From cf27ee5e34c27063541d782d6f0a8e8968bd1164 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 01:10:30 +0800
Subject: [PATCH 001/187] docs: plan v2.5.22 runtime reliability

---
 ...08-28-v2522-install-runtime-reliability.md | 255 ++++++++++++++++++
 ...2522-install-runtime-reliability-design.md | 100 +++++++
 2 files changed, 355 insertions(+)
 create mode 100644 docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md
 create mode 100644 docs/superpowers/specs/2026-08-28-v2522-install-runtime-reliability-design.md

diff --git a/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md b/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md
new file mode 100644
index 0000000..dc9fb82
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md
@@ -0,0 +1,255 @@
+# v2.5.22 Install and Runtime Reliability Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Ship v2.5.22 so a fresh or legacy upgrade can only activate the
+payload supplied by that setup, while stable Codex roots survive transient
+Electron child churn and tray action failures remain diagnosable.
+
+**Architecture:** Setup uses a versioned immutable payload directory and a
+hash manifest as the lifecycle source allowlist.  Lifecycle close/recovery
+retries only indeterminate child-tree reads while retaining the exact top-level
+root identity boundary.  Tray actions retain the authenticated protocol but
+produce a sanitized local diagnostic result and receive end-to-end coverage.
+
+**Tech Stack:** Windows PowerShell 5.1, Inno Setup, C# TrayHost, Node.js 22,
+existing PowerShell persistence self-tests.
+
+**Spec:** `docs/superpowers/specs/2026-08-28-v2522-install-runtime-reliability-design.md`
+
+## Global Constraints
+
+- Release version is exactly `2.5.22`; setup, portable ZIP, runtime manifests,
+  README, and release contracts must agree.
+- Never modify Codex binaries or `WindowsApps`; preserve the current-user DPAPI
+  device-key file.
+- A changed PID, creation time, session, user SID, package family, executable
+  path, mode, or debug-port identity is fail-closed and must not be retried as
+  success.
+- Every implementation change begins with a failing behavioral test, then the
+  smallest production change, then focused and full validation.
+- Keep the primary checkout untouched; all work occurs in this worktree.
+
+---
+
+### Task 1: Bind setup activation to an immutable payload
+
+**Files:**
+- Modify: `build/build.ps1`
+- Modify: `build/CodexControlOtherDevices.iss`
+- Modify: `Activate-CcodRemoteFix.ps1`
+- Modify: `Install-CodexControlOtherDevices.ps1`
+- Modify: `src/persistence/modules/InstallLifecycle.psm1`
+- Test: `tests/persistence/InstallLifecycle.SelfTest.ps1`
+- Test: `tests/persistence/ReleaseWorkflow.SelfTest.ps1`
+
+**Interfaces:**
+- Build writes `installer-payload.manifest.json` with ordered
+  `{schemaVersion,projectVersion,files}` records in the setup payload root.
+- `Activate-CcodRemoteFix.ps1` receives `-ExpectedVersion` and validates the
+  payload before activation and the active runtime after `Ready`.
+- `Invoke-CcodInstall` receives `-ExpectedVersion` and `-PayloadManifestPath`.
+
+- [ ] **Step 1: Write failing lifecycle tests**
+
+```powershell
+$oldPayload = New-CcodLifecycleSourceFixture -Root $source -Version '2.5.13'
+Assert-CcodThrows {
+    Invoke-CcodInstall -SourceRoot $source -InstallRoot $install `
+      -ExpectedVersion '2.5.22' -PayloadManifestPath $manifestPath -Adapters $fake.Adapters
+} 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH'
+Assert-CcodEqual $oldRuntime $pointer.activeRuntime 'old payload cannot replace the active runtime'
+```
+
+Add a second test whose matching manifest has an extra stale source file.  It
+must prove the staged runtime contains only manifest-listed records.
+
+- [ ] **Step 2: Run the focused test and confirm RED**
+
+Run: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/InstallLifecycle.SelfTest.ps1`
+
+Expected: the new test fails because `Invoke-CcodInstall` does not accept or
+enforce the expected version/manifest yet.
+
+- [ ] **Step 3: Implement the smallest payload-binding path**
+
+Generate the ordered manifest during build, copy the release payload into
+`{app}\payload\{#ProjectVersion}`, and pass that directory plus
+`-ExpectedVersion {#ProjectVersion}` to activation.  Validate each source file
+against the manifest before staging, reject an unexpected project version, and
+reread `active.json` plus the selected runtime manifest after readiness before
+writing `Ready`.
+
+- [ ] **Step 4: Run focused tests and prove GREEN**
+
+Run the lifecycle test, release workflow test, and Inno compile contract test.
+Expected: matching new/upgrade fixtures are Ready; mismatched and stale payload
+fixtures fail before active-pointer mutation.
+
+- [ ] **Step 5: Commit**
+
+```text
+fix: bind setup activation to immutable payload
+```
+
+### Task 2: Retry only transient Electron tree reads
+
+**Files:**
+- Modify: `src/persistence/modules/ProcessControl.psm1`
+- Modify: `src/persistence/modules/SessionEngine.psm1`
+- Test: `tests/persistence/ProcessControl.SelfTest.ps1`
+- Test: `tests/persistence/SessionEngine.SelfTest.ps1`
+
+**Interfaces:**
+- Add `Get-CcodStableVerifiedProcessTree` that accepts a root snapshot,
+  `StatusEvidence`, a fixed retry budget, and adapters.
+- It returns a verified tree only if every successful attempt preserves the
+  original root identity; otherwise it returns no tree.
+
+- [ ] **Step 1: Write failing process-tree tests**
+
+```powershell
+$attempt = 0
+$tree = Get-CcodStableVerifiedProcessTree -Root $root -Adapters @{
+  GetVerifiedTree = { $attempt++; if ($attempt -eq 1) { @() } else { @($root,$child) } }
+  GetProcess = { param($pid,$status) if ($pid -eq $root.Pid) { $root } else { $child } }
+  Delay = { param($milliseconds) }
+}
+Assert-CcodEqual 2 $tree.Count 'one transient empty tree is retried without relaxing root identity'
+```
+
+Add a companion test where the second root snapshot has a different creation
+time; it must return no tree and perform no close mutation.
+
+- [ ] **Step 2: Run focused tests and confirm RED**
+
+Run: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/ProcessControl.SelfTest.ps1`
+
+Expected: the new helper is unavailable and the tests fail for that missing
+behavior.
+
+- [ ] **Step 3: Implement bounded stable acquisition**
+
+Use a fixed small retry count and condition-based delay only around a failed
+tree acquisition.  On each retry reread the root and require
+`Test-CcodProcessMatch` against the original root.  Replace pre-mutation
+`GetTree` calls in close and recovery paths with this helper; leave per-member
+pre-stop/post-stop/final proofs unchanged.
+
+- [ ] **Step 4: Run focused tests and prove GREEN**
+
+Run ProcessControl and SessionEngine self-tests.  Confirm child churn retries
+successfully, root drift remains fail-closed, and ordinary close tests still
+prove every stopped member.
+
+- [ ] **Step 5: Commit**
+
+```text
+fix: stabilize verified Electron process trees
+```
+
+### Task 3: Make tray action correlation testable and diagnosable
+
+**Files:**
+- Modify: `src/persistence/modules/TrayHostClient.psm1`
+- Modify: `src/persistence/Supervisor.ps1`
+- Modify: `src/trayhost/HostTransport.cs`
+- Modify: `src/trayhost/TrayWindow.cs`
+- Test: `tests/persistence/TrayHostClient.SelfTest.ps1`
+- Test: `tests/persistence/Supervisor.SelfTest.ps1`
+- Test: `tests/trayhost/TrayHostTransportSelfTest.cs`
+
+**Interfaces:**
+- A terminal tray action record carries `command`, `revision`, `status`, and a
+  stable `CCOD_*` code to the local diagnostic log.
+- A current acknowledged presentation revision reaches its command handler;
+  an unacknowledged revision is rejected as `CCOD_TRAY_ACTION_STALE`.
+
+- [ ] **Step 1: Write failing end-to-end action tests**
+
+```powershell
+$action = [pscustomobject]@{ ActionId=[guid]::NewGuid(); Command='OpenLogs'; Revision=[UInt64]7 }
+$hostState.Tray.AcknowledgedPresentations['7'] = $enabledPresentation
+$result = Invoke-CcodSupervisorCommand $hostState $adapters $action
+Assert-CcodEqual 'Completed' $result.Status 'acknowledged revision reaches OpenLogs'
+```
+
+Add the same command with revision `8` and no ACK map entry; assert
+`Rejected` plus `CCOD_TRAY_ACTION_STALE` and one sanitized diagnostic record.
+
+- [ ] **Step 2: Run focused tests and confirm RED**
+
+Run the TrayHost client, Supervisor, and transport tests.  Expected failure:
+the diagnostic record and full correlation behavior are absent.
+
+- [ ] **Step 3: Implement only the action correlation record and tests**
+
+Record terminal action outcomes after Supervisor authorization and before the
+host collapses them into the generic dialog.  Keep the generic dialog wording
+and authenticated pipe protocol unchanged.  Do not add external control or a
+new unauthenticated command channel.
+
+- [ ] **Step 4: Run focused tests and prove GREEN**
+
+Run all three focused suites and the native TrayHost self-test.  Confirm a
+stale revision cannot perform any action and a current revision carries the
+exact terminal code into local diagnostics.
+
+- [ ] **Step 5: Commit**
+
+```text
+test: cover tray action revision correlation
+```
+
+### Task 4: Version, documentation, and release acceptance
+
+**Files:**
+- Modify: `package.json`
+- Modify: `src/trayhost/AssemblyInfo.cs`
+- Modify: `src/portable/AssemblyInfo.cs`
+- Modify: `README.md`
+- Modify: `README.zh-CN.md`
+- Modify: `CHANGELOG.md`
+- Test: `tests/persistence/ReleaseWorkflow.SelfTest.ps1`
+
+- [ ] **Step 1: Write failing version-contract assertions**
+
+Add release contract coverage requiring version `2.5.22`, the versioned setup
+payload route, and both setup/portable manifests to expose the same version.
+
+- [ ] **Step 2: Run the release contract test and confirm RED**
+
+Run: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/ReleaseWorkflow.SelfTest.ps1`
+
+Expected: it fails while the product metadata is still `2.5.21`.
+
+- [ ] **Step 3: Update metadata and concise user documentation**
+
+Set every product version to `2.5.22`.  Keep the README stable-release section
+concise; put technical repair detail in `CHANGELOG.md` and the GitHub release
+body.
+
+- [ ] **Step 4: Run focused and full validation**
+
+Run `npm.cmd test`, release contract tests, native TrayHost tests, and a clean
+release build.  Review setup and portable manifests byte-for-byte against the
+generated assets.
+
+- [ ] **Step 5: Commit**
+
+```text
+release: prepare CodexRemote-fix v2.5.22
+```
+
+## Plan self-review
+
+- Task 1 produces the immutable source/expected-version contract consumed by
+  the new setup flow and release contract.
+- Task 2 changes only pre-mutation tree acquisition and explicitly leaves all
+  identity and post-stop checks strict.
+- Task 3 has no dependency on Task 2 and can be reviewed independently; its
+  diagnostics make future live failures actionable without weakening protocol
+  authentication.
+- Task 4 consumes the completed behavior and performs no release publication;
+  publishing, installation, and reboot remain a separately authorized final
+  acceptance step.
diff --git a/docs/superpowers/specs/2026-08-28-v2522-install-runtime-reliability-design.md b/docs/superpowers/specs/2026-08-28-v2522-install-runtime-reliability-design.md
new file mode 100644
index 0000000..cfdb7bc
--- /dev/null
+++ b/docs/superpowers/specs/2026-08-28-v2522-install-runtime-reliability-design.md
@@ -0,0 +1,100 @@
+# v2.5.22 Install and Runtime Reliability Design
+
+## Goal
+
+Make a fresh installation and an upgrade from any supported historical
+CodexRemote-fix installation converge on one verified current-user runtime,
+then keep remote recovery and tray actions reliable while preserving the
+existing strict process-identity security boundary.
+
+## Evidence driving this design
+
+The reported v2.5.21 machine contained a current versioned runtime while its
+installer shell and active pointer could still describe an older payload.  The
+current Inno route treats a correlated `Ready` receipt as sufficient evidence;
+it does not bind the receipt to the setup version or verify the final active
+runtime manifest.  Separately, normal Electron child-process churn can make
+the one-pass verified-tree read fail during a close operation even though the
+top-level Codex root has not changed.  Native tray commands reach TrayHost but
+the production result path reduces every rejected or failed action to the same
+generic dialog.
+
+## Non-negotiable constraints
+
+- Remain a current-user Windows installation.  Do not modify `ChatGPT.exe`,
+  `app.asar`, `WindowsApps`, account state, or the DPAPI device-key store.
+- Retain exact PID, creation time, user SID, package family, executable path,
+  session, and debug-port checks.  A retry must never convert an identity
+  mismatch into success.
+- The setup and portable paths must reject an incomplete or stale payload
+  instead of reporting successful activation.
+- Preserve a working old runtime until the new active pointer, Supervisor, and
+  TrayHost have all been proven ready.
+- Keep end-user tray text concise; write sanitized support codes to the local
+  log rather than exposing raw implementation details in a dialog.
+
+## Architecture
+
+### 1. Immutable, version-bound installer payload
+
+The setup package installs its executable payload into
+`{app}\payload\<ProjectVersion>` and launches activation from that exact
+directory.  Build generates an `installer-payload-manifest.json` in the same
+directory with a schema version, project version, and ordered SHA-256 records
+for every file the lifecycle installer may copy.  The activation worker accepts
+the compile-time expected version, validates the versioned payload manifest and
+the local `package.json`, and passes the expected version and manifest path to
+the lifecycle installer.
+
+`InstallLifecycle` consumes the validated manifest records as its source-file
+allowlist.  It no longer discovers arbitrary leftover files under `{app}`.
+After the scheduled task signals readiness it rereads `active.json`, validates
+the selected runtime manifest, and requires that the manifest project version
+equals the expected setup version before it writes a terminal `Ready` receipt.
+This works for new users because the versioned payload directory is created
+from scratch, and for upgrades because an old app root cannot substitute its
+payload for the requested version.
+
+### 2. Bounded stable-tree acquisition
+
+Add a retry wrapper around verified Electron process-tree acquisition for
+close/recovery work.  It makes a small, bounded number of fresh snapshots with
+a short condition-based delay only when a read is indeterminate or the child
+set is transient.  Every successful attempt must independently prove the same
+top-level root identity and a self-consistent tree.  If the root PID, creation
+time, session, SID, package family, executable path, command line mode, or
+recorded debug ports change, the operation remains fail-closed immediately.
+
+The wrapper is used only before a mutation starts.  Once a close transition is
+written, the existing per-member pre-stop, post-stop, and final identity checks
+remain strict.  Diagnostics classify the last stable failure boundary so a
+future support log can distinguish tree churn from an unsafe process identity.
+
+### 3. Tray action correlation and diagnostics
+
+Keep the authenticated TrayHost protocol and revision/capability gates.  Add a
+small sanitized action-result record that includes the command, presentation
+revision, terminal status, and stable error code.  Add an end-to-end test that
+drives a native menu command through the real host transport, presentation ACK
+map, Supervisor authorization, and result ACK.  A missing acknowledged revision
+must be reported as `CCOD_TRAY_ACTION_STALE`; a current acknowledged revision
+must reach the specific handler.
+
+## Acceptance criteria
+
+1. A test simulating an old installer payload with a newer requested setup
+   version fails before changing the active pointer and returns a stable
+   activation error.
+2. A matching versioned payload activates exactly the expected runtime and the
+   final receipt is `Ready` only after pointer and manifest revalidation.
+3. Fresh and upgrade fixtures copy only manifest-listed payload files; stale
+   app-root leftovers cannot enter a new runtime.
+4. A stable root plus one transient child-tree read succeeds within the fixed
+   retry budget; a changed root identity still fails without a retry-based
+   bypass.
+5. Tray end-to-end action tests prove an acknowledged current revision succeeds
+   and a stale revision is rejected with a recorded support code.
+6. Existing persistence, package, release, native TrayHost, and Defender gates
+   remain green.  A real current-user setup install, reboot, remote connection,
+   About, language switching, open logs, and repair are all checked before
+   release completion.

From 30cf6dcde037a8719c60f85ae4c07ee17d44f4cb Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 01:29:29 +0800
Subject: [PATCH 002/187] fix: bind setup activation to immutable payload

---
 Activate-CcodRemoteFix.ps1                    |  84 +++++++++++-
 Install-CodexControlOtherDevices.ps1          |   8 +-
 build/CodexControlOtherDevices.iss            |   8 ++
 build/build.ps1                               |  23 +++-
 src/persistence/modules/InstallLifecycle.psm1 | 125 +++++++++++++++++-
 .../persistence/InstallLifecycle.SelfTest.ps1 | 107 +++++++++++++++
 .../persistence/ReleaseWorkflow.SelfTest.ps1  |  13 ++
 7 files changed, 361 insertions(+), 7 deletions(-)

diff --git a/Activate-CcodRemoteFix.ps1 b/Activate-CcodRemoteFix.ps1
index 9837167..3fa3cf5 100644
--- a/Activate-CcodRemoteFix.ps1
+++ b/Activate-CcodRemoteFix.ps1
@@ -2,6 +2,8 @@
 param(
     [Parameter(Mandatory)][string]$AppRoot,
     [Parameter(Mandatory)][string]$InstallRoot,
+    [string]$PayloadRoot,
+    [string]$ExpectedVersion,
     [string]$ActivationId,
     [switch]$ValidateReceiptOnly,
     [switch]$ValidateReceiptWithTimeout,
@@ -51,6 +53,59 @@ function Write-CcodActivationRecord {
     } catch { }
 }
 
+function Assert-CcodActivationPayload {
+    param(
+        [Parameter(Mandatory)][string]$Root,
+        [Parameter(Mandatory)][string]$Version
+    )
+
+    if ($Version -cnotmatch '^\d+\.\d+\.\d+$') { throw 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH' }
+    $payload = [IO.Path]::GetFullPath($Root)
+    $packagePath = Join-Path $payload 'package.json'
+    $manifestPath = Join-Path $payload 'installer-payload.manifest.json'
+    $modulePath = Join-Path $payload 'src\persistence\modules\InstallLifecycle.psm1'
+    if (-not [IO.File]::Exists($packagePath) -or -not [IO.File]::Exists($manifestPath) -or -not [IO.File]::Exists($modulePath)) {
+        throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID'
+    }
+    try { $package = Get-Content -LiteralPath $packagePath -Raw | ConvertFrom-Json -ErrorAction Stop }
+    catch { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+    if ($package.version -isnot [string] -or [string]$package.version -cne $Version) {
+        throw 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH'
+    }
+    $module = Import-Module $modulePath -Force -PassThru
+    try {
+        & $module {
+            param($SourceRoot,$ExpectedVersion,$ManifestPath)
+            Get-CcodLifecyclePayloadManifestFiles -SourceRoot $SourceRoot -ExpectedVersion $ExpectedVersion -PayloadManifestPath $ManifestPath | Out-Null
+        } $payload $Version $manifestPath
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+    }
+    return $manifestPath
+}
+
+function Assert-CcodActivatedRuntimeVersion {
+    param(
+        [Parameter(Mandatory)][string]$Root,
+        [Parameter(Mandatory)][string]$RuntimeId,
+        [Parameter(Mandatory)][string]$Version,
+        [Parameter(Mandatory)][string]$RuntimeModulePath
+    )
+
+    $module = Import-Module $RuntimeModulePath -Force -PassThru
+    try {
+        $pointer = Read-CcodActiveRuntime -InstallRoot $Root
+        if ($pointer.activeRuntime -cne $RuntimeId) { throw 'CCOD_ACTIVATION_RUNTIME_VERSION_MISMATCH' }
+        $runtimeRoot = Join-Path (Join-Path $Root 'runtime') $RuntimeId
+        $validation = Test-CcodRuntimeManifest -RuntimeDirectory $runtimeRoot -ExpectedRuntimeId $RuntimeId
+        if (-not $validation.Valid -or [string]$validation.Manifest.projectVersion -cne $Version) {
+            throw 'CCOD_ACTIVATION_RUNTIME_VERSION_MISMATCH'
+        }
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+    }
+}
+
 function Assert-CcodActivationReceiptPathSafe {
     param([Parameter(Mandatory)][string]$Root,[Parameter(Mandatory)][string]$Path)
     $canonicalRoot = [IO.Path]::GetFullPath($Root).TrimEnd([IO.Path]::DirectorySeparatorChar)
@@ -179,6 +234,9 @@ function Invoke-CcodOwnedInstallWorker {
             '-ActivationId',
             $ActivationId
         )
+        if (-not [string]::IsNullOrWhiteSpace($ExpectedVersion)) {
+            $arguments += @('-ExpectedVersion',$ExpectedVersion,'-PayloadManifestPath',(Join-Path $PayloadRoot 'installer-payload.manifest.json'))
+        }
         $startInfo = [Diagnostics.ProcessStartInfo]::new()
         $startInfo.FileName = $PowerShellPath
         $startInfo.Arguments = (($arguments | ForEach-Object { ConvertTo-CcodNativeProcessArgument ([string]$_) }) -join ' ')
@@ -235,12 +293,15 @@ function Invoke-CcodBoundedReceiptValidator {
             $PSCommandPath,
             '-AppRoot',
             $AppRoot,
+            '-PayloadRoot',
+            $PayloadRoot,
             '-InstallRoot',
             $InstallRoot,
             '-ValidateReceiptOnly',
             '-ActivationId',
             $ActivationId
         )
+        if (-not [string]::IsNullOrWhiteSpace($ExpectedVersion)) { $arguments += @('-ExpectedVersion',$ExpectedVersion) }
         $startInfo = [Diagnostics.ProcessStartInfo]::new()
         $startInfo.FileName = $hostExecutable
         $startInfo.Arguments = (($arguments | ForEach-Object { ConvertTo-CcodNativeProcessArgument ([string]$_) }) -join ' ')
@@ -286,6 +347,17 @@ function Show-CcodActivationFailure {
 }
 
 if ($ValidateReceiptOnly -and $ValidateReceiptWithTimeout) { Write-Error 'CCOD_ACTIVATION_VALIDATOR_MODE_INVALID' -ErrorAction Continue; exit 3 }
+if ([string]::IsNullOrWhiteSpace($PayloadRoot)) { $PayloadRoot = $AppRoot }
+$PayloadRoot = [IO.Path]::GetFullPath($PayloadRoot)
+if (-not [string]::IsNullOrWhiteSpace($ExpectedVersion)) {
+    try { $null = Assert-CcodActivationPayload -Root $PayloadRoot -Version $ExpectedVersion }
+    catch {
+        $candidate = ([string]$_.FullyQualifiedErrorId -split ',')[0]
+        $code = if ($candidate -cmatch '^CCOD_[A-Z0-9_]{1,96}$') { $candidate } elseif ($_.Exception.Message -cmatch '^CCOD_[A-Z0-9_]{1,96}$') { $Matches[0] } else { 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+        Write-Error $code -ErrorAction Continue
+        exit 3
+    }
+}
 if ([string]::IsNullOrWhiteSpace($ActivationId)) {
     if ($ValidateReceiptOnly -or $ValidateReceiptWithTimeout) { Write-Error 'CCOD_ACTIVATION_ID_INVALID' -ErrorAction Continue; exit 3 }
     $ActivationId = [guid]::NewGuid().ToString('D')
@@ -299,7 +371,12 @@ if ($ValidateReceiptWithTimeout) {
 if ($ValidateReceiptOnly) {
     try {
         $terminalReceipt = Read-CcodTerminalActivationReceipt -Root ([IO.Path]::GetFullPath($InstallRoot)) -ExpectedActivationId $ActivationId
-        if ($terminalReceipt.phase -ceq 'Ready') { exit 0 }
+        if ($terminalReceipt.phase -ceq 'Ready') {
+            if (-not [string]::IsNullOrWhiteSpace($ExpectedVersion)) {
+                Assert-CcodActivatedRuntimeVersion -Root ([IO.Path]::GetFullPath($InstallRoot)) -RuntimeId ([string]$terminalReceipt.runtimeId) -Version $ExpectedVersion -RuntimeModulePath (Join-Path $PayloadRoot 'src\persistence\modules\RuntimeManifest.psm1')
+            }
+            exit 0
+        }
         if ($terminalReceipt.phase -ceq 'Failed') { exit 2 }
         throw 'CCOD_ACTIVATION_RECEIPT_NOT_READY'
     } catch {
@@ -313,7 +390,7 @@ $clock = [Diagnostics.Stopwatch]::StartNew()
 try {
     $root = [IO.Path]::GetFullPath($AppRoot)
     $stateRoot = [IO.Path]::GetFullPath($InstallRoot)
-    $installScript = Join-Path $root 'Install-CodexControlOtherDevices.ps1'
+    $installScript = Join-Path $PayloadRoot 'Install-CodexControlOtherDevices.ps1'
     if (-not [IO.File]::Exists($installScript)) { throw 'CCOD_ACTIVATION_INSTALL_SCRIPT_MISSING' }
     $powershell = (Get-Command powershell.exe -ErrorAction Stop).Source
     Write-CcodActivationRecord -Code 'STARTED' -DurationMilliseconds $clock.ElapsedMilliseconds
@@ -328,6 +405,9 @@ try {
         throw 'CCOD_ACTIVATION_RUNTIME_FAILED'
     }
     $activationReceipt = Read-CcodFinalActivationReceipt -Root $stateRoot -ExpectedActivationId $ActivationId
+    if (-not [string]::IsNullOrWhiteSpace($ExpectedVersion)) {
+        Assert-CcodActivatedRuntimeVersion -Root $stateRoot -RuntimeId ([string]$activationReceipt.runtimeId) -Version $ExpectedVersion -RuntimeModulePath (Join-Path $PayloadRoot 'src\persistence\modules\RuntimeManifest.psm1')
+    }
     Write-CcodActivationRecord -Code 'RUNTIME_ACTIVATED' -DurationMilliseconds $clock.ElapsedMilliseconds
 } catch {
     $candidate = ([string]$_.FullyQualifiedErrorId -split ',')[0]
diff --git a/Install-CodexControlOtherDevices.ps1 b/Install-CodexControlOtherDevices.ps1
index 3b5d71f..4960ea0 100644
--- a/Install-CodexControlOtherDevices.ps1
+++ b/Install-CodexControlOtherDevices.ps1
@@ -4,7 +4,9 @@ param(
     [switch]$EnableCandidateCompatibleUpdates,
     [switch]$RepairState,
     [switch]$DoNotStart,
-    [string]$ActivationId
+    [string]$ActivationId,
+    [string]$ExpectedVersion,
+    [string]$PayloadManifestPath
 )
 
 $ErrorActionPreference = 'Stop'
@@ -37,7 +39,9 @@ $receipt = Invoke-CcodInstall `
     -EnableCandidateCompatibleUpdates:([bool]$EnableCandidateCompatibleUpdates) `
     -RepairState:([bool]$RepairState) `
     -DoNotStart:([bool]$DoNotStart) `
-    -ActivationId $ActivationId
+    -ActivationId $ActivationId `
+    -ExpectedVersion $ExpectedVersion `
+    -PayloadManifestPath $PayloadManifestPath
 
 Write-Host ''
 Write-Host 'CodexRemote-fix - install result' -ForegroundColor Cyan
diff --git a/build/CodexControlOtherDevices.iss b/build/CodexControlOtherDevices.iss
index 49445df..c8c6e29 100644
--- a/build/CodexControlOtherDevices.iss
+++ b/build/CodexControlOtherDevices.iss
@@ -5,6 +5,9 @@
 #ifndef PortableArtifactDirectory
 #define PortableArtifactDirectory SourcePath + "\generated\portable"
 #endif
+#ifndef InstallerPayloadDirectory
+#define InstallerPayloadDirectory SourcePath + "\.."
+#endif
 AppId={{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}
 AppName=CodexRemote-fix
 AppVersion={#ProjectVersion}
@@ -68,6 +71,7 @@ Source: "..\Reset-CodexControlOtherDevices.ps1"; DestDir: "{app}"; Flags: ignore
 Source: "..\Test-CodexControlOtherDevices.ps1"; DestDir: "{app}"; Flags: ignoreversion
 Source: "..\Activate-CcodRemoteFix.ps1"; DestDir: "{app}"; Flags: ignoreversion
 Source: "..\Prompt-CcodRestart.ps1"; DestDir: "{app}"; Flags: ignoreversion
+Source: "{#InstallerPayloadDirectory}\*"; DestDir: "{app}\payload\{#ProjectVersion}"; Flags: ignoreversion recursesubdirs createallsubdirs
 
 [InstallDelete]
 Type: files; Name: "{userprograms}\Codex Control other devices\Codex Control other devices for Windows.lnk"
@@ -294,6 +298,8 @@ begin
   UpdateActivationStartingPresentation();
   Parameters := '-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File "' +
     ExpandConstant('{app}\Activate-CcodRemoteFix.ps1') + '" -AppRoot "' + ExpandConstant('{app}') +
+    '" -PayloadRoot "' + ExpandConstant('{app}\payload\{#ProjectVersion}') +
+    '" -ExpectedVersion "{#ProjectVersion}' +
     '" -InstallRoot "' + ExpandConstant('{localappdata}\CodexControlOtherDevices') +
     '" -ActivationId "' + ActivationId + '" -FirstReceiptTimeoutMilliseconds ' +
     IntToStr(FIRST_ACTIVATION_RECEIPT_TIMEOUT_MILLISECONDS) + ' -ActivationTimeoutMilliseconds ' +
@@ -312,6 +318,8 @@ begin
   end;
   Parameters := '-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File "' +
     ExpandConstant('{app}\Activate-CcodRemoteFix.ps1') + '" -AppRoot "' + ExpandConstant('{app}') +
+    '" -PayloadRoot "' + ExpandConstant('{app}\payload\{#ProjectVersion}') +
+    '" -ExpectedVersion "{#ProjectVersion}' +
     '" -InstallRoot "' + ExpandConstant('{localappdata}\CodexControlOtherDevices') +
     '" -ValidateReceiptWithTimeout -ValidationTimeoutMilliseconds ' + IntToStr(VALIDATION_TIMEOUT_MILLISECONDS) +
     ' -ActivationId "' + ActivationId + '"';
diff --git a/build/build.ps1 b/build/build.ps1
index 3fc8236..af3ba71 100644
--- a/build/build.ps1
+++ b/build/build.ps1
@@ -138,6 +138,7 @@ foreach ($path in @($bundle,$checksum,$provenance,$payloadManifestAsset,$release
 }
 
 $stageRoot = Join-Path $PSScriptRoot ('.portable-stage-' + [guid]::NewGuid().ToString('N'))
+$installerPayloadDirectory = Join-Path $PSScriptRoot ('.installer-payload-stage-' + [guid]::NewGuid().ToString('N'))
 try {
     [IO.Directory]::CreateDirectory($stageRoot) | Out-Null
     $payloadRoot = Join-Path $stageRoot 'payload'
@@ -186,6 +187,16 @@ try {
         Remove-Module -Name $lifecycleModule.Name -Force -ErrorAction SilentlyContinue
     }
     $payloadRecords = Get-CcodBuildPayloadRecords -PayloadRoot $payloadRoot
+    [IO.Directory]::CreateDirectory($installerPayloadDirectory) | Out-Null
+    foreach ($record in $payloadRecords) {
+        Copy-CcodBuildPayloadFile -Source (Join-Path $payloadRoot ([string]$record.path).Replace('/','\')) -PayloadRoot $installerPayloadDirectory -Relative ([string]$record.path)
+    }
+    $installerPayloadManifest = [ordered]@{
+        schemaVersion = 1
+        projectVersion = $Version
+        files = $payloadRecords
+    }
+    Write-CcodBuildUtf8 -Path (Join-Path $installerPayloadDirectory 'installer-payload.manifest.json') -Text (($installerPayloadManifest | ConvertTo-Json -Depth 8) + [Environment]::NewLine)
     $payloadManifestPath = Join-Path $stageRoot 'payload-manifest.json'
     $payloadManifest = [ordered]@{
         schemaVersion = 1
@@ -257,7 +268,7 @@ $iscc = $isccCandidates | Where-Object { -not [string]::IsNullOrWhiteSpace($_) -
 if (-not $iscc) { throw 'Inno Setup 6 (ISCC.exe) was not found. Install it with: winget install --id JRSoftware.InnoSetup --exact' }
 $issPath = Join-Path $PSScriptRoot 'CodexControlOtherDevices.iss'
 $portableArtifact = Join-Path $PSScriptRoot 'generated\portable'
-& $iscc "/DProjectVersion=$Version" "/DTrayHostArtifactDirectory=$trayHostArtifact" "/DPortableArtifactDirectory=$portableArtifact" "/O$dist\." $issPath
+& $iscc "/DProjectVersion=$Version" "/DTrayHostArtifactDirectory=$trayHostArtifact" "/DPortableArtifactDirectory=$portableArtifact" "/DInstallerPayloadDirectory=$installerPayloadDirectory" "/O$dist\." $issPath
 if ($LASTEXITCODE -ne 0 -or -not (Test-Path -LiteralPath $setupExe -PathType Leaf)) {
     throw "Inno Setup compilation failed with exit code $LASTEXITCODE"
 }
@@ -285,3 +296,13 @@ Write-Host ("  Setup:    {0}" -f $setupExe)
 Write-Host ("  SHA-256:  {0}" -f $setupChecksum)
 Write-Host ("  Manifest: {0}" -f $setupReleaseManifest)
 Write-Host ''
+
+if ([IO.Directory]::Exists($installerPayloadDirectory)) {
+    $installerPayloadFull = [IO.Path]::GetFullPath($installerPayloadDirectory)
+    $buildFull = [IO.Path]::GetFullPath($PSScriptRoot).TrimEnd('\') + '\'
+    if ($installerPayloadFull.StartsWith($buildFull,[StringComparison]::OrdinalIgnoreCase) -and
+        [IO.Path]::GetFileName($installerPayloadFull).StartsWith('.installer-payload-stage-',[StringComparison]::Ordinal) -and
+        -not ((Get-Item -LiteralPath $installerPayloadFull -Force).Attributes -band [IO.FileAttributes]::ReparsePoint)) {
+        Remove-Item -LiteralPath $installerPayloadFull -Recurse -Force -ErrorAction SilentlyContinue
+    }
+}
diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index ffc7656..ed5c4c3 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -363,6 +363,108 @@ function Get-CcodLifecycleSourceFiles {
     return @($files)
 }
 
+function Get-CcodLifecyclePayloadManifestFiles {
+    param(
+        [Parameter(Mandatory)][string]$SourceRoot,
+        [Parameter(Mandatory)][string]$ExpectedVersion,
+        [Parameter(Mandatory)][string]$PayloadManifestPath
+    )
+
+    if ($ExpectedVersion -cnotmatch '^\d+\.\d+\.\d+$') {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_INPUT_INVALID' 'ExpectedVersion must be a canonical three-part project version' $ExpectedVersion
+    }
+    $root = Get-CcodLifecycleCanonicalRoot -Path $SourceRoot -Kind 'Source root'
+    try { $manifestPath = [IO.Path]::GetFullPath($PayloadManifestPath) }
+    catch { Throw-CcodLifecycleError 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' 'Payload manifest path could not be canonicalized' $PayloadManifestPath }
+    $prefix = $root.TrimEnd('\') + '\'
+    if (-not $manifestPath.StartsWith($prefix,[StringComparison]::OrdinalIgnoreCase) -or -not [IO.File]::Exists($manifestPath)) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' 'Payload manifest must be a file inside the source root' $manifestPath
+    }
+    $cursor = $manifestPath
+    while ($true) {
+        if (Test-CcodLifecycleReparse -Path $cursor) {
+            Throw-CcodLifecycleError 'CCOD_INSTALL_SOURCE_REPARSE' 'Payload manifest path contains a reparse point' $cursor
+        }
+        if ($cursor -ceq $root) { break }
+        $cursor = Split-Path $cursor -Parent
+        if ([string]::IsNullOrWhiteSpace($cursor)) {
+            Throw-CcodLifecycleError 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' 'Payload manifest escaped the source root' $manifestPath
+        }
+    }
+    try { $manifest = Get-Content -LiteralPath $manifestPath -Raw | ConvertFrom-Json -ErrorAction Stop }
+    catch { Throw-CcodLifecycleError 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' 'Payload manifest is not valid JSON' $manifestPath }
+    if ($manifest -isnot [pscustomobject]) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' 'Payload manifest must be one JSON object' $manifestPath
+    }
+    $properties = @($manifest.PSObject.Properties.Name)
+    $expectedProperties = @('schemaVersion','projectVersion','files')
+    if ($properties.Count -ne $expectedProperties.Count) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' 'Payload manifest fields are invalid' $manifestPath
+    }
+    for ($index = 0; $index -lt $expectedProperties.Count; $index++) {
+        if ($properties[$index] -cne $expectedProperties[$index]) {
+            Throw-CcodLifecycleError 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' 'Payload manifest fields are not canonical' $manifestPath
+        }
+    }
+    if ($manifest.schemaVersion -isnot [int] -or $manifest.schemaVersion -ne 1 -or $manifest.projectVersion -isnot [string]) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' 'Payload manifest header is invalid' $manifestPath
+    }
+    if ($manifest.projectVersion -cne $ExpectedVersion) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH' 'Payload manifest does not match the expected setup version' $manifestPath
+    }
+    $records = @($manifest.files)
+    if ($records.Count -eq 0) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' 'Payload manifest contains no source records' $manifestPath
+    }
+    $seen = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    $files = [Collections.Generic.List[object]]::new()
+    $previousPath = $null
+    foreach ($record in $records) {
+        if ($record -isnot [pscustomobject] -or
+            @($record.PSObject.Properties.Name).Count -ne 3 -or
+            @($record.PSObject.Properties.Name)[0] -cne 'path' -or
+            @($record.PSObject.Properties.Name)[1] -cne 'length' -or
+            @($record.PSObject.Properties.Name)[2] -cne 'sha256' -or
+            $record.path -isnot [string] -or $record.path -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$' -or
+            $record.path.Contains('//') -or $record.path.Contains('..') -or $record.path.Contains(':') -or $record.path.Contains('\') -or
+            $record.length -isnot [ValueType] -or [int64]$record.length -lt 0 -or
+            $record.sha256 -isnot [string] -or $record.sha256 -cnotmatch '^[0-9a-f]{64}$') {
+            Throw-CcodLifecycleError 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' 'Payload manifest file record is invalid' $manifestPath
+        }
+        if (($null -ne $previousPath -and [StringComparer]::Ordinal.Compare($previousPath,[string]$record.path) -ge 0) -or -not $seen.Add([string]$record.path)) {
+            Throw-CcodLifecycleError 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' 'Payload manifest file records are not strictly ordered and unique' $manifestPath
+        }
+        $previousPath = [string]$record.path
+        $source = [IO.Path]::GetFullPath((Join-Path $root ($record.path.Replace('/','\'))))
+        if (-not $source.StartsWith($prefix,[StringComparison]::OrdinalIgnoreCase) -or -not [IO.File]::Exists($source)) {
+            Throw-CcodLifecycleError 'CCOD_INSTALL_SOURCE_INCOMPLETE' 'A manifest-listed source file is missing' $source
+        }
+        $cursor = $source
+        while ($true) {
+            if (Test-CcodLifecycleReparse -Path $cursor) {
+                Throw-CcodLifecycleError 'CCOD_INSTALL_SOURCE_REPARSE' 'A manifest-listed source path contains a reparse point' $cursor
+            }
+            if ($cursor -ceq $root) { break }
+            $cursor = Split-Path $cursor -Parent
+        }
+        $item = Get-Item -LiteralPath $source -Force -ErrorAction Stop
+        if ($item.PSIsContainer -or (Test-CcodLifecycleAlternateDataStreams -Path $source)) {
+            Throw-CcodLifecycleError 'CCOD_INSTALL_SOURCE_INCOMPLETE' 'A manifest-listed source file is not a plain data-stream file' $source
+        }
+        if ([int64]$item.Length -ne [int64]$record.length -or
+            (Get-CcodLifecycleFileSha256 -Path $source) -cne [string]$record.sha256) {
+            Throw-CcodLifecycleError 'CCOD_INSTALL_FILE_HASH_MISMATCH' 'A manifest-listed source file failed immutable payload validation' $source
+        }
+        $files.Add([pscustomobject][ordered]@{
+            Relative = ([string]$record.path).Replace('/','\')
+            Source = $source
+            ExpectedLength = [int64]$record.length
+            ExpectedSha256 = [string]$record.sha256
+        })
+    }
+    return @($files)
+}
+
 function Copy-CcodLifecycleStaging {
     param(
         [Parameter(Mandatory)][string]$SourceRoot,
@@ -407,7 +509,7 @@ function Copy-CcodLifecycleStaging {
         }
         foreach ($file in $Files) {
             $destination = [IO.Path]::GetFullPath((Join-Path $stagingDirectory $file.Relative))
-            $expected = Get-CcodLifecycleFileSha256 -Path $file.Source
+            $expected = if ($null -ne $file.PSObject.Properties['ExpectedSha256']) { [string]$file.ExpectedSha256 } else { Get-CcodLifecycleFileSha256 -Path $file.Source }
             $actual = Get-CcodLifecycleFileSha256 -Path $destination
             if ($actual -cne $expected) {
                 Throw-CcodLifecycleError 'CCOD_INSTALL_FILE_HASH_MISMATCH' 'A staged runtime file failed its source hash comparison' $destination
@@ -1562,6 +1664,8 @@ function Invoke-CcodInstall {
         [switch]$RepairState,
         [switch]$DoNotStart,
         [string]$ActivationId,
+        [string]$ExpectedVersion,
+        [string]$PayloadManifestPath,
         [hashtable]$Adapters
     )
 
@@ -1586,6 +1690,13 @@ function Invoke-CcodInstall {
     if (-not [IO.Directory]::Exists($sourceRoot)) {
         Throw-CcodLifecycleError 'CCOD_INSTALL_SOURCE_MISSING' 'Source checkout does not exist' $sourceRoot
     }
+    $payloadBound = -not [string]::IsNullOrWhiteSpace($ExpectedVersion) -or -not [string]::IsNullOrWhiteSpace($PayloadManifestPath)
+    if ($payloadBound -and ([string]::IsNullOrWhiteSpace($ExpectedVersion) -or [string]::IsNullOrWhiteSpace($PayloadManifestPath))) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_INPUT_INVALID' 'ExpectedVersion and PayloadManifestPath must be supplied together' $null
+    }
+    $files = if ($payloadBound) {
+        @(Get-CcodLifecyclePayloadManifestFiles -SourceRoot $sourceRoot -ExpectedVersion $ExpectedVersion -PayloadManifestPath $PayloadManifestPath)
+    } else { $null }
     if (-not (& $adapters.ValidateSource $sourceRoot)) {
         Throw-CcodLifecycleError 'CCOD_INSTALL_SOURCE_INVALID' 'Source checkout failed hermetic validation' $sourceRoot
     }
@@ -1594,8 +1705,11 @@ function Invoke-CcodInstall {
         Throw-CcodLifecycleError 'CCOD_INSTALL_IDENTITY_INVALID' 'Current user identity is unavailable' $null
     }
     $projectVersion = & $adapters.GetProjectVersion $sourceRoot
+    if ($payloadBound -and [string]$projectVersion -cne $ExpectedVersion) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH' 'Source package version does not match the expected setup version' $sourceRoot
+    }
     $nodeCandidates = @(Get-CcodLifecycleNodeCandidates -Adapters $adapters)
-    $files = @(Get-CcodLifecycleSourceFiles -SourceRoot $sourceRoot -RequireTrayHost)
+    if (-not $payloadBound) { $files = @(Get-CcodLifecycleSourceFiles -SourceRoot $sourceRoot -RequireTrayHost) }
 
     $existingPointer = $null
     $activePath = Join-Path $root 'active.json'
@@ -1730,6 +1844,13 @@ function Invoke-CcodInstall {
             -not $readyProof.SupervisorReady -or -not $readyProof.TrayReady) {
             Throw-CcodLifecycleError 'CCOD_INSTALL_NEW_RUNTIME_NOT_READY' 'The new Supervisor and authenticated TrayHost readiness were not proven' $null
         }
+        $finalPointer = Read-CcodActiveRuntime -InstallRoot $root
+        $finalValidation = Test-CcodRuntimeManifest -RuntimeDirectory $runtimeRoot -ExpectedRuntimeId $runtimeId
+        $finalExpectedVersion = if ($payloadBound) { $ExpectedVersion } else { [string]$projectVersion }
+        if ($finalPointer.activeRuntime -cne $runtimeId -or [UInt64]$finalPointer.generation -ne [UInt64]$pointer.generation -or
+            -not $finalValidation.Valid -or [string]$finalValidation.Manifest.projectVersion -cne $finalExpectedVersion) {
+            Throw-CcodLifecycleError 'CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN' 'The final active pointer and runtime version could not be revalidated' $runtimeRoot
+        }
         Write-CcodInstallActivationPhase -Activation $activation -Phase 'Ready' -RuntimeId $runtimeId -PreviousRuntimeId $pointer.previousRuntime -ErrorCode $null -Adapters $adapters -InstallRoot $root | Out-Null
         if ($upgrade) {
             try { Remove-CcodLifecycleOldRuntimes -InstallRoot $root -ActiveRuntimeId $runtimeId -PreviousRuntimeId $pointer.previousRuntime }
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index d84bd9b..e8710b9 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -60,6 +60,34 @@ function New-CcodLifecycleSourceFixture {
     return $Root
 }
 
+function New-CcodLifecyclePayloadManifest {
+    param(
+        [Parameter(Mandatory)][string]$Root,
+        [Parameter(Mandatory)][string]$Version
+    )
+
+    $module = Get-Module InstallLifecycle
+    $sourceFiles = @(& $module { param($SourceRoot) Get-CcodLifecycleSourceFiles -SourceRoot $SourceRoot -RequireTrayHost } $Root)
+    $recordList = [Collections.Generic.List[object]]::new()
+    foreach ($sourceFile in $sourceFiles) {
+        $recordList.Add([pscustomobject][ordered]@{
+            path = ([string]$sourceFile.Relative).Replace('\','/')
+            length = [int64](Get-Item -LiteralPath $sourceFile.Source -Force).Length
+            sha256 = (Get-FileHash -LiteralPath $sourceFile.Source -Algorithm SHA256).Hash.ToLowerInvariant()
+        })
+    }
+    $comparison = [System.Comparison[object]]{ param($left,$right) [StringComparer]::Ordinal.Compare([string]$left.path,[string]$right.path) }
+    $recordList.Sort($comparison)
+    $records = @($recordList)
+    $manifestPath = Join-Path $Root 'installer-payload.manifest.json'
+    [IO.File]::WriteAllText(
+        $manifestPath,
+        ([ordered]@{ schemaVersion = 1; projectVersion = $Version; files = $records } | ConvertTo-Json -Depth 8),
+        [Text.UTF8Encoding]::new($false)
+    )
+    return $manifestPath
+}
+
 function New-CcodLifecycleFakeNode {
     param([Parameter(Mandatory)][string]$Root)
     New-Item -ItemType Directory -Path (Join-Path $Root 'node') -Force | Out-Null
@@ -639,6 +667,85 @@ $results += Invoke-CcodTest 'first install stages verifies activates task and pe
     }
 }
 
+# Production mutation caught: accepting an old setup payload for a newer expected setup version and stopping the active runtime before rejecting it.
+$results += Invoke-CcodTest 'upgrade rejects a payload version mismatch before active-pointer or protection mutation' {
+    $source = New-CcodLifecycleTempRoot
+    $install = New-CcodLifecycleTempRoot
+    $nodeRoot = New-CcodLifecycleTempRoot
+    try {
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.13' | Out-Null
+        $manifestPath = New-CcodLifecyclePayloadManifest -Root $source -Version '2.5.13'
+        $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
+        $first = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
+        $oldRuntime = [string]$first.RuntimeId
+        $before = Read-CcodActiveRuntime -InstallRoot $install
+        $fake = New-CcodLifecycleFake -NodePath $nodePath
+
+        Assert-CcodThrows {
+            Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -ExpectedVersion '2.5.22' -PayloadManifestPath $manifestPath -Adapters $fake.Adapters | Out-Null
+        } 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH'
+
+        $after = Read-CcodActiveRuntime -InstallRoot $install
+        Assert-CcodEqual $oldRuntime $after.activeRuntime 'old payload cannot replace the active runtime'
+        Assert-CcodEqual $before.generation $after.generation 'version mismatch cannot advance the active generation'
+        Assert-CcodEqual 0 $fake.World.ShutdownSignaled 'version mismatch cannot stop the existing protection'
+        Assert-CcodEqual 0 $fake.World.TaskInstalled 'version mismatch performs no task mutation'
+    } finally {
+        foreach ($path in @($source,$install,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
+    }
+}
+
+# Production mutation caught: rediscovering the payload directory after manifest validation and copying an unlisted leftover into the runtime.
+$results += Invoke-CcodTest 'matching payload stages only immutable manifest-listed records' {
+    $source = New-CcodLifecycleTempRoot
+    $install = New-CcodLifecycleTempRoot
+    $nodeRoot = New-CcodLifecycleTempRoot
+    try {
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22' | Out-Null
+        $manifestPath = New-CcodLifecyclePayloadManifest -Root $source -Version '2.5.22'
+        $stalePath = Join-Path $source 'src\runtime\stale-old-payload.js'
+        [IO.File]::WriteAllText($stalePath,"module.exports = 'stale';`n",[Text.UTF8Encoding]::new($false))
+        $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
+
+        $receipt = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -ExpectedVersion '2.5.22' -PayloadManifestPath $manifestPath -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
+
+        $runtimeRoot = Join-Path $install "runtime\$($receipt.RuntimeId)"
+        Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $runtimeRoot 'src\runtime\stale-old-payload.js'))) 'unlisted stale source file is absent from the runtime'
+        $runtimeManifest = Test-CcodRuntimeManifest -RuntimeDirectory $runtimeRoot -ExpectedRuntimeId $receipt.RuntimeId
+        Assert-CcodEqual $true $runtimeManifest.Valid 'manifest-filtered runtime remains valid'
+        Assert-CcodEqual 0 @($runtimeManifest.Manifest.files | Where-Object { $_.path -ceq 'src/runtime/stale-old-payload.js' }).Count 'runtime manifest contains no unlisted stale record'
+    } finally {
+        foreach ($path in @($source,$install,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
+    }
+}
+
+# Production mutation caught: trusting readiness without rereading the active pointer and selected runtime manifest before the terminal Ready receipt.
+$results += Invoke-CcodTest 'payload-bound install rereads the active pointer after readiness before reporting Ready' {
+    $source = New-CcodLifecycleTempRoot
+    $install = New-CcodLifecycleTempRoot
+    $nodeRoot = New-CcodLifecycleTempRoot
+    try {
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22' | Out-Null
+        $manifestPath = New-CcodLifecyclePayloadManifest -Root $source -Version '2.5.22'
+        $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
+        $first = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
+        $oldPointer = Read-CcodActiveRuntime -InstallRoot $install
+        $fake = New-CcodLifecycleFake -NodePath $nodePath
+        $fake.Adapters.WaitNewRuntimeReady = {
+            param($InstallRoot,$RuntimeId,$RuntimeGeneration,$Identity,$TaskStartedAtUtc,$TimeoutMilliseconds)
+            [IO.File]::WriteAllText((Join-Path $InstallRoot 'active.json'),($oldPointer | ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+            [pscustomobject][ordered]@{ SupervisorReady = $true; TrayReady = $true }
+        }.GetNewClosure()
+
+        Assert-CcodThrows {
+            Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -ExpectedVersion '2.5.22' -PayloadManifestPath $manifestPath -Adapters $fake.Adapters | Out-Null
+        } 'CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN'
+        Assert-CcodTrue ($fake.World.Phases -notcontains 'Ready') 'pointer drift after readiness cannot produce a Ready receipt'
+    } finally {
+        foreach ($path in @($source,$install,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
+    }
+}
+
 # Production mutation caught: routing the activation progress receipt through the generic pretty-printed JSON writer.
 $results += Invoke-CcodTest 'activation progress receipt uses one compact JSON line for PowerShell 5.1 and Inno' {
     $install = New-CcodLifecycleTempRoot
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 2fc3b87..e8b881a 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -80,6 +80,19 @@ Invoke-CcodTest 'release defender tool exposes manifest and scan functions witho
     Assert-CcodTrue ($null -ne (Get-Command Invoke-CcodReleaseDefenderCheck -ErrorAction SilentlyContinue)) 'Defender invocation is available'
 }
 
+Invoke-CcodTest 'setup build and activation bind one immutable versioned payload end to end' {
+    $build = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\build.ps1') -Raw -Encoding UTF8
+    $inno = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw -Encoding UTF8
+    $activation = Get-Content -LiteralPath (Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1') -Raw -Encoding UTF8
+    $installer = Get-Content -LiteralPath (Join-Path $repositoryRoot 'Install-CodexControlOtherDevices.ps1') -Raw -Encoding UTF8
+
+    Assert-CcodTrue ($build -cmatch 'installer-payload\.manifest\.json' -and $build -cmatch 'schemaVersion\s*=\s*1\s+projectVersion\s*=\s*\$Version\s+files\s*=\s*\$payloadRecords') 'build emits the canonical ordered setup payload manifest'
+    Assert-CcodTrue ($inno -cmatch 'InstallerPayloadDirectory' -and $inno -cmatch 'DestDir:\s*"\{app\}\\payload\\\{#ProjectVersion\}"') 'Inno copies the immutable build payload into its exact version directory'
+    Assert-CcodTrue ($inno -cmatch "ExpandConstant\('\{app\}\\payload\\\{#ProjectVersion\}'\)" -and $inno -cmatch '-ExpectedVersion\s+"\{#ProjectVersion\}') 'Inno binds activation to its compiled payload version'
+    Assert-CcodTrue ($activation -cmatch '\[string\]\$ExpectedVersion' -and $activation -cmatch 'installer-payload\.manifest\.json') 'activation accepts and resolves the expected payload contract'
+    Assert-CcodTrue ($installer -cmatch '\[string\]\$ExpectedVersion' -and $installer -cmatch '\[string\]\$PayloadManifestPath' -and $installer -cmatch '-ExpectedVersion\s+\$ExpectedVersion' -and $installer -cmatch '-PayloadManifestPath\s+\$PayloadManifestPath') 'installer forwards the immutable payload contract to lifecycle activation'
+}
+
 Invoke-CcodTest 'release manifest binds the final asset names hashes version commit and timestamp' {
     . $defenderPath -Library
     $fixture = New-CcodReleaseFixture

From aec0eeb06b55ada520a517b76f3928363df532cf Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 02:06:21 +0800
Subject: [PATCH 003/187] fix: harden immutable setup payload verification

---
 Activate-CcodRemoteFix.ps1                    | 123 +++++++-
 build/CodexControlOtherDevices.iss            |  32 +-
 build/build.ps1                               |  19 +-
 src/persistence/modules/InstallLifecycle.psm1 |  79 ++++-
 .../persistence/InstallLifecycle.SelfTest.ps1 | 135 +++++++++
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 277 +++++++++++++++++-
 tools/New-InstallerPayloadManifest.ps1        |  54 ++++
 7 files changed, 683 insertions(+), 36 deletions(-)
 create mode 100644 tools/New-InstallerPayloadManifest.ps1

diff --git a/Activate-CcodRemoteFix.ps1 b/Activate-CcodRemoteFix.ps1
index 3fa3cf5..bebd91a 100644
--- a/Activate-CcodRemoteFix.ps1
+++ b/Activate-CcodRemoteFix.ps1
@@ -4,6 +4,7 @@ param(
     [Parameter(Mandatory)][string]$InstallRoot,
     [string]$PayloadRoot,
     [string]$ExpectedVersion,
+    [string]$ExpectedPayloadManifestSha256,
     [string]$ActivationId,
     [switch]$ValidateReceiptOnly,
     [switch]$ValidateReceiptWithTimeout,
@@ -53,34 +54,126 @@ function Write-CcodActivationRecord {
     } catch { }
 }
 
+function Get-CcodActivationFileSha256 {
+    param([Parameter(Mandatory)][string]$Path)
+    $sha = [Security.Cryptography.SHA256]::Create()
+    $stream = $null
+    try {
+        $stream = [IO.File]::Open([IO.Path]::GetFullPath($Path),[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read)
+        return [BitConverter]::ToString($sha.ComputeHash($stream)).Replace('-','').ToLowerInvariant()
+    } finally {
+        if ($null -ne $stream) { $stream.Dispose() }
+        $sha.Dispose()
+    }
+}
+
+function Assert-CcodActivationNonReparsePath {
+    param([Parameter(Mandatory)][string]$Root,[Parameter(Mandatory)][string]$Path)
+    $canonicalRoot = [IO.Path]::GetFullPath($Root).TrimEnd('\')
+    $canonicalPath = [IO.Path]::GetFullPath($Path)
+    $prefix = $canonicalRoot + '\'
+    if (-not ($canonicalPath.Equals($canonicalRoot,[StringComparison]::OrdinalIgnoreCase) -or $canonicalPath.StartsWith($prefix,[StringComparison]::OrdinalIgnoreCase))) {
+        throw 'CCOD_INSTALL_PAYLOAD_PATH_INVALID'
+    }
+    $cursor = $canonicalPath
+    while ($true) {
+        $item = Get-Item -LiteralPath $cursor -Force -ErrorAction Stop
+        if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'CCOD_INSTALL_SOURCE_REPARSE' }
+        if ($cursor.Equals($canonicalRoot,[StringComparison]::OrdinalIgnoreCase)) { break }
+        $parent = Split-Path $cursor -Parent
+        if ([string]::IsNullOrWhiteSpace($parent) -or $parent -ceq $cursor) { throw 'CCOD_INSTALL_PAYLOAD_PATH_INVALID' }
+        $cursor = $parent
+    }
+    return $canonicalPath
+}
+
+function Test-CcodActivationAlternateDataStreams {
+    param([Parameter(Mandatory)][string]$Path)
+    try {
+        foreach ($stream in @(Get-Item -LiteralPath $Path -Stream * -ErrorAction Stop)) {
+            if ([string]$stream.Stream -cnotin @(':$DATA','::$DATA','$DATA')) { return $true }
+        }
+        return $false
+    } catch {
+        throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID'
+    }
+}
+
 function Assert-CcodActivationPayload {
     param(
+        [Parameter(Mandatory)][string]$AppRoot,
         [Parameter(Mandatory)][string]$Root,
-        [Parameter(Mandatory)][string]$Version
+        [Parameter(Mandatory)][string]$Version,
+        [Parameter(Mandatory)][string]$ExpectedManifestSha256
     )
 
-    if ($Version -cnotmatch '^\d+\.\d+\.\d+$') { throw 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH' }
-    $payload = [IO.Path]::GetFullPath($Root)
+    if ($Version -cnotmatch '^\d+\.\d+\.\d+$' -or $ExpectedManifestSha256 -cnotmatch '^[0-9a-f]{64}$') { throw 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH' }
+    $app = [IO.Path]::GetFullPath($AppRoot).TrimEnd('\')
+    $payload = [IO.Path]::GetFullPath($Root).TrimEnd('\')
+    $expectedPayload = [IO.Path]::GetFullPath((Join-Path (Join-Path $app 'payload') $Version)).TrimEnd('\')
+    if (-not $payload.Equals($expectedPayload,[StringComparison]::OrdinalIgnoreCase)) { throw 'CCOD_INSTALL_PAYLOAD_PATH_INVALID' }
+    [void](Assert-CcodActivationNonReparsePath -Root $app -Path $app)
+    [void](Assert-CcodActivationNonReparsePath -Root $app -Path (Join-Path $app 'payload'))
+    [void](Assert-CcodActivationNonReparsePath -Root $app -Path $payload)
     $packagePath = Join-Path $payload 'package.json'
     $manifestPath = Join-Path $payload 'installer-payload.manifest.json'
     $modulePath = Join-Path $payload 'src\persistence\modules\InstallLifecycle.psm1'
     if (-not [IO.File]::Exists($packagePath) -or -not [IO.File]::Exists($manifestPath) -or -not [IO.File]::Exists($modulePath)) {
         throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID'
     }
-    try { $package = Get-Content -LiteralPath $packagePath -Raw | ConvertFrom-Json -ErrorAction Stop }
+    [void](Assert-CcodActivationNonReparsePath -Root $payload -Path $manifestPath)
+    $manifestItem = Get-Item -LiteralPath $manifestPath -Force -ErrorAction Stop
+    if ($manifestItem.PSIsContainer -or $manifestItem.Length -le 0 -or $manifestItem.Length -gt 4194304 -or
+        (Test-CcodActivationAlternateDataStreams -Path $manifestPath) -or
+        (Get-CcodActivationFileSha256 -Path $manifestPath) -cne $ExpectedManifestSha256) {
+        throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID'
+    }
+    try {
+        $manifest = [IO.File]::ReadAllText($manifestPath,[Text.Encoding]::UTF8) | ConvertFrom-Json -ErrorAction Stop
+    } catch { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+    $properties = @($manifest.PSObject.Properties.Name)
+    $expectedProperties = @('schemaVersion','projectVersion','files')
+    if ($manifest -isnot [pscustomobject] -or $properties.Count -ne $expectedProperties.Count) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+    for ($index=0;$index-lt$expectedProperties.Count;$index++) {
+        if ($properties[$index] -cne $expectedProperties[$index]) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+    }
+    if ($manifest.schemaVersion -isnot [int] -or $manifest.schemaVersion -ne 1 -or $manifest.projectVersion -isnot [string] -or $manifest.projectVersion -cne $Version) {
+        throw 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH'
+    }
+    $records = @($manifest.files)
+    if ($records.Count -eq 0) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+    $seen = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    $previous = $null
+    foreach ($record in $records) {
+        $recordProperties = @($record.PSObject.Properties.Name)
+        if ($record -isnot [pscustomobject] -or $recordProperties.Count -ne 3 -or $recordProperties[0] -cne 'path' -or $recordProperties[1] -cne 'length' -or $recordProperties[2] -cne 'sha256' -or
+            $record.path -isnot [string] -or $record.path -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$' -or $record.path.Contains('//') -or $record.path.Contains('..') -or $record.path.Contains(':') -or $record.path.Contains('\') -or
+            $record.length -isnot [ValueType] -or [decimal]$record.length -ne [decimal][int64]$record.length -or [int64]$record.length -lt 0 -or
+            $record.sha256 -isnot [string] -or $record.sha256 -cnotmatch '^[0-9a-f]{64}$') { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+        if (($null-ne$previous -and [StringComparer]::Ordinal.Compare([string]$previous,[string]$record.path)-ge 0) -or -not $seen.Add([string]$record.path)) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+        $previous = [string]$record.path
+        $source = [IO.Path]::GetFullPath((Join-Path $payload ($record.path.Replace('/','\'))))
+        [void](Assert-CcodActivationNonReparsePath -Root $payload -Path $source)
+        $item = Get-Item -LiteralPath $source -Force -ErrorAction Stop
+        if ($item.PSIsContainer -or (Test-CcodActivationAlternateDataStreams -Path $source) -or [int64]$item.Length -ne [int64]$record.length -or
+            (Get-CcodActivationFileSha256 -Path $source) -cne [string]$record.sha256) { throw 'CCOD_INSTALL_FILE_HASH_MISMATCH' }
+    }
+    $actualFileList = [Collections.Generic.List[string]]::new()
+    foreach ($actualItem in @(Get-ChildItem -LiteralPath $payload -Force -Recurse -ErrorAction Stop)) {
+        if (($actualItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'CCOD_INSTALL_SOURCE_REPARSE' }
+        if ($actualItem.PSIsContainer -or $actualItem.FullName.Equals($manifestPath,[StringComparison]::OrdinalIgnoreCase)) { continue }
+        $actualFileList.Add($actualItem.FullName.Substring($payload.Length + 1).Replace('\','/'))
+    }
+    $actualFiles = @($actualFileList)
+    if ($actualFiles.Count -ne $records.Count) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+    foreach ($actual in $actualFiles) {
+        if (-not $seen.Contains([string]$actual)) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+    }
+    try { $package = [IO.File]::ReadAllText($packagePath,[Text.Encoding]::UTF8) | ConvertFrom-Json -ErrorAction Stop }
     catch { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
     if ($package.version -isnot [string] -or [string]$package.version -cne $Version) {
         throw 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH'
     }
-    $module = Import-Module $modulePath -Force -PassThru
-    try {
-        & $module {
-            param($SourceRoot,$ExpectedVersion,$ManifestPath)
-            Get-CcodLifecyclePayloadManifestFiles -SourceRoot $SourceRoot -ExpectedVersion $ExpectedVersion -PayloadManifestPath $ManifestPath | Out-Null
-        } $payload $Version $manifestPath
-    } finally {
-        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
-    }
     return $manifestPath
 }
 
@@ -301,7 +394,7 @@ function Invoke-CcodBoundedReceiptValidator {
             '-ActivationId',
             $ActivationId
         )
-        if (-not [string]::IsNullOrWhiteSpace($ExpectedVersion)) { $arguments += @('-ExpectedVersion',$ExpectedVersion) }
+        if (-not [string]::IsNullOrWhiteSpace($ExpectedVersion)) { $arguments += @('-ExpectedVersion',$ExpectedVersion,'-ExpectedPayloadManifestSha256',$ExpectedPayloadManifestSha256) }
         $startInfo = [Diagnostics.ProcessStartInfo]::new()
         $startInfo.FileName = $hostExecutable
         $startInfo.Arguments = (($arguments | ForEach-Object { ConvertTo-CcodNativeProcessArgument ([string]$_) }) -join ' ')
@@ -350,7 +443,7 @@ if ($ValidateReceiptOnly -and $ValidateReceiptWithTimeout) { Write-Error 'CCOD_A
 if ([string]::IsNullOrWhiteSpace($PayloadRoot)) { $PayloadRoot = $AppRoot }
 $PayloadRoot = [IO.Path]::GetFullPath($PayloadRoot)
 if (-not [string]::IsNullOrWhiteSpace($ExpectedVersion)) {
-    try { $null = Assert-CcodActivationPayload -Root $PayloadRoot -Version $ExpectedVersion }
+    try { $null = Assert-CcodActivationPayload -AppRoot $AppRoot -Root $PayloadRoot -Version $ExpectedVersion -ExpectedManifestSha256 $ExpectedPayloadManifestSha256 }
     catch {
         $candidate = ([string]$_.FullyQualifiedErrorId -split ',')[0]
         $code = if ($candidate -cmatch '^CCOD_[A-Z0-9_]{1,96}$') { $candidate } elseif ($_.Exception.Message -cmatch '^CCOD_[A-Z0-9_]{1,96}$') { $Matches[0] } else { 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
diff --git a/build/CodexControlOtherDevices.iss b/build/CodexControlOtherDevices.iss
index c8c6e29..1a0eade 100644
--- a/build/CodexControlOtherDevices.iss
+++ b/build/CodexControlOtherDevices.iss
@@ -6,7 +6,10 @@
 #define PortableArtifactDirectory SourcePath + "\generated\portable"
 #endif
 #ifndef InstallerPayloadDirectory
-#define InstallerPayloadDirectory SourcePath + "\.."
+#error InstallerPayloadDirectory must be supplied by the release builder
+#endif
+#ifndef InstallerPayloadManifestSha256
+#error InstallerPayloadManifestSha256 must be supplied by the release builder
 #endif
 AppId={{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}
 AppName=CodexRemote-fix
@@ -71,6 +74,7 @@ Source: "..\Reset-CodexControlOtherDevices.ps1"; DestDir: "{app}"; Flags: ignore
 Source: "..\Test-CodexControlOtherDevices.ps1"; DestDir: "{app}"; Flags: ignoreversion
 Source: "..\Activate-CcodRemoteFix.ps1"; DestDir: "{app}"; Flags: ignoreversion
 Source: "..\Prompt-CcodRestart.ps1"; DestDir: "{app}"; Flags: ignoreversion
+Source: "..\tools\New-InstallerPayloadManifest.ps1"; DestDir: "{app}\tools"; Flags: ignoreversion
 Source: "{#InstallerPayloadDirectory}\*"; DestDir: "{app}\payload\{#ProjectVersion}"; Flags: ignoreversion recursesubdirs createallsubdirs
 
 [InstallDelete]
@@ -115,6 +119,30 @@ function StringFromGUID2(var Guid: TGUID; GuidString: String; MaxCharacters: Int
 function GetFileAttributesW(const FileName: String): Cardinal;
   external 'GetFileAttributesW@kernel32.dll stdcall';
 
+function IsSafeExistingPayloadDirectory(const DirectoryName: String): Boolean;
+var
+  Attributes: Cardinal;
+begin
+  Attributes := GetFileAttributesW(DirectoryName);
+  Result := (Attributes = CCOD_INVALID_FILE_ATTRIBUTES) or
+    (((Attributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) <> 0) and
+     ((Attributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) = 0));
+end;
+
+function PrepareToInstall(var NeedsRestart: Boolean): String;
+var
+  AppDirectory, PayloadDirectory, VersionDirectory: String;
+begin
+  Result := '';
+  AppDirectory := ExpandConstant('{app}');
+  PayloadDirectory := ExpandConstant('{app}\payload');
+  VersionDirectory := ExpandConstant('{app}\payload\{#ProjectVersion}');
+  if not IsSafeExistingPayloadDirectory(AppDirectory) or
+     not IsSafeExistingPayloadDirectory(PayloadDirectory) or
+     not IsSafeExistingPayloadDirectory(VersionDirectory) then
+    Result := 'CodexRemote-fix refused an unsafe existing payload directory.';
+end;
+
 function NewActivationId(): String;
 var
   Guid: TGUID;
@@ -300,6 +328,7 @@ begin
     ExpandConstant('{app}\Activate-CcodRemoteFix.ps1') + '" -AppRoot "' + ExpandConstant('{app}') +
     '" -PayloadRoot "' + ExpandConstant('{app}\payload\{#ProjectVersion}') +
     '" -ExpectedVersion "{#ProjectVersion}' +
+    '" -ExpectedPayloadManifestSha256 "{#InstallerPayloadManifestSha256}' +
     '" -InstallRoot "' + ExpandConstant('{localappdata}\CodexControlOtherDevices') +
     '" -ActivationId "' + ActivationId + '" -FirstReceiptTimeoutMilliseconds ' +
     IntToStr(FIRST_ACTIVATION_RECEIPT_TIMEOUT_MILLISECONDS) + ' -ActivationTimeoutMilliseconds ' +
@@ -320,6 +349,7 @@ begin
     ExpandConstant('{app}\Activate-CcodRemoteFix.ps1') + '" -AppRoot "' + ExpandConstant('{app}') +
     '" -PayloadRoot "' + ExpandConstant('{app}\payload\{#ProjectVersion}') +
     '" -ExpectedVersion "{#ProjectVersion}' +
+    '" -ExpectedPayloadManifestSha256 "{#InstallerPayloadManifestSha256}' +
     '" -InstallRoot "' + ExpandConstant('{localappdata}\CodexControlOtherDevices') +
     '" -ValidateReceiptWithTimeout -ValidationTimeoutMilliseconds ' + IntToStr(VALIDATION_TIMEOUT_MILLISECONDS) +
     ' -ActivationId "' + ActivationId + '"';
diff --git a/build/build.ps1 b/build/build.ps1
index af3ba71..27b0b29 100644
--- a/build/build.ps1
+++ b/build/build.ps1
@@ -191,12 +191,19 @@ try {
     foreach ($record in $payloadRecords) {
         Copy-CcodBuildPayloadFile -Source (Join-Path $payloadRoot ([string]$record.path).Replace('/','\')) -PayloadRoot $installerPayloadDirectory -Relative ([string]$record.path)
     }
-    $installerPayloadManifest = [ordered]@{
-        schemaVersion = 1
-        projectVersion = $Version
-        files = $payloadRecords
+    $installerPayloadManifestPath = Join-Path $installerPayloadDirectory 'installer-payload.manifest.json'
+    $installerPayloadGenerator = Join-Path $repoRoot 'tools\New-InstallerPayloadManifest.ps1'
+    if (-not [IO.File]::Exists($installerPayloadGenerator)) { throw "Installer payload manifest generator is missing: $installerPayloadGenerator" }
+    $installerPayloadManifest = & $installerPayloadGenerator -PayloadRoot $installerPayloadDirectory -ProjectVersion $Version -OutputPath $installerPayloadManifestPath
+    if (@($installerPayloadManifest.files).Count -ne $payloadRecords.Count) { throw 'Installer payload generator record count differs from the verified portable payload.' }
+    for ($recordIndex = 0; $recordIndex -lt $payloadRecords.Count; $recordIndex++) {
+        if ([string]$installerPayloadManifest.files[$recordIndex].path -cne [string]$payloadRecords[$recordIndex].path -or
+            [int64]$installerPayloadManifest.files[$recordIndex].length -ne [int64]$payloadRecords[$recordIndex].length -or
+            [string]$installerPayloadManifest.files[$recordIndex].sha256 -cne [string]$payloadRecords[$recordIndex].sha256) {
+            throw 'Installer payload generator records differ from the verified portable payload.'
+        }
     }
-    Write-CcodBuildUtf8 -Path (Join-Path $installerPayloadDirectory 'installer-payload.manifest.json') -Text (($installerPayloadManifest | ConvertTo-Json -Depth 8) + [Environment]::NewLine)
+    $installerPayloadManifestSha256 = Get-CcodBuildFileSha256 -Path $installerPayloadManifestPath
     $payloadManifestPath = Join-Path $stageRoot 'payload-manifest.json'
     $payloadManifest = [ordered]@{
         schemaVersion = 1
@@ -268,7 +275,7 @@ $iscc = $isccCandidates | Where-Object { -not [string]::IsNullOrWhiteSpace($_) -
 if (-not $iscc) { throw 'Inno Setup 6 (ISCC.exe) was not found. Install it with: winget install --id JRSoftware.InnoSetup --exact' }
 $issPath = Join-Path $PSScriptRoot 'CodexControlOtherDevices.iss'
 $portableArtifact = Join-Path $PSScriptRoot 'generated\portable'
-& $iscc "/DProjectVersion=$Version" "/DTrayHostArtifactDirectory=$trayHostArtifact" "/DPortableArtifactDirectory=$portableArtifact" "/DInstallerPayloadDirectory=$installerPayloadDirectory" "/O$dist\." $issPath
+& $iscc "/DProjectVersion=$Version" "/DTrayHostArtifactDirectory=$trayHostArtifact" "/DPortableArtifactDirectory=$portableArtifact" "/DInstallerPayloadDirectory=$installerPayloadDirectory" "/DInstallerPayloadManifestSha256=$installerPayloadManifestSha256" "/O$dist\." $issPath
 if ($LASTEXITCODE -ne 0 -or -not (Test-Path -LiteralPath $setupExe -PathType Leaf)) {
     throw "Inno Setup compilation failed with exit code $LASTEXITCODE"
 }
diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index ed5c4c3..ecbf18e 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -142,6 +142,38 @@ function Get-CcodLifecycleCanonicalRoot {
     return $root.TrimEnd('\')
 }
 
+function Assert-CcodLifecycleInstallPathSafe {
+    param(
+        [Parameter(Mandatory)][string]$InstallRoot,
+        [Parameter(Mandatory)][string]$Path
+    )
+
+    $root = Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
+    $candidate = [IO.Path]::GetFullPath($Path)
+    $prefix = $root.TrimEnd('\') + '\'
+    if (-not ($candidate.Equals($root,[StringComparison]::OrdinalIgnoreCase) -or $candidate.StartsWith($prefix,[StringComparison]::OrdinalIgnoreCase))) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_PATH_OUTSIDE_ROOT' 'Install path escaped the install root' $candidate
+    }
+    $cursor = $candidate
+    while (-not (Test-Path -LiteralPath $cursor)) {
+        $parent = Split-Path $cursor -Parent
+        if ([string]::IsNullOrWhiteSpace($parent) -or $parent -ceq $cursor) {
+            Throw-CcodLifecycleError 'CCOD_INSTALL_REPARSE_PATH' 'Install path has no safe existing ancestor' $candidate
+        }
+        $cursor = $parent
+    }
+    while ($true) {
+        $item = Get-Item -LiteralPath $cursor -Force -ErrorAction Stop
+        if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) {
+            Throw-CcodLifecycleError 'CCOD_INSTALL_REPARSE_PATH' 'Install path contains a reparse point' $cursor
+        }
+        $parent = Split-Path $cursor -Parent
+        if ([string]::IsNullOrWhiteSpace($parent) -or $parent -ceq $cursor) { break }
+        $cursor = $parent
+    }
+    return $candidate
+}
+
 function Test-CcodLifecycleReparse {
     param([Parameter(Mandatory)][string]$Path)
     if (-not (Test-Path -LiteralPath $Path)) { return $false }
@@ -385,7 +417,7 @@ function Get-CcodLifecyclePayloadManifestFiles {
         if (Test-CcodLifecycleReparse -Path $cursor) {
             Throw-CcodLifecycleError 'CCOD_INSTALL_SOURCE_REPARSE' 'Payload manifest path contains a reparse point' $cursor
         }
-        if ($cursor -ceq $root) { break }
+        if ($cursor.Equals($root,[StringComparison]::OrdinalIgnoreCase)) { break }
         $cursor = Split-Path $cursor -Parent
         if ([string]::IsNullOrWhiteSpace($cursor)) {
             Throw-CcodLifecycleError 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' 'Payload manifest escaped the source root' $manifestPath
@@ -444,7 +476,7 @@ function Get-CcodLifecyclePayloadManifestFiles {
             if (Test-CcodLifecycleReparse -Path $cursor) {
                 Throw-CcodLifecycleError 'CCOD_INSTALL_SOURCE_REPARSE' 'A manifest-listed source path contains a reparse point' $cursor
             }
-            if ($cursor -ceq $root) { break }
+            if ($cursor.Equals($root,[StringComparison]::OrdinalIgnoreCase)) { break }
             $cursor = Split-Path $cursor -Parent
         }
         $item = Get-Item -LiteralPath $source -Force -ErrorAction Stop
@@ -473,10 +505,14 @@ function Copy-CcodLifecycleStaging {
         [Parameter(Mandatory)][object[]]$Files
     )
 
+    [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $InstallRoot)
     $stagingRoot = [IO.Path]::GetFullPath((Join-Path $InstallRoot '.staging'))
+    [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $stagingRoot)
     [IO.Directory]::CreateDirectory($stagingRoot) | Out-Null
+    [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $stagingRoot)
     $stagingDirectory = Join-Path $stagingRoot ([guid]::NewGuid().ToString('N'))
     [IO.Directory]::CreateDirectory($stagingDirectory) | Out-Null
+    [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $stagingDirectory)
     $bootstrapPath = Join-Path $InstallRoot 'bootstrap.ps1'
     $uninstallerPath = Join-Path $InstallRoot 'Uninstall-CodexControlOtherDevices.ps1'
     $bootstrapExistedBefore = [IO.File]::Exists($bootstrapPath)
@@ -505,7 +541,9 @@ function Copy-CcodLifecycleStaging {
             if (-not $destination.StartsWith($prefix, [StringComparison]::OrdinalIgnoreCase)) {
                 Throw-CcodLifecycleError 'CCOD_INSTALL_STAGING_PATH_INVALID' 'Staging path escaped the staging root' $destination
             }
+            [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $destination)
             & $Adapters.CopyFile $file.Source $destination
+            [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $destination)
         }
         foreach ($file in $Files) {
             $destination = [IO.Path]::GetFullPath((Join-Path $stagingDirectory $file.Relative))
@@ -515,21 +553,29 @@ function Copy-CcodLifecycleStaging {
                 Throw-CcodLifecycleError 'CCOD_INSTALL_FILE_HASH_MISMATCH' 'A staged runtime file failed its source hash comparison' $destination
             }
         }
-        $bootstrapSource = [IO.Path]::GetFullPath((Join-Path (Split-Path $PSScriptRoot -Parent) 'bootstrap.ps1'))
+        $bootstrapSource = [IO.Path]::GetFullPath((Join-Path $stagingDirectory 'src\persistence\bootstrap.ps1'))
         if (-not [IO.File]::Exists($bootstrapSource)) {
-            Throw-CcodLifecycleError 'CCOD_INSTALL_SOURCE_INCOMPLETE' 'The bootstrap script is missing from the persistence source' $bootstrapSource
+            Throw-CcodLifecycleError 'CCOD_INSTALL_SOURCE_INCOMPLETE' 'The verified staging bootstrap script is missing' $bootstrapSource
         }
         & $Adapters.CopyFile $bootstrapSource $bootstrapPath
+        [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $bootstrapPath)
+        if ((Get-CcodLifecycleFileSha256 -Path $bootstrapPath) -cne (Get-CcodLifecycleFileSha256 -Path $bootstrapSource)) {
+            Throw-CcodLifecycleError 'CCOD_INSTALL_FILE_HASH_MISMATCH' 'The stable bootstrap copy differs from verified staging bytes' $bootstrapPath
+        }
         $copiedStableBootstrap = $true
-        $uninstallerSource = Join-Path $SourceRoot 'Uninstall-CodexControlOtherDevices.ps1'
+        $uninstallerSource = Join-Path $stagingDirectory 'Uninstall-CodexControlOtherDevices.ps1'
         if ([IO.File]::Exists($uninstallerSource)) {
             & $Adapters.CopyFile $uninstallerSource $uninstallerPath
+            [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $uninstallerPath)
+            if ((Get-CcodLifecycleFileSha256 -Path $uninstallerPath) -cne (Get-CcodLifecycleFileSha256 -Path $uninstallerSource)) {
+                Throw-CcodLifecycleError 'CCOD_INSTALL_FILE_HASH_MISMATCH' 'The stable uninstaller copy differs from verified staging bytes' $uninstallerPath
+            }
             $copiedStableUninstaller = $true
         }
         return $stagingDirectory
     } catch {
         if ([IO.Directory]::Exists($stagingDirectory)) {
-            try { Remove-Item -LiteralPath $stagingDirectory -Recurse -Force -ErrorAction Stop } catch { }
+            try { [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $stagingDirectory); Remove-Item -LiteralPath $stagingDirectory -Recurse -Force -ErrorAction Stop } catch { }
         }
         if ($copiedStableBootstrap -and -not $bootstrapExistedBefore -and [IO.File]::Exists($bootstrapPath)) {
             try { Remove-Item -LiteralPath $bootstrapPath -Force -ErrorAction Stop } catch { }
@@ -1613,8 +1659,10 @@ function Remove-CcodLifecycleOldRuntimes {
 
     $runtimeRoot = Join-Path $InstallRoot 'runtime'
     if (-not [IO.Directory]::Exists($runtimeRoot)) { return }
+    [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $runtimeRoot)
     foreach ($directory in Get-ChildItem -LiteralPath $runtimeRoot -Directory -Force -ErrorAction Stop) {
         if ($directory.Name -ceq $ActiveRuntimeId -or $directory.Name -ceq $PreviousRuntimeId) { continue }
+        [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $directory.FullName)
         [void](Test-CcodLifecycleRemovePath -Root $InstallRoot -Path $directory.FullName)
         Remove-Item -LiteralPath $directory.FullName -Recurse -Force -ErrorAction Stop
     }
@@ -1673,6 +1721,7 @@ function Invoke-CcodInstall {
     if ([string]::IsNullOrWhiteSpace($InstallRoot)) { $InstallRoot = $script:CcodLifecycleDefaultInstallRoot }
     $root = Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
     $sourceRoot = Get-CcodLifecycleCanonicalRoot -Path $SourceRoot -Kind 'Source root'
+    [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $root)
 
     if ($RepairState) {
         return Invoke-CcodRepairState -InstallRoot $root -Adapters $adapters
@@ -1782,18 +1831,24 @@ function Invoke-CcodInstall {
         if (-not $validation.Valid) {
             Throw-CcodLifecycleError 'CCOD_INSTALL_MANIFEST_INVALID' ("Staged runtime failed manifest validation: {0}" -f $validation.Code) $stagingDirectory
         }
-        $runtimeRoot = [IO.Path]::GetFullPath((Join-Path (Join-Path $root 'runtime') $runtimeId))
+        $runtimeContainer = [IO.Path]::GetFullPath((Join-Path $root 'runtime'))
+        [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $runtimeContainer)
+        $runtimeRoot = [IO.Path]::GetFullPath((Join-Path $runtimeContainer $runtimeId))
+        [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $runtimeRoot)
         if ([IO.Directory]::Exists($runtimeRoot)) {
             $existingValidation = Test-CcodRuntimeManifest -RuntimeDirectory $runtimeRoot -ExpectedRuntimeId $runtimeId
             if (-not $existingValidation.Valid) {
                 Throw-CcodLifecycleError 'CCOD_INSTALL_RUNTIME_CONFLICT' 'An invalid runtime already occupies the target runtime id' $runtimeRoot
             }
             if ([IO.Directory]::Exists($stagingDirectory)) {
-                try { Remove-Item -LiteralPath $stagingDirectory -Recurse -Force -ErrorAction Stop } catch { }
+                try { [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $stagingDirectory); Remove-Item -LiteralPath $stagingDirectory -Recurse -Force -ErrorAction Stop } catch { }
             }
         } else {
-            [IO.Directory]::CreateDirectory((Split-Path $runtimeRoot -Parent)) | Out-Null
+            [IO.Directory]::CreateDirectory($runtimeContainer) | Out-Null
+            [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $runtimeContainer)
+            [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $stagingDirectory)
             [IO.Directory]::Move($stagingDirectory, $runtimeRoot)
+            [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $runtimeRoot)
             $runtimeCreated = $true
         }
         $stagingDirectory = $null
@@ -1921,7 +1976,7 @@ function Invoke-CcodInstall {
             }
         }
         if (-not $pointerCommitted -and $runtimeCreated -and $null -ne $runtimeRoot -and [IO.Directory]::Exists($runtimeRoot)) {
-            try { Remove-Item -LiteralPath $runtimeRoot -Recurse -Force -ErrorAction Stop } catch { }
+            try { [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $runtimeRoot); Remove-Item -LiteralPath $runtimeRoot -Recurse -Force -ErrorAction Stop } catch { }
         }
         if ($errorCode -cne 'CCOD_INSTALL_ACTIVATION_RECEIPT_FAILED') {
             try {
@@ -1941,11 +1996,11 @@ function Invoke-CcodInstall {
             try { & $adapters.ExitLifecycleOwnership $lifecycleOwnership | Out-Null } catch { }
         }
         if ($null -ne $stagingDirectory -and [IO.Directory]::Exists($stagingDirectory)) {
-            try { Remove-Item -LiteralPath $stagingDirectory -Recurse -Force -ErrorAction Stop } catch { }
+            try { [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $stagingDirectory); Remove-Item -LiteralPath $stagingDirectory -Recurse -Force -ErrorAction Stop } catch { }
         }
         $stagingRoot = [IO.Path]::GetFullPath((Join-Path $root '.staging'))
         if ([IO.Directory]::Exists($stagingRoot) -and -not (Test-CcodLifecycleReparse -Path $stagingRoot)) {
-            try { Remove-Item -LiteralPath $stagingRoot -Recurse -Force -ErrorAction Stop } catch { }
+            try { [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $stagingRoot); Remove-Item -LiteralPath $stagingRoot -Recurse -Force -ErrorAction Stop } catch { }
         }
     }
 
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index e8710b9..92cb918 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -746,6 +746,141 @@ $results += Invoke-CcodTest 'payload-bound install rereads the active pointer af
     }
 }
 
+# Production mutation caught: copying stable bootstrap/uninstaller from mutable source paths after their manifest-verified staging copies already exist.
+$results += Invoke-CcodTest 'stable bootstrap and uninstaller come from manifest-verified staging bytes' {
+    $source = New-CcodLifecycleTempRoot
+    $install = New-CcodLifecycleTempRoot
+    $nodeRoot = New-CcodLifecycleTempRoot
+    try {
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22' | Out-Null
+        $uninstallerSource = Join-Path $source 'Uninstall-CodexControlOtherDevices.ps1'
+        [IO.File]::WriteAllText($uninstallerSource,"# verified uninstaller`r`n",[Text.UTF8Encoding]::new($false))
+        $manifestPath = New-CcodLifecyclePayloadManifest -Root $source -Version '2.5.22'
+        $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
+        $fake = New-CcodLifecycleFake -NodePath $nodePath
+        $fake.World.CopyOverride = [pscustomobject]@{
+            Match = '*Uninstall-CodexControlOtherDevices.ps1'
+            Action = {
+                param($SourcePath,$DestinationPath)
+                [IO.Directory]::CreateDirectory((Split-Path $DestinationPath -Parent)) | Out-Null
+                [IO.File]::Copy($SourcePath,$DestinationPath,$true)
+                if ([IO.Path]::GetFullPath($SourcePath).Equals([IO.Path]::GetFullPath($uninstallerSource),[StringComparison]::OrdinalIgnoreCase)) {
+                    [IO.File]::WriteAllText($SourcePath,"# mutated after staging`r`n",[Text.UTF8Encoding]::new($false))
+                }
+            }.GetNewClosure()
+        }
+
+        $receipt = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -ExpectedVersion '2.5.22' -PayloadManifestPath $manifestPath -Adapters $fake.Adapters
+
+        $runtimeRoot = Join-Path $install "runtime\$($receipt.RuntimeId)"
+        Assert-CcodEqual (Get-CcodTestFileSha256 -Path (Join-Path $runtimeRoot 'src\persistence\bootstrap.ps1')) (Get-CcodTestFileSha256 -Path (Join-Path $install 'bootstrap.ps1')) 'stable bootstrap equals its verified runtime byte copy'
+        Assert-CcodEqual (Get-CcodTestFileSha256 -Path (Join-Path $runtimeRoot 'Uninstall-CodexControlOtherDevices.ps1')) (Get-CcodTestFileSha256 -Path (Join-Path $install 'Uninstall-CodexControlOtherDevices.ps1')) 'stable uninstaller ignores post-staging source mutation'
+    } finally {
+        foreach ($path in @($source,$install,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
+    }
+}
+
+$results += Invoke-CcodTest 'install root junction is rejected before staging writes' {
+    $source = New-CcodLifecycleTempRoot
+    $install = New-CcodLifecycleTempRoot
+    $target = New-CcodLifecycleTempRoot
+    $nodeRoot = New-CcodLifecycleTempRoot
+    try {
+        New-CcodLifecycleSourceFixture -Root $source | Out-Null
+        [IO.Directory]::CreateDirectory($target) | Out-Null
+        New-Item -ItemType Junction -Path $install -Target $target | Out-Null
+        $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
+        Assert-CcodThrows { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters | Out-Null } 'CCOD_INSTALL_REPARSE_PATH'
+        Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $target 'active.json'))) 'install-root junction target receives no active pointer'
+        Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $target '.staging'))) 'install-root junction target receives no staging directory'
+    } finally {
+        if (Test-Path -LiteralPath $install) { [IO.Directory]::Delete($install) }
+        foreach ($path in @($source,$target,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
+    }
+}
+
+$results += Invoke-CcodTest 'staging junction is rejected before payload writes' {
+    $source = New-CcodLifecycleTempRoot
+    $install = New-CcodLifecycleTempRoot
+    $target = New-CcodLifecycleTempRoot
+    $nodeRoot = New-CcodLifecycleTempRoot
+    try {
+        New-CcodLifecycleSourceFixture -Root $source | Out-Null
+        [IO.Directory]::CreateDirectory($install) | Out-Null
+        [IO.Directory]::CreateDirectory($target) | Out-Null
+        New-Item -ItemType Junction -Path (Join-Path $install '.staging') -Target $target | Out-Null
+        $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
+        Assert-CcodThrows { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters | Out-Null } 'CCOD_INSTALL_REPARSE_PATH'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath $target -Force).Count 'staging junction target remains empty'
+    } finally {
+        $junction = Join-Path $install '.staging'
+        if (Test-Path -LiteralPath $junction) { [IO.Directory]::Delete($junction) }
+        foreach ($path in @($source,$install,$target,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
+    }
+}
+
+$results += Invoke-CcodTest 'runtime junction is rejected before staging promotion' {
+    $source = New-CcodLifecycleTempRoot
+    $install = New-CcodLifecycleTempRoot
+    $target = New-CcodLifecycleTempRoot
+    $nodeRoot = New-CcodLifecycleTempRoot
+    try {
+        New-CcodLifecycleSourceFixture -Root $source | Out-Null
+        [IO.Directory]::CreateDirectory($install) | Out-Null
+        [IO.Directory]::CreateDirectory($target) | Out-Null
+        New-Item -ItemType Junction -Path (Join-Path $install 'runtime') -Target $target | Out-Null
+        $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
+        Assert-CcodThrows { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters | Out-Null } 'CCOD_INSTALL_REPARSE_PATH'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath $target -Force).Count 'runtime junction target receives no promoted runtime'
+        Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $install 'active.json'))) 'runtime junction cannot reach active pointer mutation'
+    } finally {
+        $junction = Join-Path $install 'runtime'
+        if (Test-Path -LiteralPath $junction) { [IO.Directory]::Delete($junction) }
+        foreach ($path in @($source,$install,$target,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
+    }
+}
+
+$results += Invoke-CcodTest 'payload manifest ancestry treats Windows root equality case-insensitively' {
+    $source = New-CcodLifecycleTempRoot
+    $install = New-CcodLifecycleTempRoot
+    $nodeRoot = New-CcodLifecycleTempRoot
+    try {
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22' | Out-Null
+        $manifestPath = New-CcodLifecyclePayloadManifest -Root $source -Version '2.5.22'
+        $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
+        $receipt = Invoke-CcodInstall -SourceRoot $source.ToUpperInvariant() -InstallRoot $install -ExpectedVersion '2.5.22' -PayloadManifestPath $manifestPath -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
+        Assert-CcodEqual 'Installed' $receipt.Outcome 'case-only source-root difference preserves valid Windows payload ancestry'
+    } finally {
+        foreach ($path in @($source,$install,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
+    }
+}
+
+$results += Invoke-CcodTest 'payload-bound install rejects a changed runtime manifest after readiness' {
+    $source = New-CcodLifecycleTempRoot
+    $install = New-CcodLifecycleTempRoot
+    $nodeRoot = New-CcodLifecycleTempRoot
+    try {
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22' | Out-Null
+        $manifestPath = New-CcodLifecyclePayloadManifest -Root $source -Version '2.5.22'
+        $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
+        $fake = New-CcodLifecycleFake -NodePath $nodePath
+        $fake.Adapters.WaitNewRuntimeReady = {
+            param($InstallRoot,$RuntimeId,$RuntimeGeneration,$Identity,$TaskStartedAtUtc,$TimeoutMilliseconds)
+            $runtimeManifestPath = Join-Path $InstallRoot "runtime\$RuntimeId\manifest.json"
+            $runtimeManifest = Get-Content -LiteralPath $runtimeManifestPath -Raw | ConvertFrom-Json
+            $runtimeManifest.projectVersion = '2.5.13'
+            [IO.File]::WriteAllText($runtimeManifestPath,($runtimeManifest|ConvertTo-Json -Depth 16),[Text.UTF8Encoding]::new($false))
+            [pscustomobject][ordered]@{SupervisorReady=$true;TrayReady=$true}
+        }.GetNewClosure()
+        Assert-CcodThrows {
+            Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -ExpectedVersion '2.5.22' -PayloadManifestPath $manifestPath -Adapters $fake.Adapters | Out-Null
+        } 'CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN'
+        Assert-CcodTrue ($fake.World.Phases -notcontains 'Ready') 'changed selected runtime manifest cannot produce Ready'
+    } finally {
+        foreach ($path in @($source,$install,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
+    }
+}
+
 # Production mutation caught: routing the activation progress receipt through the generic pretty-printed JSON writer.
 $results += Invoke-CcodTest 'activation progress receipt uses one compact JSON line for PowerShell 5.1 and Inno' {
     $install = New-CcodLifecycleTempRoot
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index e8b881a..be03513 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -80,19 +80,292 @@ Invoke-CcodTest 'release defender tool exposes manifest and scan functions witho
     Assert-CcodTrue ($null -ne (Get-Command Invoke-CcodReleaseDefenderCheck -ErrorAction SilentlyContinue)) 'Defender invocation is available'
 }
 
+Invoke-CcodTest 'production installer payload generator writes ordered version-bound file records' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-installer-manifest-generator-' + [guid]::NewGuid().ToString('N'))
+    try {
+        $payload = Join-Path $root 'payload'
+        [IO.Directory]::CreateDirectory((Join-Path $payload 'nested')) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $payload 'z-last.txt'),'z',[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText((Join-Path $payload 'nested\a-first.txt'),'alpha',[Text.UTF8Encoding]::new($false))
+        $manifestPath = Join-Path $root 'installer-payload.manifest.json'
+        & (Join-Path $repositoryRoot 'tools\New-InstallerPayloadManifest.ps1') -PayloadRoot $payload -ProjectVersion '2.5.22' -OutputPath $manifestPath | Out-Null
+        Assert-CcodTrue (Test-Path -LiteralPath $manifestPath -PathType Leaf) 'production manifest generator writes its requested output'
+        $manifest = Get-Content -LiteralPath $manifestPath -Raw | ConvertFrom-Json
+        Assert-CcodEqual 'schemaVersion,projectVersion,files' (@($manifest.PSObject.Properties.Name) -join ',') 'generator writes the canonical manifest field order'
+        Assert-CcodEqual '2.5.22' $manifest.projectVersion 'generator binds the requested project version'
+        Assert-CcodEqual 'nested/a-first.txt,z-last.txt' (@($manifest.files.path) -join ',') 'generator sorts file records ordinally'
+        foreach ($record in $manifest.files) {
+            $file = Join-Path $payload ([string]$record.path).Replace('/','\')
+            Assert-CcodEqual ([int64](Get-Item -LiteralPath $file).Length) ([int64]$record.length) 'record length binds the file bytes'
+            Assert-CcodEqual (Get-CcodTestFileSha256 -Path $file) ([string]$record.sha256) 'record hash binds the file bytes'
+        }
+    } finally {
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
+function New-CcodActivationPayloadFixture {
+    param([string]$Version = '2.5.22')
+
+    $appRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-activation-payload-' + [guid]::NewGuid().ToString('N'))
+    $payloadRoot = Join-Path $appRoot "payload\$Version"
+    [IO.Directory]::CreateDirectory((Join-Path $payloadRoot 'src\persistence\modules')) | Out-Null
+    [IO.File]::WriteAllText((Join-Path $payloadRoot 'package.json'),([ordered]@{name='fixture';version=$Version}|ConvertTo-Json),[Text.UTF8Encoding]::new($false))
+    [IO.File]::WriteAllText((Join-Path $payloadRoot 'Install-CodexControlOtherDevices.ps1'),'exit 0',[Text.UTF8Encoding]::new($false))
+    [IO.File]::WriteAllText((Join-Path $payloadRoot 'src\persistence\modules\InstallLifecycle.psm1'),'function Get-CcodLifecyclePayloadManifestFiles { @() }',[Text.UTF8Encoding]::new($false))
+    $records = [Collections.Generic.List[object]]::new()
+    foreach ($file in @(Get-ChildItem -LiteralPath $payloadRoot -File -Force -Recurse)) {
+        $relative = $file.FullName.Substring($payloadRoot.TrimEnd('\').Length + 1).Replace('\','/')
+        $records.Add([pscustomobject][ordered]@{path=$relative;length=[int64]$file.Length;sha256=Get-CcodTestFileSha256 -Path $file.FullName})
+    }
+    $comparison = [System.Comparison[object]]{param($left,$right)[StringComparer]::Ordinal.Compare([string]$left.path,[string]$right.path)}
+    $records.Sort($comparison)
+    $manifestPath = Join-Path $payloadRoot 'installer-payload.manifest.json'
+    [IO.File]::WriteAllText($manifestPath,([ordered]@{schemaVersion=1;projectVersion=$Version;files=@($records)}|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+    return [pscustomobject]@{AppRoot=$appRoot;PayloadRoot=$payloadRoot;ManifestPath=$manifestPath;ManifestSha256=Get-CcodTestFileSha256 -Path $manifestPath}
+}
+
+function Invoke-CcodActivationVerifierFixture {
+    param([Parameter(Mandatory)]$Fixture,[Parameter(Mandatory)][string]$ExpectedManifestSha256,[string]$PayloadRoot)
+
+    $stdoutPath = Join-Path $Fixture.AppRoot ('stdout-' + [guid]::NewGuid().ToString('N') + '.txt')
+    $stderrPath = Join-Path $Fixture.AppRoot ('stderr-' + [guid]::NewGuid().ToString('N') + '.txt')
+    if ([string]::IsNullOrWhiteSpace($PayloadRoot)) { $PayloadRoot = $Fixture.PayloadRoot }
+    $argumentLine = '-NoProfile -NonInteractive -ExecutionPolicy Bypass -File "{0}" -AppRoot "{1}" -InstallRoot "{1}" -PayloadRoot "{2}" -ExpectedVersion "2.5.22" -ExpectedPayloadManifestSha256 "{3}" -ActivationId "77777777-6666-5555-4444-333333333333" -ValidateReceiptOnly' -f (Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1'),$Fixture.AppRoot,$PayloadRoot,$ExpectedManifestSha256
+    $process = Start-Process -FilePath (Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe') -ArgumentList $argumentLine -WindowStyle Hidden -RedirectStandardOutput $stdoutPath -RedirectStandardError $stderrPath -Wait -PassThru
+    try { $exitCode = [int]$process.ExitCode } finally { $process.Dispose() }
+    return [pscustomobject]@{ExitCode=$exitCode;Output=([IO.File]::ReadAllText($stdoutPath)+[IO.File]::ReadAllText($stderrPath))}
+}
+
+function Invoke-CcodInnoPayloadCompileFixture {
+    param([switch]$IncludePayloadDefines)
+
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-inno-payload-contract-' + [guid]::NewGuid().ToString('N'))
+    $tray = Join-Path $root 'tray'
+    $portable = Join-Path $root 'portable'
+    $payload = Join-Path $root 'payload'
+    $output = Join-Path $root 'output'
+    foreach ($directory in @($tray,$portable,$payload,$output)) { [IO.Directory]::CreateDirectory($directory) | Out-Null }
+    foreach ($leaf in @('CodexRemote.TrayHost.exe','CodexRemote.TrayHost.exe.config','trayhost-build-provenance.json')) {
+        [IO.File]::WriteAllText((Join-Path $tray $leaf),"fixture $leaf",[Text.UTF8Encoding]::new($false))
+    }
+    foreach ($leaf in @('CodexRemote.Portable.exe','CodexRemote.Portable.exe.config','portable-launcher-provenance.json')) {
+        [IO.File]::WriteAllText((Join-Path $portable $leaf),"fixture $leaf",[Text.UTF8Encoding]::new($false))
+    }
+    [IO.File]::WriteAllText((Join-Path $payload 'package.json'),'{"version":"2.5.21"}',[Text.UTF8Encoding]::new($false))
+    $packageHash = Get-CcodTestFileSha256 -Path (Join-Path $payload 'package.json')
+    $manifest = [ordered]@{schemaVersion=1;projectVersion='2.5.21';files=@([ordered]@{path='package.json';length=[int64](Get-Item -LiteralPath (Join-Path $payload 'package.json')).Length;sha256=$packageHash})}
+    $manifestPath = Join-Path $payload 'installer-payload.manifest.json'
+    [IO.File]::WriteAllText($manifestPath,($manifest|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+    $iscc = @(
+        (Join-Path $env:LOCALAPPDATA 'Programs\Inno Setup 6\ISCC.exe'),
+        (Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'),
+        (Join-Path $env:ProgramFiles 'Inno Setup 6\ISCC.exe')
+    ) | Where-Object { $_ -and [IO.File]::Exists($_) } | Select-Object -First 1
+    if (-not $iscc) { throw 'Inno Setup 6 is required for the setup payload contract' }
+    $arguments = @('/DProjectVersion=2.5.21',"/DTrayHostArtifactDirectory=$tray","/DPortableArtifactDirectory=$portable","/O$output\",(Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss'))
+    if ($IncludePayloadDefines) {
+        $arguments = @('/DProjectVersion=2.5.21',"/DTrayHostArtifactDirectory=$tray","/DPortableArtifactDirectory=$portable","/DInstallerPayloadDirectory=$payload","/DInstallerPayloadManifestSha256=$(Get-CcodTestFileSha256 -Path $manifestPath)","/O$output\",(Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss'))
+    }
+    $previousPreference = $ErrorActionPreference
+    try {
+        $ErrorActionPreference = 'Continue'
+        $compileOutput = @(& $iscc @arguments 2>&1)
+        $exitCode = $LASTEXITCODE
+    } finally { $ErrorActionPreference = $previousPreference }
+    return [pscustomobject]@{Root=$root;ExitCode=$exitCode;Output=($compileOutput -join "`n");SetupPath=(Join-Path $output 'CodexRemote-fix-2.5.21-setup.exe')}
+}
+
 Invoke-CcodTest 'setup build and activation bind one immutable versioned payload end to end' {
     $build = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\build.ps1') -Raw -Encoding UTF8
     $inno = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw -Encoding UTF8
     $activation = Get-Content -LiteralPath (Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1') -Raw -Encoding UTF8
     $installer = Get-Content -LiteralPath (Join-Path $repositoryRoot 'Install-CodexControlOtherDevices.ps1') -Raw -Encoding UTF8
 
-    Assert-CcodTrue ($build -cmatch 'installer-payload\.manifest\.json' -and $build -cmatch 'schemaVersion\s*=\s*1\s+projectVersion\s*=\s*\$Version\s+files\s*=\s*\$payloadRecords') 'build emits the canonical ordered setup payload manifest'
+    Assert-CcodTrue ($build -cmatch 'New-InstallerPayloadManifest\.ps1' -and $build -cmatch 'InstallerPayloadManifestSha256') 'build invokes the tested generator and binds its manifest hash into setup compilation'
     Assert-CcodTrue ($inno -cmatch 'InstallerPayloadDirectory' -and $inno -cmatch 'DestDir:\s*"\{app\}\\payload\\\{#ProjectVersion\}"') 'Inno copies the immutable build payload into its exact version directory'
     Assert-CcodTrue ($inno -cmatch "ExpandConstant\('\{app\}\\payload\\\{#ProjectVersion\}'\)" -and $inno -cmatch '-ExpectedVersion\s+"\{#ProjectVersion\}') 'Inno binds activation to its compiled payload version'
-    Assert-CcodTrue ($activation -cmatch '\[string\]\$ExpectedVersion' -and $activation -cmatch 'installer-payload\.manifest\.json') 'activation accepts and resolves the expected payload contract'
+    Assert-CcodTrue ($activation -cmatch '\[string\]\$ExpectedVersion' -and $activation -cmatch '\[string\]\$ExpectedPayloadManifestSha256' -and $activation -cmatch 'installer-payload\.manifest\.json') 'activation accepts and resolves the expected payload contract'
     Assert-CcodTrue ($installer -cmatch '\[string\]\$ExpectedVersion' -and $installer -cmatch '\[string\]\$PayloadManifestPath' -and $installer -cmatch '-ExpectedVersion\s+\$ExpectedVersion' -and $installer -cmatch '-PayloadManifestPath\s+\$PayloadManifestPath') 'installer forwards the immutable payload contract to lifecycle activation'
 }
 
+Invoke-CcodTest 'activation accepts a compile-bound installer manifest hash before payload verification' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-activation-hash-interface-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $activationId = '77777777-6666-5555-4444-333333333333'
+        $stdoutPath = Join-Path $root 'stdout.txt'
+        $stderrPath = Join-Path $root 'stderr.txt'
+        $argumentLine = '-NoProfile -NonInteractive -ExecutionPolicy Bypass -File "{0}" -AppRoot "{1}" -InstallRoot "{1}" -PayloadRoot "{1}\payload\2.5.22" -ExpectedVersion "2.5.22" -ExpectedPayloadManifestSha256 "{2}" -ActivationId "{3}" -ValidateReceiptOnly' -f (Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1'),$root,('0' * 64),$activationId
+        $process = Start-Process -FilePath (Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe') -ArgumentList $argumentLine -WindowStyle Hidden -RedirectStandardOutput $stdoutPath -RedirectStandardError $stderrPath -Wait -PassThru
+        try { $exitCode = [int]$process.ExitCode } finally { $process.Dispose() }
+        $output = [IO.File]::ReadAllText($stdoutPath) + [IO.File]::ReadAllText($stderrPath)
+        Assert-CcodEqual 3 $exitCode 'missing payload reaches the bounded verifier contract after accepting the manifest hash parameter'
+        Assert-CcodTrue ($output -cnotmatch 'parameter name .ExpectedPayloadManifestSha256') 'compile-bound hash is a real activation parameter'
+    } finally {
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'activation rejects a changed payload module before any payload code executes' {
+    $fixture = New-CcodActivationPayloadFixture
+    try {
+        $marker = Join-Path $fixture.AppRoot 'payload-module-executed.txt'
+        $modulePath = Join-Path $fixture.PayloadRoot 'src\persistence\modules\InstallLifecycle.psm1'
+        $markerLiteral = $marker.Replace("'","''")
+        [IO.File]::WriteAllText($modulePath,"[IO.File]::WriteAllText('$markerLiteral','executed'); function Get-CcodLifecyclePayloadManifestFiles { @() }",[Text.UTF8Encoding]::new($false))
+
+        $result = Invoke-CcodActivationVerifierFixture -Fixture $fixture -ExpectedManifestSha256 $fixture.ManifestSha256
+
+        Assert-CcodEqual 3 $result.ExitCode 'payload hash mismatch is a bounded verification failure'
+        Assert-CcodTrue (-not (Test-Path -LiteralPath $marker)) 'unverified payload module code never executes'
+        Assert-CcodTrue ($result.Output -cmatch 'CCOD_INSTALL_FILE_HASH_MISMATCH|CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID') 'failure retains a stable payload verification code'
+    } finally {
+        if (Test-Path -LiteralPath $fixture.AppRoot) { Remove-Item -LiteralPath $fixture.AppRoot -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'activation distinguishes a valid payload from a bad compile-bound manifest hash' {
+    $fixture = New-CcodActivationPayloadFixture
+    try {
+        $valid = Invoke-CcodActivationVerifierFixture -Fixture $fixture -ExpectedManifestSha256 $fixture.ManifestSha256
+        Assert-CcodEqual 3 $valid.ExitCode 'valid payload advances to bounded receipt verification'
+        Assert-CcodTrue ($valid.Output -cmatch 'CCOD_ACTIVATION_RECEIPT_MISSING') 'valid payload reaches the receipt boundary after independent verification'
+        $invalid = Invoke-CcodActivationVerifierFixture -Fixture $fixture -ExpectedManifestSha256 ('0' * 64)
+        Assert-CcodEqual 3 $invalid.ExitCode 'bad compile-bound manifest hash fails verification'
+        Assert-CcodTrue ($invalid.Output -cmatch 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID') 'bad manifest hash retains the stable payload code'
+    } finally {
+        if (Test-Path -LiteralPath $fixture.AppRoot) { Remove-Item -LiteralPath $fixture.AppRoot -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'activation requires the exact versioned payload root' {
+    $fixture = New-CcodActivationPayloadFixture
+    try {
+        $wrongRoot = Join-Path $fixture.AppRoot 'payload\other'
+        [IO.Directory]::CreateDirectory($wrongRoot) | Out-Null
+        $result = Invoke-CcodActivationVerifierFixture -Fixture $fixture -ExpectedManifestSha256 $fixture.ManifestSha256 -PayloadRoot $wrongRoot
+        Assert-CcodEqual 3 $result.ExitCode 'wrong version directory fails before receipt processing'
+        Assert-CcodTrue ($result.Output -cmatch 'CCOD_INSTALL_PAYLOAD_PATH_INVALID') 'wrong payload root retains a stable path code'
+    } finally {
+        if (Test-Path -LiteralPath $fixture.AppRoot) { Remove-Item -LiteralPath $fixture.AppRoot -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'activation rejects a reparse payload ancestor' {
+    $fixture = New-CcodActivationPayloadFixture
+    $targetRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-activation-payload-target-' + [guid]::NewGuid().ToString('N'))
+    try {
+        $sourceVersion = $fixture.PayloadRoot
+        [IO.Directory]::CreateDirectory($targetRoot) | Out-Null
+        Move-Item -LiteralPath $sourceVersion -Destination (Join-Path $targetRoot '2.5.22')
+        Remove-Item -LiteralPath (Join-Path $fixture.AppRoot 'payload') -Force
+        New-Item -ItemType Junction -Path (Join-Path $fixture.AppRoot 'payload') -Target $targetRoot | Out-Null
+        $result = Invoke-CcodActivationVerifierFixture -Fixture $fixture -ExpectedManifestSha256 $fixture.ManifestSha256
+        Assert-CcodEqual 3 $result.ExitCode 'payload junction fails before receipt processing'
+        Assert-CcodTrue ($result.Output -cmatch 'CCOD_INSTALL_SOURCE_REPARSE') 'payload junction retains the reparse support code'
+    } finally {
+        $junction = Join-Path $fixture.AppRoot 'payload'
+        if (Test-Path -LiteralPath $junction) { [IO.Directory]::Delete($junction) }
+        if (Test-Path -LiteralPath $fixture.AppRoot) { Remove-Item -LiteralPath $fixture.AppRoot -Recurse -Force }
+        if (Test-Path -LiteralPath $targetRoot) { Remove-Item -LiteralPath $targetRoot -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'activation rejects an unlisted nested payload junction' {
+    $fixture = New-CcodActivationPayloadFixture
+    $targetRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-activation-nested-target-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($targetRoot) | Out-Null
+        $junction = Join-Path $fixture.PayloadRoot 'unlisted-junction'
+        New-Item -ItemType Junction -Path $junction -Target $targetRoot | Out-Null
+        $result = Invoke-CcodActivationVerifierFixture -Fixture $fixture -ExpectedManifestSha256 $fixture.ManifestSha256
+        Assert-CcodEqual 3 $result.ExitCode 'nested payload junction fails before receipt processing'
+        Assert-CcodTrue ($result.Output -cmatch 'CCOD_INSTALL_SOURCE_REPARSE') 'nested payload junction retains the reparse support code'
+    } finally {
+        $junction = Join-Path $fixture.PayloadRoot 'unlisted-junction'
+        if (Test-Path -LiteralPath $junction) { [IO.Directory]::Delete($junction) }
+        if (Test-Path -LiteralPath $fixture.AppRoot) { Remove-Item -LiteralPath $fixture.AppRoot -Recurse -Force }
+        if (Test-Path -LiteralPath $targetRoot) { Remove-Item -LiteralPath $targetRoot -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'Inno compile refuses an implicit installer payload source' {
+    $compile = Invoke-CcodInnoPayloadCompileFixture
+    try {
+        Assert-CcodTrue ($compile.ExitCode -ne 0) 'setup compilation fails without an explicit installer payload directory and manifest hash'
+        Assert-CcodTrue ($compile.Output -cmatch 'InstallerPayloadDirectory') 'compiler identifies the missing immutable payload define'
+        Assert-CcodTrue (-not (Test-Path -LiteralPath $compile.SetupPath)) 'missing payload define produces no setup artifact'
+    } finally {
+        if (Test-Path -LiteralPath $compile.Root) { Remove-Item -LiteralPath $compile.Root -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'Inno compile packages the explicit manifest-bound installer payload' {
+    $compile = Invoke-CcodInnoPayloadCompileFixture -IncludePayloadDefines
+    try {
+        Assert-CcodEqual 0 $compile.ExitCode "explicit setup payload contract compiles: $($compile.Output)"
+        Assert-CcodTrue (Test-Path -LiteralPath $compile.SetupPath -PathType Leaf) 'explicit payload compile produces the setup artifact'
+        Assert-CcodTrue ($compile.Output -cmatch 'installer-payload\.manifest\.json' -and $compile.Output -cmatch 'payload\\package\.json') 'compiler input trace contains the exact payload manifest and manifest-listed file'
+    } finally {
+        if (Test-Path -LiteralPath $compile.Root) { Remove-Item -LiteralPath $compile.Root -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'Inno exposes a pre-write payload-directory reparse gate' {
+    $inno = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw -Encoding UTF8
+    $helper = [regex]::Match($inno,'(?ms)^function IsSafeExistingPayloadDirectory\(.*?^end;')
+    Assert-CcodTrue $helper.Success 'production Inno script exposes the directory predicate used before payload writes'
+    Assert-CcodTrue ($inno -cmatch '(?ms)^function PrepareToInstall\(var NeedsRestart: Boolean\): String;.*?IsSafeExistingPayloadDirectory') 'PrepareToInstall rejects unsafe app and payload directories before file copy'
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-inno-reparse-harness-' + [guid]::NewGuid().ToString('N'))
+    try {
+        $normal = Join-Path $root 'normal'
+        $target = Join-Path $root 'target'
+        $junction = Join-Path $root 'junction'
+        $missing = Join-Path $root 'missing'
+        $resultPath = Join-Path $root 'result.txt'
+        [IO.Directory]::CreateDirectory($normal) | Out-Null
+        [IO.Directory]::CreateDirectory($target) | Out-Null
+        New-Item -ItemType Junction -Path $junction -Target $target | Out-Null
+        $harnessPath = Join-Path $root 'ReparseGate.iss'
+        $harness = @"
+[Setup]
+AppName=ReparseGate
+AppVersion=1.0.0
+DefaultDirName={tmp}\ReparseGate
+PrivilegesRequired=lowest
+OutputDir=$($root.Replace('\','\\'))
+OutputBaseFilename=ReparseGate
+Uninstallable=no
+[Code]
+const
+  CCOD_FILE_ATTRIBUTE_DIRECTORY = `$00000010;
+  CCOD_FILE_ATTRIBUTE_REPARSE_POINT = `$00000400;
+  CCOD_INVALID_FILE_ATTRIBUTES = `$FFFFFFFF;
+function GetFileAttributesW(const FileName: String): Cardinal;
+  external 'GetFileAttributesW@kernel32.dll stdcall';
+$($helper.Value)
+function InitializeSetup(): Boolean;
+begin
+  if IsSafeExistingPayloadDirectory('$($normal.Replace("'","''"))') and
+     IsSafeExistingPayloadDirectory('$($missing.Replace("'","''"))') and
+     (not IsSafeExistingPayloadDirectory('$($junction.Replace("'","''"))')) then
+    SaveStringToFile('$($resultPath.Replace("'","''"))','pass',False);
+  Result := False;
+end;
+"@
+        [IO.File]::WriteAllText($harnessPath,$harness,[Text.UTF8Encoding]::new($false))
+        $iscc = Join-Path $env:LOCALAPPDATA 'Programs\Inno Setup 6\ISCC.exe'
+        $compileOutput = @(& $iscc $harnessPath 2>&1)
+        Assert-CcodEqual 0 $LASTEXITCODE "reparse predicate harness compiles: $($compileOutput -join ' ')"
+        $process = Start-Process -FilePath (Join-Path $root 'ReparseGate.exe') -ArgumentList @('/VERYSILENT','/SUPPRESSMSGBOXES','/NORESTART','/SP-') -WindowStyle Hidden -Wait -PassThru
+        try { $null = $process.ExitCode } finally { $process.Dispose() }
+        Assert-CcodEqual 'pass' ([IO.File]::ReadAllText($resultPath,[Text.UTF8Encoding]::new($false))) 'production predicate accepts absent/normal directories and rejects a junction'
+    } finally {
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
 Invoke-CcodTest 'release manifest binds the final asset names hashes version commit and timestamp' {
     . $defenderPath -Library
     $fixture = New-CcodReleaseFixture
diff --git a/tools/New-InstallerPayloadManifest.ps1 b/tools/New-InstallerPayloadManifest.ps1
new file mode 100644
index 0000000..ce22b3a
--- /dev/null
+++ b/tools/New-InstallerPayloadManifest.ps1
@@ -0,0 +1,54 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)][string]$PayloadRoot,
+    [Parameter(Mandatory)][string]$ProjectVersion,
+    [Parameter(Mandatory)][string]$OutputPath
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+function Get-CcodInstallerPayloadSha256 {
+    param([Parameter(Mandatory)][string]$Path)
+    $sha = [Security.Cryptography.SHA256]::Create()
+    $stream = $null
+    try {
+        $stream = [IO.File]::Open([IO.Path]::GetFullPath($Path),[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read)
+        return [BitConverter]::ToString($sha.ComputeHash($stream)).Replace('-','').ToLowerInvariant()
+    } finally {
+        if ($null -ne $stream) { $stream.Dispose() }
+        $sha.Dispose()
+    }
+}
+
+function Test-CcodInstallerPayloadRelativePath {
+    param([Parameter(Mandatory)][string]$Path)
+    return $Path -cmatch '^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$' -and -not $Path.Contains('//') -and -not $Path.Contains('..') -and -not $Path.Contains(':')
+}
+
+if ($ProjectVersion -cnotmatch '^\d+\.\d+\.\d+$') { throw "Invalid installer payload project version: $ProjectVersion" }
+$root = [IO.Path]::GetFullPath($PayloadRoot).TrimEnd('\')
+$output = [IO.Path]::GetFullPath($OutputPath)
+if (-not [IO.Directory]::Exists($root)) { throw "Installer payload root is missing: $root" }
+if ([IO.File]::Exists($output) -or [IO.Directory]::Exists($output)) { throw "Refusing to overwrite installer payload manifest: $output" }
+$rootItem = Get-Item -LiteralPath $root -Force -ErrorAction Stop
+if (($rootItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw "Installer payload root is a reparse point: $root" }
+$prefix = $root + '\'
+$records = [Collections.Generic.List[object]]::new()
+foreach ($item in @(Get-ChildItem -LiteralPath $root -Force -Recurse -ErrorAction Stop)) {
+    if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw "Installer payload contains a reparse point: $($item.FullName)" }
+    if ($item.PSIsContainer) { continue }
+    $full = [IO.Path]::GetFullPath($item.FullName)
+    if (-not $full.StartsWith($prefix,[StringComparison]::OrdinalIgnoreCase)) { throw "Installer payload file escaped its root: $full" }
+    $relative = $full.Substring($prefix.Length).Replace('\','/')
+    if (-not (Test-CcodInstallerPayloadRelativePath $relative)) { throw "Installer payload relative path is invalid: $relative" }
+    $records.Add([pscustomobject][ordered]@{path=$relative;length=[int64]$item.Length;sha256=Get-CcodInstallerPayloadSha256 -Path $full})
+}
+$comparison = [System.Comparison[object]]{param($left,$right)[StringComparer]::Ordinal.Compare([string]$left.path,[string]$right.path)}
+$records.Sort($comparison)
+if ($records.Count -eq 0) { throw 'Installer payload is empty.' }
+$manifest = [ordered]@{schemaVersion=1;projectVersion=$ProjectVersion;files=@($records)}
+$outputParent = Split-Path $output -Parent
+if (-not [IO.Directory]::Exists($outputParent)) { [IO.Directory]::CreateDirectory($outputParent) | Out-Null }
+[IO.File]::WriteAllText($output,(($manifest|ConvertTo-Json -Depth 8)+[Environment]::NewLine),[Text.UTF8Encoding]::new($false))
+Write-Output ([pscustomobject]$manifest)

From b9e74657e5439e02a8a4eab8d6b5bc70e84ee751 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 02:17:38 +0800
Subject: [PATCH 004/187] docs: refine stable rebind acceptance

---
 ...6-08-28-v2522-install-runtime-reliability.md | 17 ++++++++++++++---
 ...-v2522-install-runtime-reliability-design.md | 16 ++++++++++++----
 2 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md b/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md
index dc9fb82..49ea10c 100644
--- a/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md
+++ b/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md
@@ -97,14 +97,19 @@ fix: bind setup activation to immutable payload
 **Files:**
 - Modify: `src/persistence/modules/ProcessControl.psm1`
 - Modify: `src/persistence/modules/SessionEngine.psm1`
+- Modify: `src/persistence/Supervisor.ps1`
 - Test: `tests/persistence/ProcessControl.SelfTest.ps1`
 - Test: `tests/persistence/SessionEngine.SelfTest.ps1`
+- Test: `tests/persistence/Supervisor.SelfTest.ps1`
 
 **Interfaces:**
 - Add `Get-CcodStableVerifiedProcessTree` that accepts a root snapshot,
   `StatusEvidence`, a fixed retry budget, and adapters.
 - It returns a verified tree only if every successful attempt preserves the
   original root identity; otherwise it returns no tree.
+- `Confirm-CcodSupervisorLifecycleProofCandidate` uses the same bounded
+  candidate-root rebind rule and records a stable failure reason without
+  granting a changed root any authority.
 
 - [ ] **Step 1: Write failing process-tree tests**
 
@@ -121,6 +126,11 @@ Assert-CcodEqual 2 $tree.Count 'one transient empty tree is retried without rela
 Add a companion test where the second root snapshot has a different creation
 time; it must return no tree and perform no close mutation.
 
+Add a Supervisor test where the first post-worker rebind sees no special root
+but the second sees the same candidate root; it must publish `RemoteVerified`.
+Add its counterpart where the second root has a different creation time; it
+must remain `CCOD_REMOTE_PROOF_REBIND_FAILED`.
+
 - [ ] **Step 2: Run focused tests and confirm RED**
 
 Run: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/ProcessControl.SelfTest.ps1`
@@ -138,9 +148,10 @@ pre-stop/post-stop/final proofs unchanged.
 
 - [ ] **Step 4: Run focused tests and prove GREEN**
 
-Run ProcessControl and SessionEngine self-tests.  Confirm child churn retries
-successfully, root drift remains fail-closed, and ordinary close tests still
-prove every stopped member.
+Run ProcessControl, SessionEngine, and Supervisor self-tests.  Confirm child
+churn retries successfully, a transient same-identity rebind succeeds, root
+drift remains fail-closed, and ordinary close tests still prove every stopped
+member.
 
 - [ ] **Step 5: Commit**
 
diff --git a/docs/superpowers/specs/2026-08-28-v2522-install-runtime-reliability-design.md b/docs/superpowers/specs/2026-08-28-v2522-install-runtime-reliability-design.md
index cfdb7bc..021295f 100644
--- a/docs/superpowers/specs/2026-08-28-v2522-install-runtime-reliability-design.md
+++ b/docs/superpowers/specs/2026-08-28-v2522-install-runtime-reliability-design.md
@@ -65,10 +65,18 @@ top-level root identity and a self-consistent tree.  If the root PID, creation
 time, session, SID, package family, executable path, command line mode, or
 recorded debug ports change, the operation remains fail-closed immediately.
 
-The wrapper is used only before a mutation starts.  Once a close transition is
-written, the existing per-member pre-stop, post-stop, and final identity checks
-remain strict.  Diagnostics classify the last stable failure boundary so a
-future support log can distinguish tree churn from an unsafe process identity.
+The wrapper is used before a mutation starts and for a transient rich snapshot
+read of an already verified member.  Once a close transition is written, the
+existing per-member pre-stop, post-stop, and final identity checks remain
+strict.  A `SameIdentity` result is required before retrying a null or
+mismatched rich snapshot; an absent or changed root remains fail-closed.
+
+The same bounded policy applies to Supervisor's `RemoteVerified` rebind: it
+may retry an indeterminate reread of the exact candidate root, but a different
+root, changed creation time, changed ports, or a malformed state read remains
+an immediate failed proof.  Diagnostics classify the last stable failure
+boundary so a future support log can distinguish tree churn from an unsafe
+process identity.
 
 ### 3. Tray action correlation and diagnostics
 

From 493245e54884db4e0cf7e982dacef137e5c6d00a Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 02:36:22 +0800
Subject: [PATCH 005/187] fix: close setup payload reparse write windows

---
 build/CodexControlOtherDevices.iss            | 48 ++++++++++-
 src/persistence/modules/InstallLifecycle.psm1 | 59 ++++++++++---
 .../persistence/InstallLifecycle.SelfTest.ps1 | 82 +++++++++++++++++++
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 17 +++-
 4 files changed, 192 insertions(+), 14 deletions(-)

diff --git a/build/CodexControlOtherDevices.iss b/build/CodexControlOtherDevices.iss
index 1a0eade..4e79f0e 100644
--- a/build/CodexControlOtherDevices.iss
+++ b/build/CodexControlOtherDevices.iss
@@ -129,6 +129,42 @@ begin
      ((Attributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) = 0));
 end;
 
+function IsSafeExistingSetupTree(const DirectoryName: String): Boolean;
+var
+  Attributes: Cardinal;
+  FindRec: TFindRec;
+  ChildPath: String;
+begin
+  Result := IsSafeExistingPayloadDirectory(DirectoryName);
+  if not Result then Exit;
+  Attributes := GetFileAttributesW(DirectoryName);
+  if Attributes = CCOD_INVALID_FILE_ATTRIBUTES then Exit;
+  if FindFirst(AddBackslash(DirectoryName) + '*', FindRec) then
+  begin
+    try
+      repeat
+        if (FindRec.Name <> '.') and (FindRec.Name <> '..') then
+        begin
+          ChildPath := AddBackslash(DirectoryName) + FindRec.Name;
+          if (FindRec.Attributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) <> 0 then
+          begin
+            Result := False;
+            Exit;
+          end;
+          if ((FindRec.Attributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) <> 0) and
+             (not IsSafeExistingSetupTree(ChildPath)) then
+          begin
+            Result := False;
+            Exit;
+          end;
+        end;
+      until not FindNext(FindRec);
+    finally
+      FindClose(FindRec);
+    end;
+  end;
+end;
+
 function PrepareToInstall(var NeedsRestart: Boolean): String;
 var
   AppDirectory, PayloadDirectory, VersionDirectory: String;
@@ -137,7 +173,17 @@ begin
   AppDirectory := ExpandConstant('{app}');
   PayloadDirectory := ExpandConstant('{app}\payload');
   VersionDirectory := ExpandConstant('{app}\payload\{#ProjectVersion}');
-  if not IsSafeExistingPayloadDirectory(AppDirectory) or
+  if not IsSafeExistingSetupTree(AppDirectory) or
+     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\build')) or
+     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\bin')) or
+     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\.github')) or
+     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\.github\workflows')) or
+     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\assets')) or
+     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\assets\codexremote-fix')) or
+     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\docs')) or
+     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\src')) or
+     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\tests')) or
+     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\tools')) or
      not IsSafeExistingPayloadDirectory(PayloadDirectory) or
      not IsSafeExistingPayloadDirectory(VersionDirectory) then
     Result := 'CodexRemote-fix refused an unsafe existing payload directory.';
diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index ecbf18e..329f1ed 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -174,6 +174,31 @@ function Assert-CcodLifecycleInstallPathSafe {
     return $candidate
 }
 
+function Assert-CcodLifecycleInstallTreeSafe {
+    param(
+        [Parameter(Mandatory)][string]$InstallRoot,
+        [Parameter(Mandatory)][string]$Path
+    )
+
+    $tree = Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $Path
+    if (-not [IO.Directory]::Exists($tree)) { return $tree }
+    $prefix = $tree.TrimEnd('\') + '\'
+    $pending = [Collections.Generic.Stack[string]]::new()
+    $pending.Push($tree)
+    while ($pending.Count -gt 0) {
+        $directory = $pending.Pop()
+        foreach ($item in @(Get-ChildItem -LiteralPath $directory -Force -ErrorAction Stop)) {
+            $full = [IO.Path]::GetFullPath($item.FullName)
+            if (-not $full.StartsWith($prefix,[StringComparison]::OrdinalIgnoreCase) -or
+                ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) {
+                Throw-CcodLifecycleError 'CCOD_INSTALL_REPARSE_PATH' 'Install tree contains a reparse point or escaped entry' $full
+            }
+            if ($item.PSIsContainer) { $pending.Push($full) }
+        }
+    }
+    return $tree
+}
+
 function Test-CcodLifecycleReparse {
     param([Parameter(Mandatory)][string]$Path)
     if (-not (Test-Path -LiteralPath $Path)) { return $false }
@@ -541,6 +566,10 @@ function Copy-CcodLifecycleStaging {
             if (-not $destination.StartsWith($prefix, [StringComparison]::OrdinalIgnoreCase)) {
                 Throw-CcodLifecycleError 'CCOD_INSTALL_STAGING_PATH_INVALID' 'Staging path escaped the staging root' $destination
             }
+            $destinationParent = Split-Path $destination -Parent
+            [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $destinationParent)
+            [IO.Directory]::CreateDirectory($destinationParent) | Out-Null
+            [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $destinationParent)
             [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $destination)
             & $Adapters.CopyFile $file.Source $destination
             [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $destination)
@@ -557,6 +586,7 @@ function Copy-CcodLifecycleStaging {
         if (-not [IO.File]::Exists($bootstrapSource)) {
             Throw-CcodLifecycleError 'CCOD_INSTALL_SOURCE_INCOMPLETE' 'The verified staging bootstrap script is missing' $bootstrapSource
         }
+        [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $bootstrapPath)
         & $Adapters.CopyFile $bootstrapSource $bootstrapPath
         [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $bootstrapPath)
         if ((Get-CcodLifecycleFileSha256 -Path $bootstrapPath) -cne (Get-CcodLifecycleFileSha256 -Path $bootstrapSource)) {
@@ -565,6 +595,7 @@ function Copy-CcodLifecycleStaging {
         $copiedStableBootstrap = $true
         $uninstallerSource = Join-Path $stagingDirectory 'Uninstall-CodexControlOtherDevices.ps1'
         if ([IO.File]::Exists($uninstallerSource)) {
+            [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $uninstallerPath)
             & $Adapters.CopyFile $uninstallerSource $uninstallerPath
             [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $uninstallerPath)
             if ((Get-CcodLifecycleFileSha256 -Path $uninstallerPath) -cne (Get-CcodLifecycleFileSha256 -Path $uninstallerSource)) {
@@ -575,13 +606,13 @@ function Copy-CcodLifecycleStaging {
         return $stagingDirectory
     } catch {
         if ([IO.Directory]::Exists($stagingDirectory)) {
-            try { [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $stagingDirectory); Remove-Item -LiteralPath $stagingDirectory -Recurse -Force -ErrorAction Stop } catch { }
+            try { [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $InstallRoot -Path $stagingDirectory); Remove-Item -LiteralPath $stagingDirectory -Recurse -Force -ErrorAction Stop } catch { }
         }
         if ($copiedStableBootstrap -and -not $bootstrapExistedBefore -and [IO.File]::Exists($bootstrapPath)) {
-            try { Remove-Item -LiteralPath $bootstrapPath -Force -ErrorAction Stop } catch { }
+            try { [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $bootstrapPath); Remove-Item -LiteralPath $bootstrapPath -Force -ErrorAction Stop } catch { }
         }
         if ($copiedStableUninstaller -and -not $uninstallerExistedBefore -and [IO.File]::Exists($uninstallerPath)) {
-            try { Remove-Item -LiteralPath $uninstallerPath -Force -ErrorAction Stop } catch { }
+            try { [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $uninstallerPath); Remove-Item -LiteralPath $uninstallerPath -Force -ErrorAction Stop } catch { }
         }
         $candidateId = ([string]$_.FullyQualifiedErrorId -split ',')[0]
         if ($candidateId -clike 'CCOD_INSTALL_*' -or $candidateId -clike 'CCOD_*') {
@@ -1422,6 +1453,10 @@ function Get-CcodLifecycleAdapters {
             [IO.Directory]::CreateDirectory((Split-Path $Destination -Parent)) | Out-Null
             [IO.File]::Copy($Source, $Destination, $true)
         }
+        NewRuntimeManifest = {
+            param($RuntimeDirectory, $ProjectVersion)
+            New-CcodRuntimeManifest -RuntimeDirectory $RuntimeDirectory -ProjectVersion $ProjectVersion
+        }
         WriteLog = {
             param($InstallRoot, $Record)
             $logDirectory = Join-Path $InstallRoot 'logs'
@@ -1664,6 +1699,7 @@ function Remove-CcodLifecycleOldRuntimes {
         if ($directory.Name -ceq $ActiveRuntimeId -or $directory.Name -ceq $PreviousRuntimeId) { continue }
         [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $directory.FullName)
         [void](Test-CcodLifecycleRemovePath -Root $InstallRoot -Path $directory.FullName)
+        [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $InstallRoot -Path $directory.FullName)
         Remove-Item -LiteralPath $directory.FullName -Recurse -Force -ErrorAction Stop
     }
 }
@@ -1820,12 +1856,15 @@ function Invoke-CcodInstall {
 
         Write-CcodInstallActivationPhase -Activation $activation -Phase 'InstallingRuntime' -RuntimeId $null -PreviousRuntimeId $(if ($upgrade) { [string]$existingPointer.activeRuntime } else { $null }) -ErrorCode $null -Adapters $adapters -InstallRoot $root | Out-Null
         $stagingDirectory = Copy-CcodLifecycleStaging -SourceRoot $sourceRoot -InstallRoot $root -Adapters $adapters -Files $files
-        $manifest = New-CcodRuntimeManifest -RuntimeDirectory $stagingDirectory -ProjectVersion $projectVersion
+        $manifest = & $adapters.NewRuntimeManifest $stagingDirectory $projectVersion
+        $stagingManifestPath = Join-Path $stagingDirectory 'manifest.json'
+        [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $stagingManifestPath)
         [IO.File]::WriteAllText(
-            (Join-Path $stagingDirectory 'manifest.json'),
+            $stagingManifestPath,
             ($manifest | ConvertTo-Json -Depth 16),
             [Text.UTF8Encoding]::new($false)
         )
+        [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $stagingManifestPath)
         $runtimeId = [string]$manifest.runtimeId
         $validation = Test-CcodRuntimeManifest -RuntimeDirectory $stagingDirectory -ExpectedRuntimeId $runtimeId
         if (-not $validation.Valid) {
@@ -1841,12 +1880,12 @@ function Invoke-CcodInstall {
                 Throw-CcodLifecycleError 'CCOD_INSTALL_RUNTIME_CONFLICT' 'An invalid runtime already occupies the target runtime id' $runtimeRoot
             }
             if ([IO.Directory]::Exists($stagingDirectory)) {
-                try { [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $stagingDirectory); Remove-Item -LiteralPath $stagingDirectory -Recurse -Force -ErrorAction Stop } catch { }
+                try { [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $stagingDirectory); Remove-Item -LiteralPath $stagingDirectory -Recurse -Force -ErrorAction Stop } catch { }
             }
         } else {
             [IO.Directory]::CreateDirectory($runtimeContainer) | Out-Null
             [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $runtimeContainer)
-            [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $stagingDirectory)
+            [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $stagingDirectory)
             [IO.Directory]::Move($stagingDirectory, $runtimeRoot)
             [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $runtimeRoot)
             $runtimeCreated = $true
@@ -1976,7 +2015,7 @@ function Invoke-CcodInstall {
             }
         }
         if (-not $pointerCommitted -and $runtimeCreated -and $null -ne $runtimeRoot -and [IO.Directory]::Exists($runtimeRoot)) {
-            try { [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $runtimeRoot); Remove-Item -LiteralPath $runtimeRoot -Recurse -Force -ErrorAction Stop } catch { }
+            try { [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $runtimeRoot); Remove-Item -LiteralPath $runtimeRoot -Recurse -Force -ErrorAction Stop } catch { }
         }
         if ($errorCode -cne 'CCOD_INSTALL_ACTIVATION_RECEIPT_FAILED') {
             try {
@@ -1996,11 +2035,11 @@ function Invoke-CcodInstall {
             try { & $adapters.ExitLifecycleOwnership $lifecycleOwnership | Out-Null } catch { }
         }
         if ($null -ne $stagingDirectory -and [IO.Directory]::Exists($stagingDirectory)) {
-            try { [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $stagingDirectory); Remove-Item -LiteralPath $stagingDirectory -Recurse -Force -ErrorAction Stop } catch { }
+            try { [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $stagingDirectory); Remove-Item -LiteralPath $stagingDirectory -Recurse -Force -ErrorAction Stop } catch { }
         }
         $stagingRoot = [IO.Path]::GetFullPath((Join-Path $root '.staging'))
         if ([IO.Directory]::Exists($stagingRoot) -and -not (Test-CcodLifecycleReparse -Path $stagingRoot)) {
-            try { [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $stagingRoot); Remove-Item -LiteralPath $stagingRoot -Recurse -Force -ErrorAction Stop } catch { }
+            try { [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $stagingRoot); Remove-Item -LiteralPath $stagingRoot -Recurse -Force -ErrorAction Stop } catch { }
         }
     }
 
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index 92cb918..3f3013a 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -840,6 +840,88 @@ $results += Invoke-CcodTest 'runtime junction is rejected before staging promoti
     }
 }
 
+$results += Invoke-CcodTest 'stable bootstrap leaf junction is rejected before copy' {
+    $source = New-CcodLifecycleTempRoot
+    $install = New-CcodLifecycleTempRoot
+    $target = New-CcodLifecycleTempRoot
+    $nodeRoot = New-CcodLifecycleTempRoot
+    try {
+        New-CcodLifecycleSourceFixture -Root $source | Out-Null
+        [IO.Directory]::CreateDirectory($install) | Out-Null
+        [IO.Directory]::CreateDirectory($target) | Out-Null
+        $bootstrapLink = Join-Path $install 'bootstrap.ps1'
+        New-Item -ItemType Junction -Path $bootstrapLink -Target $target | Out-Null
+        $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
+        Assert-CcodThrows { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters | Out-Null } 'CCOD_INSTALL_REPARSE_PATH'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath $target -Force).Count 'stable bootstrap junction target receives no bytes'
+    } finally {
+        $bootstrapLink = Join-Path $install 'bootstrap.ps1'
+        if (Test-Path -LiteralPath $bootstrapLink) { [IO.Directory]::Delete($bootstrapLink) }
+        foreach ($path in @($source,$install,$target,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
+    }
+}
+
+$results += Invoke-CcodTest 'runtime manifest leaf junction is rejected before write' {
+    $source = New-CcodLifecycleTempRoot
+    $install = New-CcodLifecycleTempRoot
+    $target = New-CcodLifecycleTempRoot
+    $nodeRoot = New-CcodLifecycleTempRoot
+    try {
+        New-CcodLifecycleSourceFixture -Root $source | Out-Null
+        [IO.Directory]::CreateDirectory($target) | Out-Null
+        $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
+        $fake = New-CcodLifecycleFake -NodePath $nodePath
+        $fake.Adapters.NewRuntimeManifest = {
+            param($RuntimeDirectory,$ProjectVersion)
+            $manifest = New-CcodRuntimeManifest -RuntimeDirectory $RuntimeDirectory -ProjectVersion $ProjectVersion
+            New-Item -ItemType Junction -Path (Join-Path $RuntimeDirectory 'manifest.json') -Target $target | Out-Null
+            return $manifest
+        }.GetNewClosure()
+        Assert-CcodThrows { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters | Out-Null } 'CCOD_INSTALL_REPARSE_PATH'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath $target -Force).Count 'runtime manifest junction target receives no bytes'
+    } finally {
+        foreach ($staging in @(Get-ChildItem -LiteralPath (Join-Path $install '.staging') -Directory -ErrorAction SilentlyContinue)) {
+            $link = Join-Path $staging.FullName 'manifest.json'
+            if (Test-Path -LiteralPath $link) { [IO.Directory]::Delete($link) }
+        }
+        foreach ($path in @($source,$install,$target,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
+    }
+}
+
+$results += Invoke-CcodTest 'staging cleanup refuses a nested junction after copy failure' {
+    $source = New-CcodLifecycleTempRoot
+    $install = New-CcodLifecycleTempRoot
+    $target = New-CcodLifecycleTempRoot
+    $nodeRoot = New-CcodLifecycleTempRoot
+    try {
+        New-CcodLifecycleSourceFixture -Root $source | Out-Null
+        [IO.Directory]::CreateDirectory($target) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $target 'sentinel.txt'),'keep',[Text.UTF8Encoding]::new($false))
+        $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
+        $fake = New-CcodLifecycleFake -NodePath $nodePath
+        $fake.World.CopyOverride = [pscustomobject]@{
+            Match = '*Supervisor.ps1'
+            Action = {
+                param($SourcePath,$DestinationPath)
+                $stagingDirectory = Split-Path (Split-Path (Split-Path $DestinationPath -Parent) -Parent) -Parent
+                [IO.Directory]::CreateDirectory($stagingDirectory) | Out-Null
+                New-Item -ItemType Junction -Path (Join-Path $stagingDirectory 'cleanup-escape') -Target $target | Out-Null
+                throw 'PRIVATE_COPY_FAILURE_AFTER_JUNCTION'
+            }.GetNewClosure()
+        }
+        Assert-CcodThrows { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters | Out-Null } 'CCOD_INSTALL_STAGING_FAILED'
+        $retained = @(Get-ChildItem -LiteralPath (Join-Path $install '.staging') -Directory -ErrorAction SilentlyContinue | Where-Object { Test-Path -LiteralPath (Join-Path $_.FullName 'cleanup-escape') })
+        Assert-CcodEqual 1 $retained.Count 'unsafe staging tree is retained instead of recursively deleted'
+        Assert-CcodEqual 'keep' ([IO.File]::ReadAllText((Join-Path $target 'sentinel.txt'))) 'cleanup never deletes through the nested junction'
+    } finally {
+        foreach ($staging in @(Get-ChildItem -LiteralPath (Join-Path $install '.staging') -Directory -ErrorAction SilentlyContinue)) {
+            $link = Join-Path $staging.FullName 'cleanup-escape'
+            if (Test-Path -LiteralPath $link) { [IO.Directory]::Delete($link) }
+        }
+        foreach ($path in @($source,$install,$target,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
+    }
+}
+
 $results += Invoke-CcodTest 'payload manifest ancestry treats Windows root equality case-insensitively' {
     $source = New-CcodLifecycleTempRoot
     $install = New-CcodLifecycleTempRoot
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index be03513..d51bf1b 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -316,17 +316,25 @@ Invoke-CcodTest 'Inno exposes a pre-write payload-directory reparse gate' {
     $inno = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw -Encoding UTF8
     $helper = [regex]::Match($inno,'(?ms)^function IsSafeExistingPayloadDirectory\(.*?^end;')
     Assert-CcodTrue $helper.Success 'production Inno script exposes the directory predicate used before payload writes'
-    Assert-CcodTrue ($inno -cmatch '(?ms)^function PrepareToInstall\(var NeedsRestart: Boolean\): String;.*?IsSafeExistingPayloadDirectory') 'PrepareToInstall rejects unsafe app and payload directories before file copy'
+    $treeHelper = [regex]::Match($inno,'(?ms)^function IsSafeExistingSetupTree\(.*?^end;')
+    Assert-CcodTrue $treeHelper.Success 'production Inno script exposes a recursive destination-tree predicate'
+    Assert-CcodTrue ($inno -cmatch '(?ms)^function PrepareToInstall\(var NeedsRestart: Boolean\): String;.*?IsSafeExistingSetupTree') 'PrepareToInstall rejects unsafe nested setup destinations before file copy'
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-inno-reparse-harness-' + [guid]::NewGuid().ToString('N'))
     try {
         $normal = Join-Path $root 'normal'
         $target = Join-Path $root 'target'
         $junction = Join-Path $root 'junction'
         $missing = Join-Path $root 'missing'
+        $tree = Join-Path $root 'tree'
+        $nested = Join-Path $tree 'src\escape'
+        $fileDirectory = Join-Path $root 'file-as-directory'
         $resultPath = Join-Path $root 'result.txt'
         [IO.Directory]::CreateDirectory($normal) | Out-Null
         [IO.Directory]::CreateDirectory($target) | Out-Null
+        [IO.Directory]::CreateDirectory((Split-Path $nested -Parent)) | Out-Null
         New-Item -ItemType Junction -Path $junction -Target $target | Out-Null
+        New-Item -ItemType Junction -Path $nested -Target $target | Out-Null
+        [IO.File]::WriteAllText($fileDirectory,'not a directory',[Text.UTF8Encoding]::new($false))
         $harnessPath = Join-Path $root 'ReparseGate.iss'
         $harness = @"
 [Setup]
@@ -345,11 +353,14 @@ const
 function GetFileAttributesW(const FileName: String): Cardinal;
   external 'GetFileAttributesW@kernel32.dll stdcall';
 $($helper.Value)
+$($treeHelper.Value)
 function InitializeSetup(): Boolean;
 begin
   if IsSafeExistingPayloadDirectory('$($normal.Replace("'","''"))') and
      IsSafeExistingPayloadDirectory('$($missing.Replace("'","''"))') and
-     (not IsSafeExistingPayloadDirectory('$($junction.Replace("'","''"))')) then
+     (not IsSafeExistingPayloadDirectory('$($junction.Replace("'","''"))')) and
+     (not IsSafeExistingSetupTree('$($tree.Replace("'","''"))')) and
+     (not IsSafeExistingSetupTree('$($fileDirectory.Replace("'","''"))')) then
     SaveStringToFile('$($resultPath.Replace("'","''"))','pass',False);
   Result := False;
 end;
@@ -360,7 +371,7 @@ end;
         Assert-CcodEqual 0 $LASTEXITCODE "reparse predicate harness compiles: $($compileOutput -join ' ')"
         $process = Start-Process -FilePath (Join-Path $root 'ReparseGate.exe') -ArgumentList @('/VERYSILENT','/SUPPRESSMSGBOXES','/NORESTART','/SP-') -WindowStyle Hidden -Wait -PassThru
         try { $null = $process.ExitCode } finally { $process.Dispose() }
-        Assert-CcodEqual 'pass' ([IO.File]::ReadAllText($resultPath,[Text.UTF8Encoding]::new($false))) 'production predicate accepts absent/normal directories and rejects a junction'
+        Assert-CcodEqual 'pass' ([IO.File]::ReadAllText($resultPath,[Text.UTF8Encoding]::new($false))) 'production predicate rejects root/nested junctions and file-valued directory paths'
     } finally {
         if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
     }

From 6dcb725a8a6fae4e3f1178d7c69ada060f8fb8ac Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 02:52:27 +0800
Subject: [PATCH 006/187] fix: inventory all setup destination directories

---
 build/CodexControlOtherDevices.iss            | 44 ++++++----
 build/build.ps1                               | 15 +++-
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 73 ++++++++++++++--
 tools/New-InstallerDestinationInventory.ps1   | 83 +++++++++++++++++++
 4 files changed, 193 insertions(+), 22 deletions(-)
 create mode 100644 tools/New-InstallerDestinationInventory.ps1

diff --git a/build/CodexControlOtherDevices.iss b/build/CodexControlOtherDevices.iss
index 4e79f0e..c9da999 100644
--- a/build/CodexControlOtherDevices.iss
+++ b/build/CodexControlOtherDevices.iss
@@ -11,6 +11,9 @@
 #ifndef InstallerPayloadManifestSha256
 #error InstallerPayloadManifestSha256 must be supplied by the release builder
 #endif
+#ifndef InstallerDestinationInventoryInclude
+#error InstallerDestinationInventoryInclude must be supplied by the release builder
+#endif
 AppId={{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}
 AppName=CodexRemote-fix
 AppVersion={#ProjectVersion}
@@ -75,6 +78,7 @@ Source: "..\Test-CodexControlOtherDevices.ps1"; DestDir: "{app}"; Flags: ignorev
 Source: "..\Activate-CcodRemoteFix.ps1"; DestDir: "{app}"; Flags: ignoreversion
 Source: "..\Prompt-CcodRestart.ps1"; DestDir: "{app}"; Flags: ignoreversion
 Source: "..\tools\New-InstallerPayloadManifest.ps1"; DestDir: "{app}\tools"; Flags: ignoreversion
+Source: "..\tools\New-InstallerDestinationInventory.ps1"; DestDir: "{app}\tools"; Flags: ignoreversion
 Source: "{#InstallerPayloadDirectory}\*"; DestDir: "{app}\payload\{#ProjectVersion}"; Flags: ignoreversion recursesubdirs createallsubdirs
 
 [InstallDelete]
@@ -95,6 +99,7 @@ Name: "{group}\Uninstall CodexRemote-fix"; Filename: "{app}\unins000.exe"; IconF
 Name: "{userdesktop}\CodexRemote-fix"; Filename: "{sys}\WindowsPowerShell\v1.0\powershell.exe"; Parameters: "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File ""{localappdata}\CodexControlOtherDevices\bootstrap.ps1"" -InstallRoot ""{localappdata}\CodexControlOtherDevices"" -EntryMode Explicit"; WorkingDir: "{localappdata}\CodexControlOtherDevices"; IconFilename: "{app}\assets\CodexRemote-fix.ico"
 
 [Code]
+#include InstallerDestinationInventoryInclude
 const
   ACTIVATION_TIMEOUT_MILLISECONDS = 300000;
   FIRST_ACTIVATION_RECEIPT_TIMEOUT_MILLISECONDS = 90000;
@@ -165,27 +170,36 @@ begin
   end;
 end;
 
+function AreCcodExpectedSetupDirectoriesSafe(const AppDirectory: String): Boolean;
+var
+  Directories: TStringList;
+  Index: Integer;
+  Candidate: String;
+begin
+  Result := False;
+  Directories := TStringList.Create;
+  try
+    AddCcodExpectedSetupDirectories(Directories);
+    if Directories.Count = 0 then Exit;
+    for Index := 0 to Directories.Count - 1 do
+    begin
+      Candidate := AddBackslash(AppDirectory) + Directories[Index];
+      if not IsSafeExistingPayloadDirectory(Candidate) then Exit;
+    end;
+    Result := True;
+  finally
+    Directories.Free;
+  end;
+end;
+
 function PrepareToInstall(var NeedsRestart: Boolean): String;
 var
-  AppDirectory, PayloadDirectory, VersionDirectory: String;
+  AppDirectory: String;
 begin
   Result := '';
   AppDirectory := ExpandConstant('{app}');
-  PayloadDirectory := ExpandConstant('{app}\payload');
-  VersionDirectory := ExpandConstant('{app}\payload\{#ProjectVersion}');
   if not IsSafeExistingSetupTree(AppDirectory) or
-     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\build')) or
-     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\bin')) or
-     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\.github')) or
-     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\.github\workflows')) or
-     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\assets')) or
-     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\assets\codexremote-fix')) or
-     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\docs')) or
-     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\src')) or
-     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\tests')) or
-     not IsSafeExistingPayloadDirectory(ExpandConstant('{app}\tools')) or
-     not IsSafeExistingPayloadDirectory(PayloadDirectory) or
-     not IsSafeExistingPayloadDirectory(VersionDirectory) then
+     not AreCcodExpectedSetupDirectoriesSafe(AppDirectory) then
     Result := 'CodexRemote-fix refused an unsafe existing payload directory.';
 end;
 
diff --git a/build/build.ps1 b/build/build.ps1
index 27b0b29..da5a147 100644
--- a/build/build.ps1
+++ b/build/build.ps1
@@ -139,6 +139,7 @@ foreach ($path in @($bundle,$checksum,$provenance,$payloadManifestAsset,$release
 
 $stageRoot = Join-Path $PSScriptRoot ('.portable-stage-' + [guid]::NewGuid().ToString('N'))
 $installerPayloadDirectory = Join-Path $PSScriptRoot ('.installer-payload-stage-' + [guid]::NewGuid().ToString('N'))
+$installerDestinationInventoryPath = Join-Path $PSScriptRoot ('.installer-destination-inventory-' + [guid]::NewGuid().ToString('N') + '.iss')
 try {
     [IO.Directory]::CreateDirectory($stageRoot) | Out-Null
     $payloadRoot = Join-Path $stageRoot 'payload'
@@ -204,6 +205,9 @@ try {
         }
     }
     $installerPayloadManifestSha256 = Get-CcodBuildFileSha256 -Path $installerPayloadManifestPath
+    $destinationInventoryGenerator = Join-Path $repoRoot 'tools\New-InstallerDestinationInventory.ps1'
+    if (-not [IO.File]::Exists($destinationInventoryGenerator)) { throw "Installer destination inventory generator is missing: $destinationInventoryGenerator" }
+    & $destinationInventoryGenerator -RepositoryRoot $repoRoot -PayloadRoot $installerPayloadDirectory -ProjectVersion $Version -InnoScriptPath (Join-Path $PSScriptRoot 'CodexControlOtherDevices.iss') -OutputPath $installerDestinationInventoryPath | Out-Null
     $payloadManifestPath = Join-Path $stageRoot 'payload-manifest.json'
     $payloadManifest = [ordered]@{
         schemaVersion = 1
@@ -275,7 +279,7 @@ $iscc = $isccCandidates | Where-Object { -not [string]::IsNullOrWhiteSpace($_) -
 if (-not $iscc) { throw 'Inno Setup 6 (ISCC.exe) was not found. Install it with: winget install --id JRSoftware.InnoSetup --exact' }
 $issPath = Join-Path $PSScriptRoot 'CodexControlOtherDevices.iss'
 $portableArtifact = Join-Path $PSScriptRoot 'generated\portable'
-& $iscc "/DProjectVersion=$Version" "/DTrayHostArtifactDirectory=$trayHostArtifact" "/DPortableArtifactDirectory=$portableArtifact" "/DInstallerPayloadDirectory=$installerPayloadDirectory" "/DInstallerPayloadManifestSha256=$installerPayloadManifestSha256" "/O$dist\." $issPath
+& $iscc "/DProjectVersion=$Version" "/DTrayHostArtifactDirectory=$trayHostArtifact" "/DPortableArtifactDirectory=$portableArtifact" "/DInstallerPayloadDirectory=$installerPayloadDirectory" "/DInstallerPayloadManifestSha256=$installerPayloadManifestSha256" "/DInstallerDestinationInventoryInclude=$installerDestinationInventoryPath" "/O$dist\." $issPath
 if ($LASTEXITCODE -ne 0 -or -not (Test-Path -LiteralPath $setupExe -PathType Leaf)) {
     throw "Inno Setup compilation failed with exit code $LASTEXITCODE"
 }
@@ -313,3 +317,12 @@ if ([IO.Directory]::Exists($installerPayloadDirectory)) {
         Remove-Item -LiteralPath $installerPayloadFull -Recurse -Force -ErrorAction SilentlyContinue
     }
 }
+if ([IO.File]::Exists($installerDestinationInventoryPath)) {
+    $inventoryFull = [IO.Path]::GetFullPath($installerDestinationInventoryPath)
+    $buildFull = [IO.Path]::GetFullPath($PSScriptRoot).TrimEnd('\') + '\'
+    if ($inventoryFull.StartsWith($buildFull,[StringComparison]::OrdinalIgnoreCase) -and
+        [IO.Path]::GetFileName($inventoryFull).StartsWith('.installer-destination-inventory-',[StringComparison]::Ordinal) -and
+        -not ((Get-Item -LiteralPath $inventoryFull -Force).Attributes -band [IO.FileAttributes]::ReparsePoint)) {
+        Remove-Item -LiteralPath $inventoryFull -Force -ErrorAction SilentlyContinue
+    }
+}
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index d51bf1b..1013c1b 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -104,6 +104,23 @@ Invoke-CcodTest 'production installer payload generator writes ordered version-b
     }
 }
 
+Invoke-CcodTest 'production setup destination inventory derives every nested directory from Inno sources and payload input' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-installer-directory-inventory-' + [guid]::NewGuid().ToString('N'))
+    try {
+        $payload = Join-Path $root 'payload'
+        [IO.Directory]::CreateDirectory((Join-Path $payload 'src\persistence\modules')) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $payload 'src\persistence\modules\InstallLifecycle.psm1'),'fixture',[Text.UTF8Encoding]::new($false))
+        $output = Join-Path $root 'InstallerDestinationInventory.iss'
+        & (Join-Path $repositoryRoot 'tools\New-InstallerDestinationInventory.ps1') -RepositoryRoot $repositoryRoot -PayloadRoot $payload -ProjectVersion '2.5.22' -InnoScriptPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -OutputPath $output | Out-Null
+        $inventory = [IO.File]::ReadAllText($output,[Text.UTF8Encoding]::new($false))
+        foreach ($relative in @('src','src\persistence','src\persistence\modules','payload','payload\2.5.22','payload\2.5.22\src','payload\2.5.22\src\persistence','payload\2.5.22\src\persistence\modules')) {
+            Assert-CcodTrue ($inventory.Contains("Directories.Add('$relative');")) "generated setup inventory contains $relative"
+        }
+    } finally {
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
 function New-CcodActivationPayloadFixture {
     param([string]$Version = '2.5.22')
 
@@ -138,7 +155,7 @@ function Invoke-CcodActivationVerifierFixture {
 }
 
 function Invoke-CcodInnoPayloadCompileFixture {
-    param([switch]$IncludePayloadDefines)
+    param([switch]$IncludePayloadDefines,[switch]$OmitDestinationInventory)
 
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-inno-payload-contract-' + [guid]::NewGuid().ToString('N'))
     $tray = Join-Path $root 'tray'
@@ -157,6 +174,8 @@ function Invoke-CcodInnoPayloadCompileFixture {
     $manifest = [ordered]@{schemaVersion=1;projectVersion='2.5.21';files=@([ordered]@{path='package.json';length=[int64](Get-Item -LiteralPath (Join-Path $payload 'package.json')).Length;sha256=$packageHash})}
     $manifestPath = Join-Path $payload 'installer-payload.manifest.json'
     [IO.File]::WriteAllText($manifestPath,($manifest|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+    $inventoryPath = Join-Path $root 'InstallerDestinationInventory.iss'
+    & (Join-Path $repositoryRoot 'tools\New-InstallerDestinationInventory.ps1') -RepositoryRoot $repositoryRoot -PayloadRoot $payload -ProjectVersion '2.5.21' -InnoScriptPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -OutputPath $inventoryPath | Out-Null
     $iscc = @(
         (Join-Path $env:LOCALAPPDATA 'Programs\Inno Setup 6\ISCC.exe'),
         (Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'),
@@ -165,7 +184,9 @@ function Invoke-CcodInnoPayloadCompileFixture {
     if (-not $iscc) { throw 'Inno Setup 6 is required for the setup payload contract' }
     $arguments = @('/DProjectVersion=2.5.21',"/DTrayHostArtifactDirectory=$tray","/DPortableArtifactDirectory=$portable","/O$output\",(Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss'))
     if ($IncludePayloadDefines) {
-        $arguments = @('/DProjectVersion=2.5.21',"/DTrayHostArtifactDirectory=$tray","/DPortableArtifactDirectory=$portable","/DInstallerPayloadDirectory=$payload","/DInstallerPayloadManifestSha256=$(Get-CcodTestFileSha256 -Path $manifestPath)","/O$output\",(Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss'))
+        $arguments = @('/DProjectVersion=2.5.21',"/DTrayHostArtifactDirectory=$tray","/DPortableArtifactDirectory=$portable","/DInstallerPayloadDirectory=$payload","/DInstallerPayloadManifestSha256=$(Get-CcodTestFileSha256 -Path $manifestPath)")
+        if (-not $OmitDestinationInventory) { $arguments += "/DInstallerDestinationInventoryInclude=$inventoryPath" }
+        $arguments += @("/O$output\",(Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss'))
     }
     $previousPreference = $ErrorActionPreference
     try {
@@ -182,7 +203,7 @@ Invoke-CcodTest 'setup build and activation bind one immutable versioned payload
     $activation = Get-Content -LiteralPath (Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1') -Raw -Encoding UTF8
     $installer = Get-Content -LiteralPath (Join-Path $repositoryRoot 'Install-CodexControlOtherDevices.ps1') -Raw -Encoding UTF8
 
-    Assert-CcodTrue ($build -cmatch 'New-InstallerPayloadManifest\.ps1' -and $build -cmatch 'InstallerPayloadManifestSha256') 'build invokes the tested generator and binds its manifest hash into setup compilation'
+    Assert-CcodTrue ($build -cmatch 'New-InstallerPayloadManifest\.ps1' -and $build -cmatch 'New-InstallerDestinationInventory\.ps1' -and $build -cmatch 'InstallerPayloadManifestSha256' -and $build -cmatch 'InstallerDestinationInventoryInclude') 'build invokes the tested generators and binds their outputs into setup compilation'
     Assert-CcodTrue ($inno -cmatch 'InstallerPayloadDirectory' -and $inno -cmatch 'DestDir:\s*"\{app\}\\payload\\\{#ProjectVersion\}"') 'Inno copies the immutable build payload into its exact version directory'
     Assert-CcodTrue ($inno -cmatch "ExpandConstant\('\{app\}\\payload\\\{#ProjectVersion\}'\)" -and $inno -cmatch '-ExpectedVersion\s+"\{#ProjectVersion\}') 'Inno binds activation to its compiled payload version'
     Assert-CcodTrue ($activation -cmatch '\[string\]\$ExpectedVersion' -and $activation -cmatch '\[string\]\$ExpectedPayloadManifestSha256' -and $activation -cmatch 'installer-payload\.manifest\.json') 'activation accepts and resolves the expected payload contract'
@@ -306,7 +327,18 @@ Invoke-CcodTest 'Inno compile packages the explicit manifest-bound installer pay
     try {
         Assert-CcodEqual 0 $compile.ExitCode "explicit setup payload contract compiles: $($compile.Output)"
         Assert-CcodTrue (Test-Path -LiteralPath $compile.SetupPath -PathType Leaf) 'explicit payload compile produces the setup artifact'
-        Assert-CcodTrue ($compile.Output -cmatch 'installer-payload\.manifest\.json' -and $compile.Output -cmatch 'payload\\package\.json') 'compiler input trace contains the exact payload manifest and manifest-listed file'
+        Assert-CcodTrue ($compile.Output -cmatch 'InstallerDestinationInventory\.iss' -and $compile.Output -cmatch 'installer-payload\.manifest\.json' -and $compile.Output -cmatch 'payload\\package\.json') 'compiler input trace contains the destination inventory, payload manifest, and manifest-listed file'
+    } finally {
+        if (Test-Path -LiteralPath $compile.Root) { Remove-Item -LiteralPath $compile.Root -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'Inno compile refuses a missing generated destination inventory' {
+    $compile = Invoke-CcodInnoPayloadCompileFixture -IncludePayloadDefines -OmitDestinationInventory
+    try {
+        Assert-CcodTrue ($compile.ExitCode -ne 0) 'setup compilation fails when only the destination inventory define is omitted'
+        Assert-CcodTrue ($compile.Output -cmatch 'InstallerDestinationInventoryInclude') 'compiler identifies the missing generated inventory define'
+        Assert-CcodTrue (-not (Test-Path -LiteralPath $compile.SetupPath)) 'missing inventory define produces no setup artifact'
     } finally {
         if (Test-Path -LiteralPath $compile.Root) { Remove-Item -LiteralPath $compile.Root -Recurse -Force }
     }
@@ -318,7 +350,9 @@ Invoke-CcodTest 'Inno exposes a pre-write payload-directory reparse gate' {
     Assert-CcodTrue $helper.Success 'production Inno script exposes the directory predicate used before payload writes'
     $treeHelper = [regex]::Match($inno,'(?ms)^function IsSafeExistingSetupTree\(.*?^end;')
     Assert-CcodTrue $treeHelper.Success 'production Inno script exposes a recursive destination-tree predicate'
-    Assert-CcodTrue ($inno -cmatch '(?ms)^function PrepareToInstall\(var NeedsRestart: Boolean\): String;.*?IsSafeExistingSetupTree') 'PrepareToInstall rejects unsafe nested setup destinations before file copy'
+    $inventoryValidator = [regex]::Match($inno,'(?ms)^function AreCcodExpectedSetupDirectoriesSafe\(.*?^end;')
+    Assert-CcodTrue $inventoryValidator.Success 'production Inno script exposes a generated destination-inventory validator'
+    Assert-CcodTrue ($inno -cmatch 'InstallerDestinationInventoryInclude' -and $inno -cmatch '(?ms)^function PrepareToInstall\(var NeedsRestart: Boolean\): String;.*?AreCcodExpectedSetupDirectoriesSafe') 'PrepareToInstall consumes the compile-bound generated inventory before file copy'
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-inno-reparse-harness-' + [guid]::NewGuid().ToString('N'))
     try {
         $normal = Join-Path $root 'normal'
@@ -328,6 +362,12 @@ Invoke-CcodTest 'Inno exposes a pre-write payload-directory reparse gate' {
         $tree = Join-Path $root 'tree'
         $nested = Join-Path $tree 'src\escape'
         $fileDirectory = Join-Path $root 'file-as-directory'
+        $expectedFileRoot = Join-Path $root 'expected-file-root'
+        $expectedJunctionRoot = Join-Path $root 'expected-junction-root'
+        $normalExpectedRoot = Join-Path $root 'normal-expected-root'
+        $inventoryPayload = Join-Path $root 'inventory-payload'
+        $fileWriteMarker = Join-Path $expectedFileRoot 'payload-write-marker.txt'
+        $junctionWriteMarker = Join-Path $expectedJunctionRoot 'payload-write-marker.txt'
         $resultPath = Join-Path $root 'result.txt'
         [IO.Directory]::CreateDirectory($normal) | Out-Null
         [IO.Directory]::CreateDirectory($target) | Out-Null
@@ -335,6 +375,16 @@ Invoke-CcodTest 'Inno exposes a pre-write payload-directory reparse gate' {
         New-Item -ItemType Junction -Path $junction -Target $target | Out-Null
         New-Item -ItemType Junction -Path $nested -Target $target | Out-Null
         [IO.File]::WriteAllText($fileDirectory,'not a directory',[Text.UTF8Encoding]::new($false))
+        [IO.Directory]::CreateDirectory((Join-Path $expectedFileRoot 'src')) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $expectedFileRoot 'src\persistence'),'not a directory',[Text.UTF8Encoding]::new($false))
+        [IO.Directory]::CreateDirectory((Join-Path $expectedJunctionRoot 'payload\2.5.22\src')) | Out-Null
+        New-Item -ItemType Junction -Path (Join-Path $expectedJunctionRoot 'payload\2.5.22\src\persistence') -Target $target | Out-Null
+        [IO.Directory]::CreateDirectory($normalExpectedRoot) | Out-Null
+        [IO.Directory]::CreateDirectory((Join-Path $inventoryPayload 'src\persistence\modules')) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $inventoryPayload 'src\persistence\modules\InstallLifecycle.psm1'),'fixture',[Text.UTF8Encoding]::new($false))
+        $inventoryPath = Join-Path $root 'InventoryFixture.iss'
+        & (Join-Path $repositoryRoot 'tools\New-InstallerDestinationInventory.ps1') -RepositoryRoot $repositoryRoot -PayloadRoot $inventoryPayload -ProjectVersion '2.5.22' -InnoScriptPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -OutputPath $inventoryPath | Out-Null
+        $inventorySource = [IO.File]::ReadAllText($inventoryPath,[Text.UTF8Encoding]::new($false))
         $harnessPath = Join-Path $root 'ReparseGate.iss'
         $harness = @"
 [Setup]
@@ -354,13 +404,22 @@ function GetFileAttributesW(const FileName: String): Cardinal;
   external 'GetFileAttributesW@kernel32.dll stdcall';
 $($helper.Value)
 $($treeHelper.Value)
+$inventorySource
+$($inventoryValidator.Value)
 function InitializeSetup(): Boolean;
 begin
+  if AreCcodExpectedSetupDirectoriesSafe('$($expectedFileRoot.Replace("'","''"))') then
+    SaveStringToFile('$($fileWriteMarker.Replace("'","''"))','unsafe write',False);
+  if AreCcodExpectedSetupDirectoriesSafe('$($expectedJunctionRoot.Replace("'","''"))') then
+    SaveStringToFile('$($junctionWriteMarker.Replace("'","''"))','unsafe write',False);
   if IsSafeExistingPayloadDirectory('$($normal.Replace("'","''"))') and
      IsSafeExistingPayloadDirectory('$($missing.Replace("'","''"))') and
      (not IsSafeExistingPayloadDirectory('$($junction.Replace("'","''"))')) and
      (not IsSafeExistingSetupTree('$($tree.Replace("'","''"))')) and
-     (not IsSafeExistingSetupTree('$($fileDirectory.Replace("'","''"))')) then
+     (not IsSafeExistingSetupTree('$($fileDirectory.Replace("'","''"))')) and
+     AreCcodExpectedSetupDirectoriesSafe('$($normalExpectedRoot.Replace("'","''"))') and
+     (not AreCcodExpectedSetupDirectoriesSafe('$($expectedFileRoot.Replace("'","''"))')) and
+     (not AreCcodExpectedSetupDirectoriesSafe('$($expectedJunctionRoot.Replace("'","''"))')) then
     SaveStringToFile('$($resultPath.Replace("'","''"))','pass',False);
   Result := False;
 end;
@@ -372,6 +431,8 @@ end;
         $process = Start-Process -FilePath (Join-Path $root 'ReparseGate.exe') -ArgumentList @('/VERYSILENT','/SUPPRESSMSGBOXES','/NORESTART','/SP-') -WindowStyle Hidden -Wait -PassThru
         try { $null = $process.ExitCode } finally { $process.Dispose() }
         Assert-CcodEqual 'pass' ([IO.File]::ReadAllText($resultPath,[Text.UTF8Encoding]::new($false))) 'production predicate rejects root/nested junctions and file-valued directory paths'
+        Assert-CcodTrue (-not (Test-Path -LiteralPath $fileWriteMarker)) 'nested file-as-directory is rejected before simulated payload writes'
+        Assert-CcodTrue (-not (Test-Path -LiteralPath $junctionWriteMarker)) 'nested junction is rejected before simulated payload writes'
     } finally {
         if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
     }
diff --git a/tools/New-InstallerDestinationInventory.ps1 b/tools/New-InstallerDestinationInventory.ps1
new file mode 100644
index 0000000..6c0ba4b
--- /dev/null
+++ b/tools/New-InstallerDestinationInventory.ps1
@@ -0,0 +1,83 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)][string]$RepositoryRoot,
+    [Parameter(Mandatory)][string]$PayloadRoot,
+    [Parameter(Mandatory)][string]$ProjectVersion,
+    [Parameter(Mandatory)][string]$InnoScriptPath,
+    [Parameter(Mandatory)][string]$OutputPath
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+if ($ProjectVersion -cnotmatch '^\d+\.\d+\.\d+$') { throw "Invalid project version: $ProjectVersion" }
+$repository = [IO.Path]::GetFullPath($RepositoryRoot).TrimEnd('\')
+$payload = [IO.Path]::GetFullPath($PayloadRoot).TrimEnd('\')
+$inno = [IO.Path]::GetFullPath($InnoScriptPath)
+$output = [IO.Path]::GetFullPath($OutputPath)
+if (-not [IO.Directory]::Exists($repository) -or -not [IO.Directory]::Exists($payload) -or -not [IO.File]::Exists($inno)) { throw 'Setup destination inventory input is missing.' }
+if ([IO.File]::Exists($output) -or [IO.Directory]::Exists($output)) { throw "Refusing to overwrite setup destination inventory: $output" }
+
+$directories = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+function Add-CcodExpectedDirectory {
+    param([Parameter(Mandatory)][AllowEmptyString()][string]$Relative)
+    $normalized = $Relative.Replace('/','\').Trim('\')
+    if ([string]::IsNullOrWhiteSpace($normalized)) { return }
+    if ($normalized -notmatch '^[A-Za-z0-9._-]+(?:\\[A-Za-z0-9._-]+)*$') { throw "Unsafe setup destination directory: $normalized" }
+    $segments = $normalized -split '\\'
+    $current = ''
+    foreach ($segment in $segments) {
+        $current = if ([string]::IsNullOrEmpty($current)) { $segment } else { "$current\$segment" }
+        [void]$directories.Add($current)
+    }
+}
+
+$lines = @(Get-Content -LiteralPath $inno -Encoding UTF8)
+$insideFiles = $false
+foreach ($line in $lines) {
+    if ($line -ceq '[Files]') { $insideFiles = $true; continue }
+    if ($insideFiles -and $line -match '^\[') { break }
+    if (-not $insideFiles -or [string]::IsNullOrWhiteSpace($line)) { continue }
+    $match = [regex]::Match($line,'^Source:\s*"(?<source>[^"]+)";\s*DestDir:\s*"(?<destination>[^"]+)";(?<tail>.*)$')
+    if (-not $match.Success) { throw "Unsupported [Files] entry for destination inventory: $line" }
+    $destination = $match.Groups['destination'].Value.Replace('{#ProjectVersion}',$ProjectVersion)
+    if (-not $destination.StartsWith('{app}',[StringComparison]::Ordinal)) { throw "Setup destination is outside app root: $destination" }
+    $destinationRelative = $destination.Substring(5).TrimStart('\')
+    Add-CcodExpectedDirectory -Relative $destinationRelative
+    if ($match.Groups['tail'].Value -cnotmatch '(?:^|\s)recursesubdirs(?:\s|$)') { continue }
+
+    $sourceExpression = $match.Groups['source'].Value
+    $sourceRoot = $null
+    if ($sourceExpression.StartsWith('{#InstallerPayloadDirectory}',[StringComparison]::Ordinal)) {
+        $sourceRoot = $payload
+    } elseif ($sourceExpression.StartsWith('..\',[StringComparison]::Ordinal) -and $sourceExpression.EndsWith('\*',[StringComparison]::Ordinal)) {
+        $sourceRoot = [IO.Path]::GetFullPath((Join-Path (Split-Path $inno -Parent) $sourceExpression.Substring(0,$sourceExpression.Length-2)))
+    } else {
+        throw "Recursive [Files] source cannot be inventoried deterministically: $sourceExpression"
+    }
+    if (-not [IO.Directory]::Exists($sourceRoot)) { throw "Recursive [Files] source root is missing: $sourceRoot" }
+    $sourcePrefix = $sourceRoot.TrimEnd('\') + '\'
+    foreach ($entry in @(Get-ChildItem -LiteralPath $sourceRoot -Force -Recurse -ErrorAction Stop)) {
+        if (($entry.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw "Recursive [Files] source contains a reparse point: $($entry.FullName)" }
+        $relativeDirectory = if ($entry.PSIsContainer) {
+            $entry.FullName.Substring($sourcePrefix.Length)
+        } else {
+            $parent = Split-Path $entry.FullName -Parent
+            if ($parent.Equals($sourceRoot,[StringComparison]::OrdinalIgnoreCase)) { '' } else { $parent.Substring($sourcePrefix.Length) }
+        }
+        if (-not [string]::IsNullOrWhiteSpace($relativeDirectory)) {
+            Add-CcodExpectedDirectory -Relative $(if ([string]::IsNullOrWhiteSpace($destinationRelative)) { $relativeDirectory } else { "$destinationRelative\$relativeDirectory" })
+        }
+    }
+}
+if (-not $insideFiles -or $directories.Count -eq 0) { throw 'No setup destination directories were generated.' }
+$ordered = [Collections.Generic.List[string]]::new()
+foreach ($directory in $directories) { $ordered.Add($directory) }
+$ordered.Sort([StringComparer]::Ordinal)
+$builder = [Text.StringBuilder]::new()
+[void]$builder.AppendLine('procedure AddCcodExpectedSetupDirectories(Directories: TStrings);')
+[void]$builder.AppendLine('begin')
+foreach ($directory in $ordered) { [void]$builder.AppendLine("  Directories.Add('$directory');") }
+[void]$builder.AppendLine('end;')
+[IO.File]::WriteAllText($output,$builder.ToString(),[Text.UTF8Encoding]::new($false))
+Write-Output ([pscustomobject]@{Path=$output;Directories=@($ordered)})

From 8611e73b2c51761c260e064b649d86f925735968 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 02:59:37 +0800
Subject: [PATCH 007/187] fix: require one Inno Files section

---
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 35 +++++++++++++++++++
 tools/New-InstallerDestinationInventory.ps1   |  4 ++-
 2 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 1013c1b..0c00285 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -121,6 +121,41 @@ Invoke-CcodTest 'production setup destination inventory derives every nested dir
     }
 }
 
+Invoke-CcodTest 'production setup destination inventory rejects multiple Files sections' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-installer-multiple-files-sections-' + [guid]::NewGuid().ToString('N'))
+    try {
+        $payload = Join-Path $root 'payload'
+        [IO.Directory]::CreateDirectory($payload) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $payload 'package.json'),'{}',[Text.UTF8Encoding]::new($false))
+        $innoPath = Join-Path $root 'MultipleFilesSections.iss'
+        $innoSource = @'
+[Setup]
+AppName=Fixture
+AppVersion=1.0.0
+DefaultDirName={app}
+[Files]
+Source: "fixture-a.txt"; DestDir: "{app}\first"; Flags: ignoreversion
+[Code]
+procedure Fixture();
+begin
+end;
+[Files]
+Source: "fixture-b.txt"; DestDir: "{app}\second"; Flags: ignoreversion
+'@
+        [IO.File]::WriteAllText($innoPath,$innoSource,[Text.UTF8Encoding]::new($false))
+        $output = Join-Path $root 'Inventory.iss'
+        $failure = $null
+        try {
+            & (Join-Path $repositoryRoot 'tools\New-InstallerDestinationInventory.ps1') -RepositoryRoot $repositoryRoot -PayloadRoot $payload -ProjectVersion '2.5.22' -InnoScriptPath $innoPath -OutputPath $output | Out-Null
+        } catch { $failure = $_ }
+        Assert-CcodTrue ($null -ne $failure) 'generator fails closed when the Inno source contains multiple Files sections'
+        Assert-CcodTrue ($failure.Exception.Message -cmatch 'exactly one \[Files\] section') 'multiple-section failure explains the structural contract'
+        Assert-CcodTrue (-not (Test-Path -LiteralPath $output)) 'multiple Files sections produce no partial inventory artifact'
+    } finally {
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
 function New-CcodActivationPayloadFixture {
     param([string]$Version = '2.5.22')
 
diff --git a/tools/New-InstallerDestinationInventory.ps1 b/tools/New-InstallerDestinationInventory.ps1
index 6c0ba4b..1475da2 100644
--- a/tools/New-InstallerDestinationInventory.ps1
+++ b/tools/New-InstallerDestinationInventory.ps1
@@ -33,9 +33,11 @@ function Add-CcodExpectedDirectory {
 }
 
 $lines = @(Get-Content -LiteralPath $inno -Encoding UTF8)
+$filesSectionCount = @($lines | Where-Object { $_ -match '^\s*\[Files\]\s*$' }).Count
+if ($filesSectionCount -ne 1) { throw "Setup destination inventory requires exactly one [Files] section; found $filesSectionCount." }
 $insideFiles = $false
 foreach ($line in $lines) {
-    if ($line -ceq '[Files]') { $insideFiles = $true; continue }
+    if ($line -match '^\s*\[Files\]\s*$') { $insideFiles = $true; continue }
     if ($insideFiles -and $line -match '^\[') { break }
     if (-not $insideFiles -or [string]::IsNullOrWhiteSpace($line)) { continue }
     $match = [regex]::Match($line,'^Source:\s*"(?<source>[^"]+)";\s*DestDir:\s*"(?<destination>[^"]+)";(?<tail>.*)$')

From 8ac6106eb0f6ee0389ec4d9fbbf019e713f852b6 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 03:21:24 +0800
Subject: [PATCH 008/187] fix: enforce Inno inventory include boundary

---
 build/build.ps1                               |  46 +++++++-
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 110 +++++++++++++++++-
 tools/New-InstallerDestinationInventory.ps1   |   6 +
 3 files changed, 155 insertions(+), 7 deletions(-)

diff --git a/build/build.ps1 b/build/build.ps1
index da5a147..c89f84b 100644
--- a/build/build.ps1
+++ b/build/build.ps1
@@ -2,7 +2,8 @@
 param(
     [string]$Version,
     [switch]$UseExistingTrayHost,
-    [string]$TrayHostArtifactDirectory
+    [string]$TrayHostArtifactDirectory,
+    [switch]$Library
 )
 
 Set-StrictMode -Version Latest
@@ -104,6 +105,34 @@ function Write-CcodBuildUtf8 {
     [IO.File]::WriteAllText($Path,$Text,[Text.UTF8Encoding]::new($false))
 }
 
+function Assert-CcodBuildInstallerDestinationInventory {
+    param([Parameter(Mandatory)][string]$Path)
+    $inventoryPath = Assert-CcodBuildRegularFile -Path $Path -Kind 'Installer destination inventory'
+    foreach ($line in [IO.File]::ReadAllLines($inventoryPath,[Text.UTF8Encoding]::new($false))) {
+        if ($line -match '^\s*\[[^\[\]\r\n]+\]\s*(?:;.*)?$') {
+            throw "Installer destination inventory contains an Inno section header: $line"
+        }
+    }
+    return $inventoryPath
+}
+
+function Invoke-CcodBuildInnoCompiler {
+    param(
+        [Parameter(Mandatory)][string]$InventoryPath,
+        [Parameter(Mandatory)][string]$IsccPath,
+        [Parameter(Mandatory)][AllowEmptyCollection()][string[]]$Arguments,
+        [Parameter(Mandatory)][string]$SetupPath
+    )
+    Assert-CcodBuildInstallerDestinationInventory -Path $InventoryPath | Out-Null
+    & $IsccPath @Arguments
+    $compilerExitCode = $LASTEXITCODE
+    if ($compilerExitCode -ne 0 -or -not (Test-Path -LiteralPath $SetupPath -PathType Leaf)) {
+        throw "Inno Setup compilation failed with exit code $compilerExitCode"
+    }
+}
+
+if ($Library) { return }
+
 $repoRoot = Split-Path $PSScriptRoot -Parent
 $package = Get-Content -LiteralPath (Join-Path $repoRoot 'package.json') -Raw | ConvertFrom-Json
 $packageVersion = ([string]$package.version).TrimStart('v')
@@ -279,10 +308,17 @@ $iscc = $isccCandidates | Where-Object { -not [string]::IsNullOrWhiteSpace($_) -
 if (-not $iscc) { throw 'Inno Setup 6 (ISCC.exe) was not found. Install it with: winget install --id JRSoftware.InnoSetup --exact' }
 $issPath = Join-Path $PSScriptRoot 'CodexControlOtherDevices.iss'
 $portableArtifact = Join-Path $PSScriptRoot 'generated\portable'
-& $iscc "/DProjectVersion=$Version" "/DTrayHostArtifactDirectory=$trayHostArtifact" "/DPortableArtifactDirectory=$portableArtifact" "/DInstallerPayloadDirectory=$installerPayloadDirectory" "/DInstallerPayloadManifestSha256=$installerPayloadManifestSha256" "/DInstallerDestinationInventoryInclude=$installerDestinationInventoryPath" "/O$dist\." $issPath
-if ($LASTEXITCODE -ne 0 -or -not (Test-Path -LiteralPath $setupExe -PathType Leaf)) {
-    throw "Inno Setup compilation failed with exit code $LASTEXITCODE"
-}
+$isccArguments = @(
+    "/DProjectVersion=$Version",
+    "/DTrayHostArtifactDirectory=$trayHostArtifact",
+    "/DPortableArtifactDirectory=$portableArtifact",
+    "/DInstallerPayloadDirectory=$installerPayloadDirectory",
+    "/DInstallerPayloadManifestSha256=$installerPayloadManifestSha256",
+    "/DInstallerDestinationInventoryInclude=$installerDestinationInventoryPath",
+    "/O$dist\.",
+    $issPath
+)
+Invoke-CcodBuildInnoCompiler -InventoryPath $installerDestinationInventoryPath -IsccPath $iscc -Arguments $isccArguments -SetupPath $setupExe
 $setupHash = Get-CcodBuildFileSha256 -Path $setupExe
 Write-CcodBuildUtf8 -Path $setupChecksum -Text ("{0} *{1}" -f $setupHash,[IO.Path]::GetFileName($setupExe))
 $setupReleaseManifest = Join-Path $dist "CodexRemote-fix-$Version-setup-release-manifest.json"
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 0c00285..e203d90 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -104,14 +104,17 @@ Invoke-CcodTest 'production installer payload generator writes ordered version-b
     }
 }
 
-Invoke-CcodTest 'production setup destination inventory derives every nested directory from Inno sources and payload input' {
+Invoke-CcodTest 'production setup destination inventory accepts the literal symbolic include and derives every nested directory' {
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-installer-directory-inventory-' + [guid]::NewGuid().ToString('N'))
     try {
         $payload = Join-Path $root 'payload'
         [IO.Directory]::CreateDirectory((Join-Path $payload 'src\persistence\modules')) | Out-Null
         [IO.File]::WriteAllText((Join-Path $payload 'src\persistence\modules\InstallLifecycle.psm1'),'fixture',[Text.UTF8Encoding]::new($false))
         $output = Join-Path $root 'InstallerDestinationInventory.iss'
-        & (Join-Path $repositoryRoot 'tools\New-InstallerDestinationInventory.ps1') -RepositoryRoot $repositoryRoot -PayloadRoot $payload -ProjectVersion '2.5.22' -InnoScriptPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -OutputPath $output | Out-Null
+        $innoPath = Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss'
+        $allowedIncludes = @([IO.File]::ReadAllLines($innoPath,[Text.UTF8Encoding]::new($false)) | Where-Object { [string]$_ -ceq '#include InstallerDestinationInventoryInclude' })
+        Assert-CcodEqual 1 $allowedIncludes.Count 'production fixture exercises the one permitted literal include directive'
+        & (Join-Path $repositoryRoot 'tools\New-InstallerDestinationInventory.ps1') -RepositoryRoot $repositoryRoot -PayloadRoot $payload -ProjectVersion '2.5.22' -InnoScriptPath $innoPath -OutputPath $output | Out-Null
         $inventory = [IO.File]::ReadAllText($output,[Text.UTF8Encoding]::new($false))
         foreach ($relative in @('src','src\persistence','src\persistence\modules','payload','payload\2.5.22','payload\2.5.22\src','payload\2.5.22\src\persistence','payload\2.5.22\src\persistence\modules')) {
             Assert-CcodTrue ($inventory.Contains("Directories.Add('$relative');")) "generated setup inventory contains $relative"
@@ -156,6 +159,109 @@ Source: "fixture-b.txt"; DestDir: "{app}\second"; Flags: ignoreversion
     }
 }
 
+Invoke-CcodTest 'production setup destination inventory rejects an included second Files section before ISCC' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-installer-included-files-section-' + [guid]::NewGuid().ToString('N'))
+    try {
+        $payload = Join-Path $root 'payload'
+        $setupOutput = Join-Path $root 'setup-output'
+        [IO.Directory]::CreateDirectory($payload) | Out-Null
+        [IO.Directory]::CreateDirectory($setupOutput) | Out-Null
+        $firstSource = Join-Path $root 'fixture-a.txt'
+        $secondSource = Join-Path $root 'fixture-b.txt'
+        [IO.File]::WriteAllText($firstSource,'first',[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($secondSource,'second',[Text.UTF8Encoding]::new($false))
+        $extraPath = Join-Path $root 'extra.iss'
+        $extraSource = @"
+[Files]
+Source: "$secondSource"; DestDir: "{app}\second"; Flags: ignoreversion
+"@
+        [IO.File]::WriteAllText($extraPath,$extraSource,[Text.UTF8Encoding]::new($false))
+        $innoPath = Join-Path $root 'IncludedFilesSection.iss'
+        $innoSource = @"
+[Setup]
+AppName=IncludedFilesSection
+AppVersion=1.0.0
+DefaultDirName={tmp}\IncludedFilesSection
+OutputDir=$setupOutput
+OutputBaseFilename=IncludedFilesSection
+Uninstallable=no
+[Files]
+Source: "$firstSource"; DestDir: "{app}\first"; Flags: ignoreversion
+[Code]
+procedure Fixture();
+begin
+end;
+#include "extra.iss"
+"@
+        [IO.File]::WriteAllText($innoPath,$innoSource,[Text.UTF8Encoding]::new($false))
+        $inventoryPath = Join-Path $root 'Inventory.iss'
+        $setupPath = Join-Path $setupOutput 'IncludedFilesSection.exe'
+        $generatorFailure = $null
+        $compileExitCode = $null
+        try {
+            & (Join-Path $repositoryRoot 'tools\New-InstallerDestinationInventory.ps1') -RepositoryRoot $repositoryRoot -PayloadRoot $payload -ProjectVersion '2.5.22' -InnoScriptPath $innoPath -OutputPath $inventoryPath | Out-Null
+            $iscc = @(
+                (Join-Path $env:LOCALAPPDATA 'Programs\Inno Setup 6\ISCC.exe'),
+                (Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'),
+                (Join-Path $env:ProgramFiles 'Inno Setup 6\ISCC.exe')
+            ) | Where-Object { $_ -and [IO.File]::Exists($_) } | Select-Object -First 1
+            if (-not $iscc) { throw 'Inno Setup 6 is required for the include-boundary fixture' }
+            $previousPreference = $ErrorActionPreference
+            try {
+                $ErrorActionPreference = 'Continue'
+                $null = @(& $iscc $innoPath 2>&1)
+                $compileExitCode = $LASTEXITCODE
+            } finally { $ErrorActionPreference = $previousPreference }
+        } catch { $generatorFailure = $_ }
+        Assert-CcodTrue ($null -ne $generatorFailure) ("generator rejects the arbitrary include before ISCC; inventory={0} compileExit={1} setup={2}" -f [IO.File]::Exists($inventoryPath),$compileExitCode,[IO.File]::Exists($setupPath))
+        Assert-CcodTrue ($generatorFailure.Exception.Message -cmatch 'literal include directive') 'arbitrary include failure identifies the literal include boundary'
+        Assert-CcodTrue (-not [IO.File]::Exists($inventoryPath)) 'rejected include produces no destination inventory artifact'
+        Assert-CcodTrue (-not [IO.File]::Exists($setupPath)) 'rejected include produces no setup artifact'
+    } finally {
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'build validates generated inventory before invoking ISCC' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-installer-inventory-header-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $inventoryPath = Join-Path $root 'Inventory.iss'
+        $inventorySource = @'
+procedure AddCcodExpectedSetupDirectories(Directories: TStrings);
+begin
+end;
+[Files]
+'@
+        [IO.File]::WriteAllText($inventoryPath,$inventorySource,[Text.UTF8Encoding]::new($false))
+        $compilerMarker = Join-Path $root 'iscc-invoked.txt'
+        $compilerPath = Join-Path $root 'fake-iscc.cmd'
+        $setupPath = Join-Path $root 'setup.exe'
+        $compilerSource = "@echo off`r`n> `"$compilerMarker`" echo invoked`r`n> `"$setupPath`" echo setup`r`nexit /b 0`r`n"
+        [IO.File]::WriteAllText($compilerPath,$compilerSource,[Text.ASCIIEncoding]::new())
+        . (Join-Path $repositoryRoot 'build\build.ps1') -Library
+        $failure = $null
+        try {
+            Invoke-CcodBuildInnoCompiler -InventoryPath $inventoryPath -IsccPath $compilerPath -Arguments @() -SetupPath $setupPath
+        } catch { $failure = $_ }
+        Assert-CcodTrue ($null -ne $failure) 'build rejects a generated inventory carrying an Inno section header'
+        Assert-CcodTrue ($failure.Exception.Message -cmatch 'section header') 'inventory validation explains the forbidden section header'
+        Assert-CcodTrue (-not [IO.File]::Exists($compilerMarker)) 'ISCC is not invoked after inventory validation fails'
+        Assert-CcodTrue (-not [IO.File]::Exists($setupPath)) 'invalid inventory produces no setup artifact'
+        $validInventorySource = @'
+procedure AddCcodExpectedSetupDirectories(Directories: TStrings);
+begin
+end;
+'@
+        [IO.File]::WriteAllText($inventoryPath,$validInventorySource,[Text.UTF8Encoding]::new($false))
+        Invoke-CcodBuildInnoCompiler -InventoryPath $inventoryPath -IsccPath $compilerPath -Arguments @() -SetupPath $setupPath
+        Assert-CcodTrue ([IO.File]::Exists($compilerMarker)) 'validated inventory reaches ISCC'
+        Assert-CcodTrue ([IO.File]::Exists($setupPath)) 'validated inventory accepts the compiler setup artifact'
+    } finally {
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
 function New-CcodActivationPayloadFixture {
     param([string]$Version = '2.5.22')
 
diff --git a/tools/New-InstallerDestinationInventory.ps1 b/tools/New-InstallerDestinationInventory.ps1
index 1475da2..4274730 100644
--- a/tools/New-InstallerDestinationInventory.ps1
+++ b/tools/New-InstallerDestinationInventory.ps1
@@ -33,6 +33,12 @@ function Add-CcodExpectedDirectory {
 }
 
 $lines = @(Get-Content -LiteralPath $inno -Encoding UTF8)
+$includeDirectives = @($lines | Where-Object { $_ -match '^\s*#\s*include\b' })
+$allowedIncludeDirective = '#include InstallerDestinationInventoryInclude'
+if ($includeDirectives.Count -gt 1 -or
+    ($includeDirectives.Count -eq 1 -and [string]$includeDirectives[0] -cne $allowedIncludeDirective)) {
+    throw "Setup destination inventory permits only one literal include directive: $allowedIncludeDirective"
+}
 $filesSectionCount = @($lines | Where-Object { $_ -match '^\s*\[Files\]\s*$' }).Count
 if ($filesSectionCount -ne 1) { throw "Setup destination inventory requires exactly one [Files] section; found $filesSectionCount." }
 $insideFiles = $false

From c81987e07efc69e7bbe13d7cc08b045afddeb8bd Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 03:31:49 +0800
Subject: [PATCH 009/187] docs: replace Inno include parsing

---
 ...08-28-v2522-install-runtime-reliability.md | 64 +++++++++++++++++++
 ...2522-install-runtime-reliability-design.md |  7 ++
 2 files changed, 71 insertions(+)

diff --git a/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md b/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md
index 49ea10c..739a622 100644
--- a/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md
+++ b/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md
@@ -92,6 +92,68 @@ fixtures fail before active-pointer mutation.
 fix: bind setup activation to immutable payload
 ```
 
+### Task 1b: Compile an include-free generated setup script
+
+**Files:**
+- Modify: `build/build.ps1`
+- Modify: `build/CodexControlOtherDevices.iss`
+- Modify: `tools/New-InstallerDestinationInventory.ps1`
+- Test: `tests/persistence/ReleaseWorkflow.SelfTest.ps1`
+
+**Interfaces:**
+- The checked-in `.iss` contains exactly one inventory marker comment.
+- Build writes a temporary generated `.iss` by replacing that marker with the
+  verified inventory procedure and invokes ISCC only on the generated file.
+- The template rejects all external `#include` and `#+` directives.
+
+- [ ] **Step 1: Write failing behavior tests**
+
+```powershell
+$template = @'
+[Setup]
+AppName=fixture
+[Files]
+Source: "first.txt"; DestDir: "{app}\first"
+#+ "extra.iss"
+'@
+Assert-CcodThrows {
+  & $generator -RepositoryRoot $root -PayloadRoot $payload -ProjectVersion '2.5.22' `
+    -InnoScriptPath $templatePath -OutputPath $inventoryPath
+} 'include'
+Assert-CcodFalse (Test-Path -LiteralPath $inventoryPath) 'include bypass produces no partial inventory'
+```
+
+Add an actual ISCC test showing that the generated script compiles with its
+injected inventory, while a template with either include spelling is rejected
+before ISCC is launched.
+
+- [ ] **Step 2: Run the focused test and confirm RED**
+
+Run: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/ReleaseWorkflow.SelfTest.ps1`
+
+Expected: the include-alias fixture is accepted before the new template
+boundary exists.
+
+- [ ] **Step 3: Implement the generated include-free compiler input**
+
+Replace the source include with one unique marker. Build reads the checked-in
+template, refuses any `#include` or `#+` directive, substitutes the generated
+inventory text once, writes a GUID-named temporary `.iss`, validates that the
+result has no marker or external include, and passes that generated path to
+ISCC. Clean the temporary script in `finally`.
+
+- [ ] **Step 4: Run focused tests and prove GREEN**
+
+Run ReleaseWorkflow and the real ISCC fixture. Confirm the compiled setup
+source contains the expected injected procedure and arbitrary include aliases
+leave neither setup nor inventory output.
+
+- [ ] **Step 5: Commit**
+
+```text
+fix: compile include-free setup inventory
+```
+
 ### Task 2: Retry only transient Electron tree reads
 
 **Files:**
@@ -256,6 +318,8 @@ release: prepare CodexRemote-fix v2.5.22
 
 - Task 1 produces the immutable source/expected-version contract consumed by
   the new setup flow and release contract.
+- Task 1b removes the preprocessor include ambiguity from the Task 1 setup
+  source before any release compiler invocation.
 - Task 2 changes only pre-mutation tree acquisition and explicitly leaves all
   identity and post-stop checks strict.
 - Task 3 has no dependency on Task 2 and can be reviewed independently; its
diff --git a/docs/superpowers/specs/2026-08-28-v2522-install-runtime-reliability-design.md b/docs/superpowers/specs/2026-08-28-v2522-install-runtime-reliability-design.md
index 021295f..a57c866 100644
--- a/docs/superpowers/specs/2026-08-28-v2522-install-runtime-reliability-design.md
+++ b/docs/superpowers/specs/2026-08-28-v2522-install-runtime-reliability-design.md
@@ -55,6 +55,13 @@ This works for new users because the versioned payload directory is created
 from scratch, and for upgrades because an old app root cannot substitute its
 payload for the requested version.
 
+Build creates a one-time generated `.iss` from the checked-in template by
+replacing one fixed inventory marker with the verified destination-directory
+procedure. The template contains no external `#include` or `#+` directive;
+build rejects both spellings before ISCC runs. This avoids attempting to
+reimplement ISPP preprocessing while making the directory inventory and the
+exact source compiled by ISCC one artifact.
+
 ### 2. Bounded stable-tree acquisition
 
 Add a retry wrapper around verified Electron process-tree acquisition for

From ec4194f3791142bbed65150c4466f8c9b8ca5b1e Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 03:33:57 +0800
Subject: [PATCH 010/187] docs: number include boundary task

---
 ...26-08-28-v2522-install-runtime-reliability.md | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md b/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md
index 739a622..f83ada1 100644
--- a/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md
+++ b/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md
@@ -92,7 +92,7 @@ fixtures fail before active-pointer mutation.
 fix: bind setup activation to immutable payload
 ```
 
-### Task 1b: Compile an include-free generated setup script
+### Task 2: Compile an include-free generated setup script
 
 **Files:**
 - Modify: `build/build.ps1`
@@ -154,7 +154,7 @@ leave neither setup nor inventory output.
 fix: compile include-free setup inventory
 ```
 
-### Task 2: Retry only transient Electron tree reads
+### Task 3: Retry only transient Electron tree reads
 
 **Files:**
 - Modify: `src/persistence/modules/ProcessControl.psm1`
@@ -221,7 +221,7 @@ member.
 fix: stabilize verified Electron process trees
 ```
 
-### Task 3: Make tray action correlation testable and diagnosable
+### Task 4: Make tray action correlation testable and diagnosable
 
 **Files:**
 - Modify: `src/persistence/modules/TrayHostClient.psm1`
@@ -274,7 +274,7 @@ exact terminal code into local diagnostics.
 test: cover tray action revision correlation
 ```
 
-### Task 4: Version, documentation, and release acceptance
+### Task 5: Version, documentation, and release acceptance
 
 **Files:**
 - Modify: `package.json`
@@ -318,13 +318,13 @@ release: prepare CodexRemote-fix v2.5.22
 
 - Task 1 produces the immutable source/expected-version contract consumed by
   the new setup flow and release contract.
-- Task 1b removes the preprocessor include ambiguity from the Task 1 setup
+- Task 2 removes the preprocessor include ambiguity from the Task 1 setup
   source before any release compiler invocation.
-- Task 2 changes only pre-mutation tree acquisition and explicitly leaves all
+- Task 3 changes only pre-mutation tree acquisition and explicitly leaves all
   identity and post-stop checks strict.
-- Task 3 has no dependency on Task 2 and can be reviewed independently; its
+- Task 4 has no dependency on Task 3 and can be reviewed independently; its
   diagnostics make future live failures actionable without weakening protocol
   authentication.
-- Task 4 consumes the completed behavior and performs no release publication;
+- Task 5 consumes the completed behavior and performs no release publication;
   publishing, installation, and reboot remain a separately authorized final
   acceptance step.

From 31323b53659799af51478782cbea8bcf216ef1ad Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 03:46:52 +0800
Subject: [PATCH 011/187] fix: compile include-free setup inventory

---
 build/CodexControlOtherDevices.iss            |   5 +-
 build/build.ps1                               |  91 +++++-
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 301 +++++++++++++-----
 tools/New-InstallerDestinationInventory.ps1   |   8 +-
 4 files changed, 310 insertions(+), 95 deletions(-)

diff --git a/build/CodexControlOtherDevices.iss b/build/CodexControlOtherDevices.iss
index c9da999..ff42b79 100644
--- a/build/CodexControlOtherDevices.iss
+++ b/build/CodexControlOtherDevices.iss
@@ -11,9 +11,6 @@
 #ifndef InstallerPayloadManifestSha256
 #error InstallerPayloadManifestSha256 must be supplied by the release builder
 #endif
-#ifndef InstallerDestinationInventoryInclude
-#error InstallerDestinationInventoryInclude must be supplied by the release builder
-#endif
 AppId={{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}
 AppName=CodexRemote-fix
 AppVersion={#ProjectVersion}
@@ -99,7 +96,7 @@ Name: "{group}\Uninstall CodexRemote-fix"; Filename: "{app}\unins000.exe"; IconF
 Name: "{userdesktop}\CodexRemote-fix"; Filename: "{sys}\WindowsPowerShell\v1.0\powershell.exe"; Parameters: "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File ""{localappdata}\CodexControlOtherDevices\bootstrap.ps1"" -InstallRoot ""{localappdata}\CodexControlOtherDevices"" -EntryMode Explicit"; WorkingDir: "{localappdata}\CodexControlOtherDevices"; IconFilename: "{app}\assets\CodexRemote-fix.ico"
 
 [Code]
-#include InstallerDestinationInventoryInclude
+// CCOD_INSTALLER_DESTINATION_INVENTORY
 const
   ACTIVATION_TIMEOUT_MILLISECONDS = 300000;
   FIRST_ACTIVATION_RECEIPT_TIMEOUT_MILLISECONDS = 90000;
diff --git a/build/build.ps1 b/build/build.ps1
index c89f84b..426b0f3 100644
--- a/build/build.ps1
+++ b/build/build.ps1
@@ -116,18 +116,93 @@ function Assert-CcodBuildInstallerDestinationInventory {
     return $inventoryPath
 }
 
+function New-CcodBuildGeneratedInnoScript {
+    param(
+        [Parameter(Mandatory)][string]$TemplatePath,
+        [Parameter(Mandatory)][string]$InventoryPath,
+        [Parameter(Mandatory)][string]$OutputPath
+    )
+    $template = Assert-CcodBuildRegularFile -Path $TemplatePath -Kind 'Inno Setup template'
+    $inventory = Assert-CcodBuildInstallerDestinationInventory -Path $InventoryPath
+    $output = [IO.Path]::GetFullPath($OutputPath)
+    if ([IO.File]::Exists($output) -or [IO.Directory]::Exists($output)) {
+        throw "Refusing to overwrite generated Inno Setup script: $output"
+    }
+    $templateDirectory = [IO.Path]::GetFullPath((Split-Path $template -Parent)).TrimEnd('\')
+    $outputDirectory = [IO.Path]::GetFullPath((Split-Path $output -Parent)).TrimEnd('\')
+    if (-not $outputDirectory.Equals($templateDirectory,[StringComparison]::OrdinalIgnoreCase) -or
+        [IO.Path]::GetExtension($output) -cne '.iss') {
+        throw 'The generated Inno Setup script must be a sibling .iss file of its template.'
+    }
+
+    $marker = '// CCOD_INSTALLER_DESTINATION_INVENTORY'
+    $templateSource = [IO.File]::ReadAllText($template,[Text.UTF8Encoding]::new($false))
+    if ($templateSource -match '(?m)^\s*#\s*(?:include\b|\+)') {
+        throw 'The Inno Setup template must be include-free; external #include and #+ directives are not permitted.'
+    }
+    $markerCount = [regex]::Matches($templateSource,[regex]::Escape($marker)).Count
+    $markerLineCount = [regex]::Matches($templateSource,'(?m)^\s*// CCOD_INSTALLER_DESTINATION_INVENTORY\s*$').Count
+    if ($markerCount -ne 1 -or $markerLineCount -ne 1) {
+        throw "The Inno Setup template must contain exactly one inventory marker comment; found $markerCount."
+    }
+
+    $inventorySource = [IO.File]::ReadAllText($inventory,[Text.UTF8Encoding]::new($false)).TrimEnd("`r","`n")
+    $generatedSource = $templateSource.Replace($marker,$inventorySource)
+    if ($generatedSource.Contains($marker)) {
+        throw 'The generated Inno Setup script contains an unresolved inventory marker.'
+    }
+    if ($generatedSource -match '(?m)^\s*#\s*(?:include\b|\+)') {
+        throw 'The generated Inno Setup script contains an external #include or #+ directive.'
+    }
+
+    try {
+        Write-CcodBuildUtf8 -Path $output -Text $generatedSource
+        $writtenSource = [IO.File]::ReadAllText((Assert-CcodBuildRegularFile -Path $output -Kind 'Generated Inno Setup script'),[Text.UTF8Encoding]::new($false))
+        if (-not $writtenSource.Equals($generatedSource,[StringComparison]::Ordinal)) {
+            throw 'The generated Inno Setup script changed during write verification.'
+        }
+        return $output
+    } catch {
+        if ([IO.File]::Exists($output)) { Remove-Item -LiteralPath $output -Force -ErrorAction SilentlyContinue }
+        throw
+    }
+}
+
 function Invoke-CcodBuildInnoCompiler {
     param(
+        [Parameter(Mandatory)][string]$TemplatePath,
         [Parameter(Mandatory)][string]$InventoryPath,
         [Parameter(Mandatory)][string]$IsccPath,
         [Parameter(Mandatory)][AllowEmptyCollection()][string[]]$Arguments,
         [Parameter(Mandatory)][string]$SetupPath
     )
-    Assert-CcodBuildInstallerDestinationInventory -Path $InventoryPath | Out-Null
-    & $IsccPath @Arguments
-    $compilerExitCode = $LASTEXITCODE
-    if ($compilerExitCode -ne 0 -or -not (Test-Path -LiteralPath $SetupPath -PathType Leaf)) {
-        throw "Inno Setup compilation failed with exit code $compilerExitCode"
+    $template = Assert-CcodBuildRegularFile -Path $TemplatePath -Kind 'Inno Setup template'
+    $compiler = Assert-CcodBuildRegularFile -Path $IsccPath -Kind 'Inno Setup compiler'
+    $setup = [IO.Path]::GetFullPath($SetupPath)
+    if ([IO.File]::Exists($setup) -or [IO.Directory]::Exists($setup)) {
+        throw "Refusing to compile over an existing setup output: $setup"
+    }
+    $generatedScriptPath = Join-Path (Split-Path $template -Parent) ('.ccod-generated-setup-' + [guid]::NewGuid().ToString('N') + '.iss')
+    try {
+        $generatedScript = New-CcodBuildGeneratedInnoScript -TemplatePath $template -InventoryPath $InventoryPath -OutputPath $generatedScriptPath
+        $compilerArguments = @($Arguments) + @($generatedScript)
+        & $compiler @compilerArguments
+        $compilerExitCode = $LASTEXITCODE
+        if ($compilerExitCode -ne 0 -or -not (Test-Path -LiteralPath $setup -PathType Leaf)) {
+            throw "Inno Setup compilation failed with exit code $compilerExitCode"
+        }
+    } finally {
+        if ([IO.File]::Exists($generatedScriptPath)) {
+            $generatedFull = [IO.Path]::GetFullPath($generatedScriptPath)
+            $templateDirectory = [IO.Path]::GetFullPath((Split-Path $template -Parent)).TrimEnd('\') + '\'
+            $generatedItem = Get-Item -LiteralPath $generatedFull -Force -ErrorAction Stop
+            if (-not $generatedFull.StartsWith($templateDirectory,[StringComparison]::OrdinalIgnoreCase) -or
+                [IO.Path]::GetFileName($generatedFull) -cnotmatch '^\.ccod-generated-setup-[0-9a-f]{32}\.iss$' -or
+                (($generatedItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) {
+                throw "Refusing to clean an unexpected generated Inno Setup path: $generatedFull"
+            }
+            Remove-Item -LiteralPath $generatedFull -Force -ErrorAction Stop
+        }
     }
 }
 
@@ -314,11 +389,9 @@ $isccArguments = @(
     "/DPortableArtifactDirectory=$portableArtifact",
     "/DInstallerPayloadDirectory=$installerPayloadDirectory",
     "/DInstallerPayloadManifestSha256=$installerPayloadManifestSha256",
-    "/DInstallerDestinationInventoryInclude=$installerDestinationInventoryPath",
-    "/O$dist\.",
-    $issPath
+    "/O$dist\."
 )
-Invoke-CcodBuildInnoCompiler -InventoryPath $installerDestinationInventoryPath -IsccPath $iscc -Arguments $isccArguments -SetupPath $setupExe
+Invoke-CcodBuildInnoCompiler -TemplatePath $issPath -InventoryPath $installerDestinationInventoryPath -IsccPath $iscc -Arguments $isccArguments -SetupPath $setupExe
 $setupHash = Get-CcodBuildFileSha256 -Path $setupExe
 Write-CcodBuildUtf8 -Path $setupChecksum -Text ("{0} *{1}" -f $setupHash,[IO.Path]::GetFileName($setupExe))
 $setupReleaseManifest = Join-Path $dist "CodexRemote-fix-$Version-setup-release-manifest.json"
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index e203d90..af07a01 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -104,7 +104,7 @@ Invoke-CcodTest 'production installer payload generator writes ordered version-b
     }
 }
 
-Invoke-CcodTest 'production setup destination inventory accepts the literal symbolic include and derives every nested directory' {
+Invoke-CcodTest 'production setup template has one inventory marker, no external includes, and derives every nested directory' {
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-installer-directory-inventory-' + [guid]::NewGuid().ToString('N'))
     try {
         $payload = Join-Path $root 'payload'
@@ -112,8 +112,11 @@ Invoke-CcodTest 'production setup destination inventory accepts the literal symb
         [IO.File]::WriteAllText((Join-Path $payload 'src\persistence\modules\InstallLifecycle.psm1'),'fixture',[Text.UTF8Encoding]::new($false))
         $output = Join-Path $root 'InstallerDestinationInventory.iss'
         $innoPath = Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss'
-        $allowedIncludes = @([IO.File]::ReadAllLines($innoPath,[Text.UTF8Encoding]::new($false)) | Where-Object { [string]$_ -ceq '#include InstallerDestinationInventoryInclude' })
-        Assert-CcodEqual 1 $allowedIncludes.Count 'production fixture exercises the one permitted literal include directive'
+        $templateLines = @([IO.File]::ReadAllLines($innoPath,[Text.UTF8Encoding]::new($false)))
+        $inventoryMarkers = @($templateLines | Where-Object { [string]$_ -ceq '// CCOD_INSTALLER_DESTINATION_INVENTORY' })
+        $externalIncludes = @($templateLines | Where-Object { [string]$_ -match '^\s*#\s*(?:include\b|\+)' })
+        Assert-CcodEqual 1 $inventoryMarkers.Count 'production template has exactly one destination inventory marker comment'
+        Assert-CcodEqual 0 $externalIncludes.Count 'production template has no external include directive'
         & (Join-Path $repositoryRoot 'tools\New-InstallerDestinationInventory.ps1') -RepositoryRoot $repositoryRoot -PayloadRoot $payload -ProjectVersion '2.5.22' -InnoScriptPath $innoPath -OutputPath $output | Out-Null
         $inventory = [IO.File]::ReadAllText($output,[Text.UTF8Encoding]::new($false))
         foreach ($relative in @('src','src\persistence','src\persistence\modules','payload','payload\2.5.22','payload\2.5.22\src','payload\2.5.22\src\persistence','payload\2.5.22\src\persistence\modules')) {
@@ -159,104 +162,220 @@ Source: "fixture-b.txt"; DestDir: "{app}\second"; Flags: ignoreversion
     }
 }
 
-Invoke-CcodTest 'production setup destination inventory rejects an included second Files section before ISCC' {
-    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-installer-included-files-section-' + [guid]::NewGuid().ToString('N'))
+Invoke-CcodTest 'production setup destination inventory rejects every external include spelling before output' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-installer-external-include-' + [guid]::NewGuid().ToString('N'))
     try {
         $payload = Join-Path $root 'payload'
-        $setupOutput = Join-Path $root 'setup-output'
         [IO.Directory]::CreateDirectory($payload) | Out-Null
-        [IO.Directory]::CreateDirectory($setupOutput) | Out-Null
         $firstSource = Join-Path $root 'fixture-a.txt'
-        $secondSource = Join-Path $root 'fixture-b.txt'
         [IO.File]::WriteAllText($firstSource,'first',[Text.UTF8Encoding]::new($false))
-        [IO.File]::WriteAllText($secondSource,'second',[Text.UTF8Encoding]::new($false))
-        $extraPath = Join-Path $root 'extra.iss'
-        $extraSource = @"
-[Files]
-Source: "$secondSource"; DestDir: "{app}\second"; Flags: ignoreversion
-"@
-        [IO.File]::WriteAllText($extraPath,$extraSource,[Text.UTF8Encoding]::new($false))
-        $innoPath = Join-Path $root 'IncludedFilesSection.iss'
-        $innoSource = @"
+        $generator = Join-Path $repositoryRoot 'tools\New-InstallerDestinationInventory.ps1'
+        foreach ($fixture in @(
+            [pscustomobject]@{Name='plus alias';Directive='#+ "extra.iss"'},
+            [pscustomobject]@{Name='include keyword';Directive='#include "extra.iss"'}
+        )) {
+            $innoPath = Join-Path $root (($fixture.Name -replace '[^A-Za-z]','') + '.iss')
+            $innoSource = @"
 [Setup]
-AppName=IncludedFilesSection
+AppName=ExternalIncludeFixture
 AppVersion=1.0.0
-DefaultDirName={tmp}\IncludedFilesSection
-OutputDir=$setupOutput
-OutputBaseFilename=IncludedFilesSection
-Uninstallable=no
+DefaultDirName={app}
 [Files]
 Source: "$firstSource"; DestDir: "{app}\first"; Flags: ignoreversion
 [Code]
 procedure Fixture();
 begin
 end;
-#include "extra.iss"
+$($fixture.Directive)
 "@
-        [IO.File]::WriteAllText($innoPath,$innoSource,[Text.UTF8Encoding]::new($false))
-        $inventoryPath = Join-Path $root 'Inventory.iss'
-        $setupPath = Join-Path $setupOutput 'IncludedFilesSection.exe'
-        $generatorFailure = $null
-        $compileExitCode = $null
-        try {
-            & (Join-Path $repositoryRoot 'tools\New-InstallerDestinationInventory.ps1') -RepositoryRoot $repositoryRoot -PayloadRoot $payload -ProjectVersion '2.5.22' -InnoScriptPath $innoPath -OutputPath $inventoryPath | Out-Null
-            $iscc = @(
-                (Join-Path $env:LOCALAPPDATA 'Programs\Inno Setup 6\ISCC.exe'),
-                (Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'),
-                (Join-Path $env:ProgramFiles 'Inno Setup 6\ISCC.exe')
-            ) | Where-Object { $_ -and [IO.File]::Exists($_) } | Select-Object -First 1
-            if (-not $iscc) { throw 'Inno Setup 6 is required for the include-boundary fixture' }
-            $previousPreference = $ErrorActionPreference
+            [IO.File]::WriteAllText($innoPath,$innoSource,[Text.UTF8Encoding]::new($false))
+            $inventoryPath = Join-Path $root (($fixture.Name -replace '[^A-Za-z]','') + '-Inventory.iss')
+            $generatorFailure = $null
             try {
-                $ErrorActionPreference = 'Continue'
-                $null = @(& $iscc $innoPath 2>&1)
-                $compileExitCode = $LASTEXITCODE
-            } finally { $ErrorActionPreference = $previousPreference }
-        } catch { $generatorFailure = $_ }
-        Assert-CcodTrue ($null -ne $generatorFailure) ("generator rejects the arbitrary include before ISCC; inventory={0} compileExit={1} setup={2}" -f [IO.File]::Exists($inventoryPath),$compileExitCode,[IO.File]::Exists($setupPath))
-        Assert-CcodTrue ($generatorFailure.Exception.Message -cmatch 'literal include directive') 'arbitrary include failure identifies the literal include boundary'
-        Assert-CcodTrue (-not [IO.File]::Exists($inventoryPath)) 'rejected include produces no destination inventory artifact'
-        Assert-CcodTrue (-not [IO.File]::Exists($setupPath)) 'rejected include produces no setup artifact'
+                & $generator -RepositoryRoot $repositoryRoot -PayloadRoot $payload -ProjectVersion '2.5.22' -InnoScriptPath $innoPath -OutputPath $inventoryPath | Out-Null
+            } catch { $generatorFailure = $_ }
+            Assert-CcodTrue ($null -ne $generatorFailure) "generator rejects the $($fixture.Name) before writing inventory"
+            Assert-CcodTrue ($generatorFailure.Exception.Message -cmatch 'include') "$($fixture.Name) failure identifies the include-free template boundary"
+            Assert-CcodTrue (-not [IO.File]::Exists($inventoryPath)) "$($fixture.Name) produces no partial destination inventory"
+        }
     } finally {
         if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
     }
 }
 
-Invoke-CcodTest 'build validates generated inventory before invoking ISCC' {
-    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-installer-inventory-header-' + [guid]::NewGuid().ToString('N'))
+Invoke-CcodTest 'build rejects invalid generated setup inputs before invoking ISCC' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-generated-setup-invalid-' + [guid]::NewGuid().ToString('N'))
     try {
         [IO.Directory]::CreateDirectory($root) | Out-Null
+        $templatePath = Join-Path $root 'Template.iss'
         $inventoryPath = Join-Path $root 'Inventory.iss'
-        $inventorySource = @'
+        $validInventorySource = @'
 procedure AddCcodExpectedSetupDirectories(Directories: TStrings);
 begin
 end;
-[Files]
 '@
-        [IO.File]::WriteAllText($inventoryPath,$inventorySource,[Text.UTF8Encoding]::new($false))
         $compilerMarker = Join-Path $root 'iscc-invoked.txt'
         $compilerPath = Join-Path $root 'fake-iscc.cmd'
         $setupPath = Join-Path $root 'setup.exe'
         $compilerSource = "@echo off`r`n> `"$compilerMarker`" echo invoked`r`n> `"$setupPath`" echo setup`r`nexit /b 0`r`n"
         [IO.File]::WriteAllText($compilerPath,$compilerSource,[Text.ASCIIEncoding]::new())
         . (Join-Path $repositoryRoot 'build\build.ps1') -Library
-        $failure = $null
+        foreach ($fixture in @(
+            [pscustomobject]@{Name='include keyword';Directive='#include "extra.iss"'},
+            [pscustomobject]@{Name='plus alias';Directive='#+ "extra.iss"'}
+        )) {
+            $templateSource = @"
+[Setup]
+AppName=InvalidGeneratedSetup
+AppVersion=1.0.0
+DefaultDirName={tmp}\InvalidGeneratedSetup
+OutputBaseFilename=InvalidGeneratedSetup
+Uninstallable=no
+[Code]
+// CCOD_INSTALLER_DESTINATION_INVENTORY
+$($fixture.Directive)
+"@
+            [IO.File]::WriteAllText($templatePath,$templateSource,[Text.UTF8Encoding]::new($false))
+            [IO.File]::WriteAllText($inventoryPath,$validInventorySource,[Text.UTF8Encoding]::new($false))
+            $failure = $null
+            try {
+                Invoke-CcodBuildInnoCompiler -TemplatePath $templatePath -InventoryPath $inventoryPath -IsccPath $compilerPath -Arguments @() -SetupPath $setupPath
+            } catch { $failure = $_ }
+            Assert-CcodTrue ($null -ne $failure) "build rejects the $($fixture.Name) before ISCC"
+            Assert-CcodTrue ($failure.Exception.Message -cmatch 'include') "$($fixture.Name) failure identifies the include-free compiler boundary"
+            Assert-CcodTrue (-not [IO.File]::Exists($compilerMarker)) "$($fixture.Name) does not launch ISCC"
+            Assert-CcodTrue (-not [IO.File]::Exists($setupPath)) "$($fixture.Name) produces no setup artifact"
+            Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath $root -Filter '.ccod-generated-setup-*.iss' -File -Force).Count "$($fixture.Name) leaves no generated setup script"
+        }
+
+        $validTemplateSource = @'
+[Setup]
+AppName=InvalidInventory
+AppVersion=1.0.0
+DefaultDirName={tmp}\InvalidInventory
+OutputBaseFilename=InvalidInventory
+Uninstallable=no
+[Code]
+// CCOD_INSTALLER_DESTINATION_INVENTORY
+'@
+        $invalidInventorySource = $validInventorySource + "`r`n[Files]`r`n"
+        [IO.File]::WriteAllText($templatePath,$validTemplateSource,[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($inventoryPath,$invalidInventorySource,[Text.UTF8Encoding]::new($false))
+        $inventoryFailure = $null
         try {
-            Invoke-CcodBuildInnoCompiler -InventoryPath $inventoryPath -IsccPath $compilerPath -Arguments @() -SetupPath $setupPath
-        } catch { $failure = $_ }
-        Assert-CcodTrue ($null -ne $failure) 'build rejects a generated inventory carrying an Inno section header'
-        Assert-CcodTrue ($failure.Exception.Message -cmatch 'section header') 'inventory validation explains the forbidden section header'
-        Assert-CcodTrue (-not [IO.File]::Exists($compilerMarker)) 'ISCC is not invoked after inventory validation fails'
+            Invoke-CcodBuildInnoCompiler -TemplatePath $templatePath -InventoryPath $inventoryPath -IsccPath $compilerPath -Arguments @() -SetupPath $setupPath
+        } catch { $inventoryFailure = $_ }
+        Assert-CcodTrue ($null -ne $inventoryFailure) 'build rejects a generated inventory carrying an Inno section header'
+        Assert-CcodTrue ($inventoryFailure.Exception.Message -cmatch 'section header') 'inventory validation explains the forbidden section header'
+        Assert-CcodTrue (-not [IO.File]::Exists($compilerMarker)) 'invalid inventory does not launch ISCC'
         Assert-CcodTrue (-not [IO.File]::Exists($setupPath)) 'invalid inventory produces no setup artifact'
-        $validInventorySource = @'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath $root -Filter '.ccod-generated-setup-*.iss' -File -Force).Count 'invalid inventory leaves no generated setup script'
+    } finally {
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'build passes only a GUID generated include-free setup to ISCC and cleans it' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-generated-setup-valid-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $templatePath = Join-Path $root 'Template.iss'
+        $templateSource = @'
+[Setup]
+AppName=GeneratedSetup
+AppVersion=1.0.0
+DefaultDirName={tmp}\GeneratedSetup
+OutputBaseFilename=GeneratedSetup
+Uninstallable=no
+[Code]
+// CCOD_INSTALLER_DESTINATION_INVENTORY
+'@
+        [IO.File]::WriteAllText($templatePath,$templateSource,[Text.UTF8Encoding]::new($false))
+        $inventoryPath = Join-Path $root 'Inventory.iss'
+        $inventorySource = @'
+procedure AddCcodExpectedSetupDirectories(Directories: TStrings);
+begin
+  Directories.Add('payload\2.5.22');
+end;
+'@
+        [IO.File]::WriteAllText($inventoryPath,$inventorySource,[Text.UTF8Encoding]::new($false))
+        $compilerArgument = Join-Path $root 'iscc-argument.txt'
+        $capturedSource = Join-Path $root 'compiled-source.iss'
+        $compilerPath = Join-Path $root 'fake-iscc.cmd'
+        $setupPath = Join-Path $root 'setup.exe'
+        $compilerSource = "@echo off`r`n> `"$compilerArgument`" echo %~f1`r`ncopy /y `"%~1`" `"$capturedSource`" >nul`r`n> `"$setupPath`" echo setup`r`nexit /b 0`r`n"
+        [IO.File]::WriteAllText($compilerPath,$compilerSource,[Text.ASCIIEncoding]::new())
+        . (Join-Path $repositoryRoot 'build\build.ps1') -Library
+
+        Invoke-CcodBuildInnoCompiler -TemplatePath $templatePath -InventoryPath $inventoryPath -IsccPath $compilerPath -Arguments @() -SetupPath $setupPath
+
+        Assert-CcodTrue ([IO.File]::Exists($setupPath)) 'validated generated source accepts the compiler setup artifact'
+        Assert-CcodTrue ([IO.File]::Exists($capturedSource)) 'compiler receives a readable generated setup source'
+        $compiledPath = [IO.File]::ReadAllText($compilerArgument).Trim()
+        Assert-CcodTrue (-not $compiledPath.Equals([IO.Path]::GetFullPath($templatePath),[StringComparison]::OrdinalIgnoreCase)) 'ISCC never receives the checked-in template path'
+        Assert-CcodTrue ([IO.Path]::GetFileName($compiledPath) -cmatch '^\.ccod-generated-setup-[0-9a-f]{32}\.iss$') 'ISCC receives the GUID-named generated setup path'
+        Assert-CcodTrue (-not [IO.File]::Exists($compiledPath)) 'generated compiler input is cleaned after ISCC returns'
+        $compiledSource = [IO.File]::ReadAllText($capturedSource,[Text.UTF8Encoding]::new($false))
+        Assert-CcodTrue ($compiledSource.Contains("Directories.Add('payload\2.5.22');")) 'compiled source contains the verified injected inventory procedure'
+        Assert-CcodTrue (-not $compiledSource.Contains('// CCOD_INSTALLER_DESTINATION_INVENTORY')) 'compiled source contains no unresolved inventory marker'
+        Assert-CcodTrue ($compiledSource -cnotmatch '(?m)^\s*#\s*(?:include\b|\+)') 'compiled source contains no external include directive'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath $root -Filter '.ccod-generated-setup-*.iss' -File -Force).Count 'successful compile leaves no generated setup script'
+    } finally {
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'real ISCC compiles the generated setup with its injected inventory procedure' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-generated-setup-iscc-' + [guid]::NewGuid().ToString('N'))
+    try {
+        $output = Join-Path $root 'output'
+        [IO.Directory]::CreateDirectory($output) | Out-Null
+        $templatePath = Join-Path $root 'Template.iss'
+        $templateSource = @"
+[Setup]
+AppName=GeneratedSetupRealCompiler
+AppVersion=1.0.0
+DefaultDirName={tmp}\GeneratedSetupRealCompiler
+OutputDir=$output
+OutputBaseFilename=GeneratedSetupRealCompiler
+Uninstallable=no
+[Code]
+// CCOD_INSTALLER_DESTINATION_INVENTORY
+function InitializeSetup(): Boolean;
+var
+  Directories: TStringList;
+begin
+  Directories := TStringList.Create;
+  try
+    AddCcodExpectedSetupDirectories(Directories);
+    Result := Directories.Count = 1;
+  finally
+    Directories.Free;
+  end;
+end;
+"@
+        [IO.File]::WriteAllText($templatePath,$templateSource,[Text.UTF8Encoding]::new($false))
+        $inventoryPath = Join-Path $root 'Inventory.iss'
+        $inventorySource = @'
 procedure AddCcodExpectedSetupDirectories(Directories: TStrings);
 begin
+  Directories.Add('payload\2.5.22');
 end;
 '@
-        [IO.File]::WriteAllText($inventoryPath,$validInventorySource,[Text.UTF8Encoding]::new($false))
-        Invoke-CcodBuildInnoCompiler -InventoryPath $inventoryPath -IsccPath $compilerPath -Arguments @() -SetupPath $setupPath
-        Assert-CcodTrue ([IO.File]::Exists($compilerMarker)) 'validated inventory reaches ISCC'
-        Assert-CcodTrue ([IO.File]::Exists($setupPath)) 'validated inventory accepts the compiler setup artifact'
+        [IO.File]::WriteAllText($inventoryPath,$inventorySource,[Text.UTF8Encoding]::new($false))
+        $iscc = @(
+            (Join-Path $env:LOCALAPPDATA 'Programs\Inno Setup 6\ISCC.exe'),
+            (Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'),
+            (Join-Path $env:ProgramFiles 'Inno Setup 6\ISCC.exe')
+        ) | Where-Object { $_ -and [IO.File]::Exists($_) } | Select-Object -First 1
+        if (-not $iscc) { throw 'Inno Setup 6 is required for the generated setup fixture' }
+        $setupPath = Join-Path $output 'GeneratedSetupRealCompiler.exe'
+        . (Join-Path $repositoryRoot 'build\build.ps1') -Library
+
+        Invoke-CcodBuildInnoCompiler -TemplatePath $templatePath -InventoryPath $inventoryPath -IsccPath $iscc -Arguments @() -SetupPath $setupPath
+
+        Assert-CcodTrue ([IO.File]::Exists($setupPath)) 'real ISCC compiles the injected inventory procedure and its call site'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath $root -Filter '.ccod-generated-setup-*.iss' -File -Force).Count 'real ISCC compile leaves no generated setup script'
     } finally {
         if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
     }
@@ -316,26 +435,50 @@ function Invoke-CcodInnoPayloadCompileFixture {
     $manifestPath = Join-Path $payload 'installer-payload.manifest.json'
     [IO.File]::WriteAllText($manifestPath,($manifest|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
     $inventoryPath = Join-Path $root 'InstallerDestinationInventory.iss'
-    & (Join-Path $repositoryRoot 'tools\New-InstallerDestinationInventory.ps1') -RepositoryRoot $repositoryRoot -PayloadRoot $payload -ProjectVersion '2.5.21' -InnoScriptPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -OutputPath $inventoryPath | Out-Null
+    $templatePath = Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss'
+    if (-not $OmitDestinationInventory) {
+        & (Join-Path $repositoryRoot 'tools\New-InstallerDestinationInventory.ps1') -RepositoryRoot $repositoryRoot -PayloadRoot $payload -ProjectVersion '2.5.21' -InnoScriptPath $templatePath -OutputPath $inventoryPath | Out-Null
+    }
     $iscc = @(
         (Join-Path $env:LOCALAPPDATA 'Programs\Inno Setup 6\ISCC.exe'),
         (Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'),
         (Join-Path $env:ProgramFiles 'Inno Setup 6\ISCC.exe')
     ) | Where-Object { $_ -and [IO.File]::Exists($_) } | Select-Object -First 1
     if (-not $iscc) { throw 'Inno Setup 6 is required for the setup payload contract' }
-    $arguments = @('/DProjectVersion=2.5.21',"/DTrayHostArtifactDirectory=$tray","/DPortableArtifactDirectory=$portable","/O$output\",(Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss'))
+    $arguments = @('/DProjectVersion=2.5.21',"/DTrayHostArtifactDirectory=$tray","/DPortableArtifactDirectory=$portable","/O$output\")
     if ($IncludePayloadDefines) {
         $arguments = @('/DProjectVersion=2.5.21',"/DTrayHostArtifactDirectory=$tray","/DPortableArtifactDirectory=$portable","/DInstallerPayloadDirectory=$payload","/DInstallerPayloadManifestSha256=$(Get-CcodTestFileSha256 -Path $manifestPath)")
-        if (-not $OmitDestinationInventory) { $arguments += "/DInstallerDestinationInventoryInclude=$inventoryPath" }
-        $arguments += @("/O$output\",(Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss'))
+        $arguments += "/O$output\"
     }
-    $previousPreference = $ErrorActionPreference
+    . (Join-Path $repositoryRoot 'build\build.ps1') -Library
+    $generatedPath = Join-Path (Split-Path $templatePath -Parent) ('.ccod-generated-setup-' + [guid]::NewGuid().ToString('N') + '.iss')
+    $generatedSource = ''
+    $compileOutput = @()
+    $exitCode = 1
     try {
-        $ErrorActionPreference = 'Continue'
-        $compileOutput = @(& $iscc @arguments 2>&1)
-        $exitCode = $LASTEXITCODE
-    } finally { $ErrorActionPreference = $previousPreference }
-    return [pscustomobject]@{Root=$root;ExitCode=$exitCode;Output=($compileOutput -join "`n");SetupPath=(Join-Path $output 'CodexRemote-fix-2.5.21-setup.exe')}
+        $generated = New-CcodBuildGeneratedInnoScript -TemplatePath $templatePath -InventoryPath $inventoryPath -OutputPath $generatedPath
+        $generatedSource = [IO.File]::ReadAllText($generated,[Text.UTF8Encoding]::new($false))
+        $arguments += $generated
+        $previousPreference = $ErrorActionPreference
+        try {
+            $ErrorActionPreference = 'Continue'
+            $compileOutput = @(& $iscc @arguments 2>&1)
+            $exitCode = $LASTEXITCODE
+        } finally { $ErrorActionPreference = $previousPreference }
+    } catch {
+        $compileOutput = @($_.Exception.Message)
+        $exitCode = 1
+    } finally {
+        if ([IO.File]::Exists($generatedPath)) { Remove-Item -LiteralPath $generatedPath -Force }
+    }
+    return [pscustomobject]@{
+        Root = $root
+        ExitCode = $exitCode
+        Output = ($compileOutput -join "`n")
+        SetupPath = (Join-Path $output 'CodexRemote-fix-2.5.21-setup.exe')
+        GeneratedPath = $generatedPath
+        GeneratedSource = $generatedSource
+    }
 }
 
 Invoke-CcodTest 'setup build and activation bind one immutable versioned payload end to end' {
@@ -344,7 +487,7 @@ Invoke-CcodTest 'setup build and activation bind one immutable versioned payload
     $activation = Get-Content -LiteralPath (Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1') -Raw -Encoding UTF8
     $installer = Get-Content -LiteralPath (Join-Path $repositoryRoot 'Install-CodexControlOtherDevices.ps1') -Raw -Encoding UTF8
 
-    Assert-CcodTrue ($build -cmatch 'New-InstallerPayloadManifest\.ps1' -and $build -cmatch 'New-InstallerDestinationInventory\.ps1' -and $build -cmatch 'InstallerPayloadManifestSha256' -and $build -cmatch 'InstallerDestinationInventoryInclude') 'build invokes the tested generators and binds their outputs into setup compilation'
+    Assert-CcodTrue ($build -cmatch 'New-InstallerPayloadManifest\.ps1' -and $build -cmatch 'New-InstallerDestinationInventory\.ps1' -and $build -cmatch 'InstallerPayloadManifestSha256' -and $build -cmatch 'New-CcodBuildGeneratedInnoScript') 'build invokes the tested generators and binds the inventory into generated setup compilation'
     Assert-CcodTrue ($inno -cmatch 'InstallerPayloadDirectory' -and $inno -cmatch 'DestDir:\s*"\{app\}\\payload\\\{#ProjectVersion\}"') 'Inno copies the immutable build payload into its exact version directory'
     Assert-CcodTrue ($inno -cmatch "ExpandConstant\('\{app\}\\payload\\\{#ProjectVersion\}'\)" -and $inno -cmatch '-ExpectedVersion\s+"\{#ProjectVersion\}') 'Inno binds activation to its compiled payload version'
     Assert-CcodTrue ($activation -cmatch '\[string\]\$ExpectedVersion' -and $activation -cmatch '\[string\]\$ExpectedPayloadManifestSha256' -and $activation -cmatch 'installer-payload\.manifest\.json') 'activation accepts and resolves the expected payload contract'
@@ -468,7 +611,10 @@ Invoke-CcodTest 'Inno compile packages the explicit manifest-bound installer pay
     try {
         Assert-CcodEqual 0 $compile.ExitCode "explicit setup payload contract compiles: $($compile.Output)"
         Assert-CcodTrue (Test-Path -LiteralPath $compile.SetupPath -PathType Leaf) 'explicit payload compile produces the setup artifact'
-        Assert-CcodTrue ($compile.Output -cmatch 'InstallerDestinationInventory\.iss' -and $compile.Output -cmatch 'installer-payload\.manifest\.json' -and $compile.Output -cmatch 'payload\\package\.json') 'compiler input trace contains the destination inventory, payload manifest, and manifest-listed file'
+        Assert-CcodTrue ($compile.GeneratedSource -cmatch 'procedure AddCcodExpectedSetupDirectories' -and $compile.GeneratedSource -cmatch "Directories\.Add\('payload\\2\.5\.21'") 'compiler input contains the generated destination inventory procedure'
+        Assert-CcodTrue ($compile.GeneratedSource -cnotmatch 'CCOD_INSTALLER_DESTINATION_INVENTORY' -and $compile.GeneratedSource -cnotmatch '(?m)^\s*#\s*(?:include\b|\+)') 'compiler input contains neither the marker nor an external include'
+        Assert-CcodTrue (-not [IO.File]::Exists($compile.GeneratedPath)) 'payload compile cleans its generated compiler input'
+        Assert-CcodTrue ($compile.Output -cmatch 'installer-payload\.manifest\.json' -and $compile.Output -cmatch 'payload\\package\.json') 'compiler input trace contains the payload manifest and manifest-listed file'
     } finally {
         if (Test-Path -LiteralPath $compile.Root) { Remove-Item -LiteralPath $compile.Root -Recurse -Force }
     }
@@ -477,9 +623,10 @@ Invoke-CcodTest 'Inno compile packages the explicit manifest-bound installer pay
 Invoke-CcodTest 'Inno compile refuses a missing generated destination inventory' {
     $compile = Invoke-CcodInnoPayloadCompileFixture -IncludePayloadDefines -OmitDestinationInventory
     try {
-        Assert-CcodTrue ($compile.ExitCode -ne 0) 'setup compilation fails when only the destination inventory define is omitted'
-        Assert-CcodTrue ($compile.Output -cmatch 'InstallerDestinationInventoryInclude') 'compiler identifies the missing generated inventory define'
+        Assert-CcodTrue ($compile.ExitCode -ne 0) 'setup compilation fails before ISCC when the generated inventory is missing'
+        Assert-CcodTrue ($compile.Output -cmatch 'destination inventory.*missing') 'generation identifies the missing destination inventory artifact'
         Assert-CcodTrue (-not (Test-Path -LiteralPath $compile.SetupPath)) 'missing inventory define produces no setup artifact'
+        Assert-CcodTrue (-not [IO.File]::Exists($compile.GeneratedPath)) 'missing inventory leaves no generated compiler input'
     } finally {
         if (Test-Path -LiteralPath $compile.Root) { Remove-Item -LiteralPath $compile.Root -Recurse -Force }
     }
@@ -493,7 +640,7 @@ Invoke-CcodTest 'Inno exposes a pre-write payload-directory reparse gate' {
     Assert-CcodTrue $treeHelper.Success 'production Inno script exposes a recursive destination-tree predicate'
     $inventoryValidator = [regex]::Match($inno,'(?ms)^function AreCcodExpectedSetupDirectoriesSafe\(.*?^end;')
     Assert-CcodTrue $inventoryValidator.Success 'production Inno script exposes a generated destination-inventory validator'
-    Assert-CcodTrue ($inno -cmatch 'InstallerDestinationInventoryInclude' -and $inno -cmatch '(?ms)^function PrepareToInstall\(var NeedsRestart: Boolean\): String;.*?AreCcodExpectedSetupDirectoriesSafe') 'PrepareToInstall consumes the compile-bound generated inventory before file copy'
+    Assert-CcodTrue ($inno -cmatch '(?m)^// CCOD_INSTALLER_DESTINATION_INVENTORY\s*$' -and $inno -cmatch '(?ms)^function PrepareToInstall\(var NeedsRestart: Boolean\): String;.*?AreCcodExpectedSetupDirectoriesSafe') 'PrepareToInstall consumes the generated inventory injected at the unique marker before file copy'
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-inno-reparse-harness-' + [guid]::NewGuid().ToString('N'))
     try {
         $normal = Join-Path $root 'normal'
diff --git a/tools/New-InstallerDestinationInventory.ps1 b/tools/New-InstallerDestinationInventory.ps1
index 4274730..c12f952 100644
--- a/tools/New-InstallerDestinationInventory.ps1
+++ b/tools/New-InstallerDestinationInventory.ps1
@@ -33,11 +33,9 @@ function Add-CcodExpectedDirectory {
 }
 
 $lines = @(Get-Content -LiteralPath $inno -Encoding UTF8)
-$includeDirectives = @($lines | Where-Object { $_ -match '^\s*#\s*include\b' })
-$allowedIncludeDirective = '#include InstallerDestinationInventoryInclude'
-if ($includeDirectives.Count -gt 1 -or
-    ($includeDirectives.Count -eq 1 -and [string]$includeDirectives[0] -cne $allowedIncludeDirective)) {
-    throw "Setup destination inventory permits only one literal include directive: $allowedIncludeDirective"
+$includeDirectives = @($lines | Where-Object { $_ -match '^\s*#\s*(?:include\b|\+)' })
+if ($includeDirectives.Count -ne 0) {
+    throw 'Setup destination inventory requires an include-free template; external #include and #+ directives are not permitted.'
 }
 $filesSectionCount = @($lines | Where-Object { $_ -match '^\s*\[Files\]\s*$' }).Count
 if ($filesSectionCount -ne 1) { throw "Setup destination inventory requires exactly one [Files] section; found $filesSectionCount." }

From 67b9939b2bfb8caa1a0477b464efe58fecbff08f Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 04:09:28 +0800
Subject: [PATCH 012/187] docs: constrain setup preprocessor boundary

---
 ...08-28-v2522-install-runtime-reliability.md | 33 +++++++++++--------
 ...2522-install-runtime-reliability-design.md | 11 ++++---
 2 files changed, 26 insertions(+), 18 deletions(-)

diff --git a/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md b/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md
index f83ada1..39f2442 100644
--- a/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md
+++ b/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md
@@ -104,7 +104,8 @@ fix: bind setup activation to immutable payload
 - The checked-in `.iss` contains exactly one inventory marker comment.
 - Build writes a temporary generated `.iss` by replacing that marker with the
   verified inventory procedure and invokes ISCC only on the generated file.
-- The template rejects all external `#include` and `#+` directives.
+- The template accepts only the required literal build directives and rejects
+  all external/line-spanned/pragma/generated-code preprocessor directives.
 
 - [ ] **Step 1: Write failing behavior tests**
 
@@ -114,7 +115,8 @@ $template = @'
 AppName=fixture
 [Files]
 Source: "first.txt"; DestDir: "{app}\first"
-#+ "extra.iss"
+# \
++ "extra.iss"
 '@
 Assert-CcodThrows {
   & $generator -RepositoryRoot $root -PayloadRoot $payload -ProjectVersion '2.5.22' `
@@ -123,30 +125,33 @@ Assert-CcodThrows {
 Assert-CcodFalse (Test-Path -LiteralPath $inventoryPath) 'include bypass produces no partial inventory'
 ```
 
-Add an actual ISCC test showing that the generated script compiles with its
-injected inventory, while a template with either include spelling is rejected
-before ISCC is launched.
+Add actual ISCC tests showing that the generated script compiles with its
+injected inventory, while templates with literal or line-spanned include,
+pragma, emit, and unknown preprocessor directives are rejected before ISCC is
+launched.
 
 - [ ] **Step 2: Run the focused test and confirm RED**
 
 Run: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/ReleaseWorkflow.SelfTest.ps1`
 
-Expected: the include-alias fixture is accepted before the new template
-boundary exists.
+Expected: the line-spanned include-alias fixture is accepted before the new
+template boundary exists.
 
 - [ ] **Step 3: Implement the generated include-free compiler input**
 
-Replace the source include with one unique marker. Build reads the checked-in
-template, refuses any `#include` or `#+` directive, substitutes the generated
-inventory text once, writes a GUID-named temporary `.iss`, validates that the
-result has no marker or external include, and passes that generated path to
-ISCC. Clean the temporary script in `finally`.
+Build reads the checked-in template, verifies every literal preprocessor line
+is one of the fixed required directives, rejects continuation characters and
+all other directives, substitutes the generated inventory text once, writes a
+GUID-named temporary `.iss`, validates that the result has no marker or unsafe
+preprocessor directive, and passes that generated path to ISCC. Clean the
+temporary script in `finally`, including when the compiler returns nonzero.
 
 - [ ] **Step 4: Run focused tests and prove GREEN**
 
 Run ReleaseWorkflow and the real ISCC fixture. Confirm the compiled setup
-source contains the expected injected procedure and arbitrary include aliases
-leave neither setup nor inventory output.
+source contains the expected injected procedure; literal and line-spanned
+include aliases plus other code-generating directives leave neither setup nor
+inventory output; a nonzero compiler also leaves no generated `.iss`.
 
 - [ ] **Step 5: Commit**
 
diff --git a/docs/superpowers/specs/2026-08-28-v2522-install-runtime-reliability-design.md b/docs/superpowers/specs/2026-08-28-v2522-install-runtime-reliability-design.md
index a57c866..081e19d 100644
--- a/docs/superpowers/specs/2026-08-28-v2522-install-runtime-reliability-design.md
+++ b/docs/superpowers/specs/2026-08-28-v2522-install-runtime-reliability-design.md
@@ -57,10 +57,13 @@ payload for the requested version.
 
 Build creates a one-time generated `.iss` from the checked-in template by
 replacing one fixed inventory marker with the verified destination-directory
-procedure. The template contains no external `#include` or `#+` directive;
-build rejects both spellings before ISCC runs. This avoids attempting to
-reimplement ISPP preprocessing while making the directory inventory and the
-exact source compiled by ISCC one artifact.
+procedure. The template accepts only the literal build directives required by
+the checked-in script (`#ifndef`, `#define`, `#error`, `#endif`); it rejects
+every other simple preprocessor directive, any line-spanning continuation, and
+all pragma directives before ISCC runs. This prohibits external inclusion and
+preprocessor-generated `[Files]` entries without reimplementing ISPP, while
+making the directory inventory and the exact source compiled by ISCC one
+artifact.
 
 ### 2. Bounded stable-tree acquisition
 

From d1747115e030f5b36d63667d2e15d82e683e7b4f Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 04:24:38 +0800
Subject: [PATCH 013/187] fix: reject unsafe Inno preprocessor directives

---
 build/build.ps1                               |  28 +-
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 278 ++++++++++++++++++
 tools/New-InstallerDestinationInventory.ps1   |  22 +-
 3 files changed, 318 insertions(+), 10 deletions(-)

diff --git a/build/build.ps1 b/build/build.ps1
index 426b0f3..36e7693 100644
--- a/build/build.ps1
+++ b/build/build.ps1
@@ -116,6 +116,26 @@ function Assert-CcodBuildInstallerDestinationInventory {
     return $inventoryPath
 }
 
+function Assert-CcodBuildInnoPreprocessorLines {
+    param(
+        [Parameter(Mandatory)][AllowEmptyCollection()][AllowEmptyString()][string[]]$Lines,
+        [Parameter(Mandatory)][string]$Kind
+    )
+    $allowedDirectives = @('ifndef','define','error','endif')
+    for ($lineIndex = 0; $lineIndex -lt $Lines.Count; $lineIndex++) {
+        $line = [string]$Lines[$lineIndex]
+        $lineNumber = $lineIndex + 1
+        if ($line -match '\\[ \t]*$') {
+            throw "$Kind requires an include-free simple preprocessor source; line continuation is not permitted at line $lineNumber."
+        }
+        if ($line -notmatch '^[ \t]*#') { continue }
+        $directiveMatch = [regex]::Match($line,'^[ \t]*#(?<directive>[A-Za-z]+)\b')
+        if (-not $directiveMatch.Success -or $allowedDirectives -cnotcontains $directiveMatch.Groups['directive'].Value) {
+            throw "$Kind requires an include-free simple preprocessor source; unsafe directive at line ${lineNumber}: $line"
+        }
+    }
+}
+
 function New-CcodBuildGeneratedInnoScript {
     param(
         [Parameter(Mandatory)][string]$TemplatePath,
@@ -137,9 +157,7 @@ function New-CcodBuildGeneratedInnoScript {
 
     $marker = '// CCOD_INSTALLER_DESTINATION_INVENTORY'
     $templateSource = [IO.File]::ReadAllText($template,[Text.UTF8Encoding]::new($false))
-    if ($templateSource -match '(?m)^\s*#\s*(?:include\b|\+)') {
-        throw 'The Inno Setup template must be include-free; external #include and #+ directives are not permitted.'
-    }
+    Assert-CcodBuildInnoPreprocessorLines -Lines ([IO.File]::ReadAllLines($template,[Text.UTF8Encoding]::new($false))) -Kind 'The Inno Setup template'
     $markerCount = [regex]::Matches($templateSource,[regex]::Escape($marker)).Count
     $markerLineCount = [regex]::Matches($templateSource,'(?m)^\s*// CCOD_INSTALLER_DESTINATION_INVENTORY\s*$').Count
     if ($markerCount -ne 1 -or $markerLineCount -ne 1) {
@@ -151,9 +169,7 @@ function New-CcodBuildGeneratedInnoScript {
     if ($generatedSource.Contains($marker)) {
         throw 'The generated Inno Setup script contains an unresolved inventory marker.'
     }
-    if ($generatedSource -match '(?m)^\s*#\s*(?:include\b|\+)') {
-        throw 'The generated Inno Setup script contains an external #include or #+ directive.'
-    }
+    Assert-CcodBuildInnoPreprocessorLines -Lines ([regex]::Split($generatedSource,'\r\n|\n|\r')) -Kind 'The generated Inno Setup script'
 
     try {
         Write-CcodBuildUtf8 -Path $output -Text $generatedSource
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index af07a01..7a70560 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -203,6 +203,237 @@ $($fixture.Directive)
     }
 }
 
+Invoke-CcodTest 'line-spanned include forms are rejected before inventory generation or real ISCC' {
+    $iscc = @(
+        (Join-Path $env:LOCALAPPDATA 'Programs\Inno Setup 6\ISCC.exe'),
+        (Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'),
+        (Join-Path $env:ProgramFiles 'Inno Setup 6\ISCC.exe')
+    ) | Where-Object { $_ -and [IO.File]::Exists($_) } | Select-Object -First 1
+    if (-not $iscc) { throw 'Inno Setup 6 is required for the line-spanned include fixtures' }
+    . (Join-Path $repositoryRoot 'build\build.ps1') -Library
+    $results = [Collections.Generic.List[object]]::new()
+    foreach ($fixture in @(
+        [pscustomobject]@{Name='line-spanned include keyword';Lines=@('# \','include "extra.iss"')},
+        [pscustomobject]@{Name='line-spanned plus alias';Lines=@('# \','+ "extra.iss"')}
+    )) {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-line-spanned-include-' + [guid]::NewGuid().ToString('N'))
+        try {
+            $payload = Join-Path $root 'payload'
+            $output = Join-Path $root 'output'
+            [IO.Directory]::CreateDirectory($payload) | Out-Null
+            [IO.Directory]::CreateDirectory($output) | Out-Null
+            $firstSource = Join-Path $root 'fixture-a.txt'
+            $secondSource = Join-Path $root 'fixture-b.txt'
+            [IO.File]::WriteAllText($firstSource,'first',[Text.UTF8Encoding]::new($false))
+            [IO.File]::WriteAllText($secondSource,'second',[Text.UTF8Encoding]::new($false))
+            $extraPath = Join-Path $root 'extra.iss'
+            $extraSource = @"
+[Files]
+Source: "$secondSource"; DestDir: "{app}\second"; Flags: ignoreversion
+"@
+            [IO.File]::WriteAllText($extraPath,$extraSource,[Text.UTF8Encoding]::new($false))
+            $templatePath = Join-Path $root 'Template.iss'
+            $directive = $fixture.Lines -join "`r`n"
+            $templateSource = @"
+[Setup]
+AppName=LineSpannedInclude
+AppVersion=1.0.0
+DefaultDirName={tmp}\LineSpannedInclude
+OutputDir=$output
+OutputBaseFilename=LineSpannedInclude
+Uninstallable=no
+$directive
+[Files]
+Source: "$firstSource"; DestDir: "{app}\first"; Flags: ignoreversion
+[Code]
+// CCOD_INSTALLER_DESTINATION_INVENTORY
+"@
+            [IO.File]::WriteAllText($templatePath,$templateSource,[Text.UTF8Encoding]::new($false))
+            $inventoryPath = Join-Path $root 'Inventory.iss'
+            $setupPath = Join-Path $output 'LineSpannedInclude.exe'
+            $failure = $null
+            $compilerAttempted = $false
+            try {
+                & (Join-Path $repositoryRoot 'tools\New-InstallerDestinationInventory.ps1') -RepositoryRoot $repositoryRoot -PayloadRoot $payload -ProjectVersion '2.5.22' -InnoScriptPath $templatePath -OutputPath $inventoryPath | Out-Null
+                $compilerAttempted = $true
+                Invoke-CcodBuildInnoCompiler -TemplatePath $templatePath -InventoryPath $inventoryPath -IsccPath $iscc -Arguments @() -SetupPath $setupPath
+            } catch { $failure = $_ }
+            $results.Add([pscustomobject]@{
+                Name = $fixture.Name
+                Failure = $failure
+                CompilerAttempted = $compilerAttempted
+                InventoryExists = [IO.File]::Exists($inventoryPath)
+                SetupExists = [IO.File]::Exists($setupPath)
+                GeneratedCount = @(Get-ChildItem -LiteralPath $root -Filter '.ccod-generated-setup-*.iss' -File -Force).Count
+            })
+        } finally {
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+        }
+    }
+    foreach ($result in $results) {
+        Assert-CcodTrue ($null -ne $result.Failure) "$($result.Name) is rejected before the compiler boundary"
+        Assert-CcodTrue ($result.Failure.Exception.Message -cmatch 'preprocessor|continuation') "$($result.Name) failure identifies the strict preprocessor boundary"
+        Assert-CcodTrue (-not $result.CompilerAttempted) "$($result.Name) never reaches the real ISCC boundary"
+        Assert-CcodTrue (-not $result.InventoryExists) "$($result.Name) leaves no inventory output"
+        Assert-CcodTrue (-not $result.SetupExists) "$($result.Name) leaves no setup artifact"
+        Assert-CcodEqual 0 $result.GeneratedCount "$($result.Name) leaves no generated compiler input"
+    }
+}
+
+Invoke-CcodTest 'inventory generation rejects pragma, emit, and unknown simple preprocessor directives' {
+    $results = [Collections.Generic.List[object]]::new()
+    foreach ($fixture in @(
+        [pscustomobject]@{Name='pragma';Directive='#pragma parseroption -u+'},
+        [pscustomobject]@{Name='emit';Directive='#emit "[Files]"'},
+        [pscustomobject]@{Name='unknown';Directive='#futuredirective "extra.iss"'}
+    )) {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-unsafe-inno-directive-' + [guid]::NewGuid().ToString('N'))
+        try {
+            $payload = Join-Path $root 'payload'
+            [IO.Directory]::CreateDirectory($payload) | Out-Null
+            $sourcePath = Join-Path $root 'fixture.txt'
+            [IO.File]::WriteAllText($sourcePath,'fixture',[Text.UTF8Encoding]::new($false))
+            $templatePath = Join-Path $root 'Template.iss'
+            $templateSource = @"
+[Setup]
+AppName=UnsafeDirective
+AppVersion=1.0.0
+DefaultDirName={app}
+[Files]
+Source: "$sourcePath"; DestDir: "{app}\first"; Flags: ignoreversion
+[Code]
+// CCOD_INSTALLER_DESTINATION_INVENTORY
+$($fixture.Directive)
+"@
+            [IO.File]::WriteAllText($templatePath,$templateSource,[Text.UTF8Encoding]::new($false))
+            $inventoryPath = Join-Path $root 'Inventory.iss'
+            $failure = $null
+            try {
+                & (Join-Path $repositoryRoot 'tools\New-InstallerDestinationInventory.ps1') -RepositoryRoot $repositoryRoot -PayloadRoot $payload -ProjectVersion '2.5.22' -InnoScriptPath $templatePath -OutputPath $inventoryPath | Out-Null
+            } catch { $failure = $_ }
+            $results.Add([pscustomobject]@{
+                Name = $fixture.Name
+                Failure = $failure
+                InventoryExists = [IO.File]::Exists($inventoryPath)
+            })
+        } finally {
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+        }
+    }
+    foreach ($result in $results) {
+        Assert-CcodTrue ($null -ne $result.Failure) "$($result.Name) directive is rejected before inventory generation"
+        Assert-CcodTrue ($result.Failure.Exception.Message -cmatch 'preprocessor|directive') "$($result.Name) failure identifies the strict directive boundary"
+        Assert-CcodTrue (-not $result.InventoryExists) "$($result.Name) directive leaves no inventory output"
+    }
+}
+
+Invoke-CcodTest 'generated setup creation applies the same strict preprocessor boundary before ISCC' {
+    . (Join-Path $repositoryRoot 'build\build.ps1') -Library
+    $results = [Collections.Generic.List[object]]::new()
+    foreach ($fixture in @(
+        [pscustomobject]@{Name='line-spanned include keyword';Directive=(@('# \','include "extra.iss"') -join "`r`n")},
+        [pscustomobject]@{Name='line-spanned plus alias';Directive=(@('# \','+ "extra.iss"') -join "`r`n")},
+        [pscustomobject]@{Name='pragma';Directive='#pragma parseroption -u+'},
+        [pscustomobject]@{Name='emit';Directive='#emit "[Files]"'},
+        [pscustomobject]@{Name='unknown';Directive='#futuredirective "extra.iss"'}
+    )) {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-generated-unsafe-directive-' + [guid]::NewGuid().ToString('N'))
+        try {
+            [IO.Directory]::CreateDirectory($root) | Out-Null
+            $templatePath = Join-Path $root 'Template.iss'
+            $templateSource = @"
+[Setup]
+AppName=GeneratedUnsafeDirective
+AppVersion=1.0.0
+DefaultDirName={tmp}\GeneratedUnsafeDirective
+OutputBaseFilename=GeneratedUnsafeDirective
+Uninstallable=no
+[Code]
+// CCOD_INSTALLER_DESTINATION_INVENTORY
+$($fixture.Directive)
+"@
+            [IO.File]::WriteAllText($templatePath,$templateSource,[Text.UTF8Encoding]::new($false))
+            $inventoryPath = Join-Path $root 'Inventory.iss'
+            $inventorySource = @'
+procedure AddCcodExpectedSetupDirectories(Directories: TStrings);
+begin
+end;
+'@
+            [IO.File]::WriteAllText($inventoryPath,$inventorySource,[Text.UTF8Encoding]::new($false))
+            $compilerMarker = Join-Path $root 'iscc-invoked.txt'
+            $compilerPath = Join-Path $root 'fake-iscc.cmd'
+            $setupPath = Join-Path $root 'setup.exe'
+            $compilerSource = "@echo off`r`n> `"$compilerMarker`" echo invoked`r`n> `"$setupPath`" echo setup`r`nexit /b 0`r`n"
+            [IO.File]::WriteAllText($compilerPath,$compilerSource,[Text.ASCIIEncoding]::new())
+            $failure = $null
+            try {
+                Invoke-CcodBuildInnoCompiler -TemplatePath $templatePath -InventoryPath $inventoryPath -IsccPath $compilerPath -Arguments @() -SetupPath $setupPath
+            } catch { $failure = $_ }
+            $results.Add([pscustomobject]@{
+                Name = $fixture.Name
+                Failure = $failure
+                CompilerInvoked = [IO.File]::Exists($compilerMarker)
+                SetupExists = [IO.File]::Exists($setupPath)
+                GeneratedCount = @(Get-ChildItem -LiteralPath $root -Filter '.ccod-generated-setup-*.iss' -File -Force).Count
+            })
+        } finally {
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+        }
+    }
+    foreach ($result in $results) {
+        Assert-CcodTrue ($null -ne $result.Failure) "$($result.Name) is rejected before generated setup compilation"
+        Assert-CcodTrue ($result.Failure.Exception.Message -cmatch 'preprocessor|continuation|directive') "$($result.Name) failure identifies the strict generated-source boundary"
+        Assert-CcodTrue (-not $result.CompilerInvoked) "$($result.Name) does not invoke ISCC"
+        Assert-CcodTrue (-not $result.SetupExists) "$($result.Name) leaves no setup artifact"
+        Assert-CcodEqual 0 $result.GeneratedCount "$($result.Name) leaves no generated compiler input"
+    }
+}
+
+Invoke-CcodTest 'generated setup rejects an unsafe directive introduced by inventory before ISCC' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-generated-unsafe-inventory-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $templatePath = Join-Path $root 'Template.iss'
+        $templateSource = @'
+[Setup]
+AppName=GeneratedUnsafeInventory
+AppVersion=1.0.0
+DefaultDirName={tmp}\GeneratedUnsafeInventory
+OutputBaseFilename=GeneratedUnsafeInventory
+Uninstallable=no
+[Code]
+// CCOD_INSTALLER_DESTINATION_INVENTORY
+'@
+        [IO.File]::WriteAllText($templatePath,$templateSource,[Text.UTF8Encoding]::new($false))
+        $inventoryPath = Join-Path $root 'Inventory.iss'
+        $inventorySource = @'
+procedure AddCcodExpectedSetupDirectories(Directories: TStrings);
+begin
+end;
+#emit "[Files]"
+'@
+        [IO.File]::WriteAllText($inventoryPath,$inventorySource,[Text.UTF8Encoding]::new($false))
+        $compilerMarker = Join-Path $root 'iscc-invoked.txt'
+        $compilerPath = Join-Path $root 'fake-iscc.cmd'
+        $setupPath = Join-Path $root 'setup.exe'
+        $compilerSource = "@echo off`r`n> `"$compilerMarker`" echo invoked`r`n> `"$setupPath`" echo setup`r`nexit /b 0`r`n"
+        [IO.File]::WriteAllText($compilerPath,$compilerSource,[Text.ASCIIEncoding]::new())
+        . (Join-Path $repositoryRoot 'build\build.ps1') -Library
+        $failure = $null
+        try {
+            Invoke-CcodBuildInnoCompiler -TemplatePath $templatePath -InventoryPath $inventoryPath -IsccPath $compilerPath -Arguments @() -SetupPath $setupPath
+        } catch { $failure = $_ }
+
+        Assert-CcodTrue ($null -ne $failure) 'unsafe inventory directive is rejected after marker replacement'
+        Assert-CcodTrue ($failure.Exception.Message -cmatch 'preprocessor|directive') 'unsafe inventory failure identifies the final generated-source boundary'
+        Assert-CcodTrue (-not [IO.File]::Exists($compilerMarker)) 'unsafe inventory does not invoke ISCC'
+        Assert-CcodTrue (-not [IO.File]::Exists($setupPath)) 'unsafe inventory leaves no setup artifact'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath $root -Filter '.ccod-generated-setup-*.iss' -File -Force).Count 'unsafe inventory leaves no generated setup script'
+    } finally {
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
 Invoke-CcodTest 'build rejects invalid generated setup inputs before invoking ISCC' {
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-generated-setup-invalid-' + [guid]::NewGuid().ToString('N'))
     try {
@@ -325,6 +556,53 @@ end;
     }
 }
 
+Invoke-CcodTest 'build cleans the GUID generated setup when ISCC returns nonzero' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-generated-setup-compiler-failure-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $templatePath = Join-Path $root 'Template.iss'
+        $templateSource = @'
+[Setup]
+AppName=GeneratedSetupCompilerFailure
+AppVersion=1.0.0
+DefaultDirName={tmp}\GeneratedSetupCompilerFailure
+OutputBaseFilename=GeneratedSetupCompilerFailure
+Uninstallable=no
+[Code]
+// CCOD_INSTALLER_DESTINATION_INVENTORY
+'@
+        [IO.File]::WriteAllText($templatePath,$templateSource,[Text.UTF8Encoding]::new($false))
+        $inventoryPath = Join-Path $root 'Inventory.iss'
+        $inventorySource = @'
+procedure AddCcodExpectedSetupDirectories(Directories: TStrings);
+begin
+end;
+'@
+        [IO.File]::WriteAllText($inventoryPath,$inventorySource,[Text.UTF8Encoding]::new($false))
+        $compilerArgument = Join-Path $root 'iscc-argument.txt'
+        $compilerPath = Join-Path $root 'fake-iscc.cmd'
+        $setupPath = Join-Path $root 'setup.exe'
+        $compilerSource = "@echo off`r`n> `"$compilerArgument`" echo %~f1`r`nexit /b 23`r`n"
+        [IO.File]::WriteAllText($compilerPath,$compilerSource,[Text.ASCIIEncoding]::new())
+        . (Join-Path $repositoryRoot 'build\build.ps1') -Library
+        $failure = $null
+        try {
+            Invoke-CcodBuildInnoCompiler -TemplatePath $templatePath -InventoryPath $inventoryPath -IsccPath $compilerPath -Arguments @() -SetupPath $setupPath
+        } catch { $failure = $_ }
+
+        Assert-CcodTrue ($null -ne $failure) 'nonzero ISCC exit fails the build boundary'
+        Assert-CcodTrue ($failure.Exception.Message -cmatch 'exit code 23') 'compiler failure retains the exact nonzero exit code'
+        Assert-CcodTrue ([IO.File]::Exists($compilerArgument)) 'nonzero compiler records the generated source argument'
+        $compiledPath = [IO.File]::ReadAllText($compilerArgument).Trim()
+        Assert-CcodTrue ([IO.Path]::GetFileName($compiledPath) -cmatch '^\.ccod-generated-setup-[0-9a-f]{32}\.iss$') 'nonzero compiler receives the GUID generated source'
+        Assert-CcodTrue (-not [IO.File]::Exists($compiledPath)) 'nonzero compiler path is removed by the build finally boundary'
+        Assert-CcodTrue (-not [IO.File]::Exists($setupPath)) 'nonzero compiler produces no accepted setup artifact'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath $root -Filter '.ccod-generated-setup-*.iss' -File -Force).Count 'nonzero compiler leaves no generated setup script'
+    } finally {
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
 Invoke-CcodTest 'real ISCC compiles the generated setup with its injected inventory procedure' {
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-generated-setup-iscc-' + [guid]::NewGuid().ToString('N'))
     try {
diff --git a/tools/New-InstallerDestinationInventory.ps1 b/tools/New-InstallerDestinationInventory.ps1
index c12f952..e898f7a 100644
--- a/tools/New-InstallerDestinationInventory.ps1
+++ b/tools/New-InstallerDestinationInventory.ps1
@@ -32,11 +32,25 @@ function Add-CcodExpectedDirectory {
     }
 }
 
-$lines = @(Get-Content -LiteralPath $inno -Encoding UTF8)
-$includeDirectives = @($lines | Where-Object { $_ -match '^\s*#\s*(?:include\b|\+)' })
-if ($includeDirectives.Count -ne 0) {
-    throw 'Setup destination inventory requires an include-free template; external #include and #+ directives are not permitted.'
+function Assert-CcodInstallerInnoPreprocessorLines {
+    param([Parameter(Mandatory)][AllowEmptyCollection()][AllowEmptyString()][string[]]$Lines)
+    $allowedDirectives = @('ifndef','define','error','endif')
+    for ($lineIndex = 0; $lineIndex -lt $Lines.Count; $lineIndex++) {
+        $line = [string]$Lines[$lineIndex]
+        $lineNumber = $lineIndex + 1
+        if ($line -match '\\[ \t]*$') {
+            throw "Setup destination inventory requires an include-free simple preprocessor template; line continuation is not permitted at line $lineNumber."
+        }
+        if ($line -notmatch '^[ \t]*#') { continue }
+        $directiveMatch = [regex]::Match($line,'^[ \t]*#(?<directive>[A-Za-z]+)\b')
+        if (-not $directiveMatch.Success -or $allowedDirectives -cnotcontains $directiveMatch.Groups['directive'].Value) {
+            throw "Setup destination inventory requires an include-free simple preprocessor template; unsafe directive at line ${lineNumber}: $line"
+        }
+    }
 }
+
+$lines = @(Get-Content -LiteralPath $inno -Encoding UTF8)
+Assert-CcodInstallerInnoPreprocessorLines -Lines $lines
 $filesSectionCount = @($lines | Where-Object { $_ -match '^\s*\[Files\]\s*$' }).Count
 if ($filesSectionCount -ne 1) { throw "Setup destination inventory requires exactly one [Files] section; found $filesSectionCount." }
 $insideFiles = $false

From 05d3646b5f64e6eff9975722a5bd95c4261ab053 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 04:47:37 +0800
Subject: [PATCH 014/187] fix: enforce exact Inno preprocessor constructs

---
 build/build.ps1                               |  39 +++-
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 212 ++++++++++++++++++
 tools/New-InstallerDestinationInventory.ps1   |  39 +++-
 3 files changed, 278 insertions(+), 12 deletions(-)

diff --git a/build/build.ps1 b/build/build.ps1
index 36e7693..2f53eb1 100644
--- a/build/build.ps1
+++ b/build/build.ps1
@@ -121,17 +121,44 @@ function Assert-CcodBuildInnoPreprocessorLines {
         [Parameter(Mandatory)][AllowEmptyCollection()][AllowEmptyString()][string[]]$Lines,
         [Parameter(Mandatory)][string]$Kind
     )
-    $allowedDirectives = @('ifndef','define','error','endif')
+    $allowedSimpleDirectives = @(
+        '#ifndef TrayHostArtifactDirectory',
+        '#define TrayHostArtifactDirectory SourcePath + "\generated\trayhost"',
+        '#ifndef PortableArtifactDirectory',
+        '#define PortableArtifactDirectory SourcePath + "\generated\portable"',
+        '#ifndef InstallerPayloadDirectory',
+        '#error InstallerPayloadDirectory must be supplied by the release builder',
+        '#ifndef InstallerPayloadManifestSha256',
+        '#error InstallerPayloadManifestSha256 must be supplied by the release builder',
+        '#endif'
+    )
+    $allowedInlineConstructs = @(
+        '{#ProjectVersion}',
+        '{#TrayHostArtifactDirectory}',
+        '{#PortableArtifactDirectory}',
+        '{#InstallerPayloadDirectory}',
+        '{#InstallerPayloadManifestSha256}'
+    )
     for ($lineIndex = 0; $lineIndex -lt $Lines.Count; $lineIndex++) {
         $line = [string]$Lines[$lineIndex]
         $lineNumber = $lineIndex + 1
-        if ($line -match '\\[ \t]*$') {
+        if ($line -match '\\\s*$') {
             throw "$Kind requires an include-free simple preprocessor source; line continuation is not permitted at line $lineNumber."
         }
-        if ($line -notmatch '^[ \t]*#') { continue }
-        $directiveMatch = [regex]::Match($line,'^[ \t]*#(?<directive>[A-Za-z]+)\b')
-        if (-not $directiveMatch.Success -or $allowedDirectives -cnotcontains $directiveMatch.Groups['directive'].Value) {
-            throw "$Kind requires an include-free simple preprocessor source; unsafe directive at line ${lineNumber}: $line"
+        if ($line -match '^\s*#' -and $allowedSimpleDirectives -cnotcontains $line) {
+            throw "$Kind requires an include-free exact preprocessor source; unsafe simple directive at line ${lineNumber}: $line"
+        }
+        $inlineStart = $line.IndexOf('{#',[StringComparison]::Ordinal)
+        while ($inlineStart -ge 0) {
+            $inlineEnd = $line.IndexOf('}',$inlineStart + 2)
+            if ($inlineEnd -lt 0) {
+                throw "$Kind contains an unterminated inline preprocessor construct at line $lineNumber."
+            }
+            $inlineConstruct = $line.Substring($inlineStart,$inlineEnd - $inlineStart + 1)
+            if ($allowedInlineConstructs -cnotcontains $inlineConstruct) {
+                throw "$Kind contains an unsafe inline preprocessor construct at line ${lineNumber}: $inlineConstruct"
+            }
+            $inlineStart = $line.IndexOf('{#',$inlineEnd + 1,[StringComparison]::Ordinal)
         }
     }
 }
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 7a70560..9c8116a 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -327,6 +327,218 @@ $($fixture.Directive)
     }
 }
 
+Invoke-CcodTest 'VT and FF prefixed directives are rejected by inventory and build boundaries before ISCC' {
+    $iscc = @(
+        (Join-Path $env:LOCALAPPDATA 'Programs\Inno Setup 6\ISCC.exe'),
+        (Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'),
+        (Join-Path $env:ProgramFiles 'Inno Setup 6\ISCC.exe')
+    ) | Where-Object { $_ -and [IO.File]::Exists($_) } | Select-Object -First 1
+    if (-not $iscc) { throw 'Inno Setup 6 is required for the preprocessor whitespace fixtures' }
+    . (Join-Path $repositoryRoot 'build\build.ps1') -Library
+    $results = [Collections.Generic.List[object]]::new()
+    foreach ($fixture in @(
+        [pscustomobject]@{Name='vertical tab';Prefix=[char]0x0B},
+        [pscustomobject]@{Name='form feed';Prefix=[char]0x0C}
+    )) {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-preprocessor-whitespace-' + [guid]::NewGuid().ToString('N'))
+        try {
+            $payload = Join-Path $root 'payload'
+            $realOutput = Join-Path $root 'real-output'
+            [IO.Directory]::CreateDirectory($payload) | Out-Null
+            [IO.Directory]::CreateDirectory($realOutput) | Out-Null
+            $sourcePath = Join-Path $root 'fixture.txt'
+            [IO.File]::WriteAllText($sourcePath,'fixture',[Text.UTF8Encoding]::new($false))
+            $unsafeDirective = [string]$fixture.Prefix + '#emit ''AppPublisher=InjectedByWhitespace'''
+            $templatePath = Join-Path $root 'Template.iss'
+            $templateSource = @"
+[Setup]
+AppName=WhitespaceDirective
+AppVersion=1.0.0
+DefaultDirName={tmp}\WhitespaceDirective
+OutputDir=$realOutput
+OutputBaseFilename=WhitespaceDirective
+Uninstallable=no
+$unsafeDirective
+[Files]
+Source: "$sourcePath"; DestDir: "{app}\first"; Flags: ignoreversion
+[Code]
+// CCOD_INSTALLER_DESTINATION_INVENTORY
+"@
+            [IO.File]::WriteAllText($templatePath,$templateSource,[Text.UTF8Encoding]::new($false))
+            $inventoryPath = Join-Path $root 'Inventory.iss'
+            $realSetupPath = Join-Path $realOutput 'WhitespaceDirective.exe'
+            $generatorFailure = $null
+            $realCompilerAttempted = $false
+            try {
+                & (Join-Path $repositoryRoot 'tools\New-InstallerDestinationInventory.ps1') -RepositoryRoot $repositoryRoot -PayloadRoot $payload -ProjectVersion '2.5.22' -InnoScriptPath $templatePath -OutputPath $inventoryPath | Out-Null
+                $realCompilerAttempted = $true
+                Invoke-CcodBuildInnoCompiler -TemplatePath $templatePath -InventoryPath $inventoryPath -IsccPath $iscc -Arguments @() -SetupPath $realSetupPath
+            } catch { $generatorFailure = $_ }
+
+            $buildTemplatePath = Join-Path $root 'BuildTemplate.iss'
+            [IO.File]::WriteAllText($buildTemplatePath,$templateSource,[Text.UTF8Encoding]::new($false))
+            $buildInventoryPath = Join-Path $root 'BuildInventory.iss'
+            $buildInventorySource = @'
+procedure AddCcodExpectedSetupDirectories(Directories: TStrings);
+begin
+end;
+'@
+            [IO.File]::WriteAllText($buildInventoryPath,$buildInventorySource,[Text.UTF8Encoding]::new($false))
+            $compilerMarker = Join-Path $root 'fake-iscc-invoked.txt'
+            $compilerPath = Join-Path $root 'fake-iscc.cmd'
+            $buildSetupPath = Join-Path $root 'build-setup.exe'
+            $compilerSource = "@echo off`r`n> `"$compilerMarker`" echo invoked`r`n> `"$buildSetupPath`" echo setup`r`nexit /b 0`r`n"
+            [IO.File]::WriteAllText($compilerPath,$compilerSource,[Text.ASCIIEncoding]::new())
+            $buildFailure = $null
+            try {
+                Invoke-CcodBuildInnoCompiler -TemplatePath $buildTemplatePath -InventoryPath $buildInventoryPath -IsccPath $compilerPath -Arguments @() -SetupPath $buildSetupPath
+            } catch { $buildFailure = $_ }
+
+            $results.Add([pscustomobject]@{
+                Name = $fixture.Name
+                GeneratorFailure = $generatorFailure
+                InventoryExists = [IO.File]::Exists($inventoryPath)
+                RealCompilerAttempted = $realCompilerAttempted
+                RealSetupExists = [IO.File]::Exists($realSetupPath)
+                BuildFailure = $buildFailure
+                MarkerCompilerInvoked = [IO.File]::Exists($compilerMarker)
+                BuildSetupExists = [IO.File]::Exists($buildSetupPath)
+                GeneratedCount = @(Get-ChildItem -LiteralPath $root -Filter '.ccod-generated-setup-*.iss' -File -Force).Count
+            })
+        } finally {
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+        }
+    }
+    foreach ($result in $results) {
+        Assert-CcodTrue ($null -ne $result.GeneratorFailure) "$($result.Name) directive is rejected before inventory generation"
+        Assert-CcodTrue ($result.GeneratorFailure.Exception.Message -cmatch 'preprocessor|directive') "$($result.Name) generator failure identifies the preprocessor boundary"
+        Assert-CcodTrue (-not $result.InventoryExists) "$($result.Name) leaves no inventory output"
+        Assert-CcodTrue (-not $result.RealCompilerAttempted) "$($result.Name) never reaches real ISCC"
+        Assert-CcodTrue (-not $result.RealSetupExists) "$($result.Name) leaves no real setup artifact"
+        Assert-CcodTrue ($null -ne $result.BuildFailure) "$($result.Name) directive is rejected by generated setup creation"
+        Assert-CcodTrue ($result.BuildFailure.Exception.Message -cmatch 'preprocessor|directive') "$($result.Name) build failure identifies the preprocessor boundary"
+        Assert-CcodTrue (-not $result.MarkerCompilerInvoked) "$($result.Name) never reaches the marker compiler"
+        Assert-CcodTrue (-not $result.BuildSetupExists) "$($result.Name) leaves no marker setup artifact"
+        Assert-CcodEqual 0 $result.GeneratedCount "$($result.Name) leaves no generated compiler script"
+    }
+}
+
+Invoke-CcodTest 'inline file and unsafe define expansion are rejected before inventory or ISCC' {
+    $iscc = @(
+        (Join-Path $env:LOCALAPPDATA 'Programs\Inno Setup 6\ISCC.exe'),
+        (Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'),
+        (Join-Path $env:ProgramFiles 'Inno Setup 6\ISCC.exe')
+    ) | Where-Object { $_ -and [IO.File]::Exists($_) } | Select-Object -First 1
+    if (-not $iscc) { throw 'Inno Setup 6 is required for the inline preprocessor fixtures' }
+    . (Join-Path $repositoryRoot 'build\build.ps1') -Library
+    $results = [Collections.Generic.List[object]]::new()
+    foreach ($fixtureName in @('inline file','unsafe define expansion')) {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-inline-preprocessor-' + [guid]::NewGuid().ToString('N'))
+        try {
+            $payload = Join-Path $root 'payload'
+            $realOutput = Join-Path $root 'real-output'
+            [IO.Directory]::CreateDirectory($payload) | Out-Null
+            [IO.Directory]::CreateDirectory($realOutput) | Out-Null
+            $mainSource = Join-Path $root 'main.txt'
+            $injectedSource = Join-Path $root 'injected.txt'
+            $externalText = Join-Path $root 'external.txt'
+            [IO.File]::WriteAllText($mainSource,'main',[Text.UTF8Encoding]::new($false))
+            [IO.File]::WriteAllText($injectedSource,'injected',[Text.UTF8Encoding]::new($false))
+            [IO.File]::WriteAllText($externalText,'external text',[Text.UTF8Encoding]::new($false))
+            $templatePath = Join-Path $root 'Template.iss'
+            if ($fixtureName -ceq 'inline file') {
+                $templateSource = @"
+[Setup]
+AppName=InlineFileDirective
+AppVersion=1.0.0
+DefaultDirName={tmp}\InlineFileDirective
+OutputDir=$realOutput
+OutputBaseFilename=InlineFileDirective
+Uninstallable=no
+LicenseFile={#file "external.txt"}
+[Files]
+Source: "$mainSource"; DestDir: "{app}\main"; Flags: ignoreversion
+[Code]
+// CCOD_INSTALLER_DESTINATION_INVENTORY
+"@
+                $setupName = 'InlineFileDirective.exe'
+            } else {
+                $templateSource = @"
+#define TrayHostArtifactDirectory "[Files]" + NewLine + "Source: ""$injectedSource""; DestDir: ""{app}\injected""; Flags: ignoreversion"
+[Setup]
+AppName=UnsafeDefineExpansion
+AppVersion=1.0.0
+DefaultDirName={tmp}\UnsafeDefineExpansion
+OutputDir=$realOutput
+OutputBaseFilename=UnsafeDefineExpansion
+Uninstallable=no
+{#TrayHostArtifactDirectory}
+[Files]
+Source: "$mainSource"; DestDir: "{app}\main"; Flags: ignoreversion
+[Code]
+// CCOD_INSTALLER_DESTINATION_INVENTORY
+"@
+                $setupName = 'UnsafeDefineExpansion.exe'
+            }
+            [IO.File]::WriteAllText($templatePath,$templateSource,[Text.UTF8Encoding]::new($false))
+            $inventoryPath = Join-Path $root 'Inventory.iss'
+            $realSetupPath = Join-Path $realOutput $setupName
+            $generatorFailure = $null
+            $realCompilerAttempted = $false
+            try {
+                & (Join-Path $repositoryRoot 'tools\New-InstallerDestinationInventory.ps1') -RepositoryRoot $repositoryRoot -PayloadRoot $payload -ProjectVersion '2.5.22' -InnoScriptPath $templatePath -OutputPath $inventoryPath | Out-Null
+                $realCompilerAttempted = $true
+                Invoke-CcodBuildInnoCompiler -TemplatePath $templatePath -InventoryPath $inventoryPath -IsccPath $iscc -Arguments @() -SetupPath $realSetupPath
+            } catch { $generatorFailure = $_ }
+
+            $buildTemplatePath = Join-Path $root 'BuildTemplate.iss'
+            [IO.File]::WriteAllText($buildTemplatePath,$templateSource,[Text.UTF8Encoding]::new($false))
+            $buildInventoryPath = Join-Path $root 'BuildInventory.iss'
+            $buildInventorySource = @'
+procedure AddCcodExpectedSetupDirectories(Directories: TStrings);
+begin
+end;
+'@
+            [IO.File]::WriteAllText($buildInventoryPath,$buildInventorySource,[Text.UTF8Encoding]::new($false))
+            $compilerMarker = Join-Path $root 'fake-iscc-invoked.txt'
+            $compilerPath = Join-Path $root 'fake-iscc.cmd'
+            $buildSetupPath = Join-Path $root 'build-setup.exe'
+            $compilerSource = "@echo off`r`n> `"$compilerMarker`" echo invoked`r`n> `"$buildSetupPath`" echo setup`r`nexit /b 0`r`n"
+            [IO.File]::WriteAllText($compilerPath,$compilerSource,[Text.ASCIIEncoding]::new())
+            $buildFailure = $null
+            try {
+                Invoke-CcodBuildInnoCompiler -TemplatePath $buildTemplatePath -InventoryPath $buildInventoryPath -IsccPath $compilerPath -Arguments @() -SetupPath $buildSetupPath
+            } catch { $buildFailure = $_ }
+
+            $results.Add([pscustomobject]@{
+                Name = $fixtureName
+                GeneratorFailure = $generatorFailure
+                InventoryExists = [IO.File]::Exists($inventoryPath)
+                RealCompilerAttempted = $realCompilerAttempted
+                RealSetupExists = [IO.File]::Exists($realSetupPath)
+                BuildFailure = $buildFailure
+                MarkerCompilerInvoked = [IO.File]::Exists($compilerMarker)
+                BuildSetupExists = [IO.File]::Exists($buildSetupPath)
+                GeneratedCount = @(Get-ChildItem -LiteralPath $root -Filter '.ccod-generated-setup-*.iss' -File -Force).Count
+            })
+        } finally {
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+        }
+    }
+    foreach ($result in $results) {
+        Assert-CcodTrue ($null -ne $result.GeneratorFailure) "$($result.Name) is rejected before inventory generation"
+        Assert-CcodTrue ($result.GeneratorFailure.Exception.Message -cmatch 'preprocessor|inline|construct|directive') "$($result.Name) generator failure identifies the strict construct boundary"
+        Assert-CcodTrue (-not $result.InventoryExists) "$($result.Name) leaves no inventory output"
+        Assert-CcodTrue (-not $result.RealCompilerAttempted) "$($result.Name) never reaches real ISCC"
+        Assert-CcodTrue (-not $result.RealSetupExists) "$($result.Name) leaves no real setup artifact"
+        Assert-CcodTrue ($null -ne $result.BuildFailure) "$($result.Name) is rejected by generated setup creation"
+        Assert-CcodTrue ($result.BuildFailure.Exception.Message -cmatch 'preprocessor|inline|construct|directive') "$($result.Name) build failure identifies the strict construct boundary"
+        Assert-CcodTrue (-not $result.MarkerCompilerInvoked) "$($result.Name) never reaches the marker compiler"
+        Assert-CcodTrue (-not $result.BuildSetupExists) "$($result.Name) leaves no marker setup artifact"
+        Assert-CcodEqual 0 $result.GeneratedCount "$($result.Name) leaves no generated compiler script"
+    }
+}
+
 Invoke-CcodTest 'generated setup creation applies the same strict preprocessor boundary before ISCC' {
     . (Join-Path $repositoryRoot 'build\build.ps1') -Library
     $results = [Collections.Generic.List[object]]::new()
diff --git a/tools/New-InstallerDestinationInventory.ps1 b/tools/New-InstallerDestinationInventory.ps1
index e898f7a..57f543f 100644
--- a/tools/New-InstallerDestinationInventory.ps1
+++ b/tools/New-InstallerDestinationInventory.ps1
@@ -34,17 +34,44 @@ function Add-CcodExpectedDirectory {
 
 function Assert-CcodInstallerInnoPreprocessorLines {
     param([Parameter(Mandatory)][AllowEmptyCollection()][AllowEmptyString()][string[]]$Lines)
-    $allowedDirectives = @('ifndef','define','error','endif')
+    $allowedSimpleDirectives = @(
+        '#ifndef TrayHostArtifactDirectory',
+        '#define TrayHostArtifactDirectory SourcePath + "\generated\trayhost"',
+        '#ifndef PortableArtifactDirectory',
+        '#define PortableArtifactDirectory SourcePath + "\generated\portable"',
+        '#ifndef InstallerPayloadDirectory',
+        '#error InstallerPayloadDirectory must be supplied by the release builder',
+        '#ifndef InstallerPayloadManifestSha256',
+        '#error InstallerPayloadManifestSha256 must be supplied by the release builder',
+        '#endif'
+    )
+    $allowedInlineConstructs = @(
+        '{#ProjectVersion}',
+        '{#TrayHostArtifactDirectory}',
+        '{#PortableArtifactDirectory}',
+        '{#InstallerPayloadDirectory}',
+        '{#InstallerPayloadManifestSha256}'
+    )
     for ($lineIndex = 0; $lineIndex -lt $Lines.Count; $lineIndex++) {
         $line = [string]$Lines[$lineIndex]
         $lineNumber = $lineIndex + 1
-        if ($line -match '\\[ \t]*$') {
+        if ($line -match '\\\s*$') {
             throw "Setup destination inventory requires an include-free simple preprocessor template; line continuation is not permitted at line $lineNumber."
         }
-        if ($line -notmatch '^[ \t]*#') { continue }
-        $directiveMatch = [regex]::Match($line,'^[ \t]*#(?<directive>[A-Za-z]+)\b')
-        if (-not $directiveMatch.Success -or $allowedDirectives -cnotcontains $directiveMatch.Groups['directive'].Value) {
-            throw "Setup destination inventory requires an include-free simple preprocessor template; unsafe directive at line ${lineNumber}: $line"
+        if ($line -match '^\s*#' -and $allowedSimpleDirectives -cnotcontains $line) {
+            throw "Setup destination inventory requires an include-free exact preprocessor template; unsafe simple directive at line ${lineNumber}: $line"
+        }
+        $inlineStart = $line.IndexOf('{#',[StringComparison]::Ordinal)
+        while ($inlineStart -ge 0) {
+            $inlineEnd = $line.IndexOf('}',$inlineStart + 2)
+            if ($inlineEnd -lt 0) {
+                throw "Setup destination inventory contains an unterminated inline preprocessor construct at line $lineNumber."
+            }
+            $inlineConstruct = $line.Substring($inlineStart,$inlineEnd - $inlineStart + 1)
+            if ($allowedInlineConstructs -cnotcontains $inlineConstruct) {
+                throw "Setup destination inventory contains an unsafe inline preprocessor construct at line ${lineNumber}: $inlineConstruct"
+            }
+            $inlineStart = $line.IndexOf('{#',$inlineEnd + 1,[StringComparison]::Ordinal)
         }
     }
 }

From b34b0d1aed066ee0a649e34d9845b538e85216ca Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 05:09:15 +0800
Subject: [PATCH 015/187] fix: stabilize verified Electron process trees

---
 src/persistence/Supervisor.ps1                | 24 +++--
 src/persistence/modules/ProcessControl.psm1   | 40 ++++++++-
 src/persistence/modules/SessionEngine.psm1    | 17 +++-
 tests/persistence/ProcessControl.SelfTest.ps1 | 47 ++++++++++
 tests/persistence/SessionEngine.SelfTest.ps1  | 38 +++++++-
 tests/persistence/Supervisor.SelfTest.ps1     | 90 +++++++++++++++++++
 6 files changed, 242 insertions(+), 14 deletions(-)

diff --git a/src/persistence/Supervisor.ps1 b/src/persistence/Supervisor.ps1
index 0dbfb21..9742335 100644
--- a/src/persistence/Supervisor.ps1
+++ b/src/persistence/Supervisor.ps1
@@ -9,7 +9,7 @@ Set-StrictMode -Version 2.0
 $script:CcodSupervisorScriptPath=if([string]::IsNullOrWhiteSpace($PSCommandPath)){$null}else{[IO.Path]::GetFullPath($PSCommandPath)}
 $script:CcodSupervisorLogPath=$null
 $script:CcodSupervisorAdapterNames=@(
-    'GetIdentity','ResolveLayout','StartClock','GetElapsedMilliseconds','GetUtcNow',
+    'GetIdentity','ResolveLayout','StartClock','GetElapsedMilliseconds','GetUtcNow','Delay',
     'EnterLease','ExitLease','OpenReadyEvent','OpenShutdownEvent','IsEventSignaled','SignalEvent','CloseEvent',
     'ReadActiveRuntime','GetTrustedLogonIdentity','WriteSafeExitIntent','ClearSafeExitIntent','EnterLifecycleOwnership','AssertLifecycleFence','SuspendLifecycleOwnership','ResumeLifecycleOwnership','ExitLifecycleOwnership','OpenLifecycleWakeEvent','ResetLifecycleWakeEvent',
     'ReadLifecycleRequest','ReceiveLifecycleSubmissions','WriteLifecycleSubmissionReceipt','NewLifecycleRequest','WriteLifecycleRequest','MoveLifecyclePhase','CompleteLifecycleRequest','GetLifecycleStep','ReduceLifecycleWorkerResult','NewLifecycleWorkerRequest','AssertLifecycleWorkerResult',
@@ -248,6 +248,7 @@ function Get-CcodSupervisorDefaultAdapters {
     $defaults.StartClock={[Diagnostics.Stopwatch]::StartNew()}
     $defaults.GetElapsedMilliseconds={param($Clock)[long]$Clock.ElapsedMilliseconds}
     $defaults.GetUtcNow={[DateTime]::UtcNow}
+    $defaults.Delay={param($Milliseconds)Start-Sleep -Milliseconds ([int]$Milliseconds)}
     $defaults.EnterLease={param($Kind,$UserSid,$SessionId,$TimeoutMilliseconds)if($Kind -ceq 'AccountSupervisor'){Enter-CcodMutex -Kind $Kind -UserSid $UserSid -TimeoutMilliseconds $TimeoutMilliseconds}else{Enter-CcodMutex -Kind $Kind -UserSid $UserSid -SessionId $SessionId -TimeoutMilliseconds $TimeoutMilliseconds}}
     $defaults.ExitLease={param($Lease)Exit-CcodMutex -Lease $Lease}
     $defaults.OpenReadyEvent={param($UserSid,$SessionId,$Token) $kernelModule=Get-Module -Name KernelObjects|Select-Object -First 1;if($null -eq $kernelModule){throw 'kernel-object module unavailable'};& $kernelModule {param($Sid,$Sess,$Tok)Open-CcodEvent -Kind Ready -UserSid $Sid -SessionId $Sess -ReadyToken $Tok} ([string]$UserSid) ([int]$SessionId) ([string]$Token)}
@@ -662,14 +663,21 @@ function Confirm-CcodSupervisorLifecycleProofCandidate {
     param($HostState,[hashtable]$Adapters,$Candidate)
     $candidateKey=Get-CcodSupervisorSpecialProofKey $Candidate
     if($null-eq$candidateKey){return $false}
-    Update-CcodSupervisorProofObservations $HostState $Adapters
-    if(@($HostState.Special).Count-ne1-or-not(Test-CcodSupervisorExactProcessSnapshotMatch $Candidate $HostState.Special[0].Snapshot)){
-        $HostState.SpecialProof=$null;$HostState.FailedSpecialProofKey=$candidateKey;$HostState.SpecialNeedsInspect=$false
-        return $false
+    for($attempt=0;$attempt-lt2;$attempt++){
+        Update-CcodSupervisorProofObservations $HostState $Adapters
+        if(@($HostState.Special).Count-eq1-and(Test-CcodSupervisorExactProcessSnapshotMatch $Candidate $HostState.Special[0].Snapshot)){
+            $HostState.SpecialProof=$HostState.Special[0].Snapshot;$HostState.Special[0].ProbeValid=$true;$HostState.SpecialNeedsInspect=$false
+            $HostState.FailedSpecialProofKey=$null;$HostState.LifecycleObservation='RemoteVerified';$HostState.ConnectionState=ConvertTo-CcodSupervisorLifecycleObservation RemoteVerified
+            return $true
+        }
+        if($attempt-ne0-or@($HostState.Special).Count-ne0-or@($HostState.Ordinary).Count-ne0){break}
+        $statusEvidence=if($null-ne$HostState.State-and$null-ne$HostState.State.PSObject.Properties['Status']){$HostState.State.Status}else{$null}
+        $current=Invoke-CcodSupervisorNullableAdapter $Adapters.GetProcessSnapshot @([int]$Candidate.Pid,$statusEvidence)
+        if($null-eq$current-or-not(Test-CcodSupervisorExactProcessSnapshotMatch $Candidate $current)){break}
+        Invoke-CcodSupervisorAdapter $Adapters.Delay @([int]50) 0
     }
-    $HostState.SpecialProof=$HostState.Special[0].Snapshot;$HostState.Special[0].ProbeValid=$true;$HostState.SpecialNeedsInspect=$false
-    $HostState.FailedSpecialProofKey=$null;$HostState.LifecycleObservation='RemoteVerified';$HostState.ConnectionState=ConvertTo-CcodSupervisorLifecycleObservation RemoteVerified
-    return $true
+    $HostState.SpecialProof=$null;$HostState.FailedSpecialProofKey=$candidateKey;$HostState.SpecialNeedsInspect=$false
+    return $false
 }
 
 function New-CcodSupervisorLifecycleProofFailure {
diff --git a/src/persistence/modules/ProcessControl.psm1 b/src/persistence/modules/ProcessControl.psm1
index f723324..98b9f50 100644
--- a/src/persistence/modules/ProcessControl.psm1
+++ b/src/persistence/modules/ProcessControl.psm1
@@ -1408,6 +1408,44 @@ function Get-CcodVerifiedProcessTree {
     return @($included | Sort-Object | ForEach-Object { $rereadByPid[[int]$_] })
 }
 
+function Get-CcodStableVerifiedProcessTree {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)]$Root,
+        $StatusEvidence,
+        [ValidateRange(0, 2)][int]$RetryBudget = 1,
+        [hashtable]$Adapters
+    )
+
+    $adapter = Get-CcodProcessAdapters -Adapters $Adapters
+    if (-not $adapter.ContainsKey('GetVerifiedTree')) {
+        $adapter.GetVerifiedTree = {
+            param($ExpectedRoot, $Evidence)
+            Get-CcodVerifiedProcessTree -Root $ExpectedRoot -StatusEvidence $Evidence -Adapters $adapter
+        }.GetNewClosure()
+    }
+
+    for ($attempt = 0; $attempt -le $RetryBudget; $attempt++) {
+        try { $tree = @(& $adapter.GetVerifiedTree $Root $StatusEvidence) } catch { $tree = @() }
+        if ($tree.Count -gt 0) {
+            $matchingRoots = @($tree | Where-Object {
+                $null -ne $_ -and $_.PSObject.Properties['Pid'] -ne $null -and
+                $_.Pid -is [int] -and $_.Pid -eq [int]$Root.Pid -and
+                (Test-CcodProcessMatch -Expected $Root -Actual $_)
+            })
+            if ($matchingRoots.Count -ne 1) { return @() }
+            return @($tree)
+        }
+        if ($attempt -ge $RetryBudget) { return @() }
+
+        try { $rootOutput = @(& $adapter.GetProcess ([int]$Root.Pid) $StatusEvidence 2>&1) } catch { return @() }
+        if ($rootOutput.Count -ne 1 -or $rootOutput[0] -is [Management.Automation.ErrorRecord] -or
+            $null -eq $rootOutput[0] -or -not (Test-CcodProcessMatch -Expected $Root -Actual $rootOutput[0])) { return @() }
+        try { & $adapter.Delay 50 | Out-Null } catch { return @() }
+    }
+    return @()
+}
+
 function Get-CcodVerifiedStaleProcessTree {
     [CmdletBinding()]
     param(
@@ -1995,4 +2033,4 @@ function Start-CcodProcess {
     return New-CcodStartResult -Outcome 'Started' -Snapshot $null -Process $process
 }
 
-Export-ModuleMember -Function Get-CcodProcessIdentityObservation, Get-CcodProcessSnapshot, Test-CcodProcessMatch, Get-CcodStalePackageProcessSnapshot, Get-CcodStalePackageRootResult, Get-CcodVerifiedProcessTree, Get-CcodVerifiedStaleProcessTree, Get-CcodTransactionProcessResult, Find-CcodTransactionProcess, Stop-CcodProcessIfMatch, Stop-CcodStaleProcessIfMatch, Request-CcodProcessGracefulCloseIfMatch, Request-CcodStaleProcessGracefulCloseIfMatch, Wait-CcodProcessExitIfMatch, Wait-CcodStaleProcessExitIfMatch, Start-CcodProcess, Request-CcodOrdinaryPackagedLaunch, Wait-CcodVerifiedOrdinaryRoot, Get-CcodAvailableLoopbackPort, Wait-CcodPortClosed
+Export-ModuleMember -Function Get-CcodProcessIdentityObservation, Get-CcodProcessSnapshot, Test-CcodProcessMatch, Get-CcodStalePackageProcessSnapshot, Get-CcodStalePackageRootResult, Get-CcodVerifiedProcessTree, Get-CcodStableVerifiedProcessTree, Get-CcodVerifiedStaleProcessTree, Get-CcodTransactionProcessResult, Find-CcodTransactionProcess, Stop-CcodProcessIfMatch, Stop-CcodStaleProcessIfMatch, Request-CcodProcessGracefulCloseIfMatch, Request-CcodStaleProcessGracefulCloseIfMatch, Wait-CcodProcessExitIfMatch, Wait-CcodStaleProcessExitIfMatch, Start-CcodProcess, Request-CcodOrdinaryPackagedLaunch, Wait-CcodVerifiedOrdinaryRoot, Get-CcodAvailableLoopbackPort, Wait-CcodPortClosed
diff --git a/src/persistence/modules/SessionEngine.psm1 b/src/persistence/modules/SessionEngine.psm1
index 35440fd..61f1b65 100644
--- a/src/persistence/modules/SessionEngine.psm1
+++ b/src/persistence/modules/SessionEngine.psm1
@@ -457,9 +457,18 @@ function Get-CcodTreeDepth {
     return $depth
 }
 
+function Get-CcodStableSessionProcessTree {
+    param($Root,$StatusEvidence,[hashtable]$Adapter)
+    return @(Get-CcodStableVerifiedProcessTree -Root $Root -StatusEvidence $StatusEvidence -RetryBudget 1 -Adapters @{
+        GetVerifiedTree=$Adapter.GetTree
+        GetProcess=$Adapter.GetProcess
+        Delay=$Adapter.Delay
+    })
+}
+
 function Get-CcodChildFirstVerifiedTree {
     param($Root,$StatusEvidence,[hashtable]$Adapter)
-    $tree=@(& $Adapter.GetTree $Root $StatusEvidence)
+    $tree=@(Get-CcodStableSessionProcessTree $Root $StatusEvidence $Adapter)
     if($tree.Count -lt 1){Throw-CcodSessionError 'CCOD_RECOVERY_UNPROVEN' 'Recorded special tree could not be verified' $Root}
     $byPid=@{};foreach($member in $tree){$byPid[[int]$member.Pid]=$member}
     if(-not $byPid.ContainsKey([int]$Root.Pid)){Throw-CcodSessionError 'CCOD_RECOVERY_UNPROVEN' 'Verified tree omitted the recorded root' $Root}
@@ -1366,7 +1375,7 @@ function Invoke-CcodCloseSession {
             if($null -eq $target -or -not (& $adapter.ProcessMatch $Request.source $target)){Throw-CcodSessionError 'CCOD_CLOSE_UNPROVEN' 'Requested close source is not the one verified current root' $Request.source}
         }
         if($null -eq $target){$result.ok=$true;$result.outcome='Closed';$result.safeState='Closed';$result.stage='Closed';return $result}
-        $tree=@(& $adapter.GetTree $target $state.Status)
+        $tree=@(Get-CcodStableSessionProcessTree $target $state.Status $adapter)
         if($tree.Count -lt 1){Throw-CcodSessionError 'CCOD_CLOSE_UNPROVEN' 'Current close target tree is not exact and verified' $target}
         $renderer=$null;$main=$null;$source=$target
         if($isSpecial){if($null -ne $statusCodex){$renderer=$statusCodex.rendererPort;$main=$statusCodex.mainPort}else{$renderer=$target.RendererPort;$main=$target.MainPort};$source=$null;$result.special=ConvertTo-CcodSessionSpecial $target}else{$result.source=ConvertTo-CcodSessionSource $target}
@@ -1449,7 +1458,7 @@ function Invoke-CcodRecoverSession {
             }
         }
         if($null -eq $target){$result.ok=$true;$result.outcome='Closed';$result.safeState='Closed';$result.stage='Closed';return $result}
-        $tree=@(& $adapter.GetTree $target $state.Status)
+        $tree=@(Get-CcodStableSessionProcessTree $target $state.Status $adapter)
         if($tree.Count -lt 1){Throw-CcodSessionError 'CCOD_CLOSE_UNPROVEN' 'Current close target tree is not exact and verified' $target}
         $renderer=$null;$main=$null;$source=$target
         if($isSpecial){if($null -ne $statusCodex){$renderer=$statusCodex.rendererPort;$main=$statusCodex.mainPort}else{$renderer=$target.RendererPort;$main=$target.MainPort};$source=$null;$result.special=ConvertTo-CcodSessionSpecial $target}else{$result.source=ConvertTo-CcodSessionSource $target}
@@ -1531,7 +1540,7 @@ function Invoke-CcodReplayTransition {
                 $decision=Get-CcodReplayDecision -Transition $Transition -Observed $cold
                 Throw-CcodSessionError 'CCOD_CLOSE_UNPROVEN' 'Cold close replay cannot prove absence of the complete recorded tree' $decision
             }
-            $tree=@(& $adapter.GetTree $current $state.Status)
+            $tree=@(Get-CcodStableSessionProcessTree $current $state.Status $adapter)
             if($tree.Count -lt 1){Throw-CcodSessionError 'CCOD_CLOSE_UNPROVEN' 'Recorded close root does not yield a verified tree' $current}
             if($null -ne $Transition.specialPid){
                 $fact=[pscustomobject][ordered]@{Process=$current;Evidence='PersistedIdentity';Validation='Indeterminate'}
diff --git a/tests/persistence/ProcessControl.SelfTest.ps1 b/tests/persistence/ProcessControl.SelfTest.ps1
index 20564a9..008dc43 100644
--- a/tests/persistence/ProcessControl.SelfTest.ps1
+++ b/tests/persistence/ProcessControl.SelfTest.ps1
@@ -892,6 +892,53 @@ try {
         Assert-CcodTrue ($seen.RootEvidenceCount -ge 2) 'Special root proof is supplied on initial and final rereads'
     }
 
+    Invoke-CcodTest 'retries one transient verified tree miss while the exact root identity remains stable' {
+        $status = New-CcodSpecialStatus
+        $root = New-CcodSnapshot -Mode Special -RendererPort 41001 -MainPort 41002 -CommandLine 'special'
+        $child = New-CcodSnapshot -ProcessId 101 -CreationTimeUtc '2026-08-02T00:00:01.0000000Z' -ParentPid 100 -IsTopLevel $false -Mode Unrelated
+        $calls = [pscustomobject]@{ Tree = 0; Root = 0; Delay = 0 }
+        $tree = @(Get-CcodStableVerifiedProcessTree -Root $root -StatusEvidence $status -RetryBudget 1 -Adapters @{
+            GetVerifiedTree = {
+                param($ExpectedRoot, $StatusEvidence)
+                $calls.Tree++
+                if ($calls.Tree -eq 1) { return @() }
+                return @($root, $child)
+            }.GetNewClosure()
+            GetProcess = {
+                param($ProcessId, $StatusEvidence)
+                $calls.Root++
+                Assert-CcodEqual $status $StatusEvidence 'stable retry preserves root status evidence'
+                return $root
+            }.GetNewClosure()
+            Delay = { param($Milliseconds) $calls.Delay++ }.GetNewClosure()
+        })
+        Assert-CcodEqual 2 $tree.Count 'one transient empty tree is retried without relaxing root identity'
+        Assert-CcodEqual '100,101' (($tree.Pid | Sort-Object) -join ',') 'successful retry returns the complete verified tree'
+        Assert-CcodEqual 2 $calls.Tree 'the fixed one-retry budget performs exactly two tree attempts'
+        Assert-CcodEqual 1 $calls.Root 'the root is reread exactly once before the retry'
+        Assert-CcodEqual 1 $calls.Delay 'delay is entered only after an empty tree and a stable root reread'
+    }
+
+    Invoke-CcodTest 'rejects a retry when the exact root creation time changes' {
+        $root = New-CcodSnapshot
+        $changed = New-CcodSnapshot -CreationTimeUtc '2026-08-02T00:00:05.0000000Z'
+        $calls = [pscustomobject]@{ Tree = 0; Root = 0; Delay = 0 }
+        $tree = @(Get-CcodStableVerifiedProcessTree -Root $root -RetryBudget 1 -Adapters @{
+            GetVerifiedTree = {
+                param($ExpectedRoot, $StatusEvidence)
+                $calls.Tree++
+                if ($calls.Tree -eq 1) { return @() }
+                return @($changed)
+            }.GetNewClosure()
+            GetProcess = { param($ProcessId, $StatusEvidence) $calls.Root++; $changed }.GetNewClosure()
+            Delay = { param($Milliseconds) $calls.Delay++ }.GetNewClosure()
+        })
+        Assert-CcodEqual 0 $tree.Count 'creation-time drift returns no verified tree'
+        Assert-CcodEqual 1 $calls.Tree 'root drift is not retried'
+        Assert-CcodEqual 1 $calls.Root 'drift is detected by the mandatory root reread'
+        Assert-CcodEqual 0 $calls.Delay 'root drift never enters the retry delay'
+    }
+
     Invoke-CcodTest 'adopts exactly one special transaction candidate' {
         $command = '"C:\Codex\ChatGPT.exe" --remote-debugging-address=127.0.0.1 --remote-debugging-port=41001 --inspect=127.0.0.1:41002'
         $validArgv = @('C:\Codex\ChatGPT.exe','--remote-debugging-address=127.0.0.1','--remote-debugging-port=41001','--inspect=127.0.0.1:41002')
diff --git a/tests/persistence/SessionEngine.SelfTest.ps1 b/tests/persistence/SessionEngine.SelfTest.ps1
index ff0c1d6..cbd2c14 100644
--- a/tests/persistence/SessionEngine.SelfTest.ps1
+++ b/tests/persistence/SessionEngine.SelfTest.ps1
@@ -1029,6 +1029,7 @@ try {
         $stopped=[Collections.Generic.List[int]]::new();$adapters=New-CcodEngineAdapters -Processes @($source)
         $adapters.InvokeNode={param($NodePath,$Arguments)throw 'bridge failed'}
         $adapters.ListProcesses={param($StatusEvidence)@()}
+        $adapters.GetPreferredRendererPort={param($Excluded)41001}
         $adapters.GetTree={param($Root,$StatusEvidence)@($rootSpecial,$child)}.GetNewClosure()
         $adapters.GetProcess={param($ProcessId,$StatusEvidence)switch($ProcessId){201{$rootSpecial}202{$child}999{$unrelated}default{$source}}}.GetNewClosure()
         $adapters.StopProcess={param($Expected,$StatusEvidence,$TimeoutMilliseconds)$stopped.Add([int]$Expected.Pid);[pscustomobject]@{Outcome='Stopped';StoppedByController=$true;Snapshot=$Expected}}.GetNewClosure()
@@ -1396,6 +1397,41 @@ try {
         }
     }
 
+    Invoke-CcodTest 'retries transient Electron tree churn before committing and closes every verified member' {
+        $root=New-CcodEngineSnapshot
+        $child=New-CcodEngineSnapshot -Pid 101 -CreationTimeUtc '2030-02-03T04:05:07.0000000Z' -Mode Unrelated -ParentPid 100 -IsTopLevel $false
+        $alive=@{100=$root;101=$child};$events=[Collections.Generic.List[string]]::new();$treeReads=[pscustomobject]@{Count=0}
+        $adapters=New-CcodEngineAdapters -State (New-CcodEngineState -Status ([pscustomobject]@{schemaVersion=1;session=$null})) -Processes @($root) -Events $events
+        $adapters.ListProcesses={param($StatusEvidence)@($root)}.GetNewClosure()
+        $adapters.GetProcess={param($ProcessId,$StatusEvidence)if($alive.ContainsKey([int]$ProcessId)){$alive[[int]$ProcessId]}else{$null}}.GetNewClosure()
+        $adapters.GetTree={param($Root,$StatusEvidence)$treeReads.Count++;if($treeReads.Count-eq1){@()}else{@($root,$child)}}.GetNewClosure()
+        $adapters.StopProcess={param($Expected,$StatusEvidence,$TimeoutMilliseconds)$events.Add("Stop:$($Expected.Pid)");$alive.Remove([int]$Expected.Pid);[pscustomobject]@{Outcome='Stopped';StoppedByController=$true;Snapshot=$Expected}}.GetNewClosure()
+        Set-CcodEngineAliveIdentityObserver -Adapters $adapters -Alive $alive
+
+        $result=Invoke-CcodCloseSession -Request (New-CcodEngineRequest -SchemaVersion 2 -Action Close -RestartOrdinary $false) -Paths $paths -Adapters $adapters
+
+        Assert-CcodEqual 'Closed' $result.outcome 'transient tree churn still reaches durable Closed'
+        Assert-CcodEqual 2 $treeReads.Count 'close retries the one transient empty verified tree'
+        Assert-CcodEqual 'Stop:101,Stop:100' ((@($events|Where-Object{$_ -like 'Stop:*'}))-join ',') 'retry preserves child-first proof for every stopped member'
+        Assert-CcodTrue ([Array]::IndexOf(@($events),'IntentWritten') -lt [Array]::IndexOf(@($events),'Stop:101')) 'all mutations remain after stable tree acquisition'
+    }
+
+    Invoke-CcodTest 'root drift during stable tree acquisition performs no close mutation' {
+        $root=New-CcodEngineSnapshot
+        $changed=New-CcodEngineSnapshot -CreationTimeUtc '2030-02-03T04:05:09.0000000Z'
+        $events=[Collections.Generic.List[string]]::new();$processReads=[pscustomobject]@{Count=0}
+        $adapters=New-CcodEngineAdapters -State (New-CcodEngineState -Status ([pscustomobject]@{schemaVersion=1;session=$null})) -Processes @($root) -Events $events
+        $adapters.ListProcesses={param($StatusEvidence)@($root)}.GetNewClosure()
+        $adapters.GetProcess={param($ProcessId,$StatusEvidence)$processReads.Count++;if($processReads.Count-eq1){$root}else{$changed}}.GetNewClosure()
+        $adapters.GetTree={param($Root,$StatusEvidence)@()}
+
+        $result=Invoke-CcodCloseSession -Request (New-CcodEngineRequest -SchemaVersion 2 -Action Close -RestartOrdinary $false) -Paths $paths -Adapters $adapters
+
+        Assert-CcodEqual 'Error' $result.outcome 'root drift fails close safely'
+        Assert-CcodEqual 'CCOD_CLOSE_UNPROVEN' $result.error.code 'root drift keeps the stable close failure code'
+        Assert-CcodEqual 0 @($events|Where-Object{$_ -in @('IntentWritten','CloseRequested','StopProcess') -or $_ -like 'Stop:*'}).Count 'root drift occurs before every close mutation'
+    }
+
     Invoke-CcodTest 'closes an already empty session and leaves unsafe close evidence durable' {
         $counters=[pscustomobject]@{SpecialStart=0;OrdinaryStart=0;Recover=0;Node=0};$adapters=New-CcodEngineAdapters -Processes @() -Counters $counters
         $empty=Invoke-CcodRecoverSession -Request (New-CcodEngineRequest -Action Recover -RestartOrdinary $false) -Paths $paths -Adapters $adapters
@@ -1678,7 +1714,7 @@ try {
 
     Invoke-CcodTest 'production adapter declarations call upstream APIs and contain no empty process placeholder' {
         $moduleText=[IO.File]::ReadAllText((Join-Path $repositoryRoot 'src\persistence\modules\SessionEngine.psm1'))
-        foreach($command in @('Invoke-CcodStaticProbe','Get-CcodProcessSnapshot','Test-CcodProcessMatch','Stop-CcodProcessIfMatch','Get-CcodVerifiedProcessTree','Get-CcodTransactionProcessResult','Get-CcodAvailableLoopbackPort','Start-CcodProcess','Wait-CcodPortClosed','Read-CcodState','Write-CcodStatus','Write-CcodVerifiedPackages','New-CcodTransition','Set-CcodTransitionStage','Complete-CcodTransition')){Assert-CcodTrue ($moduleText -cmatch [regex]::Escape($command)) "production adapters wire $command"}
+        foreach($command in @('Invoke-CcodStaticProbe','Get-CcodProcessSnapshot','Test-CcodProcessMatch','Stop-CcodProcessIfMatch','Get-CcodVerifiedProcessTree','Get-CcodStableVerifiedProcessTree','Get-CcodTransactionProcessResult','Get-CcodAvailableLoopbackPort','Start-CcodProcess','Wait-CcodPortClosed','Read-CcodState','Write-CcodStatus','Write-CcodVerifiedPackages','New-CcodTransition','Set-CcodTransitionStage','Complete-CcodTransition')){Assert-CcodTrue ($moduleText -cmatch [regex]::Escape($command)) "production adapters wire $command"}
         Assert-CcodTrue ($moduleText -cnotmatch 'ListProcesses=\{\s*param\([^)]*\)\s*@\(\)\s*\}') 'production process enumeration is not an always-empty placeholder'
         $inspectionStart=$moduleText.IndexOf('function Merge-CcodInspectionAdapters',[StringComparison]::Ordinal)
         $inspectionEnd=$moduleText.IndexOf('function Assert-CcodInspectionState',[StringComparison]::Ordinal)
diff --git a/tests/persistence/Supervisor.SelfTest.ps1 b/tests/persistence/Supervisor.SelfTest.ps1
index fae9fd7..afe968f 100644
--- a/tests/persistence/Supervisor.SelfTest.ps1
+++ b/tests/persistence/Supervisor.SelfTest.ps1
@@ -106,6 +106,7 @@ function New-CcodSupervisorFake {
     $adapters.StartClock={$world.Calls.Add('Clock');[pscustomobject]@{Kind='Clock'}}.GetNewClosure()
     $adapters.GetElapsedMilliseconds={param($Clock)if($world.Elapsed.Count){[long]$world.Elapsed.Dequeue()}else{[long]0}}.GetNewClosure()
     $adapters.GetUtcNow={[DateTime]::Parse('2030-02-03T03:04:05Z').ToUniversalTime()}.GetNewClosure()
+    $adapters.Delay={param($Milliseconds)}
     $adapters.EnterLease={
         param($Kind,$UserSid,$SessionId,$TimeoutMilliseconds)
         $world.Calls.Add("Enter:$Kind`:$TimeoutMilliseconds")
@@ -811,6 +812,95 @@ Invoke-CcodTest 'successful lifecycle verification binds a fresh special proof b
     Assert-CcodEqual $null $hostState.LifecycleRequest 'later guardian decision creates no redundant repair lifecycle'
 }
 
+Invoke-CcodTest 'post-worker rebind retries one transient missing enumeration for the same exact candidate' {
+    $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
+    $transactionModule=Import-Module $lifecycleTransactionPath -Force -PassThru
+    $request=New-CcodPersistedLifecycleRequest -Kind RestartAndRepair
+    foreach($phase in @('CloseRequested','CloseConfirmed','RepairRequested')){
+        $request=& $transactionModule {param($Value,$NextPhase)Move-CcodLifecyclePhase -Request $Value -NextPhase $NextPhase -NowUtc '2030-02-03T03:01:05.0000000Z'} $request $phase
+    }
+    $request.ownerIdentity=$hostState.LifecycleOwnership.ownerIdentity;$request.leaseEpoch=[UInt64]$hostState.LifecycleOwnership.epoch
+    $world.ActiveLifecycleRequest=$request;$hostState.LifecycleRequest=$request;$world.AutoCompleteLifecycleWorkers=$true
+    $special=New-CcodSupervisorTestSnapshot -ProcessId 201 -CreationTimeUtc '2030-02-03T03:02:00.0000000Z'
+    $special.Mode='Special';$special.RendererPort=[int]41001;$special.MainPort=[int]41002
+    $world.ProcessIds=@(201);$world.Snapshots[201]=$special
+    $fixture.Fake.Adapters.ReadState={param($StateRoot,$SuppressionKey)$hostState.State}.GetNewClosure()
+    $enumerations=[pscustomobject]@{Count=0};$delays=[Collections.Generic.List[int]]::new()
+    $fixture.Fake.Adapters.Delay={param($Milliseconds)$delays.Add([int]$Milliseconds)}.GetNewClosure()
+    $fixture.Fake.Adapters.EnumerateProcessIds={
+        $enumerations.Count++
+        if($enumerations.Count-eq2){Write-Output -NoEnumerate @();return}
+        Write-Output -NoEnumerate @(201)
+    }.GetNewClosure()
+
+    Start-CcodSupervisorLifecycleWorkerSlot $hostState $fixture.Fake.Adapters VerifyRemote $null|Out-Null
+    Invoke-CcodSupervisorPollLifecycleSlot $hostState $fixture.Fake.Adapters
+
+    Assert-CcodEqual 3 $enumerations.Count 'one transient empty rebind enumeration receives exactly one bounded retry'
+    Assert-CcodEqual '50' (($delays)-join ',') 'same-candidate retry enters one bounded condition-based delay'
+    Assert-CcodTrue ($null-ne$hostState.SpecialProof) 'same exact candidate is rebound after transient enumeration churn'
+    Assert-CcodEqual 201 $hostState.SpecialProof.Pid 'rebound proof retains the original candidate PID'
+    Assert-CcodEqual $special.CreationTimeUtc $hostState.SpecialProof.CreationTimeUtc 'rebound proof retains the original candidate creation time'
+    Assert-CcodEqual 'RemoteVerified' $hostState.LifecycleObservation 'same-candidate retry publishes RemoteVerified'
+}
+
+Invoke-CcodTest 'post-worker rebind does not retry a transient enumeration after candidate creation-time drift' {
+    $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
+    $transactionModule=Import-Module $lifecycleTransactionPath -Force -PassThru
+    $request=New-CcodPersistedLifecycleRequest -Kind RestartAndRepair
+    foreach($phase in @('CloseRequested','CloseConfirmed','RepairRequested')){
+        $request=& $transactionModule {param($Value,$NextPhase)Move-CcodLifecyclePhase -Request $Value -NextPhase $NextPhase -NowUtc '2030-02-03T03:01:05.0000000Z'} $request $phase
+    }
+    $request.ownerIdentity=$hostState.LifecycleOwnership.ownerIdentity;$request.leaseEpoch=[UInt64]$hostState.LifecycleOwnership.epoch
+    $world.ActiveLifecycleRequest=$request;$hostState.LifecycleRequest=$request;$world.AutoCompleteLifecycleWorkers=$true
+    $special=New-CcodSupervisorTestSnapshot -ProcessId 201 -CreationTimeUtc '2030-02-03T03:02:00.0000000Z'
+    $special.Mode='Special';$special.RendererPort=[int]41001;$special.MainPort=[int]41002
+    $drift=$special.PSObject.Copy();$drift.CreationTimeUtc='2030-02-03T03:02:01.0000000Z'
+    $world.ProcessIds=@(201);$world.Snapshots[201]=$special
+    $fixture.Fake.Adapters.ReadState={param($StateRoot,$SuppressionKey)$hostState.State}.GetNewClosure()
+    $enumerations=[pscustomobject]@{Count=0};$delays=[Collections.Generic.List[int]]::new()
+    $fixture.Fake.Adapters.Delay={param($Milliseconds)$delays.Add([int]$Milliseconds)}.GetNewClosure()
+    $fixture.Fake.Adapters.EnumerateProcessIds={
+        $enumerations.Count++
+        if($enumerations.Count-eq1){Write-Output -NoEnumerate @(201);return}
+        $world.Snapshots[201]=$drift
+        Write-Output -NoEnumerate @()
+    }.GetNewClosure()
+
+    Start-CcodSupervisorLifecycleWorkerSlot $hostState $fixture.Fake.Adapters VerifyRemote $null|Out-Null
+    Invoke-CcodSupervisorPollLifecycleSlot $hostState $fixture.Fake.Adapters
+
+    Assert-CcodEqual 2 $enumerations.Count 'changed candidate receives no post-drift retry'
+    Assert-CcodEqual 0 $delays.Count 'changed candidate never enters the rebind delay'
+    Assert-CcodEqual 1 $world.CompletedLifecycleRequests.Count 'candidate drift produces one terminal lifecycle receipt'
+    Assert-CcodEqual 'CCOD_REMOTE_PROOF_REBIND_FAILED' $world.CompletedLifecycleRequests[0].error 'candidate drift keeps the stable rebind failure reason'
+    Assert-CcodEqual $null $hostState.SpecialProof 'changed candidate never receives proof authority'
+}
+
+Invoke-CcodTest 'candidate port or mode drift never enters the bounded rebind delay' {
+    foreach($case in @(
+        @{Name='port';Mutate={param($Snapshot)$Snapshot.RendererPort=[int]42001;$Snapshot}},
+        @{Name='mode';Mutate={param($Snapshot)$Snapshot.Mode='Ordinary';$Snapshot.RendererPort=$null;$Snapshot.MainPort=$null;$Snapshot}}
+    )){
+        $fixture=New-CcodTickFixture;$hostState=$fixture.Host
+        $candidate=New-CcodSupervisorTestSnapshot -ProcessId 201 -CreationTimeUtc '2030-02-03T03:02:00.0000000Z'
+        $candidate.Mode='Special';$candidate.RendererPort=[int]41001;$candidate.MainPort=[int]41002
+        $changed=& $case.Mutate $candidate.PSObject.Copy()
+        $delays=[Collections.Generic.List[int]]::new()
+        $fixture.Fake.Adapters.ReadState={param($StateRoot,$SuppressionKey)$hostState.State}.GetNewClosure()
+        $fixture.Fake.Adapters.EnumerateProcessIds={Write-Output -NoEnumerate @()}
+        $fixture.Fake.Adapters.GetProcessSnapshot={param($ProcessId,$StatusEvidence)$changed}.GetNewClosure()
+        $fixture.Fake.Adapters.Delay={param($Milliseconds)$delays.Add([int]$Milliseconds)}.GetNewClosure()
+
+        $confirmed=Confirm-CcodSupervisorLifecycleProofCandidate $hostState $fixture.Fake.Adapters $candidate
+
+        Assert-CcodEqual $false $confirmed "$($case.Name) drift cannot confirm the candidate"
+        Assert-CcodEqual 0 $delays.Count "$($case.Name) drift never enters the retry delay"
+        Assert-CcodEqual $null $hostState.SpecialProof "$($case.Name) drift receives no proof authority"
+        Assert-CcodEqual ('201|'+$candidate.CreationTimeUtc) $hostState.FailedSpecialProofKey "$($case.Name) drift records the original stable failure key"
+    }
+}
+
 Invoke-CcodTest 'post-verify identity drift becomes one terminal failure and suppresses same-root guardian retries' {
     $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
     $transactionModule=Import-Module $lifecycleTransactionPath -Force -PassThru

From fe34fdfcd0115b1a2d25d51ff226cced9501aafd Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 05:10:07 +0800
Subject: [PATCH 016/187] docs: record Task 3 verification

---
 .../task-3-report.md                          | 187 ++++++++++++++++++
 1 file changed, 187 insertions(+)
 create mode 100644 .superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-3-report.md

diff --git a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-3-report.md b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-3-report.md
new file mode 100644
index 0000000..c1db9ce
--- /dev/null
+++ b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-3-report.md
@@ -0,0 +1,187 @@
+# Task 3 report: stable verified Electron process trees
+
+## Outcome and commit
+
+Implemented Task 3 only in the linked worktree
+`C:\Users\33384\Documents\Codex-Control-other-devices-Windows\.worktrees\codex-v2522-install-runtime-reliability`.
+
+Implementation commit: `b34b0d1` (`fix: stabilize verified Electron process trees`).
+
+The report is committed separately after this entry so that it can name the
+implementation commit; a commit cannot embed its own final object ID.
+
+## Files changed
+
+- `src/persistence/modules/ProcessControl.psm1`
+- `src/persistence/modules/SessionEngine.psm1`
+- `src/persistence/Supervisor.ps1`
+- `tests/persistence/ProcessControl.SelfTest.ps1`
+- `tests/persistence/SessionEngine.SelfTest.ps1`
+- `tests/persistence/Supervisor.SelfTest.ps1`
+- `.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-3-report.md`
+
+No other source, test, installer, release, WindowsApps, DPAPI, or UI file was
+modified.
+
+## Implementation
+
+`Get-CcodStableVerifiedProcessTree` now wraps the existing one-pass verified
+tree reader with a fixed retry budget. A retry is eligible only after a failed
+or empty verified-tree acquisition. Before the retry it directly rereads the
+original root PID with the same status evidence and applies the existing exact
+`Test-CcodProcessMatch` contract across PID, creation time, session, SID,
+executable path, package family, command line, parent/top-level shape, mode,
+renderer port, and main port. A successful tree must also contain exactly one
+root member that exactly matches the original snapshot. Missing, malformed,
+changed, or differently mapped roots return no tree. The 50 ms adapter delay is
+entered only after the failed-tree condition and exact root reread both hold.
+
+SessionEngine routes every pre-mutation current-package `GetTree` boundary in
+Close, Recover, recovery cleanup, and CloseRequested replay through that stable
+helper. Journal creation and all stop mutations remain after stable acquisition.
+The existing per-member pre-stop, post-stop, and final absence/identity proofs
+were not changed.
+
+Supervisor post-worker proof confirmation now has the same bounded policy. It
+retries one empty ordinary/special enumeration only when a direct read of the
+candidate PID still matches all twelve snapshot fields. It then performs one
+condition-based 50 ms adapter delay and one final refresh. A nonempty mismatch,
+ambiguity, missing or malformed direct read, creation-time drift, debug-port
+drift, or mode drift is not delayed or retried and receives no proof authority.
+The lifecycle result continues to reduce through the stable
+`CCOD_REMOTE_PROOF_REBIND_FAILED` reason, and `FailedSpecialProofKey` remains
+bound to the original candidate PID and creation time.
+
+One pre-existing recovery fixture was made deterministic by fixing its
+preferred renderer port to the exact port in its expected root snapshot. The
+new stable helper correctly exposed that the old fixture supplied a 41001 tree
+root while the launch fixture selected 9335.
+
+## Baseline
+
+Before test or production changes:
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/ProcessControl.SelfTest.ps1
+exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/SessionEngine.SelfTest.ps1
+exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/Supervisor.SelfTest.ps1
+existing output reached the final production-adapter cases without a failure; the
+initial combined shell capture timed out before its receipt, so the suite was
+rerun independently during RED/GREEN and final verification below.
+```
+
+## RED evidence
+
+Tests were added before production changes.
+
+### RED 1: missing stable process-tree helper
+
+Command:
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/ProcessControl.SelfTest.ps1
+```
+
+Result: exit `1` at
+`retries one transient verified tree miss while the exact root identity remains stable`:
+
+```text
+The term 'Get-CcodStableVerifiedProcessTree' is not recognized
+```
+
+### RED 2: SessionEngine did not retry transient tree churn
+
+Command:
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/SessionEngine.SelfTest.ps1
+```
+
+Result: exit `1` at
+`retries transient Electron tree churn before committing and closes every verified member`:
+
+```text
+expected=[Closed] actual=[Error]
+```
+
+### RED 3: Supervisor had no bounded second rebind
+
+Command:
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/Supervisor.SelfTest.ps1
+```
+
+After correcting the empty-array fixture to emit one array object, result was
+exit `1`:
+
+```text
+one transient empty rebind enumeration receives exactly one bounded retry
+expected=[3] actual=[2]
+```
+
+The count includes one pre-worker candidate observation plus the two required
+post-worker observations.
+
+### RED 4: Supervisor retry had no condition-based delay
+
+After the immediate bounded retry was implemented, a timing boundary test was
+added before adding a Delay adapter. The same Supervisor command exited `1`:
+
+```text
+same-candidate retry enters one bounded condition-based delay
+expected=[50] actual=[]
+```
+
+## GREEN and final verification
+
+Fresh committed-content verification command:
+
+```powershell
+$tests=@(
+  'tests/persistence/ProcessControl.SelfTest.ps1',
+  'tests/persistence/SessionEngine.SelfTest.ps1',
+  'tests/persistence/Supervisor.SelfTest.ps1'
+)
+foreach($test in $tests){
+  powershell.exe -NoProfile -ExecutionPolicy Bypass -File $test
+  if($LASTEXITCODE -ne 0){ throw "$test failed" }
+}
+```
+
+Result: exit `0` for all three suites.
+
+- ProcessControl: 40 behavioral cases passed, including transient empty-tree
+  retry and creation-time drift fail-closed coverage.
+- SessionEngine: 58 behavioral cases passed, including retry-before-journal,
+  child-first stop of every captured member, root drift with zero close
+  mutation, ordinary close behavior, and all existing per-member proof cases.
+- Supervisor: 93 behavioral cases passed. The suite printed
+  `Supervisor self-tests passed: 93`, including one exact condition-based
+  50 ms retry, creation-time drift with zero delay, port/mode drift with zero
+  delay, no proof authority for changed roots, and the stable
+  `CCOD_REMOTE_PROOF_REBIND_FAILED` terminal result.
+
+`git diff --cached --check` exited `0` before the implementation commit.
+
+## Scope, safety, and concerns
+
+- No real Codex, ChatGPT, installer, tray, or UI process was started, stopped,
+  signaled, or controlled. All process behavior used fixtures/adapters.
+- Nothing was installed, pushed, published, released, uploaded, or signed.
+- WindowsApps and DPAPI/device-key boundaries were not changed.
+- Exact root identity was not relaxed. Retry eligibility uses the same full
+  snapshot matcher, including mode and both debug ports.
+- The only delay is fixed at 50 ms and is adapter-driven. It is called only
+  after an empty/failed acquisition plus an exact candidate-root reread; all
+  mismatch tests assert zero delay.
+- The repository-wide suite was not run because other persistence integration
+  paths may exercise real process-stop boundaries, which conflicts with this
+  task's explicit fixture-only authority. The three brief-named focused suites
+  are green.
+- No independent agent review was run because the task explicitly prohibited
+  spawning agents. Parent integration review remains the next external gate.

From b312174a4807463a3b068f6080399cbad297de2f Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 05:25:31 +0800
Subject: [PATCH 017/187] test: cover tray action revision correlation

---
 src/persistence/Supervisor.ps1                | 17 ++++++
 tests/persistence/Supervisor.SelfTest.ps1     | 61 +++++++++++++++++++
 tests/persistence/TrayHostClient.SelfTest.ps1 | 26 +++++++-
 tests/trayhost/TrayHostTransportSelfTest.cs   |  4 +-
 4 files changed, 105 insertions(+), 3 deletions(-)

diff --git a/src/persistence/Supervisor.ps1 b/src/persistence/Supervisor.ps1
index 9742335..7bab1a3 100644
--- a/src/persistence/Supervisor.ps1
+++ b/src/persistence/Supervisor.ps1
@@ -1154,9 +1154,26 @@ function Throw-CcodSupervisorCommandError {
     throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new($Message),$Code,[Management.Automation.ErrorCategory]::InvalidData,$Target)
 }
 
+function Write-CcodSupervisorTrayActionTerminal {
+    param($HostState,[hashtable]$Adapters,$Action,[ValidateSet('Completed','Rejected','Failed')][string]$Status,[AllowNull()][string]$ErrorCode)
+    $code=if($Status-ceq'Completed'){'CCOD_TRAY_ACTION_COMPLETED'}elseif($ErrorCode-is[string]-and$ErrorCode-cmatch'^CCOD_[A-Z0-9_]{1,91}\z'){$ErrorCode}else{'CCOD_TRAY_ACTION_FAILED'}
+    try{
+        $now=Invoke-CcodSupervisorAdapter $Adapters.GetUtcNow @() 1
+        if($now-is[DateTimeOffset]){$timestamp=$now.UtcDateTime.ToString('o',[Globalization.CultureInfo]::InvariantCulture)}
+        elseif($now-is[DateTime]){$timestamp=$now.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)}
+        else{throw 'tray action clock is invalid'}
+        $record=[pscustomobject][ordered]@{
+            schemaVersion=1;timestampUtc=$timestamp;component='Supervisor';stage='TrayAction';code=$code;outcome=$Status
+            command=[string]$Action.Command;revision=[UInt64]$Action.Revision;status=$Status
+        }
+        Invoke-CcodSupervisorAdapter $Adapters.WriteLog @($record) 0
+    }catch{Add-CcodSupervisorCleanupCode $HostState.RuntimeCleanupCodes 'CCOD_SUPERVISOR_LOG_FAILED'}
+}
+
 function Send-CcodSupervisorTrayActionResult {
     param($HostState,[hashtable]$Adapters,$Action,[ValidateSet('Accepted','Completed','Rejected','Failed')][string]$Status,[AllowNull()][string]$ErrorCode,[AllowNull()][string]$TransactionId)
     $result=[pscustomobject][ordered]@{ActionId=$Action.ActionId;Revision=[UInt64]$Action.Revision;Status=$Status;ErrorCode=$ErrorCode;TransactionId=$TransactionId}
+    if($Status-cne'Accepted'){Write-CcodSupervisorTrayActionTerminal $HostState $Adapters $Action $Status $ErrorCode}
     try{
         $delivered=Invoke-CcodSupervisorAdapter $Adapters.SendTrayActionResult @($HostState.Tray,$result.ActionId,$result.Revision,$result.Status,$result.ErrorCode,$result.TransactionId) 1
         if($delivered-isnot[bool]-or-not$delivered){throw 'tray action result was not acknowledged'}
diff --git a/tests/persistence/Supervisor.SelfTest.ps1 b/tests/persistence/Supervisor.SelfTest.ps1
index afe968f..5686621 100644
--- a/tests/persistence/Supervisor.SelfTest.ps1
+++ b/tests/persistence/Supervisor.SelfTest.ps1
@@ -1566,6 +1566,67 @@ Invoke-CcodTest 'authorizes an acknowledged displayed revision after a newer cap
     Assert-CcodEqual 'Accepted' $result.Status 'the displayed and acknowledged revision remains action authority after a newer capable projection'
 }
 
+Invoke-CcodTest 'records an acknowledged OpenLogs terminal outcome after its handler and before result delivery' {
+    # Production mutation caught: omitting the sanitized terminal record, logging before the handler, or bypassing the revision-bound OpenLogs handler.
+    $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
+    $hostState.Tray.CurrentRevision=[UInt64]7
+    $enabled=[pscustomobject][ordered]@{RepairEnabled=$true;LanguageEnabled=$true;OpenLogsEnabled=$true;AboutEnabled=$true;ExitEnabled=$true}
+    $hostState.Tray.AcknowledgedPresentations['7']=$enabled
+    $hostState.LastAcknowledgedPresentation=$enabled
+    $action=[pscustomobject][ordered]@{ActionId=[guid]'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeee71';Command='OpenLogs';Revision=[UInt64]7}
+
+    $result=@(Invoke-CcodSupervisorCommand $hostState $fixture.Fake.Adapters $action)[0]
+
+    Assert-CcodEqual 'Completed' $result.Status 'acknowledged revision reaches the OpenLogs handler'
+    Assert-CcodEqual 1 @($world.Calls|Where-Object{$_ -eq 'Open:Logs'}).Count 'current acknowledged action invokes OpenLogs exactly once'
+    Assert-CcodEqual 1 $world.UiFailureRecords.Count 'terminal action writes exactly one local diagnostic record'
+    $record=$world.UiFailureRecords[0]
+    Assert-CcodEqual 'schemaVersion,timestampUtc,component,stage,code,outcome,command,revision,status' (@($record.PSObject.Properties.Name)-join ',') 'terminal diagnostic record is an exact sanitized schema'
+    Assert-CcodEqual 'Supervisor' $record.component 'terminal diagnostic identifies the authorizing component'
+    Assert-CcodEqual 'TrayAction' $record.stage 'terminal diagnostic uses the tray action stage'
+    Assert-CcodEqual 'CCOD_TRAY_ACTION_COMPLETED' $record.code 'successful terminal diagnostic uses a safe canonical code'
+    Assert-CcodEqual 'Completed' $record.outcome 'terminal diagnostic outcome is completed'
+    Assert-CcodEqual 'OpenLogs' $record.command 'terminal diagnostic preserves the exact command'
+    Assert-CcodEqual ([UInt64]7) $record.revision 'terminal diagnostic preserves the displayed presentation revision'
+    Assert-CcodEqual 'Completed' $record.status 'terminal diagnostic preserves the exact terminal status'
+    $calls=@($world.Calls)
+    Assert-CcodTrue ([Array]::IndexOf($calls,'Open:Logs') -lt [Array]::IndexOf($calls,'Log:CCOD_TRAY_ACTION_COMPLETED')) 'handler side effect precedes terminal logging'
+    Assert-CcodTrue ([Array]::IndexOf($calls,'Log:CCOD_TRAY_ACTION_COMPLETED') -lt [Array]::IndexOf($calls,'ActionResult:Completed')) 'terminal logging precedes host result delivery'
+}
+
+Invoke-CcodTest 'rejects and records an unacknowledged OpenLogs revision before any handler side effect' {
+    # Production mutation caught: authorizing an unacknowledged revision, invoking OpenLogs before the gate, or losing the stable stale diagnostic.
+    $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
+    $hostState.Tray.CurrentRevision=[UInt64]8
+    $action=[pscustomobject][ordered]@{ActionId=[guid]'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeee81';Command='OpenLogs';Revision=[UInt64]8}
+
+    $result=@(Invoke-CcodSupervisorCommand $hostState $fixture.Fake.Adapters $action)[0]
+
+    Assert-CcodEqual 'Rejected' $result.Status 'unacknowledged revision is rejected'
+    Assert-CcodEqual 'CCOD_TRAY_ACTION_STALE' $result.ErrorCode 'unacknowledged revision returns the stable stale code'
+    Assert-CcodEqual 0 @($world.Calls|Where-Object{$_ -eq 'Open:Logs'}).Count 'stale revision is rejected before the OpenLogs handler'
+    Assert-CcodEqual 1 $world.UiFailureRecords.Count 'stale action writes exactly one local diagnostic record'
+    $record=$world.UiFailureRecords[0]
+    Assert-CcodEqual 'schemaVersion,timestampUtc,component,stage,code,outcome,command,revision,status' (@($record.PSObject.Properties.Name)-join ',') 'stale diagnostic record is an exact sanitized schema'
+    Assert-CcodEqual 'CCOD_TRAY_ACTION_STALE' $record.code 'stale diagnostic preserves the exact canonical code'
+    Assert-CcodEqual 'OpenLogs' $record.command 'stale diagnostic preserves the rejected command'
+    Assert-CcodEqual ([UInt64]8) $record.revision 'stale diagnostic preserves the unacknowledged revision'
+    Assert-CcodEqual 'Rejected' $record.status 'stale diagnostic preserves the rejected terminal status'
+    $calls=@($world.Calls)
+    Assert-CcodTrue ([Array]::IndexOf($calls,'Log:CCOD_TRAY_ACTION_STALE') -lt [Array]::IndexOf($calls,'ActionResult:Rejected')) 'stale diagnostic is written before generic failure feedback can be queued'
+}
+
+Invoke-CcodTest 'sanitizes a malformed terminal action code before local logging' {
+    # Production mutation caught: allowing a newline or other noncanonical text into the local terminal diagnostic record.
+    $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
+    $action=[pscustomobject][ordered]@{ActionId=[guid]'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeee91';Command='OpenLogs';Revision=[UInt64]1}
+
+    [void](Send-CcodSupervisorTrayActionResult $hostState $fixture.Fake.Adapters $action Rejected "CCOD_INJECTED`n" $null)
+
+    Assert-CcodEqual 1 $world.UiFailureRecords.Count 'malformed terminal code still produces one safe diagnostic'
+    Assert-CcodEqual 'CCOD_TRAY_ACTION_FAILED' $world.UiFailureRecords[0].code 'malformed terminal code is replaced by the canonical fallback'
+}
+
 Invoke-CcodTest 'rejects an action revision that was published but never acknowledged as displayed' {
     $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
     $hostState.Tray.CurrentRevision=[UInt64]9
diff --git a/tests/persistence/TrayHostClient.SelfTest.ps1 b/tests/persistence/TrayHostClient.SelfTest.ps1
index c835400..37f650c 100644
--- a/tests/persistence/TrayHostClient.SelfTest.ps1
+++ b/tests/persistence/TrayHostClient.SelfTest.ps1
@@ -51,7 +51,13 @@ Invoke-CcodTest 'TrayHost starts fail-closed until the Supervisor publishes an e
 }
 
 Invoke-CcodTest 'TrayHost reuses an identical presentation revision and records only an exact acknowledgement' {
-    if($null-eq('PresentationSnapshot' -as [type])){Add-Type -Path (Join-Path $repositoryRoot 'src\trayhost\PresentationSnapshot.cs')}
+    if($null-eq('TrayActionResult' -as [type])){
+        Add-Type -Path @(
+            (Join-Path $repositoryRoot 'src\trayhost\PresentationSnapshot.cs'),
+            (Join-Path $repositoryRoot 'src\trayhost\PipeProtocol.cs'),
+            (Join-Path $repositoryRoot 'src\trayhost\TransportMessages.cs')
+        )
+    }
     Import-Module $localizationPath -Force
     $catalog=Get-CcodUiCatalog -ResourcesRoot (Join-Path $repositoryRoot 'src\persistence\resources') -LanguageMode en-US -SystemCultureName en-US
     $presentation=[pscustomobject][ordered]@{Color='Green';ConnectionState='Connected';ProtectionState='Running';RepairEnabled=$false;LanguageEnabled=$true;OpenLogsEnabled=$true;AboutEnabled=$true;ExitEnabled=$true;Busy=$false}
@@ -80,4 +86,22 @@ Invoke-CcodTest 'TrayHost reuses an identical presentation revision and records
     Assert-CcodTrue (-not$context.AcknowledgedPresentations.Contains('1')) 'an unrecorded revision is never inferred from a higher acknowledgement'
 }
 
+Invoke-CcodTest 'TrayHost client delivers the exact correlated terminal result to the authenticated parent client' {
+    # Production mutation caught: losing the action id, revision, status, or stable terminal code at the PowerShell-to-TrayHost boundary.
+    $received=[Collections.Generic.List[object]]::new()
+    $client=[pscustomobject]@{Received=$received}
+    $client|Add-Member -MemberType ScriptMethod -Name TryAcknowledgeAction -Value {param($Result)$this.Received.Add($Result);return $true}
+    $context=[pscustomobject]@{Client=$client}
+    $actionId=[guid]'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeea1'
+
+    $delivered=Send-CcodTrayHostActionResult -Context $context -ActionId $actionId -Revision ([UInt64]8) -Status Rejected -ErrorCode 'CCOD_TRAY_ACTION_STALE' -TransactionId $null
+
+    Assert-CcodEqual $true $delivered 'terminal result is accepted by the authenticated parent client'
+    Assert-CcodEqual 1 $received.Count 'terminal result is delivered exactly once'
+    Assert-CcodEqual $actionId $received[0].ActionId 'terminal result preserves the action id'
+    Assert-CcodEqual ([UInt64]8) $received[0].Revision 'terminal result preserves the presentation revision'
+    Assert-CcodEqual 'Rejected' $received[0].Status.ToString() 'terminal result preserves the rejected status'
+    Assert-CcodEqual 'CCOD_TRAY_ACTION_STALE' $received[0].ErrorCode 'terminal result preserves the stable stale code'
+}
+
 Write-Host 'TrayHost client self-tests passed.'
diff --git a/tests/trayhost/TrayHostTransportSelfTest.cs b/tests/trayhost/TrayHostTransportSelfTest.cs
index 63d0c7d..928289c 100644
--- a/tests/trayhost/TrayHostTransportSelfTest.cs
+++ b/tests/trayhost/TrayHostTransportSelfTest.cs
@@ -142,8 +142,8 @@ private static void TestRejectedAndFailedActionsQueueUserFeedback()
         AssertTrue(host.TryAcknowledgeAction(new TrayActionResult(rejectedId, 20UL, TrayActionResultStatus.Rejected, "CCOD_TRAY_ACTION_UNAVAILABLE", null)), "correlated rejected result is accepted");
         AssertTrue(host.TryAcknowledgeAction(new TrayActionResult(failedId, 20UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null)), "correlated failed result is accepted");
         TrayActionResult first; TrayActionResult second; TrayActionResult none;
-        AssertTrue(host.TryTakeFailedAction(out first) && first.ActionId == rejectedId && first.Status == TrayActionResultStatus.Rejected, "rejected result queues user feedback");
-        AssertTrue(host.TryTakeFailedAction(out second) && second.ActionId == failedId && second.Status == TrayActionResultStatus.Failed, "failed result queues user feedback");
+        AssertTrue(host.TryTakeFailedAction(out first) && first.ActionId == rejectedId && first.Revision == 20UL && first.Status == TrayActionResultStatus.Rejected && String.Equals(first.ErrorCode, "CCOD_TRAY_ACTION_UNAVAILABLE", StringComparison.Ordinal), "rejected result preserves its exact correlated terminal record before generic feedback");
+        AssertTrue(host.TryTakeFailedAction(out second) && second.ActionId == failedId && second.Revision == 20UL && second.Status == TrayActionResultStatus.Failed && String.Equals(second.ErrorCode, "CCOD_TRAY_ACTION_FAILED", StringComparison.Ordinal), "failed result preserves its exact correlated terminal record before generic feedback");
         AssertTrue(!host.TryTakeFailedAction(out none), "each terminal failure queues feedback exactly once");
         host.Dispose();
     }

From 6554d289a8e155acaf5520ba7f8b0ec6275b8083 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 05:26:46 +0800
Subject: [PATCH 018/187] docs: record Task 4 verification

---
 .../task-4-report.md                          | 179 ++++++++++++++++++
 1 file changed, 179 insertions(+)
 create mode 100644 .superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-4-report.md

diff --git a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-4-report.md b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-4-report.md
new file mode 100644
index 0000000..672e452
--- /dev/null
+++ b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-4-report.md
@@ -0,0 +1,179 @@
+# Task 4 report: tray action revision correlation and diagnostics
+
+## Outcome and commit
+
+Implemented Task 4 only in the linked worktree
+`C:\Users\33384\Documents\Codex-Control-other-devices-Windows\.worktrees\codex-v2522-install-runtime-reliability`.
+
+Implementation commit: `b312174` (`test: cover tray action revision correlation`).
+
+The report is committed separately after this entry so that it can name the
+implementation commit; a commit cannot embed its own final object ID.
+
+## Files changed
+
+- `src/persistence/Supervisor.ps1`
+- `tests/persistence/Supervisor.SelfTest.ps1`
+- `tests/persistence/TrayHostClient.SelfTest.ps1`
+- `tests/trayhost/TrayHostTransportSelfTest.cs`
+- `.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-4-report.md`
+
+No protocol, installer, release, lifecycle worker, Codex, WindowsApps, DPAPI,
+or user-facing localization file was changed. The planned production files
+`src/persistence/modules/TrayHostClient.psm1`, `src/trayhost/HostTransport.cs`,
+and `src/trayhost/TrayWindow.cs` required no production change: the existing
+authenticated result boundary already preserved action id, revision, terminal
+status, and canonical error code, and the existing TrayWindow already reduced
+terminal failures to the approved generic localized dialog. Their behavior is
+now covered more precisely by the wrapper, transport, and native tests.
+
+## Root cause and implementation
+
+The native menu action already reached TrayHost, the PowerShell wrapper already
+queued the exact command and presentation revision, and Supervisor already
+authorized actions against the exact acknowledged-presentation map. The missing
+boundary was in `Send-CcodSupervisorTrayActionResult`: it forwarded a terminal
+result to TrayHost without first writing a support-safe record. Once TrayHost
+accepted a rejected or failed result, it queued only the generic failure UI, so
+the end user saw the intended generic wording but the local log had no command,
+revision, terminal status, or stable code with which to diagnose the failure.
+
+`Write-CcodSupervisorTrayActionTerminal` now writes a fixed schema before the
+terminal result is sent to TrayHost:
+
+- `schemaVersion`
+- `timestampUtc`
+- `component`
+- `stage`
+- `code`
+- `outcome`
+- `command`
+- `revision`
+- `status`
+
+The record deliberately excludes action ids, transaction ids, filesystem
+paths, tokens, exception messages, and arbitrary result text. `Completed` uses
+the safe success code `CCOD_TRAY_ACTION_COMPLETED`. `Rejected` and `Failed`
+preserve an exact canonical `CCOD_*` code; malformed codes fall back to
+`CCOD_TRAY_ACTION_FAILED`. Canonical validation uses the absolute `\z` regex
+terminator so a trailing newline cannot be accepted as part of a log code.
+
+`Accepted` is not terminal and is not logged by this helper. Lifecycle actions
+therefore receive one terminal record only when their later `Completed` or
+`Failed` result is produced. Existing result delivery, transaction correlation,
+authenticated pipe framing, and generic dialog wording are unchanged.
+
+## TDD and RED evidence
+
+Tests were written before the production implementation.
+
+### RED 1: terminal diagnostic record was absent
+
+Command:
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/Supervisor.SelfTest.ps1
+```
+
+Result: exit `1` after all earlier cases passed. The acknowledged revision 7
+test reached the real `OpenLogs` adapter, but no local terminal record existed:
+
+```text
+ASSERT_EQUAL_FAILED: terminal action writes exactly one local diagnostic record expected=[1] actual=[0]
+```
+
+This RED established that the failure was the missing diagnostic boundary, not
+an invalid test fixture, PowerShell parse error, or broken command handler.
+
+### RED 2: end-of-line regex semantics allowed an unsafe code
+
+After the initial minimal logger was green, a sanitation test was added before
+tightening the canonical-code matcher. PowerShell's `$` anchor accepted a
+terminal line-feed boundary, and the test exited `1`:
+
+```text
+ASSERT_EQUAL_FAILED: malformed terminal code is replaced by the canonical fallback
+expected=[CCOD_TRAY_ACTION_FAILED] actual=[CCOD_INJECTED\n]
+```
+
+The production matcher was then changed from `$` to `\z`; the test proves the
+newline-bearing value cannot enter the local diagnostic record.
+
+### Focused baseline outside the missing logger
+
+Before the production change, these two brief-named boundaries were already
+green:
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/TrayHostClient.SelfTest.ps1
+exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -TransportOnly
+exit 0; TrayHost transport self-tests passed: 8
+```
+
+They showed that the authenticated wrapper and host-side action-result queues
+were not the missing production behavior. Their assertions were then extended
+to prove the exact stale result reaches the parent-client boundary once and
+that HostTransport retains the exact revision, terminal status, and canonical
+code before the generic UI consumes the failure.
+
+## GREEN and final verification
+
+Fresh pre-commit verification ran the three brief-named focused suites, the
+native TrayHost suite, and the whitespace gate:
+
+```powershell
+$tests=@(
+  @{Name='TrayHost client';Command=@('tests\persistence\TrayHostClient.SelfTest.ps1')},
+  @{Name='Supervisor';Command=@('tests\persistence\Supervisor.SelfTest.ps1')},
+  @{Name='TrayHost transport';Command=@('tests\trayhost\Invoke-TrayHostSelfTest.ps1','-TransportOnly')},
+  @{Name='TrayHost native';Command=@('tests\trayhost\Invoke-TrayHostSelfTest.ps1','-NativeOnly')}
+)
+foreach($test in $tests){
+  powershell.exe -NoProfile -ExecutionPolicy Bypass -File @($test.Command)
+  if($LASTEXITCODE -ne 0){throw "$($test.Name) failed"}
+}
+git diff --check
+```
+
+Result: exit `0` throughout.
+
+- TrayHost client: 8 behavioral cases passed. The only output warning is the
+  pre-existing PowerShell warning about unapproved imported verb names.
+- Supervisor: 96 behavioral cases passed.
+- TrayHost transport: 8 behavioral cases passed.
+- TrayHost native: 15 behavioral cases passed.
+- `git diff --check`: exit `0`.
+- `git diff --cached --check`: exit `0` immediately before commit `b312174`.
+
+The new Supervisor cases prove the required ordering and side-effect boundary:
+
+1. revision 7 is present in `AcknowledgedPresentations`;
+2. `OpenLogs` is invoked exactly once;
+3. `CCOD_TRAY_ACTION_COMPLETED` is logged with command `OpenLogs`, revision 7,
+   and status `Completed`;
+4. the log write occurs after the handler and before `ActionResult:Completed`;
+5. revision 8 has no acknowledged map entry;
+6. the stale action invokes `OpenLogs` zero times;
+7. `CCOD_TRAY_ACTION_STALE` is logged before `ActionResult:Rejected`.
+
+The native suite retains the existing assertion that failure feedback uses only
+the acknowledged snapshot's localized generic title and `Action failed` text.
+No internal code is added to the dialog.
+
+## Scope, safety, and concerns
+
+- No real Codex or ChatGPT process was started, stopped, signaled, or controlled.
+- No production TrayHost process, installer, release build, or interactive
+  product UI was launched. The explicitly required native self-test exercised
+  its test-owned Win32 owner/fake platform and P/Invoke surface only.
+- Nothing was installed, pushed, published, released, uploaded, or signed.
+- WindowsApps, application binaries, and DPAPI/device-key data were untouched.
+- The authenticated pipe protocol, action-result wire schema, capability gate,
+  and revision ACK map were not weakened or changed.
+- The repository-wide suite was not run because this task authorized the three
+  focused suites plus native TrayHost verification; broader persistence tests
+  may cross real process-control boundaries. All task-required suites are green.
+- No independent agent review was run because the task explicitly prohibited
+  spawning agents. Parent integration review remains the next external gate.

From 94ca92fcc65a6e47616f8da82be2e40e7652380d Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 05:38:01 +0800
Subject: [PATCH 019/187] fix: gate tray feedback on durable diagnostics

---
 src/persistence/Supervisor.ps1                |  5 +-
 tests/persistence/Supervisor.SelfTest.ps1     | 89 ++++++++++++++++-
 .../trayhost/TrayHostCorrelationTestBridge.cs | 99 +++++++++++++++++++
 3 files changed, 189 insertions(+), 4 deletions(-)
 create mode 100644 tests/trayhost/TrayHostCorrelationTestBridge.cs

diff --git a/src/persistence/Supervisor.ps1 b/src/persistence/Supervisor.ps1
index 7bab1a3..96054fa 100644
--- a/src/persistence/Supervisor.ps1
+++ b/src/persistence/Supervisor.ps1
@@ -1167,13 +1167,14 @@ function Write-CcodSupervisorTrayActionTerminal {
             command=[string]$Action.Command;revision=[UInt64]$Action.Revision;status=$Status
         }
         Invoke-CcodSupervisorAdapter $Adapters.WriteLog @($record) 0
-    }catch{Add-CcodSupervisorCleanupCode $HostState.RuntimeCleanupCodes 'CCOD_SUPERVISOR_LOG_FAILED'}
+        return $true
+    }catch{Add-CcodSupervisorCleanupCode $HostState.RuntimeCleanupCodes 'CCOD_SUPERVISOR_LOG_FAILED';return $false}
 }
 
 function Send-CcodSupervisorTrayActionResult {
     param($HostState,[hashtable]$Adapters,$Action,[ValidateSet('Accepted','Completed','Rejected','Failed')][string]$Status,[AllowNull()][string]$ErrorCode,[AllowNull()][string]$TransactionId)
     $result=[pscustomobject][ordered]@{ActionId=$Action.ActionId;Revision=[UInt64]$Action.Revision;Status=$Status;ErrorCode=$ErrorCode;TransactionId=$TransactionId}
-    if($Status-cne'Accepted'){Write-CcodSupervisorTrayActionTerminal $HostState $Adapters $Action $Status $ErrorCode}
+    if($Status-cne'Accepted'-and-not(Write-CcodSupervisorTrayActionTerminal $HostState $Adapters $Action $Status $ErrorCode)){$result|Add-Member -NotePropertyName Delivered -NotePropertyValue $false;return $result}
     try{
         $delivered=Invoke-CcodSupervisorAdapter $Adapters.SendTrayActionResult @($HostState.Tray,$result.ActionId,$result.Revision,$result.Status,$result.ErrorCode,$result.TransactionId) 1
         if($delivered-isnot[bool]-or-not$delivered){throw 'tray action result was not acknowledged'}
diff --git a/tests/persistence/Supervisor.SelfTest.ps1 b/tests/persistence/Supervisor.SelfTest.ps1
index 5686621..e2e8a0e 100644
--- a/tests/persistence/Supervisor.SelfTest.ps1
+++ b/tests/persistence/Supervisor.SelfTest.ps1
@@ -812,6 +812,22 @@ Invoke-CcodTest 'successful lifecycle verification binds a fresh special proof b
     Assert-CcodEqual $null $hostState.LifecycleRequest 'later guardian decision creates no redundant repair lifecycle'
 }
 
+function Import-CcodTrayHostCorrelationTestBridge {
+    if($null-ne('TrayHostCorrelationTestBridge' -as[type])){return}
+    $trayRoot=Join-Path $repositoryRoot 'src\trayhost'
+    Add-Type -Path @(
+        (Join-Path $trayRoot 'PresentationSnapshot.cs'),
+        (Join-Path $trayRoot 'PipeProtocol.cs'),
+        (Join-Path $trayRoot 'TransportMessages.cs'),
+        (Join-Path $trayRoot 'NativeMethods.cs'),
+        (Join-Path $trayRoot 'InputModeGuard.cs'),
+        (Join-Path $trayRoot 'NativeMenu.cs'),
+        (Join-Path $trayRoot 'TrayWindow.cs'),
+        (Join-Path $trayRoot 'HostTransport.cs'),
+        (Join-Path $repositoryRoot 'tests\trayhost\TrayHostCorrelationTestBridge.cs')
+    )
+}
+
 Invoke-CcodTest 'post-worker rebind retries one transient missing enumeration for the same exact candidate' {
     $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
     $transactionModule=Import-Module $lifecycleTransactionPath -Force -PassThru
@@ -1581,7 +1597,8 @@ Invoke-CcodTest 'records an acknowledged OpenLogs terminal outcome after its han
     Assert-CcodEqual 1 @($world.Calls|Where-Object{$_ -eq 'Open:Logs'}).Count 'current acknowledged action invokes OpenLogs exactly once'
     Assert-CcodEqual 1 $world.UiFailureRecords.Count 'terminal action writes exactly one local diagnostic record'
     $record=$world.UiFailureRecords[0]
-    Assert-CcodEqual 'schemaVersion,timestampUtc,component,stage,code,outcome,command,revision,status' (@($record.PSObject.Properties.Name)-join ',') 'terminal diagnostic record is an exact sanitized schema'
+    foreach($field in @('command','revision','status','code')){Assert-CcodTrue ($null-ne$record.PSObject.Properties[$field]) "terminal diagnostic includes required field $field"}
+    foreach($field in @('ActionId','TransactionId','path','token','exception','message','raw')){Assert-CcodTrue ($null-eq$record.PSObject.Properties[$field]) "terminal diagnostic excludes unsafe field $field"}
     Assert-CcodEqual 'Supervisor' $record.component 'terminal diagnostic identifies the authorizing component'
     Assert-CcodEqual 'TrayAction' $record.stage 'terminal diagnostic uses the tray action stage'
     Assert-CcodEqual 'CCOD_TRAY_ACTION_COMPLETED' $record.code 'successful terminal diagnostic uses a safe canonical code'
@@ -1607,7 +1624,8 @@ Invoke-CcodTest 'rejects and records an unacknowledged OpenLogs revision before
     Assert-CcodEqual 0 @($world.Calls|Where-Object{$_ -eq 'Open:Logs'}).Count 'stale revision is rejected before the OpenLogs handler'
     Assert-CcodEqual 1 $world.UiFailureRecords.Count 'stale action writes exactly one local diagnostic record'
     $record=$world.UiFailureRecords[0]
-    Assert-CcodEqual 'schemaVersion,timestampUtc,component,stage,code,outcome,command,revision,status' (@($record.PSObject.Properties.Name)-join ',') 'stale diagnostic record is an exact sanitized schema'
+    foreach($field in @('command','revision','status','code')){Assert-CcodTrue ($null-ne$record.PSObject.Properties[$field]) "stale diagnostic includes required field $field"}
+    foreach($field in @('ActionId','TransactionId','path','token','exception','message','raw')){Assert-CcodTrue ($null-eq$record.PSObject.Properties[$field]) "stale diagnostic excludes unsafe field $field"}
     Assert-CcodEqual 'CCOD_TRAY_ACTION_STALE' $record.code 'stale diagnostic preserves the exact canonical code'
     Assert-CcodEqual 'OpenLogs' $record.command 'stale diagnostic preserves the rejected command'
     Assert-CcodEqual ([UInt64]8) $record.revision 'stale diagnostic preserves the unacknowledged revision'
@@ -1627,6 +1645,73 @@ Invoke-CcodTest 'sanitizes a malformed terminal action code before local logging
     Assert-CcodEqual 'CCOD_TRAY_ACTION_FAILED' $world.UiFailureRecords[0].code 'malformed terminal code is replaced by the canonical fallback'
 }
 
+Invoke-CcodTest 'does not queue generic terminal feedback when its local diagnostic write fails' {
+    # Production mutation caught: delivering a rejected terminal result to TrayHost after the required local diagnostic failed to persist.
+    $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host;$world.FailAt='WriteLog'
+    $action=[pscustomobject][ordered]@{ActionId=[guid]'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeb1';Command='OpenLogs';Revision=[UInt64]2}
+
+    $result=@(Invoke-CcodSupervisorCommand $hostState $fixture.Fake.Adapters $action)[0]
+
+    Assert-CcodEqual 'Rejected' $result.Status 'stale action retains its supervisor terminal status'
+    Assert-CcodEqual 'CCOD_TRAY_ACTION_STALE' $result.ErrorCode 'stale action retains its stable code'
+    Assert-CcodEqual $false $result.Delivered 'failed diagnostic persistence prevents terminal feedback delivery'
+    Assert-CcodEqual 0 $world.TrayActionResults.Count 'TrayHost receives no terminal result without a durable local record'
+    Assert-CcodEqual 0 @($world.Calls|Where-Object{$_ -eq 'Open:Logs'}).Count 'stale action still performs no handler side effect'
+    Assert-CcodTrue ($hostState.RuntimeCleanupCodes.Contains('CCOD_SUPERVISOR_LOG_FAILED')) 'failed diagnostic persistence remains visible in the supervisor cleanup receipt'
+}
+
+Invoke-CcodTest 'correlates native menu actions through HostTransport Supervisor ACK authorization and result ACK' {
+    # Production mutation caught: disconnecting native revision selection, Supervisor acknowledgement authority, or the exact HostTransport terminal ACK.
+    Import-CcodTrayHostCorrelationTestBridge
+    $enabled=[pscustomobject][ordered]@{RepairEnabled=$true;LanguageEnabled=$true;OpenLogsEnabled=$true;AboutEnabled=$true;ExitEnabled=$true}
+
+    $current=[TrayHostCorrelationTestBridge]::new([UInt64]7,[TrayCommand]::OpenLogs)
+    try{
+        $current.SelectFromNativeMenu()
+        $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
+        $hostState.Tray.CurrentRevision=[UInt64]7;$hostState.Tray.AcknowledgedPresentations['7']=$enabled;$hostState.LastAcknowledgedPresentation=$enabled
+        $world|Add-Member -NotePropertyName Bridge -NotePropertyValue $current
+        $fixture.Fake.Adapters.SendTrayActionResult={
+            param($Tray,$ActionId,$Revision,$Status,$ErrorCode,$TransactionId)
+            $world.Calls.Add("ActionResult:$Status")
+            $world.TrayActionResults.Add([pscustomobject][ordered]@{ActionId=$ActionId;Revision=[UInt64]$Revision;Status=$Status;ErrorCode=$ErrorCode;TransactionId=$TransactionId})
+            return $world.Bridge.Acknowledge($ActionId,[UInt64]$Revision,$Status,$ErrorCode)
+        }.GetNewClosure()
+        $action=[pscustomobject][ordered]@{ActionId=$current.ActionId;Command=$current.Command;Revision=[UInt64]$current.Revision}
+
+        $result=@(Invoke-CcodSupervisorCommand $hostState $fixture.Fake.Adapters $action)[0]
+
+        Assert-CcodEqual 'Completed' $result.Status 'current displayed revision reaches its specific Supervisor handler'
+        Assert-CcodEqual 1 @($world.Calls|Where-Object{$_ -eq 'Open:Logs'}).Count 'native current action invokes OpenLogs exactly once'
+        Assert-CcodEqual 'Completed' $current.TerminalStatus 'real HostTransport acknowledges the completed terminal result'
+        Assert-CcodEqual ([UInt64]7) $current.TerminalRevision 'real HostTransport terminal result retains the displayed revision'
+    }finally{$current.Dispose()}
+
+    $stale=[TrayHostCorrelationTestBridge]::new([UInt64]8,[TrayCommand]::OpenLogs)
+    try{
+        $stale.SelectFromNativeMenu()
+        $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
+        $hostState.Tray.CurrentRevision=[UInt64]8
+        $world|Add-Member -NotePropertyName Bridge -NotePropertyValue $stale
+        $fixture.Fake.Adapters.SendTrayActionResult={
+            param($Tray,$ActionId,$Revision,$Status,$ErrorCode,$TransactionId)
+            $world.Calls.Add("ActionResult:$Status")
+            $world.TrayActionResults.Add([pscustomobject][ordered]@{ActionId=$ActionId;Revision=[UInt64]$Revision;Status=$Status;ErrorCode=$ErrorCode;TransactionId=$TransactionId})
+            return $world.Bridge.Acknowledge($ActionId,[UInt64]$Revision,$Status,$ErrorCode)
+        }.GetNewClosure()
+        $action=[pscustomobject][ordered]@{ActionId=$stale.ActionId;Command=$stale.Command;Revision=[UInt64]$stale.Revision}
+
+        $result=@(Invoke-CcodSupervisorCommand $hostState $fixture.Fake.Adapters $action)[0]
+
+        Assert-CcodEqual 'Rejected' $result.Status 'unacknowledged native revision is rejected'
+        Assert-CcodEqual 'CCOD_TRAY_ACTION_STALE' $result.ErrorCode 'unacknowledged native revision preserves the stale code'
+        Assert-CcodEqual 0 @($world.Calls|Where-Object{$_ -eq 'Open:Logs'}).Count 'unacknowledged native action cannot invoke OpenLogs'
+        Assert-CcodEqual 'Rejected' $stale.TerminalStatus 'real HostTransport acknowledges the stale terminal rejection'
+        Assert-CcodEqual 'CCOD_TRAY_ACTION_STALE' $stale.TerminalCode 'real HostTransport retains the exact stale code before generic feedback'
+        Assert-CcodEqual ([UInt64]8) $stale.TerminalRevision 'real HostTransport stale result retains the displayed revision'
+    }finally{$stale.Dispose()}
+}
+
 Invoke-CcodTest 'rejects an action revision that was published but never acknowledged as displayed' {
     $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
     $hostState.Tray.CurrentRevision=[UInt64]9
diff --git a/tests/trayhost/TrayHostCorrelationTestBridge.cs b/tests/trayhost/TrayHostCorrelationTestBridge.cs
new file mode 100644
index 0000000..22d13f1
--- /dev/null
+++ b/tests/trayhost/TrayHostCorrelationTestBridge.cs
@@ -0,0 +1,99 @@
+using System;
+using System.Collections.Generic;
+
+public sealed class TrayHostCorrelationTestBridge : IDisposable
+{
+    private sealed class Platform : INativeTrayPlatform
+    {
+        internal uint Selection;
+        public IntPtr CreateOwner() { return new IntPtr(10); }
+        public IntPtr AssociateOwnerInputContext(IntPtr owner, IntPtr context) { return new IntPtr(20); }
+        public IntPtr GetOwnerInputContext(IntPtr owner) { return IntPtr.Zero; }
+        public bool ReleaseInputContext(IntPtr owner, IntPtr context) { return true; }
+        public IntPtr LoadIcon() { return new IntPtr(40); }
+        public bool DestroyIcon(IntPtr icon) { return true; }
+        public bool AddIcon(ref TrayIconData icon) { return true; }
+        public bool SetIconVersion(ref TrayIconData icon) { return true; }
+        public bool DeleteIcon(ref TrayIconData icon) { return true; }
+        public IntPtr CreatePopupMenu() { return new IntPtr(30); }
+        public IntPtr CreateSubMenu() { return new IntPtr(31); }
+        public bool AppendMenu(IntPtr menu, uint flags, UIntPtr command, string text) { return true; }
+        public bool AppendSubMenu(IntPtr menu, IntPtr child, string text) { return true; }
+        public bool ShowOwner(IntPtr owner) { return true; }
+        public bool HideOwner(IntPtr owner) { return true; }
+        public bool SetForegroundWindow(IntPtr owner) { return true; }
+        public IntPtr GetForegroundWindow() { return new IntPtr(10); }
+        public uint TrackPopupMenuEx(IntPtr menu, uint flags, int x, int y, IntPtr owner, IntPtr parameters) { return Selection; }
+        public bool PostMessage(IntPtr owner, uint message, UIntPtr wParam, IntPtr lParam) { return true; }
+        public bool SetNotificationFocus(ref TrayIconData icon) { return true; }
+        public bool ShowMessageBox(IntPtr owner, string text, string caption) { return true; }
+        public bool ConfirmExit(IntPtr owner, string text, string caption) { return true; }
+        public bool DestroyMenu(IntPtr menu) { return true; }
+        public bool EndMenu() { return true; }
+        public bool DestroyOwner(IntPtr owner) { return true; }
+    }
+
+    private readonly Platform _platform;
+    private readonly HostTransport _transport;
+    private readonly TrayWindow _window;
+    private TrayHostAction _selected;
+    private TrayActionResult _terminal;
+
+    public TrayHostCorrelationTestBridge(ulong revision, TrayCommand command)
+    {
+        _platform = new Platform { Selection = (uint)command };
+        _transport = new HostTransport();
+        _window = new TrayWindow(_platform, _transport.SetMenuOpen);
+        _window.CommandSelected += delegate(TrayCommand selected, ulong displayedRevision)
+        {
+            TrayHostAction action = new TrayHostAction(Guid.NewGuid(), selected, displayedRevision);
+            if (!_transport.TryRegisterAction(action)) { throw new InvalidOperationException("test action registration failed"); }
+            _selected = action;
+        };
+        _window.Create(Snapshot(revision));
+    }
+
+    public void SelectFromNativeMenu()
+    {
+        _window.HandleContextMenu(new TrayPoint(5, 5));
+        if (_selected == null) { throw new InvalidOperationException("native menu produced no action"); }
+    }
+
+    public Guid ActionId { get { return _selected == null ? Guid.Empty : _selected.ActionId; } }
+    public string Command { get { return _selected == null ? String.Empty : _selected.Command.ToString(); } }
+    public ulong Revision { get { return _selected == null ? 0UL : _selected.Revision; } }
+
+    public bool Acknowledge(Guid actionId, ulong revision, string status, string errorCode)
+    {
+        TrayActionResultStatus parsed = (TrayActionResultStatus)Enum.Parse(typeof(TrayActionResultStatus), status, false);
+        TrayActionResult result = new TrayActionResult(actionId, revision, parsed, errorCode, null);
+        bool accepted = _transport.TryAcknowledgeAction(result);
+        if (!accepted) { return false; }
+        if (parsed == TrayActionResultStatus.Rejected || parsed == TrayActionResultStatus.Failed)
+        {
+            TrayActionResult queued;
+            if (!_transport.TryTakeFailedAction(out queued)) { return false; }
+            _terminal = queued;
+        }
+        else { _terminal = result; }
+        return true;
+    }
+
+    public string TerminalStatus { get { return _terminal == null ? String.Empty : _terminal.Status.ToString(); } }
+    public string TerminalCode { get { return _terminal == null ? String.Empty : (_terminal.ErrorCode ?? String.Empty); } }
+    public ulong TerminalRevision { get { return _terminal == null ? 0UL : _terminal.Revision; } }
+
+    private static PresentationSnapshot Snapshot(ulong revision)
+    {
+        string[] strings = new string[16];
+        for (int index = 0; index < strings.Length; index++) { strings[index] = "correlation-" + index.ToString(); }
+        return new PresentationSnapshot(revision, TrayColor.Green, ConnectionState.Connected, ProtectionState.Running, LanguageMode.English,
+            PresentationFlags.OpenLogsEnabled | PresentationFlags.LanguageEnabled | PresentationFlags.AboutEnabled, strings);
+    }
+
+    public void Dispose()
+    {
+        _window.Dispose();
+        _transport.Dispose();
+    }
+}

From 1c8a6454e013828f8a4e92a495711cf88edd4686 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 05:38:38 +0800
Subject: [PATCH 020/187] docs: record Task 4 fix round 1

---
 .../task-4-report.md                          | 131 ++++++++++++++++++
 1 file changed, 131 insertions(+)

diff --git a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-4-report.md b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-4-report.md
index 672e452..3969c76 100644
--- a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-4-report.md
+++ b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-4-report.md
@@ -177,3 +177,134 @@ No internal code is added to the dialog.
   may cross real process-control boundaries. All task-required suites are green.
 - No independent agent review was run because the task explicitly prohibited
   spawning agents. Parent integration review remains the next external gate.
+
+## Fix round 1: durable diagnostic gate and real correlation chain
+
+Independent review identified that implementation commit `b312174` attempted
+the terminal log before delivery but swallowed `WriteLog` failure and still sent
+the terminal `ActionResult`. That allowed HostTransport to queue the generic
+failure dialog without any durable local terminal record. Review also found
+that the original wrapper, Supervisor, transport, and native assertions were
+separate tests rather than one test traversing their real correlation chain.
+
+Fix implementation commit: `94ca92f`
+(`fix: gate tray feedback on durable diagnostics`).
+
+### RED evidence
+
+The `WriteLog` failure test was added before changing production code:
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/Supervisor.SelfTest.ps1
+```
+
+Result: exit `1` at the new case after all preceding cases passed:
+
+```text
+ASSERT_EQUAL_FAILED: failed diagnostic persistence prevents terminal feedback delivery
+expected=[False] actual=[True]
+```
+
+This proved the exact reviewed defect: the Supervisor returned
+`Delivered=True` even though the local action record had not persisted.
+
+The real correlation test was also written before the production fix. It uses
+the test-only `TrayHostCorrelationTestBridge`, which compiles and composes the
+checked-in production `TrayWindow`, `NativeMenu`, `HostTransport`, action/result
+types, and revision behavior. No replacement protocol or external channel is
+introduced.
+
+### Implementation and pending-action safety
+
+`Write-CcodSupervisorTrayActionTerminal` now returns `true` only after the
+existing `WriteLog` adapter completes without error. It returns `false` after
+adding `CCOD_SUPERVISOR_LOG_FAILED` to the Supervisor cleanup receipt on any
+clock, schema-construction, or log-write exception.
+
+For terminal `Completed`, `Rejected`, and `Failed` results,
+`Send-CcodSupervisorTrayActionResult` now stops immediately with
+`Delivered=false` when that durable-record gate fails. It does not call
+`SendTrayActionResult`, so HostTransport cannot queue About work or generic
+failure feedback without the required local record. `Accepted` remains a
+nonterminal lifecycle acknowledgement and retains its existing authenticated
+delivery path.
+
+The pending HostTransport action is safe under this outcome:
+
+- it receives no false terminal acknowledgement;
+- it cannot display generic terminal feedback without a durable diagnostic;
+- it remains protected by the existing action-id replay cache and eight-entry
+  pending-action bound;
+- lifecycle completion receives `Delivered=false`, so the existing repair and
+  SafeExit gates do not mark the terminal notification complete or exit the UI;
+- the Supervisor cleanup receipt exposes `CCOD_SUPERVISOR_LOG_FAILED` for the
+  enclosing host outcome.
+
+No retry or unauthenticated fallback was added, so the change cannot duplicate
+a lifecycle terminal result or weaken action identity/capability authority.
+
+### Real end-to-end correlation coverage
+
+The new Supervisor behavioral case executes both branches through one actual
+chain:
+
+```text
+TrayWindow.HandleContextMenu
+  -> NativeMenu selected command and displayed revision
+  -> HostTransport.TryRegisterAction
+  -> Supervisor AcknowledgedPresentations revision/capability gate
+  -> actual OpenLogs adapter or stale rejection
+  -> sanitized WriteLog record
+  -> Supervisor SendTrayActionResult boundary
+  -> HostTransport.TryAcknowledgeAction
+```
+
+For revision 7, the same action selected by the native menu is placed in the
+ACK map, invokes `OpenLogs` exactly once, returns `Completed`, and is accepted
+by the real HostTransport with revision 7. For revision 8, no ACK-map entry is
+created; `OpenLogs` is invoked zero times, Supervisor returns
+`CCOD_TRAY_ACTION_STALE`, and the real HostTransport accepts the exact rejected
+terminal result and preserves revision 8 and the stale code before generic UI
+consumption.
+
+The bridge is test-only and calls the production in-process APIs directly. It
+does not start a production TrayHost process, open an external control surface,
+or alter the authenticated wire protocol.
+
+### Diagnostic record shape ruling
+
+Tests now treat `command`, `revision`, `status`, and `code` as required inclusive
+fields. They retain and validate the sanitized standard envelope
+`schemaVersion`, `timestampUtc`, `component`, `stage`, and `outcome`. They also
+explicitly assert the absence of `ActionId`, `TransactionId`, path, token,
+exception, message, and raw arbitrary-text properties. The envelope is a local
+log schema, not a new wire protocol.
+
+### GREEN and fresh verification
+
+After the minimal fail-closed implementation, the Supervisor suite passed 98
+cases, including the new durable-log failure and real correlation tests. Fresh
+pre-commit verification then ran every Task 4 required suite:
+
+```text
+TrayHost client: exit 0; 8 behavioral cases
+Supervisor: exit 0; 98 behavioral cases
+TrayHost transport: exit 0; 8 behavioral cases
+TrayHost native: exit 0; 15 behavioral cases
+git diff --check: exit 0
+git diff --cached --check: exit 0
+```
+
+The existing lifecycle safety tests remained green, including SafeExit refusal
+to shut down when its correlated terminal result is not delivered and terminal
+lifecycle completion only after acknowledgement.
+
+### Fix-round scope and concerns
+
+- Changed only `src/persistence/Supervisor.ps1`, its behavioral self-test, the
+  test-only C# correlation bridge, and this report.
+- No real Codex/ChatGPT or production TrayHost process was started, stopped, or
+  controlled. No installer, release, install, push, signing, WindowsApps, DPAPI,
+  or interactive product UI operation occurred.
+- No independent agent was used because this fix round explicitly prohibited
+  agents. Parent integration review remains the next review gate.

From 3bdd575dd8afd91396cef02f1a4357915d42ec3f Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 05:50:17 +0800
Subject: [PATCH 021/187] fix: release tray actions after diagnostic failure

---
 src/persistence/Supervisor.ps1                |  2 +-
 src/trayhost/HostTransport.cs                 | 22 +++++++--
 src/trayhost/Program.cs                       |  4 +-
 src/trayhost/TrayTerminalDiagnostic.cs        | 35 ++++++++++++++
 tests/persistence/Supervisor.SelfTest.ps1     | 42 +++++++++++-----
 tests/trayhost/Invoke-TrayHostSelfTest.ps1    |  1 +
 .../trayhost/TrayHostCorrelationTestBridge.cs | 19 ++++++--
 tests/trayhost/TrayHostNativeSelfTest.cs      | 19 +++++++-
 tests/trayhost/TrayHostTransportSelfTest.cs   | 48 +++++++++++++++++--
 9 files changed, 163 insertions(+), 29 deletions(-)
 create mode 100644 src/trayhost/TrayTerminalDiagnostic.cs

diff --git a/src/persistence/Supervisor.ps1 b/src/persistence/Supervisor.ps1
index 96054fa..47219a1 100644
--- a/src/persistence/Supervisor.ps1
+++ b/src/persistence/Supervisor.ps1
@@ -1174,7 +1174,7 @@ function Write-CcodSupervisorTrayActionTerminal {
 function Send-CcodSupervisorTrayActionResult {
     param($HostState,[hashtable]$Adapters,$Action,[ValidateSet('Accepted','Completed','Rejected','Failed')][string]$Status,[AllowNull()][string]$ErrorCode,[AllowNull()][string]$TransactionId)
     $result=[pscustomobject][ordered]@{ActionId=$Action.ActionId;Revision=[UInt64]$Action.Revision;Status=$Status;ErrorCode=$ErrorCode;TransactionId=$TransactionId}
-    if($Status-cne'Accepted'-and-not(Write-CcodSupervisorTrayActionTerminal $HostState $Adapters $Action $Status $ErrorCode)){$result|Add-Member -NotePropertyName Delivered -NotePropertyValue $false;return $result}
+    if($Status-cne'Accepted'){[void](Write-CcodSupervisorTrayActionTerminal $HostState $Adapters $Action $Status $ErrorCode)}
     try{
         $delivered=Invoke-CcodSupervisorAdapter $Adapters.SendTrayActionResult @($HostState.Tray,$result.ActionId,$result.Revision,$result.Status,$result.ErrorCode,$result.TransactionId) 1
         if($delivered-isnot[bool]-or-not$delivered){throw 'tray action result was not acknowledged'}
diff --git a/src/trayhost/HostTransport.cs b/src/trayhost/HostTransport.cs
index f71a77b..e9d5848 100644
--- a/src/trayhost/HostTransport.cs
+++ b/src/trayhost/HostTransport.cs
@@ -11,6 +11,7 @@ private sealed class PendingAction
 
     private readonly object _gate = new object();
     private readonly Action _presentationReady;
+    private readonly Func<TrayTerminalDiagnostic, bool> _writeTerminalDiagnostic;
     private readonly Queue<TrayActionResult> _completedAbout = new Queue<TrayActionResult>();
     private readonly Queue<TrayActionResult> _failedActions = new Queue<TrayActionResult>();
     private readonly Dictionary<Guid, PendingAction> _pendingActions = new Dictionary<Guid, PendingAction>();
@@ -20,13 +21,18 @@ private sealed class PendingAction
     private bool _menuOpen;
     private bool _disposed;
 
-    internal HostTransport() : this(null)
+    internal HostTransport() : this(null, null)
     {
     }
 
-    internal HostTransport(Action presentationReady)
+    internal HostTransport(Action presentationReady) : this(presentationReady, null)
+    {
+    }
+
+    internal HostTransport(Action presentationReady, Func<TrayTerminalDiagnostic, bool> writeTerminalDiagnostic)
     {
         _presentationReady = presentationReady;
+        _writeTerminalDiagnostic = writeTerminalDiagnostic;
     }
 
     internal void SetMenuOpen(bool value)
@@ -97,10 +103,16 @@ internal bool TryAcknowledgeAction(TrayActionResult result)
             }
             if (result.Status != TrayActionResultStatus.Completed && result.Status != TrayActionResultStatus.Rejected && result.Status != TrayActionResultStatus.Failed) { return false; }
             if (result.Status == TrayActionResultStatus.Completed && TrayCommandPolicy.RequiresAcceptedBeforeCompleted(pending.Action.Command) && !pending.Accepted) { return false; }
-            if ((result.Status == TrayActionResultStatus.Rejected || result.Status == TrayActionResultStatus.Failed) && _failedActions.Count >= 8) { return false; }
+            bool recorded = false;
+            Func<TrayTerminalDiagnostic, bool> writer = _writeTerminalDiagnostic;
+            if (writer != null)
+            {
+                try { recorded = writer(new TrayTerminalDiagnostic(pending.Action.Command, result.Revision, result.Status, result.ErrorCode)); }
+                catch { recorded = false; }
+            }
             _pendingActions.Remove(result.ActionId);
-            if (result.Status == TrayActionResultStatus.Completed && pending.Action.Command == TrayCommand.ShowAbout) { _completedAbout.Enqueue(result); }
-            if (result.Status == TrayActionResultStatus.Rejected || result.Status == TrayActionResultStatus.Failed) { _failedActions.Enqueue(result); }
+            if (recorded && result.Status == TrayActionResultStatus.Completed && pending.Action.Command == TrayCommand.ShowAbout) { _completedAbout.Enqueue(result); }
+            if (recorded && (result.Status == TrayActionResultStatus.Rejected || result.Status == TrayActionResultStatus.Failed) && _failedActions.Count < 8) { _failedActions.Enqueue(result); }
             return true;
         }
     }
diff --git a/src/trayhost/Program.cs b/src/trayhost/Program.cs
index 106b3e6..d227d2e 100644
--- a/src/trayhost/Program.cs
+++ b/src/trayhost/Program.cs
@@ -39,7 +39,9 @@ private static int RunChild(string[] args)
         PresentationSnapshot initial = TrayHostWire.ReadPresentation(initialFrame.Payload);
         Win32TrayPlatform platform = new Win32TrayPlatform();
         TrayHostApplication application = null;
-        HostTransport transport = new HostTransport(delegate { TrayHostApplication current = application; if (current != null) { current.PostWork(); } });
+        string terminalLogPath = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "CodexControlOtherDevices", "logs", "trayhost-actions.log");
+        try { Directory.CreateDirectory(Path.GetDirectoryName(terminalLogPath)); } catch { }
+        HostTransport transport = new HostTransport(delegate { TrayHostApplication current = application; if (current != null) { current.PostWork(); } }, delegate(TrayTerminalDiagnostic record) { return TrayTerminalDiagnosticLog.TryAppend(terminalLogPath, record); });
         TrayWindow window = new TrayWindow(platform, transport.SetMenuOpen);
         bool shutdownRequested = false; bool shutdownSent = false; object stateGate = new object();
         Action<TrayCommand, ulong> command = delegate(TrayCommand selected, ulong revision)
diff --git a/src/trayhost/TrayTerminalDiagnostic.cs b/src/trayhost/TrayTerminalDiagnostic.cs
new file mode 100644
index 0000000..b4f84c8
--- /dev/null
+++ b/src/trayhost/TrayTerminalDiagnostic.cs
@@ -0,0 +1,35 @@
+using System;
+using System.IO;
+
+internal sealed class TrayTerminalDiagnostic
+{
+    internal TrayCommand Command { get; private set; }
+    internal ulong Revision { get; private set; }
+    internal TrayActionResultStatus Status { get; private set; }
+    internal string Code { get; private set; }
+
+    internal TrayTerminalDiagnostic(TrayCommand command, ulong revision, TrayActionResultStatus status, string errorCode)
+    {
+        if (!TrayCommandPolicy.IsWireCommand(command) || revision == 0UL || status == TrayActionResultStatus.Accepted || !Enum.IsDefined(typeof(TrayActionResultStatus), status)) { throw new ArgumentException("terminal diagnostic is invalid"); }
+        string code = status == TrayActionResultStatus.Completed ? "CCOD_TRAY_ACTION_COMPLETED" : errorCode;
+        if (!TrayCommandPolicy.IsCanonicalErrorCode(code)) { code = "CCOD_TRAY_ACTION_FAILED"; }
+        Command = command; Revision = revision; Status = status; Code = code;
+    }
+}
+
+internal static class TrayTerminalDiagnosticLog
+{
+    private static readonly object Gate = new object();
+
+    internal static bool TryAppend(string path, TrayTerminalDiagnostic record)
+    {
+        if (String.IsNullOrEmpty(path) || record == null) { return false; }
+        try
+        {
+            string line = "command=" + record.Command.ToString() + " revision=" + record.Revision.ToString(System.Globalization.CultureInfo.InvariantCulture) + " status=" + record.Status.ToString() + " code=" + record.Code + Environment.NewLine;
+            lock (Gate) { File.AppendAllText(path, line); }
+            return true;
+        }
+        catch { return false; }
+    }
+}
diff --git a/tests/persistence/Supervisor.SelfTest.ps1 b/tests/persistence/Supervisor.SelfTest.ps1
index e2e8a0e..42d120d 100644
--- a/tests/persistence/Supervisor.SelfTest.ps1
+++ b/tests/persistence/Supervisor.SelfTest.ps1
@@ -819,6 +819,7 @@ function Import-CcodTrayHostCorrelationTestBridge {
         (Join-Path $trayRoot 'PresentationSnapshot.cs'),
         (Join-Path $trayRoot 'PipeProtocol.cs'),
         (Join-Path $trayRoot 'TransportMessages.cs'),
+        (Join-Path $trayRoot 'TrayTerminalDiagnostic.cs'),
         (Join-Path $trayRoot 'NativeMethods.cs'),
         (Join-Path $trayRoot 'InputModeGuard.cs'),
         (Join-Path $trayRoot 'NativeMenu.cs'),
@@ -1646,18 +1647,37 @@ Invoke-CcodTest 'sanitizes a malformed terminal action code before local logging
 }
 
 Invoke-CcodTest 'does not queue generic terminal feedback when its local diagnostic write fails' {
-    # Production mutation caught: delivering a rejected terminal result to TrayHost after the required local diagnostic failed to persist.
+    # Production mutation caught: stranding a pending HostTransport action when Supervisor logging fails instead of using the authenticated host-side diagnostic gate.
+    Import-CcodTrayHostCorrelationTestBridge
     $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host;$world.FailAt='WriteLog'
-    $action=[pscustomobject][ordered]@{ActionId=[guid]'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeb1';Command='OpenLogs';Revision=[UInt64]2}
-
-    $result=@(Invoke-CcodSupervisorCommand $hostState $fixture.Fake.Adapters $action)[0]
-
-    Assert-CcodEqual 'Rejected' $result.Status 'stale action retains its supervisor terminal status'
-    Assert-CcodEqual 'CCOD_TRAY_ACTION_STALE' $result.ErrorCode 'stale action retains its stable code'
-    Assert-CcodEqual $false $result.Delivered 'failed diagnostic persistence prevents terminal feedback delivery'
-    Assert-CcodEqual 0 $world.TrayActionResults.Count 'TrayHost receives no terminal result without a durable local record'
-    Assert-CcodEqual 0 @($world.Calls|Where-Object{$_ -eq 'Open:Logs'}).Count 'stale action still performs no handler side effect'
-    Assert-CcodTrue ($hostState.RuntimeCleanupCodes.Contains('CCOD_SUPERVISOR_LOG_FAILED')) 'failed diagnostic persistence remains visible in the supervisor cleanup receipt'
+    $bridge=[TrayHostCorrelationTestBridge]::new([UInt64]2,[TrayCommand]::OpenLogs,$false)
+    try{
+        $world|Add-Member -NotePropertyName Bridge -NotePropertyValue $bridge
+        $fixture.Fake.Adapters.SendTrayActionResult={
+            param($Tray,$ActionId,$Revision,$Status,$ErrorCode,$TransactionId)
+            $world.TrayActionResults.Add([pscustomobject][ordered]@{ActionId=$ActionId;Revision=[UInt64]$Revision;Status=$Status;ErrorCode=$ErrorCode;TransactionId=$TransactionId})
+            return $world.Bridge.Acknowledge($ActionId,[UInt64]$Revision,$Status,$ErrorCode)
+        }.GetNewClosure()
+        foreach($index in 1..10){
+            $bridge.SelectFromNativeMenu()
+            $action=[pscustomobject][ordered]@{ActionId=$bridge.ActionId;Command=$bridge.Command;Revision=[UInt64]$bridge.Revision}
+            $result=@(Invoke-CcodSupervisorCommand $hostState $fixture.Fake.Adapters $action)[0]
+            Assert-CcodEqual 'Rejected' $result.Status "log-failure stale action $index retains its Supervisor status"
+            Assert-CcodEqual $true $result.Delivered "log-failure stale action $index is terminally accepted by HostTransport"
+        }
+        Assert-CcodEqual 0 $bridge.FeedbackCount 'host-side diagnostic failures suppress every generic feedback item'
+        Assert-CcodTrue ($hostState.RuntimeCleanupCodes.Contains('CCOD_SUPERVISOR_LOG_FAILED')) 'Supervisor log failure remains visible in the cleanup receipt'
+
+        $world.FailAt=$null;$bridge.SetDiagnosticPersistence($true)
+        $enabled=[pscustomobject][ordered]@{RepairEnabled=$true;LanguageEnabled=$true;OpenLogsEnabled=$true;AboutEnabled=$true;ExitEnabled=$true}
+        $hostState.Tray.AcknowledgedPresentations['2']=$enabled;$hostState.LastAcknowledgedPresentation=$enabled
+        $bridge.SelectFromNativeMenu()
+        $recovered=[pscustomobject][ordered]@{ActionId=$bridge.ActionId;Command=$bridge.Command;Revision=[UInt64]$bridge.Revision}
+        $result=@(Invoke-CcodSupervisorCommand $hostState $fixture.Fake.Adapters $recovered)[0]
+        Assert-CcodEqual 'Completed' $result.Status 'new command completes after both diagnostic paths recover'
+        Assert-CcodEqual $true $result.Delivered 'recovered HostTransport acknowledges the new completed result'
+        Assert-CcodEqual 1 @($world.Calls|Where-Object{$_ -eq 'Open:Logs'}).Count 'recovered new command reaches its handler exactly once'
+    }finally{$bridge.Dispose()}
 }
 
 Invoke-CcodTest 'correlates native menu actions through HostTransport Supervisor ACK authorization and result ACK' {
diff --git a/tests/trayhost/Invoke-TrayHostSelfTest.ps1 b/tests/trayhost/Invoke-TrayHostSelfTest.ps1
index b17c01a..8846e6d 100644
--- a/tests/trayhost/Invoke-TrayHostSelfTest.ps1
+++ b/tests/trayhost/Invoke-TrayHostSelfTest.ps1
@@ -22,6 +22,7 @@ $nativeFiles=@(
 )
 $transportFiles=@(
     (Join-Path $repositoryRoot 'src\trayhost\TransportMessages.cs'),
+    (Join-Path $repositoryRoot 'src\trayhost\TrayTerminalDiagnostic.cs'),
     (Join-Path $repositoryRoot 'src\trayhost\ParentTransport.cs'),
     (Join-Path $repositoryRoot 'src\trayhost\HostTransport.cs')
 )
diff --git a/tests/trayhost/TrayHostCorrelationTestBridge.cs b/tests/trayhost/TrayHostCorrelationTestBridge.cs
index 22d13f1..a79ba20 100644
--- a/tests/trayhost/TrayHostCorrelationTestBridge.cs
+++ b/tests/trayhost/TrayHostCorrelationTestBridge.cs
@@ -38,11 +38,18 @@ private sealed class Platform : INativeTrayPlatform
     private readonly TrayWindow _window;
     private TrayHostAction _selected;
     private TrayActionResult _terminal;
+    private bool _persistDiagnostics = true;
+    private int _feedbackCount;
 
-    public TrayHostCorrelationTestBridge(ulong revision, TrayCommand command)
+    public TrayHostCorrelationTestBridge(ulong revision, TrayCommand command) : this(revision, command, true)
+    {
+    }
+
+    public TrayHostCorrelationTestBridge(ulong revision, TrayCommand command, bool persistDiagnostics)
     {
         _platform = new Platform { Selection = (uint)command };
-        _transport = new HostTransport();
+        _persistDiagnostics = persistDiagnostics;
+        _transport = new HostTransport(null, delegate(TrayTerminalDiagnostic record) { return _persistDiagnostics; });
         _window = new TrayWindow(_platform, _transport.SetMenuOpen);
         _window.CommandSelected += delegate(TrayCommand selected, ulong displayedRevision)
         {
@@ -69,16 +76,18 @@ public bool Acknowledge(Guid actionId, ulong revision, string status, string err
         TrayActionResult result = new TrayActionResult(actionId, revision, parsed, errorCode, null);
         bool accepted = _transport.TryAcknowledgeAction(result);
         if (!accepted) { return false; }
+        _terminal = result;
         if (parsed == TrayActionResultStatus.Rejected || parsed == TrayActionResultStatus.Failed)
         {
             TrayActionResult queued;
-            if (!_transport.TryTakeFailedAction(out queued)) { return false; }
-            _terminal = queued;
+            if (_transport.TryTakeFailedAction(out queued)) { _terminal = queued; _feedbackCount++; }
         }
-        else { _terminal = result; }
         return true;
     }
 
+    public void SetDiagnosticPersistence(bool value) { _persistDiagnostics = value; }
+    public int FeedbackCount { get { return _feedbackCount; } }
+
     public string TerminalStatus { get { return _terminal == null ? String.Empty : _terminal.Status.ToString(); } }
     public string TerminalCode { get { return _terminal == null ? String.Empty : (_terminal.ErrorCode ?? String.Empty); } }
     public ulong TerminalRevision { get { return _terminal == null ? 0UL : _terminal.Revision; } }
diff --git a/tests/trayhost/TrayHostNativeSelfTest.cs b/tests/trayhost/TrayHostNativeSelfTest.cs
index 820be16..273c597 100644
--- a/tests/trayhost/TrayHostNativeSelfTest.cs
+++ b/tests/trayhost/TrayHostNativeSelfTest.cs
@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using System.IO;
 
 internal sealed class FakeTrayPlatform : INativeTrayPlatform
 {
@@ -208,6 +209,21 @@ private static void TestActionFailureUsesTheAcknowledgedSnapshotStrings()
         window.Dispose();
     }
 
+    private static void TestTerminalDiagnosticLogIsSanitizedAndReportsPersistence()
+    {
+        string root = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(root);
+        string path = Path.Combine(root, "trayhost-actions.log");
+        try
+        {
+            TrayTerminalDiagnostic record = new TrayTerminalDiagnostic(TrayCommand.OpenLogs, 23UL, TrayActionResultStatus.Rejected, "CCOD_TRAY_ACTION_STALE");
+            AssertTrue(TrayTerminalDiagnosticLog.TryAppend(path, record), "terminal diagnostic append reports durable success");
+            AssertEqual("command=OpenLogs revision=23 status=Rejected code=CCOD_TRAY_ACTION_STALE" + Environment.NewLine, File.ReadAllText(path), "terminal diagnostic file contains only the approved correlation fields");
+            AssertTrue(!TrayTerminalDiagnosticLog.TryAppend(root, record), "terminal diagnostic append reports persistence failure without throwing");
+        }
+        finally { try { Directory.Delete(root, true); } catch { } }
+    }
+
     private static void TestNoHimcFailureIsSafe()
     {
         FakeTrayPlatform platform = new FakeTrayPlatform();
@@ -287,12 +303,13 @@ public static int Main(string[] args)
             TestAboutCommandDefersProofToSupervisor();
             TestVerifiedAboutUsesTheAcknowledgedSnapshotVersion();
             TestActionFailureUsesTheAcknowledgedSnapshotStrings();
+            TestTerminalDiagnosticLogIsSanitizedAndReportsPersistence();
             TestSimplifiedMenuAndExitConfirmation();
             TestNoHimcFailureIsSafe();
             TestShellRightClickNotificationMapping();
             TestRealNativePInvokeSurface();
             TestPostedWorkMessageDispatchesToItsOwnerWindow();
-            Console.WriteLine("TrayHost native self-tests passed: 15");
+            Console.WriteLine("TrayHost native self-tests passed: 16");
             return 0;
         }
         catch (Exception error)
diff --git a/tests/trayhost/TrayHostTransportSelfTest.cs b/tests/trayhost/TrayHostTransportSelfTest.cs
index 928289c..7a55cfa 100644
--- a/tests/trayhost/TrayHostTransportSelfTest.cs
+++ b/tests/trayhost/TrayHostTransportSelfTest.cs
@@ -3,6 +3,8 @@
 
 internal static class TrayHostTransportSelfTest
 {
+    private static bool PersistTerminal(TrayTerminalDiagnostic record) { return true; }
+
     private static void AssertTrue(bool value, string message)
     {
         if (!value) { throw new InvalidOperationException(message); }
@@ -124,7 +126,7 @@ private static void TestActionResultCorrelationAndControlPriority()
 
     private static void TestAcknowledgedAboutQueuesOneUiWorkItem()
     {
-        HostTransport host = new HostTransport(); Guid actionId = Guid.NewGuid();
+        HostTransport host = new HostTransport(null, PersistTerminal); Guid actionId = Guid.NewGuid();
         AssertTrue(host.TryRegisterAction(new TrayHostAction(actionId, TrayCommand.ShowAbout, 14UL)), "About action registers");
         AssertTrue(host.TryAcknowledgeAction(new TrayActionResult(actionId, 14UL, TrayActionResultStatus.Completed, null, null)), "verified About completion is accepted");
         TrayActionResult result;
@@ -135,7 +137,7 @@ private static void TestAcknowledgedAboutQueuesOneUiWorkItem()
 
     private static void TestRejectedAndFailedActionsQueueUserFeedback()
     {
-        HostTransport host = new HostTransport();
+        HostTransport host = new HostTransport(null, PersistTerminal);
         Guid rejectedId = Guid.NewGuid(); Guid failedId = Guid.NewGuid();
         AssertTrue(host.TryRegisterAction(new TrayHostAction(rejectedId, TrayCommand.OpenLogs, 20UL)), "rejected action registers");
         AssertTrue(host.TryRegisterAction(new TrayHostAction(failedId, TrayCommand.SetLanguageEnglish, 20UL)), "failed action registers");
@@ -150,14 +152,49 @@ private static void TestRejectedAndFailedActionsQueueUserFeedback()
 
     private static void TestUndisplayedActionFailureFeedbackIsBounded()
     {
-        HostTransport host = new HostTransport();
+        HostTransport host = new HostTransport(null, PersistTerminal);
         for (int index = 0; index < 9; index++)
         {
             Guid actionId = Guid.NewGuid();
             AssertTrue(host.TryRegisterAction(new TrayHostAction(actionId, TrayCommand.OpenLogs, 21UL)), "terminal failure releases pending action capacity");
             bool accepted = host.TryAcknowledgeAction(new TrayActionResult(actionId, 21UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null));
-            AssertTrue(index < 8 ? accepted : !accepted, "undisplayed action failure feedback is bounded to the pending-action capacity");
+            AssertTrue(accepted, "bounded undisplayed feedback never strands an authenticated terminal action");
+        }
+        host.Dispose();
+    }
+
+    private static void TestTerminalDiagnosticFailureNeverStrandsPendingActions()
+    {
+        HostTransport missingWriter = new HostTransport();
+        Guid missingWriterId = Guid.NewGuid();
+        AssertTrue(missingWriter.TryRegisterAction(new TrayHostAction(missingWriterId, TrayCommand.OpenLogs, 22UL)), "action registers without a diagnostic writer");
+        AssertTrue(missingWriter.TryAcknowledgeAction(new TrayActionResult(missingWriterId, 22UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null)), "missing diagnostic writer still releases the authenticated terminal action");
+        TrayActionResult missingWriterFeedback;
+        AssertTrue(!missingWriter.TryTakeFailedAction(out missingWriterFeedback), "missing diagnostic writer cannot authorize generic feedback");
+        missingWriter.Dispose();
+
+        bool persist = false;
+        List<TrayTerminalDiagnostic> records = new List<TrayTerminalDiagnostic>();
+        HostTransport host = new HostTransport(null, delegate(TrayTerminalDiagnostic record) { records.Add(record); return persist; });
+        for (int index = 0; index < 10; index++)
+        {
+            Guid actionId = Guid.NewGuid();
+            AssertTrue(host.TryRegisterAction(new TrayHostAction(actionId, TrayCommand.OpenLogs, 22UL)), "diagnostic failure never consumes pending-action capacity");
+            AssertTrue(host.TryAcknowledgeAction(new TrayActionResult(actionId, 22UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null)), "authenticated terminal result releases its pending action even when local persistence fails");
+            TrayActionResult suppressed;
+            AssertTrue(!host.TryTakeFailedAction(out suppressed), "generic feedback is suppressed when its local terminal diagnostic did not persist");
         }
+        persist = true;
+        Guid recoveredId = Guid.NewGuid();
+        AssertTrue(host.TryRegisterAction(new TrayHostAction(recoveredId, TrayCommand.OpenLogs, 22UL)), "new action registers after repeated diagnostic failures");
+        AssertTrue(host.TryAcknowledgeAction(new TrayActionResult(recoveredId, 22UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null)), "recovered diagnostic persistence accepts a new terminal result");
+        TrayActionResult recoveredFeedback;
+        AssertTrue(host.TryTakeFailedAction(out recoveredFeedback) && recoveredFeedback.ActionId == recoveredId, "generic feedback resumes only after local terminal persistence recovers");
+        Guid completedId = Guid.NewGuid();
+        AssertTrue(host.TryRegisterAction(new TrayHostAction(completedId, TrayCommand.OpenLogs, 22UL)), "post-recovery command can still register");
+        AssertTrue(host.TryAcknowledgeAction(new TrayActionResult(completedId, 22UL, TrayActionResultStatus.Completed, null, null)), "post-recovery command can complete");
+        TrayTerminalDiagnostic last = records[records.Count - 1];
+        AssertTrue(last.Command == TrayCommand.OpenLogs && last.Revision == 22UL && last.Status == TrayActionResultStatus.Completed && String.Equals(last.Code, "CCOD_TRAY_ACTION_COMPLETED", StringComparison.Ordinal), "terminal diagnostic exposes only the exact canonical correlation fields");
         host.Dispose();
     }
 
@@ -173,7 +210,8 @@ public static int Main(string[] args)
             TestAcknowledgedAboutQueuesOneUiWorkItem();
             TestRejectedAndFailedActionsQueueUserFeedback();
             TestUndisplayedActionFailureFeedbackIsBounded();
-            Console.WriteLine("TrayHost transport self-tests passed: 8");
+            TestTerminalDiagnosticFailureNeverStrandsPendingActions();
+            Console.WriteLine("TrayHost transport self-tests passed: 9");
             return 0;
         }
         catch (Exception error)

From 424f9c84f0d3f853b2091b9f825f8ee5ff55e0f0 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 05:50:53 +0800
Subject: [PATCH 022/187] docs: record Task 4 fix round 2

---
 .../task-4-report.md                          | 138 ++++++++++++++++++
 1 file changed, 138 insertions(+)

diff --git a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-4-report.md b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-4-report.md
index 3969c76..9c7613a 100644
--- a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-4-report.md
+++ b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-4-report.md
@@ -308,3 +308,141 @@ lifecycle completion only after acknowledgement.
   or interactive product UI operation occurred.
 - No independent agent was used because this fix round explicitly prohibited
   agents. Parent integration review remains the next review gate.
+
+## Fix round 2: release pending actions through a host-side diagnostic gate
+
+Re-review found that fix round 1's suppression of the terminal ACK prevented
+generic feedback without a record, but permanently retained the corresponding
+HostTransport pending entry. Eight Supervisor-log failures could therefore fill
+the pending-action bound and disable later tray commands.
+
+Fix implementation commit: `3bdd575`
+(`fix: release tray actions after diagnostic failure`).
+
+### TDD and RED evidence
+
+Tests were changed before production code. The new transport regression
+required a typed terminal record and a diagnostic-writer HostTransport boundary.
+The focused transport compile failed with the expected missing production API:
+
+```text
+CS0246: TrayTerminalDiagnostic could not be found
+CS1729: HostTransport does not contain a constructor that takes 2 arguments
+CCOD_TRAYHOST_NATIVE_COMPILE_FAILED
+```
+
+The Supervisor correlation suite independently failed to compile its real
+native/transport bridge for the same missing type. This established that the
+repeated-failure recovery behavior did not exist.
+
+After the first implementation, a second behavioral test treated a missing
+writer as a persistence failure. It failed before the default was hardened:
+
+```text
+TrayHost transport self-test failed: System.InvalidOperationException
+missing diagnostic writer cannot authorize generic feedback
+```
+
+The default was then changed to fail closed for feedback while still consuming
+the authenticated terminal result.
+
+### Implementation
+
+`TrayTerminalDiagnostic` is a new internal strong type. Its constructor accepts
+only an existing `TrayCommand`, positive revision, terminal
+`TrayActionResultStatus`, and canonical result code. `Completed` maps to
+`CCOD_TRAY_ACTION_COMPLETED`; malformed failure values map to
+`CCOD_TRAY_ACTION_FAILED`. It cannot carry an action id, transaction id, path,
+token, exception, or arbitrary message.
+
+`TrayTerminalDiagnosticLog.TryAppend` writes exactly one fixed-format line:
+
+```text
+command=<enum> revision=<invariant UInt64> status=<terminal enum> code=<canonical CCOD code>
+```
+
+It returns `true` only after `File.AppendAllText` closes successfully and returns
+`false` without throwing on persistence failure. The native self-test writes to
+an isolated temporary file, verifies the line byte-for-byte, and verifies that
+an invalid file target returns `false`.
+
+Production `Program` derives a fixed current-user path under
+`LocalApplicationData\CodexControlOtherDevices\logs\trayhost-actions.log` and
+injects the typed writer into HostTransport. No path or arbitrary payload comes
+from the authenticated message, and no new pipe message, command, external
+control surface, or unauthenticated channel was added.
+
+HostTransport now processes a valid authenticated terminal result in this
+order while holding its existing correlation lock:
+
+1. require the exact pending action id and presentation revision;
+2. enforce lifecycle Accepted-before-Completed rules;
+3. build the typed terminal diagnostic from the pending command and result;
+4. attempt the injected local write;
+5. remove the pending action regardless of write success;
+6. enqueue About or generic failure feedback only when the write succeeded;
+7. return terminal acceptance so the authenticated reader does not treat a
+   consumed valid result as a protocol violation.
+
+If no writer exists or the writer returns/throws failure, no feedback is
+queued, but pending capacity is released. If the bounded feedback queue is
+already full, the additional terminal result is likewise consumed and its
+pending entry released; only the redundant UI item is suppressed.
+
+Supervisor again sends the authenticated terminal result after attempting its
+standard sanitized envelope log. This gives two safe cases:
+
+- Supervisor log succeeds: the standard timestamped local record already
+  exists, and TrayHost also gates feedback on its typed host receipt.
+- Supervisor log fails: `CCOD_SUPERVISOR_LOG_FAILED` remains in the cleanup
+  receipt, while the host receipt either persists before feedback or suppresses
+  feedback. In both cases the authenticated terminal result releases pending
+  capacity.
+
+The standard Supervisor envelope and its inclusive-field ruling were not
+changed.
+
+### Repeated failure and recovery proof
+
+The transport regression submits ten distinct authenticated failed actions
+while the diagnostic writer returns false. Every action registers, every exact
+terminal result is accepted, every pending entry is released, and zero generic
+feedback items are available. After switching the same writer to success, a new
+failed action registers and produces feedback, followed by a new command that
+registers and completes. The last typed record is asserted as exactly
+`OpenLogs`, revision 22, `Completed`, and `CCOD_TRAY_ACTION_COMPLETED`.
+
+The Supervisor end-to-end test repeats ten stale native-menu actions while both
+Supervisor and host diagnostic writes fail. The same real
+`TrayWindow -> NativeMenu -> HostTransport -> Supervisor ACK map -> result ACK`
+chain accepts every terminal result without invoking `OpenLogs` or producing
+feedback. After both writers recover and revision 2 is acknowledged, the next
+native command registers, reaches `OpenLogs` exactly once, and completes.
+
+### Fresh verification
+
+Fresh pre-commit verification results:
+
+```text
+TrayHost client: exit 0; 8 behavioral cases
+Supervisor: exit 0; 98 behavioral cases
+TrayHost transport: exit 0; 9 behavioral cases
+TrayHost native: exit 0; 16 behavioral cases
+TrayHost production compile/headless smoke: exit 0
+git diff --check: exit 0
+git diff --cached --check: exit 0
+```
+
+The production smoke compiles every checked-in TrayHost C# source, including
+the new diagnostic type, and runs only the existing no-UI headless path.
+
+### Fix-round scope and concerns
+
+- No authenticated wire field or result status changed.
+- No real Codex/ChatGPT or production interactive TrayHost process was started,
+  stopped, signaled, or controlled.
+- Nothing was installed, pushed, published, released, signed, or written to
+  WindowsApps/DPAPI. Runtime logging was tested only through an isolated temp
+  path; the production path was compiled but not exercised against user data.
+- No independent agent was used because this fix round explicitly prohibited
+  agents. Parent re-review remains the next gate.

From 9c1e4dfcb9acb4c6f6dc9d7a495b67d28edd6859 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 06:05:01 +0800
Subject: [PATCH 023/187] fix: harden tray terminal diagnostics

---
 src/trayhost/HostTransport.cs                 |  22 +--
 src/trayhost/Program.cs                       |  12 +-
 src/trayhost/TrayTerminalDiagnostic.cs        |  64 ++++++++-
 .../TrayHostProductionTrace.SelfTest.ps1      |  30 +++++
 tests/trayhost/Invoke-TrayHostSelfTest.ps1    |  16 ++-
 tests/trayhost/TrayHostNativeSelfTest.cs      |  35 ++++-
 .../trayhost/TrayHostParentClientSelfTest.cs  | 125 +++++++++++++++---
 tests/trayhost/TrayHostTransportSelfTest.cs   |  41 +++++-
 8 files changed, 306 insertions(+), 39 deletions(-)
 create mode 100644 tests/persistence/TrayHostProductionTrace.SelfTest.ps1

diff --git a/src/trayhost/HostTransport.cs b/src/trayhost/HostTransport.cs
index e9d5848..be636aa 100644
--- a/src/trayhost/HostTransport.cs
+++ b/src/trayhost/HostTransport.cs
@@ -90,10 +90,11 @@ internal bool TryRegisterAction(TrayHostAction action)
     internal bool TryAcknowledgeAction(TrayActionResult result)
     {
         if (result == null) { return false; }
+        PendingAction pending;
+        TrayTerminalDiagnostic diagnostic;
         lock (_gate)
         {
             if (_disposed) { return false; }
-            PendingAction pending;
             if (!_pendingActions.TryGetValue(result.ActionId, out pending) || pending.Action.Revision != result.Revision) { return false; }
             if (result.Status == TrayActionResultStatus.Accepted)
             {
@@ -103,14 +104,19 @@ internal bool TryAcknowledgeAction(TrayActionResult result)
             }
             if (result.Status != TrayActionResultStatus.Completed && result.Status != TrayActionResultStatus.Rejected && result.Status != TrayActionResultStatus.Failed) { return false; }
             if (result.Status == TrayActionResultStatus.Completed && TrayCommandPolicy.RequiresAcceptedBeforeCompleted(pending.Action.Command) && !pending.Accepted) { return false; }
-            bool recorded = false;
-            Func<TrayTerminalDiagnostic, bool> writer = _writeTerminalDiagnostic;
-            if (writer != null)
-            {
-                try { recorded = writer(new TrayTerminalDiagnostic(pending.Action.Command, result.Revision, result.Status, result.ErrorCode)); }
-                catch { recorded = false; }
-            }
+            diagnostic = new TrayTerminalDiagnostic(pending.Action.Command, result.Revision, result.Status, result.ErrorCode);
             _pendingActions.Remove(result.ActionId);
+        }
+        bool recorded = false;
+        Func<TrayTerminalDiagnostic, bool> writer = _writeTerminalDiagnostic;
+        if (writer != null)
+        {
+            try { recorded = writer(diagnostic); }
+            catch { recorded = false; }
+        }
+        lock (_gate)
+        {
+            if (_disposed) { return true; }
             if (recorded && result.Status == TrayActionResultStatus.Completed && pending.Action.Command == TrayCommand.ShowAbout) { _completedAbout.Enqueue(result); }
             if (recorded && (result.Status == TrayActionResultStatus.Rejected || result.Status == TrayActionResultStatus.Failed) && _failedActions.Count < 8) { _failedActions.Enqueue(result); }
             return true;
diff --git a/src/trayhost/Program.cs b/src/trayhost/Program.cs
index d227d2e..f438004 100644
--- a/src/trayhost/Program.cs
+++ b/src/trayhost/Program.cs
@@ -39,8 +39,8 @@ private static int RunChild(string[] args)
         PresentationSnapshot initial = TrayHostWire.ReadPresentation(initialFrame.Payload);
         Win32TrayPlatform platform = new Win32TrayPlatform();
         TrayHostApplication application = null;
-        string terminalLogPath = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "CodexControlOtherDevices", "logs", "trayhost-actions.log");
-        try { Directory.CreateDirectory(Path.GetDirectoryName(terminalLogPath)); } catch { }
+        string terminalLogPath;
+        if (!TrayTerminalDiagnosticLog.TryGetDefaultPath(out terminalLogPath)) { terminalLogPath = null; }
         HostTransport transport = new HostTransport(delegate { TrayHostApplication current = application; if (current != null) { current.PostWork(); } }, delegate(TrayTerminalDiagnostic record) { return TrayTerminalDiagnosticLog.TryAppend(terminalLogPath, record); });
         TrayWindow window = new TrayWindow(platform, transport.SetMenuOpen);
         bool shutdownRequested = false; bool shutdownSent = false; object stateGate = new object();
@@ -91,7 +91,7 @@ private static int RunChild(string[] args)
                 {
                     ProtocolFrame frame = ProtocolCodec.ReadAuthenticated(input, ProtocolDirection.ParentToHost, epoch, inboundSequence++, keys.ParentToHost);
                     if (frame.MessageType == TrayHostMessageType.Presentation) { transport.TryAcceptPresentation(TrayHostWire.ReadPresentation(frame.Payload)); application.PostWork(); }
-                    else if (frame.MessageType == TrayHostMessageType.ActionResult) { if (!transport.TryAcknowledgeAction(TrayHostWire.ReadActionResult(frame.Payload))) { throw new ProtocolViolationException("action result is uncorrelated"); } application.PostWork(); }
+                    else if (frame.MessageType == TrayHostMessageType.ActionResult) { if (!TryDispatchAuthenticatedActionResult(transport, frame.Payload)) { throw new ProtocolViolationException("action result is uncorrelated"); } application.PostWork(); }
                     else if (frame.MessageType == TrayHostMessageType.Shutdown) { lock (stateGate) { shutdownRequested = true; } application.PostWork(); }
                     else if (frame.MessageType == TrayHostMessageType.Ping) { lock (WriteGate) { ProtocolCodec.WriteAuthenticated(output, ProtocolFrame.Authenticated(ProtocolDirection.HostToParent, TrayHostMessageType.Pong, epoch, outboundSequence++, frame.Payload), keys.HostToParent); } }
                 }
@@ -108,6 +108,12 @@ private static bool VerifyParentIdentity(int pid, long creation)
         try { using (Process process = Process.GetProcessById(pid)) { return process.StartTime.ToFileTimeUtc() == creation; } } catch { return false; }
     }
 
+    internal static bool TryDispatchAuthenticatedActionResult(HostTransport transport, byte[] payload)
+    {
+        if (transport == null || payload == null) { return false; }
+        return transport.TryAcknowledgeAction(TrayHostWire.ReadActionResult(payload));
+    }
+
     private static int RunHeadlessSmoke()
     {
         string[] strings = new string[16]; for (int i = 0; i < strings.Length; i++) { strings[i] = "smoke-" + i; }
diff --git a/src/trayhost/TrayTerminalDiagnostic.cs b/src/trayhost/TrayTerminalDiagnostic.cs
index b4f84c8..c3f160e 100644
--- a/src/trayhost/TrayTerminalDiagnostic.cs
+++ b/src/trayhost/TrayTerminalDiagnostic.cs
@@ -1,5 +1,6 @@
 using System;
 using System.IO;
+using System.Text;
 
 internal sealed class TrayTerminalDiagnostic
 {
@@ -19,17 +20,76 @@ internal TrayTerminalDiagnostic(TrayCommand command, ulong revision, TrayActionR
 
 internal static class TrayTerminalDiagnosticLog
 {
+    internal const long MaximumBytes = 64L * 1024L;
     private static readonly object Gate = new object();
 
+    internal static bool TryGetDefaultPath(out string path)
+    {
+        path = null;
+        try
+        {
+            string local = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData);
+            if (String.IsNullOrEmpty(local) || !Path.IsPathRooted(local) || !IsSafeExistingDirectory(local)) { return false; }
+            string product = Path.Combine(local, "CodexControlOtherDevices");
+            if (!TryCreateSafeChildDirectory(product)) { return false; }
+            string logs = Path.Combine(product, "logs");
+            if (!TryCreateSafeChildDirectory(logs)) { return false; }
+            path = Path.Combine(logs, "trayhost-actions.log");
+            return IsSafePath(path);
+        }
+        catch { path = null; return false; }
+    }
+
     internal static bool TryAppend(string path, TrayTerminalDiagnostic record)
     {
-        if (String.IsNullOrEmpty(path) || record == null) { return false; }
+        if (String.IsNullOrEmpty(path) || record == null || !Path.IsPathRooted(path)) { return false; }
         try
         {
             string line = "command=" + record.Command.ToString() + " revision=" + record.Revision.ToString(System.Globalization.CultureInfo.InvariantCulture) + " status=" + record.Status.ToString() + " code=" + record.Code + Environment.NewLine;
-            lock (Gate) { File.AppendAllText(path, line); }
+            byte[] bytes = new UTF8Encoding(false).GetBytes(line);
+            if (bytes.LongLength > MaximumBytes) { return false; }
+            string full = Path.GetFullPath(path);
+            lock (Gate)
+            {
+                if (!IsSafePath(full)) { return false; }
+                FileMode mode = File.Exists(full) && new FileInfo(full).Length + bytes.LongLength <= MaximumBytes ? FileMode.Append : FileMode.Create;
+                using (FileStream stream = new FileStream(full, mode, FileAccess.Write, FileShare.Read))
+                {
+                    stream.Write(bytes, 0, bytes.Length);
+                    stream.Flush(true);
+                }
+            }
             return true;
         }
         catch { return false; }
     }
+
+    private static bool TryCreateSafeChildDirectory(string path)
+    {
+        if (Directory.Exists(path)) { return IsSafeExistingDirectory(path); }
+        string parent = Path.GetDirectoryName(path);
+        if (String.IsNullOrEmpty(parent) || !IsSafeExistingDirectory(parent)) { return false; }
+        Directory.CreateDirectory(path);
+        return IsSafeExistingDirectory(path);
+    }
+
+    private static bool IsSafePath(string path)
+    {
+        if (!Path.IsPathRooted(path) || !String.Equals(Path.GetFileName(path), "trayhost-actions.log", StringComparison.OrdinalIgnoreCase) || Directory.Exists(path)) { return false; }
+        if (File.Exists(path) && (File.GetAttributes(path) & FileAttributes.ReparsePoint) != 0) { return false; }
+        string directory = Path.GetDirectoryName(path);
+        return !String.IsNullOrEmpty(directory) && IsSafeExistingDirectory(directory);
+    }
+
+    private static bool IsSafeExistingDirectory(string path)
+    {
+        DirectoryInfo current = new DirectoryInfo(path);
+        if (!current.Exists) { return false; }
+        while (current != null)
+        {
+            if (!current.Exists || (current.Attributes & FileAttributes.ReparsePoint) != 0) { return false; }
+            current = current.Parent;
+        }
+        return true;
+    }
 }
diff --git a/tests/persistence/TrayHostProductionTrace.SelfTest.ps1 b/tests/persistence/TrayHostProductionTrace.SelfTest.ps1
new file mode 100644
index 0000000..a5bff83
--- /dev/null
+++ b/tests/persistence/TrayHostProductionTrace.SelfTest.ps1
@@ -0,0 +1,30 @@
+param([Parameter(Mandatory)][string]$AssemblyPath)
+$ErrorActionPreference='Stop'
+. (Join-Path $PSScriptRoot 'TestSupport.ps1')
+$repositoryRoot=Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+[Reflection.Assembly]::LoadFrom([IO.Path]::GetFullPath($AssemblyPath))|Out-Null
+Import-Module (Join-Path $repositoryRoot 'src\persistence\modules\TrayHostClient.psm1') -Force
+
+function Invoke-CcodProductionTraceCase {
+    param([bool]$Stale)
+    $client=[TrayHostProductionTraceFixture]::Start($AssemblyPath,$Stale)
+    try{
+        $queue=[Collections.Generic.Queue[object]]::new()
+        $context=[pscustomobject][ordered]@{Client=$client;CommandQueue=$queue;Exited=$false;LastError=$null;PublishedPresentations=[ordered]@{};AcknowledgedPresentations=[ordered]@{}}
+        $deadline=[DateTime]::UtcNow.AddSeconds(3)
+        while($queue.Count-eq0-and[DateTime]::UtcNow-lt$deadline){[void]$client.WaitForActivity([TimeSpan]::FromMilliseconds(100));Receive-CcodTrayHostEvents -Context $context}
+        Assert-CcodEqual 1 $queue.Count 'real TrayHostClient receives one authenticated production action'
+        $action=$queue.Dequeue()
+        Assert-CcodEqual 'OpenLogs' $action.Command 'production trace preserves command through TrayHostWire and TrayHostClient'
+        $expectedRevision=if($Stale){[UInt64]8}else{[UInt64]1}
+        Assert-CcodEqual $expectedRevision $action.Revision 'production trace preserves the exact presentation revision'
+        $status=if($Stale){'Rejected'}else{'Completed'}
+        $code=if($Stale){'CCOD_TRAY_ACTION_STALE'}else{$null}
+        Assert-CcodEqual $true (Send-CcodTrayHostActionResult -Context $context -ActionId $action.ActionId -Revision $action.Revision -Status $status -ErrorCode $code -TransactionId $null) 'real TrayHostClient sends the authenticated correlated terminal result'
+        Assert-CcodTrue $client.WaitForStopped([TimeSpan]::FromSeconds(3)) 'production trace peer validates Program dispatch and exits'
+    }finally{$client.Dispose()}
+}
+
+Invoke-CcodProductionTraceCase $false
+Invoke-CcodProductionTraceCase $true
+Write-Host 'TrayHost production correlation trace passed: 2'
diff --git a/tests/trayhost/Invoke-TrayHostSelfTest.ps1 b/tests/trayhost/Invoke-TrayHostSelfTest.ps1
index 8846e6d..f38ae62 100644
--- a/tests/trayhost/Invoke-TrayHostSelfTest.ps1
+++ b/tests/trayhost/Invoke-TrayHostSelfTest.ps1
@@ -35,12 +35,20 @@ $parentClientFiles=@(
     (Join-Path $repositoryRoot 'src\trayhost\JobObject.cs'),
     (Join-Path $repositoryRoot 'src\trayhost\TrayHostParentClient.cs')
 )
+$programTraceFiles=@(
+    (Join-Path $repositoryRoot 'src\trayhost\NativeMethods.cs'),
+    (Join-Path $repositoryRoot 'src\trayhost\InputModeGuard.cs'),
+    (Join-Path $repositoryRoot 'src\trayhost\NativeMenu.cs'),
+    (Join-Path $repositoryRoot 'src\trayhost\TrayWindow.cs'),
+    (Join-Path $repositoryRoot 'src\trayhost\TrayHostApplication.cs'),
+    (Join-Path $repositoryRoot 'src\trayhost\Program.cs')
+)
 $testPath=if($ProtocolOnly){Join-Path $repositoryRoot 'tests\trayhost\TrayHostProtocolSelfTest.cs'}elseif($NativeOnly){Join-Path $repositoryRoot 'tests\trayhost\TrayHostNativeSelfTest.cs'}elseif($TransportOnly){Join-Path $repositoryRoot 'tests\trayhost\TrayHostTransportSelfTest.cs'}else{Join-Path $repositoryRoot 'tests\trayhost\TrayHostParentClientSelfTest.cs'}
 $requiredFiles=@($protocolPath,$presentationPath,$testPath)
 if($ProtocolOnly){$requiredFiles+=$protocolSupportFiles}
 if($NativeOnly){$requiredFiles+=$nativeFiles+$transportFiles}
 if($TransportOnly){$requiredFiles+=$transportFiles}
-if($ParentClientOnly){$requiredFiles+=$transportFiles+$parentClientFiles}
+if($ParentClientOnly){$requiredFiles+=$transportFiles+$parentClientFiles+$programTraceFiles}
 if($ProductionOnly){$requiredFiles+=(Get-ChildItem -LiteralPath (Join-Path $repositoryRoot 'src\trayhost') -Filter '*.cs' -File | ForEach-Object FullName)}
 if($requiredFiles|Where-Object{ -not(Test-Path -LiteralPath $_ -PathType Leaf)}){throw 'CCOD_TRAYHOST_SOURCE_MISSING'}
 Import-Module (Join-Path $repositoryRoot 'build\TrayHostReferencePack.psm1') -Force
@@ -62,11 +70,15 @@ try{
         if($ProtocolOnly){$args+=$protocolSupportFiles}
         if($NativeOnly){$args+=$nativeFiles+$transportFiles}
         if($TransportOnly){$args+=$transportFiles}
-        if($ParentClientOnly){$args+=$transportFiles+$parentClientFiles}
+        if($ParentClientOnly){$args+=$transportFiles+$parentClientFiles+$programTraceFiles}
     }
     $args+=$testPath
     & $compiler @args
     if($LASTEXITCODE -ne 0){if($ProtocolOnly){throw 'CCOD_TRAYHOST_PROTOCOL_COMPILE_FAILED'}elseif($ProductionOnly){throw 'CCOD_TRAYHOST_PRODUCTION_COMPILE_FAILED'}else{throw 'CCOD_TRAYHOST_NATIVE_COMPILE_FAILED'}}
     if($ProductionOnly){& $outputPath '--headless-smoke'}else{& $outputPath}
     if($LASTEXITCODE -ne 0){if($ProtocolOnly){throw 'CCOD_TRAYHOST_PROTOCOL_TEST_FAILED'}elseif($ProductionOnly){throw 'CCOD_TRAYHOST_HEADLESS_SMOKE_FAILED'}else{throw 'CCOD_TRAYHOST_NATIVE_TEST_FAILED'}}
+    if($ParentClientOnly){
+        & powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $repositoryRoot 'tests\persistence\TrayHostProductionTrace.SelfTest.ps1') -AssemblyPath $outputPath
+        if($LASTEXITCODE -ne 0){throw 'CCOD_TRAYHOST_PRODUCTION_TRACE_FAILED'}
+    }
 }finally{if(Test-Path -LiteralPath $temporaryRoot){Remove-Item -LiteralPath $temporaryRoot -Recurse -Force -ErrorAction SilentlyContinue}}
diff --git a/tests/trayhost/TrayHostNativeSelfTest.cs b/tests/trayhost/TrayHostNativeSelfTest.cs
index 273c597..67a1980 100644
--- a/tests/trayhost/TrayHostNativeSelfTest.cs
+++ b/tests/trayhost/TrayHostNativeSelfTest.cs
@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using System.Diagnostics;
 using System.IO;
 
 internal sealed class FakeTrayPlatform : INativeTrayPlatform
@@ -224,6 +225,37 @@ private static void TestTerminalDiagnosticLogIsSanitizedAndReportsPersistence()
         finally { try { Directory.Delete(root, true); } catch { } }
     }
 
+    private static void TestTerminalDiagnosticLogIsBoundedAndRejectsReparseComponents()
+    {
+        string root = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-bound-" + Guid.NewGuid().ToString("N"));
+        string target = Path.Combine(root, "target");
+        string junction = Path.Combine(root, "junction");
+        Directory.CreateDirectory(target);
+        string path = Path.Combine(target, "trayhost-actions.log");
+        try
+        {
+            string lastLine = String.Empty;
+            for (ulong revision = 1UL; revision <= 1400UL; revision++)
+            {
+                TrayTerminalDiagnostic record = new TrayTerminalDiagnostic(TrayCommand.OpenLogs, revision, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED");
+                AssertTrue(TrayTerminalDiagnosticLog.TryAppend(path, record), "bounded terminal diagnostic append succeeds");
+                lastLine = "command=OpenLogs revision=" + revision.ToString(System.Globalization.CultureInfo.InvariantCulture) + " status=Failed code=CCOD_TRAY_ACTION_FAILED" + Environment.NewLine;
+            }
+            FileInfo retained = new FileInfo(path);
+            AssertTrue(retained.Length <= TrayTerminalDiagnosticLog.MaximumBytes, "terminal diagnostic retention never exceeds its fixed byte bound");
+            AssertTrue(File.ReadAllText(path).EndsWith(lastLine, StringComparison.Ordinal), "deterministic rollover retains the complete latest terminal record");
+
+            ProcessStartInfo junctionInfo = new ProcessStartInfo {
+                FileName = Environment.GetEnvironmentVariable("ComSpec"),
+                Arguments = "/d /c mklink /J \"" + junction + "\" \"" + target + "\"",
+                UseShellExecute = false, CreateNoWindow = true, RedirectStandardOutput = true, RedirectStandardError = true
+            };
+            using (Process junctionProcess = Process.Start(junctionInfo)) { junctionProcess.WaitForExit(); AssertTrue(junctionProcess.ExitCode == 0, "test junction is created"); }
+            AssertTrue(!TrayTerminalDiagnosticLog.TryAppend(Path.Combine(junction, "trayhost-actions.log"), new TrayTerminalDiagnostic(TrayCommand.OpenLogs, 1UL, TrayActionResultStatus.Rejected, "CCOD_TRAY_ACTION_STALE")), "terminal diagnostic rejects a reparse-point path component");
+        }
+        finally { try { if (Directory.Exists(junction)) { Directory.Delete(junction); } } catch { } try { Directory.Delete(root, true); } catch { } }
+    }
+
     private static void TestNoHimcFailureIsSafe()
     {
         FakeTrayPlatform platform = new FakeTrayPlatform();
@@ -304,12 +336,13 @@ public static int Main(string[] args)
             TestVerifiedAboutUsesTheAcknowledgedSnapshotVersion();
             TestActionFailureUsesTheAcknowledgedSnapshotStrings();
             TestTerminalDiagnosticLogIsSanitizedAndReportsPersistence();
+            TestTerminalDiagnosticLogIsBoundedAndRejectsReparseComponents();
             TestSimplifiedMenuAndExitConfirmation();
             TestNoHimcFailureIsSafe();
             TestShellRightClickNotificationMapping();
             TestRealNativePInvokeSurface();
             TestPostedWorkMessageDispatchesToItsOwnerWindow();
-            Console.WriteLine("TrayHost native self-tests passed: 16");
+            Console.WriteLine("TrayHost native self-tests passed: 17");
             return 0;
         }
         catch (Exception error)
diff --git a/tests/trayhost/TrayHostParentClientSelfTest.cs b/tests/trayhost/TrayHostParentClientSelfTest.cs
index ae81f18..f2e8589 100644
--- a/tests/trayhost/TrayHostParentClientSelfTest.cs
+++ b/tests/trayhost/TrayHostParentClientSelfTest.cs
@@ -5,9 +5,39 @@
 using System.Security.Cryptography;
 using System.Threading;
 
+internal sealed class ProductionTraceTrayPlatform : INativeTrayPlatform
+{
+    internal string Message;
+    public IntPtr CreateOwner() { return new IntPtr(10); }
+    public IntPtr AssociateOwnerInputContext(IntPtr owner, IntPtr context) { return new IntPtr(20); }
+    public IntPtr GetOwnerInputContext(IntPtr owner) { return IntPtr.Zero; }
+    public bool ReleaseInputContext(IntPtr owner, IntPtr context) { return true; }
+    public IntPtr LoadIcon() { return new IntPtr(40); }
+    public bool DestroyIcon(IntPtr icon) { return true; }
+    public bool AddIcon(ref TrayIconData icon) { return true; }
+    public bool SetIconVersion(ref TrayIconData icon) { return true; }
+    public bool DeleteIcon(ref TrayIconData icon) { return true; }
+    public IntPtr CreatePopupMenu() { return new IntPtr(30); }
+    public IntPtr CreateSubMenu() { return new IntPtr(31); }
+    public bool AppendMenu(IntPtr menu, uint flags, UIntPtr command, string text) { return true; }
+    public bool AppendSubMenu(IntPtr menu, IntPtr child, string text) { return true; }
+    public bool ShowOwner(IntPtr owner) { return true; }
+    public bool HideOwner(IntPtr owner) { return true; }
+    public bool SetForegroundWindow(IntPtr owner) { return true; }
+    public IntPtr GetForegroundWindow() { return new IntPtr(10); }
+    public uint TrackPopupMenuEx(IntPtr menu, uint flags, int x, int y, IntPtr owner, IntPtr parameters) { return 0U; }
+    public bool PostMessage(IntPtr owner, uint message, UIntPtr wParam, IntPtr lParam) { return true; }
+    public bool SetNotificationFocus(ref TrayIconData icon) { return true; }
+    public bool ShowMessageBox(IntPtr owner, string text, string caption) { Message = caption + "|" + text; return true; }
+    public bool ConfirmExit(IntPtr owner, string text, string caption) { return true; }
+    public bool DestroyMenu(IntPtr menu) { return true; }
+    public bool EndMenu() { return true; }
+    public bool DestroyOwner(IntPtr owner) { return true; }
+}
+
 internal static class TrayHostParentClientSelfTest
 {
-    private static string PeerArguments = "--peer";
+    internal static string PeerArguments = "--peer";
 
     private static void AssertTrue(bool value, string message) { if (!value) { throw new InvalidOperationException(message); } }
 
@@ -18,7 +48,7 @@ private static PresentationSnapshot Snapshot(ulong revision)
         return new PresentationSnapshot(revision, TrayColor.Green, ConnectionState.Connected, ProtectionState.Running, LanguageMode.Chinese, PresentationFlags.OpenLogsEnabled, strings);
     }
 
-    private static Process StartPeer(ProcessStartInfo requested)
+    internal static Process StartPeer(ProcessStartInfo requested)
     {
         requested.Arguments = PeerArguments;
         requested.UseShellExecute = false;
@@ -29,7 +59,7 @@ private static Process StartPeer(ProcessStartInfo requested)
         return Process.Start(requested);
     }
 
-    private static void RunPeer(bool emitFaultAndIgnoreShutdown, bool emitAction)
+    private static void RunPeer(bool emitFaultAndIgnoreShutdown, bool emitAction, bool staleAction)
     {
         Stream input = Console.OpenStandardInput();
         Stream output = Console.OpenStandardOutput();
@@ -50,16 +80,27 @@ private static void RunPeer(bool emitFaultAndIgnoreShutdown, bool emitAction)
         if (emitAction)
         {
             Guid actionId = Guid.Parse("aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee");
-            Guid transactionId = Guid.Parse("11111111-2222-3333-4444-555555555555");
-            ProtocolCodec.WriteAuthenticated(output, ProtocolFrame.Authenticated(ProtocolDirection.HostToParent, TrayHostMessageType.Action, epoch, outboundSequence++, TrayHostWire.WriteAction(new TrayHostAction(actionId, TrayCommand.CheckAndRepair, 1UL))), keys.HostToParent);
-            ProtocolFrame acceptedFrame = ProtocolCodec.ReadAuthenticated(input, ProtocolDirection.ParentToHost, epoch, inboundSequence++, keys.ParentToHost);
-            AssertTrue(acceptedFrame.MessageType == TrayHostMessageType.ActionResult, "peer receives one parent action result");
-            TrayActionResult accepted = TrayHostWire.ReadActionResult(acceptedFrame.Payload);
-            AssertTrue(accepted.ActionId == actionId && accepted.Revision == 1UL && accepted.Status == TrayActionResultStatus.Accepted && accepted.TransactionId.HasValue && accepted.TransactionId.Value == transactionId, "peer receives the correlated accepted result");
-            ProtocolFrame completedFrame = ProtocolCodec.ReadAuthenticated(input, ProtocolDirection.ParentToHost, epoch, inboundSequence++, keys.ParentToHost);
-            AssertTrue(completedFrame.MessageType == TrayHostMessageType.ActionResult, "peer receives one parent terminal result");
-            TrayActionResult completed = TrayHostWire.ReadActionResult(completedFrame.Payload);
-            AssertTrue(completed.ActionId == actionId && completed.Status == TrayActionResultStatus.Completed && completed.TransactionId.HasValue && completed.TransactionId.Value == transactionId, "peer receives the correlated completed result");
+            TrayHostAction action = new TrayHostAction(actionId, TrayCommand.OpenLogs, staleAction ? 8UL : 1UL);
+            HostTransport host = new HostTransport(null, delegate(TrayTerminalDiagnostic record) { return true; });
+            ProductionTraceTrayPlatform tracePlatform = new ProductionTraceTrayPlatform();
+            TrayWindow traceWindow = new TrayWindow(tracePlatform); traceWindow.Create(Snapshot(1UL));
+            AssertTrue(host.TryRegisterAction(action), "program peer registers the exact outbound action");
+            ProtocolCodec.WriteAuthenticated(output, ProtocolFrame.Authenticated(ProtocolDirection.HostToParent, TrayHostMessageType.Action, epoch, outboundSequence++, TrayHostWire.WriteAction(action)), keys.HostToParent);
+            ProtocolFrame terminalFrame = ProtocolCodec.ReadAuthenticated(input, ProtocolDirection.ParentToHost, epoch, inboundSequence++, keys.ParentToHost);
+            AssertTrue(terminalFrame.MessageType == TrayHostMessageType.ActionResult, "program peer receives one authenticated terminal result");
+            AssertTrue(Program.TryDispatchAuthenticatedActionResult(host, terminalFrame.Payload), "production Program dispatch accepts the correlated authenticated result");
+            TrayActionResult feedback;
+            if (staleAction)
+            {
+                AssertTrue(host.TryTakeFailedAction(out feedback) && feedback.Revision == 8UL && feedback.Status == TrayActionResultStatus.Rejected && String.Equals(feedback.ErrorCode, "CCOD_TRAY_ACTION_STALE", StringComparison.Ordinal), "stale authenticated result reaches the production generic-feedback queue with its exact code");
+                traceWindow.ShowActionFailed();
+                AssertTrue(String.Equals(tracePlatform.Message, "string-0|string-15", StringComparison.Ordinal), "stale production trace collapses internal details to the generic acknowledged-snapshot dialog");
+            }
+            else
+            {
+                AssertTrue(!host.TryTakeFailedAction(out feedback) && tracePlatform.Message == null, "completed current action produces no generic failure feedback");
+            }
+            traceWindow.Dispose(); host.Dispose();
             return;
         }
         if (emitFaultAndIgnoreShutdown)
@@ -86,7 +127,7 @@ private static void RunPeer(bool emitFaultAndIgnoreShutdown, bool emitAction)
         }
     }
 
-    private static TrayHostStartOptions Options()
+    internal static TrayHostStartOptions Options()
     {
         Process current = Process.GetCurrentProcess();
         return new TrayHostStartOptions {
@@ -172,16 +213,30 @@ private static void TestCorrelatedActionResults()
                 TrayHostEvent value;
                 while (client.TryDequeueEvent(out value)) { if (value.Kind == TrayHostEventKind.Action) { action = value; break; } }
             }
-            AssertTrue(action != null && action.Command == TrayCommand.CheckAndRepair && action.Revision == 1UL, "parent receives the exact v2 action event");
-            Guid transactionId = Guid.Parse("11111111-2222-3333-4444-555555555555");
-            AssertTrue(client.TryAcknowledgeAction(new TrayActionResult(action.ActionId, action.Revision, TrayActionResultStatus.Accepted, null, transactionId)), "parent queues the accepted action result");
+            AssertTrue(action != null && action.Command == TrayCommand.OpenLogs && action.Revision == 1UL, "parent receives the exact current v2 action event");
             bool completed = false; deadline = DateTime.UtcNow.AddSeconds(2);
             while (!completed && DateTime.UtcNow < deadline)
             {
-                completed = client.TryAcknowledgeAction(new TrayActionResult(action.ActionId, action.Revision, TrayActionResultStatus.Completed, null, transactionId));
+                completed = client.TryAcknowledgeAction(new TrayActionResult(action.ActionId, action.Revision, TrayActionResultStatus.Completed, null, null));
                 if (!completed) { Thread.Sleep(20); }
             }
-            AssertTrue(completed, "parent queues the terminal result after the accepted result drains");
+            AssertTrue(completed, "parent queues the current terminal result through the authenticated writer");
+        }
+        finally { if (client != null) { client.Dispose(); } PeerArguments = "--peer"; }
+
+        PeerArguments = "--stale-action-peer";
+        try
+        {
+            client = TrayHostParentClient.Start(Options());
+            TrayHostEvent action = null; DateTime deadline = DateTime.UtcNow.AddSeconds(2);
+            while (action == null && DateTime.UtcNow < deadline)
+            {
+                client.WaitForActivity(TimeSpan.FromMilliseconds(100));
+                TrayHostEvent value;
+                while (client.TryDequeueEvent(out value)) { if (value.Kind == TrayHostEventKind.Action) { action = value; break; } }
+            }
+            AssertTrue(action != null && action.Command == TrayCommand.OpenLogs && action.Revision == 8UL, "parent receives the exact stale v2 action event");
+            AssertTrue(client.TryAcknowledgeAction(new TrayActionResult(action.ActionId, action.Revision, TrayActionResultStatus.Rejected, "CCOD_TRAY_ACTION_STALE", null)), "parent queues the stale terminal result through the authenticated writer");
         }
         finally { if (client != null) { client.Dispose(); } PeerArguments = "--peer"; }
     }
@@ -190,9 +245,10 @@ public static int Main(string[] args)
     {
         try
         {
-            if (args.Length == 1 && args[0] == "--peer") { RunPeer(false, false); return 0; }
-            if (args.Length == 1 && args[0] == "--fault-peer") { RunPeer(true, false); return 0; }
-            if (args.Length == 1 && args[0] == "--action-peer") { RunPeer(false, true); return 0; }
+            if (args.Length == 1 && args[0] == "--peer") { RunPeer(false, false, false); return 0; }
+            if (args.Length == 1 && args[0] == "--fault-peer") { RunPeer(true, false, false); return 0; }
+            if (args.Length == 1 && args[0] == "--action-peer") { RunPeer(false, true, false); return 0; }
+            if (args.Length == 1 && args[0] == "--stale-action-peer") { RunPeer(false, true, true); return 0; }
             TrayHostParentClient.TestProcessFactory = StartPeer;
             TrayHostParentClient client = TrayHostParentClient.Start(Options());
             AssertTrue(client.Receipt.ProtocolMajor == 2 && client.GetHealth() == TrayHostHealth.Ready, "parent waits for verified v2 ready");
@@ -217,3 +273,28 @@ public static int Main(string[] args)
         }
     }
 }
+
+public static class TrayHostProductionTraceFixture
+{
+    public static TrayHostParentClient Start(string executablePath, bool stale)
+    {
+        if (String.IsNullOrEmpty(executablePath)) { throw new ArgumentException("trace executable is required", "executablePath"); }
+        Process current = Process.GetCurrentProcess();
+        TrayHostParentClient.TestProcessFactory = TrayHostParentClientSelfTest.StartPeer;
+        TrayHostParentClientSelfTest.PeerArguments = stale ? "--stale-action-peer" : "--action-peer";
+        return TrayHostParentClient.Start(new TrayHostStartOptions {
+            ExePath = executablePath,
+            RuntimeId = "trace-runtime",
+            ParentPid = current.Id,
+            ParentCreationFileTimeUtc = current.StartTime.ToFileTimeUtc(),
+            InitialPresentation = CreateSnapshot()
+        });
+    }
+
+    private static PresentationSnapshot CreateSnapshot()
+    {
+        string[] strings = new string[16];
+        for (int index = 0; index < strings.Length; index++) { strings[index] = "trace-" + index.ToString(); }
+        return new PresentationSnapshot(1UL, TrayColor.Green, ConnectionState.Connected, ProtectionState.Running, LanguageMode.English, PresentationFlags.OpenLogsEnabled, strings);
+    }
+}
diff --git a/tests/trayhost/TrayHostTransportSelfTest.cs b/tests/trayhost/TrayHostTransportSelfTest.cs
index 7a55cfa..d276a07 100644
--- a/tests/trayhost/TrayHostTransportSelfTest.cs
+++ b/tests/trayhost/TrayHostTransportSelfTest.cs
@@ -1,5 +1,7 @@
 using System;
 using System.Collections.Generic;
+using System.Diagnostics;
+using System.Threading;
 
 internal static class TrayHostTransportSelfTest
 {
@@ -198,6 +200,42 @@ private static void TestTerminalDiagnosticFailureNeverStrandsPendingActions()
         host.Dispose();
     }
 
+    private static void TestBlockingTerminalWriterRunsOutsideCorrelationLock()
+    {
+        ManualResetEvent writerEntered = new ManualResetEvent(false);
+        ManualResetEvent releaseWriter = new ManualResetEvent(false);
+        bool first = true;
+        HostTransport host = new HostTransport(null, delegate(TrayTerminalDiagnostic record)
+        {
+            if (first) { first = false; writerEntered.Set(); releaseWriter.WaitOne(TimeSpan.FromSeconds(3)); }
+            return true;
+        });
+        Guid blockedId = Guid.NewGuid();
+        AssertTrue(host.TryRegisterAction(new TrayHostAction(blockedId, TrayCommand.OpenLogs, 24UL)), "blocking-writer action registers");
+        bool acknowledged = false;
+        Thread acknowledgement = new Thread((ThreadStart)delegate { acknowledged = host.TryAcknowledgeAction(new TrayActionResult(blockedId, 24UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null)); });
+        acknowledgement.IsBackground = true;
+        acknowledgement.Start();
+        try
+        {
+            AssertTrue(writerEntered.WaitOne(TimeSpan.FromSeconds(2)), "terminal writer enters deterministically");
+            Guid concurrentId = Guid.NewGuid();
+            Stopwatch registration = Stopwatch.StartNew();
+            bool registered = host.TryRegisterAction(new TrayHostAction(concurrentId, TrayCommand.OpenLogs, 24UL));
+            registration.Stop();
+            AssertTrue(registered && registration.Elapsed < TimeSpan.FromMilliseconds(250), "blocking terminal I/O cannot hold the correlation lock or pending capacity");
+            releaseWriter.Set();
+            AssertTrue(acknowledgement.Join(TimeSpan.FromSeconds(2)) && acknowledged, "terminal acknowledgement completes after the writer is released");
+            AssertTrue(host.TryAcknowledgeAction(new TrayActionResult(concurrentId, 24UL, TrayActionResultStatus.Completed, null, null)), "concurrent action remains independently completable");
+        }
+        finally
+        {
+            releaseWriter.Set();
+            if (acknowledgement.IsAlive) { acknowledgement.Join(TimeSpan.FromSeconds(2)); }
+            writerEntered.Dispose(); releaseWriter.Dispose(); host.Dispose();
+        }
+    }
+
     public static int Main(string[] args)
     {
         try
@@ -211,7 +249,8 @@ public static int Main(string[] args)
             TestRejectedAndFailedActionsQueueUserFeedback();
             TestUndisplayedActionFailureFeedbackIsBounded();
             TestTerminalDiagnosticFailureNeverStrandsPendingActions();
-            Console.WriteLine("TrayHost transport self-tests passed: 9");
+            TestBlockingTerminalWriterRunsOutsideCorrelationLock();
+            Console.WriteLine("TrayHost transport self-tests passed: 10");
             return 0;
         }
         catch (Exception error)

From 4aad2a7f84e3d4cf3acb2608154e9f8c7a123ec9 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 06:05:44 +0800
Subject: [PATCH 024/187] docs: record Task 4 fix round 3

---
 .../task-4-report.md                          | 180 ++++++++++++++++++
 1 file changed, 180 insertions(+)

diff --git a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-4-report.md b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-4-report.md
index 9c7613a..f7a2224 100644
--- a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-4-report.md
+++ b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-4-report.md
@@ -446,3 +446,183 @@ the new diagnostic type, and runs only the existing no-UI headless path.
   path; the production path was compiled but not exercised against user data.
 - No independent agent was used because this fix round explicitly prohibited
   agents. Parent re-review remains the next gate.
+
+## Fix round 3: bounded reparse-safe receipts and production correlation trace
+
+Independent re-review retained three Important findings: the host action log
+was unbounded, its fixed LocalAppData path lacked reparse-component checks,
+diagnostic I/O ran while holding HostTransport's correlation lock, and the
+in-process bridge did not prove the real TrayHostClient/ParentClient/Wire/Program
+authenticated path.
+
+Fix implementation commit: `9c1e4df`
+(`fix: harden tray terminal diagnostics`).
+
+### RED evidence
+
+Tests were added before each production change.
+
+The blocking-writer transport test deliberately held the diagnostic writer for
+up to three seconds, then attempted to register another action. Current code
+failed because writer I/O still held `_gate`:
+
+```text
+TrayHost transport self-test failed: System.InvalidOperationException
+blocking terminal I/O cannot hold the correlation lock or pending capacity
+```
+
+The bounded-retention native test failed at compile time before the fixed log
+contract existed:
+
+```text
+CS0117: TrayTerminalDiagnosticLog does not contain a definition for MaximumBytes
+CCOD_TRAYHOST_NATIVE_COMPILE_FAILED
+```
+
+After adding the first lock/retention implementation, a missing-writer assertion
+was retained from fix round 2 and remained green: no writer cannot authorize
+generic feedback but still releases the terminal pending action.
+
+The production authenticated trace test referenced Program's actual result
+dispatch before it was extracted. ParentClient-only compilation failed:
+
+```text
+CS0117: Program does not contain a definition for TryDispatchAuthenticatedActionResult
+CCOD_TRAYHOST_NATIVE_COMPILE_FAILED
+```
+
+This proved the old peer was not traversing Program's production result branch.
+
+### Bounded deterministic retention
+
+`TrayTerminalDiagnosticLog.MaximumBytes` is fixed at 64 KiB. Each record is
+encoded as UTF-8 without a BOM. Under the logger's private file gate, the writer
+selects one of two deterministic modes:
+
+- append when existing bytes plus the complete new record remain within 64 KiB;
+- recreate the file with only the complete newest record when the next append
+  would exceed 64 KiB or an already oversized file is encountered.
+
+The stream is closed after `Flush(true)`. The test writes 1,400 distinct
+records, proves the file never exceeds `MaximumBytes`, and proves the complete
+latest record remains at the end after rollover. This prevents long-running
+tray action volume from growing the file without bound.
+
+### Fixed-path and reparse defense
+
+Production no longer calls an unconditional `Directory.CreateDirectory` over
+the full path. `TryGetDefaultPath` starts from the system-provided current-user
+LocalApplicationData root and creates only the fixed
+`CodexControlOtherDevices` and `logs` child directories, one level at a time.
+Before each creation it verifies the existing parent chain, and after creation
+it verifies the new directory.
+
+`TryAppend` accepts only an absolute path whose leaf is exactly
+`trayhost-actions.log`. It rejects a directory leaf, a reparse-point file, any
+missing directory, or any existing directory component with the
+`FileAttributes.ReparsePoint` bit. Production supplies only the fixed path; no
+wire field, CLI value, action property, or user payload can select a path.
+
+The native test creates a real junction inside an isolated temporary root and
+proves a fixed-name log beneath that junction is rejected. All temporary files
+and the junction are removed by the test.
+
+### Diagnostic I/O outside the correlation lock
+
+HostTransport now validates the exact action id/revision and lifecycle state,
+constructs the typed diagnostic, and removes the terminal action from
+`_pendingActions` while holding `_gate`. It then releases `_gate` before calling
+the writer. After the writer returns, it reacquires `_gate` only to enqueue the
+About/generic feedback item when persistence succeeded and the transport is
+still active.
+
+The blocking-writer regression starts terminal acknowledgement on a background
+thread, waits until the writer is blocked, then registers a distinct action.
+Registration completes within 250 ms, proving neither correlation lock nor
+pending capacity is held by file I/O. After releasing the writer, both the first
+terminal acknowledgement and the concurrently registered action complete.
+
+False, throwing, absent, blocked, and full-feedback-queue outcomes continue to
+release pending capacity. Only persisted records authorize UI feedback.
+
+### Production authenticated correlation trace
+
+`Program.TryDispatchAuthenticatedActionResult` is the exact production reader
+operation extracted from the existing ActionResult branch:
+
+```text
+TrayHostWire.ReadActionResult(payload)
+  -> HostTransport.TryAcknowledgeAction(result)
+```
+
+The production reader itself now calls this internal function. No new CLI mode,
+frame type, wire field, external endpoint, or unauthenticated channel was added.
+
+The ParentClient self-test compiles Program and the real native/transport/wire
+sources into its isolated test executable. Its existing test-only peer process
+performs the real parent/host bootstrap, key derivation, MAC verification,
+sequence checks, and Action/ActionResult serialization. The peer registers the
+same action in real HostTransport and sends it over `TrayHostWire`; the result
+returns over the real authenticated `TrayHostParentClient` writer and is
+consumed by Program's production dispatch.
+
+`TrayHostProductionTrace.SelfTest.ps1` then loads that same compiled assembly
+and uses the real production PowerShell wrapper:
+
+```text
+TrayHostClient.Receive-CcodTrayHostEvents
+  -> TrayHostParentClient authenticated event
+  -> current or stale terminal decision fixture
+  -> TrayHostClient.Send-CcodTrayHostActionResult
+  -> TrayHostParentClient authenticated writer
+  -> TrayHostWire ActionResult
+  -> Program production dispatch
+  -> HostTransport diagnostic and feedback gate
+```
+
+The current case preserves `OpenLogs` revision 1, receives `Completed`, and
+produces no generic failure feedback. The stale case preserves `OpenLogs`
+revision 8 and `CCOD_TRAY_ACTION_STALE`; after the persisted typed receipt, the
+real feedback queue is consumed and `TrayWindow.ShowActionFailed` runs against a
+fake native platform. It proves the dialog contains only the acknowledged
+snapshot's generic `string-0|string-15` title/message, not the internal code.
+The fake platform creates no real window or interactive UI.
+
+Test-only peer arguments remain implemented only by the self-test main type;
+they are not recognized by production Program and therefore create no product
+control surface.
+
+### Fresh verification
+
+Fresh verification completed with these results:
+
+```text
+TrayHost client: exit 0; 8 behavioral cases
+Supervisor: exit 0; 98 behavioral cases
+TrayHost transport: exit 0; 10 behavioral cases
+TrayHost native: exit 0; 17 behavioral cases
+TrayHost parent-client: exit 0; 4 behavioral cases
+TrayHost production correlation trace: exit 0; 2 current/stale cases
+TrayHost production compile/headless smoke: exit 0
+git diff --check: exit 0
+git diff --cached --check: exit 0
+```
+
+The first combined verification command exceeded its 30-second tool window
+after the ParentClient cases and before the trace receipt was printed. It was
+not counted as evidence for the remaining stages. ParentClient+production trace
+and ProductionOnly smoke were rerun independently and both returned explicit
+exit `0` receipts.
+
+### Fix-round scope and concerns
+
+- Changed only TrayHost terminal logging/correlation production files, focused
+  tests/trace orchestration, and this report.
+- No real Codex/ChatGPT or production interactive TrayHost process was started,
+  stopped, signaled, or controlled. Native behavior used fake platforms; the
+  subprocess trace used only the compiled self-test peer.
+- Nothing was installed, pushed, published, released, signed, or written to
+  WindowsApps/DPAPI. Reparse and rollover writes were confined to unique temp
+  roots.
+- No independent agent was used because the fix-round instruction prohibited
+  agents. Parent re-review remains the next gate.

From a7292f6b952a290a23ac852ea6ae56600293f214 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 08:25:59 +0800
Subject: [PATCH 025/187] docs: plan async tray receipt reliability

---
 .../2026-08-28-v2522-async-tray-receipts.md   | 235 ++++++++++++++++++
 ...08-28-v2522-install-runtime-reliability.md |   7 +
 ...-08-28-v2522-async-tray-receipts-design.md | 124 +++++++++
 3 files changed, 366 insertions(+)
 create mode 100644 docs/superpowers/plans/2026-08-28-v2522-async-tray-receipts.md
 create mode 100644 docs/superpowers/specs/2026-08-28-v2522-async-tray-receipts-design.md

diff --git a/docs/superpowers/plans/2026-08-28-v2522-async-tray-receipts.md b/docs/superpowers/plans/2026-08-28-v2522-async-tray-receipts.md
new file mode 100644
index 0000000..6d2b628
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-28-v2522-async-tray-receipts.md
@@ -0,0 +1,235 @@
+# v2.5.22 Async Tray Receipt Reliability Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Make terminal tray receipts non-blocking, bounded, handle-verified,
+and genuinely traceable through the authenticated production child flow.
+
+**Architecture:** Terminal action correlation remains in `HostTransport`, but
+receipt persistence moves to one bounded background sink.  A native pinned
+handle store writes the fixed local receipt without pathname re-resolution.
+An internal child-session seam lets a temporary trace executable exercise the
+same authenticated child behavior with a fake native platform.
+
+**Tech Stack:** Windows PowerShell 5.1, C#/.NET Framework 4.8, Win32 file
+handles, existing TrayHost authenticated protocol and self-tests.
+
+**Spec:** `docs/superpowers/specs/2026-08-28-v2522-async-tray-receipts-design.md`
+
+## Global Constraints
+
+- Preserve the existing wire message types, directions, payloads, sequences,
+  MAC checks, command IDs, and current-user boundaries exactly.
+- Receipt disk text contains only command, revision, terminal status, and a
+  canonical code; never persist action IDs, transaction IDs, paths, tokens,
+  exception text, or arbitrary payload text.
+- No production command-line test mode, listener, environment-variable switch,
+  or external control surface may be added.
+- All terminal actions leave the pending set before any receipt I/O or queue
+  wait; no writer hang may create a replacement writer thread.
+- Generic UI feedback is produced only after durable receipt success; its queue
+  is bounded and runs on the existing STA work path.
+- Keep primary checkout untouched; work only in this linked worktree.
+
+---
+
+### Task 1: Add a pinned, bounded receipt store
+
+**Files:**
+- Modify: `src/trayhost/TrayTerminalDiagnostic.cs`
+- Modify: `src/trayhost/Program.cs`
+- Test: `tests/trayhost/TrayHostNativeSelfTest.cs`
+- Test: `tests/trayhost/Invoke-TrayHostSelfTest.ps1`
+
+**Interfaces:**
+- `TrayTerminalDiagnosticStore` owns validated native directory/leaf handles.
+- `TryAppendDurably(TrayTerminalDiagnostic)` returns `true` only after a full
+  write and `Flush(true)` through the validated leaf handle.
+- `TryGetDefaultPath` remains fixed to the current-user receipt leaf; no caller
+  can choose another production path.
+
+- [ ] **Step 1: Write failing native-store tests**
+
+Add a temporary-root test that precreates a reparse directory, reparse leaf,
+hard-link leaf, and an outside sentinel.  Add a barrier that attempts to
+replace the logs directory after the store has opened its directory chain.
+Assert each unsafe case returns `false` and the sentinel bytes remain unchanged.
+Add 64-KiB boundary and rollover tests that verify one whole latest record is
+retained through the open handle.
+
+- [ ] **Step 2: Run RED**
+
+Run: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -NativeOnly`
+
+Expected: compile or behavioral failure because the current path-based store
+does not own native handles or the barrier contract.
+
+- [ ] **Step 3: Implement the minimal handle-pinned store**
+
+Open directory components and the fixed leaf through `CreateFileW` safe
+handles.  Reject reparse, non-directory, non-file, multi-link, unexpected
+final-path, share, and handle-query failures before writes.  Keep handles while
+using `SetLength`, write, and `Flush(true)` for the 64-KiB rollover.  Do not
+re-resolve the leaf path for append or truncation.
+
+- [ ] **Step 4: Run GREEN**
+
+Run the native suite and production headless compile smoke.  Assert the store
+write is bounded, handle-validated, and cannot alter an outside sentinel.
+
+- [ ] **Step 5: Commit**
+
+```text
+fix: pin tray terminal receipt storage
+```
+
+### Task 2: Make terminal receipt dispatch asynchronous and bounded
+
+**Files:**
+- Create: `src/trayhost/TrayTerminalReceiptSink.cs`
+- Modify: `src/trayhost/HostTransport.cs`
+- Modify: `src/trayhost/Program.cs`
+- Test: `tests/trayhost/TrayHostTransportSelfTest.cs`
+- Test: `tests/trayhost/TrayHostNativeSelfTest.cs`
+
+**Interfaces:**
+- `HostTransport.TryAcknowledgeAction` returns a typed terminal receipt for a
+  terminal result after removing its pending entry.
+- `TrayTerminalReceiptSink.TrySubmit` is zero-wait and admits at most eight
+  outstanding receipts.
+- `HostTransport.TryPublishDurableReceipt` accepts only a trusted in-memory
+  receipt and places one bounded UI item.
+
+- [ ] **Step 1: Write failing sink/transport tests**
+
+Use a controllable fake store that blocks before open, during write, and during
+flush.  Assert current and following authenticated terminal results return
+within 250 ms, the ninth outstanding receipt is dropped immediately, no pending
+entry remains, and no generic UI work exists until an explicit durable-success
+callback.  Add disposal and recovery tests without starting a replacement
+writer.
+
+- [ ] **Step 2: Run RED**
+
+Run: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -TransportOnly`
+
+Expected: the current synchronous writer blocks the terminal call and the new
+receipt-sink API is unavailable.
+
+- [ ] **Step 3: Implement one worker and bounded UI completion**
+
+Separate correlation from receipt work.  The reader submits once and returns;
+only the single background writer calls the store.  On durable success it posts
+bounded About/failure work to the existing application context.  On admission,
+store, callback, queue, or disposal failure, consume the terminal result but
+show no feedback.  Do not alter the wire result or add a new message type.
+
+- [ ] **Step 4: Run GREEN**
+
+Run transport and native suites.  Confirm a hung writer cannot stall the reader
+or action capacity, and a later durable receipt still produces exactly one
+generic feedback item.
+
+- [ ] **Step 5: Commit**
+
+```text
+fix: isolate tray terminal receipt writes
+```
+
+### Task 3: Trace the actual child session without a shipped test hook
+
+**Files:**
+- Create: `src/trayhost/TrayHostChildSession.cs`
+- Create: `src/trayhost/WindowsTrayHostRuntime.cs`
+- Modify: `src/trayhost/Program.cs`
+- Modify: `src/trayhost/TrayHostApplication.cs`
+- Create: `tests/trayhost/TrayHostProductionTraceSelfTest.cs`
+- Modify: `tests/trayhost/Invoke-TrayHostSelfTest.ps1`
+- Modify: `tests/persistence/TrayHostProductionTrace.SelfTest.ps1`
+- Test: `tests/trayhost/TrayHostParentClientSelfTest.cs`
+- Test: `tests/persistence/TrayHostClient.SelfTest.ps1`
+
+**Interfaces:**
+- `TrayHostChildSession.Run` accepts only internal stream/runtime/sink
+  dependencies; `Program.Main` exposes no new arguments.
+- `WindowsTrayHostRuntime` composes the existing Windows platform, window, and
+  application; the temporary trace executable supplies a fake implementation.
+
+- [ ] **Step 1: Write failing real-trace tests**
+
+Compile a temporary trace executable with the same child session and a fake
+native platform.  Start it through normal `TrayHostParentClient.Start` (without
+`TestProcessFactory`).  Require a current native `OpenLogs` selection to reach
+the PowerShell TrayHostClient/Supervisor fixture and a stale authenticated
+negative action to show only the generic dialog after durable receipt success.
+
+- [ ] **Step 2: Run RED**
+
+Run: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/TrayHostProductionTrace.SelfTest.ps1`
+
+Expected: it fails because `Program.RunChild` cannot be composed with a
+test-only runtime while preserving the production child session.
+
+- [ ] **Step 3: Extract the minimal internal session seam**
+
+Move the current child bootstrap, reader/writer sequencing, work drain, and
+shutdown behavior into `TrayHostChildSession`.  `Program.RunChild` becomes a
+thin argument/identity/Windows-runtime adapter.  The trace executable shares
+the child session and real protocol code but has no production CLI selector.
+
+- [ ] **Step 4: Run GREEN**
+
+Run ParentClient, TrayHostClient, production trace, native, transport, and
+headless-smoke suites.  Confirm current completion has no generic dialog;
+stale rejection has one generic dialog with no internal code or correlation
+data; no production executable recognizes test arguments.
+
+- [ ] **Step 5: Commit**
+
+```text
+test: trace authenticated tray terminal receipts
+```
+
+### Task 4: Revalidate v2.5.22 release inputs
+
+**Files:**
+- Modify: `tests/persistence/ReleaseWorkflow.SelfTest.ps1`
+- Test: `tests/PersistenceSelfTest.ps1`
+- Test: `tests/Validate.ps1`
+
+- [ ] **Step 1: Write a failing release-surface test**
+
+Require the TrayHost provenance record to include every newly compiled source
+and require the release workflow to run the production trace before producing
+setup or portable assets.
+
+- [ ] **Step 2: Run RED**
+
+Run: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/ReleaseWorkflow.SelfTest.ps1`
+
+Expected: it fails until the release validation includes the receipt trace.
+
+- [ ] **Step 3: Add the smallest release gate**
+
+Invoke the production trace in the existing TrayHost/release validation path;
+preserve existing manifest, Defender, payload, and exact-version checks.
+
+- [ ] **Step 4: Run GREEN and commit**
+
+Run release workflow plus the persistence/validation suites under the existing
+controlled isolation harness.  Commit:
+
+```text
+test: gate release on tray receipt trace
+```
+
+## Plan self-review
+
+- Task 1 handles filesystem identity and bounded storage without changing
+  authenticated action semantics.
+- Task 2 consumes terminal actions before zero-wait sink admission and never
+  lets a writer block the reader or pending-action capacity.
+- Task 3 proves the shared production child session end-to-end in a temporary
+  executable, so tests cannot create a production test control path.
+- Task 4 makes the new trace a release gate before the existing v2.5.22
+  metadata/build/reinstall acceptance task begins.
diff --git a/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md b/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md
index 39f2442..246a845 100644
--- a/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md
+++ b/docs/superpowers/plans/2026-08-28-v2522-install-runtime-reliability.md
@@ -228,6 +228,13 @@ fix: stabilize verified Electron process trees
 
 ### Task 4: Make tray action correlation testable and diagnosable
 
+> **Superseded for execution:** Task 4 reached an approved architectural
+> correction after three reviewed fix rounds.  Execute
+> `docs/superpowers/plans/2026-08-28-v2522-async-tray-receipts.md` before this
+> plan's Task 5.  Its receipt sink preserves this task's authenticated
+> correlation and generic-dialog constraints while making persistence bounded
+> and non-blocking.
+
 **Files:**
 - Modify: `src/persistence/modules/TrayHostClient.psm1`
 - Modify: `src/persistence/Supervisor.ps1`
diff --git a/docs/superpowers/specs/2026-08-28-v2522-async-tray-receipts-design.md b/docs/superpowers/specs/2026-08-28-v2522-async-tray-receipts-design.md
new file mode 100644
index 0000000..8cbc4f8
--- /dev/null
+++ b/docs/superpowers/specs/2026-08-28-v2522-async-tray-receipts-design.md
@@ -0,0 +1,124 @@
+# v2.5.22 Async Tray Receipt Reliability Design
+
+## Goal
+
+Replace the synchronous TrayHost terminal-diagnostic write with a bounded,
+asynchronous receipt pipeline.  A slow, failed, or unsafe receipt write must
+never block authenticated result consumption, exhaust pending tray actions, or
+show a generic dialog without a durable local receipt.
+
+## Why this is a separate design
+
+The prior task established action correlation, exact acknowledgement gates, and
+sanitized terminal fields.  Three repair rounds showed that a synchronous file
+append on the authenticated reader path cannot meet the full contract: a
+path-only reparse check has a time-of-check/time-of-use gap, `Flush(true)` can
+block the only reader, and an in-process test bridge does not prove the real
+authenticated child session.  The user approved this architectural correction
+on 2026-08-28.
+
+## Non-negotiable constraints
+
+- Keep the existing authenticated TrayHost wire schema, directions, message
+  types, action-result fields, sequence rules, and capability policy unchanged.
+- Do not add a production test command, listener, environment switch, external
+  control path, or unauthenticated input channel.
+- A terminal action is consumed exactly once.  It never returns to the pending
+  set after receipt admission, failure, queue saturation, writer hang, or
+  shutdown.
+- Generic failure feedback and About display require a successfully flushed,
+  sanitized receipt.  A failed, full, busy, closed, or hung receipt path drops
+  only the feedback; it never invents a result or blocks later actions.
+- Receipt disk content contains exactly `command`, `revision`, `status`, and a
+  canonical `CCOD_*` code.  It excludes action IDs, transaction IDs, paths,
+  tokens, exceptions, messages, and raw wire data.
+- Preserve current-user operation.  Do not modify Codex binaries, WindowsApps,
+  account data, or the DPAPI device-key store.
+
+## Architecture
+
+### 1. Terminal correlation and zero-wait admission
+
+`HostTransport` continues to authenticate and validate a terminal result
+against its pending action ID, revision, accepted-before-completed rule, and
+command policy.  Under its correlation lock it constructs a typed
+`TrayTerminalReceipt`, removes the pending action, and returns the receipt to
+the child session.  It performs no file I/O and no wait for queue capacity.
+
+`TrayTerminalReceiptSink.TrySubmit` accepts at most eight outstanding receipts,
+including one currently writing.  It returns immediately with an admission
+result.  Busy, full, or closed admission suppresses feedback but leaves the
+action consumed.  The sink has one background writer only; it never creates a
+replacement thread for a stuck write.
+
+After a durable write, the sink calls back into `HostTransport` with the
+in-memory receipt.  The transport enqueues a single bounded UI work item:
+completed About maps to About; rejected/failed maps to the existing generic
+failure dialog; all other completed commands map to no UI.  The callback posts
+work to the STA application context outside transport locks.  The UI queue is
+also bounded at eight shared items.
+
+### 2. Pinned, bounded native receipt store
+
+The store uses the fixed path
+`%LOCALAPPDATA%\CodexControlOtherDevices\logs\trayhost-actions.log`.  It opens
+the LocalAppData, product, and logs directories as native directory handles,
+with reparse-point opening flags and delete sharing denied, validates each
+opened handle as the expected non-reparse directory, and holds the directory
+chain while it opens the fixed leaf.  The leaf is opened through a native handle
+before any write; its handle must prove a regular, non-reparse, single-link file
+at the expected final path.  Writes and rollover occur only through that
+validated handle, never through a re-resolved pathname.
+
+The file is UTF-8 without a BOM and has a hard 64 KiB limit.  If adding a whole
+record would cross the limit, the validated handle is truncated and receives
+only the new complete record.  A receipt is durable only after the write and
+`Flush(true)` both succeed.  Handle or validation failure fails closed for UI
+feedback.
+
+### 3. Child-session seam and trace executable
+
+Move the existing `Program.RunChild` session behavior behind an internal child
+session/runtime seam.  `Program.Main` retains only its existing `--child` and
+`--headless-smoke` inputs and creates the Windows runtime adapter.  A temporary
+self-test executable uses the same child session and authenticated startup but
+substitutes only a fake native tray platform.  It is compiled in the existing
+temporary test directory and is never shipped or selectable by the production
+binary.
+
+The production trace uses the real PowerShell TrayHostClient exports,
+TrayHostParentClient, authenticated wire, child session, HostTransport, receipt
+sink, and generic-dialog invocation.  It covers both a current native
+`OpenLogs` selection and an explicitly authenticated stale-revision negative
+fixture.  The latter is required because an ordinary native click always uses
+the current displayed revision.
+
+## Failure policy
+
+| Condition | Pending action | Receipt/UI |
+| --- | --- | --- |
+| Sink busy, full, or closed | Consumed | Drop receipt and UI feedback |
+| Unsafe path, reparse, hard link, sharing failure | Consumed | Store fails; no UI feedback |
+| Write or flush failure | Consumed | Store fails; no UI feedback |
+| Writer hangs | Consumed | One writer remains blocked; bounded later receipts drop; no UI feedback |
+| Durable success, UI queue full | Consumed | Keep durable receipt; drop only UI item |
+| Disposal | Consumed | Stop admission and callbacks; bounded join only |
+
+## Acceptance criteria
+
+1. A terminal result removes its pending action before sink admission; eight or
+   more failed admissions cannot stop later actions from registering.
+2. A blocked store leaves the authenticated reader responsive to a subsequent
+   presentation or ping and cannot hold the transport correlation lock.
+3. The store rejects reparse directory components, a reparse leaf, a hard-link
+   leaf, a second writer, and a concurrent replacement attempt before any
+   outside target is written.
+4. Receipt storage never exceeds 64 KiB and retains one complete latest record
+   after rollover through the validated handle.
+5. Generic feedback or About work is queued only after durable success; false,
+   throw, full, blocked, or failed paths queue none.
+6. The production trace exercises current and stale paths through TrayHostClient
+   to ParentClient, authenticated wire, child session, HostTransport, receipt
+   sink, and generic dialog, without a production-only test selector.
+7. Existing installer/new-user/upgrade, process identity, package, native
+   TrayHost, and Defender checks remain green before release acceptance.

From 365fde2430723fc8f80106e86490f7fb70be163f Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 08:54:02 +0800
Subject: [PATCH 026/187] fix: pin tray terminal receipt storage

---
 src/trayhost/Program.cs                    |   7 +-
 src/trayhost/TrayTerminalDiagnostic.cs     | 353 ++++++++++++++++++---
 tests/trayhost/Invoke-TrayHostSelfTest.ps1 |   1 +
 tests/trayhost/TrayHostNativeSelfTest.cs   | 252 +++++++++++++--
 4 files changed, 543 insertions(+), 70 deletions(-)

diff --git a/src/trayhost/Program.cs b/src/trayhost/Program.cs
index f438004..895c118 100644
--- a/src/trayhost/Program.cs
+++ b/src/trayhost/Program.cs
@@ -39,9 +39,8 @@ private static int RunChild(string[] args)
         PresentationSnapshot initial = TrayHostWire.ReadPresentation(initialFrame.Payload);
         Win32TrayPlatform platform = new Win32TrayPlatform();
         TrayHostApplication application = null;
-        string terminalLogPath;
-        if (!TrayTerminalDiagnosticLog.TryGetDefaultPath(out terminalLogPath)) { terminalLogPath = null; }
-        HostTransport transport = new HostTransport(delegate { TrayHostApplication current = application; if (current != null) { current.PostWork(); } }, delegate(TrayTerminalDiagnostic record) { return TrayTerminalDiagnosticLog.TryAppend(terminalLogPath, record); });
+        TrayTerminalDiagnosticStore terminalStore = new TrayTerminalDiagnosticStore();
+        HostTransport transport = new HostTransport(delegate { TrayHostApplication current = application; if (current != null) { current.PostWork(); } }, delegate(TrayTerminalDiagnostic record) { return terminalStore.TryAppendDurably(record); });
         TrayWindow window = new TrayWindow(platform, transport.SetMenuOpen);
         bool shutdownRequested = false; bool shutdownSent = false; object stateGate = new object();
         Action<TrayCommand, ulong> command = delegate(TrayCommand selected, ulong revision)
@@ -100,7 +99,7 @@ private static int RunChild(string[] args)
         })) { IsBackground = true, Name = "CodexRemote.TrayHost.Reader" };
         reader.Start();
         int result = application.Run();
-        application.Dispose(); transport.Dispose(); return result;
+        application.Dispose(); transport.Dispose(); terminalStore.Dispose(); return result;
     }
 
     private static bool VerifyParentIdentity(int pid, long creation)
diff --git a/src/trayhost/TrayTerminalDiagnostic.cs b/src/trayhost/TrayTerminalDiagnostic.cs
index c3f160e..43497af 100644
--- a/src/trayhost/TrayTerminalDiagnostic.cs
+++ b/src/trayhost/TrayTerminalDiagnostic.cs
@@ -1,6 +1,11 @@
 using System;
+using System.Collections.Generic;
 using System.IO;
+using System.Runtime.InteropServices;
+using System.Security.AccessControl;
+using System.Security.Principal;
 using System.Text;
+using Microsoft.Win32.SafeHandles;
 
 internal sealed class TrayTerminalDiagnostic
 {
@@ -18,78 +23,350 @@ internal TrayTerminalDiagnostic(TrayCommand command, ulong revision, TrayActionR
     }
 }
 
-internal static class TrayTerminalDiagnosticLog
+internal sealed class TrayTerminalDiagnosticStore : IDisposable
 {
+    private sealed class ReceiptPaths
+    {
+        internal string LocalRoot;
+        internal string Product;
+        internal string Logs;
+        internal string Leaf;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct NativeFileTime
+    {
+        internal uint Low;
+        internal uint High;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct ByHandleFileInformation
+    {
+        internal uint FileAttributes;
+        internal NativeFileTime CreationTime;
+        internal NativeFileTime LastAccessTime;
+        internal NativeFileTime LastWriteTime;
+        internal uint VolumeSerialNumber;
+        internal uint FileSizeHigh;
+        internal uint FileSizeLow;
+        internal uint NumberOfLinks;
+        internal uint FileIndexHigh;
+        internal uint FileIndexLow;
+    }
+
     internal const long MaximumBytes = 64L * 1024L;
-    private static readonly object Gate = new object();
+    private const uint GenericRead = 0x80000000U;
+    private const uint GenericWrite = 0x40000000U;
+    private const uint ReadControl = 0x00020000U;
+    private const uint FileListDirectory = 0x00000001U;
+    private const uint FileReadAttributes = 0x00000080U;
+    private const uint FileShareRead = 0x00000001U;
+    private const uint FileShareWrite = 0x00000002U;
+    private const uint OpenExisting = 3U;
+    private const uint OpenAlways = 4U;
+    private const uint FileAttributeDirectory = 0x00000010U;
+    private const uint FileAttributeDevice = 0x00000040U;
+    private const uint FileAttributeReparsePoint = 0x00000400U;
+    private const uint FileFlagWriteThrough = 0x80000000U;
+    private const uint FileFlagBackupSemantics = 0x02000000U;
+    private const uint FileFlagOpenReparsePoint = 0x00200000U;
+    private const uint FileTypeDisk = 1U;
+    private const uint SecurityInformationOwner = 0x00000001U;
+    private const uint SecurityInformationDacl = 0x00000004U;
+    private const uint SeFileObject = 1U;
+    private const int FullControlAccessMask = 0x001F01FF;
+    private readonly object _gate = new object();
+    private bool _disposed;
+
+    internal TrayTerminalDiagnosticStore()
+    {
+    }
+
+#if TRAYHOST_SELF_TEST
+    private readonly string _testLocalRoot;
+    private readonly Action _testDirectoryChainOpened;
+    private readonly Action _testLeafValidated;
+
+    private TrayTerminalDiagnosticStore(string testLocalRoot, Action directoryChainOpened, Action leafValidated)
+    {
+        _testLocalRoot = testLocalRoot;
+        _testDirectoryChainOpened = directoryChainOpened;
+        _testLeafValidated = leafValidated;
+    }
+
+    internal static TrayTerminalDiagnosticStore CreateForTesting(string localRoot, Action directoryChainOpened, Action leafValidated)
+    {
+        return new TrayTerminalDiagnosticStore(localRoot, directoryChainOpened, leafValidated);
+    }
+#endif
 
     internal static bool TryGetDefaultPath(out string path)
     {
         path = null;
         try
         {
-            string local = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData);
-            if (String.IsNullOrEmpty(local) || !Path.IsPathRooted(local) || !IsSafeExistingDirectory(local)) { return false; }
-            string product = Path.Combine(local, "CodexControlOtherDevices");
-            if (!TryCreateSafeChildDirectory(product)) { return false; }
-            string logs = Path.Combine(product, "logs");
-            if (!TryCreateSafeChildDirectory(logs)) { return false; }
-            path = Path.Combine(logs, "trayhost-actions.log");
-            return IsSafePath(path);
+            ReceiptPaths paths;
+            if (!TryBuildPaths(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), out paths)) { return false; }
+            path = paths.Leaf;
+            return true;
         }
         catch { path = null; return false; }
     }
 
-    internal static bool TryAppend(string path, TrayTerminalDiagnostic record)
+    internal bool TryAppendDurably(TrayTerminalDiagnostic record)
     {
-        if (String.IsNullOrEmpty(path) || record == null || !Path.IsPathRooted(path)) { return false; }
+        if (record == null) { return false; }
+        byte[] bytes;
         try
         {
             string line = "command=" + record.Command.ToString() + " revision=" + record.Revision.ToString(System.Globalization.CultureInfo.InvariantCulture) + " status=" + record.Status.ToString() + " code=" + record.Code + Environment.NewLine;
-            byte[] bytes = new UTF8Encoding(false).GetBytes(line);
+            bytes = new UTF8Encoding(false).GetBytes(line);
             if (bytes.LongLength > MaximumBytes) { return false; }
-            string full = Path.GetFullPath(path);
-            lock (Gate)
+        }
+        catch { return false; }
+
+        lock (_gate)
+        {
+            if (_disposed) { return false; }
+            try
             {
-                if (!IsSafePath(full)) { return false; }
-                FileMode mode = File.Exists(full) && new FileInfo(full).Length + bytes.LongLength <= MaximumBytes ? FileMode.Append : FileMode.Create;
-                using (FileStream stream = new FileStream(full, mode, FileAccess.Write, FileShare.Read))
+                ReceiptPaths paths;
+                if (!TryGetPaths(out paths)) { return false; }
+                return TryAppendThroughValidatedHandles(paths, bytes);
+            }
+            catch { return false; }
+        }
+    }
+
+    public void Dispose()
+    {
+        lock (_gate) { _disposed = true; }
+    }
+
+    private bool TryGetPaths(out ReceiptPaths paths)
+    {
+#if TRAYHOST_SELF_TEST
+        if (_testLocalRoot != null) { return TryBuildPaths(_testLocalRoot, out paths); }
+#endif
+        return TryBuildPaths(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), out paths);
+    }
+
+    private bool TryAppendThroughValidatedHandles(ReceiptPaths paths, byte[] bytes)
+    {
+        using (SafeFileHandle local = OpenDirectory(paths.LocalRoot))
+        {
+            if (!IsExpectedDirectory(local, paths.LocalRoot, false)) { return false; }
+            if (!TryCreateChildDirectory(paths.Product)) { return false; }
+            using (SafeFileHandle product = OpenDirectory(paths.Product))
+            {
+                if (!IsExpectedDirectory(product, paths.Product, true)) { return false; }
+                if (!TryCreateChildDirectory(paths.Logs)) { return false; }
+                using (SafeFileHandle logs = OpenDirectory(paths.Logs))
                 {
-                    stream.Write(bytes, 0, bytes.Length);
-                    stream.Flush(true);
+                    if (!IsExpectedDirectory(logs, paths.Logs, true)) { return false; }
+#if TRAYHOST_SELF_TEST
+                    if (_testDirectoryChainOpened != null) { _testDirectoryChainOpened(); }
+#endif
+                    using (SafeFileHandle leaf = CreateFileW(paths.Leaf, GenericRead | GenericWrite | ReadControl, FileShareRead, IntPtr.Zero, OpenAlways, FileFlagOpenReparsePoint | FileFlagWriteThrough, IntPtr.Zero))
+                    {
+                        if (!IsExpectedLeaf(leaf, paths.Leaf)) { return false; }
+#if TRAYHOST_SELF_TEST
+                        if (_testLeafValidated != null) { _testLeafValidated(); }
+#endif
+                        using (FileStream stream = new FileStream(leaf, FileAccess.ReadWrite, 4096, false))
+                        {
+                            long length = stream.Length;
+                            if (length > MaximumBytes || length > MaximumBytes - bytes.LongLength)
+                            {
+                                stream.SetLength(0L);
+                                stream.Position = 0L;
+                            }
+                            else { stream.Position = length; }
+                            stream.Write(bytes, 0, bytes.Length);
+                            stream.Flush(true);
+                            return true;
+                        }
+                    }
                 }
             }
+        }
+    }
+
+    private static bool TryBuildPaths(string localRoot, out ReceiptPaths paths)
+    {
+        paths = null;
+        if (String.IsNullOrEmpty(localRoot) || !Path.IsPathRooted(localRoot) || localRoot.StartsWith("\\\\?\\", StringComparison.Ordinal) || localRoot.StartsWith("\\\\.\\", StringComparison.Ordinal)) { return false; }
+        string canonicalRoot = NormalizePath(localRoot);
+        if (String.IsNullOrEmpty(canonicalRoot)) { return false; }
+        string product = NormalizePath(Path.Combine(canonicalRoot, "CodexControlOtherDevices"));
+        string logs = NormalizePath(Path.Combine(product, "logs"));
+        string leaf = NormalizePath(Path.Combine(logs, "trayhost-actions.log"));
+        if (String.IsNullOrEmpty(product) || String.IsNullOrEmpty(logs) || String.IsNullOrEmpty(leaf)) { return false; }
+        if (!String.Equals(Path.GetDirectoryName(product), canonicalRoot, StringComparison.OrdinalIgnoreCase) || !String.Equals(Path.GetDirectoryName(logs), product, StringComparison.OrdinalIgnoreCase) || !String.Equals(Path.GetDirectoryName(leaf), logs, StringComparison.OrdinalIgnoreCase)) { return false; }
+        if (!String.Equals(Path.GetFileName(product), "CodexControlOtherDevices", StringComparison.Ordinal) || !String.Equals(Path.GetFileName(logs), "logs", StringComparison.Ordinal) || !String.Equals(Path.GetFileName(leaf), "trayhost-actions.log", StringComparison.Ordinal) || Path.GetFileName(leaf).IndexOf(':') >= 0) { return false; }
+        paths = new ReceiptPaths { LocalRoot = canonicalRoot, Product = product, Logs = logs, Leaf = leaf };
+        return true;
+    }
+
+    private static string NormalizePath(string path)
+    {
+        try
+        {
+            string full = Path.GetFullPath(path);
+            string root = Path.GetPathRoot(full);
+            while (!String.IsNullOrEmpty(root) && full.Length > root.Length && (full.EndsWith("\\", StringComparison.Ordinal) || full.EndsWith("/", StringComparison.Ordinal))) { full = full.Substring(0, full.Length - 1); }
+            return full;
+        }
+        catch { return null; }
+    }
+
+    private static bool TryCreateChildDirectory(string path)
+    {
+        try
+        {
+            if (Directory.Exists(path)) { return true; }
+            Directory.CreateDirectory(path, CreatePrivateDirectorySecurity());
             return true;
         }
         catch { return false; }
     }
 
-    private static bool TryCreateSafeChildDirectory(string path)
+    private static DirectorySecurity CreatePrivateDirectorySecurity()
+    {
+        SecurityIdentifier user = GetCurrentUserSid();
+        if (user == null) { throw new InvalidOperationException("current user SID is unavailable"); }
+        DirectorySecurity security = new DirectorySecurity();
+        security.SetOwner(user);
+        security.SetAccessRuleProtection(true, false);
+        InheritanceFlags inheritance = InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit;
+        SecurityIdentifier[] identities = new SecurityIdentifier[] {
+            user,
+            new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null),
+            new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null)
+        };
+        for (int i = 0; i < identities.Length; i++)
+        {
+            security.AddAccessRule(new FileSystemAccessRule(identities[i], FileSystemRights.FullControl, inheritance, PropagationFlags.None, AccessControlType.Allow));
+        }
+        return security;
+    }
+
+    private static SecurityIdentifier GetCurrentUserSid()
+    {
+        try
+        {
+            using (WindowsIdentity identity = WindowsIdentity.GetCurrent())
+            {
+                return identity == null || identity.User == null ? null : new SecurityIdentifier(identity.User.Value);
+            }
+        }
+        catch { return null; }
+    }
+
+    private static SafeFileHandle OpenDirectory(string path)
+    {
+        return CreateFileW(path, FileListDirectory | FileReadAttributes | ReadControl, FileShareRead | FileShareWrite, IntPtr.Zero, OpenExisting, FileFlagBackupSemantics | FileFlagOpenReparsePoint, IntPtr.Zero);
+    }
+
+    private static bool IsExpectedDirectory(SafeFileHandle handle, string expectedPath, bool requirePrivateSecurity)
+    {
+        ByHandleFileInformation information;
+        if (handle == null || handle.IsInvalid || GetFileType(handle) != FileTypeDisk || !GetFileInformationByHandle(handle, out information)) { return false; }
+        if ((information.FileAttributes & FileAttributeDirectory) == 0U || (information.FileAttributes & (FileAttributeReparsePoint | FileAttributeDevice)) != 0U) { return false; }
+        if (!IsExpectedFinalPath(handle, expectedPath)) { return false; }
+        return !requirePrivateSecurity || HasPrivateDirectorySecurity(handle);
+    }
+
+    private static bool HasPrivateDirectorySecurity(SafeFileHandle handle)
+    {
+        IntPtr owner; IntPtr group; IntPtr dacl; IntPtr sacl; IntPtr descriptor;
+        uint result = GetSecurityInfo(handle, SeFileObject, SecurityInformationOwner | SecurityInformationDacl, out owner, out group, out dacl, out sacl, out descriptor);
+        if (result != 0U || descriptor == IntPtr.Zero) { return false; }
+        try
+        {
+            uint length = GetSecurityDescriptorLength(descriptor);
+            if (length == 0U || length > 65536U) { return false; }
+            byte[] bytes = new byte[checked((int)length)];
+            Marshal.Copy(descriptor, bytes, 0, bytes.Length);
+            RawSecurityDescriptor security = new RawSecurityDescriptor(bytes, 0);
+            SecurityIdentifier user = GetCurrentUserSid();
+            if (user == null || security.Owner == null || !String.Equals(security.Owner.Value, user.Value, StringComparison.Ordinal)) { return false; }
+            if ((security.ControlFlags & ControlFlags.DiscretionaryAclPresent) == 0 || (security.ControlFlags & ControlFlags.DiscretionaryAclProtected) == 0 || security.DiscretionaryAcl == null || security.DiscretionaryAcl.Count != 3) { return false; }
+            HashSet<string> expected = new HashSet<string>(StringComparer.Ordinal) {
+                user.Value,
+                new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null).Value,
+                new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null).Value
+            };
+            HashSet<string> seen = new HashSet<string>(StringComparer.Ordinal);
+            AceFlags inheritance = AceFlags.ContainerInherit | AceFlags.ObjectInherit;
+            for (int i = 0; i < security.DiscretionaryAcl.Count; i++)
+            {
+                CommonAce ace = security.DiscretionaryAcl[i] as CommonAce;
+                if (ace == null || ace.IsCallback || ace.AceQualifier != AceQualifier.AccessAllowed || ace.SecurityIdentifier == null || ace.AccessMask != FullControlAccessMask) { return false; }
+                if ((ace.AceFlags & inheritance) != inheritance || (ace.AceFlags & ~(inheritance)) != AceFlags.None) { return false; }
+                if (!expected.Contains(ace.SecurityIdentifier.Value) || !seen.Add(ace.SecurityIdentifier.Value)) { return false; }
+            }
+            return seen.Count == expected.Count;
+        }
+        catch { return false; }
+        finally { LocalFree(descriptor); }
+    }
+
+    private static bool IsExpectedLeaf(SafeFileHandle handle, string expectedPath)
     {
-        if (Directory.Exists(path)) { return IsSafeExistingDirectory(path); }
-        string parent = Path.GetDirectoryName(path);
-        if (String.IsNullOrEmpty(parent) || !IsSafeExistingDirectory(parent)) { return false; }
-        Directory.CreateDirectory(path);
-        return IsSafeExistingDirectory(path);
+        ByHandleFileInformation information;
+        if (handle == null || handle.IsInvalid || GetFileType(handle) != FileTypeDisk || !GetFileInformationByHandle(handle, out information)) { return false; }
+        if ((information.FileAttributes & (FileAttributeDirectory | FileAttributeReparsePoint | FileAttributeDevice)) != 0U || information.NumberOfLinks != 1U) { return false; }
+        return IsExpectedFinalPath(handle, expectedPath);
     }
 
-    private static bool IsSafePath(string path)
+    private static bool IsExpectedFinalPath(SafeFileHandle handle, string expectedPath)
     {
-        if (!Path.IsPathRooted(path) || !String.Equals(Path.GetFileName(path), "trayhost-actions.log", StringComparison.OrdinalIgnoreCase) || Directory.Exists(path)) { return false; }
-        if (File.Exists(path) && (File.GetAttributes(path) & FileAttributes.ReparsePoint) != 0) { return false; }
-        string directory = Path.GetDirectoryName(path);
-        return !String.IsNullOrEmpty(directory) && IsSafeExistingDirectory(directory);
+        string actual;
+        if (!TryGetFinalPath(handle, out actual)) { return false; }
+        return String.Equals(actual, NormalizePath(expectedPath), StringComparison.OrdinalIgnoreCase);
     }
 
-    private static bool IsSafeExistingDirectory(string path)
+    private static bool TryGetFinalPath(SafeFileHandle handle, out string path)
     {
-        DirectoryInfo current = new DirectoryInfo(path);
-        if (!current.Exists) { return false; }
-        while (current != null)
+        path = null;
+        StringBuilder buffer = new StringBuilder(512);
+        uint length = GetFinalPathNameByHandleW(handle, buffer, (uint)buffer.Capacity, 0U);
+        if (length == 0U) { return false; }
+        if (length >= (uint)buffer.Capacity)
         {
-            if (!current.Exists || (current.Attributes & FileAttributes.ReparsePoint) != 0) { return false; }
-            current = current.Parent;
+            if (length > 32767U) { return false; }
+            buffer = new StringBuilder(checked((int)length + 1));
+            length = GetFinalPathNameByHandleW(handle, buffer, (uint)buffer.Capacity, 0U);
+            if (length == 0U || length >= (uint)buffer.Capacity) { return false; }
         }
-        return true;
+        string value = buffer.ToString();
+        if (value.StartsWith("\\\\?\\UNC\\", StringComparison.OrdinalIgnoreCase)) { value = "\\\\" + value.Substring(8); }
+        else if (value.StartsWith("\\\\?\\", StringComparison.Ordinal)) { value = value.Substring(4); }
+        path = NormalizePath(value);
+        return !String.IsNullOrEmpty(path);
     }
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern SafeFileHandle CreateFileW(string fileName, uint desiredAccess, uint shareMode, IntPtr securityAttributes, uint creationDisposition, uint flagsAndAttributes, IntPtr templateFile);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle file, out ByHandleFileInformation information);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern uint GetFileType(SafeFileHandle file);
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern uint GetFinalPathNameByHandleW(SafeFileHandle file, StringBuilder path, uint pathLength, uint flags);
+
+    [DllImport("advapi32.dll", SetLastError = true)]
+    private static extern uint GetSecurityInfo(SafeFileHandle handle, uint objectType, uint securityInformation, out IntPtr owner, out IntPtr group, out IntPtr dacl, out IntPtr sacl, out IntPtr securityDescriptor);
+
+    [DllImport("advapi32.dll", SetLastError = true)]
+    private static extern uint GetSecurityDescriptorLength(IntPtr securityDescriptor);
+
+    [DllImport("kernel32.dll")]
+    private static extern IntPtr LocalFree(IntPtr memory);
 }
diff --git a/tests/trayhost/Invoke-TrayHostSelfTest.ps1 b/tests/trayhost/Invoke-TrayHostSelfTest.ps1
index f38ae62..ad95efa 100644
--- a/tests/trayhost/Invoke-TrayHostSelfTest.ps1
+++ b/tests/trayhost/Invoke-TrayHostSelfTest.ps1
@@ -62,6 +62,7 @@ try{
     $mainType=if($ProtocolOnly){'TrayHostProtocolSelfTest'}elseif($NativeOnly){'TrayHostNativeSelfTest'}elseif($TransportOnly){'TrayHostTransportSelfTest'}elseif($ParentClientOnly){'TrayHostParentClientSelfTest'}else{'Program'}
     $outputPath=Join-Path $temporaryRoot $outputName
     $args=@('/nologo','/noconfig','/nostdlib+','/target:exe','/platform:anycpu','/optimize+','/checked+','/warn:4','/warnaserror+',('/out:{0}' -f $outputPath),('/main:{0}' -f $mainType))
+    if($NativeOnly){$args+='/define:TRAYHOST_SELF_TEST'}
     foreach($leaf in @('mscorlib.dll','System.dll','System.Core.dll','System.Drawing.dll')){$args+=('/reference:'+ (Join-Path $reference.ReferenceRoot $leaf))}
     if($ProductionOnly){$args+=(Get-ChildItem -LiteralPath (Join-Path $repositoryRoot 'src\trayhost') -Filter '*.cs' -File | ForEach-Object FullName)}
     else
diff --git a/tests/trayhost/TrayHostNativeSelfTest.cs b/tests/trayhost/TrayHostNativeSelfTest.cs
index 67a1980..316ea72 100644
--- a/tests/trayhost/TrayHostNativeSelfTest.cs
+++ b/tests/trayhost/TrayHostNativeSelfTest.cs
@@ -2,6 +2,11 @@
 using System.Collections.Generic;
 using System.Diagnostics;
 using System.IO;
+using System.Runtime.InteropServices;
+using System.Security.AccessControl;
+using System.Security.Principal;
+using System.Text;
+using System.Threading;
 
 internal sealed class FakeTrayPlatform : INativeTrayPlatform
 {
@@ -48,9 +53,48 @@ internal sealed class FakeTrayPlatform : INativeTrayPlatform
 
 internal static class TrayHostNativeSelfTest
 {
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool CreateHardLinkW(string fileName, string existingFileName, IntPtr securityAttributes);
+
     private static void AssertTrue(bool value, string message) { if (!value) { throw new InvalidOperationException(message); } }
     private static void AssertEqual(string expected, string actual, string message) { if (!String.Equals(expected, actual, StringComparison.Ordinal)) { throw new InvalidOperationException(message + " expected=[" + expected + "] actual=[" + actual + "]"); } }
 
+    private static string ReceiptPath(string root)
+    {
+        return Path.Combine(root, "CodexControlOtherDevices", "logs", "trayhost-actions.log");
+    }
+
+    private static TrayTerminalDiagnosticStore TestStore(string root, Action directoryChainOpened, Action leafValidated)
+    {
+        return TrayTerminalDiagnosticStore.CreateForTesting(root, directoryChainOpened, leafValidated);
+    }
+
+    private static void CreateJunction(string link, string target)
+    {
+        ProcessStartInfo info = new ProcessStartInfo {
+            FileName = Environment.GetEnvironmentVariable("ComSpec"),
+            Arguments = "/d /c mklink /J \"" + link + "\" \"" + target + "\"",
+            UseShellExecute = false, CreateNoWindow = true, RedirectStandardOutput = true, RedirectStandardError = true
+        };
+        using (Process process = Process.Start(info))
+        {
+            process.WaitForExit();
+            AssertTrue(process.ExitCode == 0, "test junction is created: " + process.StandardError.ReadToEnd());
+        }
+    }
+
+    private static void DeleteJunction(string path)
+    {
+        try { if (Directory.Exists(path)) { Directory.Delete(path); } } catch { }
+    }
+
+    private static byte[] ReceiptBytes(TrayCommand command, ulong revision, TrayActionResultStatus status, string code)
+    {
+        string line = "command=" + command.ToString() + " revision=" + revision.ToString(System.Globalization.CultureInfo.InvariantCulture) + " status=" + status.ToString() + " code=" + code + Environment.NewLine;
+        return new UTF8Encoding(false).GetBytes(line);
+    }
+
     private static PresentationSnapshot Snapshot(ulong revision)
     {
         return SnapshotV2(revision);
@@ -214,46 +258,194 @@ private static void TestTerminalDiagnosticLogIsSanitizedAndReportsPersistence()
     {
         string root = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-" + Guid.NewGuid().ToString("N"));
         Directory.CreateDirectory(root);
-        string path = Path.Combine(root, "trayhost-actions.log");
+        string path = ReceiptPath(root);
         try
         {
             TrayTerminalDiagnostic record = new TrayTerminalDiagnostic(TrayCommand.OpenLogs, 23UL, TrayActionResultStatus.Rejected, "CCOD_TRAY_ACTION_STALE");
-            AssertTrue(TrayTerminalDiagnosticLog.TryAppend(path, record), "terminal diagnostic append reports durable success");
-            AssertEqual("command=OpenLogs revision=23 status=Rejected code=CCOD_TRAY_ACTION_STALE" + Environment.NewLine, File.ReadAllText(path), "terminal diagnostic file contains only the approved correlation fields");
-            AssertTrue(!TrayTerminalDiagnosticLog.TryAppend(root, record), "terminal diagnostic append reports persistence failure without throwing");
+            using (TrayTerminalDiagnosticStore store = TestStore(root, null, null))
+            {
+                AssertTrue(store.TryAppendDurably(record), "terminal diagnostic append reports durable success");
+            }
+            byte[] expected = ReceiptBytes(TrayCommand.OpenLogs, 23UL, TrayActionResultStatus.Rejected, "CCOD_TRAY_ACTION_STALE");
+            AssertTrue(Convert.ToBase64String(expected) == Convert.ToBase64String(File.ReadAllBytes(path)), "terminal diagnostic file is exact UTF-8 without a BOM and contains only approved fields");
+            string defaultPath;
+            AssertTrue(TrayTerminalDiagnosticStore.TryGetDefaultPath(out defaultPath), "fixed production receipt path resolves");
+            string expectedDefaultPath = Path.GetFullPath(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "CodexControlOtherDevices", "logs", "trayhost-actions.log"));
+            AssertTrue(String.Equals(expectedDefaultPath, defaultPath, StringComparison.OrdinalIgnoreCase), "production receipt path is fixed to the current user's exact LocalApplicationData leaf");
         }
         finally { try { Directory.Delete(root, true); } catch { } }
     }
 
-    private static void TestTerminalDiagnosticLogIsBoundedAndRejectsReparseComponents()
+    private static void TestTerminalDiagnosticStoreRejectsUnsafeObjectsAndProtectsOutsideSentinel()
     {
-        string root = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-bound-" + Guid.NewGuid().ToString("N"));
-        string target = Path.Combine(root, "target");
-        string junction = Path.Combine(root, "junction");
-        Directory.CreateDirectory(target);
-        string path = Path.Combine(target, "trayhost-actions.log");
+        string root = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-unsafe-" + Guid.NewGuid().ToString("N"));
+        string outside = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-outside-" + Guid.NewGuid().ToString("N"));
+        string outsideSentinel = Path.Combine(outside, "trayhost-actions.log");
+        string path = ReceiptPath(root);
+        string logs = Path.GetDirectoryName(path);
+        byte[] sentinel = new byte[] { 0x10, 0x22, 0x34, 0x46, 0x58, 0x6a };
+        Directory.CreateDirectory(root); Directory.CreateDirectory(outside); File.WriteAllBytes(outsideSentinel, sentinel);
         try
         {
-            string lastLine = String.Empty;
-            for (ulong revision = 1UL; revision <= 1400UL; revision++)
+            TrayTerminalDiagnostic record = new TrayTerminalDiagnostic(TrayCommand.OpenLogs, 1UL, TrayActionResultStatus.Rejected, "CCOD_TRAY_ACTION_STALE");
+            using (TrayTerminalDiagnosticStore bootstrap = TestStore(root, null, null)) { AssertTrue(bootstrap.TryAppendDurably(record), "safe receipt directories are bootstrapped"); }
+            File.Delete(path); Directory.Delete(logs);
+
+            CreateJunction(logs, outside);
+            using (TrayTerminalDiagnosticStore reparseDirectory = TestStore(root, null, null))
+            {
+                AssertTrue(!reparseDirectory.TryAppendDurably(record), "a reparse logs directory is rejected before writing");
+            }
+            AssertTrue(Convert.ToBase64String(sentinel) == Convert.ToBase64String(File.ReadAllBytes(outsideSentinel)), "reparse directory cannot alter the outside sentinel");
+            DeleteJunction(logs);
+
+            using (TrayTerminalDiagnosticStore restore = TestStore(root, null, null)) { AssertTrue(restore.TryAppendDurably(record), "safe logs directory is restored for leaf tests"); }
+            File.Delete(path);
+            CreateJunction(path, outside);
+            using (TrayTerminalDiagnosticStore reparseLeaf = TestStore(root, null, null))
+            {
+                AssertTrue(!reparseLeaf.TryAppendDurably(record), "a reparse receipt leaf is rejected before writing");
+            }
+            AssertTrue(Convert.ToBase64String(sentinel) == Convert.ToBase64String(File.ReadAllBytes(outsideSentinel)), "reparse leaf cannot alter the outside sentinel");
+            DeleteJunction(path);
+
+            AssertTrue(CreateHardLinkW(path, outsideSentinel, IntPtr.Zero), "test hard link is created");
+            using (TrayTerminalDiagnosticStore hardLinkLeaf = TestStore(root, null, null))
             {
-                TrayTerminalDiagnostic record = new TrayTerminalDiagnostic(TrayCommand.OpenLogs, revision, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED");
-                AssertTrue(TrayTerminalDiagnosticLog.TryAppend(path, record), "bounded terminal diagnostic append succeeds");
-                lastLine = "command=OpenLogs revision=" + revision.ToString(System.Globalization.CultureInfo.InvariantCulture) + " status=Failed code=CCOD_TRAY_ACTION_FAILED" + Environment.NewLine;
+                AssertTrue(!hardLinkLeaf.TryAppendDurably(record), "a multi-link receipt leaf is rejected before writing");
             }
-            FileInfo retained = new FileInfo(path);
-            AssertTrue(retained.Length <= TrayTerminalDiagnosticLog.MaximumBytes, "terminal diagnostic retention never exceeds its fixed byte bound");
-            AssertTrue(File.ReadAllText(path).EndsWith(lastLine, StringComparison.Ordinal), "deterministic rollover retains the complete latest terminal record");
-
-            ProcessStartInfo junctionInfo = new ProcessStartInfo {
-                FileName = Environment.GetEnvironmentVariable("ComSpec"),
-                Arguments = "/d /c mklink /J \"" + junction + "\" \"" + target + "\"",
-                UseShellExecute = false, CreateNoWindow = true, RedirectStandardOutput = true, RedirectStandardError = true
+            AssertTrue(Convert.ToBase64String(sentinel) == Convert.ToBase64String(File.ReadAllBytes(outsideSentinel)), "hard-link leaf cannot alter the outside sentinel");
+            File.Delete(path);
+
+            DirectorySecurity unsafeSecurity = Directory.GetAccessControl(logs);
+            unsafeSecurity.AddAccessRule(new FileSystemAccessRule(new SecurityIdentifier(WellKnownSidType.WorldSid, null), FileSystemRights.FullControl, InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit, PropagationFlags.None, AccessControlType.Allow));
+            Directory.SetAccessControl(logs, unsafeSecurity);
+            using (TrayTerminalDiagnosticStore unsafeAcl = TestStore(root, null, null))
+            {
+                AssertTrue(!unsafeAcl.TryAppendDurably(record), "an unexpected logs DACL is rejected before writing");
+            }
+            AssertTrue(!File.Exists(path), "unsafe directory ACL cannot create or write the receipt leaf");
+            AssertTrue(Convert.ToBase64String(sentinel) == Convert.ToBase64String(File.ReadAllBytes(outsideSentinel)), "unsafe directory ACL cannot alter the outside sentinel");
+        }
+        finally
+        {
+            DeleteJunction(path); DeleteJunction(logs);
+            try { Directory.Delete(root, true); } catch { }
+            try { Directory.Delete(outside, true); } catch { }
+        }
+    }
+
+    private static void TestTerminalDiagnosticStorePinsDirectoryChainAgainstReplacement()
+    {
+        string root = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-pin-" + Guid.NewGuid().ToString("N"));
+        string outside = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-pin-outside-" + Guid.NewGuid().ToString("N"));
+        string path = ReceiptPath(root); string logs = Path.GetDirectoryName(path); string displaced = logs + ".displaced";
+        string outsideSentinel = Path.Combine(outside, "trayhost-actions.log");
+        byte[] sentinel = new byte[] { 0x71, 0x72, 0x73, 0x74, 0x75 };
+        bool barrierEntered = false; bool replacementSucceeded = false;
+        Directory.CreateDirectory(root); Directory.CreateDirectory(outside); File.WriteAllBytes(outsideSentinel, sentinel);
+        try
+        {
+            TrayTerminalDiagnostic record = new TrayTerminalDiagnostic(TrayCommand.OpenLogs, 2UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED");
+            using (TrayTerminalDiagnosticStore bootstrap = TestStore(root, null, null)) { AssertTrue(bootstrap.TryAppendDurably(record), "safe receipt chain is bootstrapped"); }
+            File.Delete(path);
+            Action barrier = delegate
+            {
+                barrierEntered = true;
+                try { Directory.Move(logs, displaced); replacementSucceeded = true; CreateJunction(logs, outside); } catch (IOException) { }
+                catch (UnauthorizedAccessException) { }
+                throw new InvalidOperationException("intentional barrier stop");
             };
-            using (Process junctionProcess = Process.Start(junctionInfo)) { junctionProcess.WaitForExit(); AssertTrue(junctionProcess.ExitCode == 0, "test junction is created"); }
-            AssertTrue(!TrayTerminalDiagnosticLog.TryAppend(Path.Combine(junction, "trayhost-actions.log"), new TrayTerminalDiagnostic(TrayCommand.OpenLogs, 1UL, TrayActionResultStatus.Rejected, "CCOD_TRAY_ACTION_STALE")), "terminal diagnostic rejects a reparse-point path component");
+            using (TrayTerminalDiagnosticStore store = TestStore(root, barrier, null))
+            {
+                AssertTrue(!store.TryAppendDurably(record), "a replacement attempt at the directory-to-leaf barrier fails closed");
+            }
+            AssertTrue(barrierEntered, "replacement barrier runs after the directory chain is opened");
+            AssertTrue(!replacementSucceeded, "the opened logs handle denies rename replacement");
+            AssertTrue(Convert.ToBase64String(sentinel) == Convert.ToBase64String(File.ReadAllBytes(outsideSentinel)), "replacement attempt leaves the outside sentinel byte-identical");
+        }
+        finally
+        {
+            DeleteJunction(logs);
+            try { if (Directory.Exists(displaced) && !Directory.Exists(logs)) { Directory.Move(displaced, logs); } } catch { }
+            try { Directory.Delete(root, true); } catch { }
+            try { Directory.Delete(outside, true); } catch { }
+        }
+    }
+
+    private static void TestTerminalDiagnosticStoreRejectsConcurrentWriter()
+    {
+        string root = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-share-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(root);
+        ManualResetEvent leafValidated = new ManualResetEvent(false); ManualResetEvent release = new ManualResetEvent(false);
+        bool firstResult = false;
+        try
+        {
+            TrayTerminalDiagnostic first = new TrayTerminalDiagnostic(TrayCommand.OpenLogs, 3UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED");
+            TrayTerminalDiagnostic second = new TrayTerminalDiagnostic(TrayCommand.OpenLogs, 4UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED");
+            using (TrayTerminalDiagnosticStore firstStore = TestStore(root, null, delegate { leafValidated.Set(); release.WaitOne(); }))
+            using (TrayTerminalDiagnosticStore secondStore = TestStore(root, null, null))
+            {
+                Thread writer = new Thread(new ThreadStart(delegate { firstResult = firstStore.TryAppendDurably(first); }));
+                writer.Start();
+                AssertTrue(leafValidated.WaitOne(5000), "first writer reaches the validated leaf barrier");
+                Stopwatch rejection = Stopwatch.StartNew();
+                AssertTrue(!secondStore.TryAppendDurably(second), "a concurrent writer is rejected by leaf sharing");
+                rejection.Stop(); AssertTrue(rejection.ElapsedMilliseconds < 250L, "a sharing conflict fails without waiting or retrying");
+                release.Set(); AssertTrue(writer.Join(5000), "first writer completes after the sharing probe");
+                AssertTrue(firstResult, "the validated first writer remains durable");
+            }
+        }
+        finally { release.Set(); leafValidated.Dispose(); release.Dispose(); try { Directory.Delete(root, true); } catch { } }
+    }
+
+    private static void TestTerminalDiagnosticStoreRejectsDirectoryLeafWithoutWriting()
+    {
+        string root = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-directory-leaf-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(root); string path = ReceiptPath(root);
+        try
+        {
+            TrayTerminalDiagnostic record = new TrayTerminalDiagnostic(TrayCommand.OpenLogs, 5UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED");
+            using (TrayTerminalDiagnosticStore bootstrap = TestStore(root, null, null)) { AssertTrue(bootstrap.TryAppendDurably(record), "safe receipt chain is bootstrapped for directory-leaf test"); }
+            File.Delete(path); Directory.CreateDirectory(path);
+            using (TrayTerminalDiagnosticStore directoryLeaf = TestStore(root, null, null))
+            {
+                AssertTrue(!directoryLeaf.TryAppendDurably(record), "a directory at the fixed receipt leaf is rejected before writing");
+            }
+            AssertTrue(Directory.Exists(path) && Directory.GetFileSystemEntries(path).Length == 0, "directory leaf remains unchanged after rejection");
         }
-        finally { try { if (Directory.Exists(junction)) { Directory.Delete(junction); } } catch { } try { Directory.Delete(root, true); } catch { } }
+        finally { try { if (Directory.Exists(path)) { Directory.Delete(path, true); } } catch { } try { Directory.Delete(root, true); } catch { } }
+    }
+
+    private static void TestTerminalDiagnosticStoreIsBoundedThroughValidatedHandle()
+    {
+        string root = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-bound-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(root); string path = ReceiptPath(root);
+        try
+        {
+            TrayTerminalDiagnostic first = new TrayTerminalDiagnostic(TrayCommand.OpenLogs, 41UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED");
+            TrayTerminalDiagnostic second = new TrayTerminalDiagnostic(TrayCommand.OpenLogs, 42UL, TrayActionResultStatus.Rejected, "CCOD_TRAY_ACTION_STALE");
+            byte[] firstBytes = ReceiptBytes(TrayCommand.OpenLogs, 41UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED");
+            byte[] secondBytes = ReceiptBytes(TrayCommand.OpenLogs, 42UL, TrayActionResultStatus.Rejected, "CCOD_TRAY_ACTION_STALE");
+            using (TrayTerminalDiagnosticStore store = TestStore(root, null, null))
+            {
+                AssertTrue(store.TryAppendDurably(first), "safe receipt chain is created before boundary setup");
+                byte[] boundaryPrefix = new byte[checked((int)(TrayTerminalDiagnosticStore.MaximumBytes - firstBytes.Length))];
+                for (int i = 0; i < boundaryPrefix.Length; i++) { boundaryPrefix[i] = (byte)'x'; }
+                File.WriteAllBytes(path, boundaryPrefix);
+                AssertTrue(store.TryAppendDurably(first), "a whole receipt fitting the exact 64-KiB boundary is appended");
+                AssertTrue(new FileInfo(path).Length == TrayTerminalDiagnosticStore.MaximumBytes, "exact-boundary append retains exactly 64 KiB");
+                AssertTrue(File.ReadAllText(path).EndsWith(Encoding.UTF8.GetString(firstBytes), StringComparison.Ordinal), "exact-boundary append retains the whole latest record");
+
+                AssertTrue(store.TryAppendDurably(second), "a boundary-crossing receipt rolls over through the validated handle");
+                AssertTrue(Convert.ToBase64String(secondBytes) == Convert.ToBase64String(File.ReadAllBytes(path)), "rollover retains exactly one complete latest record");
+
+                File.WriteAllBytes(path, new byte[checked((int)TrayTerminalDiagnosticStore.MaximumBytes + 17)]);
+                AssertTrue(store.TryAppendDurably(first), "an oversized existing receipt rolls over through the validated handle");
+                AssertTrue(Convert.ToBase64String(firstBytes) == Convert.ToBase64String(File.ReadAllBytes(path)), "oversized rollover retains exactly one complete latest record");
+            }
+        }
+        finally { try { Directory.Delete(root, true); } catch { } }
     }
 
     private static void TestNoHimcFailureIsSafe()
@@ -336,13 +528,17 @@ public static int Main(string[] args)
             TestVerifiedAboutUsesTheAcknowledgedSnapshotVersion();
             TestActionFailureUsesTheAcknowledgedSnapshotStrings();
             TestTerminalDiagnosticLogIsSanitizedAndReportsPersistence();
-            TestTerminalDiagnosticLogIsBoundedAndRejectsReparseComponents();
+            TestTerminalDiagnosticStoreRejectsUnsafeObjectsAndProtectsOutsideSentinel();
+            TestTerminalDiagnosticStorePinsDirectoryChainAgainstReplacement();
+            TestTerminalDiagnosticStoreRejectsConcurrentWriter();
+            TestTerminalDiagnosticStoreRejectsDirectoryLeafWithoutWriting();
+            TestTerminalDiagnosticStoreIsBoundedThroughValidatedHandle();
             TestSimplifiedMenuAndExitConfirmation();
             TestNoHimcFailureIsSafe();
             TestShellRightClickNotificationMapping();
             TestRealNativePInvokeSurface();
             TestPostedWorkMessageDispatchesToItsOwnerWindow();
-            Console.WriteLine("TrayHost native self-tests passed: 17");
+            Console.WriteLine("TrayHost native self-tests passed: 21");
             return 0;
         }
         catch (Exception error)

From 592ef5ad682b4c55ba96d4cf4d796a0716b488e2 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 08:55:55 +0800
Subject: [PATCH 027/187] docs: record async tray receipt Task 1

---
 .../task-1-report.md                          | 221 ++++++++++++++++++
 1 file changed, 221 insertions(+)
 create mode 100644 .superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-1-report.md

diff --git a/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-1-report.md b/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-1-report.md
new file mode 100644
index 0000000..90d935c
--- /dev/null
+++ b/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-1-report.md
@@ -0,0 +1,221 @@
+# Task 1 report: pinned, bounded tray receipt store
+
+Date: 2026-08-28
+
+Worktree: `C:\Users\33384\Documents\Codex-Control-other-devices-Windows\.worktrees\codex-v2522-install-runtime-reliability`
+
+Branch: `codex/v2522-install-runtime-reliability`
+
+## Status
+
+Task 1 is implemented and focused verification is green. This report does not
+claim the later asynchronous sink, bounded UI completion, or child-session
+trace from Tasks 2 and 3.
+
+## Files
+
+- `src/trayhost/TrayTerminalDiagnostic.cs`
+  - Replaced the caller-selected path append helper with
+    `TrayTerminalDiagnosticStore`.
+  - The production constructor has no path parameter. `TryGetDefaultPath`
+    resolves only
+    `%LOCALAPPDATA%\CodexControlOtherDevices\logs\trayhost-actions.log`.
+  - Opens LocalAppData, product, and logs through `CreateFileW` directory
+    handles using backup-semantics/open-reparse flags, `FILE_LIST_DIRECTORY`,
+    attribute/security read access, read/write sharing, and no delete sharing.
+  - Validates the actual opened directory handles for disk type, directory and
+    non-reparse attributes, expected final path, and (for product/logs) exact
+    current-user/SYSTEM/Administrators owner/DACL policy.
+  - Opens the fixed leaf through `CreateFileW(OPEN_ALWAYS)` with open-reparse
+    and write-through flags plus read sharing only. It rejects non-disk,
+    directory, reparse, device, multi-link, unexpected-final-path, query, and
+    sharing failures before any content write or truncation.
+  - Reads length, performs rollover with `SetLength(0)`, writes the complete
+    UTF-8 no-BOM record, and calls `Flush(true)` through the already validated
+    leaf handle. It returns `true` only after the flush succeeds.
+- `src/trayhost/Program.cs`
+  - Owns one `TrayTerminalDiagnosticStore` and passes
+    `TryAppendDurably` to the existing transport callback.
+  - Disposes the store during the existing shutdown cleanup.
+  - No command-line input, protocol type, wire field, direction, sequence, or
+    authentication rule changed.
+- `tests/trayhost/TrayHostNativeSelfTest.cs`
+  - Added exact UTF-8/sanitization and fixed-production-path checks.
+  - Added temporary-root reparse-directory, reparse-leaf, ordinary-directory
+    leaf, hard-link leaf, unsafe DACL, directory-replacement barrier, concurrent
+    writer, exact 64-KiB, crossing-rollover, and oversized-file checks.
+  - The directory replacement and hard-link cases retain an outside sentinel
+    byte-for-byte.
+- `tests/trayhost/Invoke-TrayHostSelfTest.ps1`
+  - Defines `TRAYHOST_SELF_TEST` only for the temporary NativeOnly test
+    executable. The temporary-root factory and barriers are compiled out of
+    every production build and do not create a production CLI, environment
+    switch, listener, or external control surface.
+
+## TDD evidence
+
+### Clean baseline
+
+Command:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -NativeOnly
+```
+
+Output before test changes, exit `0`:
+
+```text
+TrayHost native self-tests passed: 17
+```
+
+### Initial RED
+
+The behavioral test surface was added before production code.
+
+Command:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -NativeOnly
+```
+
+Exit `1`; exact decisive output:
+
+```text
+tests\trayhost\TrayHostNativeSelfTest.cs(66,20): error CS0246: ... TrayTerminalDiagnosticStore ...
+CCOD_TRAYHOST_NATIVE_COMPILE_FAILED
+```
+
+This was the expected missing-feature failure: the current implementation did
+not provide a store that owned native handles or exposed the temporary-only
+barrier contract.
+
+### Directory replacement behavior RED and native root cause
+
+After the first minimal implementation compiled, the barrier remained red:
+
+```text
+TrayHost native self-test failed: System.InvalidOperationException
+the opened logs handle denies rename replacement
+CCOD_TRAYHOST_NATIVE_TEST_FAILED
+```
+
+A temporary in-memory Win32 probe isolated the cause. With the same
+no-delete-share flags, an attribute-only directory handle allowed
+`Directory.Move`; adding `FILE_LIST_DIRECTORY` made the move fail with sharing
+violation `0x80070020`:
+
+```text
+ReadAttributes       : move-succeeded
+ListDirectory        : IOException:80070020
+Delete               : IOException:80070020
+GenericRead          : IOException:80070020
+ReadAttributesDelete : IOException:80070020
+```
+
+The production directory open therefore requests the minimal
+`FILE_LIST_DIRECTORY | FILE_READ_ATTRIBUTES | READ_CONTROL` access needed for
+the no-delete-share pin to enforce the approved barrier.
+
+### ACL RED
+
+An additional test added an Everyone full-control ACE to the existing logs
+directory. Before handle-based ACL validation, NativeOnly exited `1` with:
+
+```text
+TrayHost native self-test failed: System.InvalidOperationException
+an unexpected logs DACL is rejected before writing
+CCOD_TRAYHOST_NATIVE_TEST_FAILED
+```
+
+The green implementation queries the security descriptor through the opened
+directory handle with `GetSecurityInfo`. It never repairs an existing
+unexpected ACL and rejects it before opening or creating the receipt leaf.
+
+## Fresh GREEN evidence
+
+All commands below were rerun after the last source/test change.
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -NativeOnly
+```
+
+Exit `0`:
+
+```text
+TrayHost native self-tests passed: 21
+```
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionOnly
+```
+
+Exit `0`, no output. This compiled the complete production TrayHost and ran
+`--headless-smoke` without the self-test symbol.
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -TransportOnly
+```
+
+Exit `0`:
+
+```text
+TrayHost transport self-tests passed: 10
+```
+
+This preserves the existing rule that a `false` persistence result cannot
+produce About/failure feedback.
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProtocolOnly
+```
+
+Exit `0`:
+
+```text
+TrayHost protocol self-tests passed: 11
+```
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ParentClientOnly
+```
+
+Exit `0`:
+
+```text
+TrayHost parent-client self-tests passed: 4
+TrayHost production correlation trace passed: 2
+```
+
+The ParentClient run also printed the repository's existing PowerShell warning
+about unapproved verbs in `TrayHostClient`; no command in this task changed
+that module or warning surface.
+
+```powershell
+git diff --check
+```
+
+Exit `0`; only Git's existing LF-to-CRLF conversion notices were printed.
+
+## Commit
+
+- `365fde2430723fc8f80106e86490f7fb70be163f` —
+  `fix: pin tray terminal receipt storage`
+
+## Concerns and explicit boundaries
+
+- `Program` still invokes the receipt callback synchronously because the
+  bounded background sink is Task 2. This commit fixes filesystem identity,
+  pinning, safety, and bounded storage only; it does not yet make the
+  authenticated reader non-blocking.
+- Existing product/log directories with a different owner or DACL fail closed
+  and are not repaired. This follows the approved design, but a pre-existing
+  inherited/broadened directory will suppress receipt durability and therefore
+  generic feedback until a separately authorized migration or repair policy is
+  designed.
+- The private ACL, reparse, hard-link, and sharing controls contain accidental
+  replacement and unsafe filesystem objects. They are not represented as a
+  security boundary against a fully hostile process already running as the
+  same Windows user.
+- No installer, installed Codex process, real tray UI, push, release, or public
+  operation was run. Release-wide and real-machine acceptance remain outside
+  Task 1.

From debe0935ea68433816971756679f7aad7ac97a33 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 09:16:01 +0800
Subject: [PATCH 028/187] docs: refine tray receipt compatibility boundary

---
 .../2026-08-28-v2522-async-tray-receipts.md   | 13 +++++++----
 ...-08-28-v2522-async-tray-receipts-design.md | 23 ++++++++++++-------
 2 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/docs/superpowers/plans/2026-08-28-v2522-async-tray-receipts.md b/docs/superpowers/plans/2026-08-28-v2522-async-tray-receipts.md
index 6d2b628..6b2a809 100644
--- a/docs/superpowers/plans/2026-08-28-v2522-async-tray-receipts.md
+++ b/docs/superpowers/plans/2026-08-28-v2522-async-tray-receipts.md
@@ -66,11 +66,14 @@ does not own native handles or the barrier contract.
 
 - [ ] **Step 3: Implement the minimal handle-pinned store**
 
-Open directory components and the fixed leaf through `CreateFileW` safe
-handles.  Reject reparse, non-directory, non-file, multi-link, unexpected
-final-path, share, and handle-query failures before writes.  Keep handles while
-using `SetLength`, write, and `Flush(true)` for the 64-KiB rollover.  Do not
-re-resolve the leaf path for append or truncation.
+Open the existing LocalAppData/product/logs compatibility parents and the fixed
+leaf through `CreateFileW` safe handles.  Create only
+`logs\tray-receipts` as a protected current-user/SYSTEM/Administrators child,
+then reopen and validate its exact handle; legacy direct receipt leaves are
+never reused.  Reject reparse, non-directory, non-file, multi-link,
+unexpected-final-path, share, and handle-query failures before writes.  Keep
+handles while using `SetLength`, write, and `Flush(true)` for the 64-KiB
+rollover.  Do not re-resolve the leaf path for append or truncation.
 
 - [ ] **Step 4: Run GREEN**
 
diff --git a/docs/superpowers/specs/2026-08-28-v2522-async-tray-receipts-design.md b/docs/superpowers/specs/2026-08-28-v2522-async-tray-receipts-design.md
index 8cbc4f8..6c09ae1 100644
--- a/docs/superpowers/specs/2026-08-28-v2522-async-tray-receipts-design.md
+++ b/docs/superpowers/specs/2026-08-28-v2522-async-tray-receipts-design.md
@@ -61,14 +61,21 @@ also bounded at eight shared items.
 ### 2. Pinned, bounded native receipt store
 
 The store uses the fixed path
-`%LOCALAPPDATA%\CodexControlOtherDevices\logs\trayhost-actions.log`.  It opens
-the LocalAppData, product, and logs directories as native directory handles,
-with reparse-point opening flags and delete sharing denied, validates each
-opened handle as the expected non-reparse directory, and holds the directory
-chain while it opens the fixed leaf.  The leaf is opened through a native handle
-before any write; its handle must prove a regular, non-reparse, single-link file
-at the expected final path.  Writes and rollover occur only through that
-validated handle, never through a re-resolved pathname.
+`%LOCALAPPDATA%\CodexControlOtherDevices\logs\tray-receipts\trayhost-actions.log`.
+The existing product and `logs` directories are created by supported historical
+installations with normal inherited current-user ACLs, so they remain
+compatibility parents: the store opens and pins them as non-reparse directory
+handles but does not require them to have the receipt-private ACL.  Beneath the
+pinned `logs` handle it creates the fixed `tray-receipts` child with a protected
+current-user/SYSTEM/Administrators ACL, reopens and validates that exact child
+handle, and fails closed if an existing child does not match.  It never reuses
+the legacy direct `logs\trayhost-actions.log` leaf.
+
+The store holds the native directory chain with reparse-point opening flags and
+delete sharing denied while it opens the fixed leaf.  The leaf is opened through
+a native handle before any write; its handle must prove a regular, non-reparse,
+single-link file at the expected final path.  Writes and rollover occur only
+through that validated handle, never through a re-resolved pathname.
 
 The file is UTF-8 without a BOM and has a hard 64 KiB limit.  If adding a whole
 record would cross the limit, the validated handle is truncated and receives

From f207496df1ceee744a09bbc5c3d24a48695e58bc Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 09:23:53 +0800
Subject: [PATCH 029/187] fix: preserve tray receipt parent compatibility

---
 src/trayhost/TrayTerminalDiagnostic.cs   |  55 +++++-----
 tests/trayhost/TrayHostNativeSelfTest.cs | 127 +++++++++++++++++++----
 2 files changed, 136 insertions(+), 46 deletions(-)

diff --git a/src/trayhost/TrayTerminalDiagnostic.cs b/src/trayhost/TrayTerminalDiagnostic.cs
index 43497af..b1b7774 100644
--- a/src/trayhost/TrayTerminalDiagnostic.cs
+++ b/src/trayhost/TrayTerminalDiagnostic.cs
@@ -30,6 +30,7 @@ private sealed class ReceiptPaths
         internal string LocalRoot;
         internal string Product;
         internal string Logs;
+        internal string ReceiptDirectory;
         internal string Leaf;
     }
 
@@ -157,35 +158,38 @@ private bool TryAppendThroughValidatedHandles(ReceiptPaths paths, byte[] bytes)
         using (SafeFileHandle local = OpenDirectory(paths.LocalRoot))
         {
             if (!IsExpectedDirectory(local, paths.LocalRoot, false)) { return false; }
-            if (!TryCreateChildDirectory(paths.Product)) { return false; }
             using (SafeFileHandle product = OpenDirectory(paths.Product))
             {
-                if (!IsExpectedDirectory(product, paths.Product, true)) { return false; }
-                if (!TryCreateChildDirectory(paths.Logs)) { return false; }
+                if (!IsExpectedDirectory(product, paths.Product, false)) { return false; }
                 using (SafeFileHandle logs = OpenDirectory(paths.Logs))
                 {
-                    if (!IsExpectedDirectory(logs, paths.Logs, true)) { return false; }
-#if TRAYHOST_SELF_TEST
-                    if (_testDirectoryChainOpened != null) { _testDirectoryChainOpened(); }
-#endif
-                    using (SafeFileHandle leaf = CreateFileW(paths.Leaf, GenericRead | GenericWrite | ReadControl, FileShareRead, IntPtr.Zero, OpenAlways, FileFlagOpenReparsePoint | FileFlagWriteThrough, IntPtr.Zero))
+                    if (!IsExpectedDirectory(logs, paths.Logs, false)) { return false; }
+                    if (!TryCreatePrivateReceiptDirectory(paths.ReceiptDirectory)) { return false; }
+                    using (SafeFileHandle receiptDirectory = OpenDirectory(paths.ReceiptDirectory))
                     {
-                        if (!IsExpectedLeaf(leaf, paths.Leaf)) { return false; }
+                        if (!IsExpectedDirectory(receiptDirectory, paths.ReceiptDirectory, true)) { return false; }
 #if TRAYHOST_SELF_TEST
-                        if (_testLeafValidated != null) { _testLeafValidated(); }
+                        if (_testDirectoryChainOpened != null) { _testDirectoryChainOpened(); }
 #endif
-                        using (FileStream stream = new FileStream(leaf, FileAccess.ReadWrite, 4096, false))
+                        using (SafeFileHandle leaf = CreateFileW(paths.Leaf, GenericRead | GenericWrite | ReadControl, FileShareRead, IntPtr.Zero, OpenAlways, FileFlagOpenReparsePoint | FileFlagWriteThrough, IntPtr.Zero))
                         {
-                            long length = stream.Length;
-                            if (length > MaximumBytes || length > MaximumBytes - bytes.LongLength)
+                            if (!IsExpectedLeaf(leaf, paths.Leaf)) { return false; }
+#if TRAYHOST_SELF_TEST
+                            if (_testLeafValidated != null) { _testLeafValidated(); }
+#endif
+                            using (FileStream stream = new FileStream(leaf, FileAccess.ReadWrite, 4096, false))
                             {
-                                stream.SetLength(0L);
-                                stream.Position = 0L;
+                                long length = stream.Length;
+                                if (length > MaximumBytes || length > MaximumBytes - bytes.LongLength)
+                                {
+                                    stream.SetLength(0L);
+                                    stream.Position = 0L;
+                                }
+                                else { stream.Position = length; }
+                                stream.Write(bytes, 0, bytes.Length);
+                                stream.Flush(true);
+                                return true;
                             }
-                            else { stream.Position = length; }
-                            stream.Write(bytes, 0, bytes.Length);
-                            stream.Flush(true);
-                            return true;
                         }
                     }
                 }
@@ -201,11 +205,12 @@ private static bool TryBuildPaths(string localRoot, out ReceiptPaths paths)
         if (String.IsNullOrEmpty(canonicalRoot)) { return false; }
         string product = NormalizePath(Path.Combine(canonicalRoot, "CodexControlOtherDevices"));
         string logs = NormalizePath(Path.Combine(product, "logs"));
-        string leaf = NormalizePath(Path.Combine(logs, "trayhost-actions.log"));
-        if (String.IsNullOrEmpty(product) || String.IsNullOrEmpty(logs) || String.IsNullOrEmpty(leaf)) { return false; }
-        if (!String.Equals(Path.GetDirectoryName(product), canonicalRoot, StringComparison.OrdinalIgnoreCase) || !String.Equals(Path.GetDirectoryName(logs), product, StringComparison.OrdinalIgnoreCase) || !String.Equals(Path.GetDirectoryName(leaf), logs, StringComparison.OrdinalIgnoreCase)) { return false; }
-        if (!String.Equals(Path.GetFileName(product), "CodexControlOtherDevices", StringComparison.Ordinal) || !String.Equals(Path.GetFileName(logs), "logs", StringComparison.Ordinal) || !String.Equals(Path.GetFileName(leaf), "trayhost-actions.log", StringComparison.Ordinal) || Path.GetFileName(leaf).IndexOf(':') >= 0) { return false; }
-        paths = new ReceiptPaths { LocalRoot = canonicalRoot, Product = product, Logs = logs, Leaf = leaf };
+        string receiptDirectory = NormalizePath(Path.Combine(logs, "tray-receipts"));
+        string leaf = NormalizePath(Path.Combine(receiptDirectory, "trayhost-actions.log"));
+        if (String.IsNullOrEmpty(product) || String.IsNullOrEmpty(logs) || String.IsNullOrEmpty(receiptDirectory) || String.IsNullOrEmpty(leaf)) { return false; }
+        if (!String.Equals(Path.GetDirectoryName(product), canonicalRoot, StringComparison.OrdinalIgnoreCase) || !String.Equals(Path.GetDirectoryName(logs), product, StringComparison.OrdinalIgnoreCase) || !String.Equals(Path.GetDirectoryName(receiptDirectory), logs, StringComparison.OrdinalIgnoreCase) || !String.Equals(Path.GetDirectoryName(leaf), receiptDirectory, StringComparison.OrdinalIgnoreCase)) { return false; }
+        if (!String.Equals(Path.GetFileName(product), "CodexControlOtherDevices", StringComparison.Ordinal) || !String.Equals(Path.GetFileName(logs), "logs", StringComparison.Ordinal) || !String.Equals(Path.GetFileName(receiptDirectory), "tray-receipts", StringComparison.Ordinal) || !String.Equals(Path.GetFileName(leaf), "trayhost-actions.log", StringComparison.Ordinal) || Path.GetFileName(leaf).IndexOf(':') >= 0) { return false; }
+        paths = new ReceiptPaths { LocalRoot = canonicalRoot, Product = product, Logs = logs, ReceiptDirectory = receiptDirectory, Leaf = leaf };
         return true;
     }
 
@@ -221,7 +226,7 @@ private static string NormalizePath(string path)
         catch { return null; }
     }
 
-    private static bool TryCreateChildDirectory(string path)
+    private static bool TryCreatePrivateReceiptDirectory(string path)
     {
         try
         {
diff --git a/tests/trayhost/TrayHostNativeSelfTest.cs b/tests/trayhost/TrayHostNativeSelfTest.cs
index 316ea72..42298dc 100644
--- a/tests/trayhost/TrayHostNativeSelfTest.cs
+++ b/tests/trayhost/TrayHostNativeSelfTest.cs
@@ -60,9 +60,59 @@ internal static class TrayHostNativeSelfTest
     private static void AssertTrue(bool value, string message) { if (!value) { throw new InvalidOperationException(message); } }
     private static void AssertEqual(string expected, string actual, string message) { if (!String.Equals(expected, actual, StringComparison.Ordinal)) { throw new InvalidOperationException(message + " expected=[" + expected + "] actual=[" + actual + "]"); } }
 
+    private static string ProductPath(string root)
+    {
+        return Path.Combine(root, "CodexControlOtherDevices");
+    }
+
+    private static string LogsPath(string root)
+    {
+        return Path.Combine(ProductPath(root), "logs");
+    }
+
+    private static string ReceiptDirectoryPath(string root)
+    {
+        return Path.Combine(LogsPath(root), "tray-receipts");
+    }
+
     private static string ReceiptPath(string root)
     {
-        return Path.Combine(root, "CodexControlOtherDevices", "logs", "trayhost-actions.log");
+        return Path.Combine(ReceiptDirectoryPath(root), "trayhost-actions.log");
+    }
+
+    private static string LegacyReceiptPath(string root)
+    {
+        return Path.Combine(LogsPath(root), "trayhost-actions.log");
+    }
+
+    private static void CreateCompatibilityParents(string root)
+    {
+        Directory.CreateDirectory(LogsPath(root));
+    }
+
+    private static void AssertPrivateReceiptDirectory(string path)
+    {
+        DirectorySecurity security = Directory.GetAccessControl(path);
+        SecurityIdentifier owner = security.GetOwner(typeof(SecurityIdentifier)) as SecurityIdentifier;
+        SecurityIdentifier current;
+        using (WindowsIdentity identity = WindowsIdentity.GetCurrent()) { current = identity.User; }
+        AssertTrue(security.AreAccessRulesProtected && owner != null && current != null && String.Equals(owner.Value, current.Value, StringComparison.Ordinal), "receipt child has a protected current-user owner/DACL");
+        HashSet<string> expected = new HashSet<string>(StringComparer.Ordinal) {
+            current.Value,
+            new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null).Value,
+            new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null).Value
+        };
+        HashSet<string> seen = new HashSet<string>(StringComparer.Ordinal);
+        AuthorizationRuleCollection rules = security.GetAccessRules(true, false, typeof(SecurityIdentifier));
+        AssertTrue(rules.Count == 3, "receipt child DACL contains exactly three explicit rules");
+        foreach (FileSystemAccessRule rule in rules)
+        {
+            SecurityIdentifier sid = rule.IdentityReference as SecurityIdentifier;
+            AssertTrue(sid != null && expected.Contains(sid.Value) && seen.Add(sid.Value), "receipt child DACL contains only current-user, SYSTEM, and Administrators rules");
+            AssertTrue(rule.AccessControlType == AccessControlType.Allow && rule.FileSystemRights == FileSystemRights.FullControl, "receipt child principals receive exact full control");
+            AssertTrue(rule.InheritanceFlags == (InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit) && rule.PropagationFlags == PropagationFlags.None, "receipt child private rules inherit to its fixed leaf");
+        }
+        AssertTrue(seen.Count == expected.Count, "receipt child DACL proves every required principal");
     }
 
     private static TrayTerminalDiagnosticStore TestStore(string root, Action directoryChainOpened, Action leafValidated)
@@ -258,6 +308,7 @@ private static void TestTerminalDiagnosticLogIsSanitizedAndReportsPersistence()
     {
         string root = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-" + Guid.NewGuid().ToString("N"));
         Directory.CreateDirectory(root);
+        CreateCompatibilityParents(root);
         string path = ReceiptPath(root);
         try
         {
@@ -270,36 +321,69 @@ private static void TestTerminalDiagnosticLogIsSanitizedAndReportsPersistence()
             AssertTrue(Convert.ToBase64String(expected) == Convert.ToBase64String(File.ReadAllBytes(path)), "terminal diagnostic file is exact UTF-8 without a BOM and contains only approved fields");
             string defaultPath;
             AssertTrue(TrayTerminalDiagnosticStore.TryGetDefaultPath(out defaultPath), "fixed production receipt path resolves");
-            string expectedDefaultPath = Path.GetFullPath(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "CodexControlOtherDevices", "logs", "trayhost-actions.log"));
+            string expectedDefaultPath = Path.GetFullPath(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "CodexControlOtherDevices", "logs", "tray-receipts", "trayhost-actions.log"));
             AssertTrue(String.Equals(expectedDefaultPath, defaultPath, StringComparison.OrdinalIgnoreCase), "production receipt path is fixed to the current user's exact LocalApplicationData leaf");
         }
         finally { try { Directory.Delete(root, true); } catch { } }
     }
 
+    private static void TestTerminalDiagnosticStoreSupportsInheritedCompatibilityParentsAndCreatesPrivateChild()
+    {
+        string root = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-compat-" + Guid.NewGuid().ToString("N"));
+        string product = ProductPath(root); string logs = LogsPath(root); string receiptDirectory = ReceiptDirectoryPath(root);
+        string path = ReceiptPath(root); string legacyPath = LegacyReceiptPath(root);
+        byte[] legacySentinel = new byte[] { 0x42, 0x31, 0x37, 0x29 };
+        Directory.CreateDirectory(root); CreateCompatibilityParents(root); File.WriteAllBytes(legacyPath, legacySentinel);
+        try
+        {
+            AssertTrue(!Directory.GetAccessControl(product).AreAccessRulesProtected && !Directory.GetAccessControl(logs).AreAccessRulesProtected, "supported existing product/logs parents retain inherited ACLs");
+            TrayTerminalDiagnostic record = new TrayTerminalDiagnostic(TrayCommand.OpenLogs, 24UL, TrayActionResultStatus.Rejected, "CCOD_TRAY_ACTION_STALE");
+            using (TrayTerminalDiagnosticStore store = TestStore(root, null, null))
+            {
+                AssertTrue(store.TryAppendDurably(record), "inherited supported parents accept a durable receipt in the dedicated private child");
+            }
+            AssertPrivateReceiptDirectory(receiptDirectory);
+            byte[] expected = ReceiptBytes(TrayCommand.OpenLogs, 24UL, TrayActionResultStatus.Rejected, "CCOD_TRAY_ACTION_STALE");
+            AssertTrue(Convert.ToBase64String(expected) == Convert.ToBase64String(File.ReadAllBytes(path)), "compatible parent flow writes only the fixed dedicated receipt leaf");
+            AssertTrue(Convert.ToBase64String(legacySentinel) == Convert.ToBase64String(File.ReadAllBytes(legacyPath)), "legacy direct logs receipt leaf remains byte-identical and is never reused");
+        }
+        finally { try { Directory.Delete(root, true); } catch { } }
+    }
+
     private static void TestTerminalDiagnosticStoreRejectsUnsafeObjectsAndProtectsOutsideSentinel()
     {
         string root = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-unsafe-" + Guid.NewGuid().ToString("N"));
         string outside = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-outside-" + Guid.NewGuid().ToString("N"));
         string outsideSentinel = Path.Combine(outside, "trayhost-actions.log");
         string path = ReceiptPath(root);
-        string logs = Path.GetDirectoryName(path);
+        string receiptDirectory = ReceiptDirectoryPath(root);
+        string logs = LogsPath(root);
         byte[] sentinel = new byte[] { 0x10, 0x22, 0x34, 0x46, 0x58, 0x6a };
-        Directory.CreateDirectory(root); Directory.CreateDirectory(outside); File.WriteAllBytes(outsideSentinel, sentinel);
+        Directory.CreateDirectory(root); CreateCompatibilityParents(root); Directory.CreateDirectory(outside); File.WriteAllBytes(outsideSentinel, sentinel);
         try
         {
             TrayTerminalDiagnostic record = new TrayTerminalDiagnostic(TrayCommand.OpenLogs, 1UL, TrayActionResultStatus.Rejected, "CCOD_TRAY_ACTION_STALE");
             using (TrayTerminalDiagnosticStore bootstrap = TestStore(root, null, null)) { AssertTrue(bootstrap.TryAppendDurably(record), "safe receipt directories are bootstrapped"); }
-            File.Delete(path); Directory.Delete(logs);
+            File.Delete(path); Directory.Delete(receiptDirectory);
 
+            Directory.Delete(logs);
             CreateJunction(logs, outside);
+            using (TrayTerminalDiagnosticStore reparseParent = TestStore(root, null, null))
+            {
+                AssertTrue(!reparseParent.TryAppendDurably(record), "a reparse compatibility logs parent is rejected before writing");
+            }
+            AssertTrue(Convert.ToBase64String(sentinel) == Convert.ToBase64String(File.ReadAllBytes(outsideSentinel)), "reparse compatibility parent cannot alter the outside sentinel");
+            DeleteJunction(logs); CreateCompatibilityParents(root);
+
+            CreateJunction(receiptDirectory, outside);
             using (TrayTerminalDiagnosticStore reparseDirectory = TestStore(root, null, null))
             {
-                AssertTrue(!reparseDirectory.TryAppendDurably(record), "a reparse logs directory is rejected before writing");
+                AssertTrue(!reparseDirectory.TryAppendDurably(record), "a reparse private receipt directory is rejected before writing");
             }
-            AssertTrue(Convert.ToBase64String(sentinel) == Convert.ToBase64String(File.ReadAllBytes(outsideSentinel)), "reparse directory cannot alter the outside sentinel");
-            DeleteJunction(logs);
+            AssertTrue(Convert.ToBase64String(sentinel) == Convert.ToBase64String(File.ReadAllBytes(outsideSentinel)), "reparse receipt directory cannot alter the outside sentinel");
+            DeleteJunction(receiptDirectory);
 
-            using (TrayTerminalDiagnosticStore restore = TestStore(root, null, null)) { AssertTrue(restore.TryAppendDurably(record), "safe logs directory is restored for leaf tests"); }
+            using (TrayTerminalDiagnosticStore restore = TestStore(root, null, null)) { AssertTrue(restore.TryAppendDurably(record), "safe private receipt directory is restored for leaf tests"); }
             File.Delete(path);
             CreateJunction(path, outside);
             using (TrayTerminalDiagnosticStore reparseLeaf = TestStore(root, null, null))
@@ -317,19 +401,19 @@ private static void TestTerminalDiagnosticStoreRejectsUnsafeObjectsAndProtectsOu
             AssertTrue(Convert.ToBase64String(sentinel) == Convert.ToBase64String(File.ReadAllBytes(outsideSentinel)), "hard-link leaf cannot alter the outside sentinel");
             File.Delete(path);
 
-            DirectorySecurity unsafeSecurity = Directory.GetAccessControl(logs);
+            DirectorySecurity unsafeSecurity = Directory.GetAccessControl(receiptDirectory);
             unsafeSecurity.AddAccessRule(new FileSystemAccessRule(new SecurityIdentifier(WellKnownSidType.WorldSid, null), FileSystemRights.FullControl, InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit, PropagationFlags.None, AccessControlType.Allow));
-            Directory.SetAccessControl(logs, unsafeSecurity);
+            Directory.SetAccessControl(receiptDirectory, unsafeSecurity);
             using (TrayTerminalDiagnosticStore unsafeAcl = TestStore(root, null, null))
             {
-                AssertTrue(!unsafeAcl.TryAppendDurably(record), "an unexpected logs DACL is rejected before writing");
+                AssertTrue(!unsafeAcl.TryAppendDurably(record), "an unexpected private receipt-child DACL is rejected before writing");
             }
-            AssertTrue(!File.Exists(path), "unsafe directory ACL cannot create or write the receipt leaf");
-            AssertTrue(Convert.ToBase64String(sentinel) == Convert.ToBase64String(File.ReadAllBytes(outsideSentinel)), "unsafe directory ACL cannot alter the outside sentinel");
+            AssertTrue(!File.Exists(path), "unsafe receipt-child ACL cannot create or write the receipt leaf");
+            AssertTrue(Convert.ToBase64String(sentinel) == Convert.ToBase64String(File.ReadAllBytes(outsideSentinel)), "unsafe receipt-child ACL cannot alter the outside sentinel");
         }
         finally
         {
-            DeleteJunction(path); DeleteJunction(logs);
+            DeleteJunction(path); DeleteJunction(receiptDirectory); DeleteJunction(logs);
             try { Directory.Delete(root, true); } catch { }
             try { Directory.Delete(outside, true); } catch { }
         }
@@ -339,11 +423,11 @@ private static void TestTerminalDiagnosticStorePinsDirectoryChainAgainstReplacem
     {
         string root = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-pin-" + Guid.NewGuid().ToString("N"));
         string outside = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-pin-outside-" + Guid.NewGuid().ToString("N"));
-        string path = ReceiptPath(root); string logs = Path.GetDirectoryName(path); string displaced = logs + ".displaced";
+        string path = ReceiptPath(root); string logs = LogsPath(root); string displaced = logs + ".displaced";
         string outsideSentinel = Path.Combine(outside, "trayhost-actions.log");
         byte[] sentinel = new byte[] { 0x71, 0x72, 0x73, 0x74, 0x75 };
         bool barrierEntered = false; bool replacementSucceeded = false;
-        Directory.CreateDirectory(root); Directory.CreateDirectory(outside); File.WriteAllBytes(outsideSentinel, sentinel);
+        Directory.CreateDirectory(root); CreateCompatibilityParents(root); Directory.CreateDirectory(outside); File.WriteAllBytes(outsideSentinel, sentinel);
         try
         {
             TrayTerminalDiagnostic record = new TrayTerminalDiagnostic(TrayCommand.OpenLogs, 2UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED");
@@ -376,7 +460,7 @@ private static void TestTerminalDiagnosticStorePinsDirectoryChainAgainstReplacem
     private static void TestTerminalDiagnosticStoreRejectsConcurrentWriter()
     {
         string root = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-share-" + Guid.NewGuid().ToString("N"));
-        Directory.CreateDirectory(root);
+        Directory.CreateDirectory(root); CreateCompatibilityParents(root);
         ManualResetEvent leafValidated = new ManualResetEvent(false); ManualResetEvent release = new ManualResetEvent(false);
         bool firstResult = false;
         try
@@ -402,7 +486,7 @@ private static void TestTerminalDiagnosticStoreRejectsConcurrentWriter()
     private static void TestTerminalDiagnosticStoreRejectsDirectoryLeafWithoutWriting()
     {
         string root = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-directory-leaf-" + Guid.NewGuid().ToString("N"));
-        Directory.CreateDirectory(root); string path = ReceiptPath(root);
+        Directory.CreateDirectory(root); CreateCompatibilityParents(root); string path = ReceiptPath(root);
         try
         {
             TrayTerminalDiagnostic record = new TrayTerminalDiagnostic(TrayCommand.OpenLogs, 5UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED");
@@ -420,7 +504,7 @@ private static void TestTerminalDiagnosticStoreRejectsDirectoryLeafWithoutWritin
     private static void TestTerminalDiagnosticStoreIsBoundedThroughValidatedHandle()
     {
         string root = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-bound-" + Guid.NewGuid().ToString("N"));
-        Directory.CreateDirectory(root); string path = ReceiptPath(root);
+        Directory.CreateDirectory(root); CreateCompatibilityParents(root); string path = ReceiptPath(root);
         try
         {
             TrayTerminalDiagnostic first = new TrayTerminalDiagnostic(TrayCommand.OpenLogs, 41UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED");
@@ -527,6 +611,7 @@ public static int Main(string[] args)
             TestAboutCommandDefersProofToSupervisor();
             TestVerifiedAboutUsesTheAcknowledgedSnapshotVersion();
             TestActionFailureUsesTheAcknowledgedSnapshotStrings();
+            TestTerminalDiagnosticStoreSupportsInheritedCompatibilityParentsAndCreatesPrivateChild();
             TestTerminalDiagnosticLogIsSanitizedAndReportsPersistence();
             TestTerminalDiagnosticStoreRejectsUnsafeObjectsAndProtectsOutsideSentinel();
             TestTerminalDiagnosticStorePinsDirectoryChainAgainstReplacement();
@@ -538,7 +623,7 @@ public static int Main(string[] args)
             TestShellRightClickNotificationMapping();
             TestRealNativePInvokeSurface();
             TestPostedWorkMessageDispatchesToItsOwnerWindow();
-            Console.WriteLine("TrayHost native self-tests passed: 21");
+            Console.WriteLine("TrayHost native self-tests passed: 22");
             return 0;
         }
         catch (Exception error)

From 6cdbcdbcc77d504c7debdbb95dca0ce5db33d9a2 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 09:24:55 +0800
Subject: [PATCH 030/187] docs: record tray receipt compatibility fix

---
 .../task-1-report.md                          | 82 +++++++++++++++++++
 1 file changed, 82 insertions(+)

diff --git a/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-1-report.md b/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-1-report.md
index 90d935c..4c9448c 100644
--- a/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-1-report.md
+++ b/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-1-report.md
@@ -219,3 +219,85 @@ Exit `0`; only Git's existing LF-to-CRLF conversion notices were printed.
 - No installer, installed Codex process, real tray UI, push, release, or public
   operation was run. Release-wide and real-machine acceptance remain outside
   Task 1.
+
+## Fix round 1/5: inherited compatibility parents
+
+Review finding: the first implementation required the existing product and
+`logs` directories to have the protected receipt-private ACL. Supported
+current and legacy installations create those parents with normal inherited
+ACLs, so production receipt writes returned `false` before opening a leaf.
+
+### Compatibility ruling and implementation
+
+- The fixed production leaf moved from the legacy direct path to
+  `%LOCALAPPDATA%\CodexControlOtherDevices\logs\tray-receipts\trayhost-actions.log`.
+- LocalAppData, product, and `logs` remain pinned compatibility parents. Their
+  actual opened handles must still prove disk-directory type, non-reparse
+  attributes, and the exact final path, and the handles continue to deny
+  delete sharing while the receipt child and leaf are opened and written.
+- The store no longer creates product or `logs`; supported installation/runtime
+  setup remains responsible for those parents. A missing, wrong-type,
+  reparse-point, or unqueryable parent fails closed.
+- Only the fixed `logs\tray-receipts` child is created with the protected
+  current-user/SYSTEM/Administrators ACL. Its reopened native handle must pass
+  the strict owner/DACL, non-reparse, type, and final-path checks. An existing
+  arbitrary or broadened child remains rejected and is never repaired.
+- The direct legacy `logs\trayhost-actions.log` leaf is never opened, reused,
+  truncated, or written.
+
+### RED evidence
+
+The compatibility test precreated product and `logs` with normal inherited
+ACLs, asserted `AreAccessRulesProtected == false`, placed a byte sentinel in
+the legacy direct leaf, and requested a durable receipt. Before the production
+fix, this command exited `1`:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -NativeOnly
+```
+
+Exact decisive output:
+
+```text
+TrayHost native self-test failed: System.InvalidOperationException
+inherited supported parents accept a durable receipt in the dedicated private child
+CCOD_TRAYHOST_NATIVE_TEST_FAILED
+```
+
+This is the reviewed compatibility defect: the old store rejected supported
+inherited parents before it could create a safe receipt boundary.
+
+### GREEN and regression evidence
+
+After the change, the compatibility test proves durable success, exact private
+ACL creation on `tray-receipts`, exact UTF-8 content in the new leaf, and
+byte-identical retention of the direct legacy leaf. Existing negative coverage
+was retained or moved to the correct boundary: reparse compatibility parent,
+reparse receipt child, reparse/directory/hard-link leaf, broadened receipt-child
+ACL, concurrent writer, replacement barrier/outside sentinel, and exact or
+crossing 64-KiB rollover.
+
+Fresh pre-commit commands and results:
+
+```text
+NativeOnly:       exit 0, TrayHost native self-tests passed: 22
+ProductionOnly:   exit 0, headless compile/run emitted no output
+TransportOnly:    exit 0, TrayHost transport self-tests passed: 10
+ProtocolOnly:     exit 0, TrayHost protocol self-tests passed: 11
+ParentClientOnly: exit 0, TrayHost parent-client self-tests passed: 4
+Production trace:          TrayHost production correlation trace passed: 2
+git diff --check: exit 0 (only repository LF-to-CRLF notices)
+```
+
+The ParentClient command again emitted the repository's existing unapproved-
+verbs warning for `TrayHostClient`; this fix did not modify that module.
+
+### Fix-round commit and remaining boundary
+
+- `f207496df1ceee744a09bbc5c3d24a48695e58bc` —
+  `fix: preserve tray receipt parent compatibility`
+
+Task 1 now supports the inherited parent ACLs created by existing
+installations while retaining a dedicated fail-closed private receipt child.
+The asynchronous/non-blocking sink remains Task 2. No installer, installed
+process, real UI, release, push, or public operation was run in this fix round.

From 7549dde154fd6c2430a13aa9ddcf66698560f717 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 09:59:03 +0800
Subject: [PATCH 031/187] fix: isolate tray terminal receipt writes

---
 src/trayhost/HostTransport.cs                 |  94 +++-
 src/trayhost/Program.cs                       |  17 +-
 src/trayhost/TrayTerminalReceiptSink.cs       | 168 +++++++
 tests/trayhost/Invoke-TrayHostSelfTest.ps1    |   1 +
 tests/trayhost/TrayHostNativeSelfTest.cs      |  32 +-
 .../trayhost/TrayHostParentClientSelfTest.cs  |  13 +-
 tests/trayhost/TrayHostTransportSelfTest.cs   | 428 +++++++++++++-----
 7 files changed, 619 insertions(+), 134 deletions(-)
 create mode 100644 src/trayhost/TrayTerminalReceiptSink.cs

diff --git a/src/trayhost/HostTransport.cs b/src/trayhost/HostTransport.cs
index be636aa..25d405b 100644
--- a/src/trayhost/HostTransport.cs
+++ b/src/trayhost/HostTransport.cs
@@ -11,28 +11,23 @@ private sealed class PendingAction
 
     private readonly object _gate = new object();
     private readonly Action _presentationReady;
-    private readonly Func<TrayTerminalDiagnostic, bool> _writeTerminalDiagnostic;
     private readonly Queue<TrayActionResult> _completedAbout = new Queue<TrayActionResult>();
     private readonly Queue<TrayActionResult> _failedActions = new Queue<TrayActionResult>();
     private readonly Dictionary<Guid, PendingAction> _pendingActions = new Dictionary<Guid, PendingAction>();
     private readonly Queue<Guid> _recentActionOrder = new Queue<Guid>();
     private readonly HashSet<Guid> _recentActions = new HashSet<Guid>();
     private PresentationSnapshot _pendingPresentation;
+    private int _uiWorkCount;
     private bool _menuOpen;
     private bool _disposed;
 
-    internal HostTransport() : this(null, null)
+    internal HostTransport() : this(null)
     {
     }
 
-    internal HostTransport(Action presentationReady) : this(presentationReady, null)
-    {
-    }
-
-    internal HostTransport(Action presentationReady, Func<TrayTerminalDiagnostic, bool> writeTerminalDiagnostic)
+    internal HostTransport(Action presentationReady)
     {
         _presentationReady = presentationReady;
-        _writeTerminalDiagnostic = writeTerminalDiagnostic;
     }
 
     internal void SetMenuOpen(bool value)
@@ -87,14 +82,14 @@ internal bool TryRegisterAction(TrayHostAction action)
         }
     }
 
-    internal bool TryAcknowledgeAction(TrayActionResult result)
+    internal bool TryAcknowledgeAction(TrayActionResult result, out TrayTerminalReceipt receipt)
     {
+        receipt = null;
         if (result == null) { return false; }
-        PendingAction pending;
-        TrayTerminalDiagnostic diagnostic;
         lock (_gate)
         {
             if (_disposed) { return false; }
+            PendingAction pending;
             if (!_pendingActions.TryGetValue(result.ActionId, out pending) || pending.Action.Revision != result.Revision) { return false; }
             if (result.Status == TrayActionResultStatus.Accepted)
             {
@@ -104,22 +99,70 @@ internal bool TryAcknowledgeAction(TrayActionResult result)
             }
             if (result.Status != TrayActionResultStatus.Completed && result.Status != TrayActionResultStatus.Rejected && result.Status != TrayActionResultStatus.Failed) { return false; }
             if (result.Status == TrayActionResultStatus.Completed && TrayCommandPolicy.RequiresAcceptedBeforeCompleted(pending.Action.Command) && !pending.Accepted) { return false; }
-            diagnostic = new TrayTerminalDiagnostic(pending.Action.Command, result.Revision, result.Status, result.ErrorCode);
+            receipt = new TrayTerminalReceipt(this, pending.Action.Command, result);
             _pendingActions.Remove(result.ActionId);
+            return true;
+        }
+    }
+
+    internal bool TryPublishDurableReceipt(TrayTerminalReceipt receipt)
+    {
+        if (receipt == null) { return false; }
+        bool notify = false;
+        bool accepted = false;
+        lock (_gate)
+        {
+            if (_disposed || !receipt.TryClaimPublication(this)) { return false; }
+            TrayActionResult result = receipt.Result;
+            if (result.Status == TrayActionResultStatus.Completed && receipt.Command == TrayCommand.ShowAbout)
+            {
+                if (_uiWorkCount >= 8) { return false; }
+                _completedAbout.Enqueue(result);
+                _uiWorkCount++;
+                notify = true;
+                accepted = true;
+            }
+            else if (result.Status == TrayActionResultStatus.Rejected || result.Status == TrayActionResultStatus.Failed)
+            {
+                if (_uiWorkCount >= 8) { return false; }
+                _failedActions.Enqueue(result);
+                _uiWorkCount++;
+                notify = true;
+                accepted = true;
+            }
+            else
+            {
+                accepted = true;
+            }
         }
-        bool recorded = false;
-        Func<TrayTerminalDiagnostic, bool> writer = _writeTerminalDiagnostic;
-        if (writer != null)
+        Action presentationReady = _presentationReady;
+        if (notify && presentationReady != null)
         {
-            try { recorded = writer(diagnostic); }
-            catch { recorded = false; }
+            try { presentationReady(); }
+            catch
+            {
+                DropUiWork(receipt.Result);
+                return false;
+            }
         }
+        return accepted;
+    }
+
+    private void DropUiWork(TrayActionResult target)
+    {
+        if (target == null) { return; }
         lock (_gate)
         {
-            if (_disposed) { return true; }
-            if (recorded && result.Status == TrayActionResultStatus.Completed && pending.Action.Command == TrayCommand.ShowAbout) { _completedAbout.Enqueue(result); }
-            if (recorded && (result.Status == TrayActionResultStatus.Rejected || result.Status == TrayActionResultStatus.Failed) && _failedActions.Count < 8) { _failedActions.Enqueue(result); }
-            return true;
+            Queue<TrayActionResult> queue = target.Status == TrayActionResultStatus.Completed ? _completedAbout : _failedActions;
+            int count = queue.Count;
+            bool removed = false;
+            for (int index = 0; index < count; index++)
+            {
+                TrayActionResult current = queue.Dequeue();
+                if (!removed && Object.ReferenceEquals(current, target)) { removed = true; }
+                else { queue.Enqueue(current); }
+            }
+            if (removed && _uiWorkCount > 0) { _uiWorkCount--; }
         }
     }
 
@@ -128,7 +171,9 @@ internal bool TryTakeCompletedAbout(out TrayActionResult result)
         lock (_gate)
         {
             if (_completedAbout.Count == 0) { result = null; return false; }
-            result = _completedAbout.Dequeue(); return true;
+            result = _completedAbout.Dequeue();
+            if (_uiWorkCount > 0) { _uiWorkCount--; }
+            return true;
         }
     }
 
@@ -137,7 +182,9 @@ internal bool TryTakeFailedAction(out TrayActionResult result)
         lock (_gate)
         {
             if (_failedActions.Count == 0) { result = null; return false; }
-            result = _failedActions.Dequeue(); return true;
+            result = _failedActions.Dequeue();
+            if (_uiWorkCount > 0) { _uiWorkCount--; }
+            return true;
         }
     }
 
@@ -149,6 +196,7 @@ public void Dispose()
             _disposed = true;
             _completedAbout.Clear();
             _failedActions.Clear();
+            _uiWorkCount = 0;
             _pendingActions.Clear();
             _recentActions.Clear();
             _recentActionOrder.Clear();
diff --git a/src/trayhost/Program.cs b/src/trayhost/Program.cs
index 895c118..2cdaed1 100644
--- a/src/trayhost/Program.cs
+++ b/src/trayhost/Program.cs
@@ -40,7 +40,8 @@ private static int RunChild(string[] args)
         Win32TrayPlatform platform = new Win32TrayPlatform();
         TrayHostApplication application = null;
         TrayTerminalDiagnosticStore terminalStore = new TrayTerminalDiagnosticStore();
-        HostTransport transport = new HostTransport(delegate { TrayHostApplication current = application; if (current != null) { current.PostWork(); } }, delegate(TrayTerminalDiagnostic record) { return terminalStore.TryAppendDurably(record); });
+        HostTransport transport = new HostTransport(delegate { TrayHostApplication current = application; if (current != null) { current.PostWork(); } });
+        TrayTerminalReceiptSink receiptSink = new TrayTerminalReceiptSink(terminalStore.TryAppendDurably, transport.TryPublishDurableReceipt, terminalStore.Dispose);
         TrayWindow window = new TrayWindow(platform, transport.SetMenuOpen);
         bool shutdownRequested = false; bool shutdownSent = false; object stateGate = new object();
         Action<TrayCommand, ulong> command = delegate(TrayCommand selected, ulong revision)
@@ -90,7 +91,7 @@ private static int RunChild(string[] args)
                 {
                     ProtocolFrame frame = ProtocolCodec.ReadAuthenticated(input, ProtocolDirection.ParentToHost, epoch, inboundSequence++, keys.ParentToHost);
                     if (frame.MessageType == TrayHostMessageType.Presentation) { transport.TryAcceptPresentation(TrayHostWire.ReadPresentation(frame.Payload)); application.PostWork(); }
-                    else if (frame.MessageType == TrayHostMessageType.ActionResult) { if (!TryDispatchAuthenticatedActionResult(transport, frame.Payload)) { throw new ProtocolViolationException("action result is uncorrelated"); } application.PostWork(); }
+                    else if (frame.MessageType == TrayHostMessageType.ActionResult) { if (!TryDispatchAuthenticatedActionResult(transport, receiptSink, frame.Payload)) { throw new ProtocolViolationException("action result is uncorrelated"); } }
                     else if (frame.MessageType == TrayHostMessageType.Shutdown) { lock (stateGate) { shutdownRequested = true; } application.PostWork(); }
                     else if (frame.MessageType == TrayHostMessageType.Ping) { lock (WriteGate) { ProtocolCodec.WriteAuthenticated(output, ProtocolFrame.Authenticated(ProtocolDirection.HostToParent, TrayHostMessageType.Pong, epoch, outboundSequence++, frame.Payload), keys.HostToParent); } }
                 }
@@ -99,7 +100,7 @@ private static int RunChild(string[] args)
         })) { IsBackground = true, Name = "CodexRemote.TrayHost.Reader" };
         reader.Start();
         int result = application.Run();
-        application.Dispose(); transport.Dispose(); terminalStore.Dispose(); return result;
+        receiptSink.Dispose(); application.Dispose(); transport.Dispose(); return result;
     }
 
     private static bool VerifyParentIdentity(int pid, long creation)
@@ -107,10 +108,16 @@ private static bool VerifyParentIdentity(int pid, long creation)
         try { using (Process process = Process.GetProcessById(pid)) { return process.StartTime.ToFileTimeUtc() == creation; } } catch { return false; }
     }
 
-    internal static bool TryDispatchAuthenticatedActionResult(HostTransport transport, byte[] payload)
+    internal static bool TryDispatchAuthenticatedActionResult(HostTransport transport, TrayTerminalReceiptSink receiptSink, byte[] payload)
     {
         if (transport == null || payload == null) { return false; }
-        return transport.TryAcknowledgeAction(TrayHostWire.ReadActionResult(payload));
+        TrayTerminalReceipt receipt;
+        if (!transport.TryAcknowledgeAction(TrayHostWire.ReadActionResult(payload), out receipt)) { return false; }
+        if (receipt != null && receiptSink != null)
+        {
+            try { receiptSink.TrySubmit(receipt); } catch { }
+        }
+        return true;
     }
 
     private static int RunHeadlessSmoke()
diff --git a/src/trayhost/TrayTerminalReceiptSink.cs b/src/trayhost/TrayTerminalReceiptSink.cs
new file mode 100644
index 0000000..c9b5f1c
--- /dev/null
+++ b/src/trayhost/TrayTerminalReceiptSink.cs
@@ -0,0 +1,168 @@
+using System;
+using System.Collections.Generic;
+using System.Threading;
+
+internal sealed class TrayTerminalReceipt
+{
+    private readonly object _authority;
+    private int _publicationClaimed;
+
+    internal TrayTerminalReceipt(object authority, TrayCommand command, TrayActionResult result)
+    {
+        if (authority == null) { throw new ArgumentNullException("authority"); }
+        if (!TrayCommandPolicy.IsWireCommand(command) || result == null || result.Status == TrayActionResultStatus.Accepted) { throw new ArgumentException("terminal receipt is invalid"); }
+        _authority = authority;
+        Command = command;
+        Result = result;
+        Diagnostic = new TrayTerminalDiagnostic(command, result.Revision, result.Status, result.ErrorCode);
+    }
+
+    internal TrayCommand Command { get; private set; }
+    internal TrayActionResult Result { get; private set; }
+    internal TrayTerminalDiagnostic Diagnostic { get; private set; }
+
+    internal bool TryClaimPublication(object authority)
+    {
+        return Object.ReferenceEquals(_authority, authority) && Interlocked.CompareExchange(ref _publicationClaimed, 1, 0) == 0;
+    }
+}
+
+internal sealed class TrayTerminalReceiptSink : IDisposable
+{
+    internal const int MaximumOutstanding = 8;
+    private const int DisposeJoinMilliseconds = 100;
+    private readonly object _gate = new object();
+    private readonly Queue<TrayTerminalReceipt> _pending = new Queue<TrayTerminalReceipt>();
+    private readonly AutoResetEvent _available = new AutoResetEvent(false);
+    private readonly Func<TrayTerminalDiagnostic, bool> _writeDurably;
+    private readonly Func<TrayTerminalReceipt, bool> _publishDurable;
+    private readonly Action _disposeStore;
+    private readonly Thread _writer;
+    private int _outstanding;
+    private int _cleanupStarted;
+    private bool _writerStarted;
+    private bool _closed;
+
+    internal TrayTerminalReceiptSink(Func<TrayTerminalDiagnostic, bool> writeDurably, Func<TrayTerminalReceipt, bool> publishDurable)
+        : this(writeDurably, publishDurable, null)
+    {
+    }
+
+    internal TrayTerminalReceiptSink(Func<TrayTerminalDiagnostic, bool> writeDurably, Func<TrayTerminalReceipt, bool> publishDurable, Action disposeStore)
+    {
+        _writeDurably = writeDurably;
+        _publishDurable = publishDurable;
+        _disposeStore = disposeStore;
+        if (_writeDurably == null || _publishDurable == null) { _closed = true; return; }
+        try
+        {
+            _writer = new Thread(new ThreadStart(WriterMain)) { IsBackground = true, Name = "CodexRemote.TrayHost.ReceiptWriter" };
+            _writer.Start();
+            _writerStarted = true;
+        }
+        catch { _closed = true; }
+    }
+
+    internal bool TrySubmit(TrayTerminalReceipt receipt)
+    {
+        if (receipt == null || !Monitor.TryEnter(_gate)) { return false; }
+        try
+        {
+            if (_closed || _outstanding >= MaximumOutstanding) { return false; }
+            try { _available.Set(); }
+            catch { return false; }
+            try
+            {
+                _pending.Enqueue(receipt);
+                _outstanding++;
+                return true;
+            }
+            catch { return false; }
+        }
+        finally { Monitor.Exit(_gate); }
+    }
+
+    public void Dispose()
+    {
+        Thread writer;
+        lock (_gate)
+        {
+            if (_closed)
+            {
+                writer = _writer;
+            }
+            else
+            {
+                _closed = true;
+                _pending.Clear();
+                _outstanding = 0;
+                writer = _writer;
+                try { _available.Set(); } catch { }
+            }
+        }
+        if (writer == null || !_writerStarted) { CleanupAfterWriter(); return; }
+        if (Object.ReferenceEquals(writer, Thread.CurrentThread)) { return; }
+        bool stopped = false;
+        try { stopped = writer.Join(DisposeJoinMilliseconds); } catch { }
+        if (stopped) { CleanupAfterWriter(); }
+    }
+
+    private void WriterMain()
+    {
+        try
+        {
+            while (true)
+            {
+                TrayTerminalReceipt receipt = null;
+                lock (_gate)
+                {
+                    if (_closed) { return; }
+                    if (_pending.Count != 0) { receipt = _pending.Dequeue(); }
+                }
+                if (receipt == null)
+                {
+                    try { _available.WaitOne(); }
+                    catch { return; }
+                    continue;
+                }
+
+                bool durable = false;
+                try { durable = _writeDurably(receipt.Diagnostic); }
+                catch { durable = false; }
+                if (durable && !IsClosed())
+                {
+                    try { _publishDurable(receipt); }
+                    catch { }
+                }
+                lock (_gate)
+                {
+                    if (_outstanding > 0) { _outstanding--; }
+                    if (_closed) { return; }
+                }
+            }
+        }
+        finally
+        {
+            lock (_gate)
+            {
+                _closed = true;
+                _pending.Clear();
+                _outstanding = 0;
+            }
+            CleanupAfterWriter();
+        }
+    }
+
+    private bool IsClosed()
+    {
+        lock (_gate) { return _closed; }
+    }
+
+    private void CleanupAfterWriter()
+    {
+        if (Interlocked.CompareExchange(ref _cleanupStarted, 1, 0) != 0) { return; }
+        Action disposeStore = _disposeStore;
+        if (disposeStore != null) { try { disposeStore(); } catch { } }
+        try { _available.Dispose(); } catch { }
+    }
+}
diff --git a/tests/trayhost/Invoke-TrayHostSelfTest.ps1 b/tests/trayhost/Invoke-TrayHostSelfTest.ps1
index ad95efa..b249423 100644
--- a/tests/trayhost/Invoke-TrayHostSelfTest.ps1
+++ b/tests/trayhost/Invoke-TrayHostSelfTest.ps1
@@ -23,6 +23,7 @@ $nativeFiles=@(
 $transportFiles=@(
     (Join-Path $repositoryRoot 'src\trayhost\TransportMessages.cs'),
     (Join-Path $repositoryRoot 'src\trayhost\TrayTerminalDiagnostic.cs'),
+    (Join-Path $repositoryRoot 'src\trayhost\TrayTerminalReceiptSink.cs'),
     (Join-Path $repositoryRoot 'src\trayhost\ParentTransport.cs'),
     (Join-Path $repositoryRoot 'src\trayhost\HostTransport.cs')
 )
diff --git a/tests/trayhost/TrayHostNativeSelfTest.cs b/tests/trayhost/TrayHostNativeSelfTest.cs
index 42298dc..f9185b9 100644
--- a/tests/trayhost/TrayHostNativeSelfTest.cs
+++ b/tests/trayhost/TrayHostNativeSelfTest.cs
@@ -304,6 +304,35 @@ private static void TestActionFailureUsesTheAcknowledgedSnapshotStrings()
         window.Dispose();
     }
 
+    private static void TestDurableNativeReceiptAuthorizesGenericFeedbackOnce()
+    {
+        string root = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-native-feedback-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(root); CreateCompatibilityParents(root);
+        FakeTrayPlatform platform = new FakeTrayPlatform(); TrayWindow window = new TrayWindow(platform); window.Create(SnapshotV2(1));
+        HostTransport transport = new HostTransport();
+        TrayTerminalDiagnosticStore store = TestStore(root, null, null);
+        TrayTerminalReceiptSink sink = new TrayTerminalReceiptSink(store.TryAppendDurably, transport.TryPublishDurableReceipt);
+        try
+        {
+            Guid actionId = Guid.NewGuid(); TrayTerminalReceipt receipt;
+            AssertTrue(transport.TryRegisterAction(new TrayHostAction(actionId, TrayCommand.OpenLogs, 1UL)), "native durable-feedback action registers");
+            AssertTrue(transport.TryAcknowledgeAction(new TrayActionResult(actionId, 1UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null), out receipt) && receipt != null, "native durable-feedback action returns one typed receipt");
+            TrayActionResult feedback;
+            AssertTrue(!transport.TryTakeFailedAction(out feedback) && platform.MessageBoxes.Count == 0, "native generic feedback is unavailable before durable receipt success");
+            AssertTrue(sink.TrySubmit(receipt), "native receipt enters the asynchronous sink");
+            Stopwatch elapsed = Stopwatch.StartNew();
+            while (!transport.TryTakeFailedAction(out feedback) && elapsed.ElapsedMilliseconds < 3000L) { Thread.Sleep(5); }
+            AssertTrue(feedback != null && feedback.ActionId == actionId, "handle-pinned durable success authorizes the exact native feedback item");
+            window.ShowActionFailed();
+            AssertTrue(platform.MessageBoxes.Count == 1, "durable native receipt displays generic feedback exactly once");
+            AssertTrue(!transport.TryTakeFailedAction(out feedback), "durable native feedback has no duplicate queue item");
+        }
+        finally
+        {
+            sink.Dispose(); transport.Dispose(); window.Dispose(); store.Dispose(); try { Directory.Delete(root, true); } catch { }
+        }
+    }
+
     private static void TestTerminalDiagnosticLogIsSanitizedAndReportsPersistence()
     {
         string root = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-" + Guid.NewGuid().ToString("N"));
@@ -611,6 +640,7 @@ public static int Main(string[] args)
             TestAboutCommandDefersProofToSupervisor();
             TestVerifiedAboutUsesTheAcknowledgedSnapshotVersion();
             TestActionFailureUsesTheAcknowledgedSnapshotStrings();
+            TestDurableNativeReceiptAuthorizesGenericFeedbackOnce();
             TestTerminalDiagnosticStoreSupportsInheritedCompatibilityParentsAndCreatesPrivateChild();
             TestTerminalDiagnosticLogIsSanitizedAndReportsPersistence();
             TestTerminalDiagnosticStoreRejectsUnsafeObjectsAndProtectsOutsideSentinel();
@@ -623,7 +653,7 @@ public static int Main(string[] args)
             TestShellRightClickNotificationMapping();
             TestRealNativePInvokeSurface();
             TestPostedWorkMessageDispatchesToItsOwnerWindow();
-            Console.WriteLine("TrayHost native self-tests passed: 22");
+            Console.WriteLine("TrayHost native self-tests passed: 23");
             return 0;
         }
         catch (Exception error)
diff --git a/tests/trayhost/TrayHostParentClientSelfTest.cs b/tests/trayhost/TrayHostParentClientSelfTest.cs
index f2e8589..e83f597 100644
--- a/tests/trayhost/TrayHostParentClientSelfTest.cs
+++ b/tests/trayhost/TrayHostParentClientSelfTest.cs
@@ -81,26 +81,31 @@ private static void RunPeer(bool emitFaultAndIgnoreShutdown, bool emitAction, bo
         {
             Guid actionId = Guid.Parse("aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee");
             TrayHostAction action = new TrayHostAction(actionId, TrayCommand.OpenLogs, staleAction ? 8UL : 1UL);
-            HostTransport host = new HostTransport(null, delegate(TrayTerminalDiagnostic record) { return true; });
+            ManualResetEvent receiptPersisted = new ManualResetEvent(false);
+            HostTransport host = new HostTransport();
+            TrayTerminalReceiptSink receiptSink = new TrayTerminalReceiptSink(delegate(TrayTerminalDiagnostic record) { receiptPersisted.Set(); return true; }, host.TryPublishDurableReceipt);
             ProductionTraceTrayPlatform tracePlatform = new ProductionTraceTrayPlatform();
             TrayWindow traceWindow = new TrayWindow(tracePlatform); traceWindow.Create(Snapshot(1UL));
             AssertTrue(host.TryRegisterAction(action), "program peer registers the exact outbound action");
             ProtocolCodec.WriteAuthenticated(output, ProtocolFrame.Authenticated(ProtocolDirection.HostToParent, TrayHostMessageType.Action, epoch, outboundSequence++, TrayHostWire.WriteAction(action)), keys.HostToParent);
             ProtocolFrame terminalFrame = ProtocolCodec.ReadAuthenticated(input, ProtocolDirection.ParentToHost, epoch, inboundSequence++, keys.ParentToHost);
             AssertTrue(terminalFrame.MessageType == TrayHostMessageType.ActionResult, "program peer receives one authenticated terminal result");
-            AssertTrue(Program.TryDispatchAuthenticatedActionResult(host, terminalFrame.Payload), "production Program dispatch accepts the correlated authenticated result");
+            AssertTrue(Program.TryDispatchAuthenticatedActionResult(host, receiptSink, terminalFrame.Payload), "production Program dispatch accepts the correlated authenticated result without waiting for receipt storage");
             TrayActionResult feedback;
             if (staleAction)
             {
-                AssertTrue(host.TryTakeFailedAction(out feedback) && feedback.Revision == 8UL && feedback.Status == TrayActionResultStatus.Rejected && String.Equals(feedback.ErrorCode, "CCOD_TRAY_ACTION_STALE", StringComparison.Ordinal), "stale authenticated result reaches the production generic-feedback queue with its exact code");
+                Stopwatch feedbackWait = Stopwatch.StartNew();
+                while (!host.TryTakeFailedAction(out feedback) && feedbackWait.ElapsedMilliseconds < 3000L) { Thread.Sleep(5); }
+                AssertTrue(feedback != null && feedback.Revision == 8UL && feedback.Status == TrayActionResultStatus.Rejected && String.Equals(feedback.ErrorCode, "CCOD_TRAY_ACTION_STALE", StringComparison.Ordinal), "stale authenticated result reaches the production generic-feedback queue only after its durable callback");
                 traceWindow.ShowActionFailed();
                 AssertTrue(String.Equals(tracePlatform.Message, "string-0|string-15", StringComparison.Ordinal), "stale production trace collapses internal details to the generic acknowledged-snapshot dialog");
             }
             else
             {
+                AssertTrue(receiptPersisted.WaitOne(3000), "completed current action reaches durable receipt storage asynchronously");
                 AssertTrue(!host.TryTakeFailedAction(out feedback) && tracePlatform.Message == null, "completed current action produces no generic failure feedback");
             }
-            traceWindow.Dispose(); host.Dispose();
+            receiptSink.Dispose(); traceWindow.Dispose(); host.Dispose(); receiptPersisted.Dispose();
             return;
         }
         if (emitFaultAndIgnoreShutdown)
diff --git a/tests/trayhost/TrayHostTransportSelfTest.cs b/tests/trayhost/TrayHostTransportSelfTest.cs
index d276a07..43436fe 100644
--- a/tests/trayhost/TrayHostTransportSelfTest.cs
+++ b/tests/trayhost/TrayHostTransportSelfTest.cs
@@ -1,11 +1,86 @@
 using System;
 using System.Collections.Generic;
 using System.Diagnostics;
+using System.Reflection;
 using System.Threading;
 
 internal static class TrayHostTransportSelfTest
 {
-    private static bool PersistTerminal(TrayTerminalDiagnostic record) { return true; }
+    private enum ReceiptStoreBlockStage
+    {
+        None = 0,
+        BeforeOpen = 1,
+        DuringWrite = 2,
+        DuringFlush = 3
+    }
+
+    private sealed class ControllableReceiptStore : IDisposable
+    {
+        private readonly object _gate = new object();
+        private readonly ReceiptStoreBlockStage _blockStage;
+        private readonly Queue<int> _outcomes = new Queue<int>();
+        private readonly HashSet<int> _writerThreads = new HashSet<int>();
+        private readonly ManualResetEvent _entered = new ManualResetEvent(false);
+        private readonly ManualResetEvent _release = new ManualResetEvent(false);
+        private int _active;
+        private int _callCount;
+        private int _completedCount;
+        private int _maximumConcurrent;
+
+        internal ControllableReceiptStore(ReceiptStoreBlockStage blockStage, params int[] outcomes)
+        {
+            _blockStage = blockStage;
+            if (outcomes != null) { for (int index = 0; index < outcomes.Length; index++) { _outcomes.Enqueue(outcomes[index]); } }
+        }
+
+        internal bool TryAppendDurably(TrayTerminalDiagnostic record)
+        {
+            if (record == null) { return false; }
+            int call = Interlocked.Increment(ref _callCount);
+            int active = Interlocked.Increment(ref _active);
+            lock (_gate)
+            {
+                _writerThreads.Add(Thread.CurrentThread.ManagedThreadId);
+                if (active > _maximumConcurrent) { _maximumConcurrent = active; }
+            }
+            try
+            {
+                BlockAt(call, ReceiptStoreBlockStage.BeforeOpen);
+                BlockAt(call, ReceiptStoreBlockStage.DuringWrite);
+                BlockAt(call, ReceiptStoreBlockStage.DuringFlush);
+                int outcome = 1;
+                lock (_gate) { if (_outcomes.Count != 0) { outcome = _outcomes.Dequeue(); } }
+                if (outcome < 0) { throw new InvalidOperationException("intentional receipt-store failure"); }
+                return outcome > 0;
+            }
+            finally
+            {
+                Interlocked.Decrement(ref _active);
+                Interlocked.Increment(ref _completedCount);
+            }
+        }
+
+        internal bool WaitUntilBlocked(int milliseconds) { return _entered.WaitOne(milliseconds); }
+        internal void Release() { _release.Set(); }
+        internal int CallCount { get { return Interlocked.CompareExchange(ref _callCount, 0, 0); } }
+        internal int CompletedCount { get { return Interlocked.CompareExchange(ref _completedCount, 0, 0); } }
+        internal int MaximumConcurrent { get { lock (_gate) { return _maximumConcurrent; } } }
+        internal int WriterThreadCount { get { lock (_gate) { return _writerThreads.Count; } } }
+
+        private void BlockAt(int call, ReceiptStoreBlockStage stage)
+        {
+            if (call != 1 || _blockStage != stage) { return; }
+            _entered.Set();
+            _release.WaitOne();
+        }
+
+        public void Dispose()
+        {
+            _release.Set();
+            _entered.Dispose();
+            _release.Dispose();
+        }
+    }
 
     private static void AssertTrue(bool value, string message)
     {
@@ -19,6 +94,18 @@ private static void AssertThrows(Action action, string message)
         AssertTrue(threw, message);
     }
 
+    private static void AssertReturnsQuickly(Stopwatch elapsed, string message)
+    {
+        AssertTrue(elapsed.Elapsed < TimeSpan.FromMilliseconds(250), message + " elapsedMs=" + elapsed.ElapsedMilliseconds.ToString());
+    }
+
+    private static void WaitUntil(Func<bool> condition, int milliseconds, string message)
+    {
+        Stopwatch elapsed = Stopwatch.StartNew();
+        while (!condition() && elapsed.ElapsedMilliseconds < milliseconds) { Thread.Sleep(5); }
+        AssertTrue(condition(), message);
+    }
+
     private static PresentationSnapshot Snapshot(ulong revision)
     {
         string[] strings = new string[16];
@@ -26,6 +113,29 @@ private static PresentationSnapshot Snapshot(ulong revision)
         return new PresentationSnapshot(revision, TrayColor.Green, ConnectionState.Connected, ProtectionState.Running, LanguageMode.Chinese, PresentationFlags.OpenLogsEnabled, strings);
     }
 
+    private static bool TryAcknowledge(HostTransport host, TrayActionResult result)
+    {
+        TrayTerminalReceipt ignored;
+        return host.TryAcknowledgeAction(result, out ignored);
+    }
+
+    private static TrayTerminalReceipt AcknowledgeTerminalQuickly(HostTransport host, TrayActionResult result, string message)
+    {
+        TrayTerminalReceipt receipt;
+        Stopwatch elapsed = Stopwatch.StartNew();
+        bool accepted = host.TryAcknowledgeAction(result, out receipt);
+        elapsed.Stop();
+        AssertTrue(accepted && receipt != null, message + " is correlated into a typed receipt");
+        AssertReturnsQuickly(elapsed, message + " never waits for receipt storage");
+        return receipt;
+    }
+
+    private static TrayTerminalReceipt RegisterAndAcknowledgeFailure(HostTransport host, Guid actionId, ulong revision, string message)
+    {
+        AssertTrue(host.TryRegisterAction(new TrayHostAction(actionId, TrayCommand.OpenLogs, revision)), message + " registers");
+        return AcknowledgeTerminalQuickly(host, new TrayActionResult(actionId, revision, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null), message);
+    }
+
     private static void TestParentLatestAndReservedControl()
     {
         ParentTransport transport = new ParentTransport();
@@ -69,12 +179,12 @@ private static void TestHostPendingAndReplayBound()
         Guid actionId = Guid.NewGuid();
         AssertTrue(transport.TryRegisterAction(new TrayHostAction(actionId, TrayCommand.OpenLogs, 2UL)), "first action accepted");
         AssertTrue(!transport.TryRegisterAction(new TrayHostAction(actionId, TrayCommand.OpenLogs, 2UL)), "replayed action id is rejected");
-        AssertTrue(transport.TryAcknowledgeAction(new TrayActionResult(actionId, 2UL, TrayActionResultStatus.Completed, null, null)), "terminal non-lifecycle result clears the pending action");
+        AssertTrue(TryAcknowledge(transport, new TrayActionResult(actionId, 2UL, TrayActionResultStatus.Completed, null, null)), "terminal non-lifecycle result clears the pending action");
         for (int i = 0; i < 63; i++)
         {
             Guid next = Guid.NewGuid();
             AssertTrue(transport.TryRegisterAction(new TrayHostAction(next, TrayCommand.OpenLogs, 2UL)), "replay cache accepts distinct ids");
-            AssertTrue(transport.TryAcknowledgeAction(new TrayActionResult(next, 2UL, TrayActionResultStatus.Completed, null, null)), "terminal non-lifecycle result drains independently");
+            AssertTrue(TryAcknowledge(transport, new TrayActionResult(next, 2UL, TrayActionResultStatus.Completed, null, null)), "terminal non-lifecycle result drains independently");
         }
         AssertTrue(!transport.TryRegisterAction(new TrayHostAction(actionId, TrayCommand.OpenLogs, 2UL)), "the 64-entry replay cache rejects a replayed id");
         transport.Dispose();
@@ -97,17 +207,18 @@ private static void TestActionResultCorrelationAndControlPriority()
         Guid actionId = Guid.NewGuid(); Guid transactionId = Guid.Parse("11111111-2222-3333-4444-555555555555");
         HostTransport host = new HostTransport();
         AssertTrue(host.TryRegisterAction(new TrayHostAction(actionId, TrayCommand.CheckAndRepair, 12UL)), "host registers one v2 lifecycle action");
-        AssertTrue(!host.TryAcknowledgeAction(new TrayActionResult(actionId, 12UL, TrayActionResultStatus.Accepted, null, null)), "lifecycle accepted result requires its durable transaction id");
+        AssertTrue(!TryAcknowledge(host, new TrayActionResult(actionId, 12UL, TrayActionResultStatus.Accepted, null, null)), "lifecycle accepted result requires its durable transaction id");
         TrayActionResult accepted = new TrayActionResult(actionId, 12UL, TrayActionResultStatus.Accepted, null, transactionId);
-        AssertTrue(host.TryAcknowledgeAction(accepted), "host accepts the correlated accepted result");
-        AssertTrue(!host.TryAcknowledgeAction(accepted), "host rejects a duplicate accepted result");
-        AssertTrue(!host.TryAcknowledgeAction(new TrayActionResult(Guid.NewGuid(), 12UL, TrayActionResultStatus.Completed, null, transactionId)), "host rejects a result for an unknown action id");
-        AssertTrue(!host.TryAcknowledgeAction(new TrayActionResult(actionId, 99UL, TrayActionResultStatus.Completed, null, transactionId)), "host rejects a result with the wrong revision");
-        AssertTrue(host.TryAcknowledgeAction(new TrayActionResult(actionId, 12UL, TrayActionResultStatus.Completed, null, transactionId)), "host accepts the correlated terminal result after accepted");
-        AssertTrue(!host.TryAcknowledgeAction(new TrayActionResult(actionId, 12UL, TrayActionResultStatus.Completed, null, transactionId)), "host rejects a double terminal result");
+        TrayTerminalReceipt terminal;
+        AssertTrue(host.TryAcknowledgeAction(accepted, out terminal) && terminal == null, "host accepts the correlated nonterminal accepted result without a receipt");
+        AssertTrue(!TryAcknowledge(host, accepted), "host rejects a duplicate accepted result");
+        AssertTrue(!TryAcknowledge(host, new TrayActionResult(Guid.NewGuid(), 12UL, TrayActionResultStatus.Completed, null, transactionId)), "host rejects a result for an unknown action id");
+        AssertTrue(!TryAcknowledge(host, new TrayActionResult(actionId, 99UL, TrayActionResultStatus.Completed, null, transactionId)), "host rejects a result with the wrong revision");
+        AssertTrue(host.TryAcknowledgeAction(new TrayActionResult(actionId, 12UL, TrayActionResultStatus.Completed, null, transactionId), out terminal) && terminal != null, "host returns the correlated terminal receipt after accepted");
+        AssertTrue(!TryAcknowledge(host, new TrayActionResult(actionId, 12UL, TrayActionResultStatus.Completed, null, transactionId)), "host rejects a double terminal result");
         Guid prematureId = Guid.NewGuid();
         AssertTrue(host.TryRegisterAction(new TrayHostAction(prematureId, TrayCommand.CheckAndRepair, 13UL)), "second lifecycle action registers");
-        AssertTrue(!host.TryAcknowledgeAction(new TrayActionResult(prematureId, 13UL, TrayActionResultStatus.Completed, null, null)), "lifecycle completion before accepted is rejected");
+        AssertTrue(!TryAcknowledge(host, new TrayActionResult(prematureId, 13UL, TrayActionResultStatus.Completed, null, null)), "lifecycle completion before accepted is rejected");
         AssertThrows(delegate { new TrayActionResult(Guid.NewGuid(), 1UL, TrayActionResultStatus.Rejected, "not-canonical", null); }, "invalid action result error code is rejected");
         AssertThrows(delegate { new TrayActionResult(Guid.NewGuid(), 1UL, TrayActionResultStatus.Completed, null, Guid.Empty); }, "empty action result transaction id is rejected");
         host.Dispose();
@@ -126,113 +237,228 @@ private static void TestActionResultCorrelationAndControlPriority()
         parent.Dispose();
     }
 
-    private static void TestAcknowledgedAboutQueuesOneUiWorkItem()
+    private static void TestBlockedReceiptStagesNeverBlockCorrelationOrUi()
     {
-        HostTransport host = new HostTransport(null, PersistTerminal); Guid actionId = Guid.NewGuid();
-        AssertTrue(host.TryRegisterAction(new TrayHostAction(actionId, TrayCommand.ShowAbout, 14UL)), "About action registers");
-        AssertTrue(host.TryAcknowledgeAction(new TrayActionResult(actionId, 14UL, TrayActionResultStatus.Completed, null, null)), "verified About completion is accepted");
-        TrayActionResult result;
-        AssertTrue(host.TryTakeCompletedAbout(out result) && result.ActionId == actionId && result.Status == TrayActionResultStatus.Completed, "verified About completion queues one UI work item");
-        AssertTrue(!host.TryTakeCompletedAbout(out result), "About UI work item is consumed exactly once");
-        host.Dispose();
+        ReceiptStoreBlockStage[] stages = new ReceiptStoreBlockStage[] { ReceiptStoreBlockStage.BeforeOpen, ReceiptStoreBlockStage.DuringWrite, ReceiptStoreBlockStage.DuringFlush };
+        for (int stageIndex = 0; stageIndex < stages.Length; stageIndex++)
+        {
+            ControllableReceiptStore store = new ControllableReceiptStore(stages[stageIndex], 1, 1);
+            int uiSignals = 0;
+            HostTransport host = new HostTransport(delegate { Interlocked.Increment(ref uiSignals); });
+            TrayTerminalReceiptSink sink = new TrayTerminalReceiptSink(store.TryAppendDurably, host.TryPublishDurableReceipt);
+            try
+            {
+                Guid firstId = Guid.NewGuid(); Guid followingId = Guid.NewGuid();
+                TrayTerminalReceipt first = RegisterAndAcknowledgeFailure(host, firstId, 24UL, stages[stageIndex].ToString() + " current terminal result");
+                Stopwatch firstSubmit = Stopwatch.StartNew(); bool firstAdmitted = sink.TrySubmit(first); firstSubmit.Stop();
+                AssertTrue(firstAdmitted, "current receipt is admitted before the fake store blocks " + stages[stageIndex].ToString());
+                AssertReturnsQuickly(firstSubmit, "current receipt admission is zero-wait");
+                AssertTrue(store.WaitUntilBlocked(2000), "fake store reaches " + stages[stageIndex].ToString());
+
+                AssertTrue(host.TryRegisterAction(new TrayHostAction(followingId, TrayCommand.ShowAbout, 24UL)), stages[stageIndex].ToString() + " following About action registers");
+                TrayTerminalReceipt following = AcknowledgeTerminalQuickly(host, new TrayActionResult(followingId, 24UL, TrayActionResultStatus.Completed, null, null), stages[stageIndex].ToString() + " following About terminal result");
+                Stopwatch followingSubmit = Stopwatch.StartNew(); bool followingAdmitted = sink.TrySubmit(following); followingSubmit.Stop();
+                AssertTrue(followingAdmitted, "following receipt is admitted while the store is blocked " + stages[stageIndex].ToString());
+                AssertReturnsQuickly(followingSubmit, "following receipt admission never waits for the current store operation");
+                TrayTerminalReceipt duplicate;
+                AssertTrue(!host.TryAcknowledgeAction(new TrayActionResult(firstId, 24UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null), out duplicate), "current terminal action is removed before sink submission");
+                AssertTrue(!host.TryAcknowledgeAction(new TrayActionResult(followingId, 24UL, TrayActionResultStatus.Completed, null, null), out duplicate), "following terminal action is removed before sink submission");
+                TrayActionResult prematureFailure; TrayActionResult prematureAbout;
+                AssertTrue(!host.TryTakeFailedAction(out prematureFailure) && !host.TryTakeCompletedAbout(out prematureAbout) && Interlocked.CompareExchange(ref uiSignals, 0, 0) == 0, "blocked store exposes no generic or About UI work before durable success");
+
+                store.Release();
+                WaitUntil(delegate { return Interlocked.CompareExchange(ref uiSignals, 0, 0) == 2; }, 2000, "both durable successes post exactly one work signal");
+                TrayActionResult firstUi; TrayActionResult followingUi; TrayActionResult none;
+                AssertTrue(host.TryTakeFailedAction(out firstUi) && firstUi.ActionId == firstId, "first durable receipt publishes its exact generic-feedback item");
+                AssertTrue(host.TryTakeCompletedAbout(out followingUi) && followingUi.ActionId == followingId, "following durable receipt publishes its exact About item");
+                AssertTrue(!host.TryTakeFailedAction(out none), "durable callbacks publish no duplicate feedback");
+                AssertTrue(store.WriterThreadCount == 1 && store.MaximumConcurrent == 1, "all blocked stages are serviced by exactly one non-overlapping writer");
+            }
+            finally
+            {
+                store.Release();
+                sink.Dispose();
+                host.Dispose();
+                store.Dispose();
+            }
+        }
     }
 
-    private static void TestRejectedAndFailedActionsQueueUserFeedback()
+    private static void TestNinthReceiptAndBusyAdmissionDropWithoutPendingOrUi()
     {
-        HostTransport host = new HostTransport(null, PersistTerminal);
-        Guid rejectedId = Guid.NewGuid(); Guid failedId = Guid.NewGuid();
-        AssertTrue(host.TryRegisterAction(new TrayHostAction(rejectedId, TrayCommand.OpenLogs, 20UL)), "rejected action registers");
-        AssertTrue(host.TryRegisterAction(new TrayHostAction(failedId, TrayCommand.SetLanguageEnglish, 20UL)), "failed action registers");
-        AssertTrue(host.TryAcknowledgeAction(new TrayActionResult(rejectedId, 20UL, TrayActionResultStatus.Rejected, "CCOD_TRAY_ACTION_UNAVAILABLE", null)), "correlated rejected result is accepted");
-        AssertTrue(host.TryAcknowledgeAction(new TrayActionResult(failedId, 20UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null)), "correlated failed result is accepted");
-        TrayActionResult first; TrayActionResult second; TrayActionResult none;
-        AssertTrue(host.TryTakeFailedAction(out first) && first.ActionId == rejectedId && first.Revision == 20UL && first.Status == TrayActionResultStatus.Rejected && String.Equals(first.ErrorCode, "CCOD_TRAY_ACTION_UNAVAILABLE", StringComparison.Ordinal), "rejected result preserves its exact correlated terminal record before generic feedback");
-        AssertTrue(host.TryTakeFailedAction(out second) && second.ActionId == failedId && second.Revision == 20UL && second.Status == TrayActionResultStatus.Failed && String.Equals(second.ErrorCode, "CCOD_TRAY_ACTION_FAILED", StringComparison.Ordinal), "failed result preserves its exact correlated terminal record before generic feedback");
-        AssertTrue(!host.TryTakeFailedAction(out none), "each terminal failure queues feedback exactly once");
-        host.Dispose();
+        ControllableReceiptStore store = new ControllableReceiptStore(ReceiptStoreBlockStage.BeforeOpen, 1);
+        HostTransport host = new HostTransport();
+        TrayTerminalReceiptSink sink = new TrayTerminalReceiptSink(store.TryAppendDurably, host.TryPublishDurableReceipt);
+        try
+        {
+            TrayTerminalReceipt first = RegisterAndAcknowledgeFailure(host, Guid.NewGuid(), 25UL, "first hung-store action");
+            AssertTrue(sink.TrySubmit(first), "current receipt occupies the first outstanding slot");
+            AssertTrue(store.WaitUntilBlocked(2000), "single writer enters the hung fake store");
+            for (int index = 1; index < 8; index++)
+            {
+                TrayTerminalReceipt queued = RegisterAndAcknowledgeFailure(host, Guid.NewGuid(), 25UL, "queued outstanding action " + index.ToString());
+                AssertTrue(sink.TrySubmit(queued), "outstanding receipt slots include current plus seven queued items");
+            }
+
+            Guid ninthId = Guid.NewGuid();
+            TrayTerminalReceipt ninth = RegisterAndAcknowledgeFailure(host, ninthId, 25UL, "ninth full-sink action");
+            Stopwatch ninthSubmit = Stopwatch.StartNew(); bool ninthAdmitted = sink.TrySubmit(ninth); ninthSubmit.Stop();
+            AssertTrue(!ninthAdmitted, "ninth outstanding receipt is dropped");
+            AssertReturnsQuickly(ninthSubmit, "ninth outstanding admission is rejected immediately");
+            TrayTerminalReceipt duplicate;
+            AssertTrue(!host.TryAcknowledgeAction(new TrayActionResult(ninthId, 25UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null), out duplicate), "full-sink terminal action remains consumed");
+            for (int index = 0; index < 8; index++)
+            {
+                Guid droppedId = Guid.NewGuid();
+                TrayTerminalReceipt dropped = RegisterAndAcknowledgeFailure(host, droppedId, 25UL, "additional full-sink action " + index.ToString());
+                AssertTrue(!sink.TrySubmit(dropped), "repeated full-sink paths drop only receipt feedback");
+            }
+            for (int index = 0; index < 8; index++)
+            {
+                Guid capacityId = Guid.NewGuid();
+                AssertTrue(host.TryRegisterAction(new TrayHostAction(capacityId, TrayCommand.OpenLogs, 25UL)), "receipt saturation never consumes pending action capacity");
+                AssertTrue(TryAcknowledge(host, new TrayActionResult(capacityId, 25UL, TrayActionResultStatus.Completed, null, null)), "capacity proof action remains terminally consumable");
+            }
+            AssertTrue(store.CallCount == 1 && store.WriterThreadCount == 1 && store.MaximumConcurrent == 1, "hung writer is never replaced");
+            TrayActionResult none;
+            AssertTrue(!host.TryTakeFailedAction(out none), "full and hung paths show no UI");
+
+            FieldInfo gateField = typeof(TrayTerminalReceiptSink).GetField("_gate", BindingFlags.Instance | BindingFlags.NonPublic);
+            AssertTrue(gateField != null, "busy-admission fixture locates the sink admission gate");
+            object admissionGate = gateField.GetValue(sink);
+            ManualResetEvent gateHeld = new ManualResetEvent(false); ManualResetEvent releaseGate = new ManualResetEvent(false);
+            Thread holder = new Thread((ThreadStart)delegate { lock (admissionGate) { gateHeld.Set(); releaseGate.WaitOne(); } });
+            holder.IsBackground = true; holder.Start();
+            try
+            {
+                AssertTrue(gateHeld.WaitOne(2000), "busy-admission fixture holds the sink gate");
+                Guid busyId = Guid.NewGuid();
+                TrayTerminalReceipt busy = RegisterAndAcknowledgeFailure(host, busyId, 25UL, "busy-sink action");
+                bool busyReturned = false; bool busyAdmitted = true;
+                Thread submitter = new Thread((ThreadStart)delegate { busyAdmitted = sink.TrySubmit(busy); busyReturned = true; });
+                submitter.IsBackground = true; submitter.Start();
+                AssertTrue(submitter.Join(250) && busyReturned && !busyAdmitted, "busy admission returns immediately without waiting for the gate");
+                AssertTrue(!host.TryAcknowledgeAction(new TrayActionResult(busyId, 25UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null), out duplicate), "busy-sink terminal action remains consumed");
+                AssertTrue(!host.TryTakeFailedAction(out none), "busy admission shows no UI");
+            }
+            finally
+            {
+                releaseGate.Set(); holder.Join(2000); gateHeld.Dispose(); releaseGate.Dispose();
+            }
+        }
+        finally
+        {
+            store.Release();
+            sink.Dispose();
+            host.Dispose();
+            store.Dispose();
+        }
     }
 
-    private static void TestUndisplayedActionFailureFeedbackIsBounded()
+    private static void TestStoreAndCallbackFailuresRecoverOnTheSameWriter()
     {
-        HostTransport host = new HostTransport(null, PersistTerminal);
-        for (int index = 0; index < 9; index++)
+        ControllableReceiptStore store = new ControllableReceiptStore(ReceiptStoreBlockStage.DuringFlush, 0, 1, 1);
+        bool failCallback = true; int successfulSignals = 0;
+        HostTransport host = new HostTransport(delegate
         {
-            Guid actionId = Guid.NewGuid();
-            AssertTrue(host.TryRegisterAction(new TrayHostAction(actionId, TrayCommand.OpenLogs, 21UL)), "terminal failure releases pending action capacity");
-            bool accepted = host.TryAcknowledgeAction(new TrayActionResult(actionId, 21UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null));
-            AssertTrue(accepted, "bounded undisplayed feedback never strands an authenticated terminal action");
+            if (failCallback) { failCallback = false; throw new InvalidOperationException("intentional UI callback failure"); }
+            Interlocked.Increment(ref successfulSignals);
+        });
+        TrayTerminalReceiptSink sink = new TrayTerminalReceiptSink(store.TryAppendDurably, host.TryPublishDurableReceipt);
+        try
+        {
+            Guid storeFailureId = Guid.NewGuid(); Guid callbackFailureId = Guid.NewGuid(); Guid recoveredId = Guid.NewGuid();
+            AssertTrue(sink.TrySubmit(RegisterAndAcknowledgeFailure(host, storeFailureId, 26UL, "store-failure action")), "first receipt is admitted before the store failure");
+            AssertTrue(store.WaitUntilBlocked(2000), "first receipt blocks during the simulated flush");
+            AssertTrue(sink.TrySubmit(RegisterAndAcknowledgeFailure(host, callbackFailureId, 26UL, "callback-failure action")), "second receipt queues behind the first store failure");
+            AssertTrue(sink.TrySubmit(RegisterAndAcknowledgeFailure(host, recoveredId, 26UL, "recovered action")), "third receipt queues for recovery");
+            TrayActionResult none;
+            AssertTrue(!host.TryTakeFailedAction(out none), "blocked and not-yet-durable receipts expose no UI");
+            store.Release();
+            WaitUntil(delegate { return store.CompletedCount == 3 && Interlocked.CompareExchange(ref successfulSignals, 0, 0) == 1; }, 3000, "same writer continues through store and callback failures to a later success");
+            TrayActionResult recovered; TrayActionResult extra;
+            AssertTrue(host.TryTakeFailedAction(out recovered) && recovered.ActionId == recoveredId, "only the later durable callback publishes generic feedback");
+            AssertTrue(!host.TryTakeFailedAction(out extra), "store and callback failures publish no latent UI");
+            AssertTrue(store.WriterThreadCount == 1 && store.MaximumConcurrent == 1, "recovery keeps the original single writer instead of starting a replacement");
+        }
+        finally
+        {
+            store.Release(); sink.Dispose(); host.Dispose(); store.Dispose();
         }
-        host.Dispose();
     }
 
-    private static void TestTerminalDiagnosticFailureNeverStrandsPendingActions()
+    private static void TestDurableReceiptTrustAndSharedUiBound()
     {
-        HostTransport missingWriter = new HostTransport();
-        Guid missingWriterId = Guid.NewGuid();
-        AssertTrue(missingWriter.TryRegisterAction(new TrayHostAction(missingWriterId, TrayCommand.OpenLogs, 22UL)), "action registers without a diagnostic writer");
-        AssertTrue(missingWriter.TryAcknowledgeAction(new TrayActionResult(missingWriterId, 22UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null)), "missing diagnostic writer still releases the authenticated terminal action");
-        TrayActionResult missingWriterFeedback;
-        AssertTrue(!missingWriter.TryTakeFailedAction(out missingWriterFeedback), "missing diagnostic writer cannot authorize generic feedback");
-        missingWriter.Dispose();
-
-        bool persist = false;
-        List<TrayTerminalDiagnostic> records = new List<TrayTerminalDiagnostic>();
-        HostTransport host = new HostTransport(null, delegate(TrayTerminalDiagnostic record) { records.Add(record); return persist; });
-        for (int index = 0; index < 10; index++)
+        int signals = 0;
+        HostTransport host = new HostTransport(delegate { Interlocked.Increment(ref signals); });
+        HostTransport foreign = new HostTransport();
+        try
         {
-            Guid actionId = Guid.NewGuid();
-            AssertTrue(host.TryRegisterAction(new TrayHostAction(actionId, TrayCommand.OpenLogs, 22UL)), "diagnostic failure never consumes pending-action capacity");
-            AssertTrue(host.TryAcknowledgeAction(new TrayActionResult(actionId, 22UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null)), "authenticated terminal result releases its pending action even when local persistence fails");
-            TrayActionResult suppressed;
-            AssertTrue(!host.TryTakeFailedAction(out suppressed), "generic feedback is suppressed when its local terminal diagnostic did not persist");
+            Guid aboutId = Guid.NewGuid();
+            AssertTrue(host.TryRegisterAction(new TrayHostAction(aboutId, TrayCommand.ShowAbout, 27UL)), "About action registers for durable authorization");
+            TrayTerminalReceipt about = AcknowledgeTerminalQuickly(host, new TrayActionResult(aboutId, 27UL, TrayActionResultStatus.Completed, null, null), "About terminal result");
+            TrayActionResult beforeDurable;
+            AssertTrue(!host.TryTakeCompletedAbout(out beforeDurable), "typed receipt alone cannot expose About UI before durable publication");
+            AssertTrue(!foreign.TryPublishDurableReceipt(about), "a different transport rejects a receipt it did not correlate");
+            AssertTrue(host.TryPublishDurableReceipt(about), "originating transport accepts one explicit durable-success callback");
+            AssertTrue(!host.TryPublishDurableReceipt(about), "the same durable receipt cannot publish twice");
+
+            for (int index = 0; index < 7; index++)
+            {
+                TrayTerminalReceipt failure = RegisterAndAcknowledgeFailure(host, Guid.NewGuid(), 27UL, "bounded UI failure " + index.ToString());
+                AssertTrue(host.TryPublishDurableReceipt(failure), "shared UI queue admits through eight total items");
+            }
+            TrayTerminalReceipt overflow = RegisterAndAcknowledgeFailure(host, Guid.NewGuid(), 27UL, "bounded UI overflow");
+            AssertTrue(!host.TryPublishDurableReceipt(overflow), "ninth shared About/failure UI item is dropped");
+
+            Guid noUiId = Guid.NewGuid();
+            AssertTrue(host.TryRegisterAction(new TrayHostAction(noUiId, TrayCommand.OpenLogs, 27UL)), "non-UI completion registers while UI work is full");
+            TrayTerminalReceipt noUi = AcknowledgeTerminalQuickly(host, new TrayActionResult(noUiId, 27UL, TrayActionResultStatus.Completed, null, null), "non-UI completion");
+            AssertTrue(host.TryPublishDurableReceipt(noUi), "durable non-UI completion is consumed without UI capacity");
+
+            TrayActionResult aboutUi;
+            AssertTrue(host.TryTakeCompletedAbout(out aboutUi) && aboutUi.ActionId == aboutId, "durable About maps to one About UI item");
+            int failures = 0; TrayActionResult failed;
+            while (host.TryTakeFailedAction(out failed)) { failures++; }
+            AssertTrue(failures == 7, "About and generic failure share one eight-item UI bound");
+            AssertTrue(Interlocked.CompareExchange(ref signals, 0, 0) == 8, "only admitted UI items post application work");
         }
-        persist = true;
-        Guid recoveredId = Guid.NewGuid();
-        AssertTrue(host.TryRegisterAction(new TrayHostAction(recoveredId, TrayCommand.OpenLogs, 22UL)), "new action registers after repeated diagnostic failures");
-        AssertTrue(host.TryAcknowledgeAction(new TrayActionResult(recoveredId, 22UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null)), "recovered diagnostic persistence accepts a new terminal result");
-        TrayActionResult recoveredFeedback;
-        AssertTrue(host.TryTakeFailedAction(out recoveredFeedback) && recoveredFeedback.ActionId == recoveredId, "generic feedback resumes only after local terminal persistence recovers");
-        Guid completedId = Guid.NewGuid();
-        AssertTrue(host.TryRegisterAction(new TrayHostAction(completedId, TrayCommand.OpenLogs, 22UL)), "post-recovery command can still register");
-        AssertTrue(host.TryAcknowledgeAction(new TrayActionResult(completedId, 22UL, TrayActionResultStatus.Completed, null, null)), "post-recovery command can complete");
-        TrayTerminalDiagnostic last = records[records.Count - 1];
-        AssertTrue(last.Command == TrayCommand.OpenLogs && last.Revision == 22UL && last.Status == TrayActionResultStatus.Completed && String.Equals(last.Code, "CCOD_TRAY_ACTION_COMPLETED", StringComparison.Ordinal), "terminal diagnostic exposes only the exact canonical correlation fields");
-        host.Dispose();
+        finally { foreign.Dispose(); host.Dispose(); }
     }
 
-    private static void TestBlockingTerminalWriterRunsOutsideCorrelationLock()
+    private static void TestDisposalReturnsWhileStoreIsHungAndSuppressesLateCallbacks()
     {
-        ManualResetEvent writerEntered = new ManualResetEvent(false);
-        ManualResetEvent releaseWriter = new ManualResetEvent(false);
-        bool first = true;
-        HostTransport host = new HostTransport(null, delegate(TrayTerminalDiagnostic record)
-        {
-            if (first) { first = false; writerEntered.Set(); releaseWriter.WaitOne(TimeSpan.FromSeconds(3)); }
-            return true;
-        });
-        Guid blockedId = Guid.NewGuid();
-        AssertTrue(host.TryRegisterAction(new TrayHostAction(blockedId, TrayCommand.OpenLogs, 24UL)), "blocking-writer action registers");
-        bool acknowledged = false;
-        Thread acknowledgement = new Thread((ThreadStart)delegate { acknowledged = host.TryAcknowledgeAction(new TrayActionResult(blockedId, 24UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null)); });
-        acknowledgement.IsBackground = true;
-        acknowledgement.Start();
+        ControllableReceiptStore store = new ControllableReceiptStore(ReceiptStoreBlockStage.BeforeOpen, 1);
+        int signals = 0;
+        HostTransport host = new HostTransport(delegate { Interlocked.Increment(ref signals); });
+        TrayTerminalReceiptSink sink = new TrayTerminalReceiptSink(store.TryAppendDurably, host.TryPublishDurableReceipt);
         try
         {
-            AssertTrue(writerEntered.WaitOne(TimeSpan.FromSeconds(2)), "terminal writer enters deterministically");
-            Guid concurrentId = Guid.NewGuid();
-            Stopwatch registration = Stopwatch.StartNew();
-            bool registered = host.TryRegisterAction(new TrayHostAction(concurrentId, TrayCommand.OpenLogs, 24UL));
-            registration.Stop();
-            AssertTrue(registered && registration.Elapsed < TimeSpan.FromMilliseconds(250), "blocking terminal I/O cannot hold the correlation lock or pending capacity");
-            releaseWriter.Set();
-            AssertTrue(acknowledgement.Join(TimeSpan.FromSeconds(2)) && acknowledged, "terminal acknowledgement completes after the writer is released");
-            AssertTrue(host.TryAcknowledgeAction(new TrayActionResult(concurrentId, 24UL, TrayActionResultStatus.Completed, null, null)), "concurrent action remains independently completable");
+            TrayTerminalReceipt current = RegisterAndAcknowledgeFailure(host, Guid.NewGuid(), 28UL, "dispose-hung current action");
+            AssertTrue(sink.TrySubmit(current), "dispose-hung receipt is admitted");
+            AssertTrue(store.WaitUntilBlocked(2000), "writer is hung before sink disposal");
+            Stopwatch disposal = Stopwatch.StartNew(); sink.Dispose(); disposal.Stop();
+            AssertReturnsQuickly(disposal, "sink disposal uses a bounded join when the only writer is hung");
+
+            Guid closedId = Guid.NewGuid();
+            TrayTerminalReceipt closed = RegisterAndAcknowledgeFailure(host, closedId, 28UL, "closed-sink action");
+            Stopwatch closedSubmit = Stopwatch.StartNew(); bool closedAdmitted = sink.TrySubmit(closed); closedSubmit.Stop();
+            AssertTrue(!closedAdmitted, "disposed sink rejects new receipts");
+            AssertReturnsQuickly(closedSubmit, "closed admission is immediate");
+            TrayTerminalReceipt duplicate;
+            AssertTrue(!host.TryAcknowledgeAction(new TrayActionResult(closedId, 28UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null), out duplicate), "closed-sink action remains terminally consumed");
+
+            store.Release();
+            WaitUntil(delegate { return store.CompletedCount == 1; }, 2000, "hung store can return after disposal without reviving the sink");
+            Stopwatch finalJoin = Stopwatch.StartNew(); sink.Dispose(); finalJoin.Stop();
+            AssertReturnsQuickly(finalJoin, "disposed sink remains bounded while joining its original completed writer");
+            TrayActionResult none;
+            AssertTrue(Interlocked.CompareExchange(ref signals, 0, 0) == 0 && !host.TryTakeFailedAction(out none), "late durable return after disposal cannot publish UI");
+            AssertTrue(store.CallCount == 1 && store.WriterThreadCount == 1, "disposal never starts a replacement writer");
         }
         finally
         {
-            releaseWriter.Set();
-            if (acknowledgement.IsAlive) { acknowledgement.Join(TimeSpan.FromSeconds(2)); }
-            writerEntered.Dispose(); releaseWriter.Dispose(); host.Dispose();
+            store.Release(); sink.Dispose(); host.Dispose(); store.Dispose();
         }
     }
 
@@ -245,11 +471,11 @@ public static int Main(string[] args)
             TestHostPendingAndReplayBound();
             TestDirectPresentationAcksDoNotAccumulateAnUnusedControlQueue();
             TestActionResultCorrelationAndControlPriority();
-            TestAcknowledgedAboutQueuesOneUiWorkItem();
-            TestRejectedAndFailedActionsQueueUserFeedback();
-            TestUndisplayedActionFailureFeedbackIsBounded();
-            TestTerminalDiagnosticFailureNeverStrandsPendingActions();
-            TestBlockingTerminalWriterRunsOutsideCorrelationLock();
+            TestBlockedReceiptStagesNeverBlockCorrelationOrUi();
+            TestNinthReceiptAndBusyAdmissionDropWithoutPendingOrUi();
+            TestStoreAndCallbackFailuresRecoverOnTheSameWriter();
+            TestDurableReceiptTrustAndSharedUiBound();
+            TestDisposalReturnsWhileStoreIsHungAndSuppressesLateCallbacks();
             Console.WriteLine("TrayHost transport self-tests passed: 10");
             return 0;
         }

From 1f1ecc5f72fbbb1c070d62a745b36be003b50506 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 10:07:49 +0800
Subject: [PATCH 032/187] fix: hide provisional tray receipt UI

---
 src/trayhost/HostTransport.cs               | 77 +++++++++++--------
 src/trayhost/Program.cs                     | 11 ++-
 tests/trayhost/TrayHostTransportSelfTest.cs | 85 +++++++++++++++++++--
 3 files changed, 135 insertions(+), 38 deletions(-)

diff --git a/src/trayhost/HostTransport.cs b/src/trayhost/HostTransport.cs
index 25d405b..fe426f1 100644
--- a/src/trayhost/HostTransport.cs
+++ b/src/trayhost/HostTransport.cs
@@ -9,10 +9,18 @@ private sealed class PendingAction
         internal bool Accepted;
     }
 
+    private sealed class UiWorkItem
+    {
+        internal TrayActionResult Result;
+        internal bool Ready;
+        internal bool ProbeObserved;
+    }
+
     private readonly object _gate = new object();
     private readonly Action _presentationReady;
-    private readonly Queue<TrayActionResult> _completedAbout = new Queue<TrayActionResult>();
-    private readonly Queue<TrayActionResult> _failedActions = new Queue<TrayActionResult>();
+    private readonly Action _receiptReady;
+    private readonly Queue<UiWorkItem> _completedAbout = new Queue<UiWorkItem>();
+    private readonly Queue<UiWorkItem> _failedActions = new Queue<UiWorkItem>();
     private readonly Dictionary<Guid, PendingAction> _pendingActions = new Dictionary<Guid, PendingAction>();
     private readonly Queue<Guid> _recentActionOrder = new Queue<Guid>();
     private readonly HashSet<Guid> _recentActions = new HashSet<Guid>();
@@ -21,13 +29,18 @@ private sealed class PendingAction
     private bool _menuOpen;
     private bool _disposed;
 
-    internal HostTransport() : this(null)
+    internal HostTransport() : this(null, null)
+    {
+    }
+
+    internal HostTransport(Action presentationReady) : this(presentationReady, presentationReady)
     {
     }
 
-    internal HostTransport(Action presentationReady)
+    internal HostTransport(Action presentationReady, Action receiptReady)
     {
         _presentationReady = presentationReady;
+        _receiptReady = receiptReady;
     }
 
     internal void SetMenuOpen(bool value)
@@ -108,8 +121,8 @@ internal bool TryAcknowledgeAction(TrayActionResult result, out TrayTerminalRece
     internal bool TryPublishDurableReceipt(TrayTerminalReceipt receipt)
     {
         if (receipt == null) { return false; }
-        bool notify = false;
-        bool accepted = false;
+        UiWorkItem work = null;
+        Action receiptReady = _receiptReady;
         lock (_gate)
         {
             if (_disposed || !receipt.TryClaimPublication(this)) { return false; }
@@ -117,48 +130,48 @@ internal bool TryPublishDurableReceipt(TrayTerminalReceipt receipt)
             if (result.Status == TrayActionResultStatus.Completed && receipt.Command == TrayCommand.ShowAbout)
             {
                 if (_uiWorkCount >= 8) { return false; }
-                _completedAbout.Enqueue(result);
+                work = new UiWorkItem { Result = result, Ready = receiptReady == null };
+                _completedAbout.Enqueue(work);
                 _uiWorkCount++;
-                notify = true;
-                accepted = true;
             }
             else if (result.Status == TrayActionResultStatus.Rejected || result.Status == TrayActionResultStatus.Failed)
             {
                 if (_uiWorkCount >= 8) { return false; }
-                _failedActions.Enqueue(result);
+                work = new UiWorkItem { Result = result, Ready = receiptReady == null };
+                _failedActions.Enqueue(work);
                 _uiWorkCount++;
-                notify = true;
-                accepted = true;
-            }
-            else
-            {
-                accepted = true;
             }
         }
-        Action presentationReady = _presentationReady;
-        if (notify && presentationReady != null)
+        if (work == null || receiptReady == null) { return true; }
+        try { receiptReady(); }
+        catch
         {
-            try { presentationReady(); }
-            catch
-            {
-                DropUiWork(receipt.Result);
-                return false;
-            }
+            DropUiWork(work);
+            return false;
+        }
+        bool repost;
+        lock (_gate)
+        {
+            if (_disposed) { return false; }
+            work.Ready = true;
+            repost = work.ProbeObserved;
+            work.ProbeObserved = false;
         }
-        return accepted;
+        if (repost) { try { receiptReady(); } catch { } }
+        return true;
     }
 
-    private void DropUiWork(TrayActionResult target)
+    private void DropUiWork(UiWorkItem target)
     {
         if (target == null) { return; }
         lock (_gate)
         {
-            Queue<TrayActionResult> queue = target.Status == TrayActionResultStatus.Completed ? _completedAbout : _failedActions;
+            Queue<UiWorkItem> queue = target.Result.Status == TrayActionResultStatus.Completed ? _completedAbout : _failedActions;
             int count = queue.Count;
             bool removed = false;
             for (int index = 0; index < count; index++)
             {
-                TrayActionResult current = queue.Dequeue();
+                UiWorkItem current = queue.Dequeue();
                 if (!removed && Object.ReferenceEquals(current, target)) { removed = true; }
                 else { queue.Enqueue(current); }
             }
@@ -171,7 +184,9 @@ internal bool TryTakeCompletedAbout(out TrayActionResult result)
         lock (_gate)
         {
             if (_completedAbout.Count == 0) { result = null; return false; }
-            result = _completedAbout.Dequeue();
+            UiWorkItem work = _completedAbout.Peek();
+            if (!work.Ready) { work.ProbeObserved = true; result = null; return false; }
+            result = _completedAbout.Dequeue().Result;
             if (_uiWorkCount > 0) { _uiWorkCount--; }
             return true;
         }
@@ -182,7 +197,9 @@ internal bool TryTakeFailedAction(out TrayActionResult result)
         lock (_gate)
         {
             if (_failedActions.Count == 0) { result = null; return false; }
-            result = _failedActions.Dequeue();
+            UiWorkItem work = _failedActions.Peek();
+            if (!work.Ready) { work.ProbeObserved = true; result = null; return false; }
+            result = _failedActions.Dequeue().Result;
             if (_uiWorkCount > 0) { _uiWorkCount--; }
             return true;
         }
diff --git a/src/trayhost/Program.cs b/src/trayhost/Program.cs
index 2cdaed1..82c310a 100644
--- a/src/trayhost/Program.cs
+++ b/src/trayhost/Program.cs
@@ -39,10 +39,17 @@ private static int RunChild(string[] args)
         PresentationSnapshot initial = TrayHostWire.ReadPresentation(initialFrame.Payload);
         Win32TrayPlatform platform = new Win32TrayPlatform();
         TrayHostApplication application = null;
+        TrayWindow window = null;
         TrayTerminalDiagnosticStore terminalStore = new TrayTerminalDiagnosticStore();
-        HostTransport transport = new HostTransport(delegate { TrayHostApplication current = application; if (current != null) { current.PostWork(); } });
+        HostTransport transport = new HostTransport(
+            delegate { TrayHostApplication current = application; if (current != null) { current.PostWork(); } },
+            delegate
+            {
+                TrayWindow current = window;
+                if (current == null || !Win32TrayPlatform.PostToWindow(current.OwnerHandle, TrayNativeConstants.WmApp + 2U)) { throw new InvalidOperationException("receipt UI callback failed"); }
+            });
         TrayTerminalReceiptSink receiptSink = new TrayTerminalReceiptSink(terminalStore.TryAppendDurably, transport.TryPublishDurableReceipt, terminalStore.Dispose);
-        TrayWindow window = new TrayWindow(platform, transport.SetMenuOpen);
+        window = new TrayWindow(platform, transport.SetMenuOpen);
         bool shutdownRequested = false; bool shutdownSent = false; object stateGate = new object();
         Action<TrayCommand, ulong> command = delegate(TrayCommand selected, ulong revision)
         {
diff --git a/tests/trayhost/TrayHostTransportSelfTest.cs b/tests/trayhost/TrayHostTransportSelfTest.cs
index 43436fe..1352d8c 100644
--- a/tests/trayhost/TrayHostTransportSelfTest.cs
+++ b/tests/trayhost/TrayHostTransportSelfTest.cs
@@ -102,8 +102,9 @@ private static void AssertReturnsQuickly(Stopwatch elapsed, string message)
     private static void WaitUntil(Func<bool> condition, int milliseconds, string message)
     {
         Stopwatch elapsed = Stopwatch.StartNew();
-        while (!condition() && elapsed.ElapsedMilliseconds < milliseconds) { Thread.Sleep(5); }
-        AssertTrue(condition(), message);
+        bool satisfied = condition();
+        while (!satisfied && elapsed.ElapsedMilliseconds < milliseconds) { Thread.Sleep(5); satisfied = condition(); }
+        AssertTrue(satisfied, message);
     }
 
     private static PresentationSnapshot Snapshot(ulong revision)
@@ -269,8 +270,11 @@ private static void TestBlockedReceiptStagesNeverBlockCorrelationOrUi()
                 store.Release();
                 WaitUntil(delegate { return Interlocked.CompareExchange(ref uiSignals, 0, 0) == 2; }, 2000, "both durable successes post exactly one work signal");
                 TrayActionResult firstUi; TrayActionResult followingUi; TrayActionResult none;
-                AssertTrue(host.TryTakeFailedAction(out firstUi) && firstUi.ActionId == firstId, "first durable receipt publishes its exact generic-feedback item");
-                AssertTrue(host.TryTakeCompletedAbout(out followingUi) && followingUi.ActionId == followingId, "following durable receipt publishes its exact About item");
+                firstUi = null; followingUi = null;
+                WaitUntil(delegate { return host.TryTakeFailedAction(out firstUi); }, 2000, "first durable receipt becomes visible after its callback succeeds");
+                WaitUntil(delegate { return host.TryTakeCompletedAbout(out followingUi); }, 2000, "following durable About becomes visible after its callback succeeds");
+                AssertTrue(firstUi.ActionId == firstId, "first durable receipt publishes its exact generic-feedback item");
+                AssertTrue(followingUi.ActionId == followingId, "following durable receipt publishes its exact About item");
                 AssertTrue(!host.TryTakeFailedAction(out none), "durable callbacks publish no duplicate feedback");
                 AssertTrue(store.WriterThreadCount == 1 && store.MaximumConcurrent == 1, "all blocked stages are serviced by exactly one non-overlapping writer");
             }
@@ -377,7 +381,9 @@ private static void TestStoreAndCallbackFailuresRecoverOnTheSameWriter()
             store.Release();
             WaitUntil(delegate { return store.CompletedCount == 3 && Interlocked.CompareExchange(ref successfulSignals, 0, 0) == 1; }, 3000, "same writer continues through store and callback failures to a later success");
             TrayActionResult recovered; TrayActionResult extra;
-            AssertTrue(host.TryTakeFailedAction(out recovered) && recovered.ActionId == recoveredId, "only the later durable callback publishes generic feedback");
+            recovered = null;
+            WaitUntil(delegate { return host.TryTakeFailedAction(out recovered); }, 2000, "later durable callback makes its recovered feedback visible");
+            AssertTrue(recovered.ActionId == recoveredId, "only the later durable callback publishes generic feedback");
             AssertTrue(!host.TryTakeFailedAction(out extra), "store and callback failures publish no latent UI");
             AssertTrue(store.WriterThreadCount == 1 && store.MaximumConcurrent == 1, "recovery keeps the original single writer instead of starting a replacement");
         }
@@ -426,6 +432,71 @@ private static void TestDurableReceiptTrustAndSharedUiBound()
         finally { foreign.Dispose(); host.Dispose(); }
     }
 
+    private static void TestFailingCallbackNeverExposesProvisionalUiWork()
+    {
+        ManualResetEvent callbackEntered = new ManualResetEvent(false);
+        ManualResetEvent releaseCallback = new ManualResetEvent(false);
+        HostTransport host = new HostTransport(delegate
+        {
+            callbackEntered.Set();
+            releaseCallback.WaitOne();
+            throw new InvalidOperationException("intentional UI callback failure");
+        });
+        try
+        {
+            TrayTerminalReceipt receipt = RegisterAndAcknowledgeFailure(host, Guid.NewGuid(), 29UL, "provisional callback-failure action");
+            bool published = true;
+            Thread publisher = new Thread((ThreadStart)delegate { published = host.TryPublishDurableReceipt(receipt); });
+            publisher.IsBackground = true; publisher.Start();
+            AssertTrue(callbackEntered.WaitOne(2000), "durable UI callback enters before failing");
+            TrayActionResult provisional = null; bool takeReturned = false; bool tookProvisional = true;
+            Thread taker = new Thread((ThreadStart)delegate { tookProvisional = host.TryTakeFailedAction(out provisional); takeReturned = true; });
+            taker.IsBackground = true; taker.Start();
+            AssertTrue(taker.Join(250) && takeReturned && !tookProvisional && provisional == null, "provisional UI work returns immediately but remains unavailable while callback outcome is unknown");
+            releaseCallback.Set();
+            AssertTrue(publisher.Join(2000) && !published, "throwing durable callback reports publication failure");
+            TrayActionResult none;
+            AssertTrue(!host.TryTakeFailedAction(out none), "callback failure leaves no latent generic UI work");
+        }
+        finally
+        {
+            releaseCallback.Set(); host.Dispose(); callbackEntered.Dispose(); releaseCallback.Dispose();
+        }
+    }
+
+    private static void TestSuccessfulCallbackRepostsAfterAnEarlyUiProbe()
+    {
+        ManualResetEvent callbackEntered = new ManualResetEvent(false);
+        ManualResetEvent releaseCallback = new ManualResetEvent(false);
+        int callbackCount = 0;
+        HostTransport host = new HostTransport(delegate
+        {
+            int call = Interlocked.Increment(ref callbackCount);
+            if (call == 1) { callbackEntered.Set(); releaseCallback.WaitOne(); }
+        });
+        try
+        {
+            Guid actionId = Guid.NewGuid();
+            TrayTerminalReceipt receipt = RegisterAndAcknowledgeFailure(host, actionId, 30UL, "early-probe durable action");
+            bool published = false;
+            Thread publisher = new Thread((ThreadStart)delegate { published = host.TryPublishDurableReceipt(receipt); });
+            publisher.IsBackground = true; publisher.Start();
+            AssertTrue(callbackEntered.WaitOne(2000), "first successful UI post is held before returning");
+            TrayActionResult early;
+            AssertTrue(!host.TryTakeFailedAction(out early), "work-message probe cannot consume provisional feedback");
+            releaseCallback.Set();
+            AssertTrue(publisher.Join(2000) && published, "durable publication succeeds after its first UI post returns");
+            AssertTrue(Interlocked.CompareExchange(ref callbackCount, 0, 0) == 2, "an early work-message probe causes one replacement UI post");
+            TrayActionResult ready; TrayActionResult none;
+            AssertTrue(host.TryTakeFailedAction(out ready) && ready.ActionId == actionId, "replacement post observes the now-ready durable feedback");
+            AssertTrue(!host.TryTakeFailedAction(out none), "replacement posting never duplicates the UI item");
+        }
+        finally
+        {
+            releaseCallback.Set(); host.Dispose(); callbackEntered.Dispose(); releaseCallback.Dispose();
+        }
+    }
+
     private static void TestDisposalReturnsWhileStoreIsHungAndSuppressesLateCallbacks()
     {
         ControllableReceiptStore store = new ControllableReceiptStore(ReceiptStoreBlockStage.BeforeOpen, 1);
@@ -475,8 +546,10 @@ public static int Main(string[] args)
             TestNinthReceiptAndBusyAdmissionDropWithoutPendingOrUi();
             TestStoreAndCallbackFailuresRecoverOnTheSameWriter();
             TestDurableReceiptTrustAndSharedUiBound();
+            TestFailingCallbackNeverExposesProvisionalUiWork();
+            TestSuccessfulCallbackRepostsAfterAnEarlyUiProbe();
             TestDisposalReturnsWhileStoreIsHungAndSuppressesLateCallbacks();
-            Console.WriteLine("TrayHost transport self-tests passed: 10");
+            Console.WriteLine("TrayHost transport self-tests passed: 12");
             return 0;
         }
         catch (Exception error)

From 1212579676a1b4773450ed961094a02c6322d0f7 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 10:10:14 +0800
Subject: [PATCH 033/187] fix: drop failed tray receipt reposts

---
 src/trayhost/HostTransport.cs               | 10 +++++-
 tests/trayhost/TrayHostTransportSelfTest.cs | 35 ++++++++++++++++++++-
 2 files changed, 43 insertions(+), 2 deletions(-)

diff --git a/src/trayhost/HostTransport.cs b/src/trayhost/HostTransport.cs
index fe426f1..5a6048b 100644
--- a/src/trayhost/HostTransport.cs
+++ b/src/trayhost/HostTransport.cs
@@ -157,7 +157,15 @@ internal bool TryPublishDurableReceipt(TrayTerminalReceipt receipt)
             repost = work.ProbeObserved;
             work.ProbeObserved = false;
         }
-        if (repost) { try { receiptReady(); } catch { } }
+        if (repost)
+        {
+            try { receiptReady(); }
+            catch
+            {
+                DropUiWork(work);
+                return false;
+            }
+        }
         return true;
     }
 
diff --git a/tests/trayhost/TrayHostTransportSelfTest.cs b/tests/trayhost/TrayHostTransportSelfTest.cs
index 1352d8c..c5cec99 100644
--- a/tests/trayhost/TrayHostTransportSelfTest.cs
+++ b/tests/trayhost/TrayHostTransportSelfTest.cs
@@ -497,6 +497,38 @@ private static void TestSuccessfulCallbackRepostsAfterAnEarlyUiProbe()
         }
     }
 
+    private static void TestReplacementCallbackFailureDropsReadyUiWork()
+    {
+        ManualResetEvent callbackEntered = new ManualResetEvent(false);
+        ManualResetEvent releaseCallback = new ManualResetEvent(false);
+        int callbackCount = 0;
+        HostTransport host = new HostTransport(delegate
+        {
+            int call = Interlocked.Increment(ref callbackCount);
+            if (call == 1) { callbackEntered.Set(); releaseCallback.WaitOne(); return; }
+            throw new InvalidOperationException("intentional replacement UI callback failure");
+        });
+        try
+        {
+            TrayTerminalReceipt receipt = RegisterAndAcknowledgeFailure(host, Guid.NewGuid(), 31UL, "replacement-callback failure action");
+            bool published = true;
+            Thread publisher = new Thread((ThreadStart)delegate { published = host.TryPublishDurableReceipt(receipt); });
+            publisher.IsBackground = true; publisher.Start();
+            AssertTrue(callbackEntered.WaitOne(2000), "first UI post is held before replacement-failure probe");
+            TrayActionResult early;
+            AssertTrue(!host.TryTakeFailedAction(out early), "replacement-failure probe cannot consume provisional feedback");
+            releaseCallback.Set();
+            AssertTrue(publisher.Join(2000) && !published, "replacement callback failure reports publication failure");
+            TrayActionResult none;
+            AssertTrue(!host.TryTakeFailedAction(out none), "replacement callback failure removes the ready-but-unnotified UI item");
+            AssertTrue(Interlocked.CompareExchange(ref callbackCount, 0, 0) == 2, "replacement callback is attempted exactly once");
+        }
+        finally
+        {
+            releaseCallback.Set(); host.Dispose(); callbackEntered.Dispose(); releaseCallback.Dispose();
+        }
+    }
+
     private static void TestDisposalReturnsWhileStoreIsHungAndSuppressesLateCallbacks()
     {
         ControllableReceiptStore store = new ControllableReceiptStore(ReceiptStoreBlockStage.BeforeOpen, 1);
@@ -548,8 +580,9 @@ public static int Main(string[] args)
             TestDurableReceiptTrustAndSharedUiBound();
             TestFailingCallbackNeverExposesProvisionalUiWork();
             TestSuccessfulCallbackRepostsAfterAnEarlyUiProbe();
+            TestReplacementCallbackFailureDropsReadyUiWork();
             TestDisposalReturnsWhileStoreIsHungAndSuppressesLateCallbacks();
-            Console.WriteLine("TrayHost transport self-tests passed: 12");
+            Console.WriteLine("TrayHost transport self-tests passed: 13");
             return 0;
         }
         catch (Exception error)

From 3315c33adeb67edd6dce0a22ad905a16ad49e7bd Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 10:11:26 +0800
Subject: [PATCH 034/187] docs: record async tray receipt Task 2

---
 .../task-2-report.md                          | 268 ++++++++++++++++++
 1 file changed, 268 insertions(+)
 create mode 100644 .superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-2-report.md

diff --git a/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-2-report.md b/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-2-report.md
new file mode 100644
index 0000000..2320aa5
--- /dev/null
+++ b/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-2-report.md
@@ -0,0 +1,268 @@
+# Task 2 report: asynchronous bounded tray terminal receipts
+
+Date: 2026-08-28
+
+Worktree: `C:\Users\33384\Documents\Codex-Control-other-devices-Windows\.worktrees\codex-v2522-install-runtime-reliability`
+
+Branch: `codex/v2522-install-runtime-reliability`
+
+## Status
+
+Task 2 is implemented and its focused transport/native acceptance is green.
+The authenticated reader now consumes a correlated terminal result before one
+zero-wait sink submission; receipt store I/O and durable UI publication run on
+one bounded background writer. This report does not claim the Task 3 shared
+child-session/full production trace or the Task 4 release gate.
+
+## Implementation
+
+- `src/trayhost/TrayTerminalReceiptSink.cs`
+  - Adds a typed `TrayTerminalReceipt` containing the correlated immutable
+    action result plus the existing sanitized `TrayTerminalDiagnostic` used by
+    the accepted handle-pinned store.
+  - Binds each receipt to the `HostTransport` that correlated it and permits
+    publication at most once.
+  - Starts exactly one background receipt writer. No error, timeout, or hang
+    starts a replacement writer.
+  - `TrySubmit` uses a non-waiting admission gate and admits at most eight
+    outstanding receipts, including the receipt currently inside store I/O or
+    its durable callback.
+  - Store `false`/throw and callback `false`/throw drop only feedback and allow
+    the same writer to process later receipts.
+  - Disposal closes admission, clears queued work, suppresses late callbacks,
+    and joins the one writer for at most 100 ms. If store I/O remains hung, the
+    original background writer owns deferred store cleanup after it eventually
+    returns; shutdown never starts or waits for a replacement.
+- `src/trayhost/HostTransport.cs`
+  - `TryAcknowledgeAction` validates correlation under the existing lock,
+    creates the typed terminal receipt, removes the pending action, and returns
+    without file I/O or capacity waiting.
+  - `TryPublishDurableReceipt` accepts only a once-publishable receipt from the
+    same transport. Completed About maps to About work; rejected/failed maps to
+    generic failure; all other completed commands map to no UI.
+  - About and generic feedback share one eight-item UI bound. Queue or callback
+    failure consumes the publication but leaves no retryable feedback.
+  - UI work is provisional while the application-post callback is unresolved.
+    Consumers return immediately without seeing it; callback failure removes
+    it, while callback success makes it ready. If a posted work message probes
+    the provisional item before callback return, the transport posts one
+    replacement work message after marking it ready. Replacement-post failure
+    removes the ready item and returns its shared UI capacity.
+  - Presentation and receipt callbacks are separate. Application receipt work
+    posting remains outside the transport correlation lock.
+- `src/trayhost/Program.cs`
+  - Composes one existing `TrayTerminalDiagnosticStore`, one `HostTransport`,
+    and one `TrayTerminalReceiptSink`.
+  - The authenticated reader calls correlation and one `TrySubmit`, ignores
+    admission failure after the action is consumed, and no longer posts UI work
+    immediately for terminal wire results.
+  - The durable callback is the only terminal path that posts About/failure
+    work. Its production callback checks the actual `PostMessage` result and
+    fails closed before UI visibility when posting fails. Sink disposal
+    precedes window/transport disposal, and the sink owns safe deferred store
+    disposal if its writer is hung.
+  - No command-line selector, message type, wire field, direction, sequence,
+    capability, authentication, or storage-security rule changed.
+- `tests/trayhost/TrayHostTransportSelfTest.cs`
+  - Retains the parent/presentation/pending/replay/result-correlation coverage
+    and replaces the synchronous-writer expectations with Task 2 behavior.
+  - Uses a controllable fake store that blocks before open, during write, and
+    during flush.
+  - Covers current and following terminal returns under 250 ms, pending removal
+    before submission, eight outstanding including current, immediate ninth
+    drop, deterministic busy admission, closed admission, store failure,
+    callback failure, provisional UI invisibility, early-message repost, later
+    recovery on the same writer, shared UI bound, trusted once-only
+    publication, and hung-store disposal.
+  - The blocked following result is completed About, while the current result
+    is failed OpenLogs, so both About and generic feedback are proven absent
+    until explicit durable success.
+- `tests/trayhost/TrayHostNativeSelfTest.cs`
+  - Adds a fake-native-window integration test using the real handle-pinned
+    store through the asynchronous sink. Generic native feedback is unavailable
+    before durable success and appears exactly once afterward.
+- `tests/trayhost/Invoke-TrayHostSelfTest.ps1`
+  - Adds the new source to the existing temporary transport/native compilation
+    list. Production compilation already collects every `src/trayhost/*.cs`.
+- `tests/trayhost/TrayHostParentClientSelfTest.cs`
+  - Migrates the current temporary peer caller to the typed receipt/sink API so
+    the complete production source set compiles. This is only an API adaptation;
+    it is not the Task 3 shared production child-session trace.
+
+## TDD evidence
+
+### Clean baseline
+
+Before test changes:
+
+```text
+TransportOnly: exit 0, TrayHost transport self-tests passed: 10
+NativeOnly:    exit 0, TrayHost native self-tests passed: 22
+```
+
+### RED
+
+The new behavioral tests and temporary compile list were written before the
+new production source/API.
+
+Command:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -TransportOnly
+```
+
+Exit `1`; decisive output:
+
+```text
+CCOD_TRAYHOST_SOURCE_MISSING
+FullyQualifiedErrorId : CCOD_TRAYHOST_SOURCE_MISSING
+```
+
+This was the expected missing-feature RED: the planned
+`TrayTerminalReceiptSink.cs` and typed receipt API did not yet exist. No
+production source had been changed when this run was captured.
+
+### Callback-visibility RED
+
+Post-commit concurrency review identified that the first implementation placed
+UI work in a consumable queue before its application callback returned. A
+callback that later threw could therefore race a queue consumer. A test held a
+callback that would throw and probed the UI queue concurrently. Before the
+two-phase UI work fix, TransportOnly exited `1` with:
+
+```text
+TrayHost transport self-test failed: System.InvalidOperationException
+provisional UI work returns immediately but remains unavailable while callback outcome is unknown
+CCOD_TRAYHOST_NATIVE_TEST_FAILED
+```
+
+The fixed transport keeps the item provisional and nonblocking until callback
+success, or removes it before visibility on callback failure.
+
+### Early-work-message repost RED
+
+The provisional design also needs to recover when the posted work message is
+processed before the callback returns and before the item becomes ready. The
+repost behavior was removed before its test was added. Without the repost,
+TransportOnly exited `1` with:
+
+```text
+TrayHost transport self-test failed: System.InvalidOperationException
+an early work-message probe causes one replacement UI post
+CCOD_TRAYHOST_NATIVE_TEST_FAILED
+```
+
+The green implementation records the early probe, marks the item ready only
+after callback success, and posts one replacement message without duplicating
+the UI item.
+
+### Replacement-post failure RED
+
+A final callback-failure test made the replacement post throw after the first
+post succeeded but was processed while the item remained provisional. Before
+the fail-closed replacement handling, TransportOnly exited `1` with:
+
+```text
+TrayHost transport self-test failed: System.InvalidOperationException
+replacement callback failure reports publication failure
+CCOD_TRAYHOST_NATIVE_TEST_FAILED
+```
+
+The green path removes the ready-but-unnotified item, returns `false`, and
+retains no latent UI work or occupied UI capacity.
+
+### Focused GREEN and stability
+
+After the final source/test change, the focused gates were rerun:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -TransportOnly
+```
+
+Exit `0`:
+
+```text
+TrayHost transport self-tests passed: 13
+```
+
+The final transport suite was also run ten consecutive times in one stability
+probe; all ten runs reported `TrayHost transport self-tests passed: 13` with
+exit `0`.
+
+The first attempted ten-run probe exposed a test-helper defect: `WaitUntil`
+evaluated a consuming `TryTake*` condition twice, so the second evaluation saw
+an already-consumed queue and reported a false failure. The helper now caches
+the successful evaluation; no production change was made for that incident,
+and the complete ten-run probe above was rerun from the start.
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -NativeOnly
+```
+
+Exit `0`:
+
+```text
+TrayHost native self-tests passed: 23
+```
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionOnly
+```
+
+Exit `0`, no output. This compiles every production TrayHost source, including
+the new sink and all current production callers, then runs `--headless-smoke`.
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProtocolOnly
+```
+
+Exit `0`:
+
+```text
+TrayHost protocol self-tests passed: 11
+```
+
+No wire implementation file changed; the protocol run is the byte-level
+regression gate for the existing schema/directions/sequences.
+
+```powershell
+git diff --check
+```
+
+Exit `0`. Git printed only repository LF-to-CRLF conversion notices.
+
+## Diagnostic-only run, not Task 3 acceptance
+
+`ParentClientOnly` was run once after adapting its current temporary caller and
+exited `0`. That command still uses the pre-Task-3 fake peer/correlation trace;
+it does not exercise the approved shared `TrayHostChildSession` seam and is not
+counted as production-trace acceptance here.
+
+## Commit
+
+- `7549dde154fd6c2430a13aa9ddcf66698560f717` —
+  `fix: isolate tray terminal receipt writes`
+- `1f1ecc5f72fbbb1c070d62a745b36be003b50506` —
+  `fix: hide provisional tray receipt UI`
+- `1212579676a1b4773450ed961094a02c6322d0f7` —
+  `fix: drop failed tray receipt reposts`
+
+## Concerns and explicit boundaries
+
+- Task 3 remains required to extract the shared child session and prove current
+  and stale results through the real authenticated ParentClient/PowerShell
+  path with a temporary fake native runtime. The existing fake-peer diagnostic
+  is not that proof.
+- The legacy `tests/persistence/Supervisor.SelfTest.ps1` correlation bridge has
+  an explicit pre-Task-2 source list and old synchronous HostTransport calls.
+  It is a test-only caller, not production source, and is intentionally deferred
+  for the Task 3 trace/bridge migration. The full persistence suite is therefore
+  not claimed by Task 2.
+- Task 4 release-workflow/provenance gating and release-wide validation remain
+  deferred. The production build itself discovers every TrayHost `.cs` source,
+  so the new sink is compiled without a new runtime selector.
+- A receipt store that never returns leaves the one background writer alive
+  until process termination; this is the approved no-replacement failure mode.
+  Admission and pending-action capacity remain bounded and responsive.
+- No installer, installed Codex process, real tray UI, push, release, install,
+  signing, or public operation was run.

From 2f028bb1f13d3c55fd74da26c78b6b599c628571 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 10:35:35 +0800
Subject: [PATCH 035/187] docs: clarify async tray receipt callback boundary

---
 .../plans/2026-08-28-v2522-async-tray-receipts.md  | 14 +++++++++-----
 .../2026-08-28-v2522-async-tray-receipts-design.md | 14 +++++++++++---
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/docs/superpowers/plans/2026-08-28-v2522-async-tray-receipts.md b/docs/superpowers/plans/2026-08-28-v2522-async-tray-receipts.md
index 6b2a809..0a3cfea 100644
--- a/docs/superpowers/plans/2026-08-28-v2522-async-tray-receipts.md
+++ b/docs/superpowers/plans/2026-08-28-v2522-async-tray-receipts.md
@@ -92,6 +92,7 @@ fix: pin tray terminal receipt storage
 - Create: `src/trayhost/TrayTerminalReceiptSink.cs`
 - Modify: `src/trayhost/HostTransport.cs`
 - Modify: `src/trayhost/Program.cs`
+- Modify: `src/trayhost/TrayHostApplication.cs`
 - Test: `tests/trayhost/TrayHostTransportSelfTest.cs`
 - Test: `tests/trayhost/TrayHostNativeSelfTest.cs`
 
@@ -121,11 +122,14 @@ receipt-sink API is unavailable.
 
 - [ ] **Step 3: Implement one worker and bounded UI completion**
 
-Separate correlation from receipt work.  The reader submits once and returns;
-only the single background writer calls the store.  On durable success it posts
-bounded About/failure work to the existing application context.  On admission,
-store, callback, queue, or disposal failure, consume the terminal result but
-show no feedback.  Do not alter the wire result or add a new message type.
+Separate correlation from receipt work. The reader submits once and returns;
+only the single background writer calls the store. On durable success it posts
+bounded tokened About/failure work to an internal STA message path separate from
+presentation/shutdown drains; no unrelated work message may make an unresolved
+receipt visible. Callback admission and disposal must be atomic: no durable
+callback begins after close. On admission, store, callback, queue, token-post,
+or disposal failure, consume the terminal result but show no feedback. Do not
+alter the wire result or add a new message type.
 
 - [ ] **Step 4: Run GREEN**
 
diff --git a/docs/superpowers/specs/2026-08-28-v2522-async-tray-receipts-design.md b/docs/superpowers/specs/2026-08-28-v2522-async-tray-receipts-design.md
index 6c09ae1..f97052c 100644
--- a/docs/superpowers/specs/2026-08-28-v2522-async-tray-receipts-design.md
+++ b/docs/superpowers/specs/2026-08-28-v2522-async-tray-receipts-design.md
@@ -54,9 +54,17 @@ replacement thread for a stuck write.
 After a durable write, the sink calls back into `HostTransport` with the
 in-memory receipt.  The transport enqueues a single bounded UI work item:
 completed About maps to About; rejected/failed maps to the existing generic
-failure dialog; all other completed commands map to no UI.  The callback posts
-work to the STA application context outside transport locks.  The UI queue is
-also bounded at eight shared items.
+failure dialog; all other completed commands map to no UI. Receipt UI uses an
+internal tokened work message, separate from presentation/shutdown drains. The
+transport makes a token visible only for a successful tokened post; ordinary
+work messages can never consume a receipt item while that post is unresolved.
+If the post fails, the item is retracted before any UI path can see it. The UI
+queue is also bounded at eight shared items.
+
+The sink claims callback admission under its close gate before invoking the
+durable callback. Once `Dispose` closes that gate, no new callback can begin;
+an already-started callback may finish, but the disposed transport refuses to
+publish UI work.
 
 ### 2. Pinned, bounded native receipt store
 

From 85882890202f420479728a9ed1532f2085b970c8 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 11:23:35 +0800
Subject: [PATCH 036/187] fix: seal tray receipt dispatch races

---
 src/trayhost/HostTransport.cs                 | 157 +++++-----
 src/trayhost/NativeMethods.cs                 |   3 +-
 src/trayhost/Program.cs                       |  21 +-
 src/trayhost/TrayHostApplication.cs           |  30 +-
 src/trayhost/TrayTerminalReceiptSink.cs       |  28 +-
 tests/trayhost/Invoke-TrayHostSelfTest.ps1    |   1 +
 .../trayhost/TrayHostCorrelationTestBridge.cs |   1 +
 tests/trayhost/TrayHostNativeSelfTest.cs      | 106 ++++++-
 .../trayhost/TrayHostParentClientSelfTest.cs  |   1 +
 tests/trayhost/TrayHostTransportSelfTest.cs   | 274 ++++++++++++++----
 10 files changed, 459 insertions(+), 163 deletions(-)

diff --git a/src/trayhost/HostTransport.cs b/src/trayhost/HostTransport.cs
index 5a6048b..b18171f 100644
--- a/src/trayhost/HostTransport.cs
+++ b/src/trayhost/HostTransport.cs
@@ -1,6 +1,12 @@
 using System;
 using System.Collections.Generic;
 
+internal enum TrayTerminalReceiptUiKind : byte
+{
+    About = 1,
+    Failure = 2
+}
+
 internal sealed class HostTransport : IDisposable
 {
     private sealed class PendingAction
@@ -11,21 +17,24 @@ private sealed class PendingAction
 
     private sealed class UiWorkItem
     {
+        internal uint Token;
+        internal TrayTerminalReceiptUiKind Kind;
         internal TrayActionResult Result;
-        internal bool Ready;
-        internal bool ProbeObserved;
+        internal bool Committed;
+        internal bool DeliveryObserved;
     }
 
+    private const int MaximumUiWork = 8;
+    private const int MaximumTokenPostAttempts = 2;
     private readonly object _gate = new object();
     private readonly Action _presentationReady;
-    private readonly Action _receiptReady;
-    private readonly Queue<UiWorkItem> _completedAbout = new Queue<UiWorkItem>();
-    private readonly Queue<UiWorkItem> _failedActions = new Queue<UiWorkItem>();
+    private readonly Func<uint, bool> _receiptReady;
+    private readonly Dictionary<uint, UiWorkItem> _receiptUi = new Dictionary<uint, UiWorkItem>();
     private readonly Dictionary<Guid, PendingAction> _pendingActions = new Dictionary<Guid, PendingAction>();
     private readonly Queue<Guid> _recentActionOrder = new Queue<Guid>();
     private readonly HashSet<Guid> _recentActions = new HashSet<Guid>();
     private PresentationSnapshot _pendingPresentation;
-    private int _uiWorkCount;
+    private uint _nextReceiptToken = unchecked((uint)Guid.NewGuid().GetHashCode());
     private bool _menuOpen;
     private bool _disposed;
 
@@ -33,11 +42,11 @@ internal HostTransport() : this(null, null)
     {
     }
 
-    internal HostTransport(Action presentationReady) : this(presentationReady, presentationReady)
+    internal HostTransport(Action presentationReady) : this(presentationReady, null)
     {
     }
 
-    internal HostTransport(Action presentationReady, Action receiptReady)
+    internal HostTransport(Action presentationReady, Func<uint, bool> receiptReady)
     {
         _presentationReady = presentationReady;
         _receiptReady = receiptReady;
@@ -122,95 +131,71 @@ internal bool TryPublishDurableReceipt(TrayTerminalReceipt receipt)
     {
         if (receipt == null) { return false; }
         UiWorkItem work = null;
-        Action receiptReady = _receiptReady;
+        Func<uint, bool> receiptReady = _receiptReady;
         lock (_gate)
         {
             if (_disposed || !receipt.TryClaimPublication(this)) { return false; }
             TrayActionResult result = receipt.Result;
-            if (result.Status == TrayActionResultStatus.Completed && receipt.Command == TrayCommand.ShowAbout)
-            {
-                if (_uiWorkCount >= 8) { return false; }
-                work = new UiWorkItem { Result = result, Ready = receiptReady == null };
-                _completedAbout.Enqueue(work);
-                _uiWorkCount++;
-            }
-            else if (result.Status == TrayActionResultStatus.Rejected || result.Status == TrayActionResultStatus.Failed)
-            {
-                if (_uiWorkCount >= 8) { return false; }
-                work = new UiWorkItem { Result = result, Ready = receiptReady == null };
-                _failedActions.Enqueue(work);
-                _uiWorkCount++;
-            }
-        }
-        if (work == null || receiptReady == null) { return true; }
-        try { receiptReady(); }
-        catch
-        {
-            DropUiWork(work);
-            return false;
+            TrayTerminalReceiptUiKind kind;
+            if (result.Status == TrayActionResultStatus.Completed && receipt.Command == TrayCommand.ShowAbout) { kind = TrayTerminalReceiptUiKind.About; }
+            else if (result.Status == TrayActionResultStatus.Rejected || result.Status == TrayActionResultStatus.Failed) { kind = TrayTerminalReceiptUiKind.Failure; }
+            else { return true; }
+            if (receiptReady == null || _receiptUi.Count >= MaximumUiWork) { return false; }
+            uint token = NextReceiptTokenLocked();
+            if (token == 0U) { return false; }
+            work = new UiWorkItem { Token = token, Kind = kind, Result = result };
+            _receiptUi.Add(token, work);
         }
-        bool repost;
-        lock (_gate)
-        {
-            if (_disposed) { return false; }
-            work.Ready = true;
-            repost = work.ProbeObserved;
-            work.ProbeObserved = false;
-        }
-        if (repost)
+
+        for (int attempt = 0; attempt < MaximumTokenPostAttempts; attempt++)
         {
-            try { receiptReady(); }
-            catch
+            bool posted = false;
+            try { posted = receiptReady(work.Token); }
+            catch { posted = false; }
+            if (!posted) { DropUiWork(work); return false; }
+            lock (_gate)
             {
-                DropUiWork(work);
-                return false;
+                UiWorkItem current;
+                if (_disposed || !_receiptUi.TryGetValue(work.Token, out current) || !Object.ReferenceEquals(current, work)) { return false; }
+                if (!work.DeliveryObserved)
+                {
+                    work.Committed = true;
+                    return true;
+                }
+                work.DeliveryObserved = false;
             }
         }
-        return true;
+
+        DropUiWork(work);
+        return false;
     }
 
-    private void DropUiWork(UiWorkItem target)
+    internal bool TryTakeReceiptUi(uint token, out TrayTerminalReceiptUiKind kind, out TrayActionResult result)
     {
-        if (target == null) { return; }
+        kind = 0; result = null;
+        if (token == 0U) { return false; }
         lock (_gate)
         {
-            Queue<UiWorkItem> queue = target.Result.Status == TrayActionResultStatus.Completed ? _completedAbout : _failedActions;
-            int count = queue.Count;
-            bool removed = false;
-            for (int index = 0; index < count; index++)
-            {
-                UiWorkItem current = queue.Dequeue();
-                if (!removed && Object.ReferenceEquals(current, target)) { removed = true; }
-                else { queue.Enqueue(current); }
-            }
-            if (removed && _uiWorkCount > 0) { _uiWorkCount--; }
+            if (_disposed) { return false; }
+            UiWorkItem work;
+            if (!_receiptUi.TryGetValue(token, out work)) { return false; }
+            if (!work.Committed) { work.DeliveryObserved = true; return false; }
+            _receiptUi.Remove(token);
+            kind = work.Kind; result = work.Result;
+            return true;
         }
     }
 
     internal bool TryTakeCompletedAbout(out TrayActionResult result)
     {
-        lock (_gate)
-        {
-            if (_completedAbout.Count == 0) { result = null; return false; }
-            UiWorkItem work = _completedAbout.Peek();
-            if (!work.Ready) { work.ProbeObserved = true; result = null; return false; }
-            result = _completedAbout.Dequeue().Result;
-            if (_uiWorkCount > 0) { _uiWorkCount--; }
-            return true;
-        }
+        result = null;
+        return false;
     }
 
     internal bool TryTakeFailedAction(out TrayActionResult result)
     {
-        lock (_gate)
-        {
-            if (_failedActions.Count == 0) { result = null; return false; }
-            UiWorkItem work = _failedActions.Peek();
-            if (!work.Ready) { work.ProbeObserved = true; result = null; return false; }
-            result = _failedActions.Dequeue().Result;
-            if (_uiWorkCount > 0) { _uiWorkCount--; }
-            return true;
-        }
+        result = null;
+        return false;
     }
 
     public void Dispose()
@@ -219,13 +204,31 @@ public void Dispose()
         {
             if (_disposed) { return; }
             _disposed = true;
-            _completedAbout.Clear();
-            _failedActions.Clear();
-            _uiWorkCount = 0;
+            _receiptUi.Clear();
             _pendingActions.Clear();
             _recentActions.Clear();
             _recentActionOrder.Clear();
             _pendingPresentation = null;
         }
     }
+
+    private uint NextReceiptTokenLocked()
+    {
+        for (int attempt = 0; attempt < MaximumUiWork + 2; attempt++)
+        {
+            _nextReceiptToken = unchecked(_nextReceiptToken + 1U);
+            if (_nextReceiptToken != 0U && !_receiptUi.ContainsKey(_nextReceiptToken)) { return _nextReceiptToken; }
+        }
+        return 0U;
+    }
+
+    private void DropUiWork(UiWorkItem target)
+    {
+        if (target == null) { return; }
+        lock (_gate)
+        {
+            UiWorkItem current;
+            if (_receiptUi.TryGetValue(target.Token, out current) && Object.ReferenceEquals(current, target)) { _receiptUi.Remove(target.Token); }
+        }
+    }
 }
diff --git a/src/trayhost/NativeMethods.cs b/src/trayhost/NativeMethods.cs
index 9a27055..a71528d 100644
--- a/src/trayhost/NativeMethods.cs
+++ b/src/trayhost/NativeMethods.cs
@@ -77,6 +77,7 @@ internal TrayPoint(int x, int y)
 
 internal interface INativeTrayPlatform
 {
+    void SetMessageHandler(Action<uint, IntPtr, IntPtr> handler);
     IntPtr CreateOwner();
     IntPtr AssociateOwnerInputContext(IntPtr owner, IntPtr context);
     IntPtr GetOwnerInputContext(IntPtr owner);
@@ -113,7 +114,7 @@ internal sealed class Win32TrayPlatform : INativeTrayPlatform
     private Action<uint, IntPtr, IntPtr> _messageHandler;
     private IntPtr _owner;
 
-    internal void SetMessageHandler(Action<uint, IntPtr, IntPtr> handler) { _messageHandler = handler; }
+    public void SetMessageHandler(Action<uint, IntPtr, IntPtr> handler) { _messageHandler = handler; }
 
     public IntPtr CreateOwner()
     {
diff --git a/src/trayhost/Program.cs b/src/trayhost/Program.cs
index 82c310a..c2193a5 100644
--- a/src/trayhost/Program.cs
+++ b/src/trayhost/Program.cs
@@ -43,11 +43,7 @@ private static int RunChild(string[] args)
         TrayTerminalDiagnosticStore terminalStore = new TrayTerminalDiagnosticStore();
         HostTransport transport = new HostTransport(
             delegate { TrayHostApplication current = application; if (current != null) { current.PostWork(); } },
-            delegate
-            {
-                TrayWindow current = window;
-                if (current == null || !Win32TrayPlatform.PostToWindow(current.OwnerHandle, TrayNativeConstants.WmApp + 2U)) { throw new InvalidOperationException("receipt UI callback failed"); }
-            });
+            delegate(uint token) { TrayHostApplication current = application; return current != null && current.PostReceiptWork(token); });
         TrayTerminalReceiptSink receiptSink = new TrayTerminalReceiptSink(terminalStore.TryAppendDurably, transport.TryPublishDurableReceipt, terminalStore.Dispose);
         window = new TrayWindow(platform, transport.SetMenuOpen);
         bool shutdownRequested = false; bool shutdownSent = false; object stateGate = new object();
@@ -69,10 +65,6 @@ private static int RunChild(string[] args)
                     lock (WriteGate) { ProtocolCodec.WriteAuthenticated(output, ProtocolFrame.Authenticated(ProtocolDirection.HostToParent, TrayHostMessageType.PresentationAck, epoch, outboundSequence++, TrayHostWire.WriteRevision(next.Revision)), keys.HostToParent); }
                 }
             }
-            TrayActionResult about;
-            while (transport.TryTakeCompletedAbout(out about)) { window.ShowAbout(); }
-            TrayActionResult failed;
-            while (transport.TryTakeFailedAction(out failed)) { window.ShowActionFailed(); }
             bool shouldShutdown;
             lock (stateGate) { shouldShutdown = shutdownRequested && !shutdownSent; if (shouldShutdown) { shutdownSent = true; } }
             if (shouldShutdown)
@@ -82,8 +74,15 @@ private static int RunChild(string[] args)
                 application.RequestExit();
             }
         };
+        Action<uint> receiptWork = delegate(uint token)
+        {
+            TrayTerminalReceiptUiKind kind; TrayActionResult receiptResult;
+            if (!transport.TryTakeReceiptUi(token, out kind, out receiptResult)) { return; }
+            if (kind == TrayTerminalReceiptUiKind.About) { window.ShowAbout(); }
+            else if (kind == TrayTerminalReceiptUiKind.Failure) { window.ShowActionFailed(); }
+        };
         window.CommandSelected += command;
-        application = new TrayHostApplication(platform, window, command, work);
+        application = new TrayHostApplication(platform, window, command, work, receiptWork);
         window.Create(initial);
         lock (WriteGate)
         {
@@ -107,7 +106,7 @@ private static int RunChild(string[] args)
         })) { IsBackground = true, Name = "CodexRemote.TrayHost.Reader" };
         reader.Start();
         int result = application.Run();
-        receiptSink.Dispose(); application.Dispose(); transport.Dispose(); return result;
+        receiptSink.Dispose(); transport.Dispose(); application.Dispose(); return result;
     }
 
     private static bool VerifyParentIdentity(int pid, long creation)
diff --git a/src/trayhost/TrayHostApplication.cs b/src/trayhost/TrayHostApplication.cs
index 9239f79..13ca503 100644
--- a/src/trayhost/TrayHostApplication.cs
+++ b/src/trayhost/TrayHostApplication.cs
@@ -5,9 +5,10 @@
 internal sealed class TrayHostApplication : IDisposable
 {
     private readonly TrayWindow _window;
-    private readonly Win32TrayPlatform _platform;
+    private readonly INativeTrayPlatform _platform;
     private readonly Action<TrayCommand, ulong> _command;
     private readonly Action _work;
+    private readonly Action<uint> _receiptWork;
     private readonly uint _taskbarCreated;
     private bool _exitRequested;
 
@@ -17,11 +18,16 @@ internal TrayHostApplication(TrayWindow window)
         _window = window;
     }
 
-    internal TrayHostApplication(Win32TrayPlatform platform, TrayWindow window, Action<TrayCommand, ulong> command, Action work)
+    internal TrayHostApplication(INativeTrayPlatform platform, TrayWindow window, Action<TrayCommand, ulong> command, Action work)
+        : this(platform, window, command, work, null)
+    {
+    }
+
+    internal TrayHostApplication(INativeTrayPlatform platform, TrayWindow window, Action<TrayCommand, ulong> command, Action work, Action<uint> receiptWork)
     {
         if (platform == null) { throw new ArgumentNullException("platform"); }
         if (window == null) { throw new ArgumentNullException("window"); }
-        _platform = platform; _window = window; _command = command; _work = work; _taskbarCreated = (uint)Win32TrayPlatform.RegisterTaskbarCreatedMessage().ToInt64();
+        _platform = platform; _window = window; _command = command; _work = work; _receiptWork = receiptWork; _taskbarCreated = (uint)Win32TrayPlatform.RegisterTaskbarCreatedMessage().ToInt64();
         _platform.SetMessageHandler(HandleMessage);
     }
 
@@ -40,7 +46,8 @@ internal int Run()
         return 0;
     }
 
-    internal void PostWork() { if (_platform != null) { Win32TrayPlatform.PostToWindow(_window.OwnerHandle, TrayNativeConstants.WmApp + 2U); } }
+    internal void PostWork() { if (_platform != null && _window.OwnerHandle != IntPtr.Zero) { _platform.PostMessage(_window.OwnerHandle, TrayNativeConstants.WmApp + 2U, UIntPtr.Zero, IntPtr.Zero); } }
+    internal bool PostReceiptWork(uint token) { return token != 0U && _platform != null && _window.OwnerHandle != IntPtr.Zero && _platform.PostMessage(_window.OwnerHandle, TrayNativeConstants.WmApp + 3U, new UIntPtr(token), IntPtr.Zero); }
     internal void RequestExit()
     {
         if (_exitRequested) { return; }
@@ -54,6 +61,15 @@ internal static bool IsContextMenuEvent(uint message, IntPtr callbackData)
         return IsContextMenuEvent(message, IntPtr.Zero, callbackData);
     }
 
+    internal static bool TryDecodeReceiptWorkToken(uint message, IntPtr wParam, IntPtr lParam, out uint token)
+    {
+        token = 0U;
+        if (message != TrayNativeConstants.WmApp + 3U || lParam != IntPtr.Zero) { return false; }
+        ulong raw = IntPtr.Size == 4 ? unchecked((uint)wParam.ToInt32()) : unchecked((ulong)wParam.ToInt64());
+        if (raw == 0UL || raw > UInt32.MaxValue) { return false; }
+        token = unchecked((uint)raw); return true;
+    }
+
     internal static bool IsContextMenuEvent(uint message, IntPtr wParam, IntPtr lParam)
     {
         const uint wmContextMenu = 0x007bU;
@@ -74,6 +90,12 @@ private static bool HasContextMenuEvent(IntPtr value, uint wmContextMenu, uint w
 
     private void HandleMessage(uint message, IntPtr wParam, IntPtr lParam)
     {
+        uint receiptToken;
+        if (TryDecodeReceiptWorkToken(message, wParam, lParam, out receiptToken))
+        {
+            Action<uint> receiptWork = _receiptWork; if (receiptWork != null) { receiptWork(receiptToken); }
+            return;
+        }
         if (message == TrayNativeConstants.WmApp + 2U)
         {
             Action work = _work; if (work != null) { work(); }
diff --git a/src/trayhost/TrayTerminalReceiptSink.cs b/src/trayhost/TrayTerminalReceiptSink.cs
index c9b5f1c..9aeb213 100644
--- a/src/trayhost/TrayTerminalReceiptSink.cs
+++ b/src/trayhost/TrayTerminalReceiptSink.cs
@@ -42,6 +42,11 @@ internal sealed class TrayTerminalReceiptSink : IDisposable
     private int _cleanupStarted;
     private bool _writerStarted;
     private bool _closed;
+    private bool _callbackClaimed;
+
+#if TRAYHOST_RECEIPT_SELF_TEST
+    internal static Action BeforeCallbackAdmissionForTesting;
+#endif
 
     internal TrayTerminalReceiptSink(Func<TrayTerminalDiagnostic, bool> writeDurably, Func<TrayTerminalReceipt, bool> publishDurable)
         : this(writeDurably, publishDurable, null)
@@ -129,10 +134,26 @@ private void WriterMain()
                 bool durable = false;
                 try { durable = _writeDurably(receipt.Diagnostic); }
                 catch { durable = false; }
-                if (durable && !IsClosed())
+#if TRAYHOST_RECEIPT_SELF_TEST
+                if (durable)
+                {
+                    Action beforeCallbackAdmission = BeforeCallbackAdmissionForTesting;
+                    if (beforeCallbackAdmission != null) { try { beforeCallbackAdmission(); } catch { durable = false; } }
+                }
+#endif
+                bool callbackAdmitted = false;
+                if (durable)
+                {
+                    lock (_gate)
+                    {
+                        if (!_closed && !_callbackClaimed) { _callbackClaimed = true; callbackAdmitted = true; }
+                    }
+                }
+                if (callbackAdmitted)
                 {
                     try { _publishDurable(receipt); }
                     catch { }
+                    finally { lock (_gate) { _callbackClaimed = false; } }
                 }
                 lock (_gate)
                 {
@@ -153,11 +174,6 @@ private void WriterMain()
         }
     }
 
-    private bool IsClosed()
-    {
-        lock (_gate) { return _closed; }
-    }
-
     private void CleanupAfterWriter()
     {
         if (Interlocked.CompareExchange(ref _cleanupStarted, 1, 0) != 0) { return; }
diff --git a/tests/trayhost/Invoke-TrayHostSelfTest.ps1 b/tests/trayhost/Invoke-TrayHostSelfTest.ps1
index b249423..e29ca76 100644
--- a/tests/trayhost/Invoke-TrayHostSelfTest.ps1
+++ b/tests/trayhost/Invoke-TrayHostSelfTest.ps1
@@ -64,6 +64,7 @@ try{
     $outputPath=Join-Path $temporaryRoot $outputName
     $args=@('/nologo','/noconfig','/nostdlib+','/target:exe','/platform:anycpu','/optimize+','/checked+','/warn:4','/warnaserror+',('/out:{0}' -f $outputPath),('/main:{0}' -f $mainType))
     if($NativeOnly){$args+='/define:TRAYHOST_SELF_TEST'}
+    if($TransportOnly){$args+='/define:TRAYHOST_RECEIPT_SELF_TEST'}
     foreach($leaf in @('mscorlib.dll','System.dll','System.Core.dll','System.Drawing.dll')){$args+=('/reference:'+ (Join-Path $reference.ReferenceRoot $leaf))}
     if($ProductionOnly){$args+=(Get-ChildItem -LiteralPath (Join-Path $repositoryRoot 'src\trayhost') -Filter '*.cs' -File | ForEach-Object FullName)}
     else
diff --git a/tests/trayhost/TrayHostCorrelationTestBridge.cs b/tests/trayhost/TrayHostCorrelationTestBridge.cs
index a79ba20..5add2e8 100644
--- a/tests/trayhost/TrayHostCorrelationTestBridge.cs
+++ b/tests/trayhost/TrayHostCorrelationTestBridge.cs
@@ -6,6 +6,7 @@ public sealed class TrayHostCorrelationTestBridge : IDisposable
     private sealed class Platform : INativeTrayPlatform
     {
         internal uint Selection;
+        public void SetMessageHandler(Action<uint, IntPtr, IntPtr> handler) { }
         public IntPtr CreateOwner() { return new IntPtr(10); }
         public IntPtr AssociateOwnerInputContext(IntPtr owner, IntPtr context) { return new IntPtr(20); }
         public IntPtr GetOwnerInputContext(IntPtr owner) { return IntPtr.Zero; }
diff --git a/tests/trayhost/TrayHostNativeSelfTest.cs b/tests/trayhost/TrayHostNativeSelfTest.cs
index f9185b9..c34083d 100644
--- a/tests/trayhost/TrayHostNativeSelfTest.cs
+++ b/tests/trayhost/TrayHostNativeSelfTest.cs
@@ -10,6 +10,7 @@
 
 internal sealed class FakeTrayPlatform : INativeTrayPlatform
 {
+    private Action<uint, IntPtr, IntPtr> _messageHandler;
     internal readonly List<string> Calls = new List<string>();
     internal bool ForegroundResult = true;
     internal bool ForegroundProof = true;
@@ -23,6 +24,13 @@ internal sealed class FakeTrayPlatform : INativeTrayPlatform
     internal readonly List<string> AppendedText = new List<string>();
     internal readonly List<uint> Commands = new List<uint>();
     internal bool ConfirmExitResult = true;
+    internal Func<IntPtr, uint, UIntPtr, IntPtr, bool> PostMessageBehavior;
+    internal readonly List<uint> PostedMessages = new List<uint>();
+    internal readonly List<UIntPtr> PostedWParams = new List<UIntPtr>();
+    internal readonly List<IntPtr> PostedLParams = new List<IntPtr>();
+
+    public void SetMessageHandler(Action<uint, IntPtr, IntPtr> handler) { _messageHandler = handler; }
+    internal void DispatchMessage(uint message, UIntPtr wParam, IntPtr lParam) { Action<uint, IntPtr, IntPtr> handler = _messageHandler; if (handler != null) { IntPtr raw = IntPtr.Size == 4 ? new IntPtr(unchecked((int)wParam.ToUInt32())) : new IntPtr(unchecked((long)wParam.ToUInt64())); handler(message, raw, lParam); } }
 
     public IntPtr CreateOwner() { Calls.Add("CreateOwner"); return new IntPtr(10); }
     public IntPtr AssociateOwnerInputContext(IntPtr owner, IntPtr context) { Calls.Add(context == IntPtr.Zero ? "Associate:null" : "Associate:restore"); return new IntPtr(20); }
@@ -42,7 +50,7 @@ internal sealed class FakeTrayPlatform : INativeTrayPlatform
     public bool SetForegroundWindow(IntPtr owner) { Calls.Add("SetForeground"); return ForegroundResult; }
     public IntPtr GetForegroundWindow() { Calls.Add("GetForeground"); return ForegroundProof ? new IntPtr(10) : new IntPtr(11); }
     public uint TrackPopupMenuEx(IntPtr menu, uint flags, int x, int y, IntPtr owner, IntPtr parameters) { Calls.Add("Track"); TrackCalls++; if (DuringTrack != null) { DuringTrack(); } return TrackResult; }
-    public bool PostMessage(IntPtr owner, uint message, UIntPtr wParam, IntPtr lParam) { Calls.Add("WM_NULL"); return true; }
+    public bool PostMessage(IntPtr owner, uint message, UIntPtr wParam, IntPtr lParam) { Calls.Add("WM_NULL"); PostedMessages.Add(message); PostedWParams.Add(wParam); PostedLParams.Add(lParam); Func<IntPtr, uint, UIntPtr, IntPtr, bool> behavior = PostMessageBehavior; return behavior == null || behavior(owner, message, wParam, lParam); }
     public bool SetNotificationFocus(ref TrayIconData icon) { Calls.Add("NIM_SETFOCUS"); return true; }
     public bool ShowMessageBox(IntPtr owner, string text, string caption) { MessageBoxes.Add(caption + "|" + text); Calls.Add("MessageBox"); return true; }
     public bool ConfirmExit(IntPtr owner, string text, string caption) { MessageBoxes.Add(caption + "|" + text); Calls.Add("ConfirmExit"); return ConfirmExitResult; }
@@ -309,27 +317,36 @@ private static void TestDurableNativeReceiptAuthorizesGenericFeedbackOnce()
         string root = Path.Combine(Path.GetTempPath(), "ccod-tray-terminal-native-feedback-" + Guid.NewGuid().ToString("N"));
         Directory.CreateDirectory(root); CreateCompatibilityParents(root);
         FakeTrayPlatform platform = new FakeTrayPlatform(); TrayWindow window = new TrayWindow(platform); window.Create(SnapshotV2(1));
-        HostTransport transport = new HostTransport();
+        TrayHostApplication application = null; HostTransport transport = null;
+        transport = new HostTransport(null, delegate(uint token) { return application != null && application.PostReceiptWork(token); });
+        Action<uint> receiptWork = delegate(uint token)
+        {
+            TrayTerminalReceiptUiKind kind; TrayActionResult feedback;
+            if (transport.TryTakeReceiptUi(token, out kind, out feedback) && kind == TrayTerminalReceiptUiKind.Failure) { window.ShowActionFailed(); }
+        };
+        application = new TrayHostApplication(platform, window, null, null, receiptWork);
         TrayTerminalDiagnosticStore store = TestStore(root, null, null);
-        TrayTerminalReceiptSink sink = new TrayTerminalReceiptSink(store.TryAppendDurably, transport.TryPublishDurableReceipt);
+        ManualResetEvent publicationCompleted = new ManualResetEvent(false);
+        TrayTerminalReceiptSink sink = new TrayTerminalReceiptSink(store.TryAppendDurably, delegate(TrayTerminalReceipt durableReceipt) { bool published = transport.TryPublishDurableReceipt(durableReceipt); publicationCompleted.Set(); return published; });
         try
         {
             Guid actionId = Guid.NewGuid(); TrayTerminalReceipt receipt;
             AssertTrue(transport.TryRegisterAction(new TrayHostAction(actionId, TrayCommand.OpenLogs, 1UL)), "native durable-feedback action registers");
             AssertTrue(transport.TryAcknowledgeAction(new TrayActionResult(actionId, 1UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null), out receipt) && receipt != null, "native durable-feedback action returns one typed receipt");
             TrayActionResult feedback;
-            AssertTrue(!transport.TryTakeFailedAction(out feedback) && platform.MessageBoxes.Count == 0, "native generic feedback is unavailable before durable receipt success");
+            AssertTrue(!transport.TryTakeFailedAction(out feedback) && platform.PostedMessages.Count == 0 && platform.MessageBoxes.Count == 0, "native generic feedback is unavailable before durable receipt success");
             AssertTrue(sink.TrySubmit(receipt), "native receipt enters the asynchronous sink");
-            Stopwatch elapsed = Stopwatch.StartNew();
-            while (!transport.TryTakeFailedAction(out feedback) && elapsed.ElapsedMilliseconds < 3000L) { Thread.Sleep(5); }
-            AssertTrue(feedback != null && feedback.ActionId == actionId, "handle-pinned durable success authorizes the exact native feedback item");
-            window.ShowActionFailed();
+            AssertTrue(publicationCompleted.WaitOne(3000), "handle-pinned durable success completes receipt-token publication");
+            AssertTrue(platform.PostedMessages.Count == 1 && platform.PostedMessages[0] == TrayNativeConstants.WmApp + 3U && platform.PostedWParams[0] != UIntPtr.Zero, "handle-pinned durable success posts one exact receipt token to the native application");
+            AssertTrue(platform.MessageBoxes.Count == 0, "posted token does not display generic feedback before STA dispatch");
+            platform.DispatchMessage(platform.PostedMessages[0], platform.PostedWParams[0], platform.PostedLParams[0]);
             AssertTrue(platform.MessageBoxes.Count == 1, "durable native receipt displays generic feedback exactly once");
-            AssertTrue(!transport.TryTakeFailedAction(out feedback), "durable native feedback has no duplicate queue item");
+            platform.DispatchMessage(platform.PostedMessages[0], platform.PostedWParams[0], platform.PostedLParams[0]);
+            AssertTrue(platform.MessageBoxes.Count == 1 && !transport.TryTakeFailedAction(out feedback), "durable native feedback has no duplicate token or ordinary queue item");
         }
         finally
         {
-            sink.Dispose(); transport.Dispose(); window.Dispose(); store.Dispose(); try { Directory.Delete(root, true); } catch { }
+            sink.Dispose(); transport.Dispose(); application.Dispose(); store.Dispose(); publicationCompleted.Dispose(); try { Directory.Delete(root, true); } catch { }
         }
     }
 
@@ -626,6 +643,71 @@ private static void TestPostedWorkMessageDispatchesToItsOwnerWindow()
         }
     }
 
+    private static void TestReceiptWorkMessageRequiresItsExactInternalToken()
+    {
+        uint token;
+        AssertTrue(!TrayHostApplication.TryDecodeReceiptWorkToken(TrayNativeConstants.WmApp + 2U, new IntPtr(41), IntPtr.Zero, out token), "ordinary work message never decodes a receipt token");
+        AssertTrue(!TrayHostApplication.TryDecodeReceiptWorkToken(TrayNativeConstants.WmApp + 3U, IntPtr.Zero, IntPtr.Zero, out token), "zero receipt token is rejected");
+        AssertTrue(!TrayHostApplication.TryDecodeReceiptWorkToken(TrayNativeConstants.WmApp + 3U, new IntPtr(41), new IntPtr(1), out token), "receipt message rejects unexpected lParam data");
+        AssertTrue(TrayHostApplication.TryDecodeReceiptWorkToken(TrayNativeConstants.WmApp + 3U, new IntPtr(41), IntPtr.Zero, out token) && token == 41U, "receipt-specific work message preserves its exact nonzero token");
+    }
+
+    private static void TestFailedTokenPostCannotLeakIntoOrdinaryApplicationWork()
+    {
+        FakeTrayPlatform platform = new FakeTrayPlatform(); TrayWindow window = new TrayWindow(platform); window.Create(SnapshotV2(1));
+        ManualResetEvent replacementPostEntered = new ManualResetEvent(false); ManualResetEvent releaseReplacementPost = new ManualResetEvent(false);
+        TrayHostApplication application = null; HostTransport transport = null;
+        int receiptPosts = 0; int ordinaryRuns = 0; uint observedToken = 0U; bool published = true;
+        try
+        {
+            transport = new HostTransport(null, delegate(uint token) { return application != null && application.PostReceiptWork(token); });
+            Action ordinaryWork = delegate
+            {
+                Interlocked.Increment(ref ordinaryRuns);
+                TrayActionResult ordinary;
+                if (transport.TryTakeFailedAction(out ordinary)) { window.ShowActionFailed(); }
+            };
+            Action<uint> receiptWork = delegate(uint token)
+            {
+                TrayTerminalReceiptUiKind kind; TrayActionResult receiptResult;
+                if (transport.TryTakeReceiptUi(token, out kind, out receiptResult) && kind == TrayTerminalReceiptUiKind.Failure) { window.ShowActionFailed(); }
+            };
+            application = new TrayHostApplication(platform, window, null, ordinaryWork, receiptWork);
+            platform.PostMessageBehavior = delegate(IntPtr owner, uint message, UIntPtr wParam, IntPtr lParam)
+            {
+                if (message == TrayNativeConstants.WmApp + 2U) { platform.DispatchMessage(message, wParam, lParam); return true; }
+                if (message != TrayNativeConstants.WmApp + 3U) { return true; }
+                observedToken = unchecked((uint)wParam.ToUInt64());
+                int call = Interlocked.Increment(ref receiptPosts);
+                if (call == 1) { platform.DispatchMessage(message, wParam, lParam); return true; }
+                replacementPostEntered.Set(); releaseReplacementPost.WaitOne();
+                throw new InvalidOperationException("intentional token-post failure");
+            };
+
+            Guid actionId = Guid.NewGuid(); TrayTerminalReceipt receipt;
+            AssertTrue(transport.TryRegisterAction(new TrayHostAction(actionId, TrayCommand.OpenLogs, 1UL)), "token-race native action registers");
+            AssertTrue(transport.TryAcknowledgeAction(new TrayActionResult(actionId, 1UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null), out receipt) && receipt != null, "token-race native action returns one typed receipt");
+            Thread publisher = new Thread((ThreadStart)delegate { published = transport.TryPublishDurableReceipt(receipt); });
+            publisher.IsBackground = true; publisher.Start();
+            AssertTrue(replacementPostEntered.WaitOne(2000), "replacement receipt-token post is blocked before failure");
+
+            application.PostWork();
+            AssertTrue(Interlocked.CompareExchange(ref ordinaryRuns, 0, 0) == 1 && platform.MessageBoxes.Count == 0, "ordinary WmApp work cannot consume or display the unresolved receipt");
+            releaseReplacementPost.Set();
+            AssertTrue(publisher.Join(2000) && !published, "failed replacement token post reports publication failure");
+            AssertTrue(observedToken != 0U && Interlocked.CompareExchange(ref receiptPosts, 0, 0) == 2, "receipt path uses one exact token across its bounded replacement post");
+
+            platform.DispatchMessage(TrayNativeConstants.WmApp + 3U, new UIntPtr(observedToken), IntPtr.Zero);
+            TrayTerminalReceiptUiKind missingKind; TrayActionResult missingResult;
+            AssertTrue(!transport.TryTakeReceiptUi(observedToken, out missingKind, out missingResult) && platform.MessageBoxes.Count == 0, "failed token post retracts the receipt before stale token dispatch can show a generic dialog");
+        }
+        finally
+        {
+            releaseReplacementPost.Set(); if (transport != null) { transport.Dispose(); } if (application != null) { application.Dispose(); } else { window.Dispose(); }
+            replacementPostEntered.Dispose(); releaseReplacementPost.Dispose();
+        }
+    }
+
     public static int Main(string[] args)
     {
         try
@@ -653,7 +735,9 @@ public static int Main(string[] args)
             TestShellRightClickNotificationMapping();
             TestRealNativePInvokeSurface();
             TestPostedWorkMessageDispatchesToItsOwnerWindow();
-            Console.WriteLine("TrayHost native self-tests passed: 23");
+            TestReceiptWorkMessageRequiresItsExactInternalToken();
+            TestFailedTokenPostCannotLeakIntoOrdinaryApplicationWork();
+            Console.WriteLine("TrayHost native self-tests passed: 25");
             return 0;
         }
         catch (Exception error)
diff --git a/tests/trayhost/TrayHostParentClientSelfTest.cs b/tests/trayhost/TrayHostParentClientSelfTest.cs
index e83f597..5e02eec 100644
--- a/tests/trayhost/TrayHostParentClientSelfTest.cs
+++ b/tests/trayhost/TrayHostParentClientSelfTest.cs
@@ -8,6 +8,7 @@
 internal sealed class ProductionTraceTrayPlatform : INativeTrayPlatform
 {
     internal string Message;
+    public void SetMessageHandler(Action<uint, IntPtr, IntPtr> handler) { }
     public IntPtr CreateOwner() { return new IntPtr(10); }
     public IntPtr AssociateOwnerInputContext(IntPtr owner, IntPtr context) { return new IntPtr(20); }
     public IntPtr GetOwnerInputContext(IntPtr owner) { return IntPtr.Zero; }
diff --git a/tests/trayhost/TrayHostTransportSelfTest.cs b/tests/trayhost/TrayHostTransportSelfTest.cs
index c5cec99..fe2e2ef 100644
--- a/tests/trayhost/TrayHostTransportSelfTest.cs
+++ b/tests/trayhost/TrayHostTransportSelfTest.cs
@@ -82,6 +82,30 @@ public void Dispose()
         }
     }
 
+    private sealed class ReceiptTokenInbox
+    {
+        private readonly object _gate = new object();
+        private readonly Queue<uint> _tokens = new Queue<uint>();
+
+        internal bool Post(uint token)
+        {
+            if (token == 0U) { return false; }
+            lock (_gate) { _tokens.Enqueue(token); }
+            return true;
+        }
+
+        internal bool TryTake(out uint token)
+        {
+            lock (_gate)
+            {
+                if (_tokens.Count == 0) { token = 0U; return false; }
+                token = _tokens.Dequeue(); return true;
+            }
+        }
+
+        internal int Count { get { lock (_gate) { return _tokens.Count; } } }
+    }
+
     private static void AssertTrue(bool value, string message)
     {
         if (!value) { throw new InvalidOperationException(message); }
@@ -137,6 +161,35 @@ private static TrayTerminalReceipt RegisterAndAcknowledgeFailure(HostTransport h
         return AcknowledgeTerminalQuickly(host, new TrayActionResult(actionId, revision, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null), message);
     }
 
+    private static uint WaitForToken(ReceiptTokenInbox inbox, string message)
+    {
+        uint token = 0U;
+        WaitUntil(delegate { return inbox.TryTake(out token); }, 2000, message);
+        return token;
+    }
+
+    private static TrayActionResult TakeReceiptUi(HostTransport host, uint token, TrayTerminalReceiptUiKind expectedKind, string message)
+    {
+        TrayTerminalReceiptUiKind kind; TrayActionResult result;
+        AssertTrue(host.TryTakeReceiptUi(token, out kind, out result) && kind == expectedKind && result != null, message);
+        return result;
+    }
+
+    private static TrayActionResult WaitForPostedReceiptUi(HostTransport host, ReceiptTokenInbox inbox, TrayTerminalReceiptUiKind expectedKind, string message)
+    {
+        for (int attempt = 0; attempt < 2; attempt++)
+        {
+            uint token = WaitForToken(inbox, message + " token post");
+            TrayTerminalReceiptUiKind kind; TrayActionResult result;
+            if (host.TryTakeReceiptUi(token, out kind, out result))
+            {
+                AssertTrue(kind == expectedKind && result != null, message);
+                return result;
+            }
+        }
+        throw new InvalidOperationException(message + " was never committed");
+    }
+
     private static void TestParentLatestAndReservedControl()
     {
         ParentTransport transport = new ParentTransport();
@@ -244,8 +297,8 @@ private static void TestBlockedReceiptStagesNeverBlockCorrelationOrUi()
         for (int stageIndex = 0; stageIndex < stages.Length; stageIndex++)
         {
             ControllableReceiptStore store = new ControllableReceiptStore(stages[stageIndex], 1, 1);
-            int uiSignals = 0;
-            HostTransport host = new HostTransport(delegate { Interlocked.Increment(ref uiSignals); });
+            ReceiptTokenInbox inbox = new ReceiptTokenInbox();
+            HostTransport host = new HostTransport(null, inbox.Post);
             TrayTerminalReceiptSink sink = new TrayTerminalReceiptSink(store.TryAppendDurably, host.TryPublishDurableReceipt);
             try
             {
@@ -265,14 +318,12 @@ private static void TestBlockedReceiptStagesNeverBlockCorrelationOrUi()
                 AssertTrue(!host.TryAcknowledgeAction(new TrayActionResult(firstId, 24UL, TrayActionResultStatus.Failed, "CCOD_TRAY_ACTION_FAILED", null), out duplicate), "current terminal action is removed before sink submission");
                 AssertTrue(!host.TryAcknowledgeAction(new TrayActionResult(followingId, 24UL, TrayActionResultStatus.Completed, null, null), out duplicate), "following terminal action is removed before sink submission");
                 TrayActionResult prematureFailure; TrayActionResult prematureAbout;
-                AssertTrue(!host.TryTakeFailedAction(out prematureFailure) && !host.TryTakeCompletedAbout(out prematureAbout) && Interlocked.CompareExchange(ref uiSignals, 0, 0) == 0, "blocked store exposes no generic or About UI work before durable success");
+                AssertTrue(!host.TryTakeFailedAction(out prematureFailure) && !host.TryTakeCompletedAbout(out prematureAbout) && inbox.Count == 0, "blocked store exposes no generic or About UI work before durable success");
 
                 store.Release();
-                WaitUntil(delegate { return Interlocked.CompareExchange(ref uiSignals, 0, 0) == 2; }, 2000, "both durable successes post exactly one work signal");
                 TrayActionResult firstUi; TrayActionResult followingUi; TrayActionResult none;
-                firstUi = null; followingUi = null;
-                WaitUntil(delegate { return host.TryTakeFailedAction(out firstUi); }, 2000, "first durable receipt becomes visible after its callback succeeds");
-                WaitUntil(delegate { return host.TryTakeCompletedAbout(out followingUi); }, 2000, "following durable About becomes visible after its callback succeeds");
+                firstUi = WaitForPostedReceiptUi(host, inbox, TrayTerminalReceiptUiKind.Failure, "first durable receipt becomes visible only through its exact token");
+                followingUi = WaitForPostedReceiptUi(host, inbox, TrayTerminalReceiptUiKind.About, "following durable About becomes visible only through its exact token");
                 AssertTrue(firstUi.ActionId == firstId, "first durable receipt publishes its exact generic-feedback item");
                 AssertTrue(followingUi.ActionId == followingId, "following durable receipt publishes its exact About item");
                 AssertTrue(!host.TryTakeFailedAction(out none), "durable callbacks publish no duplicate feedback");
@@ -362,11 +413,11 @@ private static void TestNinthReceiptAndBusyAdmissionDropWithoutPendingOrUi()
     private static void TestStoreAndCallbackFailuresRecoverOnTheSameWriter()
     {
         ControllableReceiptStore store = new ControllableReceiptStore(ReceiptStoreBlockStage.DuringFlush, 0, 1, 1);
-        bool failCallback = true; int successfulSignals = 0;
-        HostTransport host = new HostTransport(delegate
+        bool failCallback = true; ReceiptTokenInbox inbox = new ReceiptTokenInbox();
+        HostTransport host = new HostTransport(null, delegate(uint token)
         {
             if (failCallback) { failCallback = false; throw new InvalidOperationException("intentional UI callback failure"); }
-            Interlocked.Increment(ref successfulSignals);
+            return inbox.Post(token);
         });
         TrayTerminalReceiptSink sink = new TrayTerminalReceiptSink(store.TryAppendDurably, host.TryPublishDurableReceipt);
         try
@@ -379,10 +430,9 @@ private static void TestStoreAndCallbackFailuresRecoverOnTheSameWriter()
             TrayActionResult none;
             AssertTrue(!host.TryTakeFailedAction(out none), "blocked and not-yet-durable receipts expose no UI");
             store.Release();
-            WaitUntil(delegate { return store.CompletedCount == 3 && Interlocked.CompareExchange(ref successfulSignals, 0, 0) == 1; }, 3000, "same writer continues through store and callback failures to a later success");
+            WaitUntil(delegate { return store.CompletedCount == 3 && inbox.Count != 0; }, 3000, "same writer continues through store and callback failures to a later token post");
             TrayActionResult recovered; TrayActionResult extra;
-            recovered = null;
-            WaitUntil(delegate { return host.TryTakeFailedAction(out recovered); }, 2000, "later durable callback makes its recovered feedback visible");
+            recovered = WaitForPostedReceiptUi(host, inbox, TrayTerminalReceiptUiKind.Failure, "later durable callback makes its recovered feedback visible by token");
             AssertTrue(recovered.ActionId == recoveredId, "only the later durable callback publishes generic feedback");
             AssertTrue(!host.TryTakeFailedAction(out extra), "store and callback failures publish no latent UI");
             AssertTrue(store.WriterThreadCount == 1 && store.MaximumConcurrent == 1, "recovery keeps the original single writer instead of starting a replacement");
@@ -395,8 +445,8 @@ private static void TestStoreAndCallbackFailuresRecoverOnTheSameWriter()
 
     private static void TestDurableReceiptTrustAndSharedUiBound()
     {
-        int signals = 0;
-        HostTransport host = new HostTransport(delegate { Interlocked.Increment(ref signals); });
+        ReceiptTokenInbox inbox = new ReceiptTokenInbox();
+        HostTransport host = new HostTransport(null, inbox.Post);
         HostTransport foreign = new HostTransport();
         try
         {
@@ -404,7 +454,7 @@ private static void TestDurableReceiptTrustAndSharedUiBound()
             AssertTrue(host.TryRegisterAction(new TrayHostAction(aboutId, TrayCommand.ShowAbout, 27UL)), "About action registers for durable authorization");
             TrayTerminalReceipt about = AcknowledgeTerminalQuickly(host, new TrayActionResult(aboutId, 27UL, TrayActionResultStatus.Completed, null, null), "About terminal result");
             TrayActionResult beforeDurable;
-            AssertTrue(!host.TryTakeCompletedAbout(out beforeDurable), "typed receipt alone cannot expose About UI before durable publication");
+            AssertTrue(!host.TryTakeCompletedAbout(out beforeDurable) && inbox.Count == 0, "typed receipt alone cannot expose About UI before durable publication");
             AssertTrue(!foreign.TryPublishDurableReceipt(about), "a different transport rejects a receipt it did not correlate");
             AssertTrue(host.TryPublishDurableReceipt(about), "originating transport accepts one explicit durable-success callback");
             AssertTrue(!host.TryPublishDurableReceipt(about), "the same durable receipt cannot publish twice");
@@ -422,12 +472,16 @@ private static void TestDurableReceiptTrustAndSharedUiBound()
             TrayTerminalReceipt noUi = AcknowledgeTerminalQuickly(host, new TrayActionResult(noUiId, 27UL, TrayActionResultStatus.Completed, null, null), "non-UI completion");
             AssertTrue(host.TryPublishDurableReceipt(noUi), "durable non-UI completion is consumed without UI capacity");
 
-            TrayActionResult aboutUi;
-            AssertTrue(host.TryTakeCompletedAbout(out aboutUi) && aboutUi.ActionId == aboutId, "durable About maps to one About UI item");
-            int failures = 0; TrayActionResult failed;
-            while (host.TryTakeFailedAction(out failed)) { failures++; }
+            AssertTrue(inbox.Count == 8, "only the eight admitted shared UI items receive token posts");
+            uint aboutToken; AssertTrue(inbox.TryTake(out aboutToken), "durable About token is retained");
+            TrayActionResult aboutUi = TakeReceiptUi(host, aboutToken, TrayTerminalReceiptUiKind.About, "durable About maps to one tokened About UI item");
+            AssertTrue(aboutUi.ActionId == aboutId, "durable About token retains its correlated action");
+            int failures = 0; uint failedToken;
+            while (inbox.TryTake(out failedToken))
+            {
+                TakeReceiptUi(host, failedToken, TrayTerminalReceiptUiKind.Failure, "durable failure token maps to generic UI"); failures++;
+            }
             AssertTrue(failures == 7, "About and generic failure share one eight-item UI bound");
-            AssertTrue(Interlocked.CompareExchange(ref signals, 0, 0) == 8, "only admitted UI items post application work");
         }
         finally { foreign.Dispose(); host.Dispose(); }
     }
@@ -436,8 +490,10 @@ private static void TestFailingCallbackNeverExposesProvisionalUiWork()
     {
         ManualResetEvent callbackEntered = new ManualResetEvent(false);
         ManualResetEvent releaseCallback = new ManualResetEvent(false);
-        HostTransport host = new HostTransport(delegate
+        uint observedToken = 0U;
+        HostTransport host = new HostTransport(null, delegate(uint token)
         {
+            observedToken = token;
             callbackEntered.Set();
             releaseCallback.WaitOne();
             throw new InvalidOperationException("intentional UI callback failure");
@@ -449,14 +505,14 @@ private static void TestFailingCallbackNeverExposesProvisionalUiWork()
             Thread publisher = new Thread((ThreadStart)delegate { published = host.TryPublishDurableReceipt(receipt); });
             publisher.IsBackground = true; publisher.Start();
             AssertTrue(callbackEntered.WaitOne(2000), "durable UI callback enters before failing");
-            TrayActionResult provisional = null; bool takeReturned = false; bool tookProvisional = true;
-            Thread taker = new Thread((ThreadStart)delegate { tookProvisional = host.TryTakeFailedAction(out provisional); takeReturned = true; });
+            TrayActionResult provisional = null; TrayTerminalReceiptUiKind provisionalKind = 0; bool takeReturned = false; bool tookProvisional = true;
+            Thread taker = new Thread((ThreadStart)delegate { tookProvisional = host.TryTakeReceiptUi(observedToken, out provisionalKind, out provisional); takeReturned = true; });
             taker.IsBackground = true; taker.Start();
             AssertTrue(taker.Join(250) && takeReturned && !tookProvisional && provisional == null, "provisional UI work returns immediately but remains unavailable while callback outcome is unknown");
             releaseCallback.Set();
             AssertTrue(publisher.Join(2000) && !published, "throwing durable callback reports publication failure");
-            TrayActionResult none;
-            AssertTrue(!host.TryTakeFailedAction(out none), "callback failure leaves no latent generic UI work");
+            TrayActionResult none; TrayTerminalReceiptUiKind noneKind;
+            AssertTrue(!host.TryTakeReceiptUi(observedToken, out noneKind, out none), "callback failure leaves no latent tokened generic UI work");
         }
         finally
         {
@@ -466,35 +522,31 @@ private static void TestFailingCallbackNeverExposesProvisionalUiWork()
 
     private static void TestSuccessfulCallbackRepostsAfterAnEarlyUiProbe()
     {
-        ManualResetEvent callbackEntered = new ManualResetEvent(false);
-        ManualResetEvent releaseCallback = new ManualResetEvent(false);
-        int callbackCount = 0;
-        HostTransport host = new HostTransport(delegate
+        int callbackCount = 0; uint observedToken = 0U;
+        HostTransport host = null;
+        host = new HostTransport(null, delegate(uint token)
         {
+            observedToken = token;
             int call = Interlocked.Increment(ref callbackCount);
-            if (call == 1) { callbackEntered.Set(); releaseCallback.WaitOne(); }
+            if (call == 1)
+            {
+                TrayTerminalReceiptUiKind earlyKind; TrayActionResult earlyResult;
+                AssertTrue(!host.TryTakeReceiptUi(token, out earlyKind, out earlyResult), "early token dispatch cannot consume provisional feedback");
+            }
+            return true;
         });
         try
         {
             Guid actionId = Guid.NewGuid();
             TrayTerminalReceipt receipt = RegisterAndAcknowledgeFailure(host, actionId, 30UL, "early-probe durable action");
-            bool published = false;
-            Thread publisher = new Thread((ThreadStart)delegate { published = host.TryPublishDurableReceipt(receipt); });
-            publisher.IsBackground = true; publisher.Start();
-            AssertTrue(callbackEntered.WaitOne(2000), "first successful UI post is held before returning");
-            TrayActionResult early;
-            AssertTrue(!host.TryTakeFailedAction(out early), "work-message probe cannot consume provisional feedback");
-            releaseCallback.Set();
-            AssertTrue(publisher.Join(2000) && published, "durable publication succeeds after its first UI post returns");
+            AssertTrue(host.TryPublishDurableReceipt(receipt), "durable publication succeeds after one early token delivery retry");
             AssertTrue(Interlocked.CompareExchange(ref callbackCount, 0, 0) == 2, "an early work-message probe causes one replacement UI post");
-            TrayActionResult ready; TrayActionResult none;
-            AssertTrue(host.TryTakeFailedAction(out ready) && ready.ActionId == actionId, "replacement post observes the now-ready durable feedback");
-            AssertTrue(!host.TryTakeFailedAction(out none), "replacement posting never duplicates the UI item");
-        }
-        finally
-        {
-            releaseCallback.Set(); host.Dispose(); callbackEntered.Dispose(); releaseCallback.Dispose();
+            TrayActionResult ready = TakeReceiptUi(host, observedToken, TrayTerminalReceiptUiKind.Failure, "replacement token observes the now-committed durable feedback");
+            AssertTrue(ready.ActionId == actionId, "replacement token preserves the exact correlated action");
+            TrayActionResult none; TrayTerminalReceiptUiKind noneKind;
+            AssertTrue(!host.TryTakeReceiptUi(observedToken, out noneKind, out none), "replacement posting never duplicates the tokened UI item");
         }
+        finally { host.Dispose(); }
     }
 
     private static void TestReplacementCallbackFailureDropsReadyUiWork()
@@ -502,10 +554,18 @@ private static void TestReplacementCallbackFailureDropsReadyUiWork()
         ManualResetEvent callbackEntered = new ManualResetEvent(false);
         ManualResetEvent releaseCallback = new ManualResetEvent(false);
         int callbackCount = 0;
-        HostTransport host = new HostTransport(delegate
+        uint observedToken = 0U; HostTransport host = null;
+        host = new HostTransport(null, delegate(uint token)
         {
+            observedToken = token;
             int call = Interlocked.Increment(ref callbackCount);
-            if (call == 1) { callbackEntered.Set(); releaseCallback.WaitOne(); return; }
+            if (call == 1)
+            {
+                callbackEntered.Set(); releaseCallback.WaitOne();
+                TrayTerminalReceiptUiKind earlyKind; TrayActionResult earlyResult;
+                AssertTrue(!host.TryTakeReceiptUi(token, out earlyKind, out earlyResult), "replacement-failure early token cannot consume provisional feedback");
+                return true;
+            }
             throw new InvalidOperationException("intentional replacement UI callback failure");
         });
         try
@@ -515,12 +575,10 @@ private static void TestReplacementCallbackFailureDropsReadyUiWork()
             Thread publisher = new Thread((ThreadStart)delegate { published = host.TryPublishDurableReceipt(receipt); });
             publisher.IsBackground = true; publisher.Start();
             AssertTrue(callbackEntered.WaitOne(2000), "first UI post is held before replacement-failure probe");
-            TrayActionResult early;
-            AssertTrue(!host.TryTakeFailedAction(out early), "replacement-failure probe cannot consume provisional feedback");
             releaseCallback.Set();
             AssertTrue(publisher.Join(2000) && !published, "replacement callback failure reports publication failure");
-            TrayActionResult none;
-            AssertTrue(!host.TryTakeFailedAction(out none), "replacement callback failure removes the ready-but-unnotified UI item");
+            TrayActionResult none; TrayTerminalReceiptUiKind noneKind;
+            AssertTrue(!host.TryTakeReceiptUi(observedToken, out noneKind, out none), "replacement callback failure removes the uncommitted tokened UI item");
             AssertTrue(Interlocked.CompareExchange(ref callbackCount, 0, 0) == 2, "replacement callback is attempted exactly once");
         }
         finally
@@ -529,6 +587,50 @@ private static void TestReplacementCallbackFailureDropsReadyUiWork()
         }
     }
 
+    private static void TestTokenedPostFailureNeverCommitsReceiptVisibility()
+    {
+        ManualResetEvent tokenCallbackEntered = new ManualResetEvent(false);
+        ManualResetEvent releaseTokenCallback = new ManualResetEvent(false);
+        int callbackCount = 0; int genericDialogs = 0; uint observedToken = 0U;
+        HostTransport host = null;
+        host = new HostTransport(null, delegate(uint token)
+        {
+            observedToken = token;
+            int call = Interlocked.Increment(ref callbackCount);
+            if (call == 1)
+            {
+                TrayTerminalReceiptUiKind earlyKind; TrayActionResult earlyResult;
+                AssertTrue(!host.TryTakeReceiptUi(token, out earlyKind, out earlyResult), "early token dispatch cannot consume an uncommitted receipt");
+                return true;
+            }
+            tokenCallbackEntered.Set();
+            releaseTokenCallback.WaitOne();
+            throw new InvalidOperationException("intentional token-post failure");
+        });
+        try
+        {
+            TrayTerminalReceipt receipt = RegisterAndAcknowledgeFailure(host, Guid.NewGuid(), 34UL, "token-post failure action");
+            bool published = true;
+            Thread publisher = new Thread((ThreadStart)delegate { published = host.TryPublishDurableReceipt(receipt); });
+            publisher.IsBackground = true; publisher.Start();
+            AssertTrue(tokenCallbackEntered.WaitOne(2000), "replacement token post is held before failure");
+
+            TrayTerminalReceiptUiKind ordinaryKind; TrayActionResult ordinaryResult;
+            if (host.TryTakeReceiptUi(0U, out ordinaryKind, out ordinaryResult)) { Interlocked.Increment(ref genericDialogs); }
+            AssertTrue(ordinaryResult == null && Interlocked.CompareExchange(ref genericDialogs, 0, 0) == 0, "ordinary no-token work cannot observe receipt UI while token post is unresolved");
+
+            releaseTokenCallback.Set();
+            AssertTrue(publisher.Join(2000) && !published, "failed replacement token post retracts the receipt");
+            TrayTerminalReceiptUiKind missingKind; TrayActionResult missingResult;
+            AssertTrue(observedToken != 0U && !host.TryTakeReceiptUi(observedToken, out missingKind, out missingResult) && missingResult == null, "failed token post leaves no exact-token receipt item");
+            AssertTrue(Interlocked.CompareExchange(ref genericDialogs, 0, 0) == 0, "failed token post produces no generic dialog");
+        }
+        finally
+        {
+            releaseTokenCallback.Set(); host.Dispose(); tokenCallbackEntered.Dispose(); releaseTokenCallback.Dispose();
+        }
+    }
+
     private static void TestDisposalReturnsWhileStoreIsHungAndSuppressesLateCallbacks()
     {
         ControllableReceiptStore store = new ControllableReceiptStore(ReceiptStoreBlockStage.BeforeOpen, 1);
@@ -565,6 +667,69 @@ private static void TestDisposalReturnsWhileStoreIsHungAndSuppressesLateCallback
         }
     }
 
+    private static void TestDisposeClosesCallbackAdmissionAfterDurableStoreReturn()
+    {
+        ManualResetEvent beforeAdmission = new ManualResetEvent(false);
+        ManualResetEvent releaseAdmission = new ManualResetEvent(false);
+        int callbackStarts = 0;
+        HostTransport host = new HostTransport();
+        TrayTerminalReceiptSink.BeforeCallbackAdmissionForTesting = delegate { beforeAdmission.Set(); releaseAdmission.WaitOne(); };
+        TrayTerminalReceiptSink sink = new TrayTerminalReceiptSink(
+            delegate(TrayTerminalDiagnostic record) { return true; },
+            delegate(TrayTerminalReceipt receipt) { Interlocked.Increment(ref callbackStarts); return host.TryPublishDurableReceipt(receipt); },
+            null);
+        try
+        {
+            TrayTerminalReceipt receipt = RegisterAndAcknowledgeFailure(host, Guid.NewGuid(), 33UL, "durable-to-callback dispose handoff action");
+            AssertTrue(sink.TrySubmit(receipt), "handoff receipt is admitted before its durable write");
+            AssertTrue(beforeAdmission.WaitOne(2000), "worker reaches the controlled handoff after durable store return and before callback begin");
+            Stopwatch disposal = Stopwatch.StartNew(); sink.Dispose(); disposal.Stop();
+            AssertReturnsQuickly(disposal, "dispose returns while the writer is held before callback admission");
+            releaseAdmission.Set();
+            sink.Dispose();
+            AssertTrue(Interlocked.CompareExchange(ref callbackStarts, 0, 0) == 0, "close gate prevents any new durable callback from starting after Dispose");
+            TrayActionResult none;
+            AssertTrue(!host.TryTakeFailedAction(out none), "post-close handoff cannot publish receipt UI");
+        }
+        finally
+        {
+            releaseAdmission.Set(); sink.Dispose(); TrayTerminalReceiptSink.BeforeCallbackAdmissionForTesting = null; host.Dispose(); beforeAdmission.Dispose(); releaseAdmission.Dispose();
+        }
+    }
+
+    private static void TestAlreadyStartedCallbackCannotPublishToDisposedTransport()
+    {
+        ManualResetEvent callbackStarted = new ManualResetEvent(false);
+        ManualResetEvent releaseCallback = new ManualResetEvent(false);
+        int tokenPosts = 0; bool callbackResult = true;
+        HostTransport host = new HostTransport(null, delegate(uint token) { Interlocked.Increment(ref tokenPosts); return true; });
+        TrayTerminalReceiptSink sink = new TrayTerminalReceiptSink(
+            delegate(TrayTerminalDiagnostic record) { return true; },
+            delegate(TrayTerminalReceipt receipt)
+            {
+                callbackStarted.Set();
+                releaseCallback.WaitOne();
+                callbackResult = host.TryPublishDurableReceipt(receipt);
+                return callbackResult;
+            });
+        try
+        {
+            TrayTerminalReceipt receipt = RegisterAndAcknowledgeFailure(host, Guid.NewGuid(), 35UL, "already-started callback disposal action");
+            AssertTrue(sink.TrySubmit(receipt), "already-started callback receipt is admitted");
+            AssertTrue(callbackStarted.WaitOne(2000), "durable callback starts before sink closure");
+            Stopwatch disposal = Stopwatch.StartNew(); sink.Dispose(); disposal.Stop();
+            AssertReturnsQuickly(disposal, "sink disposal remains bounded with one already-started callback");
+            host.Dispose();
+            releaseCallback.Set();
+            sink.Dispose();
+            AssertTrue(!callbackResult && Interlocked.CompareExchange(ref tokenPosts, 0, 0) == 0, "already-started callback cannot token-post receipt UI to a disposed transport");
+        }
+        finally
+        {
+            releaseCallback.Set(); sink.Dispose(); host.Dispose(); callbackStarted.Dispose(); releaseCallback.Dispose();
+        }
+    }
+
     public static int Main(string[] args)
     {
         try
@@ -582,7 +747,10 @@ public static int Main(string[] args)
             TestSuccessfulCallbackRepostsAfterAnEarlyUiProbe();
             TestReplacementCallbackFailureDropsReadyUiWork();
             TestDisposalReturnsWhileStoreIsHungAndSuppressesLateCallbacks();
-            Console.WriteLine("TrayHost transport self-tests passed: 13");
+            TestDisposeClosesCallbackAdmissionAfterDurableStoreReturn();
+            TestAlreadyStartedCallbackCannotPublishToDisposedTransport();
+            TestTokenedPostFailureNeverCommitsReceiptVisibility();
+            Console.WriteLine("TrayHost transport self-tests passed: 16");
             return 0;
         }
         catch (Exception error)

From 924a97ac829f827908c06a8b7c73cfa6f2c5948d Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 11:25:05 +0800
Subject: [PATCH 037/187] docs: record tray receipt race fix

---
 .../task-2-report.md                          | 91 +++++++++++++++++++
 1 file changed, 91 insertions(+)

diff --git a/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-2-report.md b/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-2-report.md
index 2320aa5..86f9638 100644
--- a/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-2-report.md
+++ b/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-2-report.md
@@ -266,3 +266,94 @@ counted as production-trace acceptance here.
   Admission and pending-action capacity remain bounded and responsive.
 - No installer, installed Codex process, real tray UI, push, release, install,
   signing, or public operation was run.
+
+## Fix round 1/5: tokened STA visibility and atomic callback admission
+
+Review found two remaining races in the first Task 2 implementation:
+
+1. A receipt became consumable before its replacement UI-post callback had
+   returned successfully. An unrelated ordinary `WmApp+2` drain could display
+   the item before a later callback failure attempted to retract it.
+2. The sink checked `_closed` and then invoked the durable callback separately.
+   `Dispose` could close and return in that gap before a new callback began.
+
+### Implementation
+
+- `HostTransport` now assigns each bounded receipt UI item one nonzero,
+  process-randomized `uint` token and keeps the item uncommitted while its
+  token-post callback is unresolved.
+- Receipt UI lives in one token-keyed eight-item map shared by About and
+  failure. Ordinary no-token drains always return no item; only
+  `TryTakeReceiptUi(exactToken, ...)` can consume a committed receipt.
+- An early exact-token delivery records an observation without exposing UI.
+  The transport permits one bounded replacement post while the item remains
+  uncommitted. A false/throwing post, a second early delivery, disposal, or an
+  invalid token retracts the item before any UI result is returned.
+- `TrayHostApplication` owns internal `WmApp+3` receipt-token posting and
+  decoding. `WmApp+2` remains exclusively the presentation/shutdown work path.
+  The pipe protocol, CLI inputs, authenticated message types, and wire fields
+  are unchanged.
+- `Program` removed receipt drains from ordinary work and maps only an exact
+  `WmApp+3` token to About or generic failure. Shutdown closes the sink, then
+  disposes the transport before destroying the window.
+- `TrayTerminalReceiptSink` now sets an explicit `_callbackClaimed` state under
+  the same `_gate` used by `Dispose`, before invoking the callback, and clears
+  it in `finally`. Once close wins the gate, no new callback claim succeeds.
+  An already-started callback may finish, but a disposed transport rejects its
+  token publication.
+- The callback-handoff barrier is compiled only into the temporary
+  `TRAYHOST_RECEIPT_SELF_TEST` TransportOnly executable. No production test
+  selector, environment switch, listener, or external control was added.
+
+### TDD RED evidence
+
+The existing shared-drain race was first captured behaviorally. Before the
+tokened path, TransportOnly exited `1` with:
+
+```text
+TrayHost transport self-test failed: System.InvalidOperationException
+ordinary work cannot expose or display receipt UI while the replacement callback is unresolved
+CCOD_TRAYHOST_NATIVE_TEST_FAILED
+```
+
+The durable-return/callback-begin handoff was then blocked deterministically.
+Before atomic callback admission, TransportOnly exited `1` with:
+
+```text
+TrayHost transport self-test failed: System.InvalidOperationException
+close gate prevents any new durable callback from starting after Dispose
+CCOD_TRAYHOST_NATIVE_TEST_FAILED
+```
+
+The desired token APIs were also written before implementation. TransportOnly
+then failed compilation because the token-aware callback,
+`TrayTerminalReceiptUiKind`, and `TryTakeReceiptUi` did not exist; NativeOnly
+failed because `TrayHostApplication.TryDecodeReceiptWorkToken` did not exist.
+
+The final deterministic NativeOnly race delivers the first `WmApp+3` token
+before its post returns, blocks the replacement token post, concurrently
+dispatches ordinary `WmApp+2`, then throws the token callback. It asserts zero
+generic dialogs before and after stale-token replay.
+
+### Fresh GREEN and stability evidence
+
+All commands below were run after the final source/test change:
+
+```text
+TransportOnly: 10 consecutive runs, each exit 0, TrayHost transport self-tests passed: 16
+NativeOnly:     5 consecutive runs, each exit 0, TrayHost native self-tests passed: 25
+ProductionOnly: exit 0, complete production compile plus --headless-smoke, no output
+ProtocolOnly:   exit 0, TrayHost protocol self-tests passed: 11
+git diff --check: exit 0; only repository LF-to-CRLF conversion notices
+```
+
+### Commit and remaining boundary
+
+- `85882890202f420479728a9ed1532f2085b970c8` —
+  `fix: seal tray receipt dispatch races`
+
+Task 3 still owns the shared child-session/authenticated production trace and
+the legacy Supervisor correlation-bridge migration; neither is claimed by this
+fix round. Task 4 release gating also remains deferred. No installer, installed
+Codex process, real tray UI, push, release, signing, install, or public operation
+was run.

From 31a74c6bbe315a293fca78bf7bfdbb88239b05d7 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 12:06:02 +0800
Subject: [PATCH 038/187] test: trace authenticated tray terminal receipts

---
 src/trayhost/Program.cs                       | 118 +------
 src/trayhost/TrayHostChildSession.cs          | 257 +++++++++++++++
 src/trayhost/WindowsTrayHostRuntime.cs        |  71 +++++
 tests/persistence/Supervisor.SelfTest.ps1     |   2 +
 tests/persistence/TrayHostClient.SelfTest.ps1 |   9 +
 .../TrayHostProductionTrace.SelfTest.ps1      | 146 +++++++--
 tests/trayhost/Invoke-TrayHostSelfTest.ps1    |  39 ++-
 .../trayhost/TrayHostCorrelationTestBridge.cs |  92 +++++-
 .../trayhost/TrayHostParentClientSelfTest.cs  |  85 +----
 .../TrayHostProductionTraceSelfTest.cs        | 298 ++++++++++++++++++
 10 files changed, 883 insertions(+), 234 deletions(-)
 create mode 100644 src/trayhost/TrayHostChildSession.cs
 create mode 100644 src/trayhost/WindowsTrayHostRuntime.cs
 create mode 100644 tests/trayhost/TrayHostProductionTraceSelfTest.cs

diff --git a/src/trayhost/Program.cs b/src/trayhost/Program.cs
index c2193a5..04aa76e 100644
--- a/src/trayhost/Program.cs
+++ b/src/trayhost/Program.cs
@@ -1,13 +1,8 @@
 using System;
-using System.Diagnostics;
 using System.IO;
-using System.Security.Cryptography;
-using System.Threading;
 
 internal static class Program
 {
-    private static readonly object WriteGate = new object();
-
     internal static int Main(string[] args)
     {
         try
@@ -21,109 +16,18 @@ internal static int Main(string[] args)
 
     private static int RunChild(string[] args)
     {
-        int expectedParentPid; long expectedParentCreation; string expectedRuntime;
-        if (!Int32.TryParse(args[2], out expectedParentPid) || !Int64.TryParse(args[4], out expectedParentCreation) || String.IsNullOrEmpty(args[6]) || !String.Equals(args[1], "--parent-pid", StringComparison.Ordinal) || !String.Equals(args[3], "--parent-created", StringComparison.Ordinal) || !String.Equals(args[5], "--runtime-id", StringComparison.Ordinal)) { return 2; }
-        expectedRuntime = args[6];
-        Stream input = Console.OpenStandardInput(); Stream output = Console.OpenStandardOutput();
-        ProtocolFrame bootstrap = ProtocolCodec.ReadBootstrap(input, ProtocolDirection.ParentToHost);
-        TrayHostHello parent = TrayHostWire.ReadParentHello(bootstrap.Payload);
-        if (parent.ProcessId != expectedParentPid || parent.CreationFileTimeUtc != expectedParentCreation || !String.Equals(parent.RuntimeId, expectedRuntime, StringComparison.Ordinal) || !VerifyParentIdentity(expectedParentPid, expectedParentCreation)) { return 2; }
-        byte[] nonce = new byte[32]; using (RandomNumberGenerator rng = RandomNumberGenerator.Create()) { rng.GetBytes(nonce); }
-        ulong epoch = (ulong)DateTime.UtcNow.Ticks;
-        Process self = Process.GetCurrentProcess();
-        ProtocolCodec.WriteBootstrap(output, ProtocolFrame.Bootstrap(ProtocolDirection.HostToParent, TrayHostMessageType.HostHello, TrayHostWire.WriteHostHello(self.Id, self.StartTime.ToFileTimeUtc(), expectedRuntime, nonce, epoch)));
-        SessionKeys keys = ProtocolCodec.DeriveDirectionalKeys(parent.SessionSeed, parent.ParentChallenge, nonce, epoch);
-        ulong inboundSequence = 1UL; ulong outboundSequence = 1UL;
-        ProtocolFrame initialFrame = ProtocolCodec.ReadAuthenticated(input, ProtocolDirection.ParentToHost, epoch, inboundSequence++, keys.ParentToHost);
-        if (initialFrame.MessageType != TrayHostMessageType.Presentation) { return 2; }
-        PresentationSnapshot initial = TrayHostWire.ReadPresentation(initialFrame.Payload);
-        Win32TrayPlatform platform = new Win32TrayPlatform();
-        TrayHostApplication application = null;
-        TrayWindow window = null;
-        TrayTerminalDiagnosticStore terminalStore = new TrayTerminalDiagnosticStore();
-        HostTransport transport = new HostTransport(
-            delegate { TrayHostApplication current = application; if (current != null) { current.PostWork(); } },
-            delegate(uint token) { TrayHostApplication current = application; return current != null && current.PostReceiptWork(token); });
-        TrayTerminalReceiptSink receiptSink = new TrayTerminalReceiptSink(terminalStore.TryAppendDurably, transport.TryPublishDurableReceipt, terminalStore.Dispose);
-        window = new TrayWindow(platform, transport.SetMenuOpen);
-        bool shutdownRequested = false; bool shutdownSent = false; object stateGate = new object();
-        Action<TrayCommand, ulong> command = delegate(TrayCommand selected, ulong revision)
-        {
-            TrayHostAction action;
-            try { action = new TrayHostAction(Guid.NewGuid(), selected, revision); }
-            catch (ArgumentException) { return; }
-            if (!transport.TryRegisterAction(action)) { return; }
-            lock (WriteGate) { ProtocolCodec.WriteAuthenticated(output, ProtocolFrame.Authenticated(ProtocolDirection.HostToParent, TrayHostMessageType.Action, epoch, outboundSequence++, TrayHostWire.WriteAction(action)), keys.HostToParent); }
-        };
-        Action work = delegate
-        {
-            PresentationSnapshot next;
-            if (transport.TryTakePresentation(out next))
-            {
-                if (window.Apply(next))
-                {
-                    lock (WriteGate) { ProtocolCodec.WriteAuthenticated(output, ProtocolFrame.Authenticated(ProtocolDirection.HostToParent, TrayHostMessageType.PresentationAck, epoch, outboundSequence++, TrayHostWire.WriteRevision(next.Revision)), keys.HostToParent); }
-                }
-            }
-            bool shouldShutdown;
-            lock (stateGate) { shouldShutdown = shutdownRequested && !shutdownSent; if (shouldShutdown) { shutdownSent = true; } }
-            if (shouldShutdown)
-            {
-                window.RequestShutdown();
-                lock (WriteGate) { ProtocolCodec.WriteAuthenticated(output, ProtocolFrame.Authenticated(ProtocolDirection.HostToParent, TrayHostMessageType.ShutdownAck, epoch, outboundSequence++, TrayHostWire.WriteRevision(window.CurrentRevision)), keys.HostToParent); }
-                application.RequestExit();
-            }
-        };
-        Action<uint> receiptWork = delegate(uint token)
-        {
-            TrayTerminalReceiptUiKind kind; TrayActionResult receiptResult;
-            if (!transport.TryTakeReceiptUi(token, out kind, out receiptResult)) { return; }
-            if (kind == TrayTerminalReceiptUiKind.About) { window.ShowAbout(); }
-            else if (kind == TrayTerminalReceiptUiKind.Failure) { window.ShowActionFailed(); }
-        };
-        window.CommandSelected += command;
-        application = new TrayHostApplication(platform, window, command, work, receiptWork);
-        window.Create(initial);
-        lock (WriteGate)
-        {
-            ProtocolCodec.WriteAuthenticated(output, ProtocolFrame.Authenticated(ProtocolDirection.HostToParent, TrayHostMessageType.PresentationAck, epoch, outboundSequence++, TrayHostWire.WriteRevision(initial.Revision)), keys.HostToParent);
-            ProtocolCodec.WriteAuthenticated(output, ProtocolFrame.Authenticated(ProtocolDirection.HostToParent, TrayHostMessageType.UiReady, epoch, outboundSequence++, TrayHostWire.WriteRevision(initial.Revision)), keys.HostToParent);
-        }
-        Thread reader = new Thread(new ThreadStart(delegate
-        {
-            try
+        TrayHostChildIdentity identity;
+        if (!TrayHostChildSession.TryCreateIdentity(args, out identity)) { return 2; }
+        return TrayHostChildSession.Run(
+            Console.OpenStandardInput(),
+            Console.OpenStandardOutput(),
+            identity,
+            new WindowsTrayHostRuntime(),
+            delegate(HostTransport transport)
             {
-                while (true)
-                {
-                    ProtocolFrame frame = ProtocolCodec.ReadAuthenticated(input, ProtocolDirection.ParentToHost, epoch, inboundSequence++, keys.ParentToHost);
-                    if (frame.MessageType == TrayHostMessageType.Presentation) { transport.TryAcceptPresentation(TrayHostWire.ReadPresentation(frame.Payload)); application.PostWork(); }
-                    else if (frame.MessageType == TrayHostMessageType.ActionResult) { if (!TryDispatchAuthenticatedActionResult(transport, receiptSink, frame.Payload)) { throw new ProtocolViolationException("action result is uncorrelated"); } }
-                    else if (frame.MessageType == TrayHostMessageType.Shutdown) { lock (stateGate) { shutdownRequested = true; } application.PostWork(); }
-                    else if (frame.MessageType == TrayHostMessageType.Ping) { lock (WriteGate) { ProtocolCodec.WriteAuthenticated(output, ProtocolFrame.Authenticated(ProtocolDirection.HostToParent, TrayHostMessageType.Pong, epoch, outboundSequence++, frame.Payload), keys.HostToParent); } }
-                }
-            }
-            catch { application.RequestExit(); }
-        })) { IsBackground = true, Name = "CodexRemote.TrayHost.Reader" };
-        reader.Start();
-        int result = application.Run();
-        receiptSink.Dispose(); transport.Dispose(); application.Dispose(); return result;
-    }
-
-    private static bool VerifyParentIdentity(int pid, long creation)
-    {
-        try { using (Process process = Process.GetProcessById(pid)) { return process.StartTime.ToFileTimeUtc() == creation; } } catch { return false; }
-    }
-
-    internal static bool TryDispatchAuthenticatedActionResult(HostTransport transport, TrayTerminalReceiptSink receiptSink, byte[] payload)
-    {
-        if (transport == null || payload == null) { return false; }
-        TrayTerminalReceipt receipt;
-        if (!transport.TryAcknowledgeAction(TrayHostWire.ReadActionResult(payload), out receipt)) { return false; }
-        if (receipt != null && receiptSink != null)
-        {
-            try { receiptSink.TrySubmit(receipt); } catch { }
-        }
-        return true;
+                TrayTerminalDiagnosticStore terminalStore = new TrayTerminalDiagnosticStore();
+                return new TrayTerminalReceiptSink(terminalStore.TryAppendDurably, transport.TryPublishDurableReceipt, terminalStore.Dispose);
+            });
     }
 
     private static int RunHeadlessSmoke()
diff --git a/src/trayhost/TrayHostChildSession.cs b/src/trayhost/TrayHostChildSession.cs
new file mode 100644
index 0000000..122d046
--- /dev/null
+++ b/src/trayhost/TrayHostChildSession.cs
@@ -0,0 +1,257 @@
+using System;
+using System.Diagnostics;
+using System.IO;
+using System.Security.Cryptography;
+using System.Threading;
+
+internal sealed class TrayHostChildIdentity
+{
+    internal int ParentProcessId { get; private set; }
+    internal long ParentCreationFileTimeUtc { get; private set; }
+    internal string RuntimeId { get; private set; }
+
+    internal TrayHostChildIdentity(int parentProcessId, long parentCreationFileTimeUtc, string runtimeId)
+    {
+        ParentProcessId = parentProcessId;
+        ParentCreationFileTimeUtc = parentCreationFileTimeUtc;
+        RuntimeId = runtimeId;
+    }
+}
+
+internal interface ITrayHostRuntime : IDisposable
+{
+    ulong CurrentRevision { get; }
+    void Initialize(Action<bool> menuOpenChanged, Action<TrayCommand, ulong> commandSelected, Action work, Action<uint> receiptWork);
+    void Create(PresentationSnapshot initial);
+    bool Apply(PresentationSnapshot snapshot);
+    void PostWork();
+    bool PostReceiptWork(uint token);
+    void ShowAbout();
+    void ShowActionFailed();
+    void RequestShutdown();
+    void RequestExit();
+    int Run();
+}
+
+internal static class TrayHostChildSession
+{
+    internal static bool TryCreateIdentity(string[] args, out TrayHostChildIdentity identity)
+    {
+        identity = null;
+        int parentProcessId;
+        long parentCreation;
+        if (args == null || args.Length != 7 ||
+            !String.Equals(args[0], "--child", StringComparison.Ordinal) ||
+            !String.Equals(args[1], "--parent-pid", StringComparison.Ordinal) ||
+            !Int32.TryParse(args[2], out parentProcessId) ||
+            !String.Equals(args[3], "--parent-created", StringComparison.Ordinal) ||
+            !Int64.TryParse(args[4], out parentCreation) ||
+            !String.Equals(args[5], "--runtime-id", StringComparison.Ordinal) ||
+            String.IsNullOrEmpty(args[6])) { return false; }
+        identity = new TrayHostChildIdentity(parentProcessId, parentCreation, args[6]);
+        return true;
+    }
+
+    internal static int Run(
+        Stream input,
+        Stream output,
+        TrayHostChildIdentity identity,
+        ITrayHostRuntime runtime,
+        Func<HostTransport, TrayTerminalReceiptSink> createReceiptSink)
+    {
+        if (input == null || output == null || identity == null || runtime == null || createReceiptSink == null) { throw new ArgumentNullException("child session dependency"); }
+        HostTransport transport = null;
+        TrayTerminalReceiptSink receiptSink = null;
+        try
+        {
+            ProtocolFrame bootstrap = ProtocolCodec.ReadBootstrap(input, ProtocolDirection.ParentToHost);
+            TrayHostHello parent = TrayHostWire.ReadParentHello(bootstrap.Payload);
+            if (parent.ProcessId != identity.ParentProcessId ||
+                parent.CreationFileTimeUtc != identity.ParentCreationFileTimeUtc ||
+                !String.Equals(parent.RuntimeId, identity.RuntimeId, StringComparison.Ordinal) ||
+                !VerifyParentIdentity(identity.ParentProcessId, identity.ParentCreationFileTimeUtc)) { return 2; }
+
+            byte[] nonce = new byte[32];
+            using (RandomNumberGenerator random = RandomNumberGenerator.Create()) { random.GetBytes(nonce); }
+            ulong epoch = (ulong)DateTime.UtcNow.Ticks;
+            Process self = Process.GetCurrentProcess();
+            try
+            {
+                ProtocolCodec.WriteBootstrap(output, ProtocolFrame.Bootstrap(
+                    ProtocolDirection.HostToParent,
+                    TrayHostMessageType.HostHello,
+                    TrayHostWire.WriteHostHello(self.Id, self.StartTime.ToFileTimeUtc(), identity.RuntimeId, nonce, epoch)));
+            }
+            finally { self.Dispose(); }
+
+            SessionKeys keys = ProtocolCodec.DeriveDirectionalKeys(parent.SessionSeed, parent.ParentChallenge, nonce, epoch);
+            ulong inboundSequence = 1UL;
+            ulong outboundSequence = 1UL;
+            object writeGate = new object();
+            ProtocolFrame initialFrame = ProtocolCodec.ReadAuthenticated(input, ProtocolDirection.ParentToHost, epoch, inboundSequence++, keys.ParentToHost);
+            if (initialFrame.MessageType != TrayHostMessageType.Presentation) { return 2; }
+            PresentationSnapshot initial = TrayHostWire.ReadPresentation(initialFrame.Payload);
+
+            transport = new HostTransport(
+                delegate { runtime.PostWork(); },
+                delegate(uint token) { return runtime.PostReceiptWork(token); });
+            receiptSink = createReceiptSink(transport);
+            if (receiptSink == null) { throw new InvalidOperationException("receipt sink is unavailable"); }
+
+            bool shutdownRequested = false;
+            bool shutdownSent = false;
+            object stateGate = new object();
+            HostTransport currentTransport = transport;
+            TrayTerminalReceiptSink currentReceiptSink = receiptSink;
+
+            Action<TrayCommand, ulong> command = delegate(TrayCommand selected, ulong revision)
+            {
+                TrayHostAction action;
+                try { action = new TrayHostAction(Guid.NewGuid(), selected, revision); }
+                catch (ArgumentException) { return; }
+                if (!currentTransport.TryRegisterAction(action)) { return; }
+                lock (writeGate)
+                {
+                    ProtocolCodec.WriteAuthenticated(output, ProtocolFrame.Authenticated(
+                        ProtocolDirection.HostToParent,
+                        TrayHostMessageType.Action,
+                        epoch,
+                        outboundSequence++,
+                        TrayHostWire.WriteAction(action)), keys.HostToParent);
+                }
+            };
+
+            Action work = delegate
+            {
+                PresentationSnapshot next;
+                if (currentTransport.TryTakePresentation(out next) && runtime.Apply(next))
+                {
+                    lock (writeGate)
+                    {
+                        ProtocolCodec.WriteAuthenticated(output, ProtocolFrame.Authenticated(
+                            ProtocolDirection.HostToParent,
+                            TrayHostMessageType.PresentationAck,
+                            epoch,
+                            outboundSequence++,
+                            TrayHostWire.WriteRevision(next.Revision)), keys.HostToParent);
+                    }
+                }
+                bool shouldShutdown;
+                lock (stateGate)
+                {
+                    shouldShutdown = shutdownRequested && !shutdownSent;
+                    if (shouldShutdown) { shutdownSent = true; }
+                }
+                if (shouldShutdown)
+                {
+                    runtime.RequestShutdown();
+                    lock (writeGate)
+                    {
+                        ProtocolCodec.WriteAuthenticated(output, ProtocolFrame.Authenticated(
+                            ProtocolDirection.HostToParent,
+                            TrayHostMessageType.ShutdownAck,
+                            epoch,
+                            outboundSequence++,
+                            TrayHostWire.WriteRevision(runtime.CurrentRevision)), keys.HostToParent);
+                    }
+                    runtime.RequestExit();
+                }
+            };
+
+            Action<uint> receiptWork = delegate(uint token)
+            {
+                TrayTerminalReceiptUiKind kind;
+                TrayActionResult receiptResult;
+                if (!currentTransport.TryTakeReceiptUi(token, out kind, out receiptResult)) { return; }
+                if (kind == TrayTerminalReceiptUiKind.About) { runtime.ShowAbout(); }
+                else if (kind == TrayTerminalReceiptUiKind.Failure) { runtime.ShowActionFailed(); }
+            };
+
+            runtime.Initialize(currentTransport.SetMenuOpen, command, work, receiptWork);
+            runtime.Create(initial);
+            lock (writeGate)
+            {
+                ProtocolCodec.WriteAuthenticated(output, ProtocolFrame.Authenticated(
+                    ProtocolDirection.HostToParent,
+                    TrayHostMessageType.PresentationAck,
+                    epoch,
+                    outboundSequence++,
+                    TrayHostWire.WriteRevision(initial.Revision)), keys.HostToParent);
+                ProtocolCodec.WriteAuthenticated(output, ProtocolFrame.Authenticated(
+                    ProtocolDirection.HostToParent,
+                    TrayHostMessageType.UiReady,
+                    epoch,
+                    outboundSequence++,
+                    TrayHostWire.WriteRevision(initial.Revision)), keys.HostToParent);
+            }
+
+            Thread reader = new Thread(new ThreadStart(delegate
+            {
+                try
+                {
+                    while (true)
+                    {
+                        ProtocolFrame frame = ProtocolCodec.ReadAuthenticated(input, ProtocolDirection.ParentToHost, epoch, inboundSequence++, keys.ParentToHost);
+                        if (frame.MessageType == TrayHostMessageType.Presentation)
+                        {
+                            currentTransport.TryAcceptPresentation(TrayHostWire.ReadPresentation(frame.Payload));
+                            runtime.PostWork();
+                        }
+                        else if (frame.MessageType == TrayHostMessageType.ActionResult)
+                        {
+                            if (!TryDispatchAuthenticatedActionResult(currentTransport, currentReceiptSink, frame.Payload)) { throw new ProtocolViolationException("action result is uncorrelated"); }
+                        }
+                        else if (frame.MessageType == TrayHostMessageType.Shutdown)
+                        {
+                            lock (stateGate) { shutdownRequested = true; }
+                            runtime.PostWork();
+                        }
+                        else if (frame.MessageType == TrayHostMessageType.Ping)
+                        {
+                            lock (writeGate)
+                            {
+                                ProtocolCodec.WriteAuthenticated(output, ProtocolFrame.Authenticated(
+                                    ProtocolDirection.HostToParent,
+                                    TrayHostMessageType.Pong,
+                                    epoch,
+                                    outboundSequence++,
+                                    frame.Payload), keys.HostToParent);
+                            }
+                        }
+                    }
+                }
+                catch { runtime.RequestExit(); }
+            })) { IsBackground = true, Name = "CodexRemote.TrayHost.Reader" };
+            reader.Start();
+            return runtime.Run();
+        }
+        finally
+        {
+            if (receiptSink != null) { receiptSink.Dispose(); }
+            if (transport != null) { transport.Dispose(); }
+            runtime.Dispose();
+        }
+    }
+
+    private static bool TryDispatchAuthenticatedActionResult(HostTransport transport, TrayTerminalReceiptSink receiptSink, byte[] payload)
+    {
+        if (transport == null || receiptSink == null || payload == null) { return false; }
+        TrayTerminalReceipt receipt;
+        if (!transport.TryAcknowledgeAction(TrayHostWire.ReadActionResult(payload), out receipt)) { return false; }
+        if (receipt != null)
+        {
+            try { receiptSink.TrySubmit(receipt); }
+            catch { }
+        }
+        return true;
+    }
+
+    private static bool VerifyParentIdentity(int processId, long creationFileTimeUtc)
+    {
+        try
+        {
+            using (Process process = Process.GetProcessById(processId)) { return process.StartTime.ToFileTimeUtc() == creationFileTimeUtc; }
+        }
+        catch { return false; }
+    }
+}
diff --git a/src/trayhost/WindowsTrayHostRuntime.cs b/src/trayhost/WindowsTrayHostRuntime.cs
new file mode 100644
index 0000000..4280440
--- /dev/null
+++ b/src/trayhost/WindowsTrayHostRuntime.cs
@@ -0,0 +1,71 @@
+using System;
+
+internal sealed class WindowsTrayHostRuntime : ITrayHostRuntime
+{
+    private Win32TrayPlatform _platform;
+    private TrayWindow _window;
+    private TrayHostApplication _application;
+    private bool _disposed;
+
+    public ulong CurrentRevision { get { return _window == null ? 0UL : _window.CurrentRevision; } }
+
+    public void Initialize(Action<bool> menuOpenChanged, Action<TrayCommand, ulong> commandSelected, Action work, Action<uint> receiptWork)
+    {
+        if (_disposed || _application != null || commandSelected == null || work == null || receiptWork == null) { throw new InvalidOperationException("Windows tray runtime initialization is invalid"); }
+        _platform = new Win32TrayPlatform();
+        _window = new TrayWindow(_platform, menuOpenChanged);
+        _window.CommandSelected += commandSelected;
+        _application = new TrayHostApplication(_platform, _window, commandSelected, work, receiptWork);
+    }
+
+    public void Create(PresentationSnapshot initial) { RequireWindow().Create(initial); }
+    public bool Apply(PresentationSnapshot snapshot) { return RequireWindow().Apply(snapshot); }
+    public void PostWork()
+    {
+        TrayHostApplication application = _application;
+        if (!_disposed && application != null) { application.PostWork(); }
+    }
+
+    public bool PostReceiptWork(uint token)
+    {
+        TrayHostApplication application = _application;
+        return !_disposed && application != null && application.PostReceiptWork(token);
+    }
+    public void ShowAbout() { RequireWindow().ShowAbout(); }
+    public void ShowActionFailed() { RequireWindow().ShowActionFailed(); }
+    public void RequestShutdown()
+    {
+        TrayWindow window = _window;
+        if (!_disposed && window != null) { window.RequestShutdown(); }
+    }
+
+    public void RequestExit()
+    {
+        TrayHostApplication application = _application;
+        if (!_disposed && application != null) { application.RequestExit(); }
+    }
+    public int Run() { return RequireApplication().Run(); }
+
+    public void Dispose()
+    {
+        if (_disposed) { return; }
+        _disposed = true;
+        if (_application != null) { _application.Dispose(); }
+        else if (_window != null) { _window.Dispose(); }
+        _application = null;
+        _window = null;
+        _platform = null;
+    }
+
+    private TrayWindow RequireWindow()
+    {
+        if (_disposed || _window == null) { throw new InvalidOperationException("Windows tray runtime is unavailable"); }
+        return _window;
+    }
+
+    private TrayHostApplication RequireApplication()
+    {
+        if (_disposed || _application == null) { throw new InvalidOperationException("Windows tray runtime is unavailable"); }
+        return _application;
+    }
+}
diff --git a/tests/persistence/Supervisor.SelfTest.ps1 b/tests/persistence/Supervisor.SelfTest.ps1
index 42d120d..7cda07f 100644
--- a/tests/persistence/Supervisor.SelfTest.ps1
+++ b/tests/persistence/Supervisor.SelfTest.ps1
@@ -820,10 +820,12 @@ function Import-CcodTrayHostCorrelationTestBridge {
         (Join-Path $trayRoot 'PipeProtocol.cs'),
         (Join-Path $trayRoot 'TransportMessages.cs'),
         (Join-Path $trayRoot 'TrayTerminalDiagnostic.cs'),
+        (Join-Path $trayRoot 'TrayTerminalReceiptSink.cs'),
         (Join-Path $trayRoot 'NativeMethods.cs'),
         (Join-Path $trayRoot 'InputModeGuard.cs'),
         (Join-Path $trayRoot 'NativeMenu.cs'),
         (Join-Path $trayRoot 'TrayWindow.cs'),
+        (Join-Path $trayRoot 'TrayHostApplication.cs'),
         (Join-Path $trayRoot 'HostTransport.cs'),
         (Join-Path $repositoryRoot 'tests\trayhost\TrayHostCorrelationTestBridge.cs')
     )
diff --git a/tests/persistence/TrayHostClient.SelfTest.ps1 b/tests/persistence/TrayHostClient.SelfTest.ps1
index 37f650c..e22877b 100644
--- a/tests/persistence/TrayHostClient.SelfTest.ps1
+++ b/tests/persistence/TrayHostClient.SelfTest.ps1
@@ -104,4 +104,13 @@ Invoke-CcodTest 'TrayHost client delivers the exact correlated terminal result t
     Assert-CcodEqual 'CCOD_TRAY_ACTION_STALE' $received[0].ErrorCode 'terminal result preserves the stable stale code'
 }
 
+Invoke-CcodTest 'production trace launches the temporary child through the normal parent client' {
+    # Production mutation caught: replacing the real child process with TestProcessFactory or bypassing TrayHostParentClient.Start.
+    $traceSource=Get-Content -LiteralPath (Join-Path $repositoryRoot 'tests\trayhost\TrayHostProductionTraceSelfTest.cs') -Raw -Encoding UTF8
+    $traceScript=Get-Content -LiteralPath (Join-Path $repositoryRoot 'tests\persistence\TrayHostProductionTrace.SelfTest.ps1') -Raw -Encoding UTF8
+    Assert-CcodTrue ($traceSource -cmatch 'TrayHostParentClient\.Start\(') 'temporary trace uses the normal parent-client start path'
+    Assert-CcodTrue ($traceSource -cnotmatch 'TestProcessFactory\s*=') 'temporary trace never assigns the parent-client test process factory'
+    Assert-CcodTrue ($traceScript -cnotmatch 'TryDispatchAuthenticatedActionResult|TryTakeFailedAction') 'PowerShell trace cannot bypass authenticated child dispatch or tokened receipt work'
+}
+
 Write-Host 'TrayHost client self-tests passed.'
diff --git a/tests/persistence/TrayHostProductionTrace.SelfTest.ps1 b/tests/persistence/TrayHostProductionTrace.SelfTest.ps1
index a5bff83..31db00a 100644
--- a/tests/persistence/TrayHostProductionTrace.SelfTest.ps1
+++ b/tests/persistence/TrayHostProductionTrace.SelfTest.ps1
@@ -1,30 +1,136 @@
-param([Parameter(Mandatory)][string]$AssemblyPath)
+param(
+    [string]$AssemblyPath,
+    [string]$CurrentTracePath,
+    [string]$StaleTracePath,
+    [string]$ProductionExePath
+)
+
 $ErrorActionPreference='Stop'
-. (Join-Path $PSScriptRoot 'TestSupport.ps1')
 $repositoryRoot=Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+if([string]::IsNullOrEmpty($AssemblyPath)-and[string]::IsNullOrEmpty($CurrentTracePath)-and[string]::IsNullOrEmpty($StaleTracePath)-and[string]::IsNullOrEmpty($ProductionExePath)){
+    & powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $repositoryRoot 'tests\trayhost\Invoke-TrayHostSelfTest.ps1') -ProductionTraceOnly
+    exit $LASTEXITCODE
+}
+foreach($path in @($AssemblyPath,$CurrentTracePath,$StaleTracePath,$ProductionExePath)){if([string]::IsNullOrEmpty($path)-or-not(Test-Path -LiteralPath $path -PathType Leaf)){throw 'CCOD_TRAYHOST_PRODUCTION_TRACE_INPUT_INVALID'}}
+
+. (Join-Path $PSScriptRoot 'TestSupport.ps1')
 [Reflection.Assembly]::LoadFrom([IO.Path]::GetFullPath($AssemblyPath))|Out-Null
-Import-Module (Join-Path $repositoryRoot 'src\persistence\modules\TrayHostClient.psm1') -Force
+Import-Module (Join-Path $repositoryRoot 'src\persistence\modules\TrayHostClient.psm1') -Force -WarningAction SilentlyContinue
+. (Join-Path $repositoryRoot 'src\persistence\Supervisor.ps1') -ReadyToken ('a'*64)
+
+function New-CcodProductionTraceContext {
+    param($Client)
+    $enabled=[pscustomobject][ordered]@{RepairEnabled=$false;LanguageEnabled=$false;OpenLogsEnabled=$true;AboutEnabled=$false;ExitEnabled=$false;Busy=$false}
+    $acknowledged=[ordered]@{};$acknowledged['1']=$enabled
+    $queue=[Collections.Generic.Queue[object]]::new()
+    $context=[pscustomobject][ordered]@{
+        Client=$Client;CommandQueue=$queue;CurrentRevision=[UInt64]1;LastAcknowledgedRevision=[UInt64]1
+        PublishedPresentations=[ordered]@{};AcknowledgedPresentations=$acknowledged;Exited=$false;LastError=$null
+    }
+    return [pscustomobject][ordered]@{Context=$context;Enabled=$enabled}
+}
+
+function New-CcodProductionTraceHostState {
+    param($Context,$Enabled)
+    return [pscustomobject][ordered]@{
+        Tray=$Context;LastAcknowledgedPresentation=$Enabled;TrayActionIds=[ordered]@{}
+        WorkerSlot=$null;LifecycleWorkerSlot=$null;LifecycleRequest=$null;Journal=$null
+        State=[pscustomobject][ordered]@{AutomationEnabled=$true;Settings=[pscustomobject]@{candidateCompatibleOptIn=$false};VerifiedPackages=[pscustomobject][ordered]@{};Damage=$null}
+        Identity=[pscustomobject][ordered]@{UserSid='S-1-5-21-111-222-333-1001';SessionId=[int]1}
+        Layout=[pscustomobject][ordered]@{RuntimeId='trace-runtime';LogDirectory='C:\Trace\Logs'}
+        PackageFullName=$null;AppAsarSha256=$null;Classification=$null;Ordinary=[object[]]@();Special=[object[]]@()
+        AttemptKeys=[ordered]@{};RecoveryIgnoreKeys=[ordered]@{};SuppressionKeys=[ordered]@{}
+        RuntimeCleanupCodes=[Collections.Generic.List[string]]::new()
+    }
+}
+
+function Wait-CcodProductionTraceWitness {
+    param([string]$Path,$Context,[scriptblock]$Condition)
+    $deadline=[DateTime]::UtcNow.AddSeconds(4)
+    while([DateTime]::UtcNow-lt$deadline){
+        Receive-CcodTrayHostEvents -Context $Context
+        $lines=if(Test-Path -LiteralPath $Path -PathType Leaf){@(Get-Content -LiteralPath $Path -ErrorAction SilentlyContinue)}else{@()}
+        if(& $Condition $lines){return @($lines)}
+        [void]$Context.Client.WaitForActivity([TimeSpan]::FromMilliseconds(25))
+    }
+    throw 'CCOD_TRAYHOST_PRODUCTION_TRACE_WITNESS_TIMEOUT'
+}
 
 function Invoke-CcodProductionTraceCase {
-    param([bool]$Stale)
-    $client=[TrayHostProductionTraceFixture]::Start($AssemblyPath,$Stale)
+    param([string]$TracePath,[bool]$Stale)
+    $client=[TrayHostProductionTraceFixture]::Start($TracePath)
     try{
-        $queue=[Collections.Generic.Queue[object]]::new()
-        $context=[pscustomobject][ordered]@{Client=$client;CommandQueue=$queue;Exited=$false;LastError=$null;PublishedPresentations=[ordered]@{};AcknowledgedPresentations=[ordered]@{}}
-        $deadline=[DateTime]::UtcNow.AddSeconds(3)
-        while($queue.Count-eq0-and[DateTime]::UtcNow-lt$deadline){[void]$client.WaitForActivity([TimeSpan]::FromMilliseconds(100));Receive-CcodTrayHostEvents -Context $context}
-        Assert-CcodEqual 1 $queue.Count 'real TrayHostClient receives one authenticated production action'
-        $action=$queue.Dequeue()
-        Assert-CcodEqual 'OpenLogs' $action.Command 'production trace preserves command through TrayHostWire and TrayHostClient'
+        $parentProcess=[Diagnostics.Process]::GetCurrentProcess()
+        try{Assert-CcodTrue ($client.Receipt.HostPid-gt0-and$client.Receipt.HostPid-ne$parentProcess.Id) 'normal parent start launches a distinct child process'}finally{$parentProcess.Dispose()}
+        $childProcess=[Diagnostics.Process]::GetProcessById($client.Receipt.HostPid)
+        try{Assert-CcodTrue ([string]::Equals([IO.Path]::GetFullPath($TracePath),[IO.Path]::GetFullPath($childProcess.MainModule.FileName),[StringComparison]::OrdinalIgnoreCase)) 'normal parent start launches the requested temporary trace executable'}finally{$childProcess.Dispose()}
+        Assert-CcodEqual 'trace-runtime' $client.Receipt.RuntimeId 'real child handshake preserves the opaque runtime identity'
+        $fixture=New-CcodProductionTraceContext $client;$context=$fixture.Context
+        $hostState=New-CcodProductionTraceHostState $context $fixture.Enabled
+        $opened=[Collections.Generic.List[string]]::new();$supervisorReceipts=[Collections.Generic.List[object]]::new()
+        $adapters=@{
+            GetUtcNow={ [DateTime]::Parse('2030-02-03T03:04:05Z').ToUniversalTime() }
+            OpenLogs={param($Path)[void]$opened.Add([string]$Path)}.GetNewClosure()
+            WriteLog={param($Record)[void]$supervisorReceipts.Add($Record)}.GetNewClosure()
+            SendTrayActionResult={param($Tray,$ActionId,$Revision,$Status,$ErrorCode,$TransactionId)[bool](Send-CcodTrayHostActionResult -Context $context -ActionId $ActionId -Revision ([UInt64]$Revision) -Status $Status -ErrorCode $ErrorCode -TransactionId $TransactionId)}.GetNewClosure()
+        }
+
+        $deadline=[DateTime]::UtcNow.AddSeconds(4)
+        while($context.CommandQueue.Count-eq0-and[DateTime]::UtcNow-lt$deadline){[void]$client.WaitForActivity([TimeSpan]::FromMilliseconds(25));Receive-CcodTrayHostEvents -Context $context}
+        Assert-CcodEqual 1 $context.CommandQueue.Count 'real TrayHostClient receives one authenticated child-session action'
+        $action=$context.CommandQueue.Dequeue()
+        Assert-CcodTrue ($action.ActionId-ne[guid]::Empty) 'production trace preserves a nonempty action id'
+        Assert-CcodEqual 'OpenLogs' $action.Command 'production trace preserves OpenLogs through native/session/wire/client'
         $expectedRevision=if($Stale){[UInt64]8}else{[UInt64]1}
-        Assert-CcodEqual $expectedRevision $action.Revision 'production trace preserves the exact presentation revision'
-        $status=if($Stale){'Rejected'}else{'Completed'}
-        $code=if($Stale){'CCOD_TRAY_ACTION_STALE'}else{$null}
-        Assert-CcodEqual $true (Send-CcodTrayHostActionResult -Context $context -ActionId $action.ActionId -Revision $action.Revision -Status $status -ErrorCode $code -TransactionId $null) 'real TrayHostClient sends the authenticated correlated terminal result'
-        Assert-CcodTrue $client.WaitForStopped([TimeSpan]::FromSeconds(3)) 'production trace peer validates Program dispatch and exits'
+        Assert-CcodEqual $expectedRevision $action.Revision 'production trace preserves the exact action revision'
+
+        $results=@(Invoke-CcodSupervisorCommand $hostState $adapters $action)
+        Assert-CcodEqual 1 $results.Count 'Supervisor produces one terminal result'
+        $expectedStatus=if($Stale){'Rejected'}else{'Completed'}
+        $expectedCode=if($Stale){'CCOD_TRAY_ACTION_STALE'}else{$null}
+        Assert-CcodEqual $expectedStatus $results[0].Status 'Supervisor makes the expected revision-bound decision'
+        if($Stale){Assert-CcodEqual $expectedCode $results[0].ErrorCode 'Supervisor preserves the expected terminal code'}else{Assert-CcodTrue ([string]::IsNullOrEmpty($results[0].ErrorCode)) 'current completion carries no terminal error code'}
+        Assert-CcodEqual $true $results[0].Delivered 'Supervisor sends the terminal result through real TrayHostClient'
+        Assert-CcodEqual $(if($Stale){0}else{1}) $opened.Count 'OpenLogs side effect occurs only for the current action'
+        Assert-CcodEqual 1 $supervisorReceipts.Count 'Supervisor records exactly one terminal decision'
+
+        $witnessPath=[TrayHostProductionTraceFixture]::GetWitnessPath($TracePath)
+        $condition=if($Stale){{param($Items)@($Items|Where-Object{$_-like'dialog *'}).Count-eq1}}else{{param($Items)@($Items|Where-Object{$_-eq'publication accepted=true'}).Count-eq1}}
+        $lines=Wait-CcodProductionTraceWitness $witnessPath $context $condition
+        $receipt="receipt command=OpenLogs revision=$expectedRevision status=$expectedStatus code=$(if($Stale){'CCOD_TRAY_ACTION_STALE'}else{'CCOD_TRAY_ACTION_COMPLETED'})"
+        Assert-CcodEqual 1 @($lines|Where-Object{$_-like'receipt *'}).Count 'child async sink writes exactly one terminal receipt'
+        Assert-CcodTrue ($lines-ccontains$receipt) 'child receipt is exact and sanitized'
+        Assert-CcodEqual 1 @($lines|Where-Object{$_-eq'publication accepted=true'}).Count 'durable receipt callback publishes exactly once'
+        if($Stale){
+            Assert-CcodTrue ($lines-ccontains'fixture command=OpenLogs revision=8') 'stale action comes from the test-only authenticated fixture'
+            $tokenPosts=@($lines|Where-Object{$_-cmatch'^post message=32771 token=[1-9][0-9]*$'})
+            Assert-CcodTrue ($tokenPosts.Count-ge1) 'stale durable callback uses nonzero tokened WmApp+3 work'
+            $dialog='dialog caption=trace-0 text=trace-15'
+            Assert-CcodEqual 1 @($lines|Where-Object{$_-like'dialog *'}).Count 'stale result displays one generic dialog'
+            Assert-CcodTrue ($lines-ccontains$dialog) 'stale dialog contains only acknowledged generic UI text'
+            Assert-CcodTrue ([Array]::IndexOf([object[]]$lines,$receipt)-lt[Array]::IndexOf([object[]]$lines,$dialog)) 'generic dialog occurs only after durable receipt success'
+            Assert-CcodTrue ([Array]::IndexOf([object[]]$lines,$tokenPosts[0])-lt[Array]::IndexOf([object[]]$lines,$dialog)) 'generic dialog is drained through tokened receipt work'
+            Assert-CcodTrue ($dialog-cnotmatch'CCOD_|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}') 'generic dialog leaks no internal code or correlation id'
+        }else{
+            Assert-CcodTrue ($lines-ccontains'native-menu command=OpenLogs') 'current action originates from real TrayWindow.HandleContextMenu'
+            Assert-CcodTrue ($lines-ccontains'native command=OpenLogs revision=1') 'current native selection retains the displayed revision'
+            Assert-CcodEqual 0 @($lines|Where-Object{$_-like'dialog *'}).Count 'current completion displays no generic dialog'
+        }
+
+        Receive-CcodTrayHostEvents -Context $context
+        Assert-CcodEqual 0 $context.CommandQueue.Count 'production trace emits no duplicate action'
+        Assert-CcodTrue ([string]::IsNullOrEmpty($context.LastError)) 'production trace emits no remote fault'
+        Assert-CcodTrue $client.BeginShutdown([ShutdownReason]::SupervisorExit,[UInt64]1) 'parent requests normal authenticated shutdown'
+        Assert-CcodTrue $client.WaitForStopped([TimeSpan]::FromSeconds(4)) 'child session returns an authenticated shutdown acknowledgement'
+        Receive-CcodTrayHostEvents -Context $context
+        Assert-CcodEqual $true $context.Exited 'TrayHostClient observes the normal child exit'
+        Assert-CcodTrue ([string]::IsNullOrEmpty($context.LastError)) 'normal child shutdown has no fault'
+        Assert-CcodEqual 0 $context.CommandQueue.Count 'normal child shutdown adds no extra action'
     }finally{$client.Dispose()}
 }
 
-Invoke-CcodProductionTraceCase $false
-Invoke-CcodProductionTraceCase $true
-Write-Host 'TrayHost production correlation trace passed: 2'
+& $ProductionExePath '--production-trace-test-selector'
+Assert-CcodEqual 2 $LASTEXITCODE 'shipped Program.Main rejects the temporary trace selector'
+Invoke-CcodProductionTraceCase $CurrentTracePath $false
+Invoke-CcodProductionTraceCase $StaleTracePath $true
+Write-Host 'TrayHost production child-session trace passed: 2'
diff --git a/tests/trayhost/Invoke-TrayHostSelfTest.ps1 b/tests/trayhost/Invoke-TrayHostSelfTest.ps1
index e29ca76..661f0d1 100644
--- a/tests/trayhost/Invoke-TrayHostSelfTest.ps1
+++ b/tests/trayhost/Invoke-TrayHostSelfTest.ps1
@@ -4,12 +4,13 @@ param(
     [switch]$NativeOnly,
     [switch]$TransportOnly,
     [switch]$ParentClientOnly,
+    [switch]$ProductionTraceOnly,
     [switch]$ProductionOnly
 )
 
 $ErrorActionPreference='Stop'
 $repositoryRoot=Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
-if((@($ProtocolOnly,$NativeOnly,$TransportOnly,$ParentClientOnly,$ProductionOnly)|Where-Object{$_}).Count -ne 1){throw 'CCOD_TRAYHOST_TEST_MODE_REQUIRED'}
+if((@($ProtocolOnly,$NativeOnly,$TransportOnly,$ParentClientOnly,$ProductionTraceOnly,$ProductionOnly)|Where-Object{$_}).Count -ne 1){throw 'CCOD_TRAYHOST_TEST_MODE_REQUIRED'}
 $protocolPath=Join-Path $repositoryRoot 'src\trayhost\PipeProtocol.cs'
 $presentationPath=Join-Path $repositoryRoot 'src\trayhost\PresentationSnapshot.cs'
 $nativeFiles=@(
@@ -36,20 +37,13 @@ $parentClientFiles=@(
     (Join-Path $repositoryRoot 'src\trayhost\JobObject.cs'),
     (Join-Path $repositoryRoot 'src\trayhost\TrayHostParentClient.cs')
 )
-$programTraceFiles=@(
-    (Join-Path $repositoryRoot 'src\trayhost\NativeMethods.cs'),
-    (Join-Path $repositoryRoot 'src\trayhost\InputModeGuard.cs'),
-    (Join-Path $repositoryRoot 'src\trayhost\NativeMenu.cs'),
-    (Join-Path $repositoryRoot 'src\trayhost\TrayWindow.cs'),
-    (Join-Path $repositoryRoot 'src\trayhost\TrayHostApplication.cs'),
-    (Join-Path $repositoryRoot 'src\trayhost\Program.cs')
-)
-$testPath=if($ProtocolOnly){Join-Path $repositoryRoot 'tests\trayhost\TrayHostProtocolSelfTest.cs'}elseif($NativeOnly){Join-Path $repositoryRoot 'tests\trayhost\TrayHostNativeSelfTest.cs'}elseif($TransportOnly){Join-Path $repositoryRoot 'tests\trayhost\TrayHostTransportSelfTest.cs'}else{Join-Path $repositoryRoot 'tests\trayhost\TrayHostParentClientSelfTest.cs'}
+$testPath=if($ProtocolOnly){Join-Path $repositoryRoot 'tests\trayhost\TrayHostProtocolSelfTest.cs'}elseif($NativeOnly){Join-Path $repositoryRoot 'tests\trayhost\TrayHostNativeSelfTest.cs'}elseif($TransportOnly){Join-Path $repositoryRoot 'tests\trayhost\TrayHostTransportSelfTest.cs'}elseif($ProductionTraceOnly){Join-Path $repositoryRoot 'tests\trayhost\TrayHostProductionTraceSelfTest.cs'}else{Join-Path $repositoryRoot 'tests\trayhost\TrayHostParentClientSelfTest.cs'}
 $requiredFiles=@($protocolPath,$presentationPath,$testPath)
 if($ProtocolOnly){$requiredFiles+=$protocolSupportFiles}
 if($NativeOnly){$requiredFiles+=$nativeFiles+$transportFiles}
 if($TransportOnly){$requiredFiles+=$transportFiles}
-if($ParentClientOnly){$requiredFiles+=$transportFiles+$parentClientFiles+$programTraceFiles}
+if($ParentClientOnly){$requiredFiles+=$transportFiles+$parentClientFiles}
+if($ProductionTraceOnly){$requiredFiles+=(Get-ChildItem -LiteralPath (Join-Path $repositoryRoot 'src\trayhost') -Filter '*.cs' -File | ForEach-Object FullName)}
 if($ProductionOnly){$requiredFiles+=(Get-ChildItem -LiteralPath (Join-Path $repositoryRoot 'src\trayhost') -Filter '*.cs' -File | ForEach-Object FullName)}
 if($requiredFiles|Where-Object{ -not(Test-Path -LiteralPath $_ -PathType Leaf)}){throw 'CCOD_TRAYHOST_SOURCE_MISSING'}
 Import-Module (Join-Path $repositoryRoot 'build\TrayHostReferencePack.psm1') -Force
@@ -59,6 +53,23 @@ $compiler=$compilerCandidates|Where-Object{Test-Path -LiteralPath $_ -PathType L
 if($null -eq $compiler){throw 'CCOD_TRAYHOST_COMPILER_MISSING'}
 $temporaryRoot=Join-Path $env:TEMP ('ccod-trayhost-protocol-'+[Guid]::NewGuid().ToString('N'));New-Item -ItemType Directory -Path $temporaryRoot -Force|Out-Null
 try{
+    if($ProductionTraceOnly){
+        $productionSources=@(Get-ChildItem -LiteralPath (Join-Path $repositoryRoot 'src\trayhost') -Filter '*.cs' -File|Sort-Object Name|ForEach-Object FullName)
+        $productionPath=Join-Path $temporaryRoot 'CodexRemote.TrayHost.exe'
+        $currentTracePath=Join-Path $temporaryRoot 'TrayHostProductionTrace.Current.exe'
+        $staleTracePath=Join-Path $temporaryRoot 'TrayHostProductionTrace.Stale.exe'
+        $compilerBase=@('/nologo','/noconfig','/nostdlib+','/target:exe','/platform:anycpu','/optimize+','/checked+','/warn:4','/warnaserror+')
+        foreach($leaf in @('mscorlib.dll','System.dll','System.Core.dll','System.Drawing.dll')){$compilerBase+=('/reference:'+ (Join-Path $reference.ReferenceRoot $leaf))}
+        & $compiler @compilerBase ('/out:'+ $productionPath) '/main:Program' @productionSources
+        if($LASTEXITCODE -ne 0){throw 'CCOD_TRAYHOST_PRODUCTION_COMPILE_FAILED'}
+        & $compiler @compilerBase ('/out:'+ $currentTracePath) '/main:TrayHostProductionTraceMain' @productionSources $testPath
+        if($LASTEXITCODE -ne 0){throw 'CCOD_TRAYHOST_PRODUCTION_TRACE_COMPILE_FAILED'}
+        & $compiler @compilerBase '/define:TRAYHOST_TRACE_STALE' ('/out:'+ $staleTracePath) '/main:TrayHostProductionTraceMain' @productionSources $testPath
+        if($LASTEXITCODE -ne 0){throw 'CCOD_TRAYHOST_PRODUCTION_TRACE_COMPILE_FAILED'}
+        & powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $repositoryRoot 'tests\persistence\TrayHostProductionTrace.SelfTest.ps1') -AssemblyPath $currentTracePath -CurrentTracePath $currentTracePath -StaleTracePath $staleTracePath -ProductionExePath $productionPath
+        if($LASTEXITCODE -ne 0){throw 'CCOD_TRAYHOST_PRODUCTION_TRACE_FAILED'}
+        return
+    }
     $outputName=if($ProtocolOnly){'TrayHostProtocolSelfTest.exe'}elseif($NativeOnly){'TrayHostNativeSelfTest.exe'}elseif($TransportOnly){'TrayHostTransportSelfTest.exe'}elseif($ParentClientOnly){'TrayHostParentClientSelfTest.exe'}else{'CodexRemote.TrayHost.exe'}
     $mainType=if($ProtocolOnly){'TrayHostProtocolSelfTest'}elseif($NativeOnly){'TrayHostNativeSelfTest'}elseif($TransportOnly){'TrayHostTransportSelfTest'}elseif($ParentClientOnly){'TrayHostParentClientSelfTest'}else{'Program'}
     $outputPath=Join-Path $temporaryRoot $outputName
@@ -73,15 +84,11 @@ try{
         if($ProtocolOnly){$args+=$protocolSupportFiles}
         if($NativeOnly){$args+=$nativeFiles+$transportFiles}
         if($TransportOnly){$args+=$transportFiles}
-        if($ParentClientOnly){$args+=$transportFiles+$parentClientFiles+$programTraceFiles}
+        if($ParentClientOnly){$args+=$transportFiles+$parentClientFiles}
     }
     $args+=$testPath
     & $compiler @args
     if($LASTEXITCODE -ne 0){if($ProtocolOnly){throw 'CCOD_TRAYHOST_PROTOCOL_COMPILE_FAILED'}elseif($ProductionOnly){throw 'CCOD_TRAYHOST_PRODUCTION_COMPILE_FAILED'}else{throw 'CCOD_TRAYHOST_NATIVE_COMPILE_FAILED'}}
     if($ProductionOnly){& $outputPath '--headless-smoke'}else{& $outputPath}
     if($LASTEXITCODE -ne 0){if($ProtocolOnly){throw 'CCOD_TRAYHOST_PROTOCOL_TEST_FAILED'}elseif($ProductionOnly){throw 'CCOD_TRAYHOST_HEADLESS_SMOKE_FAILED'}else{throw 'CCOD_TRAYHOST_NATIVE_TEST_FAILED'}}
-    if($ParentClientOnly){
-        & powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $repositoryRoot 'tests\persistence\TrayHostProductionTrace.SelfTest.ps1') -AssemblyPath $outputPath
-        if($LASTEXITCODE -ne 0){throw 'CCOD_TRAYHOST_PRODUCTION_TRACE_FAILED'}
-    }
 }finally{if(Test-Path -LiteralPath $temporaryRoot){Remove-Item -LiteralPath $temporaryRoot -Recurse -Force -ErrorAction SilentlyContinue}}
diff --git a/tests/trayhost/TrayHostCorrelationTestBridge.cs b/tests/trayhost/TrayHostCorrelationTestBridge.cs
index 5add2e8..a7e4c6d 100644
--- a/tests/trayhost/TrayHostCorrelationTestBridge.cs
+++ b/tests/trayhost/TrayHostCorrelationTestBridge.cs
@@ -1,12 +1,25 @@
 using System;
 using System.Collections.Generic;
+using System.Threading;
 
 public sealed class TrayHostCorrelationTestBridge : IDisposable
 {
     private sealed class Platform : INativeTrayPlatform
     {
+        private sealed class Message
+        {
+            internal uint Id;
+            internal IntPtr WParam;
+            internal IntPtr LParam;
+        }
+
+        private readonly object _gate = new object();
+        private readonly Queue<Message> _messages = new Queue<Message>();
+        private readonly AutoResetEvent _available = new AutoResetEvent(false);
+        private Action<uint, IntPtr, IntPtr> _handler;
         internal uint Selection;
-        public void SetMessageHandler(Action<uint, IntPtr, IntPtr> handler) { }
+        internal int MessageBoxCount;
+        public void SetMessageHandler(Action<uint, IntPtr, IntPtr> handler) { _handler = handler; }
         public IntPtr CreateOwner() { return new IntPtr(10); }
         public IntPtr AssociateOwnerInputContext(IntPtr owner, IntPtr context) { return new IntPtr(20); }
         public IntPtr GetOwnerInputContext(IntPtr owner) { return IntPtr.Zero; }
@@ -25,22 +38,48 @@ public void SetMessageHandler(Action<uint, IntPtr, IntPtr> handler) { }
         public bool SetForegroundWindow(IntPtr owner) { return true; }
         public IntPtr GetForegroundWindow() { return new IntPtr(10); }
         public uint TrackPopupMenuEx(IntPtr menu, uint flags, int x, int y, IntPtr owner, IntPtr parameters) { return Selection; }
-        public bool PostMessage(IntPtr owner, uint message, UIntPtr wParam, IntPtr lParam) { return true; }
+        public bool PostMessage(IntPtr owner, uint message, UIntPtr wParam, IntPtr lParam)
+        {
+            ulong raw = wParam.ToUInt64();
+            IntPtr converted = IntPtr.Size == 4 ? new IntPtr(unchecked((int)raw)) : new IntPtr(unchecked((long)raw));
+            lock (_gate) { _messages.Enqueue(new Message { Id = message, WParam = converted, LParam = lParam }); }
+            _available.Set();
+            return true;
+        }
         public bool SetNotificationFocus(ref TrayIconData icon) { return true; }
-        public bool ShowMessageBox(IntPtr owner, string text, string caption) { return true; }
+        public bool ShowMessageBox(IntPtr owner, string text, string caption) { MessageBoxCount++; return true; }
         public bool ConfirmExit(IntPtr owner, string text, string caption) { return true; }
         public bool DestroyMenu(IntPtr menu) { return true; }
         public bool EndMenu() { return true; }
         public bool DestroyOwner(IntPtr owner) { return true; }
+
+        internal bool DispatchNext(TimeSpan timeout)
+        {
+            Message message = null;
+            lock (_gate) { if (_messages.Count != 0) { message = _messages.Dequeue(); } }
+            if (message == null)
+            {
+                if (!_available.WaitOne(timeout)) { return false; }
+                lock (_gate) { if (_messages.Count != 0) { message = _messages.Dequeue(); } }
+            }
+            if (message == null || _handler == null) { return false; }
+            _handler(message.Id, message.WParam, message.LParam);
+            return true;
+        }
+
+        internal void Dispose() { _available.Dispose(); }
     }
 
     private readonly Platform _platform;
     private readonly HostTransport _transport;
     private readonly TrayWindow _window;
+    private readonly TrayHostApplication _application;
+    private readonly TrayTerminalReceiptSink _receiptSink;
+    private readonly ManualResetEvent _receiptAttempted = new ManualResetEvent(false);
+    private readonly ManualResetEvent _publicationCompleted = new ManualResetEvent(false);
     private TrayHostAction _selected;
     private TrayActionResult _terminal;
     private bool _persistDiagnostics = true;
-    private int _feedbackCount;
 
     public TrayHostCorrelationTestBridge(ulong revision, TrayCommand command) : this(revision, command, true)
     {
@@ -50,7 +89,8 @@ public TrayHostCorrelationTestBridge(ulong revision, TrayCommand command, bool p
     {
         _platform = new Platform { Selection = (uint)command };
         _persistDiagnostics = persistDiagnostics;
-        _transport = new HostTransport(null, delegate(TrayTerminalDiagnostic record) { return _persistDiagnostics; });
+        TrayHostApplication application = null;
+        _transport = new HostTransport(null, delegate(uint token) { return application != null && application.PostReceiptWork(token); });
         _window = new TrayWindow(_platform, _transport.SetMenuOpen);
         _window.CommandSelected += delegate(TrayCommand selected, ulong displayedRevision)
         {
@@ -58,6 +98,20 @@ public TrayHostCorrelationTestBridge(ulong revision, TrayCommand command, bool p
             if (!_transport.TryRegisterAction(action)) { throw new InvalidOperationException("test action registration failed"); }
             _selected = action;
         };
+        Action<uint> receiptWork = delegate(uint token)
+        {
+            TrayTerminalReceiptUiKind kind;
+            TrayActionResult result;
+            if (!_transport.TryTakeReceiptUi(token, out kind, out result)) { return; }
+            _terminal = result;
+            if (kind == TrayTerminalReceiptUiKind.Failure) { _window.ShowActionFailed(); }
+            else if (kind == TrayTerminalReceiptUiKind.About) { _window.ShowAbout(); }
+        };
+        application = new TrayHostApplication(_platform, _window, null, delegate { }, receiptWork);
+        _application = application;
+        _receiptSink = new TrayTerminalReceiptSink(
+            delegate(TrayTerminalDiagnostic record) { bool persisted = _persistDiagnostics; _receiptAttempted.Set(); return persisted; },
+            delegate(TrayTerminalReceipt receipt) { bool published = _transport.TryPublishDurableReceipt(receipt); _publicationCompleted.Set(); return published; });
         _window.Create(Snapshot(revision));
     }
 
@@ -75,19 +129,31 @@ public bool Acknowledge(Guid actionId, ulong revision, string status, string err
     {
         TrayActionResultStatus parsed = (TrayActionResultStatus)Enum.Parse(typeof(TrayActionResultStatus), status, false);
         TrayActionResult result = new TrayActionResult(actionId, revision, parsed, errorCode, null);
-        bool accepted = _transport.TryAcknowledgeAction(result);
+        _receiptAttempted.Reset();
+        _publicationCompleted.Reset();
+        TrayTerminalReceipt receipt;
+        bool accepted = _transport.TryAcknowledgeAction(result, out receipt);
         if (!accepted) { return false; }
         _terminal = result;
-        if (parsed == TrayActionResultStatus.Rejected || parsed == TrayActionResultStatus.Failed)
+        if (receipt != null && _receiptSink.TrySubmit(receipt))
         {
-            TrayActionResult queued;
-            if (_transport.TryTakeFailedAction(out queued)) { _terminal = queued; _feedbackCount++; }
+            if (!_receiptAttempted.WaitOne(TimeSpan.FromSeconds(2))) { throw new InvalidOperationException("test receipt writer did not run"); }
+            if (_persistDiagnostics)
+            {
+                if (!_publicationCompleted.WaitOne(TimeSpan.FromSeconds(2))) { throw new InvalidOperationException("test receipt publication did not complete"); }
+                if (parsed == TrayActionResultStatus.Rejected || parsed == TrayActionResultStatus.Failed)
+                {
+                    DateTime deadline = DateTime.UtcNow.AddSeconds(2);
+                    while (_platform.MessageBoxCount == 0 && DateTime.UtcNow < deadline) { _platform.DispatchNext(TimeSpan.FromMilliseconds(25)); }
+                    if (_platform.MessageBoxCount != 1) { throw new InvalidOperationException("test receipt UI was not token-dispatched"); }
+                }
+            }
         }
         return true;
     }
 
     public void SetDiagnosticPersistence(bool value) { _persistDiagnostics = value; }
-    public int FeedbackCount { get { return _feedbackCount; } }
+    public int FeedbackCount { get { return _platform.MessageBoxCount; } }
 
     public string TerminalStatus { get { return _terminal == null ? String.Empty : _terminal.Status.ToString(); } }
     public string TerminalCode { get { return _terminal == null ? String.Empty : (_terminal.ErrorCode ?? String.Empty); } }
@@ -103,7 +169,11 @@ private static PresentationSnapshot Snapshot(ulong revision)
 
     public void Dispose()
     {
-        _window.Dispose();
+        _receiptSink.Dispose();
         _transport.Dispose();
+        _application.Dispose();
+        _receiptAttempted.Dispose();
+        _publicationCompleted.Dispose();
+        _platform.Dispose();
     }
 }
diff --git a/tests/trayhost/TrayHostParentClientSelfTest.cs b/tests/trayhost/TrayHostParentClientSelfTest.cs
index 5e02eec..d455f73 100644
--- a/tests/trayhost/TrayHostParentClientSelfTest.cs
+++ b/tests/trayhost/TrayHostParentClientSelfTest.cs
@@ -5,37 +5,6 @@
 using System.Security.Cryptography;
 using System.Threading;
 
-internal sealed class ProductionTraceTrayPlatform : INativeTrayPlatform
-{
-    internal string Message;
-    public void SetMessageHandler(Action<uint, IntPtr, IntPtr> handler) { }
-    public IntPtr CreateOwner() { return new IntPtr(10); }
-    public IntPtr AssociateOwnerInputContext(IntPtr owner, IntPtr context) { return new IntPtr(20); }
-    public IntPtr GetOwnerInputContext(IntPtr owner) { return IntPtr.Zero; }
-    public bool ReleaseInputContext(IntPtr owner, IntPtr context) { return true; }
-    public IntPtr LoadIcon() { return new IntPtr(40); }
-    public bool DestroyIcon(IntPtr icon) { return true; }
-    public bool AddIcon(ref TrayIconData icon) { return true; }
-    public bool SetIconVersion(ref TrayIconData icon) { return true; }
-    public bool DeleteIcon(ref TrayIconData icon) { return true; }
-    public IntPtr CreatePopupMenu() { return new IntPtr(30); }
-    public IntPtr CreateSubMenu() { return new IntPtr(31); }
-    public bool AppendMenu(IntPtr menu, uint flags, UIntPtr command, string text) { return true; }
-    public bool AppendSubMenu(IntPtr menu, IntPtr child, string text) { return true; }
-    public bool ShowOwner(IntPtr owner) { return true; }
-    public bool HideOwner(IntPtr owner) { return true; }
-    public bool SetForegroundWindow(IntPtr owner) { return true; }
-    public IntPtr GetForegroundWindow() { return new IntPtr(10); }
-    public uint TrackPopupMenuEx(IntPtr menu, uint flags, int x, int y, IntPtr owner, IntPtr parameters) { return 0U; }
-    public bool PostMessage(IntPtr owner, uint message, UIntPtr wParam, IntPtr lParam) { return true; }
-    public bool SetNotificationFocus(ref TrayIconData icon) { return true; }
-    public bool ShowMessageBox(IntPtr owner, string text, string caption) { Message = caption + "|" + text; return true; }
-    public bool ConfirmExit(IntPtr owner, string text, string caption) { return true; }
-    public bool DestroyMenu(IntPtr menu) { return true; }
-    public bool EndMenu() { return true; }
-    public bool DestroyOwner(IntPtr owner) { return true; }
-}
-
 internal static class TrayHostParentClientSelfTest
 {
     internal static string PeerArguments = "--peer";
@@ -82,32 +51,13 @@ private static void RunPeer(bool emitFaultAndIgnoreShutdown, bool emitAction, bo
         {
             Guid actionId = Guid.Parse("aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee");
             TrayHostAction action = new TrayHostAction(actionId, TrayCommand.OpenLogs, staleAction ? 8UL : 1UL);
-            ManualResetEvent receiptPersisted = new ManualResetEvent(false);
-            HostTransport host = new HostTransport();
-            TrayTerminalReceiptSink receiptSink = new TrayTerminalReceiptSink(delegate(TrayTerminalDiagnostic record) { receiptPersisted.Set(); return true; }, host.TryPublishDurableReceipt);
-            ProductionTraceTrayPlatform tracePlatform = new ProductionTraceTrayPlatform();
-            TrayWindow traceWindow = new TrayWindow(tracePlatform); traceWindow.Create(Snapshot(1UL));
-            AssertTrue(host.TryRegisterAction(action), "program peer registers the exact outbound action");
             ProtocolCodec.WriteAuthenticated(output, ProtocolFrame.Authenticated(ProtocolDirection.HostToParent, TrayHostMessageType.Action, epoch, outboundSequence++, TrayHostWire.WriteAction(action)), keys.HostToParent);
             ProtocolFrame terminalFrame = ProtocolCodec.ReadAuthenticated(input, ProtocolDirection.ParentToHost, epoch, inboundSequence++, keys.ParentToHost);
-            AssertTrue(terminalFrame.MessageType == TrayHostMessageType.ActionResult, "program peer receives one authenticated terminal result");
-            AssertTrue(Program.TryDispatchAuthenticatedActionResult(host, receiptSink, terminalFrame.Payload), "production Program dispatch accepts the correlated authenticated result without waiting for receipt storage");
-            TrayActionResult feedback;
-            if (staleAction)
-            {
-                Stopwatch feedbackWait = Stopwatch.StartNew();
-                while (!host.TryTakeFailedAction(out feedback) && feedbackWait.ElapsedMilliseconds < 3000L) { Thread.Sleep(5); }
-                AssertTrue(feedback != null && feedback.Revision == 8UL && feedback.Status == TrayActionResultStatus.Rejected && String.Equals(feedback.ErrorCode, "CCOD_TRAY_ACTION_STALE", StringComparison.Ordinal), "stale authenticated result reaches the production generic-feedback queue only after its durable callback");
-                traceWindow.ShowActionFailed();
-                AssertTrue(String.Equals(tracePlatform.Message, "string-0|string-15", StringComparison.Ordinal), "stale production trace collapses internal details to the generic acknowledged-snapshot dialog");
-            }
-            else
-            {
-                AssertTrue(receiptPersisted.WaitOne(3000), "completed current action reaches durable receipt storage asynchronously");
-                AssertTrue(!host.TryTakeFailedAction(out feedback) && tracePlatform.Message == null, "completed current action produces no generic failure feedback");
-            }
-            receiptSink.Dispose(); traceWindow.Dispose(); host.Dispose(); receiptPersisted.Dispose();
-            return;
+            AssertTrue(terminalFrame.MessageType == TrayHostMessageType.ActionResult, "synthetic peer receives one authenticated terminal result");
+            TrayActionResult terminal = TrayHostWire.ReadActionResult(terminalFrame.Payload);
+            AssertTrue(terminal.ActionId == action.ActionId && terminal.Revision == action.Revision, "parent writer preserves the exact correlated action identity");
+            if (staleAction) { AssertTrue(terminal.Status == TrayActionResultStatus.Rejected && String.Equals(terminal.ErrorCode, "CCOD_TRAY_ACTION_STALE", StringComparison.Ordinal), "parent writer preserves the stale terminal result"); }
+            else { AssertTrue(terminal.Status == TrayActionResultStatus.Completed && terminal.ErrorCode == null, "parent writer preserves the current completion result"); }
         }
         if (emitFaultAndIgnoreShutdown)
         {
@@ -279,28 +229,3 @@ public static int Main(string[] args)
         }
     }
 }
-
-public static class TrayHostProductionTraceFixture
-{
-    public static TrayHostParentClient Start(string executablePath, bool stale)
-    {
-        if (String.IsNullOrEmpty(executablePath)) { throw new ArgumentException("trace executable is required", "executablePath"); }
-        Process current = Process.GetCurrentProcess();
-        TrayHostParentClient.TestProcessFactory = TrayHostParentClientSelfTest.StartPeer;
-        TrayHostParentClientSelfTest.PeerArguments = stale ? "--stale-action-peer" : "--action-peer";
-        return TrayHostParentClient.Start(new TrayHostStartOptions {
-            ExePath = executablePath,
-            RuntimeId = "trace-runtime",
-            ParentPid = current.Id,
-            ParentCreationFileTimeUtc = current.StartTime.ToFileTimeUtc(),
-            InitialPresentation = CreateSnapshot()
-        });
-    }
-
-    private static PresentationSnapshot CreateSnapshot()
-    {
-        string[] strings = new string[16];
-        for (int index = 0; index < strings.Length; index++) { strings[index] = "trace-" + index.ToString(); }
-        return new PresentationSnapshot(1UL, TrayColor.Green, ConnectionState.Connected, ProtectionState.Running, LanguageMode.English, PresentationFlags.OpenLogsEnabled, strings);
-    }
-}
diff --git a/tests/trayhost/TrayHostProductionTraceSelfTest.cs b/tests/trayhost/TrayHostProductionTraceSelfTest.cs
new file mode 100644
index 0000000..869102a
--- /dev/null
+++ b/tests/trayhost/TrayHostProductionTraceSelfTest.cs
@@ -0,0 +1,298 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Text;
+using System.Threading;
+
+public static class TrayHostProductionTraceFixture
+{
+    public static TrayHostParentClient Start(string executablePath)
+    {
+        if (String.IsNullOrEmpty(executablePath) || !Path.IsPathRooted(executablePath) || !File.Exists(executablePath)) { throw new ArgumentException("trace executable is required", "executablePath"); }
+        string witnessPath = GetWitnessPath(executablePath);
+        if (File.Exists(witnessPath)) { File.Delete(witnessPath); }
+        using (Process current = Process.GetCurrentProcess())
+        {
+            return TrayHostParentClient.Start(new TrayHostStartOptions {
+                ExePath = executablePath,
+                RuntimeId = "trace-runtime",
+                ParentPid = current.Id,
+                ParentCreationFileTimeUtc = current.StartTime.ToFileTimeUtc(),
+                InitialPresentation = CreateSnapshot()
+            });
+        }
+    }
+
+    public static string GetWitnessPath(string executablePath)
+    {
+        return Path.GetFullPath(executablePath) + ".witness.log";
+    }
+
+    private static PresentationSnapshot CreateSnapshot()
+    {
+        string[] strings = new string[16];
+        for (int index = 0; index < strings.Length; index++) { strings[index] = "trace-" + index.ToString(); }
+        return new PresentationSnapshot(1UL, TrayColor.Green, ConnectionState.Connected, ProtectionState.Running, LanguageMode.English, PresentationFlags.OpenLogsEnabled, strings);
+    }
+}
+
+internal static class TrayHostProductionTraceMain
+{
+    public static int Main(string[] args)
+    {
+        string witnessPath = TrayHostProductionTraceFixture.GetWitnessPath(Process.GetCurrentProcess().MainModule.FileName);
+        TraceWitness witness = new TraceWitness(witnessPath);
+        try
+        {
+            TrayHostChildIdentity identity;
+            if (!TrayHostChildSession.TryCreateIdentity(args, out identity)) { return 2; }
+#if TRAYHOST_TRACE_STALE
+            bool stale = true;
+#else
+            bool stale = false;
+#endif
+            using (ScriptedTraceRuntime runtime = new ScriptedTraceRuntime(witness, stale))
+            {
+                return TrayHostChildSession.Run(
+                    Console.OpenStandardInput(),
+                    Console.OpenStandardOutput(),
+                    identity,
+                    runtime,
+                    delegate(HostTransport transport)
+                    {
+                        return new TrayTerminalReceiptSink(
+                            witness.TryWriteDurably,
+                            delegate(TrayTerminalReceipt receipt)
+                            {
+                                bool published = transport.TryPublishDurableReceipt(receipt);
+                                witness.Append("publication accepted=" + published.ToString().ToLowerInvariant());
+                                runtime.ReleaseReceiptDispatch();
+                                return published;
+                            });
+                    });
+            }
+        }
+        catch (Exception error)
+        {
+            witness.Append("fatal type=" + error.GetType().Name);
+            return 1;
+        }
+    }
+}
+
+internal sealed class ScriptedTraceRuntime : ITrayHostRuntime
+{
+    private readonly TraceWitness _witness;
+    private readonly bool _stale;
+    private readonly ScriptedTracePlatform _platform;
+    private TrayWindow _window;
+    private TrayHostApplication _application;
+    private Action<TrayCommand, ulong> _commandSelected;
+    private bool _exitRequested;
+    private bool _started;
+    private bool _disposed;
+
+    internal ScriptedTraceRuntime(TraceWitness witness, bool stale)
+    {
+        if (witness == null) { throw new ArgumentNullException("witness"); }
+        _witness = witness;
+        _stale = stale;
+        _platform = new ScriptedTracePlatform(witness);
+    }
+
+    public ulong CurrentRevision { get { return _window == null ? 0UL : _window.CurrentRevision; } }
+
+    public void Initialize(Action<bool> menuOpenChanged, Action<TrayCommand, ulong> commandSelected, Action work, Action<uint> receiptWork)
+    {
+        if (_window != null || commandSelected == null || work == null || receiptWork == null) { throw new InvalidOperationException("trace runtime initialization is invalid"); }
+        _commandSelected = commandSelected;
+        _window = new TrayWindow(_platform, menuOpenChanged);
+        _window.CommandSelected += commandSelected;
+        _application = new TrayHostApplication(_platform, _window, commandSelected, work, receiptWork);
+    }
+
+    public void Create(PresentationSnapshot initial) { _window.Create(initial); }
+    public bool Apply(PresentationSnapshot snapshot) { return _window.Apply(snapshot); }
+    public void PostWork() { _application.PostWork(); }
+    public bool PostReceiptWork(uint token) { return _application.PostReceiptWork(token); }
+    public void ShowAbout() { _window.ShowAbout(); }
+    public void ShowActionFailed() { _window.ShowActionFailed(); }
+    public void RequestShutdown() { _window.RequestShutdown(); }
+
+    internal void ReleaseReceiptDispatch() { _platform.ReleaseReceiptDispatch(); }
+
+    public void RequestExit()
+    {
+        _exitRequested = true;
+        _platform.Signal();
+    }
+
+    public int Run()
+    {
+        if (_started || _window == null) { throw new InvalidOperationException("trace runtime lifecycle is invalid"); }
+        _started = true;
+        if (_stale)
+        {
+            _witness.Append("fixture command=OpenLogs revision=8");
+            _commandSelected(TrayCommand.OpenLogs, 8UL);
+        }
+        else
+        {
+            uint? selected = _window.HandleContextMenu(new TrayPoint(4, 5));
+            if (!selected.HasValue || selected.Value != (uint)TrayCommand.OpenLogs) { throw new InvalidOperationException("native OpenLogs selection failed"); }
+            _witness.Append("native command=OpenLogs revision=" + CurrentRevision.ToString());
+        }
+        while (!_exitRequested) { _platform.TryDispatch(TimeSpan.FromMilliseconds(250)); }
+        return 0;
+    }
+
+    public void Dispose()
+    {
+        if (_disposed) { return; }
+        _disposed = true;
+        if (_application != null) { _application.Dispose(); }
+        _platform.Dispose();
+    }
+}
+
+internal sealed class ScriptedTracePlatform : INativeTrayPlatform, IDisposable
+{
+    private sealed class QueuedMessage
+    {
+        internal uint Message;
+        internal IntPtr WParam;
+        internal IntPtr LParam;
+    }
+
+    private readonly object _gate = new object();
+    private readonly Queue<QueuedMessage> _messages = new Queue<QueuedMessage>();
+    private readonly AutoResetEvent _available = new AutoResetEvent(false);
+    private readonly TraceWitness _witness;
+    private Action<uint, IntPtr, IntPtr> _handler;
+    private bool _receiptDispatchReleased;
+    private bool _disposed;
+
+    internal ScriptedTracePlatform(TraceWitness witness) { _witness = witness; }
+
+    public void SetMessageHandler(Action<uint, IntPtr, IntPtr> handler) { _handler = handler; }
+    public IntPtr CreateOwner() { return new IntPtr(10); }
+    public IntPtr AssociateOwnerInputContext(IntPtr owner, IntPtr context) { return new IntPtr(20); }
+    public IntPtr GetOwnerInputContext(IntPtr owner) { return IntPtr.Zero; }
+    public bool ReleaseInputContext(IntPtr owner, IntPtr context) { return true; }
+    public IntPtr LoadIcon() { return new IntPtr(40); }
+    public bool DestroyIcon(IntPtr icon) { return true; }
+    public bool AddIcon(ref TrayIconData icon) { return true; }
+    public bool SetIconVersion(ref TrayIconData icon) { return true; }
+    public bool DeleteIcon(ref TrayIconData icon) { return true; }
+    public IntPtr CreatePopupMenu() { return new IntPtr(30); }
+    public IntPtr CreateSubMenu() { return new IntPtr(31); }
+    public bool AppendMenu(IntPtr menu, uint flags, UIntPtr command, string text) { return true; }
+    public bool AppendSubMenu(IntPtr menu, IntPtr child, string text) { return true; }
+    public bool ShowOwner(IntPtr owner) { return true; }
+    public bool HideOwner(IntPtr owner) { return true; }
+    public bool SetForegroundWindow(IntPtr owner) { return true; }
+    public IntPtr GetForegroundWindow() { return new IntPtr(10); }
+
+    public uint TrackPopupMenuEx(IntPtr menu, uint flags, int x, int y, IntPtr owner, IntPtr parameters)
+    {
+        _witness.Append("native-menu command=OpenLogs");
+        return (uint)TrayCommand.OpenLogs;
+    }
+
+    public bool PostMessage(IntPtr owner, uint message, UIntPtr wParam, IntPtr lParam)
+    {
+        ulong raw = wParam.ToUInt64();
+        IntPtr converted = IntPtr.Size == 4 ? new IntPtr(unchecked((int)raw)) : new IntPtr(unchecked((long)raw));
+        lock (_gate)
+        {
+            if (_disposed) { return false; }
+            _messages.Enqueue(new QueuedMessage { Message = message, WParam = converted, LParam = lParam });
+        }
+        _witness.Append("post message=" + message.ToString() + " token=" + raw.ToString());
+        _available.Set();
+        return true;
+    }
+
+    public bool SetNotificationFocus(ref TrayIconData icon) { return true; }
+
+    public bool ShowMessageBox(IntPtr owner, string text, string caption)
+    {
+        _witness.Append("dialog caption=" + caption + " text=" + text);
+        return true;
+    }
+
+    public bool ConfirmExit(IntPtr owner, string text, string caption) { return true; }
+    public bool DestroyMenu(IntPtr menu) { return true; }
+    public bool EndMenu() { return true; }
+    public bool DestroyOwner(IntPtr owner) { return true; }
+
+    internal bool TryDispatch(TimeSpan timeout)
+    {
+        QueuedMessage queued = null;
+        lock (_gate)
+        {
+            if (_messages.Count != 0 && (_messages.Peek().Message != TrayNativeConstants.WmApp + 3U || _receiptDispatchReleased)) { queued = _messages.Dequeue(); }
+        }
+        if (queued == null)
+        {
+            try { if (!_available.WaitOne(timeout)) { return false; } }
+            catch (ObjectDisposedException) { return false; }
+            lock (_gate)
+            {
+                if (_messages.Count != 0 && (_messages.Peek().Message != TrayNativeConstants.WmApp + 3U || _receiptDispatchReleased)) { queued = _messages.Dequeue(); }
+            }
+        }
+        if (queued == null) { return false; }
+        Action<uint, IntPtr, IntPtr> handler = _handler;
+        if (handler == null) { throw new InvalidOperationException("trace native handler is unavailable"); }
+        handler(queued.Message, queued.WParam, queued.LParam);
+        return true;
+    }
+
+    internal void Signal() { try { _available.Set(); } catch (ObjectDisposedException) { } }
+
+    internal void ReleaseReceiptDispatch()
+    {
+        lock (_gate) { if (!_disposed) { _receiptDispatchReleased = true; } }
+        Signal();
+    }
+
+    public void Dispose()
+    {
+        lock (_gate) { if (_disposed) { return; } _disposed = true; _messages.Clear(); }
+        _available.Dispose();
+    }
+}
+
+internal sealed class TraceWitness
+{
+    private readonly object _gate = new object();
+    private readonly string _path;
+
+    internal TraceWitness(string path)
+    {
+        if (String.IsNullOrEmpty(path) || !Path.IsPathRooted(path)) { throw new ArgumentException("trace witness path is invalid", "path"); }
+        _path = path;
+    }
+
+    internal bool TryWriteDurably(TrayTerminalDiagnostic record)
+    {
+        if (record == null) { return false; }
+        Append("receipt command=" + record.Command.ToString() + " revision=" + record.Revision.ToString() + " status=" + record.Status.ToString() + " code=" + record.Code);
+        return true;
+    }
+
+    internal void Append(string value)
+    {
+        byte[] bytes = new UTF8Encoding(false).GetBytes(value + "\r\n");
+        lock (_gate)
+        {
+            using (FileStream stream = new FileStream(_path, FileMode.Append, FileAccess.Write, FileShare.ReadWrite))
+            {
+                stream.Write(bytes, 0, bytes.Length);
+                stream.Flush(true);
+            }
+        }
+    }
+}

From 939f2fac6df639d998d10fb94dd815bb8801a8d7 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 12:06:12 +0800
Subject: [PATCH 039/187] docs: record authenticated tray receipt trace

---
 .../task-3-report.md                          | 159 ++++++++++++++++++
 1 file changed, 159 insertions(+)
 create mode 100644 .superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-3-report.md

diff --git a/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-3-report.md b/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-3-report.md
new file mode 100644
index 0000000..e729421
--- /dev/null
+++ b/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-3-report.md
@@ -0,0 +1,159 @@
+# Task 3 report: authenticated child-session production trace
+
+## Outcome
+
+Task 3 now runs the real authenticated TrayHost child session in temporary
+child processes without adding a shipped test selector or using
+`TrayHostParentClient.TestProcessFactory`.
+
+- `Program.RunChild` is a thin argument/identity/Windows-runtime adapter.
+- `TrayHostChildSession` owns the existing bootstrap, directional keys,
+  authenticated reader/writer sequences, action registration, presentation and
+  shutdown work, async receipt admission, and token-bound UI drain.
+- `WindowsTrayHostRuntime` composes the unchanged `Win32TrayPlatform`,
+  `TrayWindow`, and `TrayHostApplication` behavior.
+- `TrayHostProductionTraceSelfTest.cs` is compiled only under the runner's
+  temporary directory. Its fake native platform remains under `tests/`; no
+  test runtime, scenario, witness, macro, or selector is present in
+  `src/trayhost`.
+- The old ParentClient fake peer is again only a narrow authenticated
+  parent-writer test. It no longer calls production dispatch, HostTransport
+  receipt drains, or the dialog directly.
+- The deferred Supervisor correlation bridge now uses the real async
+  `TrayTerminalReceiptSink` and `TrayHostApplication` token dispatch rather
+  than the removed synchronous `TryTakeFailedAction` path.
+
+## End-to-end evidence
+
+### Current action
+
+The trace launches a distinct requested executable through the normal
+`TrayHostParentClient.Start` path. After the real parent/child identity and
+authenticated handshake, the temporary runtime calls the real
+`TrayWindow.HandleContextMenu`; its fake `INativeTrayPlatform` returns
+`OpenLogs` from `TrackPopupMenuEx`. The shared child session registers and
+writes that exact action. The real PowerShell `Receive-CcodTrayHostEvents`
+delivers it to `Invoke-CcodSupervisorCommand`, whose in-memory `OpenLogs`
+adapter runs once and whose terminal result returns through
+`Send-CcodTrayHostActionResult` and the real ParentClient writer.
+
+The child reader authenticates and correlates the completion, the real async
+sink flushes exactly one sanitized receipt, and `HostTransport` publishes no
+receipt UI for a completed `OpenLogs`. The witness contains no dialog, no
+duplicate action, no fault, and the normal parent-requested shutdown receives
+an authenticated acknowledgement.
+
+### Stale authenticated negative
+
+The separately compiled temporary stale fixture emits an explicit revision-8
+`OpenLogs` through the same child-session command delegate; this is test-only
+and does not use a runtime-id convention or production selector. The real
+PowerShell client receives the authenticated action. Because only revision 1
+is acknowledged, `Invoke-CcodSupervisorCommand` rejects it with
+`CCOD_TRAY_ACTION_STALE` before the `OpenLogs` adapter and sends the exact
+correlated terminal result through ParentClient.
+
+The child consumes the pending action, flushes one receipt containing only
+`command`, `revision`, `status`, and canonical `code`, then posts a nonzero
+token on `WmApp+3`. The test-only message pump invokes the real
+`TrayHostApplication` handler; only `TryTakeReceiptUi(exactToken, ...)` reaches
+the runtime's `TrayWindow.ShowActionFailed` delegation. The witness asserts
+the order `durable receipt -> token post -> generic dialog`, exactly one dialog
+with caption `trace-0` and text `trace-15`, and no internal code or correlation
+identifier in that dialog. Normal authenticated shutdown then completes.
+
+## TDD RED evidence
+
+The real-process trace and runner were written before the production seam.
+Running the required command:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/TrayHostProductionTrace.SelfTest.ps1
+```
+
+exited 1 with the expected missing-seam failure:
+
+```text
+tests\trayhost\TrayHostProductionTraceSelfTest.cs(84,46): error CS0246: ITrayHostRuntime
+CCOD_TRAYHOST_PRODUCTION_TRACE_COMPILE_FAILED
+```
+
+No `src/trayhost` file had been changed when this RED was captured.
+
+Running the complete Supervisor fixture then exposed the Task 2 report's
+explicitly deferred legacy bridge migration. It exited 1 at
+`Supervisor.SelfTest.ps1:818`: `HostTransport.cs(107)` could not resolve
+`TrayTerminalReceipt` because the pre-Task-2 Add-Type list omitted the async
+sink, and the bridge still used the old synchronous drain. Adding the actual
+sink/application sources and migrating the bridge to token dispatch made the
+same fixture pass 98 tests.
+
+## Fresh GREEN and stability evidence
+
+All commands below ran on the final production/test source tree and exited 0:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/TrayHostProductionTrace.SelfTest.ps1
+# TrayHost production child-session trace passed: 2
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ParentClientOnly
+# TrayHost parent-client self-tests passed: 4
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/TrayHostClient.SelfTest.ps1
+# 9 cases passed; TrayHost client self-tests passed.
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -NativeOnly
+# TrayHost native self-tests passed: 25
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -TransportOnly
+# TrayHost transport self-tests passed: 16
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProtocolOnly
+# TrayHost protocol self-tests passed: 11
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionOnly
+# complete production compile and --headless-smoke, exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/Supervisor.SelfTest.ps1
+# Supervisor self-tests passed: 98
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/TrayHostBuild.SelfTest.ps1
+# 6 build/provenance cases; TrayHost build self-tests passed.
+```
+
+The direct production-trace command was additionally run three consecutive
+times on the final tree. Every iteration launched both current and stale child
+processes and printed `TrayHost production child-session trace passed: 2`.
+
+`git diff --check` exited 0; Git printed only the repository's expected
+LF-to-CRLF conversion notices.
+
+## Production CLI and Task 2 boundary
+
+The trace runner separately compiles the production executable with
+`/main:Program` and invokes it with `--production-trace-test-selector`; the
+test requires exit code 2. A final source audit found no trace selector,
+`TRAYHOST_TRACE` define, trace runtime-id convention, or test-factory
+assignment in `Program.cs`, `TrayHostChildSession.cs`, or
+`WindowsTrayHostRuntime.cs`. `Program.Main` still recognizes only the existing
+single `--headless-smoke` form and seven-argument `--child` form.
+
+`HostTransport`, `TrayTerminalReceiptSink`, `TrayHostWire`,
+`TrayHostParentClient`, and the PowerShell wire surface were not changed.
+Native 25/25 and transport 16/16 confirm the Task 2 tokened `WmApp+3`
+publication, provisional-visibility, repost, disposal, and failure behavior
+remains green.
+
+## Remaining risks and safety boundary
+
+- The broad trace deliberately uses a fake native platform and a temporary
+  handle-flushed witness store. It proves the shared session, authenticated
+  wire, ParentClient, PowerShell client/Supervisor decision, async sink,
+  tokened application work, and generic dialog mapping; it is not an installed
+  desktop automation or real shell-notification-area test.
+- Native receipt-store pinning/reparse/hard-link/rollover behavior remains
+  covered by the focused Task 1/native tests, not duplicated here.
+- Installer, installed-runtime, Defender, release workflow, signing, and
+  independent review remain later acceptance boundaries.
+- No real UI, Codex process, installer, installation, release, push, signing,
+  or public operation was started by Task 3.

From efd2f902a03c20140e3dfd9960da3fdbf6970502 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 12:26:25 +0800
Subject: [PATCH 040/187] fix: require tray child natural exit after ack

---
 .../task-3-report.md                          | 68 +++++++++++++++++++
 src/trayhost/TrayHostParentClient.cs          | 15 +++-
 .../TrayHostProductionTrace.SelfTest.ps1      | 44 ++++++++++--
 tests/trayhost/Invoke-TrayHostSelfTest.ps1    |  5 +-
 .../TrayHostProductionTraceSelfTest.cs        | 18 ++++-
 5 files changed, 140 insertions(+), 10 deletions(-)

diff --git a/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-3-report.md b/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-3-report.md
index e729421..af3ef87 100644
--- a/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-3-report.md
+++ b/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-3-report.md
@@ -157,3 +157,71 @@ remains green.
   independent review remain later acceptance boundaries.
 - No real UI, Codex process, installer, installation, release, push, signing,
   or public operation was started by Task 3.
+
+## Fix round 1/5: ShutdownAck is not process-exit proof
+
+Independent review found that the first trace treated `ShutdownAck` as natural
+child termination. `TrayHostParentClient.ReaderLoop` enqueued `Exited` and set
+its stopped event immediately after reading the authenticated ACK, while
+`Dispose` subsequently terminated the child job. A child that wrote the ACK
+and then hung could therefore pass the trace before being force-killed.
+
+### Deterministic RED
+
+The trace runner now compiles a third temporary executable with a test-only
+`TRAYHOST_TRACE_HANG_AFTER_ACK` define. It uses the same child session,
+handshake, authenticated action/result, and shutdown wire. Its fake runtime
+records that the shared child session has written the shutdown ACK but
+deliberately does not return from its run loop. The PowerShell test retains the
+actual process identified by `TrayHostStartReceipt.HostPid` before `Dispose`
+and asserts that ACK alone cannot publish `Exited` or satisfy
+`WaitForStopped` while that process is still alive.
+
+Before the production fix, the required trace command exited 1 with the exact
+behavioral failure:
+
+```text
+ASSERT_EQUAL: ShutdownAck alone cannot satisfy WaitForStopped while the child is alive expected=[False] actual=[True]
+CCOD_TRAYHOST_PRODUCTION_TRACE_FAILED
+```
+
+### Production correction
+
+`TrayHostParentClient` now treats the authenticated ACK only as permission to
+wait for graceful termination. Its reader performs a bounded wait on the exact
+launched `Process` and requires exit code 0 before it enqueues `Exited` and
+signals stopped. A timeout, inaccessible process, or nonzero exit becomes the
+existing bounded `CCOD_TRAYHOST_TRANSPORT_FAILED` fault; `Dispose` may then use
+the existing job cleanup, but that cleanup can no longer masquerade as natural
+exit.
+
+The normal current and stale cases retain their child `Process` handles and
+independently require `WaitForExit(4000)` and exit code 0 before calling
+`Dispose`. The hung-after-ACK case requires a 250 ms stopped wait to return
+false, no `Exited` event, and a still-live child; after the bounded parent wait
+it requires the transport fault while the child remains live until explicit
+cleanup.
+
+No production CLI argument, listener, environment switch, external control
+surface, wire field, message type, or authentication rule was added or
+changed. The hang behavior and compile define exist only in the temporary
+test executable.
+
+### Fresh fix-round verification
+
+All covering commands ran after the correction and exited 0:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/TrayHostProductionTrace.SelfTest.ps1
+# TrayHost production child-session trace passed: 3
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ParentClientOnly
+# TrayHost parent-client self-tests passed: 4
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionOnly
+# complete production compile plus --headless-smoke, exit 0
+```
+
+`git diff --check` exited 0 with only the repository's expected LF-to-CRLF
+conversion notices. No real UI, Codex process, installer, release, install,
+signing, push, or public operation ran in this fix round.
diff --git a/src/trayhost/TrayHostParentClient.cs b/src/trayhost/TrayHostParentClient.cs
index 56ab25f..dd4a5ec 100644
--- a/src/trayhost/TrayHostParentClient.cs
+++ b/src/trayhost/TrayHostParentClient.cs
@@ -26,6 +26,7 @@ public sealed class TrayHostStartReceipt
 
 public sealed class TrayHostParentClient : IDisposable
 {
+    private const int GracefulProcessExitMilliseconds = 1500;
     internal static Func<ProcessStartInfo, Process> TestProcessFactory = null;
     internal static Action TestBeforeReaderStopSignal = null;
     internal static Action TestBeforeWaitHandleDispose = null;
@@ -180,7 +181,11 @@ private void ReaderLoop()
                 ProtocolFrame frame = ReadAuthenticated();
                 if (frame.MessageType == TrayHostMessageType.PresentationAck) { EnqueueEvent(TrayHostEvent.Ack(TrayHostWire.ReadRevision(frame.Payload))); }
                 else if (frame.MessageType == TrayHostMessageType.Action) { EnqueueEvent(TrayHostEvent.Action(TrayHostWire.ReadAction(frame.Payload))); }
-                else if (frame.MessageType == TrayHostMessageType.ShutdownAck) { EnqueueEvent(TrayHostEvent.Exited()); _transport.Dispose(); SignalStopped(); return; }
+                else if (frame.MessageType == TrayHostMessageType.ShutdownAck)
+                {
+                    if (!WaitForNaturalProcessExit()) { HandleTransportFailure(new InvalidOperationException("CCOD_TRAYHOST_GRACEFUL_EXIT_FAILED")); return; }
+                    EnqueueEvent(TrayHostEvent.Exited()); _transport.Dispose(); SignalStopped(); return;
+                }
                 else if (frame.MessageType == TrayHostMessageType.Fault) { EnqueueEvent(TrayHostEvent.Fault("CCOD_TRAYHOST_REMOTE_FAULT")); }
                 else if (frame.MessageType == TrayHostMessageType.Pong) { _work.Set(); }
             }
@@ -216,6 +221,14 @@ private ProtocolFrame ReadAuthenticated()
         return ProtocolCodec.ReadAuthenticated(_childOutput, ProtocolDirection.HostToParent, _keys.HostEpoch, _readSequence++, _keys.HostToParent);
     }
 
+    private bool WaitForNaturalProcessExit()
+    {
+        Process process = _process;
+        if (process == null) { return false; }
+        try { return process.WaitForExit(GracefulProcessExitMilliseconds) && process.ExitCode == 0; }
+        catch { return false; }
+    }
+
     private bool IsDisposing() { return Volatile.Read(ref _disposed) != 0; }
     private bool IsClosing() { return Volatile.Read(ref _disposeGate) != 0; }
     private void SignalWork() { try { _work.Set(); } catch (ObjectDisposedException) { } }
diff --git a/tests/persistence/TrayHostProductionTrace.SelfTest.ps1 b/tests/persistence/TrayHostProductionTrace.SelfTest.ps1
index 31db00a..4173b02 100644
--- a/tests/persistence/TrayHostProductionTrace.SelfTest.ps1
+++ b/tests/persistence/TrayHostProductionTrace.SelfTest.ps1
@@ -2,16 +2,17 @@ param(
     [string]$AssemblyPath,
     [string]$CurrentTracePath,
     [string]$StaleTracePath,
+    [string]$HungTracePath,
     [string]$ProductionExePath
 )
 
 $ErrorActionPreference='Stop'
 $repositoryRoot=Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
-if([string]::IsNullOrEmpty($AssemblyPath)-and[string]::IsNullOrEmpty($CurrentTracePath)-and[string]::IsNullOrEmpty($StaleTracePath)-and[string]::IsNullOrEmpty($ProductionExePath)){
+if([string]::IsNullOrEmpty($AssemblyPath)-and[string]::IsNullOrEmpty($CurrentTracePath)-and[string]::IsNullOrEmpty($StaleTracePath)-and[string]::IsNullOrEmpty($HungTracePath)-and[string]::IsNullOrEmpty($ProductionExePath)){
     & powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $repositoryRoot 'tests\trayhost\Invoke-TrayHostSelfTest.ps1') -ProductionTraceOnly
     exit $LASTEXITCODE
 }
-foreach($path in @($AssemblyPath,$CurrentTracePath,$StaleTracePath,$ProductionExePath)){if([string]::IsNullOrEmpty($path)-or-not(Test-Path -LiteralPath $path -PathType Leaf)){throw 'CCOD_TRAYHOST_PRODUCTION_TRACE_INPUT_INVALID'}}
+foreach($path in @($AssemblyPath,$CurrentTracePath,$StaleTracePath,$HungTracePath,$ProductionExePath)){if([string]::IsNullOrEmpty($path)-or-not(Test-Path -LiteralPath $path -PathType Leaf)){throw 'CCOD_TRAYHOST_PRODUCTION_TRACE_INPUT_INVALID'}}
 
 . (Join-Path $PSScriptRoot 'TestSupport.ps1')
 [Reflection.Assembly]::LoadFrom([IO.Path]::GetFullPath($AssemblyPath))|Out-Null
@@ -59,11 +60,12 @@ function Wait-CcodProductionTraceWitness {
 function Invoke-CcodProductionTraceCase {
     param([string]$TracePath,[bool]$Stale)
     $client=[TrayHostProductionTraceFixture]::Start($TracePath)
+    $childProcess=$null
     try{
         $parentProcess=[Diagnostics.Process]::GetCurrentProcess()
         try{Assert-CcodTrue ($client.Receipt.HostPid-gt0-and$client.Receipt.HostPid-ne$parentProcess.Id) 'normal parent start launches a distinct child process'}finally{$parentProcess.Dispose()}
         $childProcess=[Diagnostics.Process]::GetProcessById($client.Receipt.HostPid)
-        try{Assert-CcodTrue ([string]::Equals([IO.Path]::GetFullPath($TracePath),[IO.Path]::GetFullPath($childProcess.MainModule.FileName),[StringComparison]::OrdinalIgnoreCase)) 'normal parent start launches the requested temporary trace executable'}finally{$childProcess.Dispose()}
+        Assert-CcodTrue ([string]::Equals([IO.Path]::GetFullPath($TracePath),[IO.Path]::GetFullPath($childProcess.MainModule.FileName),[StringComparison]::OrdinalIgnoreCase)) 'normal parent start launches the requested temporary trace executable'
         Assert-CcodEqual 'trace-runtime' $client.Receipt.RuntimeId 'real child handshake preserves the opaque runtime identity'
         $fixture=New-CcodProductionTraceContext $client;$context=$fixture.Context
         $hostState=New-CcodProductionTraceHostState $context $fixture.Enabled
@@ -121,16 +123,46 @@ function Invoke-CcodProductionTraceCase {
         Assert-CcodEqual 0 $context.CommandQueue.Count 'production trace emits no duplicate action'
         Assert-CcodTrue ([string]::IsNullOrEmpty($context.LastError)) 'production trace emits no remote fault'
         Assert-CcodTrue $client.BeginShutdown([ShutdownReason]::SupervisorExit,[UInt64]1) 'parent requests normal authenticated shutdown'
-        Assert-CcodTrue $client.WaitForStopped([TimeSpan]::FromSeconds(4)) 'child session returns an authenticated shutdown acknowledgement'
+        Assert-CcodTrue $client.WaitForStopped([TimeSpan]::FromSeconds(4)) 'parent observes graceful child termination'
+        Assert-CcodTrue $childProcess.WaitForExit(4000) 'graceful shutdown waits for the actual child process to exit naturally'
+        Assert-CcodEqual 0 ([int]$childProcess.ExitCode) 'graceful child process exits naturally with code zero before Dispose'
         Receive-CcodTrayHostEvents -Context $context
         Assert-CcodEqual $true $context.Exited 'TrayHostClient observes the normal child exit'
         Assert-CcodTrue ([string]::IsNullOrEmpty($context.LastError)) 'normal child shutdown has no fault'
         Assert-CcodEqual 0 $context.CommandQueue.Count 'normal child shutdown adds no extra action'
-    }finally{$client.Dispose()}
+    }finally{$client.Dispose();if($null-ne$childProcess){$childProcess.Dispose()}}
+}
+
+function Invoke-CcodHungAfterAckTraceCase {
+    param([string]$TracePath)
+    $client=[TrayHostProductionTraceFixture]::Start($TracePath)
+    $childProcess=$null
+    try{
+        $childProcess=[Diagnostics.Process]::GetProcessById($client.Receipt.HostPid)
+        $fixture=New-CcodProductionTraceContext $client;$context=$fixture.Context
+        $deadline=[DateTime]::UtcNow.AddSeconds(4)
+        while($context.CommandQueue.Count-eq0-and[DateTime]::UtcNow-lt$deadline){[void]$client.WaitForActivity([TimeSpan]::FromMilliseconds(25));Receive-CcodTrayHostEvents -Context $context}
+        Assert-CcodEqual 1 $context.CommandQueue.Count 'hung-after-ACK fixture reaches the authenticated action loop'
+        $action=$context.CommandQueue.Dequeue()
+        Assert-CcodTrue (Send-CcodTrayHostActionResult -Context $context -ActionId $action.ActionId -Revision $action.Revision -Status Completed -ErrorCode $null -TransactionId $null) 'hung-after-ACK fixture consumes its current action normally'
+        $witnessPath=[TrayHostProductionTraceFixture]::GetWitnessPath($TracePath)
+        [void](Wait-CcodProductionTraceWitness $witnessPath $context {param($Items)$Items-ccontains'publication accepted=true'})
+        Assert-CcodTrue $client.BeginShutdown([ShutdownReason]::SupervisorExit,[UInt64]1) 'hung-after-ACK fixture accepts authenticated shutdown'
+        [void](Wait-CcodProductionTraceWitness $witnessPath $context {param($Items)$Items-ccontains'shutdown-ack-written-exit-blocked'})
+        Assert-CcodEqual $false $client.WaitForStopped([TimeSpan]::FromMilliseconds(250)) 'ShutdownAck alone cannot satisfy WaitForStopped while the child is alive'
+        Receive-CcodTrayHostEvents -Context $context
+        Assert-CcodEqual $false $context.Exited 'ShutdownAck alone cannot publish an Exited event'
+        Assert-CcodEqual $false $childProcess.HasExited 'hung-after-ACK child remains observable and alive before Dispose cleanup'
+        Assert-CcodTrue $client.WaitForStopped([TimeSpan]::FromSeconds(3)) 'hung-after-ACK child reaches a bounded transport failure'
+        Receive-CcodTrayHostEvents -Context $context
+        Assert-CcodEqual 'CCOD_TRAYHOST_TRANSPORT_FAILED' $context.LastError 'hung-after-ACK child reports a fault instead of a normal exit'
+        Assert-CcodEqual $false $childProcess.HasExited 'transport failure does not masquerade a forced kill as natural child exit'
+    }finally{$client.Dispose();if($null-ne$childProcess){$childProcess.Dispose()}}
 }
 
 & $ProductionExePath '--production-trace-test-selector'
 Assert-CcodEqual 2 $LASTEXITCODE 'shipped Program.Main rejects the temporary trace selector'
 Invoke-CcodProductionTraceCase $CurrentTracePath $false
 Invoke-CcodProductionTraceCase $StaleTracePath $true
-Write-Host 'TrayHost production child-session trace passed: 2'
+Invoke-CcodHungAfterAckTraceCase $HungTracePath
+Write-Host 'TrayHost production child-session trace passed: 3'
diff --git a/tests/trayhost/Invoke-TrayHostSelfTest.ps1 b/tests/trayhost/Invoke-TrayHostSelfTest.ps1
index 661f0d1..1d3ed9c 100644
--- a/tests/trayhost/Invoke-TrayHostSelfTest.ps1
+++ b/tests/trayhost/Invoke-TrayHostSelfTest.ps1
@@ -58,6 +58,7 @@ try{
         $productionPath=Join-Path $temporaryRoot 'CodexRemote.TrayHost.exe'
         $currentTracePath=Join-Path $temporaryRoot 'TrayHostProductionTrace.Current.exe'
         $staleTracePath=Join-Path $temporaryRoot 'TrayHostProductionTrace.Stale.exe'
+        $hungTracePath=Join-Path $temporaryRoot 'TrayHostProductionTrace.HungAfterAck.exe'
         $compilerBase=@('/nologo','/noconfig','/nostdlib+','/target:exe','/platform:anycpu','/optimize+','/checked+','/warn:4','/warnaserror+')
         foreach($leaf in @('mscorlib.dll','System.dll','System.Core.dll','System.Drawing.dll')){$compilerBase+=('/reference:'+ (Join-Path $reference.ReferenceRoot $leaf))}
         & $compiler @compilerBase ('/out:'+ $productionPath) '/main:Program' @productionSources
@@ -66,7 +67,9 @@ try{
         if($LASTEXITCODE -ne 0){throw 'CCOD_TRAYHOST_PRODUCTION_TRACE_COMPILE_FAILED'}
         & $compiler @compilerBase '/define:TRAYHOST_TRACE_STALE' ('/out:'+ $staleTracePath) '/main:TrayHostProductionTraceMain' @productionSources $testPath
         if($LASTEXITCODE -ne 0){throw 'CCOD_TRAYHOST_PRODUCTION_TRACE_COMPILE_FAILED'}
-        & powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $repositoryRoot 'tests\persistence\TrayHostProductionTrace.SelfTest.ps1') -AssemblyPath $currentTracePath -CurrentTracePath $currentTracePath -StaleTracePath $staleTracePath -ProductionExePath $productionPath
+        & $compiler @compilerBase '/define:TRAYHOST_TRACE_HANG_AFTER_ACK' ('/out:'+ $hungTracePath) '/main:TrayHostProductionTraceMain' @productionSources $testPath
+        if($LASTEXITCODE -ne 0){throw 'CCOD_TRAYHOST_PRODUCTION_TRACE_COMPILE_FAILED'}
+        & powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $repositoryRoot 'tests\persistence\TrayHostProductionTrace.SelfTest.ps1') -AssemblyPath $currentTracePath -CurrentTracePath $currentTracePath -StaleTracePath $staleTracePath -HungTracePath $hungTracePath -ProductionExePath $productionPath
         if($LASTEXITCODE -ne 0){throw 'CCOD_TRAYHOST_PRODUCTION_TRACE_FAILED'}
         return
     }
diff --git a/tests/trayhost/TrayHostProductionTraceSelfTest.cs b/tests/trayhost/TrayHostProductionTraceSelfTest.cs
index 869102a..49cffd7 100644
--- a/tests/trayhost/TrayHostProductionTraceSelfTest.cs
+++ b/tests/trayhost/TrayHostProductionTraceSelfTest.cs
@@ -52,7 +52,12 @@ public static int Main(string[] args)
 #else
             bool stale = false;
 #endif
-            using (ScriptedTraceRuntime runtime = new ScriptedTraceRuntime(witness, stale))
+#if TRAYHOST_TRACE_HANG_AFTER_ACK
+            bool hangAfterShutdownAck = true;
+#else
+            bool hangAfterShutdownAck = false;
+#endif
+            using (ScriptedTraceRuntime runtime = new ScriptedTraceRuntime(witness, stale, hangAfterShutdownAck))
             {
                 return TrayHostChildSession.Run(
                     Console.OpenStandardInput(),
@@ -85,6 +90,7 @@ internal sealed class ScriptedTraceRuntime : ITrayHostRuntime
 {
     private readonly TraceWitness _witness;
     private readonly bool _stale;
+    private readonly bool _hangAfterShutdownAck;
     private readonly ScriptedTracePlatform _platform;
     private TrayWindow _window;
     private TrayHostApplication _application;
@@ -92,12 +98,14 @@ internal sealed class ScriptedTraceRuntime : ITrayHostRuntime
     private bool _exitRequested;
     private bool _started;
     private bool _disposed;
+    private bool _blockedExitRecorded;
 
-    internal ScriptedTraceRuntime(TraceWitness witness, bool stale)
+    internal ScriptedTraceRuntime(TraceWitness witness, bool stale, bool hangAfterShutdownAck)
     {
         if (witness == null) { throw new ArgumentNullException("witness"); }
         _witness = witness;
         _stale = stale;
+        _hangAfterShutdownAck = hangAfterShutdownAck;
         _platform = new ScriptedTracePlatform(witness);
     }
 
@@ -124,6 +132,12 @@ public void Initialize(Action<bool> menuOpenChanged, Action<TrayCommand, ulong>
 
     public void RequestExit()
     {
+        if (_hangAfterShutdownAck)
+        {
+            if (!_blockedExitRecorded) { _blockedExitRecorded = true; _witness.Append("shutdown-ack-written-exit-blocked"); }
+            _platform.Signal();
+            return;
+        }
         _exitRequested = true;
         _platform.Signal();
     }

From 1743de6b40744c0b549d7eb6a3db962afafd36d1 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 12:48:57 +0800
Subject: [PATCH 041/187] test: gate release on tray receipt trace

---
 .github/workflows/ci.yml                      |   4 +
 .github/workflows/release.yml                 |   4 +
 build/TrayHostBuild.psm1                      |  17 +-
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 310 ++++++++++++++++++
 tests/persistence/TrayHostBuild.SelfTest.ps1  |  23 ++
 5 files changed, 357 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 46fdb75..27ef0a8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -49,3 +49,7 @@ jobs:
       - name: Run production TrayHost smoke test
         shell: pwsh
         run: ./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionOnly
+
+      - name: Run authenticated TrayHost production trace
+        shell: pwsh
+        run: ./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index de23853..16dfd70 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -65,6 +65,10 @@ jobs:
         shell: pwsh
         run: ./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionOnly
 
+      - name: Run authenticated TrayHost production trace
+        shell: pwsh
+        run: ./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly
+
       - name: Build CodexRemote-fix portable bundle
         shell: pwsh
         env:
diff --git a/build/TrayHostBuild.psm1 b/build/TrayHostBuild.psm1
index cbfd380..7609bfd 100644
--- a/build/TrayHostBuild.psm1
+++ b/build/TrayHostBuild.psm1
@@ -91,7 +91,22 @@ function Test-CcodTrayHostArtifact {
     if([int]$provenance.schemaVersion -ne 1 -or [string]$provenance.version -cne $Version -or [string]$provenance.targetFramework -cne 'net48' -or $null -eq $commit -or $null -eq $timestamp -or $commit.Value -isnot [string] -or $commit.Value -cnotmatch '^[0-9a-f]{40}$' -or $timestamp.Value -isnot [string] -or -not(Test-CcodTrayHostCanonicalUtc $timestamp.Value) -or (-not [string]::IsNullOrWhiteSpace($ExpectedGitCommit) -and $commit.Value -cne $ExpectedGitCommit)){throw 'CCOD_TRAYHOST_PROVENANCE_INVALID'}
     $icon=Join-Path $repo 'assets\codexremote-fix\codexremote-fix.ico'
     if([string]$provenance.artifactSha256 -cne (Get-CcodTrayHostHash $exe) -or [string]$provenance.configArtifactSha256 -cne (Get-CcodTrayHostHash $config) -or [string]$provenance.iconSha256 -cne (Get-CcodTrayHostHash $icon)){throw 'CCOD_TRAYHOST_ARTIFACT_TAMPERED'}
-    $sourceRoot=Join-Path $repo 'src\trayhost';foreach($record in @($provenance.sourceFiles)){ $source=Join-Path $sourceRoot ([string]$record.name);if(-not(Test-Path -LiteralPath $source -PathType Leaf) -or [string]$record.sha256 -cne (Get-CcodTrayHostHash $source)){throw 'CCOD_TRAYHOST_SOURCE_TAMPERED'} }
+    $sourceRoot=Join-Path $repo 'src\trayhost'
+    $currentSources=@(Get-ChildItem -LiteralPath $sourceRoot -Filter '*.cs' -File|Sort-Object Name)
+    $sourceFilesProperty=$provenance.PSObject.Properties['sourceFiles']
+    $sourceRecords=if($null -eq $sourceFilesProperty){@()}else{@($sourceFilesProperty.Value)}
+    if($sourceRecords.Count -ne $currentSources.Count){throw 'CCOD_TRAYHOST_SOURCE_TAMPERED'}
+    $expectedSources=[Collections.Generic.Dictionary[string,string]]::new([StringComparer]::Ordinal)
+    foreach($source in $currentSources){$expectedSources.Add($source.Name,(Get-CcodTrayHostHash $source.FullName))}
+    $seenSources=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    foreach($record in $sourceRecords){
+        if($null -eq $record){throw 'CCOD_TRAYHOST_SOURCE_TAMPERED'}
+        $nameProperty=$record.PSObject.Properties['name'];$hashProperty=$record.PSObject.Properties['sha256']
+        if($null -eq $nameProperty -or $null -eq $hashProperty -or $nameProperty.Value -isnot [string] -or $hashProperty.Value -isnot [string]){throw 'CCOD_TRAYHOST_SOURCE_TAMPERED'}
+        $name=[string]$nameProperty.Value;$hash=[string]$hashProperty.Value
+        if(-not $seenSources.Add($name) -or -not $expectedSources.ContainsKey($name) -or $hash -cnotmatch '^[0-9a-f]{64}$' -or $hash -cne $expectedSources[$name]){throw 'CCOD_TRAYHOST_SOURCE_TAMPERED'}
+    }
+    if($seenSources.Count -ne $expectedSources.Count){throw 'CCOD_TRAYHOST_SOURCE_TAMPERED'}
     return [pscustomobject][ordered]@{Valid=$true;Executable=$exe;Version=$Version;GitCommit=[string]$commit.Value;Sha256=(Get-CcodTrayHostHash $exe)}
 }
 
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 9c8116a..11c7998 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -4,6 +4,149 @@ $ErrorActionPreference = 'Stop'
 $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
 $defenderPath = Join-Path $repositoryRoot 'tools\Test-ReleaseDefender.ps1'
 
+function ConvertFrom-CcodWorkflowScalar {
+    param([Parameter(Mandatory)][string]$Value)
+    $scalar = $Value.Trim()
+    if ($scalar.Length -ge 2 -and (($scalar[0] -ceq '"' -and $scalar[$scalar.Length - 1] -ceq '"') -or ($scalar[0] -ceq "'" -and $scalar[$scalar.Length - 1] -ceq "'"))) {
+        return $scalar.Substring(1, $scalar.Length - 2)
+    }
+    return $scalar
+}
+
+function Get-CcodWorkflowStructure {
+    param([Parameter(Mandatory)][string]$Path)
+    $jobs = [Collections.Generic.List[object]]::new()
+    $currentJob = $null
+    $currentStep = $null
+    $inJobs = $false
+    $inSteps = $false
+    $runBlock = $false
+    $runLines = [Collections.Generic.List[string]]::new()
+    $lines = [IO.File]::ReadAllLines($Path, [Text.UTF8Encoding]::new($false))
+    for ($index = 0; $index -lt $lines.Length; $index++) {
+        $line = $lines[$index]
+        if ($runBlock) {
+            if ([string]::IsNullOrWhiteSpace($line)) {
+                $runLines.Add('')
+                continue
+            }
+            if ($line -cmatch '^ {10,}') {
+                $runLines.Add($line.Substring(10))
+                continue
+            }
+            $currentStep.Run = $runLines -join "`n"
+            $runLines.Clear()
+            $runBlock = $false
+        }
+        if (-not $inJobs) {
+            if ($line -cmatch '^jobs:\s*(?:#.*)?$') { $inJobs = $true }
+            continue
+        }
+        if ($line -cmatch '^  (?<name>[A-Za-z0-9_-]+):\s*(?:#.*)?$') {
+            $currentJob = [pscustomobject]@{ Name = $Matches.name; Steps = [Collections.Generic.List[object]]::new() }
+            $jobs.Add($currentJob)
+            $currentStep = $null
+            $inSteps = $false
+            continue
+        }
+        if ($null -eq $currentJob) { continue }
+        if ($line -cmatch '^    steps:\s*(?:#.*)?$') {
+            $inSteps = $true
+            continue
+        }
+        if (-not $inSteps) { continue }
+        if ($line -cmatch '^      -(?:\s+(?<key>[A-Za-z][A-Za-z0-9_-]*):\s*(?<value>.*))?\s*$') {
+            $currentStep = [pscustomobject]@{ Name = ''; Shell = ''; Run = '' }
+            $currentJob.Steps.Add($currentStep)
+            $key = [string]$Matches.key
+            $value = [string]$Matches.value
+            if ($key -in @('name', 'shell', 'run')) {
+                if ($key -ceq 'run' -and $value.Trim() -in @('|', '|-', '|+')) {
+                    $runBlock = $true
+                    $runLines.Clear()
+                } else {
+                    $currentStep.$key = ConvertFrom-CcodWorkflowScalar $value
+                }
+            }
+            continue
+        }
+        if ($null -eq $currentStep) { continue }
+        if ($line -cmatch '^        (?<key>shell|run):\s*(?<value>.*)$') {
+            $key = $Matches.key
+            $value = $Matches.value.Trim()
+            if ($key -ceq 'run' -and $value -in @('|', '|-', '|+')) {
+                $runBlock = $true
+                $runLines.Clear()
+            } else {
+                $currentStep.$key = ConvertFrom-CcodWorkflowScalar $value
+            }
+        }
+    }
+    if ($runBlock) { $currentStep.Run = $runLines -join "`n" }
+    return [pscustomobject]@{ Jobs = @($jobs) }
+}
+
+function Test-CcodWorkflowStepInvokesBuild {
+    param([Parameter(Mandatory)]$Step)
+    $tokens = $null
+    $parseErrors = $null
+    $ast = [Management.Automation.Language.Parser]::ParseInput([string]$Step.Run, [ref]$tokens, [ref]$parseErrors)
+    if (@($parseErrors).Count -ne 0) { throw 'CCOD_RELEASE_TRACE_GATE_INVALID' }
+    $commands = @($ast.FindAll({ param($node) $node -is [Management.Automation.Language.CommandAst] }, $true))
+    foreach ($command in $commands) {
+        $commandName = [string]$command.GetCommandName()
+        $elements = @($command.CommandElements | ForEach-Object { $_.Extent.Text })
+        if ($commandName.Replace('\', '/') -ceq './build/build.ps1' -and $elements -ccontains '-Version') { return $true }
+    }
+    return $false
+}
+
+function Test-CcodWorkflowStepInvokesProductionTrace {
+    param([Parameter(Mandatory)]$Step)
+    $tokens = $null
+    $parseErrors = $null
+    $ast = [Management.Automation.Language.Parser]::ParseInput([string]$Step.Run, [ref]$tokens, [ref]$parseErrors)
+    if (@($parseErrors).Count -ne 0) { throw 'CCOD_RELEASE_TRACE_GATE_INVALID' }
+    $commands = @($ast.FindAll({ param($node) $node -is [Management.Automation.Language.CommandAst] }, $true))
+    foreach ($command in $commands) {
+        $commandName = [string]$command.GetCommandName()
+        $elements = @($command.CommandElements | ForEach-Object { $_.Extent.Text })
+        if ($commandName.Replace('\', '/') -ceq './tests/trayhost/Invoke-TrayHostSelfTest.ps1' -and $elements -ccontains '-ProductionTraceOnly') { return $true }
+    }
+    return $false
+}
+
+function Assert-CcodAuthenticatedTraceWorkflowContract {
+    param(
+        [Parameter(Mandatory)][string]$CiPath,
+        [Parameter(Mandatory)][string]$ReleasePath
+    )
+    $traceName = 'Run authenticated TrayHost production trace'
+    $traceRun = './tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly'
+    foreach ($target in @(
+        [pscustomobject]@{ Path = $CiPath; Job = 'validate'; RequireBuildOrder = $false },
+        [pscustomobject]@{ Path = $ReleasePath; Job = 'build'; RequireBuildOrder = $true }
+    )) {
+        $workflow = Get-CcodWorkflowStructure -Path $target.Path
+        $jobs = @($workflow.Jobs | Where-Object { $_.Name -ceq $target.Job })
+        if ($jobs.Count -ne 1) { throw 'CCOD_RELEASE_TRACE_GATE_INVALID' }
+        $allTraceSteps = @($workflow.Jobs | ForEach-Object { @($_.Steps) } | Where-Object { $_.Name -ceq $traceName })
+        $allTraceInvocationSteps = @($workflow.Jobs | ForEach-Object { @($_.Steps) } | Where-Object { Test-CcodWorkflowStepInvokesProductionTrace -Step $_ })
+        $traceSteps = @($jobs[0].Steps | Where-Object { $_.Name -ceq $traceName })
+        if ($allTraceSteps.Count -ne 1 -or $allTraceInvocationSteps.Count -ne 1 -or $traceSteps.Count -ne 1 -or $traceSteps[0].Shell -cne 'pwsh' -or $traceSteps[0].Run -cne $traceRun) {
+            throw 'CCOD_RELEASE_TRACE_GATE_INVALID'
+        }
+        if ($target.RequireBuildOrder) {
+            $buildIndexes = [Collections.Generic.List[int]]::new()
+            for ($stepIndex = 0; $stepIndex -lt $jobs[0].Steps.Count; $stepIndex++) {
+                if (Test-CcodWorkflowStepInvokesBuild -Step $jobs[0].Steps[$stepIndex]) { $buildIndexes.Add($stepIndex) }
+            }
+            $traceIndex = $jobs[0].Steps.IndexOf($traceSteps[0])
+            if ($buildIndexes.Count -ne 1 -or $traceIndex -lt 0 -or $traceIndex -ge $buildIndexes[0]) { throw 'CCOD_RELEASE_TRACE_GATE_INVALID' }
+        }
+    }
+}
+
 function New-CcodReleaseFixture {
     $root = Join-Path $env:TEMP ('ccod-release-workflow-' + [guid]::NewGuid().ToString('N'))
     $null = [IO.Directory]::CreateDirectory($root)
@@ -1333,6 +1476,173 @@ Invoke-CcodTest 'Defender gate requires Internet Zone before a custom scan and w
     }
 }
 
+Invoke-CcodTest 'TrayHost artifact validation requires the exact compiled source name and hash set' {
+    Import-Module (Join-Path $repositoryRoot 'build\TrayHostBuild.psm1') -Force
+    $artifact = Join-Path ([IO.Path]::GetTempPath()) ('ccod-trayhost-provenance-fixture-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($artifact) | Out-Null
+        $executable = Join-Path $artifact 'CodexRemote.TrayHost.exe'
+        $config = Join-Path $artifact 'CodexRemote.TrayHost.exe.config'
+        $provenancePath = Join-Path $artifact 'trayhost-build-provenance.json'
+        [IO.File]::WriteAllBytes($executable, [byte[]](7, 5, 2, 2, 1))
+        [IO.File]::WriteAllText($config, '<configuration/>', [Text.UTF8Encoding]::new($false))
+        $sourceRoot = Join-Path $repositoryRoot 'src\trayhost'
+        $sourceRecords = @(Get-ChildItem -LiteralPath $sourceRoot -Filter '*.cs' -File | Sort-Object Name | ForEach-Object {
+            [ordered]@{ name = $_.Name; sha256 = Get-CcodTestFileSha256 -Path $_.FullName }
+        })
+        Assert-CcodTrue (@($sourceRecords.name) -ccontains 'TrayHostChildSession.cs') 'release provenance fixture includes the shared production child session'
+        Assert-CcodTrue (@($sourceRecords.name) -ccontains 'WindowsTrayHostRuntime.cs') 'release provenance fixture includes the production Windows runtime adapter'
+        $commit = 'c' * 40
+        $baseline = [ordered]@{
+            schemaVersion = 1
+            product = 'CodexRemote-fix'
+            version = '2.5.21'
+            gitCommit = $commit
+            buildTimestampUtc = '2026-08-28T00:00:00.0000000Z'
+            targetFramework = 'net48'
+            sourceFiles = $sourceRecords
+            iconSha256 = Get-CcodTestFileSha256 -Path (Join-Path $repositoryRoot 'assets\codexremote-fix\codexremote-fix.ico')
+            artifactSha256 = Get-CcodTestFileSha256 -Path $executable
+            configArtifactSha256 = Get-CcodTestFileSha256 -Path $config
+        }
+        $baselineJson = $baseline | ConvertTo-Json -Depth 8
+        [IO.File]::WriteAllText($provenancePath, $baselineJson, [Text.UTF8Encoding]::new($false))
+        Test-CcodTrayHostArtifact -RepositoryRoot $repositoryRoot -Version '2.5.21' -ArtifactDirectory $artifact -ExpectedGitCommit $commit | Out-Null
+        $mutations = @(
+            [pscustomobject]@{ Name = 'missing shared child session'; Apply = { param($record) $record.sourceFiles = @($record.sourceFiles | Where-Object { $_.name -cne 'TrayHostChildSession.cs' }) } },
+            [pscustomobject]@{ Name = 'duplicate shared child session'; Apply = { param($record) $child = @($record.sourceFiles | Where-Object { $_.name -ceq 'TrayHostChildSession.cs' })[0]; $record.sourceFiles = @($record.sourceFiles | Where-Object { $_.name -cne 'WindowsTrayHostRuntime.cs' }) + @([pscustomobject]@{ name = $child.name; sha256 = $child.sha256 }) } },
+            [pscustomobject]@{ Name = 'different source name set'; Apply = { param($record) $child = @($record.sourceFiles | Where-Object { $_.name -ceq 'TrayHostChildSession.cs' })[0]; $child.name = 'TrayHostChildSession-copy.cs' } },
+            [pscustomobject]@{ Name = 'Windows runtime source hash mismatch'; Apply = { param($record) $runtime = @($record.sourceFiles | Where-Object { $_.name -ceq 'WindowsTrayHostRuntime.cs' })[0]; $runtime.sha256 = '0' * 64 } }
+        )
+        foreach ($mutationCase in $mutations) {
+            $mutated = $baselineJson | ConvertFrom-Json
+            $applyMutation = [scriptblock]$mutationCase.Apply
+            & $applyMutation $mutated
+            [IO.File]::WriteAllText($provenancePath, ($mutated | ConvertTo-Json -Depth 8), [Text.UTF8Encoding]::new($false))
+            Assert-CcodThrows {
+                Test-CcodTrayHostArtifact -RepositoryRoot $repositoryRoot -Version '2.5.21' -ArtifactDirectory $artifact -ExpectedGitCommit $commit | Out-Null
+            } 'CCOD_TRAYHOST_SOURCE_TAMPERED'
+        }
+    } finally {
+        if (Test-Path -LiteralPath $artifact) { Remove-Item -LiteralPath $artifact -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+Invoke-CcodTest 'CI and release build jobs uniquely gate asset production on the authenticated TrayHost trace' {
+    Assert-CcodAuthenticatedTraceWorkflowContract `
+        -CiPath (Join-Path $repositoryRoot '.github\workflows\ci.yml') `
+        -ReleasePath (Join-Path $repositoryRoot '.github\workflows\release.yml')
+}
+
+Invoke-CcodTest 'authenticated trace workflow gate rejects comments wrong jobs duplicates and post-build placement' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-trace-workflow-fixtures-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $ciPath = Join-Path $root 'ci.yml'
+        $releasePath = Join-Path $root 'release.yml'
+        $validCi = @'
+name: fixture CI
+jobs:
+  validate:
+    steps:
+      - name: Run authenticated TrayHost production trace
+        shell: pwsh
+        run: ./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly
+'@
+        $validRelease = @'
+name: fixture release
+jobs:
+  build:
+    steps:
+      - name: Run authenticated TrayHost production trace
+        shell: pwsh
+        run: ./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly
+      - name: Build assets
+        shell: pwsh
+        run: |
+          $version = '2.5.21'
+          ./build/build.ps1 -Version $version
+  publish:
+    steps:
+      - name: Publish fixture
+        shell: pwsh
+        run: Write-Output publish
+'@
+        [IO.File]::WriteAllText($ciPath, $validCi, [Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($releasePath, $validRelease, [Text.UTF8Encoding]::new($false))
+        Assert-CcodAuthenticatedTraceWorkflowContract -CiPath $ciPath -ReleasePath $releasePath
+        $invalidFixtures = @(
+            [pscustomobject]@{ Name = 'comment-only CI decoy'; Ci = @'
+name: fixture CI
+jobs:
+  validate:
+    steps:
+      # - name: Run authenticated TrayHost production trace
+      #   shell: pwsh
+      #   run: ./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly
+      - name: Validate
+        shell: pwsh
+        run: Write-Output validate
+'@; Release = $validRelease },
+            [pscustomobject]@{ Name = 'release publish-job decoy'; Ci = $validCi; Release = @'
+name: fixture release
+jobs:
+  build:
+    steps:
+      - name: Build assets
+        shell: pwsh
+        run: ./build/build.ps1 -Version 2.5.21
+  publish:
+    steps:
+      - name: Run authenticated TrayHost production trace
+        shell: pwsh
+        run: ./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly
+'@ },
+            [pscustomobject]@{ Name = 'post-build release gate'; Ci = $validCi; Release = @'
+name: fixture release
+jobs:
+  build:
+    steps:
+      - name: Build assets
+        shell: pwsh
+        run: ./build/build.ps1 -Version 2.5.21
+      - name: Run authenticated TrayHost production trace
+        shell: pwsh
+        run: ./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly
+'@ },
+            [pscustomobject]@{ Name = 'anonymous pre-build release step'; Ci = $validCi; Release = @'
+name: fixture release
+jobs:
+  build:
+    steps:
+      - run: ./build/build.ps1 -Version 2.5.21
+      - name: Run authenticated TrayHost production trace
+        shell: pwsh
+        run: ./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly
+'@ },
+            [pscustomobject]@{ Name = 'duplicate CI gate'; Ci = $validCi + "`n" + @'
+      - name: Run authenticated TrayHost production trace
+        shell: pwsh
+        run: ./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly
+'@; Release = $validRelease },
+            [pscustomobject]@{ Name = 'different-name duplicate CI trace invocation'; Ci = $validCi + "`n" + @'
+      - name: Trace alias
+        shell: pwsh
+        run: ./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly
+'@; Release = $validRelease }
+        )
+        foreach ($fixture in $invalidFixtures) {
+            [IO.File]::WriteAllText($ciPath, [string]$fixture.Ci, [Text.UTF8Encoding]::new($false))
+            [IO.File]::WriteAllText($releasePath, [string]$fixture.Release, [Text.UTF8Encoding]::new($false))
+            Assert-CcodThrows {
+                Assert-CcodAuthenticatedTraceWorkflowContract -CiPath $ciPath -ReleasePath $releasePath
+            } 'CCOD_RELEASE_TRACE_GATE_INVALID'
+        }
+    } finally {
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
 Invoke-CcodTest 'package scripts build provenance and workflows retain the release-contract gates' {
     $package = Get-Content -LiteralPath (Join-Path $repositoryRoot 'package.json') -Raw | ConvertFrom-Json
     Assert-CcodTrue ($null -ne $package.scripts.'test:installed-lifecycle') 'package exposes installed-lifecycle deterministic tests'
diff --git a/tests/persistence/TrayHostBuild.SelfTest.ps1 b/tests/persistence/TrayHostBuild.SelfTest.ps1
index 2e9153e..ad74661 100644
--- a/tests/persistence/TrayHostBuild.SelfTest.ps1
+++ b/tests/persistence/TrayHostBuild.SelfTest.ps1
@@ -75,6 +75,29 @@ Invoke-CcodTest 'TrayHost build emits one source-auditable artifact and rejects
         $currentCommit=(& git -C $repositoryRoot rev-parse HEAD).Trim().ToLowerInvariant()
         $validated=Test-CcodTrayHostArtifact -RepositoryRoot $repositoryRoot -Version '2.5.21' -ArtifactDirectory $artifact -ExpectedGitCommit $currentCommit
         Assert-CcodEqual $currentCommit ([string]$validated.GitCommit) 'artifact validation binds the current source commit when requested'
+        $expectedSourceNames=@(Get-ChildItem -LiteralPath (Join-Path $repositoryRoot 'src\trayhost') -Filter '*.cs' -File|Sort-Object Name|ForEach-Object Name)
+        Assert-CcodEqual ($expectedSourceNames -join ',') (@($provenance.sourceFiles.name) -join ',') 'built provenance records the exact compiled TrayHost source set in canonical order'
+        Assert-CcodTrue ($expectedSourceNames -ccontains 'TrayHostChildSession.cs') 'compiled source provenance includes the shared production child session'
+        Assert-CcodTrue ($expectedSourceNames -ccontains 'WindowsTrayHostRuntime.cs') 'compiled source provenance includes the production Windows runtime adapter'
+        $provenancePath=Join-Path $artifact 'trayhost-build-provenance.json'
+        $baselineJson=[IO.File]::ReadAllText($provenancePath,[Text.UTF8Encoding]::new($false))
+        $mutations=@(
+            [pscustomobject]@{Name='missing shared child session';Apply={param($record)$record.sourceFiles=@($record.sourceFiles|Where-Object{$_.name -cne 'TrayHostChildSession.cs'})}},
+            [pscustomobject]@{Name='duplicate shared child session';Apply={param($record)$child=@($record.sourceFiles|Where-Object{$_.name -ceq 'TrayHostChildSession.cs'})[0];$record.sourceFiles=@($record.sourceFiles|Where-Object{$_.name -cne 'WindowsTrayHostRuntime.cs'})+@([pscustomobject]@{name=$child.name;sha256=$child.sha256})}},
+            [pscustomobject]@{Name='different source name set';Apply={param($record)$child=@($record.sourceFiles|Where-Object{$_.name -ceq 'TrayHostChildSession.cs'})[0];$child.name='TrayHostChildSession-copy.cs'}},
+            [pscustomobject]@{Name='Windows runtime source hash mismatch';Apply={param($record)$runtime=@($record.sourceFiles|Where-Object{$_.name -ceq 'WindowsTrayHostRuntime.cs'})[0];$runtime.sha256='0'*64}}
+        )
+        foreach($mutationCase in $mutations){
+            $mutated=$baselineJson|ConvertFrom-Json
+            $applyMutation=[scriptblock]$mutationCase.Apply
+            & $applyMutation $mutated
+            [IO.File]::WriteAllText($provenancePath,($mutated|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+            try{
+                Assert-CcodThrows { Test-CcodTrayHostArtifact -RepositoryRoot $repositoryRoot -Version '2.5.21' -ArtifactDirectory $artifact -ExpectedGitCommit $currentCommit|Out-Null } 'CCOD_TRAYHOST_SOURCE_TAMPERED'
+            }finally{
+                [IO.File]::WriteAllText($provenancePath,$baselineJson,[Text.UTF8Encoding]::new($false))
+            }
+        }
         $tampered=Join-Path $artifact 'CodexRemote.TrayHost.exe.config'; Add-Content -LiteralPath $tampered -Value 'x'
         $threw=$false; try{Test-CcodTrayHostArtifact -RepositoryRoot $repositoryRoot -Version '2.5.21' -ArtifactDirectory $artifact|Out-Null}catch{$threw=$true}
         Assert-CcodTrue $threw 'tampered artifact is rejected'

From 2e0b49af4c940c683f6d37c915138c0ec4c949ae Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 12:51:41 +0800
Subject: [PATCH 042/187] docs: record release trace gate validation

---
 .../task-4-report.md                          | 179 ++++++++++++++++++
 1 file changed, 179 insertions(+)
 create mode 100644 .superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-4-report.md

diff --git a/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-4-report.md b/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-4-report.md
new file mode 100644
index 0000000..4481998
--- /dev/null
+++ b/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-4-report.md
@@ -0,0 +1,179 @@
+# Task 4 report: fail-closed release trace and TrayHost provenance
+
+## Outcome
+
+Task 4 closes both release-boundary gaps without changing the TrayHost wire,
+CLI, authentication, installer, version metadata, or installed runtime.
+
+- CI job `validate` and release job `build` each contain exactly one step named
+  `Run authenticated TrayHost production trace`, with `shell: pwsh` and the
+  exact run value
+  `./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly`.
+- The release trace is immediately before the asset-producing build step and
+  structurally precedes the real PowerShell command
+  `./build/build.ps1 -Version $version`.
+- `Test-CcodTrayHostArtifact` now compares provenance with the exact current
+  `src/trayhost/*.cs` name-to-SHA-256 set. Missing records, count differences,
+  duplicate names, unexpected or case-different names, malformed hashes, and
+  name/hash mismatches fail with `CCOD_TRAYHOST_SOURCE_TAMPERED`.
+- The production validator never resolves a path supplied by provenance. It
+  hashes the enumerated current sources first, stores them in an ordinal
+  dictionary, and validates records against that bounded set.
+
+Implementation commit:
+
+```text
+1743de6 test: gate release on tray receipt trace
+```
+
+## TDD RED evidence
+
+### Release workflow gate
+
+Only the structural release test had been changed when this command ran:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/ReleaseWorkflow.SelfTest.ps1
+```
+
+It exited 1 after all preceding release/manifest/Defender cases passed:
+
+```text
+CCOD_SELFTEST_FAILED case=CI-and-release-build-jobs-uniquely-gate-asset-production-on-the-authenticated-TrayHost-trace error=CCOD_RELEASE_TRACE_GATE_INVALID
+CCOD_RELEASE_TRACE_GATE_INVALID
+```
+
+No workflow production file had been changed before this RED. Adding the exact
+CI/release steps then made the same command exit 0.
+
+### Exact source provenance
+
+The provenance fixture and negative tests were added before changing
+`build/TrayHostBuild.psm1`. The same required ReleaseWorkflow command exited 1:
+
+```text
+CCOD_SELFTEST_FAILED case=TrayHost-artifact-validation-requires-the-exact-compiled-source-name-and-hash-set error=ASSERT_THROWS
+ASSERT_THROWS: expected CCOD_TRAYHOST_SOURCE_TAMPERED
+```
+
+The old verifier had accepted provenance with `TrayHostChildSession.cs`
+removed. After the exact-set validator was implemented, the same command
+exited 0 and all four provenance mutations were rejected.
+
+## Workflow evidence
+
+- `.github/workflows/ci.yml:53-55` contains the sole CI trace step under
+  `jobs.validate.steps`.
+- `.github/workflows/release.yml:68-70` contains the sole release trace step
+  under `jobs.build.steps`.
+- `.github/workflows/release.yml:72-78` places it before the build step and
+  the AST-confirmed `build.ps1 -Version` invocation.
+- `ReleaseWorkflow.SelfTest.ps1` parses job and step indentation rather than
+  searching the whole file. It parses each PowerShell `run` body into an AST,
+  counts the real trace/build commands, and compares their step indexes.
+- Controlled negative YAML fixtures reject a comment-only decoy, a trace in
+  `publish`, a post-build trace, an anonymous pre-build command, duplicate
+  named steps, and a duplicate trace invocation under a different name.
+
+The checked-in workflows each had one trace name and one exact trace run value
+at final review.
+
+## Provenance evidence
+
+The final source enumeration contained 19 `.cs` files. Both the lightweight
+release fixture and the real compiled artifact test cover:
+
+- omission of `TrayHostChildSession.cs`;
+- a same-count duplicate of `TrayHostChildSession.cs` replacing
+  `WindowsTrayHostRuntime.cs`;
+- a changed source-name set;
+- a wrong hash for `WindowsTrayHostRuntime.cs`.
+
+The real build test also requires the provenance names to equal the canonical
+sorted source names and explicitly requires both new production source files.
+The validator uses ordinal name comparison and canonical lowercase 64-digit
+SHA-256 values.
+
+## Command ledger
+
+### Required/focused tests
+
+| Command | Result |
+| --- | --- |
+| `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/ReleaseWorkflow.SelfTest.ps1` | RED 1: exit 1, missing workflow gate (`CCOD_RELEASE_TRACE_GATE_INVALID`). |
+| same ReleaseWorkflow command after workflow change | exit 0. |
+| same ReleaseWorkflow command after provenance test, before verifier change | RED 2: exit 1, missing source record was wrongly accepted (`ASSERT_THROWS`). |
+| final same ReleaseWorkflow command | exit 0; release workflow self-tests passed, including structural decoys and provenance mutations. |
+| `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/TrayHostBuild.SelfTest.ps1` | exit 0; six build/provenance cases passed against a real compiled artifact. |
+| `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly` | exit 0; `TrayHost production child-session trace passed: 3`. |
+| `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/InstalledLifecycleHarness.SelfTest.ps1` | exit 0; 20 controlled adapter/temp-root scenarios passed. |
+| all repository `.ps1`/`.psm1` files through `System.Management.Automation.Language.Parser` | exit 0; 92 files parsed. |
+| all `src` JS/MJS files through `node --check` | exit 0; 5 files parsed. |
+| `node.exe tests/CleanroomSelfTest.js` | exit 0; JSON result `ok: true`, 19 cases. |
+| `node.exe tests/PackageCheckerSelfTest.mjs` | exit 0. |
+| `git diff --check` | exit 0; only the repository's existing LF-to-CRLF warnings. |
+
+### Full Persistence/Validate isolation boundary
+
+The direct, non-npm aggregate command was attempted once:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/PersistenceSelfTest.ps1
+```
+
+It exited 1 before reaching Task 4 tests:
+
+```text
+CCOD_SELFTEST_FAILED case=selects-previous-runtime-after-active-exits-before-ready-and-swaps-pointer error=ASSERT_EXACT
+CCOD_PERSISTENCE_SELFTEST_FAILED test=Bootstrap.SelfTest.ps1 exit=1
+```
+
+Running `Bootstrap.SelfTest.ps1` alone twice reproduced
+`previous fallback succeeds expected=[0] actual=[1]`. A corrected zero-wait
+production mutex probe exited 0 and reported:
+
+```text
+CCOD_ACCOUNT_TRANSITION_PROBE outcome=TimedOut
+```
+
+An initial diagnostic probe invocation had a parent-shell quoting error and
+exited 1 before importing the module or touching a mutex; the corrected
+single-quoted probe above is the relevant result.
+
+The installed Supervisor was live, and an independent probe showed that the
+fixed account transition boundary was unavailable. `tests/Validate.ps1 -SkipInstalledPackageCheck`
+was not started because it unconditionally invokes the same Persistence
+aggregate; repeating it could not produce independent evidence. No process was
+stopped and no kernel-name, SID, or safety check was forged to bypass the
+boundary. The existing fully controlled InstalledLifecycle harness and the
+safe pre-Persistence validation components were run instead and passed.
+
+## Scope
+
+Changed implementation/test files:
+
+- `.github/workflows/ci.yml`
+- `.github/workflows/release.yml`
+- `build/TrayHostBuild.psm1`
+- `tests/persistence/ReleaseWorkflow.SelfTest.ps1`
+- `tests/persistence/TrayHostBuild.SelfTest.ps1`
+
+This task did not modify production TrayHost wire fields, message types,
+sequence/authentication rules, CLI selectors, child-session behavior, receipt
+storage, installer behavior, version metadata, README/CHANGELOG content, or
+Task 5 static manifest/version binding.
+
+No real UI, Codex process, installer, installation, release, push, package
+signing, or public operation was started. Tests used temporary artifacts and
+the Task 3 fake-native production trace only.
+
+## Remaining risks
+
+- Full `PersistenceSelfTest.ps1` and therefore `Validate.ps1` still require a
+  fresh run when the real account transition mutex is safely quiescent. This
+  task did not stop the live Supervisor to manufacture a green aggregate.
+- The production trace proves the shared authenticated child-session path with
+  a fake native platform; installed-machine notification-area and Defender
+  validation remain later release acceptance boundaries.
+- Version, Windows manifest identity, README/CHANGELOG, and final asset
+  acceptance are Task 5 scope and were intentionally not changed here.

From f0e388ee6090d1be8d119c78033a6f245764a718 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 13:06:53 +0800
Subject: [PATCH 043/187] fix: reject bypassed tray trace gates

---
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 66 ++++++++++++++++---
 1 file changed, 58 insertions(+), 8 deletions(-)

diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 11c7998..fed9492 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -5,7 +5,7 @@ $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
 $defenderPath = Join-Path $repositoryRoot 'tools\Test-ReleaseDefender.ps1'
 
 function ConvertFrom-CcodWorkflowScalar {
-    param([Parameter(Mandatory)][string]$Value)
+    param([Parameter(Mandatory)][AllowEmptyString()][string]$Value)
     $scalar = $Value.Trim()
     if ($scalar.Length -ge 2 -and (($scalar[0] -ceq '"' -and $scalar[$scalar.Length - 1] -ceq '"') -or ($scalar[0] -ceq "'" -and $scalar[$scalar.Length - 1] -ceq "'"))) {
         return $scalar.Substring(1, $scalar.Length - 2)
@@ -56,29 +56,43 @@ function Get-CcodWorkflowStructure {
         }
         if (-not $inSteps) { continue }
         if ($line -cmatch '^      -(?:\s+(?<key>[A-Za-z][A-Za-z0-9_-]*):\s*(?<value>.*))?\s*$') {
-            $currentStep = [pscustomobject]@{ Name = ''; Shell = ''; Run = '' }
+            $currentStep = [pscustomobject]@{ Name = ''; Shell = ''; Run = ''; If = ''; ContinueOnError = '' }
             $currentJob.Steps.Add($currentStep)
             $key = [string]$Matches.key
             $value = [string]$Matches.value
-            if ($key -in @('name', 'shell', 'run')) {
+            if ($key -in @('name', 'shell', 'run', 'if', 'continue-on-error')) {
                 if ($key -ceq 'run' -and $value.Trim() -in @('|', '|-', '|+')) {
                     $runBlock = $true
                     $runLines.Clear()
                 } else {
-                    $currentStep.$key = ConvertFrom-CcodWorkflowScalar $value
+                    $property = switch ($key) {
+                        'name' { 'Name' }
+                        'shell' { 'Shell' }
+                        'run' { 'Run' }
+                        'if' { 'If' }
+                        'continue-on-error' { 'ContinueOnError' }
+                    }
+                    $currentStep.$property = ConvertFrom-CcodWorkflowScalar $value
                 }
             }
             continue
         }
         if ($null -eq $currentStep) { continue }
-        if ($line -cmatch '^        (?<key>shell|run):\s*(?<value>.*)$') {
+        if ($line -cmatch '^        (?<key>name|shell|run|if|continue-on-error):\s*(?<value>.*)$') {
             $key = $Matches.key
             $value = $Matches.value.Trim()
             if ($key -ceq 'run' -and $value -in @('|', '|-', '|+')) {
                 $runBlock = $true
                 $runLines.Clear()
             } else {
-                $currentStep.$key = ConvertFrom-CcodWorkflowScalar $value
+                $property = switch ($key) {
+                    'name' { 'Name' }
+                    'shell' { 'Shell' }
+                    'run' { 'Run' }
+                    'if' { 'If' }
+                    'continue-on-error' { 'ContinueOnError' }
+                }
+                $currentStep.$property = ConvertFrom-CcodWorkflowScalar $value
             }
         }
     }
@@ -133,7 +147,7 @@ function Assert-CcodAuthenticatedTraceWorkflowContract {
         $allTraceSteps = @($workflow.Jobs | ForEach-Object { @($_.Steps) } | Where-Object { $_.Name -ceq $traceName })
         $allTraceInvocationSteps = @($workflow.Jobs | ForEach-Object { @($_.Steps) } | Where-Object { Test-CcodWorkflowStepInvokesProductionTrace -Step $_ })
         $traceSteps = @($jobs[0].Steps | Where-Object { $_.Name -ceq $traceName })
-        if ($allTraceSteps.Count -ne 1 -or $allTraceInvocationSteps.Count -ne 1 -or $traceSteps.Count -ne 1 -or $traceSteps[0].Shell -cne 'pwsh' -or $traceSteps[0].Run -cne $traceRun) {
+        if ($allTraceSteps.Count -ne 1 -or $allTraceInvocationSteps.Count -ne 1 -or $traceSteps.Count -ne 1 -or $traceSteps[0].Shell -cne 'pwsh' -or $traceSteps[0].Run -cne $traceRun -or -not [string]::IsNullOrEmpty([string]$traceSteps[0].If) -or -not [string]::IsNullOrEmpty([string]$traceSteps[0].ContinueOnError)) {
             throw 'CCOD_RELEASE_TRACE_GATE_INVALID'
         }
         if ($target.RequireBuildOrder) {
@@ -1534,7 +1548,7 @@ Invoke-CcodTest 'CI and release build jobs uniquely gate asset production on the
         -ReleasePath (Join-Path $repositoryRoot '.github\workflows\release.yml')
 }
 
-Invoke-CcodTest 'authenticated trace workflow gate rejects comments wrong jobs duplicates and post-build placement' {
+Invoke-CcodTest 'authenticated trace workflow gate rejects bypass modifiers comments wrong jobs duplicates and post-build placement' {
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-trace-workflow-fixtures-' + [guid]::NewGuid().ToString('N'))
     try {
         [IO.Directory]::CreateDirectory($root) | Out-Null
@@ -1571,7 +1585,43 @@ jobs:
         [IO.File]::WriteAllText($ciPath, $validCi, [Text.UTF8Encoding]::new($false))
         [IO.File]::WriteAllText($releasePath, $validRelease, [Text.UTF8Encoding]::new($false))
         Assert-CcodAuthenticatedTraceWorkflowContract -CiPath $ciPath -ReleasePath $releasePath
+        $emptyModifierCi = @'
+name: fixture CI
+jobs:
+  validate:
+    steps:
+      - name: Run authenticated TrayHost production trace
+        if:
+        continue-on-error:
+        shell: pwsh
+        run: ./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly
+'@
+        [IO.File]::WriteAllText($ciPath, $emptyModifierCi, [Text.UTF8Encoding]::new($false))
+        Assert-CcodAuthenticatedTraceWorkflowContract -CiPath $ciPath -ReleasePath $releasePath
         $invalidFixtures = @(
+            [pscustomobject]@{ Name = 'conditional CI trace step'; Ci = @'
+name: fixture CI
+jobs:
+  validate:
+    steps:
+      - name: Run authenticated TrayHost production trace
+        if: ${{ false }}
+        shell: pwsh
+        run: ./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly
+'@; Release = $validRelease },
+            [pscustomobject]@{ Name = 'continue-on-error release trace step'; Ci = $validCi; Release = @'
+name: fixture release
+jobs:
+  build:
+    steps:
+      - name: Run authenticated TrayHost production trace
+        continue-on-error: true
+        shell: pwsh
+        run: ./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly
+      - name: Build assets
+        shell: pwsh
+        run: ./build/build.ps1 -Version 2.5.21
+'@ },
             [pscustomobject]@{ Name = 'comment-only CI decoy'; Ci = @'
 name: fixture CI
 jobs:

From 1d6bd1fa26320201ce80b7bd308f6ff0b17f18d3 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 13:08:10 +0800
Subject: [PATCH 044/187] docs: record tray trace gate bypass fix

---
 .../task-4-report.md                          | 59 +++++++++++++++++--
 1 file changed, 53 insertions(+), 6 deletions(-)

diff --git a/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-4-report.md b/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-4-report.md
index 4481998..4aba45b 100644
--- a/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-4-report.md
+++ b/.superpowers/sdd/2026-08-28-v2522-async-tray-receipts/task-4-report.md
@@ -20,10 +20,11 @@ CLI, authentication, installer, version metadata, or installed runtime.
   hashes the enumerated current sources first, stores them in an ordinal
   dictionary, and validates records against that bounded set.
 
-Implementation commit:
+Implementation commits:
 
 ```text
 1743de6 test: gate release on tray receipt trace
+f0e388e fix: reject bypassed tray trace gates
 ```
 
 ## TDD RED evidence
@@ -71,9 +72,11 @@ exited 0 and all four provenance mutations were rejected.
 - `ReleaseWorkflow.SelfTest.ps1` parses job and step indentation rather than
   searching the whole file. It parses each PowerShell `run` body into an AST,
   counts the real trace/build commands, and compares their step indexes.
-- Controlled negative YAML fixtures reject a comment-only decoy, a trace in
-  `publish`, a post-build trace, an anonymous pre-build command, duplicate
-  named steps, and a duplicate trace invocation under a different name.
+- Controlled negative YAML fixtures reject nonempty `if` and
+  `continue-on-error` modifiers, a comment-only decoy, a trace in `publish`, a
+  post-build trace, an anonymous pre-build command, duplicate named steps, and
+  a duplicate trace invocation under a different name. Explicitly empty or
+  absent execution modifiers remain acceptable.
 
 The checked-in workflows each had one trace name and one exact trace run value
 at final review.
@@ -103,7 +106,7 @@ SHA-256 values.
 | `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/ReleaseWorkflow.SelfTest.ps1` | RED 1: exit 1, missing workflow gate (`CCOD_RELEASE_TRACE_GATE_INVALID`). |
 | same ReleaseWorkflow command after workflow change | exit 0. |
 | same ReleaseWorkflow command after provenance test, before verifier change | RED 2: exit 1, missing source record was wrongly accepted (`ASSERT_THROWS`). |
-| final same ReleaseWorkflow command | exit 0; release workflow self-tests passed, including structural decoys and provenance mutations. |
+| final same ReleaseWorkflow command | exit 0; release workflow self-tests passed, including execution-modifier bypasses, structural decoys, and provenance mutations. |
 | `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/TrayHostBuild.SelfTest.ps1` | exit 0; six build/provenance cases passed against a real compiled artifact. |
 | `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly` | exit 0; `TrayHost production child-session trace passed: 3`. |
 | `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/InstalledLifecycleHarness.SelfTest.ps1` | exit 0; 20 controlled adapter/temp-root scenarios passed. |
@@ -113,7 +116,51 @@ SHA-256 values.
 | `node.exe tests/PackageCheckerSelfTest.mjs` | exit 0. |
 | `git diff --check` | exit 0; only the repository's existing LF-to-CRLF warnings. |
 
-### Full Persistence/Validate isolation boundary
+## Fix round 1/5: execution modifiers cannot bypass the trace gate
+
+Independent review found that the first workflow structure retained only
+`Name`, `Shell`, and `Run`. A required trace step could therefore keep every
+checked field while adding `if: ${{ false }}` or
+`continue-on-error: true`; the former skips the trace and the latter tolerates
+its failure.
+
+Two deterministic temporary YAML fixtures were added before changing the
+parser or contract. Running the required command:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/ReleaseWorkflow.SelfTest.ps1
+```
+
+exited 1 after the real workflow and all preceding release/provenance checks
+passed:
+
+```text
+CCOD_SELFTEST_FAILED case=authenticated-trace-workflow-gate-rejects-comments-wrong-jobs-duplicates-and-post-build-placement error=ASSERT_THROWS
+ASSERT_THROWS: expected CCOD_RELEASE_TRACE_GATE_INVALID
+```
+
+This was the expected RED: the old contract accepted the first conditional
+trace fixture. The step model now retains `If` and `ContinueOnError` from both
+inline and following YAML keys. The exact required trace step must have both
+values empty; any nonempty literal or expression fails with
+`CCOD_RELEASE_TRACE_GATE_INVALID`. A positive fixture proves explicitly empty
+modifiers remain accepted, while the existing valid workflow proves absence
+remains accepted.
+
+Fresh fix-round verification on the final implementation tree:
+
+| Command | Result |
+| --- | --- |
+| `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/ReleaseWorkflow.SelfTest.ps1` | exit 0; both execution-modifier bypass fixtures rejected and all release checks passed. |
+| `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/persistence/TrayHostBuild.SelfTest.ps1` | exit 0; six build/provenance cases passed. |
+| `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly` | exit 0; production child-session trace passed 3 cases. |
+
+Fix-round scope was limited to
+`tests/persistence/ReleaseWorkflow.SelfTest.ps1`; no workflow production step,
+TrayHost CLI, wire, authentication, build/provenance implementation, live
+Supervisor, or controlled isolation harness was changed or invoked.
+
+## Full Persistence/Validate isolation boundary
 
 The direct, non-npm aggregate command was attempted once:
 

From 49f88e2bd511a0f98ce93f48967e4cf3a333f93b Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 13:42:25 +0800
Subject: [PATCH 045/187] release: prepare CodexRemote-fix v2.5.22

---
 .github/workflows/release.yml                 |  11 +-
 CHANGELOG.md                                  |  16 +++
 README.md                                     |  17 +--
 README.zh-CN.md                               |  14 +-
 build/TrayHostBuild.psm1                      |  71 +++++++++-
 package.json                                  |   2 +-
 src/portable/AssemblyInfo.cs                  |   4 +-
 src/portable/CodexRemote.Portable.manifest    |   2 +-
 src/trayhost/AssemblyInfo.cs                  |   4 +-
 src/trayhost/CodexRemote.TrayHost.manifest    |   2 +-
 .../persistence/InstallLifecycle.SelfTest.ps1 |   4 +-
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 127 +++++++++++------
 tests/persistence/TrayHostBuild.SelfTest.ps1  | 130 +++++++++++++++---
 tools/New-GitHubReleaseNotes.ps1              |  48 +++++++
 14 files changed, 353 insertions(+), 99 deletions(-)
 create mode 100644 tools/New-GitHubReleaseNotes.ps1

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 16dfd70..deaf09f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -134,17 +134,8 @@ jobs:
             throw "Release tag output is invalid: '$tag'."
           }
           $version = $tag.Substring(1)
-          $changelog = Get-Content -LiteralPath (Join-Path $PWD 'CHANGELOG.md') -Raw -Encoding UTF8
-          $releaseSection = [regex]::Match($changelog, '(?ms)^## ' + [regex]::Escape($tag) + '\r?\n(.*?)(?=^## |\z)')
-          if (-not $releaseSection.Success) {
-            throw "CHANGELOG.md has no release section for $tag"
-          }
-          $englishSection = [regex]::Match($releaseSection.Groups[1].Value, '(?ms)^### English\r?\n(.*?)(?=^### |\z)')
-          if (-not $englishSection.Success) {
-            throw "CHANGELOG.md has no English release section for $tag"
-          }
           $notesPath = Join-Path $env:RUNNER_TEMP ("CodexRemote-fix-$tag-release-notes.md")
-          Set-Content -LiteralPath $notesPath -Value ("# CodexRemote-fix $version`n`n" + $englishSection.Groups[1].Value.Trim() + "`n") -Encoding UTF8
+          & (Join-Path $PWD 'tools\New-GitHubReleaseNotes.ps1') -ChangelogPath (Join-Path $PWD 'CHANGELOG.md') -Tag $tag -OutputPath $notesPath | Out-Null
           & gh release view $tag --repo $env:GITHUB_REPOSITORY --json assets 2>$null | Out-Null
           $exists = $LASTEXITCODE -eq 0
           $existingAssets = @()
diff --git a/CHANGELOG.md b/CHANGELOG.md
index efe008c..78dac76 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,22 @@ This file keeps the release record. GitHub Release bodies are generated from the
 
 No unreleased changes.
 
+## v2.5.22
+
+### English
+
+- Bound Setup activation to the requested version and a hash-verified installer payload manifest, then revalidated the active runtime before reporting Ready.
+- Restricted Setup compilation to one generated, inventoried input and rejected unapproved preprocessor constructs before ISCC runs.
+- Added bounded same-root process-tree rereads while preserving strict root and per-process identity checks during close and remote rebind.
+- Correlated native tray actions with the acknowledged presentation revision and durable, bounded terminal diagnostics; stale actions now produce a sanitized support code.
+
+### 简体中文
+
+- 将 Setup 激活绑定到请求版本和经哈希校验的安装载荷 manifest，并在报告 Ready 前重新校验活动 runtime。
+- Setup 只编译一份已清点目录的生成输入；任何未获准的预处理构造都会在 ISCC 运行前被拒绝。
+- 为同一根进程加入有界 process-tree 重读，同时在关闭和远程重绑定时继续严格校验根进程与每个成员的身份。
+- 将原生托盘操作绑定到已确认的 presentation revision 和持久、有界的终态诊断；过期操作会记录清理后的支持代码。
+
 ## v2.5.21
 
 ### English
diff --git a/README.md b/README.md
index 7728700..254b74a 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@
 </p>
 
 > [!NOTE]
-> **Release status:** v2.5.21 is the current stable release. The setup installer, EXE-based portable ZIP, tray actions, restart-and-repair flow, and persistent remote connection are covered by the release validation gates.
+> **Release status:** v2.5.22 is the current stable release. The setup installer and EXE-based portable ZIP are version- and manifest-bound release assets.
 
 CodexRemote-fix enables the UI that ships with Codex Desktop for Windows but is hidden by a runtime defect:
 
@@ -50,7 +50,7 @@ that existing page and leaves the Codex UI, account authorization, and enrollmen
 ## Quick start
 
 
-1. Download either `CodexRemote-fix-2.5.21-setup.exe` (recommended installer) or `CodexRemote-fix-2.5.21-windows-x64.zip` from [Releases](https://github.com/naipi11/CodexRemote-fix/releases). Download and verify the matching `.sha256.txt` before continuing.
+1. Download either `CodexRemote-fix-2.5.22-setup.exe` (recommended installer) or `CodexRemote-fix-2.5.22-windows-x64.zip` from [Releases](https://github.com/naipi11/CodexRemote-fix/releases). Download and verify the matching `.sha256.txt` before continuing.
 2. If you chose the setup installer, run it and follow the wizard. If you chose the portable ZIP, extract it into a new empty folder and double-click `CodexRemote-fix.exe`.
 
    Both paths validate the payload, run a Microsoft Defender custom scan, and preserve the DPAPI device-key store.
@@ -59,7 +59,8 @@ that existing page and leaves the Codex UI, account authorization, and enrollmen
 The current portable bundle, checksum, release manifest, and payload manifest are always published on the
 [Releases](https://github.com/naipi11/CodexRemote-fix/releases) page.
 
-Before replacing a portable build, use its installed `Uninstall-CodexControlOtherDevices.ps1`; settings and the DPAPI\r\ndevice-key store stay in place.
+Before replacing a portable build, use its installed `Uninstall-CodexControlOtherDevices.ps1`;
+settings and the DPAPI device-key store stay in place.
 
 Verified on Windows 11 · Codex Desktop `26.820.7780.0` · Node.js `22.23.1`:
 the hidden controller tab, restart-and-repair recovery, and persistent remote connection are working.
@@ -85,12 +86,12 @@ The tray reports two independent, truthful status lines instead of inferring rea
 
 ## Releases
 
-Every tagged release ships a Windows setup installer and an EXE-entry portable ZIP, each with its SHA-256 checksum, release manifest, and the shared payload manifest. The `.github/workflows/release.yml` workflow builds both from the tag automatically, so v2.5.21 includes:
+Every tagged release ships a Windows setup installer and an EXE-entry portable ZIP with separate SHA-256 checksums and release manifests. The portable distribution publishes its payload manifest as an asset; Setup embeds and hash-binds its versioned `installer-payload-manifest.json`. For v2.5.22, download:
 
-- `CodexRemote-fix-2.5.21-setup.exe` and its checksum
-- `CodexRemote-fix-2.5.21-windows-x64.zip` and its checksum
-- `CodexRemote-fix-2.5.21-payload-manifest.json`
-- `CodexRemote-fix-2.5.21-release-manifest.json` and `CodexRemote-fix-2.5.21-setup-release-manifest.json`
+- `CodexRemote-fix-2.5.22-setup.exe` and its checksum
+- `CodexRemote-fix-2.5.22-windows-x64.zip` and its checksum
+- `CodexRemote-fix-2.5.22-payload-manifest.json`
+- `CodexRemote-fix-2.5.22-release-manifest.json` and `CodexRemote-fix-2.5.22-setup-release-manifest.json`
 
 Each release appends a short English change summary to the GitHub release body. The bilingual release history is kept in [CHANGELOG.md](CHANGELOG.md).
 
diff --git a/README.zh-CN.md b/README.zh-CN.md
index c8db449..7d2a952 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -16,7 +16,7 @@
 </p>
 
 > [!NOTE]
-> **发布状态：** v2.5.21 是当前稳定版。安装包、以 EXE 启动的便携 ZIP、托盘操作、重启并修复流程和常驻远程连接均纳入发布验证门禁。
+> **发布状态：** v2.5.22 是当前稳定版。安装包与以 EXE 启动的便携 ZIP 都是绑定版本和 manifest 的发布资产。
 
 CodexRemote-fix 在 Windows 版 Codex Desktop 中启用随应用一起打包、但因运行时缺陷被隐藏的：
 
@@ -46,7 +46,7 @@ CodexRemote-fix 在 Windows 版 Codex Desktop 中启用随应用一起打包、
 
 ## 快速开始
 
-1. 从 [Releases](https://github.com/naipi11/CodexRemote-fix/releases) 下载 `CodexRemote-fix-2.5.21-setup.exe`（推荐安装包）或便携 ZIP `CodexRemote-fix-2.5.21-windows-x64.zip`；下载并核对对应的 `.sha256.txt`。
+1. 从 [Releases](https://github.com/naipi11/CodexRemote-fix/releases) 下载 `CodexRemote-fix-2.5.22-setup.exe`（推荐安装包）或便携 ZIP `CodexRemote-fix-2.5.22-windows-x64.zip`；下载并核对对应的 `.sha256.txt`。
 2. 选择安装包时直接运行并跟随向导；选择便携 ZIP 时解压到新空目录，然后双击 `CodexRemote-fix.exe`。
 
    两条路径都会校验载荷、执行 Microsoft Defender 自定义扫描，并保留 DPAPI 设备密钥。
@@ -81,12 +81,12 @@ CodexRemote-fix 在 Windows 版 Codex Desktop 中启用随应用一起打包、
 
 ## 发布（Releases）
 
-每个带 tag 的发布都会附带 Windows 安装包和以 EXE 启动的便携 ZIP，各自带 SHA-256 校验文件、release manifest，并共享 payload manifest。`.github/workflows/release.yml` 会在 tag 上自动构建两者，因此 v2.5.21 提供：
+每个带 tag 的发布都会附带 Windows 安装包和以 EXE 启动的便携 ZIP，并分别提供 SHA-256 校验文件与 release manifest。便携发行版会外发自己的 payload manifest；Setup 则内嵌并以哈希绑定版本化的 `installer-payload-manifest.json`。v2.5.22 提供：
 
-- `CodexRemote-fix-2.5.21-setup.exe` 及其校验文件
-- `CodexRemote-fix-2.5.21-windows-x64.zip` 及其校验文件
-- `CodexRemote-fix-2.5.21-payload-manifest.json`
-- `CodexRemote-fix-2.5.21-release-manifest.json` 和 `CodexRemote-fix-2.5.21-setup-release-manifest.json`
+- `CodexRemote-fix-2.5.22-setup.exe` 及其校验文件
+- `CodexRemote-fix-2.5.22-windows-x64.zip` 及其校验文件
+- `CodexRemote-fix-2.5.22-payload-manifest.json`
+- `CodexRemote-fix-2.5.22-release-manifest.json` 和 `CodexRemote-fix-2.5.22-setup-release-manifest.json`
 
 GitHub Release 正文只发布英文更新说明；本 README 继续保留中英文使用说明。
 完整历史见 [CHANGELOG.md](CHANGELOG.md)。
diff --git a/build/TrayHostBuild.psm1 b/build/TrayHostBuild.psm1
index 7609bfd..9215fb4 100644
--- a/build/TrayHostBuild.psm1
+++ b/build/TrayHostBuild.psm1
@@ -35,6 +35,53 @@ function Test-CcodTrayHostOutputDirectory {
     if([string]::IsNullOrWhiteSpace($full) -or $full -eq [IO.Path]::GetPathRoot($full).TrimEnd('\')){throw 'CCOD_TRAYHOST_OUTPUT_PATH_INVALID'}
 }
 
+function Assert-CcodNativeVersionContract {
+    param(
+        [Parameter(Mandatory)][string]$RepositoryRoot,
+        [Parameter(Mandatory)][string]$Version,
+        [Parameter(Mandatory)][ValidateSet('trayhost','portable')][string]$Component
+    )
+    $definition=if($Component -ceq 'trayhost'){
+        [pscustomobject]@{ManifestName='CodexRemote.TrayHost.manifest';IdentityName='CodexRemote.fix.TrayHost';MissingError='CCOD_TRAYHOST_SOURCE_MISSING';VersionError='CCOD_TRAYHOST_VERSION_MISMATCH'}
+    }else{
+        [pscustomobject]@{ManifestName='CodexRemote.Portable.manifest';IdentityName='CodexRemote.fix.Portable';MissingError='CCOD_PORTABLE_LAUNCHER_SOURCE_MISSING';VersionError='CCOD_PORTABLE_LAUNCHER_VERSION_MISMATCH'}
+    }
+    $repo=[IO.Path]::GetFullPath($RepositoryRoot)
+    $sourceRoot=Join-Path $repo ('src\'+$Component)
+    $packagePath=Join-Path $repo 'package.json'
+    $assemblyInfoPath=Join-Path $sourceRoot 'AssemblyInfo.cs'
+    $manifestPath=Join-Path $sourceRoot $definition.ManifestName
+    foreach($required in @($packagePath,$assemblyInfoPath,$manifestPath)){if(-not(Test-Path -LiteralPath $required -PathType Leaf)){throw $definition.MissingError}}
+    try{
+        $package=Get-Content -LiteralPath $packagePath -Raw|ConvertFrom-Json
+        if([string]$package.version -cne $Version){throw $definition.VersionError}
+        $expectedNativeVersion="$Version.0"
+        $assemblyInfo=[IO.File]::ReadAllText($assemblyInfoPath,[Text.UTF8Encoding]::new($false))
+        $assemblyVersions=@([regex]::Matches($assemblyInfo,'(?m)^\s*\[assembly:\s*AssemblyVersion\("(?<version>[^"]+)"\)\]\s*$'))
+        $fileVersions=@([regex]::Matches($assemblyInfo,'(?m)^\s*\[assembly:\s*AssemblyFileVersion\("(?<version>[^"]+)"\)\]\s*$'))
+        if($assemblyVersions.Count -ne 1 -or $fileVersions.Count -ne 1 -or
+            [string]$assemblyVersions[0].Groups['version'].Value -cne $expectedNativeVersion -or
+            [string]$fileVersions[0].Groups['version'].Value -cne $expectedNativeVersion){throw $definition.VersionError}
+        [xml]$manifest=[IO.File]::ReadAllText($manifestPath,[Text.UTF8Encoding]::new($false))
+        $namespace=[Xml.XmlNamespaceManager]::new($manifest.NameTable)
+        $namespace.AddNamespace('asmv1','urn:schemas-microsoft-com:asm.v1')
+        $identities=@($manifest.SelectNodes('/asmv1:assembly/asmv1:assemblyIdentity',$namespace))
+        if($identities.Count -ne 1 -or [string]$identities[0].version -cne $expectedNativeVersion -or
+            [string]$identities[0].name -cne [string]$definition.IdentityName -or [string]$identities[0].type -cne 'win32'){throw $definition.VersionError}
+        return [pscustomobject][ordered]@{SourceRoot=$sourceRoot;AssemblyInfoPath=$assemblyInfoPath;ManifestPath=$manifestPath;NativeVersion=$expectedNativeVersion}
+    }catch{
+        if(([string]$_.FullyQualifiedErrorId -split ',')[0] -like "$($definition.MissingError)*"){throw}
+        throw $definition.VersionError
+    }
+}
+
+function Assert-CcodNativePeVersion {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$Version,[Parameter(Mandatory)][string]$ErrorId)
+    $expected="$Version.0"
+    try{$versionInfo=[Diagnostics.FileVersionInfo]::GetVersionInfo([IO.Path]::GetFullPath($Path))}catch{throw $ErrorId}
+    if([string]$versionInfo.FileVersion -cne $expected -or [string]$versionInfo.ProductVersion -cne $expected){throw $ErrorId}
+}
+
 function Invoke-CcodTrayHostBuild {
     [CmdletBinding()]
     param(
@@ -46,11 +93,12 @@ function Invoke-CcodTrayHostBuild {
     )
     if($Version -notmatch '^\d+\.\d+\.\d+$'){throw 'CCOD_TRAYHOST_VERSION_INVALID'}
     $repo=[IO.Path]::GetFullPath($RepositoryRoot);$out=[IO.Path]::GetFullPath($OutputDirectory);Test-CcodTrayHostOutputDirectory $out
+    $versionContract=Assert-CcodNativeVersionContract -RepositoryRoot $repo -Version $Version -Component trayhost
     if([string]::IsNullOrWhiteSpace($GitCommit)){$GitCommit=Get-CcodTrayHostGitCommit -RepositoryRoot $repo}else{$GitCommit=$GitCommit.ToLowerInvariant()}
     if($GitCommit -cnotmatch '^[0-9a-f]{40}$'){throw 'CCOD_TRAYHOST_PROVENANCE_INVALID'}
     if([string]::IsNullOrWhiteSpace($BuildTimestampUtc)){$BuildTimestampUtc=[datetime]::UtcNow.ToString('o',[Globalization.CultureInfo]::InvariantCulture)}
     if(-not (Test-CcodTrayHostCanonicalUtc $BuildTimestampUtc)){throw 'CCOD_TRAYHOST_PROVENANCE_INVALID'}
-    $sourceRoot=Join-Path $repo 'src\trayhost';$manifest=Join-Path $sourceRoot 'CodexRemote.TrayHost.manifest';$config=Join-Path $sourceRoot 'CodexRemote.TrayHost.exe.config';$icon=Join-Path $repo 'assets\codexremote-fix\codexremote-fix.ico'
+    $sourceRoot=$versionContract.SourceRoot;$manifest=$versionContract.ManifestPath;$config=Join-Path $sourceRoot 'CodexRemote.TrayHost.exe.config';$icon=Join-Path $repo 'assets\codexremote-fix\codexremote-fix.ico'
     foreach($required in @($manifest,$config,$icon)){if(-not(Test-Path -LiteralPath $required -PathType Leaf)){throw 'CCOD_TRAYHOST_SOURCE_MISSING'}}
     $sources=@(Get-ChildItem -LiteralPath $sourceRoot -Filter '*.cs' -File|Sort-Object Name)
     if($sources.Count -lt 10){throw 'CCOD_TRAYHOST_SOURCE_INCOMPLETE'}
@@ -65,6 +113,7 @@ function Invoke-CcodTrayHostBuild {
         $compilerArgs+=@($sources|ForEach-Object FullName)
         & $compiler @compilerArgs
         if($LASTEXITCODE -ne 0 -or -not(Test-Path -LiteralPath $exe -PathType Leaf)){throw 'CCOD_TRAYHOST_COMPILE_FAILED'}
+        Assert-CcodNativePeVersion -Path $exe -Version $Version -ErrorId 'CCOD_TRAYHOST_ARTIFACT_VERSION_INVALID'
         $configOut=Join-Path $work 'CodexRemote.TrayHost.exe.config';Copy-Item -LiteralPath $config -Destination $configOut -Force
         $stdoutPath=Join-Path $work 'stdout.txt';$stderrPath=Join-Path $work 'stderr.txt'
         $smoke=Start-Process -FilePath $exe -ArgumentList '--headless-smoke' -Wait -PassThru -WindowStyle Hidden -RedirectStandardOutput $stdoutPath -RedirectStandardError $stderrPath
@@ -83,15 +132,23 @@ function Invoke-CcodTrayHostBuild {
 function Test-CcodTrayHostArtifact {
     [CmdletBinding()]
     param([Parameter(Mandatory)][string]$RepositoryRoot,[Parameter(Mandatory)][string]$Version,[Parameter(Mandatory)][string]$ArtifactDirectory,[string]$ExpectedGitCommit)
+    if($Version -notmatch '^\d+\.\d+\.\d+$'){throw 'CCOD_TRAYHOST_VERSION_INVALID'}
     $repo=[IO.Path]::GetFullPath($RepositoryRoot);$out=[IO.Path]::GetFullPath($ArtifactDirectory);Test-CcodTrayHostOutputDirectory $out
+    $versionContract=Assert-CcodNativeVersionContract -RepositoryRoot $repo -Version $Version -Component trayhost
     $exe=Join-Path $out 'CodexRemote.TrayHost.exe';$config=Join-Path $out 'CodexRemote.TrayHost.exe.config';$provenancePath=Join-Path $out 'trayhost-build-provenance.json'
     foreach($path in @($exe,$config,$provenancePath)){if(-not(Test-Path -LiteralPath $path -PathType Leaf)){throw 'CCOD_TRAYHOST_ARTIFACT_MISSING'}}
     $provenance=Get-Content -LiteralPath $provenancePath -Raw|ConvertFrom-Json
     $commit=$provenance.PSObject.Properties['gitCommit'];$timestamp=$provenance.PSObject.Properties['buildTimestampUtc']
     if([int]$provenance.schemaVersion -ne 1 -or [string]$provenance.version -cne $Version -or [string]$provenance.targetFramework -cne 'net48' -or $null -eq $commit -or $null -eq $timestamp -or $commit.Value -isnot [string] -or $commit.Value -cnotmatch '^[0-9a-f]{40}$' -or $timestamp.Value -isnot [string] -or -not(Test-CcodTrayHostCanonicalUtc $timestamp.Value) -or (-not [string]::IsNullOrWhiteSpace($ExpectedGitCommit) -and $commit.Value -cne $ExpectedGitCommit)){throw 'CCOD_TRAYHOST_PROVENANCE_INVALID'}
-    $icon=Join-Path $repo 'assets\codexremote-fix\codexremote-fix.ico'
-    if([string]$provenance.artifactSha256 -cne (Get-CcodTrayHostHash $exe) -or [string]$provenance.configArtifactSha256 -cne (Get-CcodTrayHostHash $config) -or [string]$provenance.iconSha256 -cne (Get-CcodTrayHostHash $icon)){throw 'CCOD_TRAYHOST_ARTIFACT_TAMPERED'}
-    $sourceRoot=Join-Path $repo 'src\trayhost'
+    $icon=Join-Path $repo 'assets\codexremote-fix\codexremote-fix.ico';$sourceConfig=Join-Path $versionContract.SourceRoot 'CodexRemote.TrayHost.exe.config'
+    foreach($required in @($icon,$sourceConfig)){if(-not(Test-Path -LiteralPath $required -PathType Leaf)){throw 'CCOD_TRAYHOST_SOURCE_MISSING'}}
+    if([string]$provenance.artifactSha256 -cne (Get-CcodTrayHostHash $exe) -or
+        [string]$provenance.configArtifactSha256 -cne (Get-CcodTrayHostHash $config) -or
+        [string]$provenance.iconSha256 -cne (Get-CcodTrayHostHash $icon) -or
+        [string]$provenance.manifestSha256 -cne (Get-CcodTrayHostHash $versionContract.ManifestPath) -or
+        [string]$provenance.configSha256 -cne (Get-CcodTrayHostHash $sourceConfig)){throw 'CCOD_TRAYHOST_ARTIFACT_TAMPERED'}
+    Assert-CcodNativePeVersion -Path $exe -Version $Version -ErrorId 'CCOD_TRAYHOST_ARTIFACT_VERSION_INVALID'
+    $sourceRoot=$versionContract.SourceRoot
     $currentSources=@(Get-ChildItem -LiteralPath $sourceRoot -Filter '*.cs' -File|Sort-Object Name)
     $sourceFilesProperty=$provenance.PSObject.Properties['sourceFiles']
     $sourceRecords=if($null -eq $sourceFilesProperty){@()}else{@($sourceFilesProperty.Value)}
@@ -121,12 +178,13 @@ function Invoke-CcodPortableLauncherBuild {
     )
     if($Version -notmatch '^\d+\.\d+\.\d+$'){throw 'CCOD_PORTABLE_LAUNCHER_VERSION_INVALID'}
     $repo=[IO.Path]::GetFullPath($RepositoryRoot);$out=[IO.Path]::GetFullPath($OutputDirectory);Test-CcodTrayHostOutputDirectory $out
+    $versionContract=Assert-CcodNativeVersionContract -RepositoryRoot $repo -Version $Version -Component portable
     if([string]::IsNullOrWhiteSpace($GitCommit)){$GitCommit=Get-CcodTrayHostGitCommit -RepositoryRoot $repo}else{$GitCommit=$GitCommit.ToLowerInvariant()}
     if($GitCommit -cnotmatch '^[0-9a-f]{40}$'){throw 'CCOD_PORTABLE_LAUNCHER_PROVENANCE_INVALID'}
     if([string]::IsNullOrWhiteSpace($BuildTimestampUtc)){$BuildTimestampUtc=[datetime]::UtcNow.ToString('o',[Globalization.CultureInfo]::InvariantCulture)}
     if(-not (Test-CcodTrayHostCanonicalUtc $BuildTimestampUtc)){throw 'CCOD_PORTABLE_LAUNCHER_PROVENANCE_INVALID'}
-    $sourceRoot=Join-Path $repo 'src\portable';$launcher=Join-Path $sourceRoot 'PortableLauncher.cs';$assemblyInfo=Join-Path $sourceRoot 'AssemblyInfo.cs';
-    $manifest=Join-Path $sourceRoot 'CodexRemote.Portable.manifest';$config=Join-Path $sourceRoot 'CodexRemote.Portable.exe.config';
+    $sourceRoot=$versionContract.SourceRoot;$launcher=Join-Path $sourceRoot 'PortableLauncher.cs';$assemblyInfo=$versionContract.AssemblyInfoPath;
+    $manifest=$versionContract.ManifestPath;$config=Join-Path $sourceRoot 'CodexRemote.Portable.exe.config';
     $icon=Join-Path $repo 'assets\codexremote-fix\codexremote-fix.ico'
     foreach($required in @($launcher,$assemblyInfo,$manifest,$config,$icon)){if(-not(Test-Path -LiteralPath $required -PathType Leaf)){throw 'CCOD_PORTABLE_LAUNCHER_SOURCE_MISSING'}}
     Import-Module (Join-Path $repo 'build\TrayHostReferencePack.psm1') -Force
@@ -139,6 +197,7 @@ function Invoke-CcodPortableLauncherBuild {
         $compilerArgs+=@($launcher,$assemblyInfo)
         & $compiler @compilerArgs
         if($LASTEXITCODE -ne 0 -or -not(Test-Path -LiteralPath $exe -PathType Leaf)){throw 'CCOD_PORTABLE_LAUNCHER_COMPILE_FAILED'}
+        Assert-CcodNativePeVersion -Path $exe -Version $Version -ErrorId 'CCOD_PORTABLE_LAUNCHER_ARTIFACT_VERSION_INVALID'
         $configOut=Join-Path $work 'CodexRemote.Portable.exe.config';Copy-Item -LiteralPath $config -Destination $configOut -Force
         $provenance=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$Version;gitCommit=$GitCommit;buildTimestampUtc=$BuildTimestampUtc;targetFramework='net48';compiler=[ordered]@{name='csc.exe';sha256=(Get-CcodTrayHostHash $compiler)};referenceRoot='locked-net48';sourceFiles=@([ordered]@{name='PortableLauncher.cs';sha256=(Get-CcodTrayHostHash $launcher)},[ordered]@{name='AssemblyInfo.cs';sha256=(Get-CcodTrayHostHash $assemblyInfo)});iconSha256=(Get-CcodTrayHostHash $icon);manifestSha256=(Get-CcodTrayHostHash $manifest);configSha256=(Get-CcodTrayHostHash $config);artifactSha256=(Get-CcodTrayHostHash $exe);configArtifactSha256=(Get-CcodTrayHostHash $configOut)}
         $provenancePath=Join-Path $work 'portable-launcher-provenance.json';$provenance|ConvertTo-Json -Depth 8|Set-Content -LiteralPath $provenancePath -Encoding UTF8
diff --git a/package.json b/package.json
index 6edd7f3..cc8df14 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "codexremote-fix",
-  "version": "2.5.21",
+  "version": "2.5.22",
   "private": true,
   "description": "CodexRemote-fix persistent current-user tray supervisor for Windows",
   "license": "MIT",
diff --git a/src/portable/AssemblyInfo.cs b/src/portable/AssemblyInfo.cs
index 79463e3..06383d5 100644
--- a/src/portable/AssemblyInfo.cs
+++ b/src/portable/AssemblyInfo.cs
@@ -5,6 +5,6 @@
 [assembly: AssemblyDescription("EXE launcher for the verified CodexRemote-fix portable bundle")]
 [assembly: AssemblyCompany("CodexRemote-fix contributors")]
 [assembly: AssemblyProduct("CodexRemote-fix")]
-[assembly: AssemblyVersion("2.5.21.0")]
-[assembly: AssemblyFileVersion("2.5.21.0")]
+[assembly: AssemblyVersion("2.5.22.0")]
+[assembly: AssemblyFileVersion("2.5.22.0")]
 [assembly: ComVisible(false)]
diff --git a/src/portable/CodexRemote.Portable.manifest b/src/portable/CodexRemote.Portable.manifest
index f97d0fb..915a9e1 100644
--- a/src/portable/CodexRemote.Portable.manifest
+++ b/src/portable/CodexRemote.Portable.manifest
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
-  <assemblyIdentity version="2.5.21.0" name="CodexRemote.fix.Portable" type="win32" />
+  <assemblyIdentity version="2.5.22.0" name="CodexRemote.fix.Portable" type="win32" />
   <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
     <security>
       <requestedPrivileges>
diff --git a/src/trayhost/AssemblyInfo.cs b/src/trayhost/AssemblyInfo.cs
index 9055236..8bfb17a 100644
--- a/src/trayhost/AssemblyInfo.cs
+++ b/src/trayhost/AssemblyInfo.cs
@@ -5,6 +5,6 @@
 [assembly: AssemblyDescription("Persistent native tray host for CodexRemote-fix")]
 [assembly: AssemblyCompany("CodexRemote-fix contributors")]
 [assembly: AssemblyProduct("CodexRemote-fix")]
-[assembly: AssemblyVersion("2.5.21.0")]
-[assembly: AssemblyFileVersion("2.5.21.0")]
+[assembly: AssemblyVersion("2.5.22.0")]
+[assembly: AssemblyFileVersion("2.5.22.0")]
 [assembly: ComVisible(false)]
diff --git a/src/trayhost/CodexRemote.TrayHost.manifest b/src/trayhost/CodexRemote.TrayHost.manifest
index 34dea1e..1e54293 100644
--- a/src/trayhost/CodexRemote.TrayHost.manifest
+++ b/src/trayhost/CodexRemote.TrayHost.manifest
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
-  <assemblyIdentity version="2.5.21.0" name="CodexRemote.fix.TrayHost" type="win32" />
+  <assemblyIdentity version="2.5.22.0" name="CodexRemote.fix.TrayHost" type="win32" />
   <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
     <security>
       <requestedPrivileges>
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index 3f3013a..a7e7c94 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -2585,9 +2585,9 @@ $results += Invoke-CcodTest 'installer exposes CodexRemote-fix as the searchable
     Assert-CcodTrue ($buildScript -cmatch '\$bundle\.sha256\.txt') 'build script writes a hash beside the public portable ZIP filename'
 }
 
-$results += Invoke-CcodTest 'portable builder publishes the exact CodexRemote-fix 2.5.21 release artifact contract' {
+$results += Invoke-CcodTest 'portable builder publishes the exact CodexRemote-fix 2.5.22 release artifact contract' {
     $package = Get-Content -LiteralPath (Join-Path $repositoryRoot 'package.json') -Raw | ConvertFrom-Json
-    Assert-CcodEqual '2.5.21' ([string]$package.version) 'package version is exactly 2.5.21'
+    Assert-CcodEqual '2.5.22' ([string]$package.version) 'package version is exactly 2.5.22'
 
     $buildScript = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\build.ps1') -Raw
     Assert-CcodTrue ($buildScript -cmatch 'CodexRemote-fix-\$Version-windows-x64\.zip') 'portable build resolves the exact public ZIP filename'
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index fed9492..9394583 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -1494,34 +1494,15 @@ Invoke-CcodTest 'TrayHost artifact validation requires the exact compiled source
     Import-Module (Join-Path $repositoryRoot 'build\TrayHostBuild.psm1') -Force
     $artifact = Join-Path ([IO.Path]::GetTempPath()) ('ccod-trayhost-provenance-fixture-' + [guid]::NewGuid().ToString('N'))
     try {
-        [IO.Directory]::CreateDirectory($artifact) | Out-Null
-        $executable = Join-Path $artifact 'CodexRemote.TrayHost.exe'
-        $config = Join-Path $artifact 'CodexRemote.TrayHost.exe.config'
+        $commit = 'c' * 40
+        Invoke-CcodTrayHostBuild -RepositoryRoot $repositoryRoot -Version '2.5.22' -OutputDirectory $artifact -GitCommit $commit -BuildTimestampUtc '2026-08-28T00:00:00.0000000Z' | Out-Null
         $provenancePath = Join-Path $artifact 'trayhost-build-provenance.json'
-        [IO.File]::WriteAllBytes($executable, [byte[]](7, 5, 2, 2, 1))
-        [IO.File]::WriteAllText($config, '<configuration/>', [Text.UTF8Encoding]::new($false))
-        $sourceRoot = Join-Path $repositoryRoot 'src\trayhost'
-        $sourceRecords = @(Get-ChildItem -LiteralPath $sourceRoot -Filter '*.cs' -File | Sort-Object Name | ForEach-Object {
-            [ordered]@{ name = $_.Name; sha256 = Get-CcodTestFileSha256 -Path $_.FullName }
-        })
+        $baselineJson = [IO.File]::ReadAllText($provenancePath,[Text.UTF8Encoding]::new($false))
+        $baseline = $baselineJson | ConvertFrom-Json
+        $sourceRecords = @($baseline.sourceFiles)
         Assert-CcodTrue (@($sourceRecords.name) -ccontains 'TrayHostChildSession.cs') 'release provenance fixture includes the shared production child session'
         Assert-CcodTrue (@($sourceRecords.name) -ccontains 'WindowsTrayHostRuntime.cs') 'release provenance fixture includes the production Windows runtime adapter'
-        $commit = 'c' * 40
-        $baseline = [ordered]@{
-            schemaVersion = 1
-            product = 'CodexRemote-fix'
-            version = '2.5.21'
-            gitCommit = $commit
-            buildTimestampUtc = '2026-08-28T00:00:00.0000000Z'
-            targetFramework = 'net48'
-            sourceFiles = $sourceRecords
-            iconSha256 = Get-CcodTestFileSha256 -Path (Join-Path $repositoryRoot 'assets\codexremote-fix\codexremote-fix.ico')
-            artifactSha256 = Get-CcodTestFileSha256 -Path $executable
-            configArtifactSha256 = Get-CcodTestFileSha256 -Path $config
-        }
-        $baselineJson = $baseline | ConvertTo-Json -Depth 8
-        [IO.File]::WriteAllText($provenancePath, $baselineJson, [Text.UTF8Encoding]::new($false))
-        Test-CcodTrayHostArtifact -RepositoryRoot $repositoryRoot -Version '2.5.21' -ArtifactDirectory $artifact -ExpectedGitCommit $commit | Out-Null
+        Test-CcodTrayHostArtifact -RepositoryRoot $repositoryRoot -Version '2.5.22' -ArtifactDirectory $artifact -ExpectedGitCommit $commit | Out-Null
         $mutations = @(
             [pscustomobject]@{ Name = 'missing shared child session'; Apply = { param($record) $record.sourceFiles = @($record.sourceFiles | Where-Object { $_.name -cne 'TrayHostChildSession.cs' }) } },
             [pscustomobject]@{ Name = 'duplicate shared child session'; Apply = { param($record) $child = @($record.sourceFiles | Where-Object { $_.name -ceq 'TrayHostChildSession.cs' })[0]; $record.sourceFiles = @($record.sourceFiles | Where-Object { $_.name -cne 'WindowsTrayHostRuntime.cs' }) + @([pscustomobject]@{ name = $child.name; sha256 = $child.sha256 }) } },
@@ -1534,7 +1515,7 @@ Invoke-CcodTest 'TrayHost artifact validation requires the exact compiled source
             & $applyMutation $mutated
             [IO.File]::WriteAllText($provenancePath, ($mutated | ConvertTo-Json -Depth 8), [Text.UTF8Encoding]::new($false))
             Assert-CcodThrows {
-                Test-CcodTrayHostArtifact -RepositoryRoot $repositoryRoot -Version '2.5.21' -ArtifactDirectory $artifact -ExpectedGitCommit $commit | Out-Null
+                Test-CcodTrayHostArtifact -RepositoryRoot $repositoryRoot -Version '2.5.22' -ArtifactDirectory $artifact -ExpectedGitCommit $commit | Out-Null
             } 'CCOD_TRAYHOST_SOURCE_TAMPERED'
         }
     } finally {
@@ -1718,6 +1699,7 @@ Invoke-CcodTest 'package scripts build provenance and workflows retain the relea
     Assert-CcodTrue ($release -match 'download-artifact') 'release promotion downloads a previously built candidate'
     Assert-CcodTrue ($release -match 'test:release-contract') 'release promotion checks the release contract'
     Assert-CcodTrue ($release -match 'release-manifest') 'release promotion uploads the bound release manifest'
+    Assert-CcodTrue ($release -match 'New-GitHubReleaseNotes\.ps1') 'release publication uses the behavior-tested English notes extractor'
     Assert-CcodTrue ($release -match 'gh release download') 'existing release assets are downloaded before any publication decision'
     Assert-CcodTrue (-not ($release -match 'gh release upload[^\r\n]*--clobber')) 'release publication never overwrites an existing asset'
     Assert-CcodTrue ($release -match 'Read back published GitHub release assets') 'release publication re-downloads every uploaded asset for hash read-back'
@@ -1726,31 +1708,96 @@ Invoke-CcodTest 'package scripts build provenance and workflows retain the relea
 }
 
 $iss = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw; Assert-CcodTrue ($iss -match 'PortableArtifactDirectory' -and $iss -match 'CodexRemote.Portable.exe' -and $iss -match 'portable-launcher-provenance.json') 'Inno installer packages the portable launcher into the verified bin set';
-Invoke-CcodTest '2.5.21 documentation matches the stable portable release, Defender gate, and protected uninstall contract' {
+Invoke-CcodTest 'release notes extraction emits only the target release English section' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-release-notes-fixture-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $changelogPath = Join-Path $root 'CHANGELOG.md'
+        $notesPath = Join-Path $root 'notes.md'
+        $fixture = @'
+# Fixture release notes
+
+## Unreleased
+
+### English
+
+- UNRELEASED_DECOY
+
+## v2.5.23
+
+### English
+
+- NEWER_DECOY
+
+## v2.5.22
+
+### English
+
+- Target English note.
+- Second target English note.
+
+### 简体中文
+
+- CHINESE_DECOY
+
+## v2.5.21
+
+### English
+
+- OLDER_DECOY
+'@
+        [IO.File]::WriteAllText($changelogPath,$fixture.Replace("`n","`r`n"),[Text.UTF8Encoding]::new($false))
+        & (Join-Path $repositoryRoot 'tools\New-GitHubReleaseNotes.ps1') -ChangelogPath $changelogPath -Tag 'v2.5.22' -OutputPath $notesPath | Out-Null
+        $actual = [IO.File]::ReadAllText($notesPath,[Text.UTF8Encoding]::new($false))
+        Assert-CcodEqual "# CodexRemote-fix 2.5.22`n`n- Target English note.`n- Second target English note.`n" $actual 'release body contains exactly the current target English notes'
+        foreach ($decoy in @('UNRELEASED_DECOY','NEWER_DECOY','CHINESE_DECOY','OLDER_DECOY')) {
+            Assert-CcodTrue (-not $actual.Contains($decoy)) "release body excludes $decoy"
+        }
+    } finally {
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+Invoke-CcodTest '2.5.22 source metadata and documentation match the release contract' {
     $package = Get-Content -LiteralPath (Join-Path $repositoryRoot 'package.json') -Raw | ConvertFrom-Json
-    Assert-CcodEqual '2.5.21' ([string]$package.version) 'package metadata is the 2.5.21 release'
+    Assert-CcodEqual '2.5.22' ([string]$package.version) 'package metadata is the 2.5.22 release'
+    foreach ($nativeComponent in @('trayhost','portable')) {
+        $assemblyInfo = Get-Content -LiteralPath (Join-Path $repositoryRoot ("src\{0}\AssemblyInfo.cs" -f $nativeComponent)) -Raw
+        Assert-CcodTrue ($assemblyInfo -cmatch 'AssemblyVersion\("2\.5\.22\.0"\)') "$nativeComponent assembly version is 2.5.22.0"
+        Assert-CcodTrue ($assemblyInfo -cmatch 'AssemblyFileVersion\("2\.5\.22\.0"\)') "$nativeComponent file version is 2.5.22.0"
+    }
+    $trayHostManifest = Get-Content -LiteralPath (Join-Path $repositoryRoot 'src\trayhost\CodexRemote.TrayHost.manifest') -Raw
+    Assert-CcodTrue ($trayHostManifest -cmatch '<assemblyIdentity version="2\.5\.22\.0" name="CodexRemote\.fix\.TrayHost"') 'TrayHost embedded manifest identity is 2.5.22.0'
+    $portableManifest = Get-Content -LiteralPath (Join-Path $repositoryRoot 'src\portable\CodexRemote.Portable.manifest') -Raw
+    Assert-CcodTrue ($portableManifest -cmatch '<assemblyIdentity version="2\.5\.22\.0" name="CodexRemote\.fix\.Portable"') 'portable embedded manifest identity is 2.5.22.0'
     $changelog = Get-Content -LiteralPath (Join-Path $repositoryRoot 'CHANGELOG.md') -Raw
-    $releaseSection = [regex]::Match($changelog, '(?ms)^## v2\.5\.21\s*\r?\n(?<body>.*?)(?=^## |\z)')
-    Assert-CcodTrue $releaseSection.Success 'v2.5.21 release section exists'
-    Assert-CcodTrue ($releaseSection.Groups['body'].Value -match '(?m)^### English\s*$') 'v2.5.21 changelog has concise English release notes'
-    Assert-CcodTrue ($releaseSection.Groups['body'].Value.Contains('stale-status recovery')) 'v2.5.21 changelog records stale-status repair'
-    Assert-CcodTrue ($releaseSection.Groups['body'].Value.Contains('safe lifecycle diagnostics')) 'v2.5.21 changelog records exact safe diagnostics'
-    Assert-CcodTrue (-not $releaseSection.Groups['body'].Value.Contains('installed Supervisor and TrayHost lifecycle evidence')) 'v2.5.21 changelog omits the unsupported Supervisor and TrayHost validation claim'
+    $releaseSection = [regex]::Match($changelog, '(?ms)^## v2\.5\.22\s*\r?\n(?<body>.*?)(?=^## |\z)')
+    Assert-CcodTrue $releaseSection.Success 'v2.5.22 release section exists'
+    Assert-CcodTrue ($releaseSection.Groups['body'].Value -match '(?m)^### English\s*$') 'v2.5.22 changelog has concise English release notes'
+    $englishSection = [regex]::Match($releaseSection.Groups['body'].Value,'(?ms)^### English\s*\r?\n(?<body>.*?)(?=^### |\z)')
+    $englishBullets = @($englishSection.Groups['body'].Value -split '\r?\n' | Where-Object { $_ -cmatch '^- ' })
+    Assert-CcodTrue ($englishSection.Success -and $englishBullets.Count -ge 3 -and $englishBullets.Count -le 5) 'v2.5.22 English release notes contain three to five bullets'
     $readme = Get-Content -LiteralPath (Join-Path $repositoryRoot 'README.md') -Raw
     $quickStart = [regex]::Match($readme, '(?ms)^## Quick start\s*\r?\n(?<body>.*?)(?=^## |\z)').Groups['body'].Value
-    Assert-CcodTrue ($readme.Contains('v2.5.21 is the current stable release')) 'English README marks v2.5.21 stable without a version-by-version What''s new block'
+    Assert-CcodTrue ($readme.Contains('v2.5.22 is the current stable release')) 'English README marks v2.5.22 stable without a version-by-version What''s new block'
     Assert-CcodTrue (-not $readme.Contains("## What's new")) 'English README keeps release details off the home page'
-    Assert-CcodTrue ($quickStart.Contains('CodexRemote-fix-2.5.21-setup.exe')) 'English Quick Start names the setup installer'
-    Assert-CcodTrue ($quickStart.Contains('CodexRemote-fix-2.5.21-windows-x64.zip')) 'English Quick Start names the portable ZIP'
+    Assert-CcodTrue ($quickStart.Contains('CodexRemote-fix-2.5.22-setup.exe')) 'English Quick Start names the setup installer'
+    Assert-CcodTrue ($quickStart.Contains('CodexRemote-fix-2.5.22-windows-x64.zip')) 'English Quick Start names the portable ZIP'
     Assert-CcodTrue ($quickStart.Contains('CodexRemote-fix.exe')) 'English Quick Start names the portable double-click entrypoint'
     Assert-CcodTrue ($quickStart.Contains('Microsoft Defender')) 'English Quick Start documents the local Defender gate'
+    Assert-CcodTrue (-not $readme.Contains('\r\n')) 'English README contains no literal CRLF escape text'
+    Assert-CcodTrue ($readme.Contains('The portable distribution publishes its payload manifest as an asset')) 'English README identifies the externally published portable payload manifest'
+    Assert-CcodTrue ($readme.Contains('Setup embeds and hash-binds its versioned `installer-payload-manifest.json`')) 'English README identifies the embedded hash-bound setup payload manifest'
+    Assert-CcodTrue (-not $readme.Contains('shared payload manifest')) 'English README does not claim setup and portable share one payload manifest'
     $readmeZh = Get-Content -LiteralPath (Join-Path $repositoryRoot 'README.zh-CN.md') -Raw -Encoding UTF8
-    Assert-CcodTrue ($readmeZh -match 'v2\.5\.21 \u662F\u5F53\u524D\u7A33\u5B9A\u7248') 'Chinese README marks v2.5.21 stable'
+    Assert-CcodTrue ($readmeZh -match 'v2\.5\.22 \u662F\u5F53\u524D\u7A33\u5B9A\u7248') 'Chinese README marks v2.5.22 stable'
     Assert-CcodTrue (-not $readmeZh.Contains("## What's new")) 'Chinese README keeps release details off the home page'
-    Assert-CcodTrue ($readmeZh.Contains('CodexRemote-fix-2.5.21-setup.exe')) 'Chinese Quick Start names the setup installer'
-    Assert-CcodTrue ($readmeZh.Contains('CodexRemote-fix-2.5.21-windows-x64.zip')) 'Chinese Quick Start names the portable ZIP'
+    Assert-CcodTrue ($readmeZh.Contains('CodexRemote-fix-2.5.22-setup.exe')) 'Chinese Quick Start names the setup installer'
+    Assert-CcodTrue ($readmeZh.Contains('CodexRemote-fix-2.5.22-windows-x64.zip')) 'Chinese Quick Start names the portable ZIP'
     Assert-CcodTrue ($readmeZh.Contains('CodexRemote-fix.exe')) 'Chinese Quick Start names the portable double-click entrypoint'
     Assert-CcodTrue ($readmeZh.Contains('Microsoft Defender')) 'Chinese Quick Start documents the local Defender gate'
+    Assert-CcodTrue ($readmeZh -match '\u4FBF\u643A\u53D1\u884C\u7248\u4F1A\u5916\u53D1\u81EA\u5DF1\u7684 payload manifest') 'Chinese README identifies the externally published portable payload manifest'
+    Assert-CcodTrue ($readmeZh -match 'Setup \u5219\u5185\u5D4C\u5E76\u4EE5\u54C8\u5E0C\u7ED1\u5B9A\u7248\u672C\u5316\u7684 `installer-payload-manifest\.json`') 'Chinese README identifies the embedded hash-bound setup payload manifest'
     $technical = Get-Content -LiteralPath (Join-Path $repositoryRoot 'docs\TECHNICAL.md') -Raw
     Assert-CcodTrue ($technical.Contains('PortableUninstallFinalizer.ps1')) 'technical documentation records the staged portable finalizer'
     $security = Get-Content -LiteralPath (Join-Path $repositoryRoot 'SECURITY.md') -Raw
diff --git a/tests/persistence/TrayHostBuild.SelfTest.ps1 b/tests/persistence/TrayHostBuild.SelfTest.ps1
index ad74661..d78ed82 100644
--- a/tests/persistence/TrayHostBuild.SelfTest.ps1
+++ b/tests/persistence/TrayHostBuild.SelfTest.ps1
@@ -4,19 +4,111 @@ $ErrorActionPreference='Stop'
 $repositoryRoot=Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
 $lockPath=Join-Path $repositoryRoot 'build\trayhost-packages.lock.json'
 
-Invoke-CcodTest '2.5.21 source metadata binds the package and native assembly identities' {
+Invoke-CcodTest 'TrayHost artifact validation binds the manifest and embedded PE version to the requested release' {
+    Import-Module (Join-Path $repositoryRoot 'build\TrayHostBuild.psm1') -Force
+    $package = Get-Content -LiteralPath (Join-Path $repositoryRoot 'package.json') -Raw | ConvertFrom-Json
+    $version = [string]$package.version
+    $nativeVersion = "$version.0"
+    $artifact = Join-Path $env:TEMP ('ccod-native-version-artifact-' + [Guid]::NewGuid().ToString('N'))
+    $fixtureRoot = Join-Path $env:TEMP ('ccod-native-version-repository-' + [Guid]::NewGuid().ToString('N'))
+    try {
+        Invoke-CcodTrayHostBuild -RepositoryRoot $repositoryRoot -Version $version -OutputDirectory $artifact -GitCommit ('b' * 40) -BuildTimestampUtc '2026-08-28T00:00:00.0000000Z' | Out-Null
+        [IO.Directory]::CreateDirectory((Join-Path $fixtureRoot 'src')) | Out-Null
+        Copy-Item -LiteralPath (Join-Path $repositoryRoot 'src\trayhost') -Destination (Join-Path $fixtureRoot 'src\trayhost') -Recurse
+        [IO.Directory]::CreateDirectory((Join-Path $fixtureRoot 'assets\codexremote-fix')) | Out-Null
+        Copy-Item -LiteralPath (Join-Path $repositoryRoot 'assets\codexremote-fix\codexremote-fix.ico') -Destination (Join-Path $fixtureRoot 'assets\codexremote-fix\codexremote-fix.ico')
+        Copy-Item -LiteralPath (Join-Path $repositoryRoot 'package.json') -Destination (Join-Path $fixtureRoot 'package.json')
+
+        $manifestPath = Join-Path $fixtureRoot 'src\trayhost\CodexRemote.TrayHost.manifest'
+        $manifestBaseline = [IO.File]::ReadAllText($manifestPath,[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($manifestPath,$manifestBaseline.Replace('</assembly>','<!-- byte mutation with unchanged identity --></assembly>'),[Text.UTF8Encoding]::new($false))
+        $manifestHashError = ''
+        try { Test-CcodTrayHostArtifact -RepositoryRoot $fixtureRoot -Version $version -ArtifactDirectory $artifact -ExpectedGitCommit ('b' * 40) | Out-Null }
+        catch { $manifestHashError = ([string]$_.FullyQualifiedErrorId -split ',')[0] }
+
+        [IO.File]::WriteAllText($manifestPath,$manifestBaseline.Replace($nativeVersion,'9.9.9.0'),[Text.UTF8Encoding]::new($false))
+        $manifestError = ''
+        try { Test-CcodTrayHostArtifact -RepositoryRoot $fixtureRoot -Version $version -ArtifactDirectory $artifact -ExpectedGitCommit ('b' * 40) | Out-Null }
+        catch { $manifestError = ([string]$_.FullyQualifiedErrorId -split ',')[0] }
+
+        [IO.File]::WriteAllText($manifestPath,$manifestBaseline.Replace($nativeVersion,'9.9.9.0'),[Text.UTF8Encoding]::new($false))
+        $assemblyPath = Join-Path $fixtureRoot 'src\trayhost\AssemblyInfo.cs'
+        $assembly = [IO.File]::ReadAllText($assemblyPath,[Text.UTF8Encoding]::new($false)).Replace($nativeVersion,'9.9.9.0')
+        [IO.File]::WriteAllText($assemblyPath,$assembly,[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText((Join-Path $fixtureRoot 'package.json'),'{"version":"9.9.9"}',[Text.UTF8Encoding]::new($false))
+        $provenancePath = Join-Path $artifact 'trayhost-build-provenance.json'
+        $provenance = Get-Content -LiteralPath $provenancePath -Raw | ConvertFrom-Json
+        $provenance.version = '9.9.9'
+        $assemblyRecord = @($provenance.sourceFiles | Where-Object { $_.name -ceq 'AssemblyInfo.cs' })[0]
+        $assemblyRecord.sha256 = Get-CcodTestFileSha256 -Path $assemblyPath
+        $provenance.manifestSha256 = Get-CcodTestFileSha256 -Path $manifestPath
+        [IO.File]::WriteAllText($provenancePath,($provenance | ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+        $peError = ''
+        try { Test-CcodTrayHostArtifact -RepositoryRoot $fixtureRoot -Version '9.9.9' -ArtifactDirectory $artifact -ExpectedGitCommit ('b' * 40) | Out-Null }
+        catch { $peError = ([string]$_.FullyQualifiedErrorId -split ',')[0] }
+
+        Assert-CcodEqual 'CCOD_TRAYHOST_ARTIFACT_TAMPERED|CCOD_TRAYHOST_VERSION_MISMATCH|CCOD_TRAYHOST_ARTIFACT_VERSION_INVALID' "$manifestHashError|$manifestError|$peError" 'validator binds manifest bytes and rejects static or PE version drift'
+    } finally {
+        if (Test-Path -LiteralPath $artifact) { Remove-Item -LiteralPath $artifact -Recurse -Force -ErrorAction SilentlyContinue }
+        if (Test-Path -LiteralPath $fixtureRoot) { Remove-Item -LiteralPath $fixtureRoot -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+Invoke-CcodTest 'native build entrypoints reject mismatched package AssemblyInfo and manifest versions before compilation' {
+    Import-Module (Join-Path $repositoryRoot 'build\TrayHostBuild.psm1') -Force
+    $root = Join-Path $env:TEMP ('ccod-native-version-contract-' + [Guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $cases = @(
+            [pscustomobject]@{ Component='trayhost'; PackageVersion='9.9.9'; AssemblyVersion='2.5.22.0'; FileVersion='2.5.22.0'; ManifestVersion='2.5.22.0'; ExpectedError='CCOD_TRAYHOST_VERSION_MISMATCH' },
+            [pscustomobject]@{ Component='trayhost'; PackageVersion='2.5.22'; AssemblyVersion='9.9.9.0'; FileVersion='2.5.22.0'; ManifestVersion='2.5.22.0'; ExpectedError='CCOD_TRAYHOST_VERSION_MISMATCH' },
+            [pscustomobject]@{ Component='trayhost'; PackageVersion='2.5.22'; AssemblyVersion='2.5.22.0'; FileVersion='9.9.9.0'; ManifestVersion='2.5.22.0'; ExpectedError='CCOD_TRAYHOST_VERSION_MISMATCH' },
+            [pscustomobject]@{ Component='trayhost'; PackageVersion='2.5.22'; AssemblyVersion='2.5.22.0'; FileVersion='2.5.22.0'; ManifestVersion='9.9.9.0'; ExpectedError='CCOD_TRAYHOST_VERSION_MISMATCH' },
+            [pscustomobject]@{ Component='portable'; PackageVersion='9.9.9'; AssemblyVersion='2.5.22.0'; FileVersion='2.5.22.0'; ManifestVersion='2.5.22.0'; ExpectedError='CCOD_PORTABLE_LAUNCHER_VERSION_MISMATCH' },
+            [pscustomobject]@{ Component='portable'; PackageVersion='2.5.22'; AssemblyVersion='9.9.9.0'; FileVersion='2.5.22.0'; ManifestVersion='2.5.22.0'; ExpectedError='CCOD_PORTABLE_LAUNCHER_VERSION_MISMATCH' },
+            [pscustomobject]@{ Component='portable'; PackageVersion='2.5.22'; AssemblyVersion='2.5.22.0'; FileVersion='9.9.9.0'; ManifestVersion='2.5.22.0'; ExpectedError='CCOD_PORTABLE_LAUNCHER_VERSION_MISMATCH' },
+            [pscustomobject]@{ Component='portable'; PackageVersion='2.5.22'; AssemblyVersion='2.5.22.0'; FileVersion='2.5.22.0'; ManifestVersion='9.9.9.0'; ExpectedError='CCOD_PORTABLE_LAUNCHER_VERSION_MISMATCH' }
+        )
+        foreach ($case in $cases) {
+            [IO.File]::WriteAllText((Join-Path $root 'package.json'),("{{`"version`":`"{0}`"}}" -f $case.PackageVersion),[Text.UTF8Encoding]::new($false))
+            $sourceRoot = Join-Path $root ('src\' + $case.Component)
+            [IO.Directory]::CreateDirectory($sourceRoot) | Out-Null
+            $assemblyInfo = "using System.Reflection;`r`n[assembly: AssemblyVersion(`"$($case.AssemblyVersion)`")]`r`n[assembly: AssemblyFileVersion(`"$($case.FileVersion)`")]`r`n"
+            [IO.File]::WriteAllText((Join-Path $sourceRoot 'AssemblyInfo.cs'),$assemblyInfo,[Text.UTF8Encoding]::new($false))
+            $manifestName = if ($case.Component -ceq 'trayhost') { 'CodexRemote.TrayHost.manifest' } else { 'CodexRemote.Portable.manifest' }
+            $identityName = if ($case.Component -ceq 'trayhost') { 'CodexRemote.fix.TrayHost' } else { 'CodexRemote.fix.Portable' }
+            $manifest = "<?xml version=`"1.0`" encoding=`"utf-8`"?><assembly manifestVersion=`"1.0`" xmlns=`"urn:schemas-microsoft-com:asm.v1`"><assemblyIdentity version=`"$($case.ManifestVersion)`" name=`"$identityName`" type=`"win32`" /></assembly>"
+            [IO.File]::WriteAllText((Join-Path $sourceRoot $manifestName),$manifest,[Text.UTF8Encoding]::new($false))
+            $actualError = ''
+            try {
+                if ($case.Component -ceq 'trayhost') {
+                    Invoke-CcodTrayHostBuild -RepositoryRoot $root -Version '2.5.22' -OutputDirectory (Join-Path $root 'trayhost-out') -GitCommit ('a' * 40) -BuildTimestampUtc '2026-08-28T00:00:00.0000000Z' | Out-Null
+                } else {
+                    Invoke-CcodPortableLauncherBuild -RepositoryRoot $root -Version '2.5.22' -OutputDirectory (Join-Path $root 'portable-out') -GitCommit ('a' * 40) -BuildTimestampUtc '2026-08-28T00:00:00.0000000Z' | Out-Null
+                }
+            } catch {
+                $actualError = ([string]$_.FullyQualifiedErrorId -split ',')[0]
+            }
+            Assert-CcodEqual ([string]$case.ExpectedError) $actualError "$($case.Component) rejects $($case.PackageVersion)/$($case.AssemblyVersion)/$($case.FileVersion)/$($case.ManifestVersion) before resolving compiler inputs"
+        }
+    } finally {
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+Invoke-CcodTest '2.5.22 source metadata binds the package and native assembly identities' {
     $package=Get-Content -LiteralPath (Join-Path $repositoryRoot 'package.json') -Raw|ConvertFrom-Json
-    Assert-CcodEqual '2.5.21' ([string]$package.version) 'package version is the 2.5.21 release version'
+    Assert-CcodEqual '2.5.22' ([string]$package.version) 'package version is the 2.5.22 release version'
     $assemblyInfo=Get-Content -LiteralPath (Join-Path $repositoryRoot 'src\trayhost\AssemblyInfo.cs') -Raw
-    Assert-CcodTrue ($assemblyInfo -match 'AssemblyVersion\("2\.5\.21\.0"\)') 'TrayHost assembly version is 2.5.21.0'
-    Assert-CcodTrue ($assemblyInfo -match 'AssemblyFileVersion\("2\.5\.21\.0"\)') 'TrayHost file version is 2.5.21.0'
+    Assert-CcodTrue ($assemblyInfo -match 'AssemblyVersion\("2\.5\.22\.0"\)') 'TrayHost assembly version is 2.5.22.0'
+    Assert-CcodTrue ($assemblyInfo -match 'AssemblyFileVersion\("2\.5\.22\.0"\)') 'TrayHost file version is 2.5.22.0'
     $manifest=Get-Content -LiteralPath (Join-Path $repositoryRoot 'src\trayhost\CodexRemote.TrayHost.manifest') -Raw
-    Assert-CcodTrue ($manifest -match '<assemblyIdentity version="2\.5\.21\.0"') 'TrayHost manifest identity is 2.5.21.0'
+    Assert-CcodTrue ($manifest -match '<assemblyIdentity version="2\.5\.22\.0"') 'TrayHost manifest identity is 2.5.22.0'
     $portableManifest=Get-Content -LiteralPath (Join-Path $repositoryRoot 'src\portable\CodexRemote.Portable.manifest') -Raw
-    Assert-CcodTrue ($portableManifest -match '<assemblyIdentity version="2\.5\.21\.0"') 'portable launcher manifest identity is 2.5.21.0'
+    Assert-CcodTrue ($portableManifest -match '<assemblyIdentity version="2\.5\.22\.0"') 'portable launcher manifest identity is 2.5.22.0'
     $portableAssemblyInfo=Get-Content -LiteralPath (Join-Path $repositoryRoot 'src\portable\AssemblyInfo.cs') -Raw
-    Assert-CcodTrue ($portableAssemblyInfo -match 'AssemblyVersion\("2\.5\.21\.0"\)') 'portable launcher assembly version is 2.5.21.0'
-    Assert-CcodTrue ($portableAssemblyInfo -match 'AssemblyFileVersion\("2\.5\.21\.0"\)') 'portable launcher file version is 2.5.21.0'
+    Assert-CcodTrue ($portableAssemblyInfo -match 'AssemblyVersion\("2\.5\.22\.0"\)') 'portable launcher assembly version is 2.5.22.0'
+    Assert-CcodTrue ($portableAssemblyInfo -match 'AssemblyFileVersion\("2\.5\.22\.0"\)') 'portable launcher file version is 2.5.22.0'
 }
 
 Invoke-CcodTest 'TrayHost build lock pins the Microsoft net48 reference package' {
@@ -53,15 +145,15 @@ Invoke-CcodTest 'TrayHost build emits one source-auditable artifact and rejects
     Import-Module $modulePath -Force
     $artifact=Join-Path $env:TEMP ('ccod-trayhost-artifact-'+[Guid]::NewGuid().ToString('N'))
     try{
-        $result=Invoke-CcodTrayHostBuild -RepositoryRoot $repositoryRoot -Version '2.5.21' -OutputDirectory $artifact
+        $result=Invoke-CcodTrayHostBuild -RepositoryRoot $repositoryRoot -Version '2.5.22' -OutputDirectory $artifact
         Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $artifact 'CodexRemote.TrayHost.exe') -PathType Leaf) 'TrayHost executable exists'
         Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $artifact 'CodexRemote.TrayHost.exe.config') -PathType Leaf) 'TrayHost config exists'
         Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $artifact 'trayhost-build-provenance.json') -PathType Leaf) 'TrayHost provenance exists'
         $provenance=Get-Content -LiteralPath (Join-Path $artifact 'trayhost-build-provenance.json') -Raw|ConvertFrom-Json
-        Assert-CcodEqual '2.5.21' ([string]$provenance.version) 'provenance version is exact'
+        Assert-CcodEqual '2.5.22' ([string]$provenance.version) 'provenance version is exact'
         $fileVersion=[Diagnostics.FileVersionInfo]::GetVersionInfo((Join-Path $artifact 'CodexRemote.TrayHost.exe'))
-        Assert-CcodEqual '2.5.21.0' ([string]$fileVersion.FileVersion) 'built TrayHost file version is release-aligned'
-        Assert-CcodEqual '2.5.21.0' ([string]$fileVersion.ProductVersion) 'built TrayHost product version is release-aligned'
+        Assert-CcodEqual '2.5.22.0' ([string]$fileVersion.FileVersion) 'built TrayHost file version is release-aligned'
+        Assert-CcodEqual '2.5.22.0' ([string]$fileVersion.ProductVersion) 'built TrayHost product version is release-aligned'
         Assert-CcodTrue ([string]$provenance.gitCommit -cmatch '^[0-9a-f]{40}$') 'provenance records one canonical source commit'
         $provenanceTimestamp=[datetime]::MinValue
         Assert-CcodTrue ([datetime]::TryParse([string]$provenance.buildTimestampUtc,[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind,[ref]$provenanceTimestamp)) 'provenance records a parseable build timestamp'
@@ -73,7 +165,7 @@ Invoke-CcodTest 'TrayHost build emits one source-auditable artifact and rejects
         Assert-CcodTrue (@($provenance.sourceFiles).Count -ge 10) 'provenance includes every TrayHost source'
         Assert-CcodTrue (-not ([string]$provenance|Select-String -Pattern '[A-Za-z]:\\|\\\\' -Quiet)) 'provenance does not leak absolute paths'
         $currentCommit=(& git -C $repositoryRoot rev-parse HEAD).Trim().ToLowerInvariant()
-        $validated=Test-CcodTrayHostArtifact -RepositoryRoot $repositoryRoot -Version '2.5.21' -ArtifactDirectory $artifact -ExpectedGitCommit $currentCommit
+        $validated=Test-CcodTrayHostArtifact -RepositoryRoot $repositoryRoot -Version '2.5.22' -ArtifactDirectory $artifact -ExpectedGitCommit $currentCommit
         Assert-CcodEqual $currentCommit ([string]$validated.GitCommit) 'artifact validation binds the current source commit when requested'
         $expectedSourceNames=@(Get-ChildItem -LiteralPath (Join-Path $repositoryRoot 'src\trayhost') -Filter '*.cs' -File|Sort-Object Name|ForEach-Object Name)
         Assert-CcodEqual ($expectedSourceNames -join ',') (@($provenance.sourceFiles.name) -join ',') 'built provenance records the exact compiled TrayHost source set in canonical order'
@@ -93,13 +185,13 @@ Invoke-CcodTest 'TrayHost build emits one source-auditable artifact and rejects
             & $applyMutation $mutated
             [IO.File]::WriteAllText($provenancePath,($mutated|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
             try{
-                Assert-CcodThrows { Test-CcodTrayHostArtifact -RepositoryRoot $repositoryRoot -Version '2.5.21' -ArtifactDirectory $artifact -ExpectedGitCommit $currentCommit|Out-Null } 'CCOD_TRAYHOST_SOURCE_TAMPERED'
+                Assert-CcodThrows { Test-CcodTrayHostArtifact -RepositoryRoot $repositoryRoot -Version '2.5.22' -ArtifactDirectory $artifact -ExpectedGitCommit $currentCommit|Out-Null } 'CCOD_TRAYHOST_SOURCE_TAMPERED'
             }finally{
                 [IO.File]::WriteAllText($provenancePath,$baselineJson,[Text.UTF8Encoding]::new($false))
             }
         }
         $tampered=Join-Path $artifact 'CodexRemote.TrayHost.exe.config'; Add-Content -LiteralPath $tampered -Value 'x'
-        $threw=$false; try{Test-CcodTrayHostArtifact -RepositoryRoot $repositoryRoot -Version '2.5.21' -ArtifactDirectory $artifact|Out-Null}catch{$threw=$true}
+        $threw=$false; try{Test-CcodTrayHostArtifact -RepositoryRoot $repositoryRoot -Version '2.5.22' -ArtifactDirectory $artifact|Out-Null}catch{$threw=$true}
         Assert-CcodTrue $threw 'tampered artifact is rejected'
     }finally{if(Test-Path -LiteralPath $artifact){Remove-Item -LiteralPath $artifact -Recurse -Force -ErrorAction SilentlyContinue}}
 }
@@ -114,15 +206,15 @@ Invoke-CcodTest 'portable launcher build emits a tamper-bound double-click entry
     Import-Module (Join-Path $repositoryRoot 'build\TrayHostBuild.psm1') -Force
     $artifact = Join-Path $env:TEMP ('ccod-portable-launcher-artifact-' + [Guid]::NewGuid().ToString('N'))
     try {
-        $result = Invoke-CcodPortableLauncherBuild -RepositoryRoot $repositoryRoot -Version '2.5.21' -OutputDirectory $artifact
+        $result = Invoke-CcodPortableLauncherBuild -RepositoryRoot $repositoryRoot -Version '2.5.22' -OutputDirectory $artifact
         Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $artifact 'CodexRemote.Portable.exe') -PathType Leaf) 'portable launcher executable exists'
         Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $artifact 'CodexRemote.Portable.exe.config') -PathType Leaf) 'portable launcher config exists'
         Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $artifact 'portable-launcher-provenance.json') -PathType Leaf) 'portable launcher provenance exists'
         $provenance = Get-Content -LiteralPath (Join-Path $artifact 'portable-launcher-provenance.json') -Raw | ConvertFrom-Json
-        Assert-CcodEqual '2.5.21' ([string]$provenance.version) 'portable launcher provenance version is exact'
+        Assert-CcodEqual '2.5.22' ([string]$provenance.version) 'portable launcher provenance version is exact'
         $fileVersion = [Diagnostics.FileVersionInfo]::GetVersionInfo((Join-Path $artifact 'CodexRemote.Portable.exe'))
-        Assert-CcodEqual '2.5.21.0' ([string]$fileVersion.FileVersion) 'portable launcher Windows file version is release-aligned'
-        Assert-CcodEqual '2.5.21.0' ([string]$fileVersion.ProductVersion) 'portable launcher Windows product version is release-aligned'
+        Assert-CcodEqual '2.5.22.0' ([string]$fileVersion.FileVersion) 'portable launcher Windows file version is release-aligned'
+        Assert-CcodEqual '2.5.22.0' ([string]$fileVersion.ProductVersion) 'portable launcher Windows product version is release-aligned'
         Assert-CcodEqual 2 @($provenance.sourceFiles).Count 'portable launcher provenance binds both implementation and assembly metadata'
         Assert-CcodTrue (@($provenance.sourceFiles.name) -ccontains 'AssemblyInfo.cs') 'portable launcher provenance includes assembly metadata'
         $validated = (Get-FileHash -LiteralPath (Join-Path $artifact 'CodexRemote.Portable.exe') -Algorithm SHA256).Hash.ToLowerInvariant()
diff --git a/tools/New-GitHubReleaseNotes.ps1 b/tools/New-GitHubReleaseNotes.ps1
new file mode 100644
index 0000000..3856a76
--- /dev/null
+++ b/tools/New-GitHubReleaseNotes.ps1
@@ -0,0 +1,48 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)][string]$ChangelogPath,
+    [Parameter(Mandatory)][string]$Tag,
+    [Parameter(Mandatory)][string]$OutputPath
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+if ($Tag -cnotmatch '^v\d+\.\d+\.\d+$') {
+    throw 'CCOD_RELEASE_NOTES_TAG_INVALID'
+}
+
+$changelog = [IO.Path]::GetFullPath($ChangelogPath)
+$output = [IO.Path]::GetFullPath($OutputPath)
+if (-not (Test-Path -LiteralPath $changelog -PathType Leaf)) {
+    throw 'CCOD_RELEASE_NOTES_CHANGELOG_MISSING'
+}
+$outputParent = [IO.Path]::GetDirectoryName($output)
+if ([string]::IsNullOrWhiteSpace($outputParent) -or -not [IO.Directory]::Exists($outputParent)) {
+    throw 'CCOD_RELEASE_NOTES_OUTPUT_INVALID'
+}
+
+$text = [IO.File]::ReadAllText($changelog,[Text.UTF8Encoding]::new($false))
+$releasePattern = '(?ms)^## ' + [regex]::Escape($Tag) + '[ \t]*\r?\n(?<body>.*?)(?=^## |\z)'
+$releaseSections = @([regex]::Matches($text,$releasePattern))
+if ($releaseSections.Count -ne 1) {
+    throw 'CCOD_RELEASE_NOTES_RELEASE_SECTION_INVALID'
+}
+$englishSections = @([regex]::Matches($releaseSections[0].Groups['body'].Value,'(?ms)^### English[ \t]*\r?\n(?<body>.*?)(?=^### |\z)'))
+if ($englishSections.Count -ne 1) {
+    throw 'CCOD_RELEASE_NOTES_ENGLISH_SECTION_INVALID'
+}
+$english = $englishSections[0].Groups['body'].Value.Trim().Replace("`r`n","`n").Replace("`r","`n")
+if ([string]::IsNullOrWhiteSpace($english)) {
+    throw 'CCOD_RELEASE_NOTES_ENGLISH_SECTION_INVALID'
+}
+
+$version = $Tag.Substring(1)
+$notes = "# CodexRemote-fix $version`n`n$english`n"
+[IO.File]::WriteAllText($output,$notes,[Text.UTF8Encoding]::new($false))
+
+[pscustomobject][ordered]@{
+    Tag = $Tag
+    Version = $version
+    OutputPath = $output
+}

From 9799d4fd2f0b9a17eb7ee2fd6738dcb7edbfedb0 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 13:45:10 +0800
Subject: [PATCH 046/187] docs: record v2.5.22 release validation

---
 .../task-5-report.md                          | 212 ++++++++++++++++++
 README.md                                     |   2 +-
 README.zh-CN.md                               |   2 +-
 .../persistence/ReleaseWorkflow.SelfTest.ps1  |   4 +-
 4 files changed, 216 insertions(+), 4 deletions(-)
 create mode 100644 .superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md

diff --git a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
new file mode 100644
index 0000000..9bc617f
--- /dev/null
+++ b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
@@ -0,0 +1,212 @@
+# Task 5 report — v2.5.22 release metadata, documentation, and contract
+
+## Scope and safety boundary
+
+- Worktree: `C:\Users\33384\Documents\Codex-Control-other-devices-Windows\.worktrees\codex-v2522-install-runtime-reliability`
+- Starting reviewed HEAD: `1d6bd1f` (`docs: record tray trace gate bypass fix`)
+- Implemented only release metadata, native build/artifact version verification,
+  release-coupled tests, stable README release references, CHANGELOG notes, and
+  deterministic GitHub release-note extraction.
+- Did not install or run the installer, start a real Codex/UI process, stop the
+  real Supervisor/TrayHost, publish, push, sign, tag, or write WindowsApps/DPAPI.
+
+## TDD evidence
+
+### Release version contract RED
+
+After changing only the ReleaseWorkflow contract to require v2.5.22:
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+exit 1
+ASSERT_EQUAL: package metadata is the 2.5.22 release
+expected=[2.5.22] actual=[2.5.21]
+```
+
+All preceding release gates, including real ISCC compilation, had passed. This
+proved the new contract failed for the intended missing release metadata.
+
+### Native static-metadata gate RED
+
+The next test called the real TrayHost/portable build entrypoints against
+controlled package, AssemblyInfo, and manifest mismatches before production
+changes:
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\TrayHostBuild.SelfTest.ps1
+exit 1
+expected=[CCOD_TRAYHOST_VERSION_MISMATCH]
+actual=[CCOD_TRAYHOST_SOURCE_MISSING]
+```
+
+This proved a requested version mismatch was not rejected before compiler input
+resolution.
+
+### Artifact manifest and PE version RED
+
+A real compiled TrayHost artifact was validated against a copied repository
+contract. The test changed the manifest and then aligned package/static
+metadata/provenance to a false `9.9.9` while retaining the original PE:
+
+```text
+exit 1
+expected=[CCOD_TRAYHOST_VERSION_MISMATCH|CCOD_TRAYHOST_ARTIFACT_VERSION_INVALID]
+actual=[|]
+```
+
+The old validator accepted both mutations. The final mutation coverage also
+changes valid-version manifest bytes without changing the identity, proving the
+manifest SHA binding independently.
+
+### Release-note extraction RED/GREEN
+
+The behavior test first failed because the workflow extractor did not exist.
+After the tool was added, a CRLF fixture produced a second intentional RED
+because the target English section retained CRLF bytes. The final extractor
+normalizes output to LF and emits only the exact target English section; the
+test excludes Unreleased, newer-version, Chinese, and older-version decoys.
+
+## Implementation
+
+### Version sources
+
+- `package.json`: `2.5.22`
+- TrayHost AssemblyVersion/FileVersion and Windows manifest: `2.5.22.0`
+- Portable launcher AssemblyVersion/FileVersion and Windows manifest:
+  `2.5.22.0`
+
+Historical CHANGELOG entries and non-release presentation/runtime fixtures
+remain unchanged. In particular, the TrayHost native `2.5.21` strings are
+acknowledged-presentation test inputs, `InstalledLifecycleHarness` uses
+`2.5.21-new` runtime fixtures, and ReleaseWorkflow retains an intentional old
+payload/structural workflow fixture.
+
+### Fail-closed native build and artifact verification
+
+`build/TrayHostBuild.psm1` now:
+
+- requires requested `-Version` to match `package.json`;
+- requires exactly one matching AssemblyVersion and AssemblyFileVersion;
+- parses the Windows assembly manifest and requires the exact identity name,
+  `win32` type, and `<version>.0` value;
+- applies that contract to both TrayHost and portable build entrypoints before
+  compiler/reference resolution;
+- reads the compiled PE FileVersion and ProductVersion and requires exact
+  `<version>.0` values before publishing either artifact;
+- makes `Test-CcodTrayHostArtifact` repeat the static contract, bind the source
+  manifest/config hashes from provenance, and reject PE version drift.
+
+Regression cases independently mutate package version, AssemblyVersion,
+AssemblyFileVersion, manifest version, manifest bytes, provenance/static
+version, and PE version relationship.
+
+### Documentation and release notes
+
+- README/README.zh-CN now name v2.5.22 only in the stable status, Quick Start,
+  and release-asset descriptions; no What's new block or internal error code
+  was added.
+- Removed the English README's literal `\r\n` text.
+- Corrected the asset contract: portable publishes its payload manifest as an
+  external asset; Setup embeds and hash-binds its versioned
+  `installer-payload.manifest.json`.
+- CHANGELOG has four concise v2.5.22 English bullets followed by Chinese notes.
+- `.github/workflows/release.yml` calls the behavior-tested
+  `tools/New-GitHubReleaseNotes.ps1`, so the GitHub body contains only the
+  requested release's English section.
+
+## Verification before primary commit
+
+```text
+TrayHostBuild.SelfTest.ps1
+  exit 0; 8 cases
+
+ReleaseWorkflow.SelfTest.ps1
+  exit 0; all cases, including real ISCC, real TrayHost PE validation,
+  CRLF-to-LF English-only release notes, and v2.5.22 documentation contract
+
+Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly
+  exit 0; 3 production child-session trace cases
+
+Invoke-TrayHostSelfTest.ps1 -NativeOnly
+  exit 0; 25 native fake-platform cases
+
+PowerShell AST parse
+  exit 0; TrayHostBuild module, three release-coupled test scripts,
+  and New-GitHubReleaseNotes.ps1
+
+version audit
+  package=2.5.22
+  tray Assembly/File/manifest=2.5.22.0
+  portable Assembly/File/manifest=2.5.22.0
+```
+
+### InstallLifecycle environment boundary
+
+The full requested test was run without stopping the real Supervisor:
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+exit 1 after approximately 67 seconds
+case=transactional-uninstall-reaches-ReadyForInno-only-after-recovery-protection-stop-task-proof-and-application-removal
+error=CCOD_LIFECYCLE_LEASE_TIMEOUT
+message=Lifecycle ownership mutex timed out
+```
+
+That failing case begins at line 1876. The v2.5.22 release-coupled builder case
+begins at line 2588, so it was not reached and is not reported as passing. No
+mutex bypass or real Supervisor stop was attempted. `npm test` / aggregate
+Validate were not run because they would recurse into the same known live
+mutex boundary, contrary to the task's safety constraint.
+
+## Clean release build
+
+The primary release commit was created as:
+
+```text
+49f88e2 release: prepare CodexRemote-fix v2.5.22
+```
+
+From that clean HEAD, the normal release workflow completed:
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File build\build.ps1 -Version 2.5.22
+exit 0
+```
+
+Generated assets remained under `build/dist` only:
+
+```text
+CodexRemote-fix-2.5.22-windows-x64.zip
+  55d0b0e383faa208f0795dbeb6b2ae01051807fdd2d40ddea115951ae6fae02b
+CodexRemote-fix-2.5.22-setup.exe
+  298dd4c821b83df3bcca32ffe0193bcaa55eff1ddcdf3115680198c635d668a0
+CodexRemote-fix-2.5.22-payload-manifest.json
+  08cbbd5eb0093b15d461f42912e1395cf2c90da0c1da503b41b9bda1293b2492
+CodexRemote-fix-2.5.22-release-manifest.json
+  e313e9943888f3b346d20f7d6627fbf60254de40c6518d47e7c3ba46bd6fd18e
+CodexRemote-fix-2.5.22-setup-release-manifest.json
+  b7a95f58b0cb3178a3a2e7d208b5ba931c2fe7d391970ec297c1b8c70db17579
+CodexRemote-fix-2.5.22-trayhost-provenance.json
+  95bc8535ba54b4a0bfc4356fd4162e71800b599b0a1b42476c0ce9912ab0ac40
+```
+
+Both release manifests passed `Test-CcodReleaseAssetManifest` for expected
+version `2.5.22`; portable reported distribution `portable-zip`. Both manifests
+and TrayHost provenance bound commit
+`49f88e2bd511a0f98ce93f48967e4cf3a333f93b`. The generated TrayHost and
+portable PE FileVersion/ProductVersion values were all `2.5.22.0`.
+
+The installer was compiled but never executed. No asset was installed,
+published, pushed, signed, or tagged. A post-build documentation precision fix
+corrected the actual embedded filename from the design spelling
+`installer-payload-manifest.json` to the implementation spelling
+`installer-payload.manifest.json`; therefore these local artifacts are retained
+as build evidence and must not be treated as immutable publish candidates for
+the follow-up documentation HEAD without a fresh clean rebuild.
+
+## Remaining acceptance boundary
+
+- A real setup install/upgrade, reboot, remote connection, About/language/logs,
+  repair, and Defender outcome remain outside this Task 5 local build scope.
+- Independent parent review remains required before any tag, push, publish,
+  signing, or installation decision.
diff --git a/README.md b/README.md
index 254b74a..dd815b0 100644
--- a/README.md
+++ b/README.md
@@ -86,7 +86,7 @@ The tray reports two independent, truthful status lines instead of inferring rea
 
 ## Releases
 
-Every tagged release ships a Windows setup installer and an EXE-entry portable ZIP with separate SHA-256 checksums and release manifests. The portable distribution publishes its payload manifest as an asset; Setup embeds and hash-binds its versioned `installer-payload-manifest.json`. For v2.5.22, download:
+Every tagged release ships a Windows setup installer and an EXE-entry portable ZIP with separate SHA-256 checksums and release manifests. The portable distribution publishes its payload manifest as an asset; Setup embeds and hash-binds its versioned `installer-payload.manifest.json`. For v2.5.22, download:
 
 - `CodexRemote-fix-2.5.22-setup.exe` and its checksum
 - `CodexRemote-fix-2.5.22-windows-x64.zip` and its checksum
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 7d2a952..7acbcf6 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -81,7 +81,7 @@ CodexRemote-fix 在 Windows 版 Codex Desktop 中启用随应用一起打包、
 
 ## 发布（Releases）
 
-每个带 tag 的发布都会附带 Windows 安装包和以 EXE 启动的便携 ZIP，并分别提供 SHA-256 校验文件与 release manifest。便携发行版会外发自己的 payload manifest；Setup 则内嵌并以哈希绑定版本化的 `installer-payload-manifest.json`。v2.5.22 提供：
+每个带 tag 的发布都会附带 Windows 安装包和以 EXE 启动的便携 ZIP，并分别提供 SHA-256 校验文件与 release manifest。便携发行版会外发自己的 payload manifest；Setup 则内嵌并以哈希绑定版本化的 `installer-payload.manifest.json`。v2.5.22 提供：
 
 - `CodexRemote-fix-2.5.22-setup.exe` 及其校验文件
 - `CodexRemote-fix-2.5.22-windows-x64.zip` 及其校验文件
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 9394583..5fdf4cd 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -1787,7 +1787,7 @@ Invoke-CcodTest '2.5.22 source metadata and documentation match the release cont
     Assert-CcodTrue ($quickStart.Contains('Microsoft Defender')) 'English Quick Start documents the local Defender gate'
     Assert-CcodTrue (-not $readme.Contains('\r\n')) 'English README contains no literal CRLF escape text'
     Assert-CcodTrue ($readme.Contains('The portable distribution publishes its payload manifest as an asset')) 'English README identifies the externally published portable payload manifest'
-    Assert-CcodTrue ($readme.Contains('Setup embeds and hash-binds its versioned `installer-payload-manifest.json`')) 'English README identifies the embedded hash-bound setup payload manifest'
+    Assert-CcodTrue ($readme.Contains('Setup embeds and hash-binds its versioned `installer-payload.manifest.json`')) 'English README identifies the embedded hash-bound setup payload manifest'
     Assert-CcodTrue (-not $readme.Contains('shared payload manifest')) 'English README does not claim setup and portable share one payload manifest'
     $readmeZh = Get-Content -LiteralPath (Join-Path $repositoryRoot 'README.zh-CN.md') -Raw -Encoding UTF8
     Assert-CcodTrue ($readmeZh -match 'v2\.5\.22 \u662F\u5F53\u524D\u7A33\u5B9A\u7248') 'Chinese README marks v2.5.22 stable'
@@ -1797,7 +1797,7 @@ Invoke-CcodTest '2.5.22 source metadata and documentation match the release cont
     Assert-CcodTrue ($readmeZh.Contains('CodexRemote-fix.exe')) 'Chinese Quick Start names the portable double-click entrypoint'
     Assert-CcodTrue ($readmeZh.Contains('Microsoft Defender')) 'Chinese Quick Start documents the local Defender gate'
     Assert-CcodTrue ($readmeZh -match '\u4FBF\u643A\u53D1\u884C\u7248\u4F1A\u5916\u53D1\u81EA\u5DF1\u7684 payload manifest') 'Chinese README identifies the externally published portable payload manifest'
-    Assert-CcodTrue ($readmeZh -match 'Setup \u5219\u5185\u5D4C\u5E76\u4EE5\u54C8\u5E0C\u7ED1\u5B9A\u7248\u672C\u5316\u7684 `installer-payload-manifest\.json`') 'Chinese README identifies the embedded hash-bound setup payload manifest'
+    Assert-CcodTrue ($readmeZh -match 'Setup \u5219\u5185\u5D4C\u5E76\u4EE5\u54C8\u5E0C\u7ED1\u5B9A\u7248\u672C\u5316\u7684 `installer-payload\.manifest\.json`') 'Chinese README identifies the embedded hash-bound setup payload manifest'
     $technical = Get-Content -LiteralPath (Join-Path $repositoryRoot 'docs\TECHNICAL.md') -Raw
     Assert-CcodTrue ($technical.Contains('PortableUninstallFinalizer.ps1')) 'technical documentation records the staged portable finalizer'
     $security = Get-Content -LiteralPath (Join-Path $repositoryRoot 'SECURITY.md') -Raw

From 6204a687816bdeea25f072363aadf62c23fe5da3 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 13:59:16 +0800
Subject: [PATCH 047/187] fix: verify portable release artifacts

---
 .../task-5-report.md                          | 64 +++++++++++++++++++
 build/TrayHostBuild.psm1                      | 42 +++++++++++-
 build/build.ps1                               |  5 +-
 .../persistence/ReleaseWorkflow.SelfTest.ps1  |  7 +-
 tests/persistence/TrayHostBuild.SelfTest.ps1  | 44 +++++++++++++
 tools/New-GitHubReleaseNotes.ps1              |  2 +-
 6 files changed, 159 insertions(+), 5 deletions(-)

diff --git a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
index 9bc617f..7e60ba7 100644
--- a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
+++ b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
@@ -210,3 +210,67 @@ the follow-up documentation HEAD without a fresh clean rebuild.
   repair, and Defender outcome remain outside this Task 5 local build scope.
 - Independent parent review remains required before any tag, push, publish,
   signing, or installation decision.
+
+## Fix round 1 — portable artifact verification and release-note body
+
+Independent review found two Important gaps: the freshly compiled portable
+launcher was copied into the payload without an artifact validator analogous to
+TrayHost, and the GitHub notes extractor synthesized an H1 instead of returning
+only the selected English section body.
+
+### RED evidence
+
+The portable regression was added before production code and called the wished-
+for validator against a real compiled launcher:
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\TrayHostBuild.SelfTest.ps1
+exit 1
+Test-CcodPortableLauncherArtifact is not recognized
+```
+
+The release-note expectation was independently changed to the exact English
+body with one LF, producing:
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+exit 1
+expected=[- Target English note.\n- Second target English note.\n]
+actual=[# CodexRemote-fix 2.5.22\n\n- Target English note.\n- Second target English note.\n]
+```
+
+### Implementation
+
+`Test-CcodPortableLauncherArtifact` now revalidates:
+
+- requested version against package, portable AssemblyInfo, and the portable
+  Windows manifest;
+- PE FileVersion and ProductVersion;
+- schema/product/version/framework/reference-pack, exact commit, and canonical
+  timestamp provenance;
+- exact `PortableLauncher.cs` and `AssemblyInfo.cs` source name/hash set;
+- icon, manifest, source config, executable, and artifact config hashes.
+
+`build/build.ps1` invokes that validator immediately after portable compilation
+and before the first portable EXE/config/provenance copy into the payload. The
+tamper regression changes commit, timestamp, every required hash class, source
+hashes, and a fully aligned false static/provenance version whose PE remains
+2.5.22.0.
+
+`New-GitHubReleaseNotes.ps1` now writes only the normalized target English body
+with exactly one trailing LF. The GitHub release title remains the workflow's
+separate `gh release create/edit --title` responsibility.
+
+### GREEN evidence and boundary
+
+```text
+TrayHostBuild.SelfTest.ps1
+  exit 0; 8 cases including portable validator tamper coverage
+
+ReleaseWorkflow.SelfTest.ps1
+  exit 0; English-body-only extraction and build-before-copy validator order
+```
+
+No formal release build, installer execution, install, publish, push, tag,
+signing, or real Codex/UI operation was performed in this fix round. The final
+fresh clean release build remains gated on scoped independent re-review.
diff --git a/build/TrayHostBuild.psm1 b/build/TrayHostBuild.psm1
index 9215fb4..f767edf 100644
--- a/build/TrayHostBuild.psm1
+++ b/build/TrayHostBuild.psm1
@@ -210,4 +210,44 @@ function Invoke-CcodPortableLauncherBuild {
     }finally{if(Test-Path -LiteralPath $work){Remove-Item -LiteralPath $work -Recurse -Force -ErrorAction SilentlyContinue}}
 }
 
-Export-ModuleMember -Function Invoke-CcodTrayHostBuild,Test-CcodTrayHostArtifact,Invoke-CcodPortableLauncherBuild
+function Test-CcodPortableLauncherArtifact {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][string]$RepositoryRoot,[Parameter(Mandatory)][string]$Version,[Parameter(Mandatory)][string]$ArtifactDirectory,[string]$ExpectedGitCommit)
+    if($Version -notmatch '^\d+\.\d+\.\d+$'){throw 'CCOD_PORTABLE_LAUNCHER_VERSION_INVALID'}
+    $repo=[IO.Path]::GetFullPath($RepositoryRoot);$out=[IO.Path]::GetFullPath($ArtifactDirectory);Test-CcodTrayHostOutputDirectory $out
+    $versionContract=Assert-CcodNativeVersionContract -RepositoryRoot $repo -Version $Version -Component portable
+    $exe=Join-Path $out 'CodexRemote.Portable.exe';$config=Join-Path $out 'CodexRemote.Portable.exe.config';$provenancePath=Join-Path $out 'portable-launcher-provenance.json'
+    foreach($path in @($exe,$config,$provenancePath)){if(-not(Test-Path -LiteralPath $path -PathType Leaf)){throw 'CCOD_PORTABLE_LAUNCHER_ARTIFACT_MISSING'}}
+    try{$provenance=Get-Content -LiteralPath $provenancePath -Raw|ConvertFrom-Json}catch{throw 'CCOD_PORTABLE_LAUNCHER_PROVENANCE_INVALID'}
+    $commit=$provenance.PSObject.Properties['gitCommit'];$timestamp=$provenance.PSObject.Properties['buildTimestampUtc'];$compiler=$provenance.PSObject.Properties['compiler']
+    if([int]$provenance.schemaVersion -ne 1 -or [string]$provenance.product -cne 'CodexRemote-fix' -or
+        [string]$provenance.version -cne $Version -or [string]$provenance.targetFramework -cne 'net48' -or
+        [string]$provenance.referenceRoot -cne 'locked-net48' -or $null -eq $commit -or $null -eq $timestamp -or $null -eq $compiler -or
+        $commit.Value -isnot [string] -or $commit.Value -cnotmatch '^[0-9a-f]{40}$' -or
+        $timestamp.Value -isnot [string] -or -not(Test-CcodTrayHostCanonicalUtc $timestamp.Value) -or
+        (-not [string]::IsNullOrWhiteSpace($ExpectedGitCommit) -and $commit.Value -cne $ExpectedGitCommit) -or
+        [string]$compiler.Value.name -cne 'csc.exe' -or [string]$compiler.Value.sha256 -cnotmatch '^[0-9a-f]{64}$'){throw 'CCOD_PORTABLE_LAUNCHER_PROVENANCE_INVALID'}
+    $icon=Join-Path $repo 'assets\codexremote-fix\codexremote-fix.ico';$sourceConfig=Join-Path $versionContract.SourceRoot 'CodexRemote.Portable.exe.config'
+    foreach($required in @($icon,$sourceConfig)){if(-not(Test-Path -LiteralPath $required -PathType Leaf)){throw 'CCOD_PORTABLE_LAUNCHER_SOURCE_MISSING'}}
+    if([string]$provenance.artifactSha256 -cne (Get-CcodTrayHostHash $exe) -or
+        [string]$provenance.configArtifactSha256 -cne (Get-CcodTrayHostHash $config) -or
+        [string]$provenance.iconSha256 -cne (Get-CcodTrayHostHash $icon) -or
+        [string]$provenance.manifestSha256 -cne (Get-CcodTrayHostHash $versionContract.ManifestPath) -or
+        [string]$provenance.configSha256 -cne (Get-CcodTrayHostHash $sourceConfig)){throw 'CCOD_PORTABLE_LAUNCHER_ARTIFACT_TAMPERED'}
+    $expectedSources=[Collections.Generic.Dictionary[string,string]]::new([StringComparer]::Ordinal)
+    foreach($name in @('AssemblyInfo.cs','PortableLauncher.cs')){$expectedSources.Add($name,(Get-CcodTrayHostHash (Join-Path $versionContract.SourceRoot $name)))}
+    $sourceFilesProperty=$provenance.PSObject.Properties['sourceFiles'];$sourceRecords=if($null -eq $sourceFilesProperty){@()}else{@($sourceFilesProperty.Value)}
+    if($sourceRecords.Count -ne $expectedSources.Count){throw 'CCOD_PORTABLE_LAUNCHER_SOURCE_TAMPERED'}
+    $seenSources=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    foreach($record in $sourceRecords){
+        if($null -eq $record){throw 'CCOD_PORTABLE_LAUNCHER_SOURCE_TAMPERED'}
+        $nameProperty=$record.PSObject.Properties['name'];$hashProperty=$record.PSObject.Properties['sha256']
+        if($null -eq $nameProperty -or $null -eq $hashProperty -or $nameProperty.Value -isnot [string] -or $hashProperty.Value -isnot [string]){throw 'CCOD_PORTABLE_LAUNCHER_SOURCE_TAMPERED'}
+        $name=[string]$nameProperty.Value;$hash=[string]$hashProperty.Value
+        if(-not $seenSources.Add($name) -or -not $expectedSources.ContainsKey($name) -or $hash -cnotmatch '^[0-9a-f]{64}$' -or $hash -cne $expectedSources[$name]){throw 'CCOD_PORTABLE_LAUNCHER_SOURCE_TAMPERED'}
+    }
+    Assert-CcodNativePeVersion -Path $exe -Version $Version -ErrorId 'CCOD_PORTABLE_LAUNCHER_ARTIFACT_VERSION_INVALID'
+    return [pscustomobject][ordered]@{Valid=$true;Executable=$exe;Version=$Version;GitCommit=[string]$commit.Value;Sha256=(Get-CcodTrayHostHash $exe)}
+}
+
+Export-ModuleMember -Function Invoke-CcodTrayHostBuild,Test-CcodTrayHostArtifact,Invoke-CcodPortableLauncherBuild,Test-CcodPortableLauncherArtifact
diff --git a/build/build.ps1 b/build/build.ps1
index 2f53eb1..8b900c8 100644
--- a/build/build.ps1
+++ b/build/build.ps1
@@ -321,7 +321,9 @@ try {
         $relative = $runtimeFile.FullName.Substring($runtimeRoot.TrimEnd('\').Length + 1).Replace('\','/')
         Copy-CcodBuildPayloadFile -Source $runtimeFile.FullName -PayloadRoot $payloadRoot -Relative ('src/runtime/' + $relative)
     }
-    Invoke-CcodPortableLauncherBuild -RepositoryRoot $repoRoot -Version $Version -OutputDirectory (Join-Path $PSScriptRoot 'generated\portable') -GitCommit $gitCommit -BuildTimestampUtc $buildTimestampUtc | Out-Null
+    $portableArtifact = Join-Path $PSScriptRoot 'generated\portable'
+    Invoke-CcodPortableLauncherBuild -RepositoryRoot $repoRoot -Version $Version -OutputDirectory $portableArtifact -GitCommit $gitCommit -BuildTimestampUtc $buildTimestampUtc | Out-Null
+    Test-CcodPortableLauncherArtifact -RepositoryRoot $repoRoot -Version $Version -ArtifactDirectory $portableArtifact -ExpectedGitCommit $gitCommit | Out-Null
     foreach ($trayHostFile in @('CodexRemote.TrayHost.exe','CodexRemote.TrayHost.exe.config','trayhost-build-provenance.json')) {
         Copy-CcodBuildPayloadFile -Source (Join-Path $trayHostArtifact $trayHostFile) -PayloadRoot $payloadRoot -Relative ('bin/' + $trayHostFile)
     }
@@ -425,7 +427,6 @@ $isccCandidates = @(
 $iscc = $isccCandidates | Where-Object { -not [string]::IsNullOrWhiteSpace($_) -and [IO.File]::Exists($_) } | Select-Object -First 1
 if (-not $iscc) { throw 'Inno Setup 6 (ISCC.exe) was not found. Install it with: winget install --id JRSoftware.InnoSetup --exact' }
 $issPath = Join-Path $PSScriptRoot 'CodexControlOtherDevices.iss'
-$portableArtifact = Join-Path $PSScriptRoot 'generated\portable'
 $isccArguments = @(
     "/DProjectVersion=$Version",
     "/DTrayHostArtifactDirectory=$trayHostArtifact",
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 5fdf4cd..91a6664 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -1749,7 +1749,7 @@ Invoke-CcodTest 'release notes extraction emits only the target release English
         [IO.File]::WriteAllText($changelogPath,$fixture.Replace("`n","`r`n"),[Text.UTF8Encoding]::new($false))
         & (Join-Path $repositoryRoot 'tools\New-GitHubReleaseNotes.ps1') -ChangelogPath $changelogPath -Tag 'v2.5.22' -OutputPath $notesPath | Out-Null
         $actual = [IO.File]::ReadAllText($notesPath,[Text.UTF8Encoding]::new($false))
-        Assert-CcodEqual "# CodexRemote-fix 2.5.22`n`n- Target English note.`n- Second target English note.`n" $actual 'release body contains exactly the current target English notes'
+        Assert-CcodEqual "- Target English note.`n- Second target English note.`n" $actual 'release body contains exactly the current target English notes'
         foreach ($decoy in @('UNRELEASED_DECOY','NEWER_DECOY','CHINESE_DECOY','OLDER_DECOY')) {
             Assert-CcodTrue (-not $actual.Contains($decoy)) "release body excludes $decoy"
         }
@@ -1758,6 +1758,11 @@ Invoke-CcodTest 'release notes extraction emits only the target release English
     }
 }
 
+Invoke-CcodTest 'release build validates the portable launcher artifact before payload copy' {
+    $build = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\build.ps1') -Raw
+    Assert-CcodTrue ($build -cmatch '(?s)Invoke-CcodPortableLauncherBuild.*?Test-CcodPortableLauncherArtifact.*?foreach \(\$portableFile in') 'portable build validates the generated artifact before copying it into the payload'
+}
+
 Invoke-CcodTest '2.5.22 source metadata and documentation match the release contract' {
     $package = Get-Content -LiteralPath (Join-Path $repositoryRoot 'package.json') -Raw | ConvertFrom-Json
     Assert-CcodEqual '2.5.22' ([string]$package.version) 'package metadata is the 2.5.22 release'
diff --git a/tests/persistence/TrayHostBuild.SelfTest.ps1 b/tests/persistence/TrayHostBuild.SelfTest.ps1
index d78ed82..5fe0072 100644
--- a/tests/persistence/TrayHostBuild.SelfTest.ps1
+++ b/tests/persistence/TrayHostBuild.SelfTest.ps1
@@ -205,6 +205,7 @@ Invoke-CcodTest 'TrayHost build embeds the product ICO instead of relying on a r
 Invoke-CcodTest 'portable launcher build emits a tamper-bound double-click entrypoint' {
     Import-Module (Join-Path $repositoryRoot 'build\TrayHostBuild.psm1') -Force
     $artifact = Join-Path $env:TEMP ('ccod-portable-launcher-artifact-' + [Guid]::NewGuid().ToString('N'))
+    $fixtureRoot = Join-Path $env:TEMP ('ccod-portable-launcher-repository-' + [Guid]::NewGuid().ToString('N'))
     try {
         $result = Invoke-CcodPortableLauncherBuild -RepositoryRoot $repositoryRoot -Version '2.5.22' -OutputDirectory $artifact
         Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $artifact 'CodexRemote.Portable.exe') -PathType Leaf) 'portable launcher executable exists'
@@ -219,8 +220,51 @@ Invoke-CcodTest 'portable launcher build emits a tamper-bound double-click entry
         Assert-CcodTrue (@($provenance.sourceFiles.name) -ccontains 'AssemblyInfo.cs') 'portable launcher provenance includes assembly metadata'
         $validated = (Get-FileHash -LiteralPath (Join-Path $artifact 'CodexRemote.Portable.exe') -Algorithm SHA256).Hash.ToLowerInvariant()
         Assert-CcodEqual $validated ([string]$provenance.artifactSha256) 'portable launcher artifact binds its executable hash'
+        $currentCommit = (& git -C $repositoryRoot rev-parse HEAD).Trim().ToLowerInvariant()
+        $artifactValidation = Test-CcodPortableLauncherArtifact -RepositoryRoot $repositoryRoot -Version '2.5.22' -ArtifactDirectory $artifact -ExpectedGitCommit $currentCommit
+        Assert-CcodEqual $currentCommit ([string]$artifactValidation.GitCommit) 'portable artifact validator binds the expected source commit'
+
+        $provenancePath = Join-Path $artifact 'portable-launcher-provenance.json'
+        $baselineJson = [IO.File]::ReadAllText($provenancePath,[Text.UTF8Encoding]::new($false))
+        $mutations = @(
+            [pscustomobject]@{ Name='commit'; Error='CCOD_PORTABLE_LAUNCHER_PROVENANCE_INVALID'; Apply={param($record)$record.gitCommit='d'*40} },
+            [pscustomobject]@{ Name='timestamp'; Error='CCOD_PORTABLE_LAUNCHER_PROVENANCE_INVALID'; Apply={param($record)$record.buildTimestampUtc='not-canonical'} },
+            [pscustomobject]@{ Name='source hash'; Error='CCOD_PORTABLE_LAUNCHER_SOURCE_TAMPERED'; Apply={param($record)$record.sourceFiles[0].sha256='0'*64} },
+            [pscustomobject]@{ Name='icon hash'; Error='CCOD_PORTABLE_LAUNCHER_ARTIFACT_TAMPERED'; Apply={param($record)$record.iconSha256='0'*64} },
+            [pscustomobject]@{ Name='manifest hash'; Error='CCOD_PORTABLE_LAUNCHER_ARTIFACT_TAMPERED'; Apply={param($record)$record.manifestSha256='0'*64} },
+            [pscustomobject]@{ Name='source config hash'; Error='CCOD_PORTABLE_LAUNCHER_ARTIFACT_TAMPERED'; Apply={param($record)$record.configSha256='0'*64} },
+            [pscustomobject]@{ Name='executable hash'; Error='CCOD_PORTABLE_LAUNCHER_ARTIFACT_TAMPERED'; Apply={param($record)$record.artifactSha256='0'*64} },
+            [pscustomobject]@{ Name='artifact config hash'; Error='CCOD_PORTABLE_LAUNCHER_ARTIFACT_TAMPERED'; Apply={param($record)$record.configArtifactSha256='0'*64} }
+        )
+        foreach ($mutationCase in $mutations) {
+            $mutated = $baselineJson | ConvertFrom-Json
+            & ([scriptblock]$mutationCase.Apply) $mutated
+            [IO.File]::WriteAllText($provenancePath,($mutated | ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+            try {
+                Assert-CcodThrows { Test-CcodPortableLauncherArtifact -RepositoryRoot $repositoryRoot -Version '2.5.22' -ArtifactDirectory $artifact -ExpectedGitCommit $currentCommit | Out-Null } ([string]$mutationCase.Error)
+            } finally {
+                [IO.File]::WriteAllText($provenancePath,$baselineJson,[Text.UTF8Encoding]::new($false))
+            }
+        }
+
+        [IO.Directory]::CreateDirectory((Join-Path $fixtureRoot 'src')) | Out-Null
+        Copy-Item -LiteralPath (Join-Path $repositoryRoot 'src\portable') -Destination (Join-Path $fixtureRoot 'src\portable') -Recurse
+        [IO.Directory]::CreateDirectory((Join-Path $fixtureRoot 'assets\codexremote-fix')) | Out-Null
+        Copy-Item -LiteralPath (Join-Path $repositoryRoot 'assets\codexremote-fix\codexremote-fix.ico') -Destination (Join-Path $fixtureRoot 'assets\codexremote-fix\codexremote-fix.ico')
+        [IO.File]::WriteAllText((Join-Path $fixtureRoot 'package.json'),'{"version":"9.9.9"}',[Text.UTF8Encoding]::new($false))
+        $assemblyPath = Join-Path $fixtureRoot 'src\portable\AssemblyInfo.cs'
+        [IO.File]::WriteAllText($assemblyPath,([IO.File]::ReadAllText($assemblyPath,[Text.UTF8Encoding]::new($false)).Replace('2.5.22.0','9.9.9.0')),[Text.UTF8Encoding]::new($false))
+        $manifestPath = Join-Path $fixtureRoot 'src\portable\CodexRemote.Portable.manifest'
+        [IO.File]::WriteAllText($manifestPath,([IO.File]::ReadAllText($manifestPath,[Text.UTF8Encoding]::new($false)).Replace('2.5.22.0','9.9.9.0')),[Text.UTF8Encoding]::new($false))
+        $falseVersion = $baselineJson | ConvertFrom-Json
+        $falseVersion.version = '9.9.9'
+        @($falseVersion.sourceFiles | Where-Object { $_.name -ceq 'AssemblyInfo.cs' })[0].sha256 = Get-CcodTestFileSha256 -Path $assemblyPath
+        $falseVersion.manifestSha256 = Get-CcodTestFileSha256 -Path $manifestPath
+        [IO.File]::WriteAllText($provenancePath,($falseVersion | ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows { Test-CcodPortableLauncherArtifact -RepositoryRoot $fixtureRoot -Version '9.9.9' -ArtifactDirectory $artifact -ExpectedGitCommit $currentCommit | Out-Null } 'CCOD_PORTABLE_LAUNCHER_ARTIFACT_VERSION_INVALID'
     } finally {
         if (Test-Path -LiteralPath $artifact) { Remove-Item -LiteralPath $artifact -Recurse -Force -ErrorAction SilentlyContinue }
+        if (Test-Path -LiteralPath $fixtureRoot) { Remove-Item -LiteralPath $fixtureRoot -Recurse -Force -ErrorAction SilentlyContinue }
     }
 }
 
diff --git a/tools/New-GitHubReleaseNotes.ps1 b/tools/New-GitHubReleaseNotes.ps1
index 3856a76..62cc90a 100644
--- a/tools/New-GitHubReleaseNotes.ps1
+++ b/tools/New-GitHubReleaseNotes.ps1
@@ -38,7 +38,7 @@ if ([string]::IsNullOrWhiteSpace($english)) {
 }
 
 $version = $Tag.Substring(1)
-$notes = "# CodexRemote-fix $version`n`n$english`n"
+$notes = "$english`n"
 [IO.File]::WriteAllText($output,$notes,[Text.UTF8Encoding]::new($false))
 
 [pscustomobject][ordered]@{

From f437d501feacc6ac7bf769842ace1a4be374ede5 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 14:13:44 +0800
Subject: [PATCH 048/187] test: normalize release notes fixture line endings

---
 .../task-5-report.md                          | 34 +++++++++++++++++++
 .../persistence/ReleaseWorkflow.SelfTest.ps1  |  3 +-
 2 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
index 7e60ba7..72b3607 100644
--- a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
+++ b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
@@ -274,3 +274,37 @@ ReleaseWorkflow.SelfTest.ps1
 No formal release build, installer execution, install, publish, push, tag,
 signing, or real Codex/UI operation was performed in this fix round. The final
 fresh clean release build remains gated on scoped independent re-review.
+
+## Fix round 2 — CRLF-stable release-note fixture
+
+Final-candidate validation on a clean CRLF checkout exposed a test portability
+defect. The fixture already contained CRLF, but the test blindly replaced every
+LF with CRLF, producing CRCRLF. The real extractor then correctly rejected the
+malformed heading boundary:
+
+```text
+ReleaseWorkflow.SelfTest.ps1
+exit 1
+CCOD_RELEASE_NOTES_RELEASE_SECTION_INVALID
+```
+
+A focused local reproduction independently confirmed the old expression:
+
+```text
+CRCRLF_REPRODUCED=True
+```
+
+The fixture now normalizes CRLF and lone CR to LF before converting LF to CRLF.
+This preserves the intended CRLF-input coverage on LF, CRLF, and mixed-line-
+ending checkouts without changing production extraction behavior.
+
+Fresh GREEN evidence:
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+exit 0
+Release workflow self-tests passed.
+```
+
+No build, installer execution, install, publish, push, tag, or signing occurred
+in this fix round.
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 91a6664..91dd6eb 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -1746,7 +1746,8 @@ Invoke-CcodTest 'release notes extraction emits only the target release English
 
 - OLDER_DECOY
 '@
-        [IO.File]::WriteAllText($changelogPath,$fixture.Replace("`n","`r`n"),[Text.UTF8Encoding]::new($false))
+        $fixtureCrlf = $fixture.Replace("`r`n","`n").Replace("`r","`n").Replace("`n","`r`n")
+        [IO.File]::WriteAllText($changelogPath,$fixtureCrlf,[Text.UTF8Encoding]::new($false))
         & (Join-Path $repositoryRoot 'tools\New-GitHubReleaseNotes.ps1') -ChangelogPath $changelogPath -Tag 'v2.5.22' -OutputPath $notesPath | Out-Null
         $actual = [IO.File]::ReadAllText($notesPath,[Text.UTF8Encoding]::new($false))
         Assert-CcodEqual "- Target English note.`n- Second target English note.`n" $actual 'release body contains exactly the current target English notes'

From 31fd365612db30a19398668c0a7b119555ddb5dd Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 14:34:48 +0800
Subject: [PATCH 049/187] test: update v2.5.22 release branding contract

---
 .../task-5-report.md                          | 32 +++++++++++++++++++
 .../persistence/InstallLifecycle.SelfTest.ps1 | 25 +++++++++++----
 2 files changed, 51 insertions(+), 6 deletions(-)

diff --git a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
index 72b3607..f883720 100644
--- a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
+++ b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
@@ -308,3 +308,35 @@ Release workflow self-tests passed.
 
 No build, installer execution, install, publish, push, tag, or signing occurred
 in this fix round.
+
+## Fix round 3 — current portable branding regression
+
+The final controlled isolated `npm test` reached
+`InstallLifecycle.SelfTest.ps1:2942` and produced the expected RED in
+`README and release workflow publish current portable-release branding`. The
+release-coupled regression still required v2.5.21 setup/ZIP names at lines
+2949/2950/2957/2958 and the retired inline
+`englishSection = [regex]::Match` implementation at lines 2971/2972.
+
+The regression now requires the v2.5.22 setup and portable asset names in both
+Quick Start sections. It preserves the public GitHub release title assertion,
+requires workflow use of `tools\New-GitHubReleaseNotes.ps1`, and rejects a
+second inline English extractor. The missing-English boundary is exercised
+against the real tool with a controlled changelog and requires
+`CCOD_RELEASE_NOTES_ENGLISH_SECTION_INVALID` with no notes output.
+
+Local bounded verification:
+
+```text
+PowerShell AST parse of InstallLifecycle.SelfTest.ps1
+  exit 0
+
+git diff --check
+  exit 0
+```
+
+The local full InstallLifecycle suite was not represented as GREEN because the
+normal desktop environment retains the earlier real-Supervisor lifecycle mutex
+boundary. The parent will rerun the controlled isolated aggregate after scoped
+re-review. No build, installer execution, install, publish, push, tag, release,
+or signing occurred in this fix round.
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index a7e7c94..538a5bd 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -2946,16 +2946,16 @@ $results += Invoke-CcodTest 'README and release workflow publish current portabl
     Assert-CcodTrue ($readmeChinese -cmatch '\A(?s:<div align="center">.*?<h1>CodexRemote-fix</h1>)') 'Chinese README uses the centered public product heading'
 
     $quickStart = [regex]::Match($readme, '(?ms)^## Quick start[^\r\n]*\r?\n(.*?)(?=^## )').Groups[1].Value
-    Assert-CcodTrue ($quickStart -cmatch 'CodexRemote-fix-2\.5\.21-setup\.exe') 'English Quick Start names the setup installer'
-    Assert-CcodTrue ($quickStart -cmatch 'CodexRemote-fix-2\.5\.21-windows-x64\.zip') 'English Quick Start names the exact portable artifact'
+    Assert-CcodTrue ($quickStart -cmatch 'CodexRemote-fix-2\.5\.22-setup\.exe') 'English Quick Start names the setup installer'
+    Assert-CcodTrue ($quickStart -cmatch 'CodexRemote-fix-2\.5\.22-windows-x64\.zip') 'English Quick Start names the exact portable artifact'
     Assert-CcodTrue ($quickStart -cmatch 'CodexRemote-fix\.exe') 'English Quick Start names the portable double-click entrypoint'
     Assert-CcodTrue ($quickStart -cmatch '\.sha256\.txt') 'English Quick Start names the checksum artifact'
 
     $quickStartChineseMatch = [regex]::Match($readmeChinese, '(?ms)^## [^\r\n]+\r?\n(?:\r?\n)?(?=1\.[^\r\n]*\[Releases\])(.*?)(?=^## |\z)')
     Assert-CcodTrue $quickStartChineseMatch.Success 'Chinese README exposes a Quick Start section'
     $quickStartChinese = $quickStartChineseMatch.Groups[1].Value
-    Assert-CcodTrue ($quickStartChinese -cmatch 'CodexRemote-fix-2\.5\.21-setup\.exe') 'Chinese Quick Start names the setup installer'
-    Assert-CcodTrue ($quickStartChinese -cmatch 'CodexRemote-fix-2\.5\.21-windows-x64\.zip') 'Chinese Quick Start names the exact portable artifact'
+    Assert-CcodTrue ($quickStartChinese -cmatch 'CodexRemote-fix-2\.5\.22-setup\.exe') 'Chinese Quick Start names the setup installer'
+    Assert-CcodTrue ($quickStartChinese -cmatch 'CodexRemote-fix-2\.5\.22-windows-x64\.zip') 'Chinese Quick Start names the exact portable artifact'
     Assert-CcodTrue ($quickStartChinese -cmatch 'CodexRemote-fix\.exe') 'Chinese Quick Start names the portable double-click entrypoint'
     Assert-CcodTrue ($quickStartChinese -cmatch '\.sha256\.txt') 'Chinese Quick Start names the checksum artifact'
 
@@ -2968,8 +2968,21 @@ $results += Invoke-CcodTest 'README and release workflow publish current portabl
     Assert-CcodTrue ($workflow -cmatch '(?m)^name: CodexRemote-fix release\r?$') 'release workflow uses public product branding'
     Assert-CcodTrue ($workflow -cmatch '(?m)^\s+name: CodexRemote-fix portable bundle\r?$') 'uploaded artifact uses public portable bundle branding'
     Assert-CcodTrue ($workflow -cmatch '--title "CodexRemote-fix \$version"') 'GitHub release title uses public product branding'
-    Assert-CcodTrue ($workflow -cmatch 'englishSection = \[regex\]::Match') 'GitHub release notes extract the English changelog section only'
-    Assert-CcodTrue ($workflow -cmatch 'has no English release section') 'release fails clearly when the English changelog section is missing'
+    Assert-CcodTrue ($workflow -cmatch 'tools\\New-GitHubReleaseNotes\.ps1''\) -ChangelogPath .*? -Tag \$tag -OutputPath \$notesPath') 'GitHub release notes use the behavior-tested target-English extractor'
+    Assert-CcodTrue ($workflow -cnotmatch 'englishSection\s*=\s*\[regex\]::Match') 'release workflow does not retain a second inline English extractor'
+    $notesTool = Join-Path $repositoryRoot 'tools\New-GitHubReleaseNotes.ps1'
+    Assert-CcodTrue (Test-Path -LiteralPath $notesTool -PathType Leaf) 'behavior-tested GitHub release notes extractor exists'
+    $notesFixtureRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-install-release-notes-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($notesFixtureRoot) | Out-Null
+        $missingEnglishChangelog = Join-Path $notesFixtureRoot 'CHANGELOG.md'
+        $notesOutput = Join-Path $notesFixtureRoot 'notes.md'
+        [IO.File]::WriteAllText($missingEnglishChangelog,"## v2.5.22`r`n`r`n### Simplified Chinese`r`n`r`n- fixture`r`n",[Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows { & $notesTool -ChangelogPath $missingEnglishChangelog -Tag 'v2.5.22' -OutputPath $notesOutput | Out-Null } 'CCOD_RELEASE_NOTES_ENGLISH_SECTION_INVALID'
+        Assert-CcodTrue (-not (Test-Path -LiteralPath $notesOutput)) 'missing English notes cannot create a GitHub release body'
+    } finally {
+        if (Test-Path -LiteralPath $notesFixtureRoot) { Remove-Item -LiteralPath $notesFixtureRoot -Recurse -Force -ErrorAction SilentlyContinue }
+    }
 }
 
 $results += Invoke-CcodTest 'installer carries the Inno contract needed by its self-validation' {

From cb36d0ba202724c6c9bb223d94dc3ce838f45f9e Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 15:08:58 +0800
Subject: [PATCH 050/187] test: expose activation payload byte swap

---
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 155 +++++++++++++++++-
 1 file changed, 153 insertions(+), 2 deletions(-)

diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 91dd6eb..3fa3cea 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -1035,8 +1035,39 @@ function New-CcodActivationPayloadFixture {
     $payloadRoot = Join-Path $appRoot "payload\$Version"
     [IO.Directory]::CreateDirectory((Join-Path $payloadRoot 'src\persistence\modules')) | Out-Null
     [IO.File]::WriteAllText((Join-Path $payloadRoot 'package.json'),([ordered]@{name='fixture';version=$Version}|ConvertTo-Json),[Text.UTF8Encoding]::new($false))
-    [IO.File]::WriteAllText((Join-Path $payloadRoot 'Install-CodexControlOtherDevices.ps1'),'exit 0',[Text.UTF8Encoding]::new($false))
-    [IO.File]::WriteAllText((Join-Path $payloadRoot 'src\persistence\modules\InstallLifecycle.psm1'),'function Get-CcodLifecyclePayloadManifestFiles { @() }',[Text.UTF8Encoding]::new($false))
+    $installSource = @'
+param(
+    [string]$InstallRoot,
+    [switch]$EnableCandidateCompatibleUpdates,
+    [string]$ActivationId,
+    [string]$ExpectedVersion,
+    [string]$PayloadManifestPath,
+    [string]$ExpectedPayloadManifestSha256
+)
+$manifest = [IO.File]::ReadAllText($PayloadManifestPath,[Text.Encoding]::UTF8) | ConvertFrom-Json
+Import-Module (Join-Path $PSScriptRoot 'src\persistence\modules\InstallLifecycle.psm1') -Force
+Invoke-CcodFixtureInstall -InstallRoot $InstallRoot -ActivationId $ActivationId -ManifestVersion ([string]$manifest.projectVersion)
+exit 0
+'@
+    [IO.File]::WriteAllText((Join-Path $payloadRoot 'Install-CodexControlOtherDevices.ps1'),$installSource,[Text.UTF8Encoding]::new($false))
+    $lifecycleSource = @'
+function Invoke-CcodFixtureInstall {
+    param([string]$InstallRoot,[string]$ActivationId,[string]$ManifestVersion)
+    [IO.Directory]::CreateDirectory((Join-Path $InstallRoot 'state')) | Out-Null
+    [IO.File]::WriteAllText((Join-Path $InstallRoot 'activation-byte-marker.txt'),('original:' + $ManifestVersion),[Text.UTF8Encoding]::new($false))
+    [IO.File]::WriteAllText((Join-Path $InstallRoot 'active.json'),'{"activeRuntime":"runtime-fixture"}',[Text.UTF8Encoding]::new($false))
+    $receipt=[ordered]@{schemaVersion=1;activationId=$ActivationId;phase='Ready';runtimeId='runtime-fixture';previousRuntimeId=$null;startedAtUtc='2030-02-03T04:05:06.0000000Z';updatedAtUtc='2030-02-03T04:05:07.0000000Z';ready=$true;errorCode=$null}
+    [IO.File]::WriteAllText((Join-Path $InstallRoot 'state\post-install-activation.json'),($receipt|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
+}
+Export-ModuleMember -Function Invoke-CcodFixtureInstall
+'@
+    [IO.File]::WriteAllText((Join-Path $payloadRoot 'src\persistence\modules\InstallLifecycle.psm1'),$lifecycleSource,[Text.UTF8Encoding]::new($false))
+    $runtimeManifestSource = @"
+function Read-CcodActiveRuntime { param([string]`$InstallRoot) Get-Content -LiteralPath (Join-Path `$InstallRoot 'active.json') -Raw | ConvertFrom-Json }
+function Test-CcodRuntimeManifest { param([string]`$RuntimeDirectory,[string]`$ExpectedRuntimeId) [pscustomobject]@{Valid=`$true;Manifest=[pscustomobject]@{projectVersion='$Version'}} }
+Export-ModuleMember -Function Read-CcodActiveRuntime,Test-CcodRuntimeManifest
+"@
+    [IO.File]::WriteAllText((Join-Path $payloadRoot 'src\persistence\modules\RuntimeManifest.psm1'),$runtimeManifestSource,[Text.UTF8Encoding]::new($false))
     $records = [Collections.Generic.List[object]]::new()
     foreach ($file in @(Get-ChildItem -LiteralPath $payloadRoot -File -Force -Recurse)) {
         $relative = $file.FullName.Substring($payloadRoot.TrimEnd('\').Length + 1).Replace('\','/')
@@ -1049,6 +1080,48 @@ function New-CcodActivationPayloadFixture {
     return [pscustomobject]@{AppRoot=$appRoot;PayloadRoot=$payloadRoot;ManifestPath=$manifestPath;ManifestSha256=Get-CcodTestFileSha256 -Path $manifestPath}
 }
 
+function New-CcodActivationBarrierHost {
+    param(
+        [Parameter(Mandatory)][string]$OutputDirectory,
+        [Parameter(Mandatory)][string]$ReadyPath,
+        [Parameter(Mandatory)][string]$ContinuePath,
+        [Parameter(Mandatory)][string]$RealPowerShellPath
+    )
+
+    [IO.Directory]::CreateDirectory($OutputDirectory) | Out-Null
+    $outputPath = Join-Path $OutputDirectory 'powershell.exe'
+    $source = @"
+using System;
+using System.Diagnostics;
+using System.IO;
+using System.Text;
+using System.Threading;
+public static class Program {
+  private static string Quote(string value) {
+    var result = new StringBuilder(); result.Append((char)34); int slashes = 0;
+    foreach (char character in value) {
+      if (character == (char)92) { slashes++; continue; }
+      if (character == (char)34) { result.Append(new string((char)92, (slashes * 2) + 1)); result.Append((char)34); slashes = 0; continue; }
+      if (slashes > 0) { result.Append(new string((char)92, slashes)); slashes = 0; }
+      result.Append(character);
+    }
+    if (slashes > 0) result.Append(new string((char)92, slashes * 2));
+    result.Append((char)34); return result.ToString();
+  }
+  public static int Main(string[] args) {
+    File.WriteAllText(@"$($ReadyPath.Replace('"','""'))", "ready", new UTF8Encoding(false));
+    var deadline = DateTime.UtcNow.AddSeconds(30);
+    while (!File.Exists(@"$($ContinuePath.Replace('"','""'))")) { if (DateTime.UtcNow >= deadline) return 124; Thread.Sleep(10); }
+    var info = new ProcessStartInfo(@"$($RealPowerShellPath.Replace('"','""'))", String.Join(" ", Array.ConvertAll(args, Quote)));
+    info.UseShellExecute = false; info.CreateNoWindow = true;
+    using (var process = Process.Start(info)) { process.WaitForExit(); return process.ExitCode; }
+  }
+}
+"@
+    Add-Type -TypeDefinition $source -Language CSharp -OutputAssembly $outputPath -OutputType ConsoleApplication
+    return $outputPath
+}
+
 function Invoke-CcodActivationVerifierFixture {
     param([Parameter(Mandatory)]$Fixture,[Parameter(Mandatory)][string]$ExpectedManifestSha256,[string]$PayloadRoot)
 
@@ -1141,6 +1214,84 @@ Invoke-CcodTest 'setup build and activation bind one immutable versioned payload
     Assert-CcodTrue ($installer -cmatch '\[string\]\$ExpectedVersion' -and $installer -cmatch '\[string\]\$PayloadManifestPath' -and $installer -cmatch '-ExpectedVersion\s+\$ExpectedVersion' -and $installer -cmatch '-PayloadManifestPath\s+\$PayloadManifestPath') 'installer forwards the immutable payload contract to lifecycle activation'
 }
 
+# Production mutation caught: reopening mutable payload paths after the parent accepted their manifest bytes.
+Invoke-CcodTest 'activation executes only the verified manifest installer and module bytes across the child-launch barrier' {
+    $fixture = New-CcodActivationPayloadFixture
+    $barrierRoot = Join-Path $fixture.AppRoot 'barrier-host'
+    $readyPath = Join-Path $fixture.AppRoot 'child-launch.ready'
+    $continuePath = Join-Path $fixture.AppRoot 'child-launch.continue'
+    $stdoutPath = Join-Path $fixture.AppRoot 'activation.stdout'
+    $stderrPath = Join-Path $fixture.AppRoot 'activation.stderr'
+    $process = $null
+    try {
+        $realPowerShell = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+        $null = New-CcodActivationBarrierHost -OutputDirectory $barrierRoot -ReadyPath $readyPath -ContinuePath $continuePath -RealPowerShellPath $realPowerShell
+        $activationId = '77777777-6666-5555-4444-333333333333'
+        $arguments = @(
+            '-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass','-File',(Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1'),
+            '-AppRoot',$fixture.AppRoot,'-InstallRoot',$fixture.AppRoot,'-PayloadRoot',$fixture.PayloadRoot,
+            '-ExpectedVersion','2.5.22','-ExpectedPayloadManifestSha256',$fixture.ManifestSha256,'-ActivationId',$activationId,
+            '-FirstReceiptTimeoutMilliseconds','30000','-ActivationTimeoutMilliseconds','30000'
+        )
+        $startInfo = [Diagnostics.ProcessStartInfo]::new()
+        $startInfo.FileName = $realPowerShell
+        $startInfo.Arguments = (($arguments | ForEach-Object { '"' + ([string]$_).Replace('\','\').Replace('"','\"') + '"' }) -join ' ')
+        $startInfo.UseShellExecute = $false
+        $startInfo.CreateNoWindow = $true
+        $startInfo.RedirectStandardOutput = $true
+        $startInfo.RedirectStandardError = $true
+        $startInfo.EnvironmentVariables['PATH'] = $barrierRoot + ';' + $env:PATH
+        $process = [Diagnostics.Process]::new()
+        $process.StartInfo = $startInfo
+        Assert-CcodTrue $process.Start() 'activation fixture process starts'
+
+        $deadline = [DateTime]::UtcNow.AddSeconds(30)
+        while (-not [IO.File]::Exists($readyPath) -and [DateTime]::UtcNow -lt $deadline -and -not $process.HasExited) {
+            [Threading.Thread]::Sleep(10)
+        }
+        Assert-CcodTrue ([IO.File]::Exists($readyPath)) 'barrier proves parent payload verification completed before child execution'
+
+        $replacementInstallerMarker = Join-Path $fixture.AppRoot 'replacement-installer-executed.txt'
+        $replacementInstaller = @"
+param([string]`$InstallRoot,[switch]`$EnableCandidateCompatibleUpdates,[string]`$ActivationId,[string]`$ExpectedVersion,[string]`$PayloadManifestPath,[string]`$ExpectedPayloadManifestSha256)
+[IO.File]::WriteAllText('$($replacementInstallerMarker.Replace("'","''"))','executed',[Text.UTF8Encoding]::new(`$false))
+`$manifest=[IO.File]::ReadAllText(`$PayloadManifestPath,[Text.Encoding]::UTF8)|ConvertFrom-Json
+Import-Module (Join-Path `$PSScriptRoot 'src\persistence\modules\InstallLifecycle.psm1') -Force
+Invoke-CcodFixtureInstall -InstallRoot `$InstallRoot -ActivationId `$ActivationId -ManifestVersion ([string]`$manifest.projectVersion)
+exit 0
+"@
+        [IO.File]::WriteAllText((Join-Path $fixture.PayloadRoot 'Install-CodexControlOtherDevices.ps1'),$replacementInstaller,[Text.UTF8Encoding]::new($false))
+        $replacementModule = @'
+function Invoke-CcodFixtureInstall {
+    param([string]$InstallRoot,[string]$ActivationId,[string]$ManifestVersion)
+    [IO.Directory]::CreateDirectory((Join-Path $InstallRoot 'state')) | Out-Null
+    [IO.File]::WriteAllText((Join-Path $InstallRoot 'activation-byte-marker.txt'),('replacement:' + $ManifestVersion),[Text.UTF8Encoding]::new($false))
+    [IO.File]::WriteAllText((Join-Path $InstallRoot 'active.json'),'{"activeRuntime":"runtime-fixture"}',[Text.UTF8Encoding]::new($false))
+    $receipt=[ordered]@{schemaVersion=1;activationId=$ActivationId;phase='Ready';runtimeId='runtime-fixture';previousRuntimeId=$null;startedAtUtc='2030-02-03T04:05:06.0000000Z';updatedAtUtc='2030-02-03T04:05:07.0000000Z';ready=$true;errorCode=$null}
+    [IO.File]::WriteAllText((Join-Path $InstallRoot 'state\post-install-activation.json'),($receipt|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
+}
+Export-ModuleMember -Function Invoke-CcodFixtureInstall
+'@
+        [IO.File]::WriteAllText((Join-Path $fixture.PayloadRoot 'src\persistence\modules\InstallLifecycle.psm1'),$replacementModule,[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($fixture.ManifestPath,'{"schemaVersion":1,"projectVersion":"9.9.9","files":[]}',[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($continuePath,'continue',[Text.UTF8Encoding]::new($false))
+
+        Assert-CcodTrue $process.WaitForExit(30000) 'activation fixture finishes within the bounded child deadline'
+        $stdout = $process.StandardOutput.ReadToEnd()
+        $stderr = $process.StandardError.ReadToEnd()
+        Assert-CcodEqual 0 ([int]$process.ExitCode) "verified fixture activation succeeds: $stdout $stderr"
+        Assert-CcodEqual 'original:2.5.22' ([IO.File]::ReadAllText((Join-Path $fixture.AppRoot 'activation-byte-marker.txt'),[Text.UTF8Encoding]::new($false))) 'child executes and parses only the original verified bytes'
+        Assert-CcodTrue (-not [IO.File]::Exists($replacementInstallerMarker)) 'post-verification installer replacement never executes'
+        Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $fixture.AppRoot 'active.json.tmp'))) 'rejection or success leaves no uncommitted pointer sidecar'
+    } finally {
+        if ($null -ne $process) {
+            try { if (-not $process.HasExited) { $process.Kill(); [void]$process.WaitForExit(5000) } } catch { }
+            $process.Dispose()
+        }
+        if (Test-Path -LiteralPath $fixture.AppRoot) { Remove-Item -LiteralPath $fixture.AppRoot -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
 Invoke-CcodTest 'activation accepts a compile-bound installer manifest hash before payload verification' {
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-activation-hash-interface-' + [guid]::NewGuid().ToString('N'))
     try {

From ed782ecadc005b60822d9fac745a2292ffab6e24 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 15:23:42 +0800
Subject: [PATCH 051/187] fix: seal activation bytes and reject linked leaves

---
 Activate-CcodRemoteFix.ps1                    | 223 +++++++++++++-----
 Install-CodexControlOtherDevices.ps1          | 169 ++++++++++++-
 build/CodexControlOtherDevices.iss            |  97 ++++++++
 src/persistence/modules/InstallLifecycle.psm1 | 168 +++++++++++--
 .../persistence/InstallLifecycle.SelfTest.ps1 |  66 +++++-
 .../persistence/ReleaseWorkflow.SelfTest.ps1  |  65 ++++-
 6 files changed, 686 insertions(+), 102 deletions(-)

diff --git a/Activate-CcodRemoteFix.ps1 b/Activate-CcodRemoteFix.ps1
index bebd91a..536f0df 100644
--- a/Activate-CcodRemoteFix.ps1
+++ b/Activate-CcodRemoteFix.ps1
@@ -54,19 +54,38 @@ function Write-CcodActivationRecord {
     } catch { }
 }
 
-function Get-CcodActivationFileSha256 {
-    param([Parameter(Mandatory)][string]$Path)
+function Get-CcodActivationBytesSha256 {
+    param([Parameter(Mandatory)][byte[]]$Bytes)
     $sha = [Security.Cryptography.SHA256]::Create()
-    $stream = $null
     try {
-        $stream = [IO.File]::Open([IO.Path]::GetFullPath($Path),[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read)
-        return [BitConverter]::ToString($sha.ComputeHash($stream)).Replace('-','').ToLowerInvariant()
+        return [BitConverter]::ToString($sha.ComputeHash($Bytes)).Replace('-','').ToLowerInvariant()
     } finally {
-        if ($null -ne $stream) { $stream.Dispose() }
         $sha.Dispose()
     }
 }
 
+function Open-CcodActivationLockedBytes {
+    param(
+        [Parameter(Mandatory)][string]$Path,
+        [ValidateRange(1,268435456)][int64]$MaximumBytes = 268435456
+    )
+
+    $full = [IO.Path]::GetFullPath($Path)
+    $stream = [IO.File]::Open($full,[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read)
+    try {
+        if ($stream.Length -lt 0 -or $stream.Length -gt $MaximumBytes) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+        $memory = [IO.MemoryStream]::new()
+        try {
+            $stream.CopyTo($memory)
+            $bytes = $memory.ToArray()
+        } finally { $memory.Dispose() }
+        return [pscustomobject]@{ Path=$full; Stream=$stream; Bytes=$bytes }
+    } catch {
+        $stream.Dispose()
+        throw
+    }
+}
+
 function Assert-CcodActivationNonReparsePath {
     param([Parameter(Mandatory)][string]$Root,[Parameter(Mandatory)][string]$Path)
     $canonicalRoot = [IO.Path]::GetFullPath($Root).TrimEnd('\')
@@ -99,7 +118,32 @@ function Test-CcodActivationAlternateDataStreams {
     }
 }
 
-function Assert-CcodActivationPayload {
+function Remove-CcodActivationPayloadStage {
+    param([Parameter(Mandatory)][string]$AppRoot,[Parameter(Mandatory)][string]$StageRoot)
+    if (-not [IO.Directory]::Exists($StageRoot)) { return }
+    $app = [IO.Path]::GetFullPath($AppRoot).TrimEnd('\')
+    $stage = [IO.Path]::GetFullPath($StageRoot).TrimEnd('\')
+    $prefix = $app + '\'
+    if (-not $stage.StartsWith($prefix,[StringComparison]::OrdinalIgnoreCase) -or
+        [IO.Path]::GetFileName($stage) -cnotmatch '^\.activation-payload-stage-[0-9a-f]{32}$') { return }
+    foreach ($item in @(Get-ChildItem -LiteralPath $stage -Force -Recurse -ErrorAction SilentlyContinue)) {
+        if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { return }
+    }
+    $stageItem = Get-Item -LiteralPath $stage -Force -ErrorAction SilentlyContinue
+    if ($null -eq $stageItem -or ($stageItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { return }
+    Remove-Item -LiteralPath $stage -Recurse -Force -ErrorAction SilentlyContinue
+}
+
+function Close-CcodActivationPayloadSeal {
+    param($Seal)
+    if ($null -eq $Seal) { return }
+    foreach ($stream in @($Seal.Streams)) {
+        if ($null -ne $stream) { try { $stream.Dispose() } catch { } }
+    }
+    Remove-CcodActivationPayloadStage -AppRoot $Seal.AppRoot -StageRoot $Seal.StageRoot
+}
+
+function New-CcodActivationPayloadSeal {
     param(
         [Parameter(Mandatory)][string]$AppRoot,
         [Parameter(Mandatory)][string]$Root,
@@ -122,59 +166,99 @@ function Assert-CcodActivationPayload {
         throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID'
     }
     [void](Assert-CcodActivationNonReparsePath -Root $payload -Path $manifestPath)
-    $manifestItem = Get-Item -LiteralPath $manifestPath -Force -ErrorAction Stop
-    if ($manifestItem.PSIsContainer -or $manifestItem.Length -le 0 -or $manifestItem.Length -gt 4194304 -or
-        (Test-CcodActivationAlternateDataStreams -Path $manifestPath) -or
-        (Get-CcodActivationFileSha256 -Path $manifestPath) -cne $ExpectedManifestSha256) {
-        throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID'
-    }
+    $sourceLocks = [Collections.Generic.List[object]]::new()
+    $stageLocks = [Collections.Generic.List[object]]::new()
+    $stageRoot = Join-Path $app ('.activation-payload-stage-' + [guid]::NewGuid().ToString('N'))
     try {
-        $manifest = [IO.File]::ReadAllText($manifestPath,[Text.Encoding]::UTF8) | ConvertFrom-Json -ErrorAction Stop
-    } catch { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
-    $properties = @($manifest.PSObject.Properties.Name)
-    $expectedProperties = @('schemaVersion','projectVersion','files')
-    if ($manifest -isnot [pscustomobject] -or $properties.Count -ne $expectedProperties.Count) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
-    for ($index=0;$index-lt$expectedProperties.Count;$index++) {
-        if ($properties[$index] -cne $expectedProperties[$index]) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
-    }
-    if ($manifest.schemaVersion -isnot [int] -or $manifest.schemaVersion -ne 1 -or $manifest.projectVersion -isnot [string] -or $manifest.projectVersion -cne $Version) {
-        throw 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH'
-    }
-    $records = @($manifest.files)
-    if ($records.Count -eq 0) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
-    $seen = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
-    $previous = $null
-    foreach ($record in $records) {
-        $recordProperties = @($record.PSObject.Properties.Name)
-        if ($record -isnot [pscustomobject] -or $recordProperties.Count -ne 3 -or $recordProperties[0] -cne 'path' -or $recordProperties[1] -cne 'length' -or $recordProperties[2] -cne 'sha256' -or
-            $record.path -isnot [string] -or $record.path -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$' -or $record.path.Contains('//') -or $record.path.Contains('..') -or $record.path.Contains(':') -or $record.path.Contains('\') -or
-            $record.length -isnot [ValueType] -or [decimal]$record.length -ne [decimal][int64]$record.length -or [int64]$record.length -lt 0 -or
-            $record.sha256 -isnot [string] -or $record.sha256 -cnotmatch '^[0-9a-f]{64}$') { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
-        if (($null-ne$previous -and [StringComparer]::Ordinal.Compare([string]$previous,[string]$record.path)-ge 0) -or -not $seen.Add([string]$record.path)) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
-        $previous = [string]$record.path
-        $source = [IO.Path]::GetFullPath((Join-Path $payload ($record.path.Replace('/','\'))))
-        [void](Assert-CcodActivationNonReparsePath -Root $payload -Path $source)
-        $item = Get-Item -LiteralPath $source -Force -ErrorAction Stop
-        if ($item.PSIsContainer -or (Test-CcodActivationAlternateDataStreams -Path $source) -or [int64]$item.Length -ne [int64]$record.length -or
-            (Get-CcodActivationFileSha256 -Path $source) -cne [string]$record.sha256) { throw 'CCOD_INSTALL_FILE_HASH_MISMATCH' }
-    }
-    $actualFileList = [Collections.Generic.List[string]]::new()
-    foreach ($actualItem in @(Get-ChildItem -LiteralPath $payload -Force -Recurse -ErrorAction Stop)) {
-        if (($actualItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'CCOD_INSTALL_SOURCE_REPARSE' }
-        if ($actualItem.PSIsContainer -or $actualItem.FullName.Equals($manifestPath,[StringComparison]::OrdinalIgnoreCase)) { continue }
-        $actualFileList.Add($actualItem.FullName.Substring($payload.Length + 1).Replace('\','/'))
-    }
-    $actualFiles = @($actualFileList)
-    if ($actualFiles.Count -ne $records.Count) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
-    foreach ($actual in $actualFiles) {
-        if (-not $seen.Contains([string]$actual)) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
-    }
-    try { $package = [IO.File]::ReadAllText($packagePath,[Text.Encoding]::UTF8) | ConvertFrom-Json -ErrorAction Stop }
-    catch { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
-    if ($package.version -isnot [string] -or [string]$package.version -cne $Version) {
-        throw 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH'
+        $manifestLock = Open-CcodActivationLockedBytes -Path $manifestPath -MaximumBytes 4194304
+        $sourceLocks.Add($manifestLock)
+        $manifestItem = Get-Item -LiteralPath $manifestPath -Force -ErrorAction Stop
+        if ($manifestItem.PSIsContainer -or $manifestLock.Bytes.Length -le 0 -or
+            (Test-CcodActivationAlternateDataStreams -Path $manifestPath) -or
+            (Get-CcodActivationBytesSha256 -Bytes $manifestLock.Bytes) -cne $ExpectedManifestSha256) {
+            throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID'
+        }
+        try {
+            $manifestText = [Text.UTF8Encoding]::new($false,$true).GetString($manifestLock.Bytes)
+            $manifest = $manifestText | ConvertFrom-Json -ErrorAction Stop
+        } catch { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+        $properties = @($manifest.PSObject.Properties.Name)
+        $expectedProperties = @('schemaVersion','projectVersion','files')
+        if ($manifest -isnot [pscustomobject] -or $properties.Count -ne $expectedProperties.Count) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+        for ($index=0;$index-lt$expectedProperties.Count;$index++) {
+            if ($properties[$index] -cne $expectedProperties[$index]) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+        }
+        if ($manifest.schemaVersion -isnot [int] -or $manifest.schemaVersion -ne 1 -or $manifest.projectVersion -isnot [string] -or $manifest.projectVersion -cne $Version) {
+            throw 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH'
+        }
+        $records = @($manifest.files)
+        if ($records.Count -eq 0) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+        $seen = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+        $snapshots = [Collections.Generic.List[object]]::new()
+        $previous = $null
+        foreach ($record in $records) {
+            $recordProperties = @($record.PSObject.Properties.Name)
+            if ($record -isnot [pscustomobject] -or $recordProperties.Count -ne 3 -or $recordProperties[0] -cne 'path' -or $recordProperties[1] -cne 'length' -or $recordProperties[2] -cne 'sha256' -or
+                $record.path -isnot [string] -or $record.path -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$' -or $record.path.Contains('//') -or $record.path.Contains('..') -or $record.path.Contains(':') -or $record.path.Contains('\') -or
+                $record.length -isnot [ValueType] -or [decimal]$record.length -ne [decimal][int64]$record.length -or [int64]$record.length -lt 0 -or
+                $record.sha256 -isnot [string] -or $record.sha256 -cnotmatch '^[0-9a-f]{64}$') { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+            if (($null-ne$previous -and [StringComparer]::Ordinal.Compare([string]$previous,[string]$record.path)-ge 0) -or -not $seen.Add([string]$record.path)) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+            $previous = [string]$record.path
+            $source = [IO.Path]::GetFullPath((Join-Path $payload ($record.path.Replace('/','\'))))
+            [void](Assert-CcodActivationNonReparsePath -Root $payload -Path $source)
+            $locked = Open-CcodActivationLockedBytes -Path $source
+            $sourceLocks.Add($locked)
+            $item = Get-Item -LiteralPath $source -Force -ErrorAction Stop
+            if ($item.PSIsContainer -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0 -or
+                (Test-CcodActivationAlternateDataStreams -Path $source) -or [int64]$locked.Bytes.Length -ne [int64]$record.length -or
+                (Get-CcodActivationBytesSha256 -Bytes $locked.Bytes) -cne [string]$record.sha256) { throw 'CCOD_INSTALL_FILE_HASH_MISMATCH' }
+            $snapshots.Add([pscustomobject]@{ Relative=[string]$record.path; Bytes=$locked.Bytes; Sha256=[string]$record.sha256 })
+        }
+        foreach ($required in @('package.json','Install-CodexControlOtherDevices.ps1','src/persistence/modules/InstallLifecycle.psm1','src/persistence/modules/RuntimeManifest.psm1')) {
+            if (-not $seen.Contains($required)) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+        }
+        $actualFileList = [Collections.Generic.List[string]]::new()
+        foreach ($actualItem in @(Get-ChildItem -LiteralPath $payload -Force -Recurse -ErrorAction Stop)) {
+            if (($actualItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'CCOD_INSTALL_SOURCE_REPARSE' }
+            if ($actualItem.PSIsContainer -or $actualItem.FullName.Equals($manifestPath,[StringComparison]::OrdinalIgnoreCase)) { continue }
+            $actualFileList.Add($actualItem.FullName.Substring($payload.Length + 1).Replace('\','/'))
+        }
+        $actualFiles = @($actualFileList)
+        if ($actualFiles.Count -ne $records.Count) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+        foreach ($actual in $actualFiles) { if (-not $seen.Contains([string]$actual)) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' } }
+        $packageSnapshot = @($snapshots | Where-Object { $_.Relative -ceq 'package.json' })
+        try { $package = [Text.UTF8Encoding]::new($false,$true).GetString([byte[]]$packageSnapshot[0].Bytes) | ConvertFrom-Json -ErrorAction Stop }
+        catch { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+        if ($packageSnapshot.Count -ne 1 -or $package.version -isnot [string] -or [string]$package.version -cne $Version) { throw 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH' }
+
+        [IO.Directory]::CreateDirectory($stageRoot) | Out-Null
+        [void](Assert-CcodActivationNonReparsePath -Root $app -Path $stageRoot)
+        foreach ($snapshot in @($snapshots) + @([pscustomobject]@{Relative='installer-payload.manifest.json';Bytes=$manifestLock.Bytes;Sha256=$ExpectedManifestSha256})) {
+            $destination = [IO.Path]::GetFullPath((Join-Path $stageRoot ([string]$snapshot.Relative).Replace('/','\')))
+            $stagePrefix = $stageRoot.TrimEnd('\') + '\'
+            if (-not $destination.StartsWith($stagePrefix,[StringComparison]::OrdinalIgnoreCase)) { throw 'CCOD_INSTALL_PAYLOAD_PATH_INVALID' }
+            [IO.Directory]::CreateDirectory((Split-Path $destination -Parent)) | Out-Null
+            $writer = [IO.File]::Open($destination,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::None)
+            try { $writer.Write([byte[]]$snapshot.Bytes,0,([byte[]]$snapshot.Bytes).Length); $writer.Flush($true) } finally { $writer.Dispose() }
+            [void](Assert-CcodActivationNonReparsePath -Root $stageRoot -Path $destination)
+            $stageLock = Open-CcodActivationLockedBytes -Path $destination
+            $stageLocks.Add($stageLock)
+            if ((Get-CcodActivationBytesSha256 -Bytes $stageLock.Bytes) -cne [string]$snapshot.Sha256) { throw 'CCOD_INSTALL_FILE_HASH_MISMATCH' }
+        }
+        return [pscustomobject]@{
+            AppRoot=$app
+            StageRoot=[IO.Path]::GetFullPath($stageRoot)
+            ManifestPath=Join-Path $stageRoot 'installer-payload.manifest.json'
+            ManifestBytes=$manifestLock.Bytes
+            Streams=@($stageLocks | ForEach-Object { $_.Stream })
+        }
+    } catch {
+        foreach ($locked in @($stageLocks)) { try { $locked.Stream.Dispose() } catch { } }
+        Remove-CcodActivationPayloadStage -AppRoot $app -StageRoot $stageRoot
+        throw
+    } finally {
+        foreach ($locked in @($sourceLocks)) { try { $locked.Stream.Dispose() } catch { } }
     }
-    return $manifestPath
 }
 
 function Assert-CcodActivatedRuntimeVersion {
@@ -306,6 +390,7 @@ function Invoke-CcodOwnedInstallWorker {
     param(
         [Parameter(Mandatory)][string]$PowerShellPath,
         [Parameter(Mandatory)][string]$InstallScript,
+        [Parameter(Mandatory)][string]$VerifiedPayloadRoot,
         [Parameter(Mandatory)][string]$StateRoot,
         [Parameter(Mandatory)][int]$FirstReceiptTimeout,
         [Parameter(Mandatory)][int]$ActivationTimeout
@@ -328,7 +413,11 @@ function Invoke-CcodOwnedInstallWorker {
             $ActivationId
         )
         if (-not [string]::IsNullOrWhiteSpace($ExpectedVersion)) {
-            $arguments += @('-ExpectedVersion',$ExpectedVersion,'-PayloadManifestPath',(Join-Path $PayloadRoot 'installer-payload.manifest.json'))
+            $arguments += @(
+                '-ExpectedVersion',$ExpectedVersion,
+                '-PayloadManifestPath',(Join-Path $VerifiedPayloadRoot 'installer-payload.manifest.json'),
+                '-ExpectedPayloadManifestSha256',$ExpectedPayloadManifestSha256
+            )
         }
         $startInfo = [Diagnostics.ProcessStartInfo]::new()
         $startInfo.FileName = $PowerShellPath
@@ -442,8 +531,10 @@ function Show-CcodActivationFailure {
 if ($ValidateReceiptOnly -and $ValidateReceiptWithTimeout) { Write-Error 'CCOD_ACTIVATION_VALIDATOR_MODE_INVALID' -ErrorAction Continue; exit 3 }
 if ([string]::IsNullOrWhiteSpace($PayloadRoot)) { $PayloadRoot = $AppRoot }
 $PayloadRoot = [IO.Path]::GetFullPath($PayloadRoot)
+$payloadSeal = $null
+try {
 if (-not [string]::IsNullOrWhiteSpace($ExpectedVersion)) {
-    try { $null = Assert-CcodActivationPayload -AppRoot $AppRoot -Root $PayloadRoot -Version $ExpectedVersion -ExpectedManifestSha256 $ExpectedPayloadManifestSha256 }
+    try { $payloadSeal = New-CcodActivationPayloadSeal -AppRoot $AppRoot -Root $PayloadRoot -Version $ExpectedVersion -ExpectedManifestSha256 $ExpectedPayloadManifestSha256 }
     catch {
         $candidate = ([string]$_.FullyQualifiedErrorId -split ',')[0]
         $code = if ($candidate -cmatch '^CCOD_[A-Z0-9_]{1,96}$') { $candidate } elseif ($_.Exception.Message -cmatch '^CCOD_[A-Z0-9_]{1,96}$') { $Matches[0] } else { 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
@@ -466,7 +557,7 @@ if ($ValidateReceiptOnly) {
         $terminalReceipt = Read-CcodTerminalActivationReceipt -Root ([IO.Path]::GetFullPath($InstallRoot)) -ExpectedActivationId $ActivationId
         if ($terminalReceipt.phase -ceq 'Ready') {
             if (-not [string]::IsNullOrWhiteSpace($ExpectedVersion)) {
-                Assert-CcodActivatedRuntimeVersion -Root ([IO.Path]::GetFullPath($InstallRoot)) -RuntimeId ([string]$terminalReceipt.runtimeId) -Version $ExpectedVersion -RuntimeModulePath (Join-Path $PayloadRoot 'src\persistence\modules\RuntimeManifest.psm1')
+                Assert-CcodActivatedRuntimeVersion -Root ([IO.Path]::GetFullPath($InstallRoot)) -RuntimeId ([string]$terminalReceipt.runtimeId) -Version $ExpectedVersion -RuntimeModulePath (Join-Path $payloadSeal.StageRoot 'src\persistence\modules\RuntimeManifest.psm1')
             }
             exit 0
         }
@@ -483,11 +574,12 @@ $clock = [Diagnostics.Stopwatch]::StartNew()
 try {
     $root = [IO.Path]::GetFullPath($AppRoot)
     $stateRoot = [IO.Path]::GetFullPath($InstallRoot)
-    $installScript = Join-Path $PayloadRoot 'Install-CodexControlOtherDevices.ps1'
+    $executionPayloadRoot = if ($null -ne $payloadSeal) { [string]$payloadSeal.StageRoot } else { $PayloadRoot }
+    $installScript = Join-Path $executionPayloadRoot 'Install-CodexControlOtherDevices.ps1'
     if (-not [IO.File]::Exists($installScript)) { throw 'CCOD_ACTIVATION_INSTALL_SCRIPT_MISSING' }
     $powershell = (Get-Command powershell.exe -ErrorAction Stop).Source
     Write-CcodActivationRecord -Code 'STARTED' -DurationMilliseconds $clock.ElapsedMilliseconds
-    $installExitCode = Invoke-CcodOwnedInstallWorker -PowerShellPath $powershell -InstallScript $installScript -StateRoot $stateRoot -FirstReceiptTimeout $FirstReceiptTimeoutMilliseconds -ActivationTimeout $ActivationTimeoutMilliseconds
+    $installExitCode = Invoke-CcodOwnedInstallWorker -PowerShellPath $powershell -InstallScript $installScript -VerifiedPayloadRoot $executionPayloadRoot -StateRoot $stateRoot -FirstReceiptTimeout $FirstReceiptTimeoutMilliseconds -ActivationTimeout $ActivationTimeoutMilliseconds
     if ($installExitCode -ne 0) {
         $reportedErrorCode = $null
         try {
@@ -499,7 +591,7 @@ try {
     }
     $activationReceipt = Read-CcodFinalActivationReceipt -Root $stateRoot -ExpectedActivationId $ActivationId
     if (-not [string]::IsNullOrWhiteSpace($ExpectedVersion)) {
-        Assert-CcodActivatedRuntimeVersion -Root $stateRoot -RuntimeId ([string]$activationReceipt.runtimeId) -Version $ExpectedVersion -RuntimeModulePath (Join-Path $PayloadRoot 'src\persistence\modules\RuntimeManifest.psm1')
+        Assert-CcodActivatedRuntimeVersion -Root $stateRoot -RuntimeId ([string]$activationReceipt.runtimeId) -Version $ExpectedVersion -RuntimeModulePath (Join-Path $payloadSeal.StageRoot 'src\persistence\modules\RuntimeManifest.psm1')
     }
     Write-CcodActivationRecord -Code 'RUNTIME_ACTIVATED' -DurationMilliseconds $clock.ElapsedMilliseconds
 } catch {
@@ -530,3 +622,6 @@ if ($Prompt) {
 
 Write-CcodActivationRecord -Code 'COMPLETED' -DurationMilliseconds $clock.ElapsedMilliseconds
 exit 0
+} finally {
+    Close-CcodActivationPayloadSeal -Seal $payloadSeal
+}
diff --git a/Install-CodexControlOtherDevices.ps1 b/Install-CodexControlOtherDevices.ps1
index 4960ea0..bc8cf47 100644
--- a/Install-CodexControlOtherDevices.ps1
+++ b/Install-CodexControlOtherDevices.ps1
@@ -6,11 +6,135 @@ param(
     [switch]$DoNotStart,
     [string]$ActivationId,
     [string]$ExpectedVersion,
-    [string]$PayloadManifestPath
+    [string]$PayloadManifestPath,
+    [string]$ExpectedPayloadManifestSha256
 )
 
 $ErrorActionPreference = 'Stop'
 
+function Get-CcodInstallerBytesSha256 {
+    param([Parameter(Mandatory)][byte[]]$Bytes)
+    $sha = [Security.Cryptography.SHA256]::Create()
+    try { return [BitConverter]::ToString($sha.ComputeHash($Bytes)).Replace('-','').ToLowerInvariant() }
+    finally { $sha.Dispose() }
+}
+
+function Open-CcodInstallerLockedBytes {
+    param([Parameter(Mandatory)][string]$Path,[int64]$MaximumBytes = 268435456)
+    $full = [IO.Path]::GetFullPath($Path)
+    $stream = [IO.File]::Open($full,[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read)
+    try {
+        if ($stream.Length -lt 0 -or $stream.Length -gt $MaximumBytes) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+        $memory = [IO.MemoryStream]::new()
+        try { $stream.CopyTo($memory); $bytes = $memory.ToArray() } finally { $memory.Dispose() }
+        return [pscustomobject]@{Path=$full;Stream=$stream;Bytes=$bytes}
+    } catch { $stream.Dispose(); throw }
+}
+
+function Assert-CcodInstallerPayloadPath {
+    param([Parameter(Mandatory)][string]$Root,[Parameter(Mandatory)][string]$Path)
+    $canonicalRoot = [IO.Path]::GetFullPath($Root).TrimEnd('\')
+    $candidate = [IO.Path]::GetFullPath($Path)
+    $prefix = $canonicalRoot + '\'
+    if (-not ($candidate.Equals($canonicalRoot,[StringComparison]::OrdinalIgnoreCase) -or $candidate.StartsWith($prefix,[StringComparison]::OrdinalIgnoreCase))) {
+        throw 'CCOD_INSTALL_PAYLOAD_PATH_INVALID'
+    }
+    $cursor = $candidate
+    while ($true) {
+        $item = Get-Item -LiteralPath $cursor -Force -ErrorAction Stop
+        if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'CCOD_INSTALL_SOURCE_REPARSE' }
+        if ($cursor.Equals($canonicalRoot,[StringComparison]::OrdinalIgnoreCase)) { break }
+        $cursor = Split-Path $cursor -Parent
+    }
+    return $candidate
+}
+
+function Test-CcodInstallerAlternateDataStreams {
+    param([Parameter(Mandatory)][string]$Path)
+    try {
+        foreach ($stream in @(Get-Item -LiteralPath $Path -Stream * -ErrorAction Stop)) {
+            if ([string]$stream.Stream -cnotin @(':$DATA','::$DATA','$DATA')) { return $true }
+        }
+        return $false
+    } catch { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+}
+
+function Open-CcodInstallerPayloadSeal {
+    param(
+        [Parameter(Mandatory)][string]$SourceRoot,
+        [Parameter(Mandatory)][string]$Version,
+        [Parameter(Mandatory)][string]$ManifestPath,
+        [Parameter(Mandatory)][string]$ExpectedManifestSha256
+    )
+    if ($Version -cnotmatch '^\d+\.\d+\.\d+$' -or $ExpectedManifestSha256 -cnotmatch '^[0-9a-f]{64}$') { throw 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH' }
+    $root = [IO.Path]::GetFullPath($SourceRoot).TrimEnd('\')
+    [void](Assert-CcodInstallerPayloadPath -Root $root -Path $root)
+    $manifestFile = Assert-CcodInstallerPayloadPath -Root $root -Path $ManifestPath
+    $locks = [Collections.Generic.List[object]]::new()
+    try {
+        $manifestLock = Open-CcodInstallerLockedBytes -Path $manifestFile -MaximumBytes 4194304
+        $locks.Add($manifestLock)
+        if ((Test-CcodInstallerAlternateDataStreams -Path $manifestFile) -or
+            (Get-CcodInstallerBytesSha256 -Bytes $manifestLock.Bytes) -cne $ExpectedManifestSha256) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+        try {
+            $manifestText = [Text.UTF8Encoding]::new($false,$true).GetString($manifestLock.Bytes)
+            $manifest = $manifestText | ConvertFrom-Json -ErrorAction Stop
+        } catch { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+        $fields = @($manifest.PSObject.Properties.Name)
+        if ($manifest -isnot [pscustomobject] -or ($fields -join ',') -cne 'schemaVersion,projectVersion,files' -or
+            $manifest.schemaVersion -isnot [int] -or $manifest.schemaVersion -ne 1 -or
+            $manifest.projectVersion -isnot [string] -or $manifest.projectVersion -cne $Version) { throw 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH' }
+        $records = @($manifest.files)
+        if ($records.Count -eq 0) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+        $seen = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+        $previous = $null
+        $packageBytes = $null
+        foreach ($record in $records) {
+            $recordFields = @($record.PSObject.Properties.Name)
+            if ($record -isnot [pscustomobject] -or ($recordFields -join ',') -cne 'path,length,sha256' -or
+                $record.path -isnot [string] -or $record.path -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$' -or
+                $record.path.Contains('//') -or $record.path.Contains('..') -or $record.path.Contains(':') -or $record.path.Contains('\') -or
+                $record.length -isnot [ValueType] -or [decimal]$record.length -ne [decimal][int64]$record.length -or [int64]$record.length -lt 0 -or
+                $record.sha256 -isnot [string] -or $record.sha256 -cnotmatch '^[0-9a-f]{64}$' -or
+                ($null -ne $previous -and [StringComparer]::Ordinal.Compare([string]$previous,[string]$record.path) -ge 0) -or
+                -not $seen.Add([string]$record.path)) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+            $previous = [string]$record.path
+            $source = Assert-CcodInstallerPayloadPath -Root $root -Path (Join-Path $root ([string]$record.path).Replace('/','\'))
+            $locked = Open-CcodInstallerLockedBytes -Path $source
+            $locks.Add($locked)
+            $item = Get-Item -LiteralPath $source -Force -ErrorAction Stop
+            if ($item.PSIsContainer -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0 -or
+                (Test-CcodInstallerAlternateDataStreams -Path $source) -or [int64]$locked.Bytes.Length -ne [int64]$record.length -or
+                (Get-CcodInstallerBytesSha256 -Bytes $locked.Bytes) -cne [string]$record.sha256) { throw 'CCOD_INSTALL_FILE_HASH_MISMATCH' }
+            if ([string]$record.path -ceq 'package.json') { $packageBytes = $locked.Bytes }
+        }
+        foreach ($required in @('package.json','Install-CodexControlOtherDevices.ps1','src/persistence/modules/InstallLifecycle.psm1','src/persistence/modules/RuntimeManifest.psm1')) {
+            if (-not $seen.Contains($required)) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+        }
+        $actual = [Collections.Generic.List[string]]::new()
+        foreach ($item in @(Get-ChildItem -LiteralPath $root -Force -Recurse -ErrorAction Stop)) {
+            if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'CCOD_INSTALL_SOURCE_REPARSE' }
+            if ($item.PSIsContainer -or $item.FullName.Equals($manifestFile,[StringComparison]::OrdinalIgnoreCase)) { continue }
+            $actual.Add($item.FullName.Substring($root.Length + 1).Replace('\','/'))
+        }
+        if ($actual.Count -ne $records.Count) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+        foreach ($relative in $actual) { if (-not $seen.Contains($relative)) { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' } }
+        try { $package = [Text.UTF8Encoding]::new($false,$true).GetString([byte[]]$packageBytes) | ConvertFrom-Json -ErrorAction Stop }
+        catch { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
+        if ($package.version -isnot [string] -or [string]$package.version -cne $Version) { throw 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH' }
+        return [pscustomobject]@{ManifestBytes=$manifestLock.Bytes;Locks=@($locks | ForEach-Object {$_.Stream})}
+    } catch {
+        foreach ($locked in @($locks)) { try { $locked.Stream.Dispose() } catch { } }
+        throw
+    }
+}
+
+function Close-CcodInstallerPayloadSeal {
+    param($Seal)
+    if ($null -eq $Seal) { return }
+    foreach ($stream in @($Seal.Locks)) { if ($null -ne $stream) { try { $stream.Dispose() } catch { } } }
+}
+
 function Resolve-CcodInstallerModule {
     param([Parameter(Mandatory)][string]$CheckoutRoot)
 
@@ -26,22 +150,41 @@ function Resolve-CcodInstallerModule {
     return $modulePath
 }
 
-$script:InstallerModule = Resolve-CcodInstallerModule -CheckoutRoot $PSScriptRoot
-Import-Module $script:InstallerModule -Force
-
 if ([string]::IsNullOrWhiteSpace($InstallRoot)) {
     $InstallRoot = Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)) 'CodexControlOtherDevices'
 }
 
-$receipt = Invoke-CcodInstall `
-    -SourceRoot $PSScriptRoot `
-    -InstallRoot $InstallRoot `
-    -EnableCandidateCompatibleUpdates:([bool]$EnableCandidateCompatibleUpdates) `
-    -RepairState:([bool]$RepairState) `
-    -DoNotStart:([bool]$DoNotStart) `
-    -ActivationId $ActivationId `
-    -ExpectedVersion $ExpectedVersion `
-    -PayloadManifestPath $PayloadManifestPath
+$payloadBound = -not [string]::IsNullOrWhiteSpace($ExpectedVersion) -or -not [string]::IsNullOrWhiteSpace($PayloadManifestPath) -or -not [string]::IsNullOrWhiteSpace($ExpectedPayloadManifestSha256)
+$payloadSeal = $null
+$installerModule = $null
+try {
+    if ($payloadBound) {
+        if ([string]::IsNullOrWhiteSpace($ExpectedVersion) -or [string]::IsNullOrWhiteSpace($PayloadManifestPath) -or [string]::IsNullOrWhiteSpace($ExpectedPayloadManifestSha256)) {
+            throw 'CCOD_INSTALL_INPUT_INVALID'
+        }
+        $payloadSeal = Open-CcodInstallerPayloadSeal -SourceRoot $PSScriptRoot -Version $ExpectedVersion -ManifestPath $PayloadManifestPath -ExpectedManifestSha256 $ExpectedPayloadManifestSha256
+    }
+    $script:InstallerModule = Resolve-CcodInstallerModule -CheckoutRoot $PSScriptRoot
+    $installerModule = Import-Module $script:InstallerModule -Force -PassThru
+    $invoke = @{
+        SourceRoot = $PSScriptRoot
+        InstallRoot = $InstallRoot
+        EnableCandidateCompatibleUpdates = [bool]$EnableCandidateCompatibleUpdates
+        RepairState = [bool]$RepairState
+        DoNotStart = [bool]$DoNotStart
+        ActivationId = $ActivationId
+    }
+    if ($payloadBound) {
+        $invoke.ExpectedVersion = $ExpectedVersion
+        $invoke.PayloadManifestPath = $PayloadManifestPath
+        $invoke.ExpectedPayloadManifestSha256 = $ExpectedPayloadManifestSha256
+        $invoke.PayloadManifestBytesBase64 = [Convert]::ToBase64String([byte[]]$payloadSeal.ManifestBytes)
+    }
+    $receipt = Invoke-CcodInstall @invoke
+} finally {
+    if ($null -ne $installerModule) { Remove-Module -Name $installerModule.Name -Force -ErrorAction SilentlyContinue }
+    Close-CcodInstallerPayloadSeal -Seal $payloadSeal
+}
 
 Write-Host ''
 Write-Host 'CodexRemote-fix - install result' -ForegroundColor Cyan
diff --git a/build/CodexControlOtherDevices.iss b/build/CodexControlOtherDevices.iss
index ff42b79..b99a09d 100644
--- a/build/CodexControlOtherDevices.iss
+++ b/build/CodexControlOtherDevices.iss
@@ -106,11 +106,39 @@ const
   VALIDATION_LAUNCH_BUDGET_MILLISECONDS = 5000;
   CCOD_FILE_ATTRIBUTE_DIRECTORY = $00000010;
   CCOD_FILE_ATTRIBUTE_REPARSE_POINT = $00000400;
+  CCOD_FILE_READ_ATTRIBUTES = $00000080;
+  CCOD_FILE_SHARE_READ = $00000001;
+  CCOD_FILE_SHARE_WRITE = $00000002;
+  CCOD_FILE_SHARE_DELETE = $00000004;
+  CCOD_OPEN_EXISTING = 3;
+  CCOD_FILE_FLAG_OPEN_REPARSE_POINT = $00200000;
   CCOD_INVALID_FILE_ATTRIBUTES = $FFFFFFFF;
+  CCOD_INVALID_HANDLE_VALUE = -1;
+  CCOD_ERROR_HANDLE_EOF = 38;
 
 type
   TActivationPhase = (apNone, apStoppingPreviousRuntime, apInstallingRuntime,
     apActivatingRuntime, apStartingProtection, apReady, apFailed);
+  TCcodFileTime = record
+    LowDateTime: Cardinal;
+    HighDateTime: Cardinal;
+  end;
+  TCcodByHandleFileInformation = record
+    FileAttributes: Cardinal;
+    CreationTime: TCcodFileTime;
+    LastAccessTime: TCcodFileTime;
+    LastWriteTime: TCcodFileTime;
+    VolumeSerialNumber: Cardinal;
+    FileSizeHigh: Cardinal;
+    FileSizeLow: Cardinal;
+    NumberOfLinks: Cardinal;
+    FileIndexHigh: Cardinal;
+    FileIndexLow: Cardinal;
+  end;
+  TCcodFindStreamData = record
+    StreamSize: Int64;
+    StreamNameBuffer: array[0..591] of Byte;
+  end;
 
 function GetTickCount64(): Int64;
   external 'GetTickCount64@kernel32.dll stdcall';
@@ -120,6 +148,25 @@ function StringFromGUID2(var Guid: TGUID; GuidString: String; MaxCharacters: Int
   external 'StringFromGUID2@ole32.dll stdcall';
 function GetFileAttributesW(const FileName: String): Cardinal;
   external 'GetFileAttributesW@kernel32.dll stdcall';
+function CreateFileW(const FileName: String; DesiredAccess, ShareMode,
+  SecurityAttributes, CreationDisposition, FlagsAndAttributes,
+  TemplateFile: Cardinal): Integer;
+  external 'CreateFileW@kernel32.dll stdcall';
+function GetFileInformationByHandle(FileHandle: Integer;
+  var Information: TCcodByHandleFileInformation): Boolean;
+  external 'GetFileInformationByHandle@kernel32.dll stdcall';
+function CloseHandle(Handle: Integer): Boolean;
+  external 'CloseHandle@kernel32.dll stdcall';
+function FindFirstStreamW(const FileName: String; InfoLevel: Integer;
+  var StreamData: TCcodFindStreamData; Flags: Cardinal): Integer;
+  external 'FindFirstStreamW@kernel32.dll stdcall';
+function FindNextStreamW(FindHandle: Integer;
+  var StreamData: TCcodFindStreamData): Boolean;
+  external 'FindNextStreamW@kernel32.dll stdcall';
+function CcodFindClose(FindHandle: Integer): Boolean;
+  external 'FindClose@kernel32.dll stdcall';
+function GetLastError(): Cardinal;
+  external 'GetLastError@kernel32.dll stdcall';
 
 function IsSafeExistingPayloadDirectory(const DirectoryName: String): Boolean;
 var
@@ -131,6 +178,50 @@ begin
      ((Attributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) = 0));
 end;
 
+function HasOnlyDefaultDataStream(const FileName: String): Boolean;
+var
+  FindHandle: Integer;
+  StreamData: TCcodFindStreamData;
+  ErrorCode: Cardinal;
+begin
+  Result := False;
+  FindHandle := FindFirstStreamW(FileName, 0, StreamData, 0);
+  if FindHandle = CCOD_INVALID_HANDLE_VALUE then Exit;
+  try
+    if FindNextStreamW(FindHandle, StreamData) then Exit;
+    ErrorCode := GetLastError();
+    Result := ErrorCode = CCOD_ERROR_HANDLE_EOF;
+  finally
+    CcodFindClose(FindHandle);
+  end;
+end;
+
+function IsSafeExistingSetupLeaf(const FileName: String): Boolean;
+var
+  Attributes: Cardinal;
+  FileHandle: Integer;
+  Information: TCcodByHandleFileInformation;
+begin
+  Result := False;
+  Attributes := GetFileAttributesW(FileName);
+  if (Attributes = CCOD_INVALID_FILE_ATTRIBUTES) or
+     ((Attributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) <> 0) or
+     ((Attributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) <> 0) then Exit;
+  FileHandle := CreateFileW(FileName, CCOD_FILE_READ_ATTRIBUTES,
+    CCOD_FILE_SHARE_READ or CCOD_FILE_SHARE_WRITE or CCOD_FILE_SHARE_DELETE,
+    0, CCOD_OPEN_EXISTING, CCOD_FILE_FLAG_OPEN_REPARSE_POINT, 0);
+  if FileHandle = CCOD_INVALID_HANDLE_VALUE then Exit;
+  try
+    if not GetFileInformationByHandle(FileHandle, Information) then Exit;
+    Result := (Information.NumberOfLinks = 1) and
+      ((Information.FileAttributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) = 0) and
+      ((Information.FileAttributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) = 0) and
+      HasOnlyDefaultDataStream(FileName);
+  finally
+    CloseHandle(FileHandle);
+  end;
+end;
+
 function IsSafeExistingSetupTree(const DirectoryName: String): Boolean;
 var
   Attributes: Cardinal;
@@ -159,6 +250,12 @@ begin
             Result := False;
             Exit;
           end;
+          if ((FindRec.Attributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) = 0) and
+             (not IsSafeExistingSetupLeaf(ChildPath)) then
+          begin
+            Result := False;
+            Exit;
+          end;
         end;
       until not FindNext(FindRec);
     finally
diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index 329f1ed..e2a7e12 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -194,6 +194,7 @@ function Assert-CcodLifecycleInstallTreeSafe {
                 Throw-CcodLifecycleError 'CCOD_INSTALL_REPARSE_PATH' 'Install tree contains a reparse point or escaped entry' $full
             }
             if ($item.PSIsContainer) { $pending.Push($full) }
+            else { [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $InstallRoot -Path $full) }
         }
     }
     return $tree
@@ -420,11 +421,126 @@ function Get-CcodLifecycleSourceFiles {
     return @($files)
 }
 
+function Get-CcodLifecycleFileLinkCount {
+    param([Parameter(Mandatory)][string]$Path)
+
+    try {
+        if ($null -eq ('CcodLifecycleFileIdentityNative' -as [type])) {
+            Add-Type -TypeDefinition @'
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+
+public static class CcodLifecycleFileIdentityNative
+{
+    [StructLayout(LayoutKind.Sequential)]
+    public struct FILETIME { public uint Low; public uint High; }
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct BY_HANDLE_FILE_INFORMATION
+    {
+        public uint FileAttributes;
+        public FILETIME CreationTime;
+        public FILETIME LastAccessTime;
+        public FILETIME LastWriteTime;
+        public uint VolumeSerialNumber;
+        public uint FileSizeHigh;
+        public uint FileSizeLow;
+        public uint NumberOfLinks;
+        public uint FileIndexHigh;
+        public uint FileIndexLow;
+    }
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern SafeFileHandle CreateFileW(string name, uint access, uint share, IntPtr security, uint creation, uint flags, IntPtr template);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle handle, out BY_HANDLE_FILE_INFORMATION information);
+
+    public static uint GetLinkCount(string path)
+    {
+        const uint FILE_READ_ATTRIBUTES = 0x80;
+        const uint FILE_SHARE_READ = 1, FILE_SHARE_WRITE = 2, FILE_SHARE_DELETE = 4;
+        const uint OPEN_EXISTING = 3, FILE_FLAG_OPEN_REPARSE_POINT = 0x00200000;
+        using (SafeFileHandle handle = CreateFileW(path, FILE_READ_ATTRIBUTES, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+            IntPtr.Zero, OPEN_EXISTING, FILE_FLAG_OPEN_REPARSE_POINT, IntPtr.Zero))
+        {
+            if (handle.IsInvalid) throw new Win32Exception(Marshal.GetLastWin32Error());
+            BY_HANDLE_FILE_INFORMATION information;
+            if (!GetFileInformationByHandle(handle, out information)) throw new Win32Exception(Marshal.GetLastWin32Error());
+            return information.NumberOfLinks;
+        }
+    }
+}
+'@
+        }
+        return [uint32][CcodLifecycleFileIdentityNative]::GetLinkCount([IO.Path]::GetFullPath($Path))
+    } catch {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_UNSAFE_LEAF' 'Unable to prove the install leaf link identity' $Path
+    }
+}
+
+function Assert-CcodLifecycleInstallLeafSafe {
+    param(
+        [Parameter(Mandatory)][string]$InstallRoot,
+        [Parameter(Mandatory)][string]$Path,
+        [switch]$AllowMissing
+    )
+
+    $candidate = Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $Path
+    if (-not [IO.File]::Exists($candidate)) {
+        if ([IO.Directory]::Exists($candidate) -or -not $AllowMissing) {
+            Throw-CcodLifecycleError 'CCOD_INSTALL_UNSAFE_LEAF' 'Install leaf is missing or not a regular file' $candidate
+        }
+        return $candidate
+    }
+    $item = Get-Item -LiteralPath $candidate -Force -ErrorAction Stop
+    $hasAds = $true
+    try { $hasAds = Test-CcodLifecycleAlternateDataStreams -Path $candidate } catch {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_UNSAFE_LEAF' 'Install leaf alternate streams could not be proven absent' $candidate
+    }
+    if ($item.PSIsContainer -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0 -or
+        $hasAds -or (Get-CcodLifecycleFileLinkCount -Path $candidate) -ne 1) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_UNSAFE_LEAF' 'Install leaf must be a regular non-reparse single-link file without alternate streams' $candidate
+    }
+    return $candidate
+}
+
+function Copy-CcodLifecycleFileAtomically {
+    param([Parameter(Mandatory)][string]$Source,[Parameter(Mandatory)][string]$Destination)
+
+    $destination = [IO.Path]::GetFullPath($Destination)
+    $parent = Split-Path $destination -Parent
+    [IO.Directory]::CreateDirectory($parent) | Out-Null
+    $temporary = Join-Path $parent ('.ccod-copy-' + [guid]::NewGuid().ToString('N') + '.tmp')
+    try {
+        [IO.File]::Copy([IO.Path]::GetFullPath($Source),$temporary,$false)
+        if ([IO.File]::Exists($destination)) {
+            [IO.File]::Replace($temporary,$destination,$null,$true)
+        } else {
+            [IO.File]::Move($temporary,$destination)
+        }
+    } finally {
+        if ([IO.File]::Exists($temporary)) { try { [IO.File]::Delete($temporary) } catch { } }
+    }
+}
+
+function Get-CcodLifecycleBytesSha256 {
+    param([Parameter(Mandatory)][byte[]]$Bytes)
+    $sha = [Security.Cryptography.SHA256]::Create()
+    try { return [BitConverter]::ToString($sha.ComputeHash($Bytes)).Replace('-', '').ToLowerInvariant() }
+    finally { $sha.Dispose() }
+}
+
 function Get-CcodLifecyclePayloadManifestFiles {
     param(
         [Parameter(Mandatory)][string]$SourceRoot,
         [Parameter(Mandatory)][string]$ExpectedVersion,
-        [Parameter(Mandatory)][string]$PayloadManifestPath
+        [Parameter(Mandatory)][string]$PayloadManifestPath,
+        [Parameter(Mandatory)][string]$ExpectedPayloadManifestSha256,
+        [Parameter(Mandatory)][string]$PayloadManifestBytesBase64
     )
 
     if ($ExpectedVersion -cnotmatch '^\d+\.\d+\.\d+$') {
@@ -448,7 +564,16 @@ function Get-CcodLifecyclePayloadManifestFiles {
             Throw-CcodLifecycleError 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' 'Payload manifest escaped the source root' $manifestPath
         }
     }
-    try { $manifest = Get-Content -LiteralPath $manifestPath -Raw | ConvertFrom-Json -ErrorAction Stop }
+    if ($ExpectedPayloadManifestSha256 -cnotmatch '^[0-9a-f]{64}$' -or [string]::IsNullOrWhiteSpace($PayloadManifestBytesBase64)) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' 'Payload manifest byte binding is missing or invalid' $manifestPath
+    }
+    try {
+        $manifestBytes = [Convert]::FromBase64String($PayloadManifestBytesBase64)
+        if ($manifestBytes.Length -le 0 -or $manifestBytes.Length -gt 4194304 -or
+            (Get-CcodLifecycleBytesSha256 -Bytes $manifestBytes) -cne $ExpectedPayloadManifestSha256) { throw 'manifest byte binding' }
+        $manifestText = [Text.UTF8Encoding]::new($false,$true).GetString($manifestBytes)
+        $manifest = $manifestText | ConvertFrom-Json -ErrorAction Stop
+    }
     catch { Throw-CcodLifecycleError 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' 'Payload manifest is not valid JSON' $manifestPath }
     if ($manifest -isnot [pscustomobject]) {
         Throw-CcodLifecycleError 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' 'Payload manifest must be one JSON object' $manifestPath
@@ -570,9 +695,9 @@ function Copy-CcodLifecycleStaging {
             [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $destinationParent)
             [IO.Directory]::CreateDirectory($destinationParent) | Out-Null
             [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $destinationParent)
-            [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $destination)
+            [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $InstallRoot -Path $destination -AllowMissing)
             & $Adapters.CopyFile $file.Source $destination
-            [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $destination)
+            [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $InstallRoot -Path $destination)
         }
         foreach ($file in $Files) {
             $destination = [IO.Path]::GetFullPath((Join-Path $stagingDirectory $file.Relative))
@@ -586,18 +711,18 @@ function Copy-CcodLifecycleStaging {
         if (-not [IO.File]::Exists($bootstrapSource)) {
             Throw-CcodLifecycleError 'CCOD_INSTALL_SOURCE_INCOMPLETE' 'The verified staging bootstrap script is missing' $bootstrapSource
         }
-        [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $bootstrapPath)
+        [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $InstallRoot -Path $bootstrapPath -AllowMissing)
         & $Adapters.CopyFile $bootstrapSource $bootstrapPath
-        [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $bootstrapPath)
+        [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $InstallRoot -Path $bootstrapPath)
         if ((Get-CcodLifecycleFileSha256 -Path $bootstrapPath) -cne (Get-CcodLifecycleFileSha256 -Path $bootstrapSource)) {
             Throw-CcodLifecycleError 'CCOD_INSTALL_FILE_HASH_MISMATCH' 'The stable bootstrap copy differs from verified staging bytes' $bootstrapPath
         }
         $copiedStableBootstrap = $true
         $uninstallerSource = Join-Path $stagingDirectory 'Uninstall-CodexControlOtherDevices.ps1'
         if ([IO.File]::Exists($uninstallerSource)) {
-            [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $uninstallerPath)
+            [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $InstallRoot -Path $uninstallerPath -AllowMissing)
             & $Adapters.CopyFile $uninstallerSource $uninstallerPath
-            [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $uninstallerPath)
+            [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $InstallRoot -Path $uninstallerPath)
             if ((Get-CcodLifecycleFileSha256 -Path $uninstallerPath) -cne (Get-CcodLifecycleFileSha256 -Path $uninstallerSource)) {
                 Throw-CcodLifecycleError 'CCOD_INSTALL_FILE_HASH_MISMATCH' 'The stable uninstaller copy differs from verified staging bytes' $uninstallerPath
             }
@@ -609,10 +734,10 @@ function Copy-CcodLifecycleStaging {
             try { [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $InstallRoot -Path $stagingDirectory); Remove-Item -LiteralPath $stagingDirectory -Recurse -Force -ErrorAction Stop } catch { }
         }
         if ($copiedStableBootstrap -and -not $bootstrapExistedBefore -and [IO.File]::Exists($bootstrapPath)) {
-            try { [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $bootstrapPath); Remove-Item -LiteralPath $bootstrapPath -Force -ErrorAction Stop } catch { }
+            try { [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $InstallRoot -Path $bootstrapPath); Remove-Item -LiteralPath $bootstrapPath -Force -ErrorAction Stop } catch { }
         }
         if ($copiedStableUninstaller -and -not $uninstallerExistedBefore -and [IO.File]::Exists($uninstallerPath)) {
-            try { [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $uninstallerPath); Remove-Item -LiteralPath $uninstallerPath -Force -ErrorAction Stop } catch { }
+            try { [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $InstallRoot -Path $uninstallerPath); Remove-Item -LiteralPath $uninstallerPath -Force -ErrorAction Stop } catch { }
         }
         $candidateId = ([string]$_.FullyQualifiedErrorId -split ',')[0]
         if ($candidateId -clike 'CCOD_INSTALL_*' -or $candidateId -clike 'CCOD_*') {
@@ -1450,8 +1575,7 @@ function Get-CcodLifecycleAdapters {
         }
         CopyFile = {
             param($Source, $Destination)
-            [IO.Directory]::CreateDirectory((Split-Path $Destination -Parent)) | Out-Null
-            [IO.File]::Copy($Source, $Destination, $true)
+            Copy-CcodLifecycleFileAtomically -Source $Source -Destination $Destination
         }
         NewRuntimeManifest = {
             param($RuntimeDirectory, $ProjectVersion)
@@ -1750,6 +1874,8 @@ function Invoke-CcodInstall {
         [string]$ActivationId,
         [string]$ExpectedVersion,
         [string]$PayloadManifestPath,
+        [string]$ExpectedPayloadManifestSha256,
+        [string]$PayloadManifestBytesBase64,
         [hashtable]$Adapters
     )
 
@@ -1775,12 +1901,18 @@ function Invoke-CcodInstall {
     if (-not [IO.Directory]::Exists($sourceRoot)) {
         Throw-CcodLifecycleError 'CCOD_INSTALL_SOURCE_MISSING' 'Source checkout does not exist' $sourceRoot
     }
-    $payloadBound = -not [string]::IsNullOrWhiteSpace($ExpectedVersion) -or -not [string]::IsNullOrWhiteSpace($PayloadManifestPath)
-    if ($payloadBound -and ([string]::IsNullOrWhiteSpace($ExpectedVersion) -or [string]::IsNullOrWhiteSpace($PayloadManifestPath))) {
-        Throw-CcodLifecycleError 'CCOD_INSTALL_INPUT_INVALID' 'ExpectedVersion and PayloadManifestPath must be supplied together' $null
+    $payloadBound = -not [string]::IsNullOrWhiteSpace($ExpectedVersion) -or
+        -not [string]::IsNullOrWhiteSpace($PayloadManifestPath) -or
+        -not [string]::IsNullOrWhiteSpace($ExpectedPayloadManifestSha256) -or
+        -not [string]::IsNullOrWhiteSpace($PayloadManifestBytesBase64)
+    if ($payloadBound -and ([string]::IsNullOrWhiteSpace($ExpectedVersion) -or
+        [string]::IsNullOrWhiteSpace($PayloadManifestPath) -or
+        [string]::IsNullOrWhiteSpace($ExpectedPayloadManifestSha256) -or
+        [string]::IsNullOrWhiteSpace($PayloadManifestBytesBase64))) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_INPUT_INVALID' 'ExpectedVersion, manifest path, hash, and exact bytes must be supplied together' $null
     }
     $files = if ($payloadBound) {
-        @(Get-CcodLifecyclePayloadManifestFiles -SourceRoot $sourceRoot -ExpectedVersion $ExpectedVersion -PayloadManifestPath $PayloadManifestPath)
+        @(Get-CcodLifecyclePayloadManifestFiles -SourceRoot $sourceRoot -ExpectedVersion $ExpectedVersion -PayloadManifestPath $PayloadManifestPath -ExpectedPayloadManifestSha256 $ExpectedPayloadManifestSha256 -PayloadManifestBytesBase64 $PayloadManifestBytesBase64)
     } else { $null }
     if (-not (& $adapters.ValidateSource $sourceRoot)) {
         Throw-CcodLifecycleError 'CCOD_INSTALL_SOURCE_INVALID' 'Source checkout failed hermetic validation' $sourceRoot
@@ -1858,13 +1990,13 @@ function Invoke-CcodInstall {
         $stagingDirectory = Copy-CcodLifecycleStaging -SourceRoot $sourceRoot -InstallRoot $root -Adapters $adapters -Files $files
         $manifest = & $adapters.NewRuntimeManifest $stagingDirectory $projectVersion
         $stagingManifestPath = Join-Path $stagingDirectory 'manifest.json'
-        [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $stagingManifestPath)
+        [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $root -Path $stagingManifestPath -AllowMissing)
         [IO.File]::WriteAllText(
             $stagingManifestPath,
             ($manifest | ConvertTo-Json -Depth 16),
             [Text.UTF8Encoding]::new($false)
         )
-        [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $stagingManifestPath)
+        [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $root -Path $stagingManifestPath)
         $runtimeId = [string]$manifest.runtimeId
         $validation = Test-CcodRuntimeManifest -RuntimeDirectory $stagingDirectory -ExpectedRuntimeId $runtimeId
         if (-not $validation.Valid) {
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index 538a5bd..55e5af8 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -88,6 +88,20 @@ function New-CcodLifecyclePayloadManifest {
     return $manifestPath
 }
 
+function Get-CcodLifecyclePayloadBinding {
+    param(
+        [Parameter(Mandatory)][string]$ManifestPath,
+        [Parameter(Mandatory)][string]$ExpectedVersion
+    )
+    $bytes = [IO.File]::ReadAllBytes($ManifestPath)
+    return @{
+        ExpectedVersion = $ExpectedVersion
+        PayloadManifestPath = $ManifestPath
+        ExpectedPayloadManifestSha256 = Get-CcodTestFileSha256 -Path $ManifestPath
+        PayloadManifestBytesBase64 = [Convert]::ToBase64String($bytes)
+    }
+}
+
 function New-CcodLifecycleFakeNode {
     param([Parameter(Mandatory)][string]$Root)
     New-Item -ItemType Directory -Path (Join-Path $Root 'node') -Force | Out-Null
@@ -681,8 +695,9 @@ $results += Invoke-CcodTest 'upgrade rejects a payload version mismatch before a
         $before = Read-CcodActiveRuntime -InstallRoot $install
         $fake = New-CcodLifecycleFake -NodePath $nodePath
 
+        $payloadBinding = Get-CcodLifecyclePayloadBinding -ManifestPath $manifestPath -ExpectedVersion '2.5.22'
         Assert-CcodThrows {
-            Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -ExpectedVersion '2.5.22' -PayloadManifestPath $manifestPath -Adapters $fake.Adapters | Out-Null
+            Invoke-CcodInstall -SourceRoot $source -InstallRoot $install @payloadBinding -Adapters $fake.Adapters | Out-Null
         } 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH'
 
         $after = Read-CcodActiveRuntime -InstallRoot $install
@@ -707,7 +722,8 @@ $results += Invoke-CcodTest 'matching payload stages only immutable manifest-lis
         [IO.File]::WriteAllText($stalePath,"module.exports = 'stale';`n",[Text.UTF8Encoding]::new($false))
         $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
 
-        $receipt = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -ExpectedVersion '2.5.22' -PayloadManifestPath $manifestPath -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
+        $payloadBinding = Get-CcodLifecyclePayloadBinding -ManifestPath $manifestPath -ExpectedVersion '2.5.22'
+        $receipt = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install @payloadBinding -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
 
         $runtimeRoot = Join-Path $install "runtime\$($receipt.RuntimeId)"
         Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $runtimeRoot 'src\runtime\stale-old-payload.js'))) 'unlisted stale source file is absent from the runtime'
@@ -737,8 +753,9 @@ $results += Invoke-CcodTest 'payload-bound install rereads the active pointer af
             [pscustomobject][ordered]@{ SupervisorReady = $true; TrayReady = $true }
         }.GetNewClosure()
 
+        $payloadBinding = Get-CcodLifecyclePayloadBinding -ManifestPath $manifestPath -ExpectedVersion '2.5.22'
         Assert-CcodThrows {
-            Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -ExpectedVersion '2.5.22' -PayloadManifestPath $manifestPath -Adapters $fake.Adapters | Out-Null
+            Invoke-CcodInstall -SourceRoot $source -InstallRoot $install @payloadBinding -Adapters $fake.Adapters | Out-Null
         } 'CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN'
         Assert-CcodTrue ($fake.World.Phases -notcontains 'Ready') 'pointer drift after readiness cannot produce a Ready receipt'
     } finally {
@@ -770,7 +787,8 @@ $results += Invoke-CcodTest 'stable bootstrap and uninstaller come from manifest
             }.GetNewClosure()
         }
 
-        $receipt = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -ExpectedVersion '2.5.22' -PayloadManifestPath $manifestPath -Adapters $fake.Adapters
+        $payloadBinding = Get-CcodLifecyclePayloadBinding -ManifestPath $manifestPath -ExpectedVersion '2.5.22'
+        $receipt = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install @payloadBinding -Adapters $fake.Adapters
 
         $runtimeRoot = Join-Path $install "runtime\$($receipt.RuntimeId)"
         Assert-CcodEqual (Get-CcodTestFileSha256 -Path (Join-Path $runtimeRoot 'src\persistence\bootstrap.ps1')) (Get-CcodTestFileSha256 -Path (Join-Path $install 'bootstrap.ps1')) 'stable bootstrap equals its verified runtime byte copy'
@@ -861,6 +879,40 @@ $results += Invoke-CcodTest 'stable bootstrap leaf junction is rejected before c
     }
 }
 
+# Production mutation caught: treating a non-reparse hard link as a safe overwrite target and changing bytes outside the install root.
+$results += Invoke-CcodTest 'stable bootstrap and public uninstaller reject hard-linked target leaves before outside bytes change' {
+    foreach ($case in @(
+        [pscustomobject]@{Name='bootstrap';Leaf='bootstrap.ps1';AddUninstaller=$false},
+        [pscustomobject]@{Name='uninstaller';Leaf='Uninstall-CodexControlOtherDevices.ps1';AddUninstaller=$true}
+    )) {
+        $source = New-CcodLifecycleTempRoot
+        $install = New-CcodLifecycleTempRoot
+        $outside = New-CcodLifecycleTempRoot
+        $nodeRoot = New-CcodLifecycleTempRoot
+        try {
+            New-CcodLifecycleSourceFixture -Root $source | Out-Null
+            if ($case.AddUninstaller) {
+                [IO.File]::WriteAllText((Join-Path $source 'Uninstall-CodexControlOtherDevices.ps1'),'# verified uninstaller',[Text.UTF8Encoding]::new($false))
+            }
+            [IO.Directory]::CreateDirectory($install) | Out-Null
+            [IO.Directory]::CreateDirectory($outside) | Out-Null
+            $sentinel = Join-Path $outside ($case.Name + '-sentinel.txt')
+            [IO.File]::WriteAllText($sentinel,'outside-original',[Text.UTF8Encoding]::new($false))
+            $targetLeaf = Join-Path $install $case.Leaf
+            New-Item -ItemType HardLink -Path $targetLeaf -Target $sentinel | Out-Null
+            $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
+
+            Assert-CcodThrows {
+                Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters | Out-Null
+            } 'CCOD_INSTALL_UNSAFE_LEAF'
+            Assert-CcodEqual 'outside-original' ([IO.File]::ReadAllText($sentinel,[Text.UTF8Encoding]::new($false))) "$($case.Name) hard-link sentinel remains unchanged"
+            Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $install 'active.json'))) "$($case.Name) hard-link rejection cannot commit an active pointer"
+        } finally {
+            foreach ($path in @($source,$install,$outside,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force -ErrorAction SilentlyContinue } }
+        }
+    }
+}
+
 $results += Invoke-CcodTest 'runtime manifest leaf junction is rejected before write' {
     $source = New-CcodLifecycleTempRoot
     $install = New-CcodLifecycleTempRoot
@@ -930,7 +982,8 @@ $results += Invoke-CcodTest 'payload manifest ancestry treats Windows root equal
         New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22' | Out-Null
         $manifestPath = New-CcodLifecyclePayloadManifest -Root $source -Version '2.5.22'
         $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
-        $receipt = Invoke-CcodInstall -SourceRoot $source.ToUpperInvariant() -InstallRoot $install -ExpectedVersion '2.5.22' -PayloadManifestPath $manifestPath -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
+        $payloadBinding = Get-CcodLifecyclePayloadBinding -ManifestPath $manifestPath -ExpectedVersion '2.5.22'
+        $receipt = Invoke-CcodInstall -SourceRoot $source.ToUpperInvariant() -InstallRoot $install @payloadBinding -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
         Assert-CcodEqual 'Installed' $receipt.Outcome 'case-only source-root difference preserves valid Windows payload ancestry'
     } finally {
         foreach ($path in @($source,$install,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
@@ -954,8 +1007,9 @@ $results += Invoke-CcodTest 'payload-bound install rejects a changed runtime man
             [IO.File]::WriteAllText($runtimeManifestPath,($runtimeManifest|ConvertTo-Json -Depth 16),[Text.UTF8Encoding]::new($false))
             [pscustomobject][ordered]@{SupervisorReady=$true;TrayReady=$true}
         }.GetNewClosure()
+        $payloadBinding = Get-CcodLifecyclePayloadBinding -ManifestPath $manifestPath -ExpectedVersion '2.5.22'
         Assert-CcodThrows {
-            Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -ExpectedVersion '2.5.22' -PayloadManifestPath $manifestPath -Adapters $fake.Adapters | Out-Null
+            Invoke-CcodInstall -SourceRoot $source -InstallRoot $install @payloadBinding -Adapters $fake.Adapters | Out-Null
         } 'CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN'
         Assert-CcodTrue ($fake.World.Phases -notcontains 'Ready') 'changed selected runtime manifest cannot produce Ready'
     } finally {
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 3fa3cea..e75107d 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -1211,7 +1211,7 @@ Invoke-CcodTest 'setup build and activation bind one immutable versioned payload
     Assert-CcodTrue ($inno -cmatch 'InstallerPayloadDirectory' -and $inno -cmatch 'DestDir:\s*"\{app\}\\payload\\\{#ProjectVersion\}"') 'Inno copies the immutable build payload into its exact version directory'
     Assert-CcodTrue ($inno -cmatch "ExpandConstant\('\{app\}\\payload\\\{#ProjectVersion\}'\)" -and $inno -cmatch '-ExpectedVersion\s+"\{#ProjectVersion\}') 'Inno binds activation to its compiled payload version'
     Assert-CcodTrue ($activation -cmatch '\[string\]\$ExpectedVersion' -and $activation -cmatch '\[string\]\$ExpectedPayloadManifestSha256' -and $activation -cmatch 'installer-payload\.manifest\.json') 'activation accepts and resolves the expected payload contract'
-    Assert-CcodTrue ($installer -cmatch '\[string\]\$ExpectedVersion' -and $installer -cmatch '\[string\]\$PayloadManifestPath' -and $installer -cmatch '-ExpectedVersion\s+\$ExpectedVersion' -and $installer -cmatch '-PayloadManifestPath\s+\$PayloadManifestPath') 'installer forwards the immutable payload contract to lifecycle activation'
+    Assert-CcodTrue ($installer -cmatch '\[string\]\$ExpectedVersion' -and $installer -cmatch '\[string\]\$PayloadManifestPath' -and $installer -cmatch '\[string\]\$ExpectedPayloadManifestSha256' -and $installer -cmatch 'Open-CcodInstallerPayloadSeal' -and $installer -cmatch 'PayloadManifestBytesBase64') 'installer revalidates and forwards the exact immutable payload bytes to lifecycle activation'
 }
 
 # Production mutation caught: reopening mutable payload paths after the parent accepted their manifest bytes.
@@ -1434,6 +1434,9 @@ Invoke-CcodTest 'Inno exposes a pre-write payload-directory reparse gate' {
     $inno = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw -Encoding UTF8
     $helper = [regex]::Match($inno,'(?ms)^function IsSafeExistingPayloadDirectory\(.*?^end;')
     Assert-CcodTrue $helper.Success 'production Inno script exposes the directory predicate used before payload writes'
+    $streamHelper = [regex]::Match($inno,'(?ms)^function HasOnlyDefaultDataStream\(.*?^end;')
+    $leafHelper = [regex]::Match($inno,'(?ms)^function IsSafeExistingSetupLeaf\(.*?^end;')
+    Assert-CcodTrue ($streamHelper.Success -and $leafHelper.Success) 'production Inno script exposes native stream and link-count predicates for existing leaves'
     $treeHelper = [regex]::Match($inno,'(?ms)^function IsSafeExistingSetupTree\(.*?^end;')
     Assert-CcodTrue $treeHelper.Success 'production Inno script exposes a recursive destination-tree predicate'
     $inventoryValidator = [regex]::Match($inno,'(?ms)^function AreCcodExpectedSetupDirectoriesSafe\(.*?^end;')
@@ -1452,6 +1455,9 @@ Invoke-CcodTest 'Inno exposes a pre-write payload-directory reparse gate' {
         $expectedJunctionRoot = Join-Path $root 'expected-junction-root'
         $normalExpectedRoot = Join-Path $root 'normal-expected-root'
         $inventoryPayload = Join-Path $root 'inventory-payload'
+        $hardLinkTree = Join-Path $root 'hardlink-tree'
+        $outsideHardLink = Join-Path $root 'outside-hardlink-sentinel.txt'
+        $hardLinkLeaf = Join-Path $hardLinkTree 'existing-leaf.txt'
         $fileWriteMarker = Join-Path $expectedFileRoot 'payload-write-marker.txt'
         $junctionWriteMarker = Join-Path $expectedJunctionRoot 'payload-write-marker.txt'
         $resultPath = Join-Path $root 'result.txt'
@@ -1466,6 +1472,9 @@ Invoke-CcodTest 'Inno exposes a pre-write payload-directory reparse gate' {
         [IO.Directory]::CreateDirectory((Join-Path $expectedJunctionRoot 'payload\2.5.22\src')) | Out-Null
         New-Item -ItemType Junction -Path (Join-Path $expectedJunctionRoot 'payload\2.5.22\src\persistence') -Target $target | Out-Null
         [IO.Directory]::CreateDirectory($normalExpectedRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($hardLinkTree) | Out-Null
+        [IO.File]::WriteAllText($outsideHardLink,'outside-original',[Text.UTF8Encoding]::new($false))
+        New-Item -ItemType HardLink -Path $hardLinkLeaf -Target $outsideHardLink | Out-Null
         [IO.Directory]::CreateDirectory((Join-Path $inventoryPayload 'src\persistence\modules')) | Out-Null
         [IO.File]::WriteAllText((Join-Path $inventoryPayload 'src\persistence\modules\InstallLifecycle.psm1'),'fixture',[Text.UTF8Encoding]::new($false))
         $inventoryPath = Join-Path $root 'InventoryFixture.iss'
@@ -1485,10 +1494,60 @@ Uninstallable=no
 const
   CCOD_FILE_ATTRIBUTE_DIRECTORY = `$00000010;
   CCOD_FILE_ATTRIBUTE_REPARSE_POINT = `$00000400;
+  CCOD_FILE_READ_ATTRIBUTES = `$00000080;
+  CCOD_FILE_SHARE_READ = `$00000001;
+  CCOD_FILE_SHARE_WRITE = `$00000002;
+  CCOD_FILE_SHARE_DELETE = `$00000004;
+  CCOD_OPEN_EXISTING = 3;
+  CCOD_FILE_FLAG_OPEN_REPARSE_POINT = `$00200000;
   CCOD_INVALID_FILE_ATTRIBUTES = `$FFFFFFFF;
+  CCOD_INVALID_HANDLE_VALUE = -1;
+  CCOD_ERROR_HANDLE_EOF = 38;
+type
+  TCcodFileTime = record
+    LowDateTime: Cardinal;
+    HighDateTime: Cardinal;
+  end;
+  TCcodByHandleFileInformation = record
+    FileAttributes: Cardinal;
+    CreationTime: TCcodFileTime;
+    LastAccessTime: TCcodFileTime;
+    LastWriteTime: TCcodFileTime;
+    VolumeSerialNumber: Cardinal;
+    FileSizeHigh: Cardinal;
+    FileSizeLow: Cardinal;
+    NumberOfLinks: Cardinal;
+    FileIndexHigh: Cardinal;
+    FileIndexLow: Cardinal;
+  end;
+  TCcodFindStreamData = record
+    StreamSize: Int64;
+    StreamNameBuffer: array[0..591] of Byte;
+  end;
 function GetFileAttributesW(const FileName: String): Cardinal;
   external 'GetFileAttributesW@kernel32.dll stdcall';
+function CreateFileW(const FileName: String; DesiredAccess, ShareMode,
+  SecurityAttributes, CreationDisposition, FlagsAndAttributes,
+  TemplateFile: Cardinal): Integer;
+  external 'CreateFileW@kernel32.dll stdcall';
+function GetFileInformationByHandle(FileHandle: Integer;
+  var Information: TCcodByHandleFileInformation): Boolean;
+  external 'GetFileInformationByHandle@kernel32.dll stdcall';
+function CloseHandle(Handle: Integer): Boolean;
+  external 'CloseHandle@kernel32.dll stdcall';
+function FindFirstStreamW(const FileName: String; InfoLevel: Integer;
+  var StreamData: TCcodFindStreamData; Flags: Cardinal): Integer;
+  external 'FindFirstStreamW@kernel32.dll stdcall';
+function FindNextStreamW(FindHandle: Integer;
+  var StreamData: TCcodFindStreamData): Boolean;
+  external 'FindNextStreamW@kernel32.dll stdcall';
+function CcodFindClose(FindHandle: Integer): Boolean;
+  external 'FindClose@kernel32.dll stdcall';
+function GetLastError(): Cardinal;
+  external 'GetLastError@kernel32.dll stdcall';
 $($helper.Value)
+$($streamHelper.Value)
+$($leafHelper.Value)
 $($treeHelper.Value)
 $inventorySource
 $($inventoryValidator.Value)
@@ -1498,11 +1557,14 @@ begin
     SaveStringToFile('$($fileWriteMarker.Replace("'","''"))','unsafe write',False);
   if AreCcodExpectedSetupDirectoriesSafe('$($expectedJunctionRoot.Replace("'","''"))') then
     SaveStringToFile('$($junctionWriteMarker.Replace("'","''"))','unsafe write',False);
+  if IsSafeExistingSetupTree('$($hardLinkTree.Replace("'","''"))') then
+    SaveStringToFile('$($hardLinkLeaf.Replace("'","''"))','unsafe overwrite',False);
   if IsSafeExistingPayloadDirectory('$($normal.Replace("'","''"))') and
      IsSafeExistingPayloadDirectory('$($missing.Replace("'","''"))') and
      (not IsSafeExistingPayloadDirectory('$($junction.Replace("'","''"))')) and
      (not IsSafeExistingSetupTree('$($tree.Replace("'","''"))')) and
      (not IsSafeExistingSetupTree('$($fileDirectory.Replace("'","''"))')) and
+     (not IsSafeExistingSetupTree('$($hardLinkTree.Replace("'","''"))')) and
      AreCcodExpectedSetupDirectoriesSafe('$($normalExpectedRoot.Replace("'","''"))') and
      (not AreCcodExpectedSetupDirectoriesSafe('$($expectedFileRoot.Replace("'","''"))')) and
      (not AreCcodExpectedSetupDirectoriesSafe('$($expectedJunctionRoot.Replace("'","''"))')) then
@@ -1519,6 +1581,7 @@ end;
         Assert-CcodEqual 'pass' ([IO.File]::ReadAllText($resultPath,[Text.UTF8Encoding]::new($false))) 'production predicate rejects root/nested junctions and file-valued directory paths'
         Assert-CcodTrue (-not (Test-Path -LiteralPath $fileWriteMarker)) 'nested file-as-directory is rejected before simulated payload writes'
         Assert-CcodTrue (-not (Test-Path -LiteralPath $junctionWriteMarker)) 'nested junction is rejected before simulated payload writes'
+        Assert-CcodEqual 'outside-original' ([IO.File]::ReadAllText($outsideHardLink,[Text.UTF8Encoding]::new($false))) 'hard-linked setup leaf is rejected before simulated outside overwrite'
     } finally {
         if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
     }

From ca5a5f71f0348d8f6cb61b033405dfcaac6917ef Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 15:42:46 +0800
Subject: [PATCH 052/187] fix: bind setup artifact provenance

---
 CHANGELOG.md                                  |   8 +-
 README.md                                     |   2 +-
 README.zh-CN.md                               |   2 +-
 build/CodexControlOtherDevices.iss            |  14 ++
 build/SetupArtifact.psm1                      | 185 ++++++++++++++++++
 build/build.ps1                               |  90 ++++++---
 .../persistence/ReleaseWorkflow.SelfTest.ps1  |  89 ++++++++-
 tools/New-InstallerDestinationInventory.ps1   |   8 +-
 tools/Test-ReleaseDefender.ps1                |  21 +-
 9 files changed, 378 insertions(+), 41 deletions(-)
 create mode 100644 build/SetupArtifact.psm1

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 78dac76..e28d9b1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,15 +10,15 @@ No unreleased changes.
 
 ### English
 
-- Bound Setup activation to the requested version and a hash-verified installer payload manifest, then revalidated the active runtime before reporting Ready.
-- Restricted Setup compilation to one generated, inventoried input and rejected unapproved preprocessor constructs before ISCC runs.
+- Bound Setup activation to the exact verified manifest, installer, and module bytes across child launch, then revalidated the selected runtime before reporting Ready.
+- Rejected hard-linked install leaves before writes and added independent Setup PE/provenance validation for version, commit, and the activation payload-manifest hash.
 - Added bounded same-root process-tree rereads while preserving strict root and per-process identity checks during close and remote rebind.
 - Correlated native tray actions with the acknowledged presentation revision and durable, bounded terminal diagnostics; stale actions now produce a sanitized support code.
 
 ### 简体中文
 
-- 将 Setup 激活绑定到请求版本和经哈希校验的安装载荷 manifest，并在报告 Ready 前重新校验活动 runtime。
-- Setup 只编译一份已清点目录的生成输入；任何未获准的预处理构造都会在 ISCC 运行前被拒绝。
+- 将 Setup 激活绑定到跨子进程启动仍保持不变的 manifest、installer 与 module 精确字节，并在报告 Ready 前重新校验所选 runtime。
+- 在写入前拒绝安装目录中的硬链接叶子，并独立校验 Setup PE/构建 provenance 所绑定的版本、commit 与激活 payload-manifest 哈希。
 - 为同一根进程加入有界 process-tree 重读，同时在关闭和远程重绑定时继续严格校验根进程与每个成员的身份。
 - 将原生托盘操作绑定到已确认的 presentation revision 和持久、有界的终态诊断；过期操作会记录清理后的支持代码。
 
diff --git a/README.md b/README.md
index dd815b0..76c384a 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@
 </p>
 
 > [!NOTE]
-> **Release status:** v2.5.22 is the current stable release. The setup installer and EXE-based portable ZIP are version- and manifest-bound release assets.
+> **Release status:** v2.5.22 is the current release candidate. Its setup installer and EXE-based portable ZIP are version- and manifest-bound; stable Windows acceptance still requires recorded install, upgrade, reboot, repair, UI, and Defender verification.
 
 CodexRemote-fix enables the UI that ships with Codex Desktop for Windows but is hidden by a runtime defect:
 
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 7acbcf6..ba6c6fe 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -16,7 +16,7 @@
 </p>
 
 > [!NOTE]
-> **发布状态：** v2.5.22 是当前稳定版。安装包与以 EXE 启动的便携 ZIP 都是绑定版本和 manifest 的发布资产。
+> **发布状态：** v2.5.22 是当前候选发布版。安装包与以 EXE 启动的便携 ZIP 都已绑定版本和 manifest；Windows 稳定版验收仍需记录安装、升级、重启、修复、UI 与 Defender 的实机验证结果。
 
 CodexRemote-fix 在 Windows 版 Codex Desktop 中启用随应用一起打包、但因运行时缺陷被隐藏的：
 
diff --git a/build/CodexControlOtherDevices.iss b/build/CodexControlOtherDevices.iss
index b99a09d..c77f35c 100644
--- a/build/CodexControlOtherDevices.iss
+++ b/build/CodexControlOtherDevices.iss
@@ -11,6 +11,12 @@
 #ifndef InstallerPayloadManifestSha256
 #error InstallerPayloadManifestSha256 must be supplied by the release builder
 #endif
+#ifndef SetupGitCommit
+#error SetupGitCommit must be supplied by the release builder
+#endif
+#ifndef SetupProvenancePath
+#error SetupProvenancePath must be supplied by the release builder
+#endif
 AppId={{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}
 AppName=CodexRemote-fix
 AppVersion={#ProjectVersion}
@@ -20,6 +26,12 @@ AppPublisherURL=https://github.com/naipi11/CodexRemote-fix
 AppSupportURL=https://github.com/naipi11/CodexRemote-fix/issues
 AppUpdatesURL=https://github.com/naipi11/CodexRemote-fix/releases
 VersionInfoVersion={#ProjectVersion}.0
+VersionInfoTextVersion={#ProjectVersion}.0
+VersionInfoProductName=CodexRemote-fix
+VersionInfoProductTextVersion={#ProjectVersion}.0
+VersionInfoDescription=CCODSETUP {#ProjectVersion}
+VersionInfoCompany={#SetupGitCommit}
+VersionInfoCopyright={#InstallerPayloadManifestSha256}
 DefaultDirName={localappdata}\CodexControlOtherDevices-installer
 DefaultGroupName=CodexRemote-fix
 UsePreviousGroup=no
@@ -43,6 +55,7 @@ MinVersion=10.0.17763
 Name: "english"; MessagesFile: "compiler:Default.isl"
 
 [Files]
+Source: "{#SetupProvenancePath}"; DestDir: "{app}"; DestName: "setup-provenance.json"; Flags: dontcopy
 Source: "..\README.md"; DestDir: "{app}"; Flags: ignoreversion
 Source: "..\README.zh-CN.md"; DestDir: "{app}"; Flags: ignoreversion
 Source: "..\LICENSE"; DestDir: "{app}"; Flags: ignoreversion
@@ -51,6 +64,7 @@ Source: "..\SECURITY.md"; DestDir: "{app}"; Flags: ignoreversion
 Source: "..\package.json"; DestDir: "{app}"; Flags: ignoreversion
 Source: "..\build\CodexControlOtherDevices.iss"; DestDir: "{app}\build"; Flags: ignoreversion
 Source: "..\build\build.ps1"; DestDir: "{app}\build"; Flags: ignoreversion
+Source: "..\build\SetupArtifact.psm1"; DestDir: "{app}\build"; Flags: ignoreversion
 Source: "..\build\build-trayhost.ps1"; DestDir: "{app}\build"; Flags: ignoreversion
 Source: "..\build\TrayHostBuild.psm1"; DestDir: "{app}\build"; Flags: ignoreversion
 Source: "..\build\TrayHostReferencePack.psm1"; DestDir: "{app}\build"; Flags: ignoreversion
diff --git a/build/SetupArtifact.psm1 b/build/SetupArtifact.psm1
new file mode 100644
index 0000000..58995fe
--- /dev/null
+++ b/build/SetupArtifact.psm1
@@ -0,0 +1,185 @@
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+function Throw-CcodSetupArtifactError {
+    param([Parameter(Mandatory)][string]$Id,[Parameter(Mandatory)][string]$Message,$Target)
+    throw [Management.Automation.ErrorRecord]::new(
+        [InvalidOperationException]::new($Message),
+        $Id,
+        [Management.Automation.ErrorCategory]::InvalidData,
+        $Target
+    )
+}
+
+function Get-CcodSetupArtifactHash {
+    param([Parameter(Mandatory)][string]$Path)
+    $sha = [Security.Cryptography.SHA256]::Create()
+    $stream = $null
+    try {
+        $stream = [IO.File]::Open([IO.Path]::GetFullPath($Path),[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read)
+        return [BitConverter]::ToString($sha.ComputeHash($stream)).Replace('-','').ToLowerInvariant()
+    } finally {
+        if ($null -ne $stream) { $stream.Dispose() }
+        $sha.Dispose()
+    }
+}
+
+function Test-CcodSetupCanonicalUtc {
+    param([AllowNull()][string]$Value)
+    if ([string]::IsNullOrWhiteSpace($Value)) { return $false }
+    $parsed = [DateTime]::MinValue
+    return [DateTime]::TryParseExact($Value,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind,[ref]$parsed) -and
+        $parsed.Kind -eq [DateTimeKind]::Utc -and
+        $parsed.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture) -ceq $Value
+}
+
+function Get-CcodSetupDescription {
+    param([Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$Version)
+    return "CCODSETUP $Version"
+}
+
+function Assert-CcodSetupRegularFile {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$Kind)
+    $full = [IO.Path]::GetFullPath($Path)
+    if (-not [IO.File]::Exists($full)) { Throw-CcodSetupArtifactError 'CCOD_SETUP_ARTIFACT_INVALID' "$Kind is missing" $full }
+    $item = Get-Item -LiteralPath $full -Force -ErrorAction Stop
+    if ($item.PSIsContainer -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) {
+        Throw-CcodSetupArtifactError 'CCOD_SETUP_ARTIFACT_INVALID' "$Kind must be a regular non-reparse file" $full
+    }
+    return $full
+}
+
+function Test-CcodSetupArtifact {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string]$SetupPath,
+        [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion,
+        [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit,
+        [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedPayloadManifestSha256
+    )
+
+    $setup = Assert-CcodSetupRegularFile -Path $SetupPath -Kind 'Setup artifact'
+    $expectedPeVersion = "$ExpectedVersion.0"
+    $expectedDescription = Get-CcodSetupDescription -Version $ExpectedVersion
+    try { $versionInfo = [Diagnostics.FileVersionInfo]::GetVersionInfo($setup) }
+    catch { Throw-CcodSetupArtifactError 'CCOD_SETUP_PE_VERSION_INVALID' 'Setup PE version metadata could not be read' $setup }
+    $fileVersion = ([string]$versionInfo.FileVersion).Trim()
+    $productVersion = ([string]$versionInfo.ProductVersion).Trim()
+    $productName = ([string]$versionInfo.ProductName).Trim()
+    $fileDescription = ([string]$versionInfo.FileDescription).Trim()
+    $companyName = ([string]$versionInfo.CompanyName).Trim()
+    $legalCopyright = ([string]$versionInfo.LegalCopyright).Trim()
+    if ($fileVersion -cne $expectedPeVersion -or $productVersion -cne $expectedPeVersion) {
+        Throw-CcodSetupArtifactError 'CCOD_SETUP_PE_VERSION_INVALID' ("Setup PE FileVersion/ProductVersion do not match the release version: file={0}; product={1}; expected={2}" -f [string]$versionInfo.FileVersion,[string]$versionInfo.ProductVersion,$expectedPeVersion) $setup
+    }
+    if ($productName -cne 'CodexRemote-fix' -or $fileDescription -cne $expectedDescription -or
+        $companyName -cne $ExpectedGitCommit -or $legalCopyright -cne $ExpectedPayloadManifestSha256) {
+        Throw-CcodSetupArtifactError 'CCOD_SETUP_PAYLOAD_BINDING_INVALID' ("Setup PE does not bind the expected version, commit, and activation payload manifest hash: product={0}; description={1}; company={2}; copyright={3}" -f $productName,$fileDescription,$companyName,$legalCopyright) $setup
+    }
+    return [pscustomobject][ordered]@{
+        Valid = $true
+        Sha256 = Get-CcodSetupArtifactHash -Path $setup
+        FileVersion = $fileVersion
+        ProductVersion = $productVersion
+        ProductName = $productName
+        FileDescription = $fileDescription
+        CompanyName = $companyName
+        LegalCopyright = $legalCopyright
+    }
+}
+
+function New-CcodSetupBuildProvenance {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$Version,
+        [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$GitCommit,
+        [Parameter(Mandatory)][string]$BuildTimestampUtc,
+        [Parameter(Mandatory)][string]$PayloadManifestPath,
+        [Parameter(Mandatory)][string]$InnoTemplatePath,
+        [Parameter(Mandatory)][string]$DestinationInventoryPath,
+        [Parameter(Mandatory)][string]$CompilerPath,
+        [Parameter(Mandatory)][string]$OutputPath
+    )
+
+    if (-not (Test-CcodSetupCanonicalUtc $BuildTimestampUtc)) { Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Setup provenance timestamp is not canonical UTC' $BuildTimestampUtc }
+    $payload = Assert-CcodSetupRegularFile -Path $PayloadManifestPath -Kind 'Installer payload manifest'
+    $template = Assert-CcodSetupRegularFile -Path $InnoTemplatePath -Kind 'Inno template'
+    $inventory = Assert-CcodSetupRegularFile -Path $DestinationInventoryPath -Kind 'Destination inventory'
+    $compiler = Assert-CcodSetupRegularFile -Path $CompilerPath -Kind 'Inno compiler'
+    try { $payloadRecord = [IO.File]::ReadAllText($payload,[Text.UTF8Encoding]::new($false)) | ConvertFrom-Json -ErrorAction Stop }
+    catch { Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Installer payload manifest is invalid JSON' $payload }
+    if ($payloadRecord.schemaVersion -isnot [int] -or $payloadRecord.schemaVersion -ne 1 -or
+        $payloadRecord.projectVersion -isnot [string] -or $payloadRecord.projectVersion -cne $Version -or
+        @($payloadRecord.files).Count -eq 0) { Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Installer payload manifest metadata is invalid' $payload }
+    $payloadHash = Get-CcodSetupArtifactHash -Path $payload
+    $compilerVersion = [Diagnostics.FileVersionInfo]::GetVersionInfo($compiler)
+    $record = [ordered]@{
+        schemaVersion = 1
+        product = 'CodexRemote-fix'
+        version = $Version
+        gitCommit = $GitCommit
+        buildTimestampUtc = $BuildTimestampUtc
+        payloadManifest = [ordered]@{
+            name = 'installer-payload.manifest.json'
+            length = [int64](Get-Item -LiteralPath $payload -Force).Length
+            sha256 = $payloadHash
+            fileCount = [int]@($payloadRecord.files).Count
+        }
+        buildInputs = [ordered]@{
+            innoTemplateSha256 = Get-CcodSetupArtifactHash -Path $template
+            destinationInventorySha256 = Get-CcodSetupArtifactHash -Path $inventory
+            compilerSha256 = Get-CcodSetupArtifactHash -Path $compiler
+            compilerFileVersion = [string]$compilerVersion.FileVersion
+        }
+        peContract = [ordered]@{
+            fileVersion = "$Version.0"
+            productVersion = "$Version.0"
+            productName = 'CodexRemote-fix'
+            fileDescription = Get-CcodSetupDescription -Version $Version
+            companyName = $GitCommit
+            legalCopyright = $payloadHash
+        }
+    }
+    $output = [IO.Path]::GetFullPath($OutputPath)
+    if ([IO.File]::Exists($output) -or [IO.Directory]::Exists($output)) { Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Refusing to overwrite Setup provenance' $output }
+    [IO.File]::WriteAllText($output,(($record | ConvertTo-Json -Depth 8) + [Environment]::NewLine),[Text.UTF8Encoding]::new($false))
+    return [pscustomobject]$record
+}
+
+function Test-CcodSetupBuildProvenance {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string]$ProvenancePath,
+        [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion,
+        [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit,
+        [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedPayloadManifestSha256,
+        [string]$ExpectedBuildTimestampUtc
+    )
+    $path = Assert-CcodSetupRegularFile -Path $ProvenancePath -Kind 'Setup provenance'
+    try { $raw = [IO.File]::ReadAllText($path,[Text.UTF8Encoding]::new($false)); $record = $raw | ConvertFrom-Json -ErrorAction Stop }
+    catch { Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Setup provenance is invalid JSON' $path }
+    $fields = @('schemaVersion','product','version','gitCommit','buildTimestampUtc','payloadManifest','buildInputs','peContract')
+    if ($record -isnot [pscustomobject] -or ((@($record.PSObject.Properties.Name | Sort-Object) -join '|') -cne (@($fields | Sort-Object) -join '|')) -or
+        $record.schemaVersion -isnot [int] -or $record.schemaVersion -ne 1 -or $record.product -isnot [string] -or $record.product -cne 'CodexRemote-fix' -or
+        $record.version -isnot [string] -or $record.version -cne $ExpectedVersion -or $record.gitCommit -isnot [string] -or $record.gitCommit -cne $ExpectedGitCommit -or
+        -not (Test-CcodSetupCanonicalUtc ([string]$record.buildTimestampUtc)) -or
+        (-not [string]::IsNullOrWhiteSpace($ExpectedBuildTimestampUtc) -and [string]$record.buildTimestampUtc -cne $ExpectedBuildTimestampUtc) -or
+        $record.payloadManifest.sha256 -isnot [string] -or $record.payloadManifest.sha256 -cne $ExpectedPayloadManifestSha256 -or
+        $record.payloadManifest.name -isnot [string] -or $record.payloadManifest.name -cne 'installer-payload.manifest.json' -or
+        [int64]$record.payloadManifest.length -le 0 -or [int]$record.payloadManifest.fileCount -le 0 -or
+        $record.peContract.fileVersion -isnot [string] -or $record.peContract.fileVersion -cne "$ExpectedVersion.0" -or
+        $record.peContract.productVersion -isnot [string] -or $record.peContract.productVersion -cne "$ExpectedVersion.0" -or
+        $record.peContract.productName -isnot [string] -or $record.peContract.productName -cne 'CodexRemote-fix' -or
+        $record.peContract.fileDescription -isnot [string] -or $record.peContract.fileDescription -cne (Get-CcodSetupDescription -Version $ExpectedVersion) -or
+        $record.peContract.companyName -isnot [string] -or $record.peContract.companyName -cne $ExpectedGitCommit -or
+        $record.peContract.legalCopyright -isnot [string] -or $record.peContract.legalCopyright -cne $ExpectedPayloadManifestSha256 -or
+        $record.buildInputs.innoTemplateSha256 -isnot [string] -or $record.buildInputs.innoTemplateSha256 -cnotmatch '^[0-9a-f]{64}$' -or
+        $record.buildInputs.destinationInventorySha256 -isnot [string] -or $record.buildInputs.destinationInventorySha256 -cnotmatch '^[0-9a-f]{64}$' -or
+        $record.buildInputs.compilerSha256 -isnot [string] -or $record.buildInputs.compilerSha256 -cnotmatch '^[0-9a-f]{64}$' -or
+        $record.buildInputs.compilerFileVersion -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$record.buildInputs.compilerFileVersion)) {
+        Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Setup provenance is not exactly bound to the release contract' $path
+    }
+    return $record
+}
+
+Export-ModuleMember -Function Get-CcodSetupArtifactHash,Get-CcodSetupDescription,New-CcodSetupBuildProvenance,Test-CcodSetupBuildProvenance,Test-CcodSetupArtifact
diff --git a/build/build.ps1 b/build/build.ps1
index 8b900c8..c9cdf94 100644
--- a/build/build.ps1
+++ b/build/build.ps1
@@ -130,6 +130,10 @@ function Assert-CcodBuildInnoPreprocessorLines {
         '#error InstallerPayloadDirectory must be supplied by the release builder',
         '#ifndef InstallerPayloadManifestSha256',
         '#error InstallerPayloadManifestSha256 must be supplied by the release builder',
+        '#ifndef SetupGitCommit',
+        '#error SetupGitCommit must be supplied by the release builder',
+        '#ifndef SetupProvenancePath',
+        '#error SetupProvenancePath must be supplied by the release builder',
         '#endif'
     )
     $allowedInlineConstructs = @(
@@ -137,7 +141,9 @@ function Assert-CcodBuildInnoPreprocessorLines {
         '{#TrayHostArtifactDirectory}',
         '{#PortableArtifactDirectory}',
         '{#InstallerPayloadDirectory}',
-        '{#InstallerPayloadManifestSha256}'
+        '{#InstallerPayloadManifestSha256}',
+        '{#SetupGitCommit}',
+        '{#SetupProvenancePath}'
     )
     for ($lineIndex = 0; $lineIndex -lt $Lines.Count; $lineIndex++) {
         $line = [string]$Lines[$lineIndex]
@@ -249,6 +255,50 @@ function Invoke-CcodBuildInnoCompiler {
     }
 }
 
+function Remove-CcodBuildTemporarySetupInput {
+    param(
+        [Parameter(Mandatory)][string]$BuildRoot,
+        [Parameter(Mandatory)][string]$Path,
+        [Parameter(Mandatory)][ValidateSet('PayloadDirectory','DestinationInventory')][string]$Kind
+    )
+    $root = [IO.Path]::GetFullPath($BuildRoot).TrimEnd('\')
+    $candidate = [IO.Path]::GetFullPath($Path)
+    $parent = [IO.Path]::GetFullPath((Split-Path $candidate -Parent)).TrimEnd('\')
+    $leaf = [IO.Path]::GetFileName($candidate)
+    $expectedPattern = if ($Kind -ceq 'PayloadDirectory') { '^\.installer-payload-stage-[0-9a-f]{32}$' } else { '^\.installer-destination-inventory-[0-9a-f]{32}\.iss$' }
+    if (-not $parent.Equals($root,[StringComparison]::OrdinalIgnoreCase) -or $leaf -cnotmatch $expectedPattern) {
+        throw "Refusing to clean an unexpected temporary Setup input: $candidate"
+    }
+    if ($Kind -ceq 'PayloadDirectory') {
+        if (-not [IO.Directory]::Exists($candidate)) { return }
+        $rootItem = Get-Item -LiteralPath $candidate -Force -ErrorAction Stop
+        if (($rootItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw "Refusing to clean a reparse Setup payload stage: $candidate" }
+        foreach ($item in @(Get-ChildItem -LiteralPath $candidate -Force -Recurse -ErrorAction Stop)) {
+            if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw "Refusing to clean a Setup payload stage containing a reparse point: $($item.FullName)" }
+        }
+        Remove-Item -LiteralPath $candidate -Recurse -Force -ErrorAction Stop
+        return
+    }
+    if (-not [IO.File]::Exists($candidate)) { return }
+    $inventory = Get-Item -LiteralPath $candidate -Force -ErrorAction Stop
+    if ($inventory.PSIsContainer -or ($inventory.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw "Refusing to clean an unsafe Setup destination inventory: $candidate" }
+    Remove-Item -LiteralPath $candidate -Force -ErrorAction Stop
+}
+
+function Invoke-CcodBuildTemporarySetupScope {
+    param(
+        [Parameter(Mandatory)][string]$BuildRoot,
+        [Parameter(Mandatory)][string]$InstallerPayloadDirectory,
+        [Parameter(Mandatory)][string]$DestinationInventoryPath,
+        [Parameter(Mandatory)][scriptblock]$Action
+    )
+    try { & $Action $InstallerPayloadDirectory $DestinationInventoryPath }
+    finally {
+        Remove-CcodBuildTemporarySetupInput -BuildRoot $BuildRoot -Path $InstallerPayloadDirectory -Kind PayloadDirectory
+        Remove-CcodBuildTemporarySetupInput -BuildRoot $BuildRoot -Path $DestinationInventoryPath -Kind DestinationInventory
+    }
+}
+
 if ($Library) { return }
 
 $repoRoot = Split-Path $PSScriptRoot -Parent
@@ -280,13 +330,16 @@ $payloadManifestAsset = Join-Path $dist "CodexRemote-fix-$Version-payload-manife
 $releaseManifest = Join-Path $dist "CodexRemote-fix-$Version-release-manifest.json"
 $setupExe = Join-Path $dist "CodexRemote-fix-$Version-setup.exe"
 $setupChecksum = "$setupExe.sha256.txt"
-foreach ($path in @($bundle,$checksum,$provenance,$payloadManifestAsset,$releaseManifest,$setupExe,$setupChecksum)) {
+$setupProvenance = Join-Path $dist "CodexRemote-fix-$Version-setup-provenance.json"
+$setupReleaseManifest = Join-Path $dist "CodexRemote-fix-$Version-setup-release-manifest.json"
+foreach ($path in @($bundle,$checksum,$provenance,$payloadManifestAsset,$releaseManifest,$setupExe,$setupChecksum,$setupProvenance,$setupReleaseManifest)) {
     if ([IO.File]::Exists($path) -or [IO.Directory]::Exists($path)) { throw "Refusing to overwrite immutable release output: $path" }
 }
 
 $stageRoot = Join-Path $PSScriptRoot ('.portable-stage-' + [guid]::NewGuid().ToString('N'))
 $installerPayloadDirectory = Join-Path $PSScriptRoot ('.installer-payload-stage-' + [guid]::NewGuid().ToString('N'))
 $installerDestinationInventoryPath = Join-Path $PSScriptRoot ('.installer-destination-inventory-' + [guid]::NewGuid().ToString('N') + '.iss')
+Invoke-CcodBuildTemporarySetupScope -BuildRoot $PSScriptRoot -InstallerPayloadDirectory $installerPayloadDirectory -DestinationInventoryPath $installerDestinationInventoryPath -Action ({
 try {
     [IO.Directory]::CreateDirectory($stageRoot) | Out-Null
     $payloadRoot = Join-Path $stageRoot 'payload'
@@ -427,18 +480,23 @@ $isccCandidates = @(
 $iscc = $isccCandidates | Where-Object { -not [string]::IsNullOrWhiteSpace($_) -and [IO.File]::Exists($_) } | Select-Object -First 1
 if (-not $iscc) { throw 'Inno Setup 6 (ISCC.exe) was not found. Install it with: winget install --id JRSoftware.InnoSetup --exact' }
 $issPath = Join-Path $PSScriptRoot 'CodexControlOtherDevices.iss'
+Import-Module (Join-Path $PSScriptRoot 'SetupArtifact.psm1') -Force
+$setupProvenanceRecord = New-CcodSetupBuildProvenance -Version $Version -GitCommit $gitCommit -BuildTimestampUtc $buildTimestampUtc -PayloadManifestPath $installerPayloadManifestPath -InnoTemplatePath $issPath -DestinationInventoryPath $installerDestinationInventoryPath -CompilerPath $iscc -OutputPath $setupProvenance
+Test-CcodSetupBuildProvenance -ProvenancePath $setupProvenance -ExpectedVersion $Version -ExpectedGitCommit $gitCommit -ExpectedPayloadManifestSha256 $installerPayloadManifestSha256 -ExpectedBuildTimestampUtc $buildTimestampUtc | Out-Null
 $isccArguments = @(
     "/DProjectVersion=$Version",
     "/DTrayHostArtifactDirectory=$trayHostArtifact",
     "/DPortableArtifactDirectory=$portableArtifact",
     "/DInstallerPayloadDirectory=$installerPayloadDirectory",
     "/DInstallerPayloadManifestSha256=$installerPayloadManifestSha256",
+    "/DSetupGitCommit=$gitCommit",
+    "/DSetupProvenancePath=$setupProvenance",
     "/O$dist\."
 )
 Invoke-CcodBuildInnoCompiler -TemplatePath $issPath -InventoryPath $installerDestinationInventoryPath -IsccPath $iscc -Arguments $isccArguments -SetupPath $setupExe
-$setupHash = Get-CcodBuildFileSha256 -Path $setupExe
+$setupValidation = Test-CcodSetupArtifact -SetupPath $setupExe -ExpectedVersion $Version -ExpectedGitCommit $gitCommit -ExpectedPayloadManifestSha256 $installerPayloadManifestSha256
+$setupHash = [string]$setupValidation.Sha256
 Write-CcodBuildUtf8 -Path $setupChecksum -Text ("{0} *{1}" -f $setupHash,[IO.Path]::GetFileName($setupExe))
-$setupReleaseManifest = Join-Path $dist "CodexRemote-fix-$Version-setup-release-manifest.json"
 $setupRecord = [ordered]@{
     schemaVersion = 1
     product = 'CodexRemote-fix'
@@ -448,7 +506,8 @@ $setupRecord = [ordered]@{
     assets = @(
         [ordered]@{ name = [IO.Path]::GetFileName($setupExe); sha256 = $setupHash },
         [ordered]@{ name = [IO.Path]::GetFileName($setupChecksum); sha256 = Get-CcodBuildFileSha256 -Path $setupChecksum },
-        [ordered]@{ name = [IO.Path]::GetFileName($provenance); sha256 = Get-CcodBuildFileSha256 -Path $provenance }
+        [ordered]@{ name = [IO.Path]::GetFileName($provenance); sha256 = Get-CcodBuildFileSha256 -Path $provenance },
+        [ordered]@{ name = [IO.Path]::GetFileName($setupProvenance); sha256 = Get-CcodBuildFileSha256 -Path $setupProvenance }
     )
 }
 Write-CcodBuildUtf8 -Path $setupReleaseManifest -Text (($setupRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine)
@@ -458,24 +517,7 @@ Write-Host ''
 Write-Host 'Installer build completed:' -ForegroundColor Green
 Write-Host ("  Setup:    {0}" -f $setupExe)
 Write-Host ("  SHA-256:  {0}" -f $setupChecksum)
+Write-Host ("  Provenance: {0}" -f $setupProvenance)
 Write-Host ("  Manifest: {0}" -f $setupReleaseManifest)
 Write-Host ''
-
-if ([IO.Directory]::Exists($installerPayloadDirectory)) {
-    $installerPayloadFull = [IO.Path]::GetFullPath($installerPayloadDirectory)
-    $buildFull = [IO.Path]::GetFullPath($PSScriptRoot).TrimEnd('\') + '\'
-    if ($installerPayloadFull.StartsWith($buildFull,[StringComparison]::OrdinalIgnoreCase) -and
-        [IO.Path]::GetFileName($installerPayloadFull).StartsWith('.installer-payload-stage-',[StringComparison]::Ordinal) -and
-        -not ((Get-Item -LiteralPath $installerPayloadFull -Force).Attributes -band [IO.FileAttributes]::ReparsePoint)) {
-        Remove-Item -LiteralPath $installerPayloadFull -Recurse -Force -ErrorAction SilentlyContinue
-    }
-}
-if ([IO.File]::Exists($installerDestinationInventoryPath)) {
-    $inventoryFull = [IO.Path]::GetFullPath($installerDestinationInventoryPath)
-    $buildFull = [IO.Path]::GetFullPath($PSScriptRoot).TrimEnd('\') + '\'
-    if ($inventoryFull.StartsWith($buildFull,[StringComparison]::OrdinalIgnoreCase) -and
-        [IO.Path]::GetFileName($inventoryFull).StartsWith('.installer-destination-inventory-',[StringComparison]::Ordinal) -and
-        -not ((Get-Item -LiteralPath $inventoryFull -Force).Attributes -band [IO.FileAttributes]::ReparsePoint)) {
-        Remove-Item -LiteralPath $inventoryFull -Force -ErrorAction SilentlyContinue
-    }
-}
+}.GetNewClosure())
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index e75107d..85efd25 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -165,28 +165,52 @@ function New-CcodReleaseFixture {
     $root = Join-Path $env:TEMP ('ccod-release-workflow-' + [guid]::NewGuid().ToString('N'))
     $null = [IO.Directory]::CreateDirectory($root)
     $installer = Join-Path $root 'CodexRemote-fix-2.5.0-setup.exe'
-    [IO.File]::WriteAllBytes($installer, [byte[]](9,8,7,6,5,4,3,2,1))
+    $commit = 'a' * 40
+    $payloadHash = 'd' * 64
+    $typeName = 'SetupFixture' + [guid]::NewGuid().ToString('N')
+    $setupSource = @"
+using System.Reflection;
+[assembly: AssemblyVersion("2.5.0.0")]
+[assembly: AssemblyFileVersion("2.5.0.0")]
+[assembly: AssemblyInformationalVersion("2.5.0.0")]
+[assembly: AssemblyProduct("CodexRemote-fix")]
+[assembly: AssemblyTitle("CCODSETUP 2.5.0")]
+[assembly: AssemblyDescription("CCODSETUP 2.5.0")]
+[assembly: AssemblyCompany("$commit")]
+[assembly: AssemblyCopyright("$payloadHash")]
+public static class $typeName { public static int Main() { return 0; } }
+"@
+    Add-Type -TypeDefinition $setupSource -Language CSharp -OutputAssembly $installer -OutputType ConsoleApplication
     $checksum = "$installer.sha256.txt"
     $installerHash = Get-CcodTestFileSha256 -Path $installer
     [IO.File]::WriteAllText($checksum, ("{0} *{1}`r`n" -f $installerHash, [IO.Path]::GetFileName($installer)), [Text.UTF8Encoding]::new($false))
     $trayHost = Join-Path $root 'CodexRemote-fix-2.5.0-trayhost-provenance.json'
-    [IO.File]::WriteAllText($trayHost, ('{"schemaVersion":1,"product":"CodexRemote-fix","version":"2.5.0","gitCommit":"' + ('a' * 40) + '","buildTimestampUtc":"2026-08-24T00:00:00.0000000Z"}'), [Text.UTF8Encoding]::new($false))
+    [IO.File]::WriteAllText($trayHost, ('{"schemaVersion":1,"product":"CodexRemote-fix","version":"2.5.0","gitCommit":"' + $commit + '","buildTimestampUtc":"2026-08-24T00:00:00.0000000Z"}'), [Text.UTF8Encoding]::new($false))
+    $setupProvenance = Join-Path $root 'CodexRemote-fix-2.5.0-setup-provenance.json'
+    $setupProvenanceRecord = [ordered]@{
+        schemaVersion=1;product='CodexRemote-fix';version='2.5.0';gitCommit=$commit;buildTimestampUtc='2026-08-24T00:00:00.0000000Z'
+        payloadManifest=[ordered]@{name='installer-payload.manifest.json';length=[int64]123;sha256=$payloadHash;fileCount=3}
+        buildInputs=[ordered]@{innoTemplateSha256=('1'*64);destinationInventorySha256=('2'*64);compilerSha256=('3'*64);compilerFileVersion='6.7.3.0'}
+        peContract=[ordered]@{fileVersion='2.5.0.0';productVersion='2.5.0.0';productName='CodexRemote-fix';fileDescription='CCODSETUP 2.5.0';companyName=$commit;legalCopyright=$payloadHash}
+    }
+    [IO.File]::WriteAllText($setupProvenance,(($setupProvenanceRecord|ConvertTo-Json -Depth 8)+"`n"),[Text.UTF8Encoding]::new($false))
     $manifest = Join-Path $root 'CodexRemote-fix-2.5.0-setup-release-manifest.json'
     $assets = @(
         [ordered]@{ name = [IO.Path]::GetFileName($installer); sha256 = $installerHash },
         [ordered]@{ name = [IO.Path]::GetFileName($checksum); sha256 = Get-CcodTestFileSha256 -Path $checksum },
-        [ordered]@{ name = [IO.Path]::GetFileName($trayHost); sha256 = Get-CcodTestFileSha256 -Path $trayHost }
+        [ordered]@{ name = [IO.Path]::GetFileName($trayHost); sha256 = Get-CcodTestFileSha256 -Path $trayHost },
+        [ordered]@{ name = [IO.Path]::GetFileName($setupProvenance); sha256 = Get-CcodTestFileSha256 -Path $setupProvenance }
     )
     $record = [ordered]@{
         schemaVersion = 1
         product = 'CodexRemote-fix'
         version = '2.5.0'
-        gitCommit = ('a' * 40)
+        gitCommit = $commit
         buildTimestampUtc = '2026-08-24T00:00:00.0000000Z'
         assets = $assets
     }
     [IO.File]::WriteAllText($manifest, ($record | ConvertTo-Json -Depth 8), [Text.UTF8Encoding]::new($false))
-    return [pscustomobject]@{ Root = $root; Installer = $installer; Checksum = $checksum; TrayHost = $trayHost; Manifest = $manifest }
+    return [pscustomobject]@{ Root = $root; Installer = $installer; Checksum = $checksum; TrayHost = $trayHost; SetupProvenance = $setupProvenance; Manifest = $manifest; PayloadManifestSha256 = $payloadHash }
 }
 
 function New-CcodPortableReleaseFixture {
@@ -1165,9 +1189,13 @@ function Invoke-CcodInnoPayloadCompileFixture {
         (Join-Path $env:ProgramFiles 'Inno Setup 6\ISCC.exe')
     ) | Where-Object { $_ -and [IO.File]::Exists($_) } | Select-Object -First 1
     if (-not $iscc) { throw 'Inno Setup 6 is required for the setup payload contract' }
-    $arguments = @('/DProjectVersion=2.5.21',"/DTrayHostArtifactDirectory=$tray","/DPortableArtifactDirectory=$portable","/O$output\")
+    $payloadManifestSha256 = Get-CcodTestFileSha256 -Path $manifestPath
+    $setupGitCommit = 'c' * 40
+    $setupProvenancePath = Join-Path $root 'setup-provenance.json'
+    [IO.File]::WriteAllText($setupProvenancePath,'{}',[Text.UTF8Encoding]::new($false))
+    $arguments = @('/DProjectVersion=2.5.21',"/DTrayHostArtifactDirectory=$tray","/DPortableArtifactDirectory=$portable","/DSetupGitCommit=$setupGitCommit","/DSetupProvenancePath=$setupProvenancePath","/O$output\")
     if ($IncludePayloadDefines) {
-        $arguments = @('/DProjectVersion=2.5.21',"/DTrayHostArtifactDirectory=$tray","/DPortableArtifactDirectory=$portable","/DInstallerPayloadDirectory=$payload","/DInstallerPayloadManifestSha256=$(Get-CcodTestFileSha256 -Path $manifestPath)")
+        $arguments = @('/DProjectVersion=2.5.21',"/DTrayHostArtifactDirectory=$tray","/DPortableArtifactDirectory=$portable","/DInstallerPayloadDirectory=$payload","/DInstallerPayloadManifestSha256=$payloadManifestSha256","/DSetupGitCommit=$setupGitCommit","/DSetupProvenancePath=$setupProvenancePath")
         $arguments += "/O$output\"
     }
     . (Join-Path $repositoryRoot 'build\build.ps1') -Library
@@ -1198,6 +1226,8 @@ function Invoke-CcodInnoPayloadCompileFixture {
         SetupPath = (Join-Path $output 'CodexRemote-fix-2.5.21-setup.exe')
         GeneratedPath = $generatedPath
         GeneratedSource = $generatedSource
+        PayloadManifestSha256 = $payloadManifestSha256
+        SetupGitCommit = $setupGitCommit
     }
 }
 
@@ -1418,6 +1448,47 @@ Invoke-CcodTest 'Inno compile packages the explicit manifest-bound installer pay
     }
 }
 
+# Production mutation caught: trusting ISCC exit zero and a newly computed sidecar without inspecting the final PE contract.
+Invoke-CcodTest 'compiled Setup independently binds PE versions commit and activation payload manifest hash' {
+    $modulePath = Join-Path $repositoryRoot 'build\SetupArtifact.psm1'
+    Assert-CcodTrue (Test-Path -LiteralPath $modulePath -PathType Leaf) 'independent Setup artifact validator exists'
+    Import-Module $modulePath -Force
+    $compile = Invoke-CcodInnoPayloadCompileFixture -IncludePayloadDefines
+    try {
+        $validated = Test-CcodSetupArtifact -SetupPath $compile.SetupPath -ExpectedVersion '2.5.21' -ExpectedGitCommit $compile.SetupGitCommit -ExpectedPayloadManifestSha256 $compile.PayloadManifestSha256
+        Assert-CcodEqual $true ([bool]$validated.Valid) 'real ISCC Setup PE satisfies the independent version and payload contract'
+        Assert-CcodEqual '2.5.21.0' ([string]$validated.FileVersion) 'Setup PE FileVersion is exact'
+        Assert-CcodEqual '2.5.21.0' ([string]$validated.ProductVersion) 'Setup PE ProductVersion is exact'
+        Assert-CcodThrows {
+            Test-CcodSetupArtifact -SetupPath $compile.SetupPath -ExpectedVersion '2.5.21' -ExpectedGitCommit $compile.SetupGitCommit -ExpectedPayloadManifestSha256 ('0' * 64) | Out-Null
+        } 'CCOD_SETUP_PAYLOAD_BINDING_INVALID'
+    } finally {
+        if (Test-Path -LiteralPath $compile.Root) { Remove-Item -LiteralPath $compile.Root -Recurse -Force }
+    }
+}
+
+# Production mutation caught: cleaning payload stage/inventory only after a successful Setup build.
+Invoke-CcodTest 'build temporary Setup inputs are cleaned from the exact finally boundary after failure' {
+    . (Join-Path $repositoryRoot 'build\build.ps1') -Library
+    Assert-CcodTrue ($null -ne (Get-Command Invoke-CcodBuildTemporarySetupScope -ErrorAction SilentlyContinue)) 'build exposes its production temporary Setup scope'
+    $buildRoot = Join-Path $repositoryRoot 'build'
+    $payloadStage = Join-Path $buildRoot ('.installer-payload-stage-' + [guid]::NewGuid().ToString('N'))
+    $inventory = Join-Path $buildRoot ('.installer-destination-inventory-' + [guid]::NewGuid().ToString('N') + '.iss')
+    $fixturePayloadStage = $payloadStage
+    $fixtureInventory = $inventory
+    Assert-CcodThrows {
+        Invoke-CcodBuildTemporarySetupScope -BuildRoot $buildRoot -InstallerPayloadDirectory $fixturePayloadStage -DestinationInventoryPath $fixtureInventory -Action {
+            param($PayloadStagePath,$InventoryPath)
+            [IO.Directory]::CreateDirectory($PayloadStagePath) | Out-Null
+            [IO.File]::WriteAllText((Join-Path $PayloadStagePath 'fixture.txt'),'fixture',[Text.UTF8Encoding]::new($false))
+            [IO.File]::WriteAllText($InventoryPath,'fixture',[Text.UTF8Encoding]::new($false))
+            throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new('fixture failure'),'CCOD_BUILD_FIXTURE_FAILURE',[Management.Automation.ErrorCategory]::OperationStopped,$null)
+        }
+    } 'CCOD_BUILD_FIXTURE_FAILURE'
+    Assert-CcodTrue (-not [IO.Directory]::Exists($payloadStage)) 'failed build leaves no installer payload stage'
+    Assert-CcodTrue (-not [IO.File]::Exists($inventory)) 'failed build leaves no destination inventory'
+}
+
 Invoke-CcodTest 'Inno compile refuses a missing generated destination inventory' {
     $compile = Invoke-CcodInnoPayloadCompileFixture -IncludePayloadDefines -OmitDestinationInventory
     try {
@@ -1999,7 +2070,7 @@ Invoke-CcodTest '2.5.22 source metadata and documentation match the release cont
     Assert-CcodTrue ($englishSection.Success -and $englishBullets.Count -ge 3 -and $englishBullets.Count -le 5) 'v2.5.22 English release notes contain three to five bullets'
     $readme = Get-Content -LiteralPath (Join-Path $repositoryRoot 'README.md') -Raw
     $quickStart = [regex]::Match($readme, '(?ms)^## Quick start\s*\r?\n(?<body>.*?)(?=^## |\z)').Groups['body'].Value
-    Assert-CcodTrue ($readme.Contains('v2.5.22 is the current stable release')) 'English README marks v2.5.22 stable without a version-by-version What''s new block'
+    Assert-CcodTrue ($readme.Contains('v2.5.22 is the current release candidate') -and $readme.Contains('stable Windows acceptance still requires recorded install, upgrade, reboot, repair, UI, and Defender verification')) 'English README does not claim stable Windows acceptance before real-machine evidence'
     Assert-CcodTrue (-not $readme.Contains("## What's new")) 'English README keeps release details off the home page'
     Assert-CcodTrue ($quickStart.Contains('CodexRemote-fix-2.5.22-setup.exe')) 'English Quick Start names the setup installer'
     Assert-CcodTrue ($quickStart.Contains('CodexRemote-fix-2.5.22-windows-x64.zip')) 'English Quick Start names the portable ZIP'
@@ -2010,7 +2081,7 @@ Invoke-CcodTest '2.5.22 source metadata and documentation match the release cont
     Assert-CcodTrue ($readme.Contains('Setup embeds and hash-binds its versioned `installer-payload.manifest.json`')) 'English README identifies the embedded hash-bound setup payload manifest'
     Assert-CcodTrue (-not $readme.Contains('shared payload manifest')) 'English README does not claim setup and portable share one payload manifest'
     $readmeZh = Get-Content -LiteralPath (Join-Path $repositoryRoot 'README.zh-CN.md') -Raw -Encoding UTF8
-    Assert-CcodTrue ($readmeZh -match 'v2\.5\.22 \u662F\u5F53\u524D\u7A33\u5B9A\u7248') 'Chinese README marks v2.5.22 stable'
+    Assert-CcodTrue ($readmeZh -match 'v2\.5\.22 \u662F\u5F53\u524D\u5019\u9009\u53D1\u5E03\u7248' -and $readmeZh -match '\u7A33\u5B9A\u7248\u9A8C\u6536\u4ECD\u9700\u8BB0\u5F55') 'Chinese README does not claim stable Windows acceptance before real-machine evidence'
     Assert-CcodTrue (-not $readmeZh.Contains("## What's new")) 'Chinese README keeps release details off the home page'
     Assert-CcodTrue ($readmeZh.Contains('CodexRemote-fix-2.5.22-setup.exe')) 'Chinese Quick Start names the setup installer'
     Assert-CcodTrue ($readmeZh.Contains('CodexRemote-fix-2.5.22-windows-x64.zip')) 'Chinese Quick Start names the portable ZIP'
diff --git a/tools/New-InstallerDestinationInventory.ps1 b/tools/New-InstallerDestinationInventory.ps1
index 57f543f..7cb2706 100644
--- a/tools/New-InstallerDestinationInventory.ps1
+++ b/tools/New-InstallerDestinationInventory.ps1
@@ -43,6 +43,10 @@ function Assert-CcodInstallerInnoPreprocessorLines {
         '#error InstallerPayloadDirectory must be supplied by the release builder',
         '#ifndef InstallerPayloadManifestSha256',
         '#error InstallerPayloadManifestSha256 must be supplied by the release builder',
+        '#ifndef SetupGitCommit',
+        '#error SetupGitCommit must be supplied by the release builder',
+        '#ifndef SetupProvenancePath',
+        '#error SetupProvenancePath must be supplied by the release builder',
         '#endif'
     )
     $allowedInlineConstructs = @(
@@ -50,7 +54,9 @@ function Assert-CcodInstallerInnoPreprocessorLines {
         '{#TrayHostArtifactDirectory}',
         '{#PortableArtifactDirectory}',
         '{#InstallerPayloadDirectory}',
-        '{#InstallerPayloadManifestSha256}'
+        '{#InstallerPayloadManifestSha256}',
+        '{#SetupGitCommit}',
+        '{#SetupProvenancePath}'
     )
     for ($lineIndex = 0; $lineIndex -lt $Lines.Count; $lineIndex++) {
         $line = [string]$Lines[$lineIndex]
diff --git a/tools/Test-ReleaseDefender.ps1 b/tools/Test-ReleaseDefender.ps1
index 3a07321..ab73cdb 100644
--- a/tools/Test-ReleaseDefender.ps1
+++ b/tools/Test-ReleaseDefender.ps1
@@ -486,7 +486,8 @@ function Test-CcodReleaseAssetManifest {
     $expectedNames = @(
         "CodexRemote-fix-$ExpectedVersion-setup.exe",
         "CodexRemote-fix-$ExpectedVersion-setup.exe.sha256.txt",
-        "CodexRemote-fix-$ExpectedVersion-trayhost-provenance.json"
+        "CodexRemote-fix-$ExpectedVersion-trayhost-provenance.json",
+        "CodexRemote-fix-$ExpectedVersion-setup-provenance.json"
     )
     if ($assets.Count -ne $expectedNames.Count) { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Release manifest does not bind the exact required asset set' $manifestFile }
     $assetHashes = @{}
@@ -530,6 +531,22 @@ function Test-CcodReleaseAssetManifest {
         $trayHostTimestampText -cne $manifestTimestamp) {
         Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'TrayHost provenance is not bound to the release version, source commit, and timestamp' $expectedNames[2]
     }
+    $setupProvenancePath = Join-Path $directory $expectedNames[3]
+    $setupArtifactModule = Join-Path (Split-Path $PSScriptRoot -Parent) 'build\SetupArtifact.psm1'
+    if (-not [IO.File]::Exists($setupArtifactModule)) {
+        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Setup artifact validator is missing' $setupArtifactModule
+    }
+    Import-Module $setupArtifactModule -Force
+    try {
+        $setupRaw = [IO.File]::ReadAllText($setupProvenancePath)
+        $setupRecord = $setupRaw | ConvertFrom-Json -ErrorAction Stop
+        $payloadHash = [string]$setupRecord.payloadManifest.sha256
+        if ($payloadHash -cnotmatch '^[0-9a-f]{64}$') { throw 'payload hash' }
+        Test-CcodSetupBuildProvenance -ProvenancePath $setupProvenancePath -ExpectedVersion $ExpectedVersion -ExpectedGitCommit ([string]$manifest.gitCommit) -ExpectedPayloadManifestSha256 $payloadHash -ExpectedBuildTimestampUtc $manifestTimestamp | Out-Null
+        Test-CcodSetupArtifact -SetupPath $installer -ExpectedVersion $ExpectedVersion -ExpectedGitCommit ([string]$manifest.gitCommit) -ExpectedPayloadManifestSha256 $payloadHash | Out-Null
+    } catch {
+        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' ('Setup provenance or final PE contract is invalid: ' + $_.Exception.Message) $setupProvenancePath
+    }
     return [pscustomobject][ordered]@{
         Valid = $true
         Version = $ExpectedVersion
@@ -537,6 +554,8 @@ function Test-CcodReleaseAssetManifest {
         BuildTimestampUtc = $manifestTimestamp
         InstallerSha256 = [string]$assetHashes[$expectedNames[0]]
         InstallerName = $expectedNames[0]
+        PayloadManifestSha256 = $payloadHash
+        SetupProvenanceName = $expectedNames[3]
     }
 }
 

From 1f4259f7003d29d1023a567d15c877c22dfabd6c Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 15:45:22 +0800
Subject: [PATCH 053/187] fix: validate setup provenance across hosts

---
 build/SetupArtifact.psm1 | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/build/SetupArtifact.psm1 b/build/SetupArtifact.psm1
index 58995fe..4458e71 100644
--- a/build/SetupArtifact.psm1
+++ b/build/SetupArtifact.psm1
@@ -158,12 +158,14 @@ function Test-CcodSetupBuildProvenance {
     $path = Assert-CcodSetupRegularFile -Path $ProvenancePath -Kind 'Setup provenance'
     try { $raw = [IO.File]::ReadAllText($path,[Text.UTF8Encoding]::new($false)); $record = $raw | ConvertFrom-Json -ErrorAction Stop }
     catch { Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Setup provenance is invalid JSON' $path }
+    $timestampMatches = [regex]::Matches($raw,'"buildTimestampUtc"\s*:\s*"(?<value>[^"\\]+)"')
+    $timestampText = if ($timestampMatches.Count -eq 1) { [string]$timestampMatches[0].Groups['value'].Value } else { $null }
     $fields = @('schemaVersion','product','version','gitCommit','buildTimestampUtc','payloadManifest','buildInputs','peContract')
     if ($record -isnot [pscustomobject] -or ((@($record.PSObject.Properties.Name | Sort-Object) -join '|') -cne (@($fields | Sort-Object) -join '|')) -or
-        $record.schemaVersion -isnot [int] -or $record.schemaVersion -ne 1 -or $record.product -isnot [string] -or $record.product -cne 'CodexRemote-fix' -or
+        ($record.schemaVersion -isnot [int] -and $record.schemaVersion -isnot [long]) -or [int64]$record.schemaVersion -ne 1 -or $record.product -isnot [string] -or $record.product -cne 'CodexRemote-fix' -or
         $record.version -isnot [string] -or $record.version -cne $ExpectedVersion -or $record.gitCommit -isnot [string] -or $record.gitCommit -cne $ExpectedGitCommit -or
-        -not (Test-CcodSetupCanonicalUtc ([string]$record.buildTimestampUtc)) -or
-        (-not [string]::IsNullOrWhiteSpace($ExpectedBuildTimestampUtc) -and [string]$record.buildTimestampUtc -cne $ExpectedBuildTimestampUtc) -or
+        -not (Test-CcodSetupCanonicalUtc $timestampText) -or
+        (-not [string]::IsNullOrWhiteSpace($ExpectedBuildTimestampUtc) -and $timestampText -cne $ExpectedBuildTimestampUtc) -or
         $record.payloadManifest.sha256 -isnot [string] -or $record.payloadManifest.sha256 -cne $ExpectedPayloadManifestSha256 -or
         $record.payloadManifest.name -isnot [string] -or $record.payloadManifest.name -cne 'installer-payload.manifest.json' -or
         [int64]$record.payloadManifest.length -le 0 -or [int]$record.payloadManifest.fileCount -le 0 -or

From 5293182b8e5fb6653b5261dd7b039760a5eeab06 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 15:48:58 +0800
Subject: [PATCH 054/187] docs: record final security fix evidence

---
 .../task-5-report.md                          | 229 ++++++++++++++++++
 1 file changed, 229 insertions(+)

diff --git a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
index f883720..b2dccac 100644
--- a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
+++ b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
@@ -340,3 +340,232 @@ normal desktop environment retains the earlier real-Supervisor lifecycle mutex
 boundary. The parent will rerun the controlled isolated aggregate after scoped
 re-review. No build, installer execution, install, publish, push, tag, release,
 or signing occurred in this fix round.
+
+## Final security-fix wave — exact activation bytes, hard-link leaves, and Setup proof
+
+### Scope and safety boundary
+
+- Started from clean reviewed head `31fd365` in the named v2.5.22 worktree.
+- Preserved package/native version `2.5.22` / `2.5.22.0`, the authenticated
+  TrayHost protocol, receipt architecture, and existing CI/trace gates.
+- Did not execute an installer, install or upgrade the product, start or stop
+  real Codex/TrayHost/Supervisor/UI processes, publish, push, tag, sign, or
+  read/write WindowsApps or DPAPI device-key data.
+
+### RED evidence
+
+#### Exact activation bytes
+
+A real cross-process barrier supplied a test-only `powershell.exe` wrapper.
+The wrapper stopped after the activation parent verified the payload and before
+the child interpreter ran. The test then replaced the accepted manifest,
+installer, and lifecycle module. The old pathname flow returned success but
+proved that it parsed/executed the replacements:
+
+```text
+ReleaseWorkflow.SelfTest.ps1
+exit 1
+case=activation-executes-only-the-verified-manifest-installer-and-module-bytes-across-the-child-launch-barrier
+expected=[original:2.5.22]
+actual=[replacement:9.9.9]
+```
+
+No production test flag, environment switch, listener, or unauthenticated
+control input was added.
+
+#### Hard-linked install leaves
+
+The lifecycle regression created an outside sentinel and hard-linked each
+stable target leaf in turn. The old copy path did not reject either target:
+
+```text
+InstallLifecycle.SelfTest.ps1
+exit 1
+case=stable-bootstrap-and-public-uninstaller-reject-hard-linked-target-leaves-before-outside-bytes-change
+ASSERT_THROWS: expected CCOD_INSTALL_UNSAFE_LEAF
+```
+
+A separately compiled and safely executed Inno predicate fixture placed a hard
+link inside the existing Setup tree. The old `IsSafeExistingSetupTree` accepted
+the leaf, reached the simulated overwrite, and therefore did not write the
+fixture's success receipt (`result.txt` missing).
+
+#### Independent Setup artifact and provenance
+
+The real-ISCC artifact test was added before its validator:
+
+```text
+ReleaseWorkflow.SelfTest.ps1
+exit 1
+case=compiled-Setup-independently-binds-PE-versions-commit-and-activation-payload-manifest-hash
+ASSERT_TRUE: independent Setup artifact validator exists
+```
+
+After the validator API existed, the setup release fixture added the required
+setup-provenance asset before the release validator changed. The old validator
+then failed its exact asset contract, proving the provenance was not yet part
+of the accepted release:
+
+```text
+CCOD_RELEASE_MANIFEST_INVALID
+Release manifest does not bind the exact required asset set
+```
+
+#### Failure cleanup
+
+The cleanup regression injected a deterministic exception after creating the
+exact GUID-named installer payload stage and destination inventory. It first
+failed because the production finally scope did not exist:
+
+```text
+ASSERT_TRUE: build exposes its production temporary Setup scope
+```
+
+### Implementation contract
+
+#### Activation byte sealing
+
+- The activation parent opens the compile-bound manifest once, hashes and
+  parses the same byte array, and opens every current manifest record with
+  read-only/no-write/no-delete sharing.
+- It writes only those verified byte arrays into a unique sibling stage,
+  rehashes each staged leaf, and holds read handles for the entire child
+  lifetime. Original payload path replacement after the barrier cannot change
+  the child's inputs.
+- The child independently opens and holds the staged manifest/records, hashes
+  and parses the same manifest bytes, verifies exact version/package/file set,
+  and only then imports `InstallLifecycle.psm1`.
+- Lifecycle receives the accepted manifest as Base64 exact bytes plus the
+  expected SHA-256; it does not reopen the accepted manifest pathname for JSON
+  parsing. Existing final Ready pointer/runtime-manifest/version proof remains.
+
+#### Hard-link-safe leaves
+
+- Lifecycle now uses `CreateFileW` plus `GetFileInformationByHandle` and
+  requires `NumberOfLinks == 1`, regular/non-reparse shape, no alternate data
+  streams, and canonical install-root containment before/after copies.
+- Production copy writes a fresh same-directory temporary leaf and uses a
+  namespace replace/move, avoiding in-place mutation of an existing inode.
+- Stable `bootstrap.ps1`, the public uninstaller, staged runtime leaves,
+  runtime manifest, and recursively deleted install trees use the same leaf
+  contract.
+- Inno `PrepareToInstall` recursively checks every existing Setup leaf with
+  native handle link count plus stream enumeration before `[Files]` writes.
+
+#### Independent Setup artifact/provenance
+
+- `build/SetupArtifact.psm1` verifies final Setup PE `FileVersion` and
+  `ProductVersion` equal `<Version>.0`.
+- The final PE version resource independently binds product/version, the exact
+  40-hex source commit, and the exact 64-hex installer payload-manifest SHA-256.
+  The negative test reuses the same final EXE with a mismatched expected hash
+  and requires `CCOD_SETUP_PAYLOAD_BINDING_INVALID`; no textual binary scan is
+  claimed.
+- `CodexRemote-fix-2.5.22-setup-provenance.json` records canonical
+  version/commit/timestamp, payload manifest name/length/hash/file count, Inno
+  template and inventory hashes, ISCC hash/version, and the expected PE
+  resource contract. It is embedded as a `dontcopy` Setup source and published
+  as an explicit release asset.
+- The setup release manifest hash-binds Setup, checksum, TrayHost provenance,
+  and Setup provenance. `Test-CcodReleaseAssetManifest` revalidates provenance
+  plus the final PE and rejects asset or metadata tampering.
+- Provenance validation reads the raw canonical timestamp representation and
+  accepts the JSON integer types produced by both Windows PowerShell 5.1 and
+  pwsh 7.
+
+#### Cleanup and documentation
+
+- The installer payload stage and destination inventory now live inside one
+  exact `try/finally` scope. Cleanup requires the build-root parent, exact GUID
+  leaf pattern, expected file/directory kind, and a reparse-free tree.
+- README and README.zh-CN now call v2.5.22 a release candidate and explicitly
+  leave stable Windows acceptance pending real install/upgrade/reboot/repair/UI/
+  Defender evidence. No What's-new block was added.
+
+### GREEN and regression evidence
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+exit 0
+Release workflow self-tests passed.
+  includes real ISCC compilation, activation swap barrier, Inno hard-link
+  fixture, Setup PE positive/negative proof, failure cleanup, and release
+  provenance validation
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\trayhost\Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly
+exit 0; 3 production child-session trace cases
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\trayhost\Invoke-TrayHostSelfTest.ps1 -NativeOnly
+exit 0; 25 native fake-platform cases
+
+PowerShell AST parse of all modified .ps1/.psm1 files
+exit 0
+
+git diff --check
+exit 0
+```
+
+The lifecycle suite passed the new activation/hard-link cases and continued to
+the already documented live-Supervisor boundary. It was not reported green:
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+exit 1
+case=transactional-uninstall-reaches-ReadyForInno-only-after-recovery-protection-stop-task-proof-and-application-removal
+error=CCOD_LIFECYCLE_LEASE_TIMEOUT
+```
+
+No mutex bypass and no real Supervisor stop was attempted.
+
+### Clean-head build evidence
+
+Normal build from clean implementation head
+`1f4259f7003d29d1023a567d15c877c22dfabd6c`:
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File build\build.ps1 -Version 2.5.22
+exit 0
+TEMP_SETUP_INPUT_COUNT=0
+```
+
+Both Windows PowerShell 5.1 and pwsh 7 independently returned
+`portable=True` and `setup=True`. Setup FileVersion/ProductVersion were both
+`2.5.22.0`; portable/setup release manifests and Setup provenance all bound
+commit `1f4259f7003d29d1023a567d15c877c22dfabd6c`. The embedded activation
+payload-manifest SHA-256 was
+`e03753640f65f28aebdf46eb113f8ad26317169cbfc424e1629a6795c752a4f1`.
+
+Final retained build evidence hashes:
+
+```text
+CodexRemote-fix-2.5.22-windows-x64.zip
+  a70419842a2509ae2035e6890474b3e7258d5f64682edb8813d6782adc1c299b
+CodexRemote-fix-2.5.22-setup.exe
+  5f650bc187112a5256f5a5b5d37972a6400cfe6e32586956830458adfc6b53e9
+CodexRemote-fix-2.5.22-setup-provenance.json
+  8f0d1973b69d440ca8dad699bb9065b3030ea4f455d757fc5278e706f6cc76e9
+CodexRemote-fix-2.5.22-setup-release-manifest.json
+  559fa329221fcd092356119b8b4aa8bf4562afe173a432ca4251969db5c4a9e6
+```
+
+Two earlier ignored artifact sets were preserved rather than deleted at:
+
+```text
+C:\Users\33384\AppData\Local\Temp\ccod-v2522-pre-final-security-build-0ff1f869906848418dc15e9ef89d5375
+C:\Users\33384\AppData\Local\Temp\ccod-v2522-ca5a5f7-build-00f3b177a3974b02bee3fe3f99f2cbc0
+```
+
+### Commits and remaining acceptance boundary
+
+```text
+cb36d0b test: expose activation payload byte swap
+ed782ec fix: seal activation bytes and reject linked leaves
+ca5a5f7 fix: bind setup artifact provenance
+1f4259f fix: validate setup provenance across hosts
+```
+
+- The compiled installer was never executed. Generated assets are unsigned,
+  unpublished local evidence only.
+- Real setup install/upgrade, reboot, remote connection, About/language/logs,
+  repair, Defender, and controlled isolated aggregate acceptance remain
+  pending. README intentionally does not call v2.5.22 stable.

From f1ee9b7b8a592355f10e71e6b1d486ea9d29f876 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 16:05:51 +0800
Subject: [PATCH 055/187] test: expose linked whole-install deletion

---
 .../persistence/InstallLifecycle.SelfTest.ps1 | 30 +++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index 55e5af8..8672679 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -913,6 +913,36 @@ $results += Invoke-CcodTest 'stable bootstrap and public uninstaller reject hard
     }
 }
 
+# Production mutation caught: recursive whole-install deletion bypassing the strict per-leaf hard-link contract.
+$results += Invoke-CcodTest 'whole-install deletion rejects a nested hard-link before removing any in-tree leaf' {
+    $install = New-CcodLifecycleTempRoot
+    $outside = New-CcodLifecycleTempRoot
+    try {
+        $nested = Join-Path $install 'runtime\nested'
+        [IO.Directory]::CreateDirectory($nested) | Out-Null
+        [IO.Directory]::CreateDirectory($outside) | Out-Null
+        $sentinel = Join-Path $outside 'outside-sentinel.txt'
+        $linkedLeaf = Join-Path $nested 'linked-state.json'
+        $ordinaryLeaf = Join-Path $install 'ordinary-state.json'
+        [IO.File]::WriteAllText($sentinel,'outside-original',[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($ordinaryLeaf,'ordinary-original',[Text.UTF8Encoding]::new($false))
+        New-Item -ItemType HardLink -Path $linkedLeaf -Target $sentinel | Out-Null
+
+        $caughtId = $null
+        try {
+            $module = Get-Module InstallLifecycle
+            & $module { param($Root) Remove-CcodLifecycleInstallTree -InstallRoot $Root -Adapters @{} } $install
+        } catch { $caughtId = ([string]$_.FullyQualifiedErrorId -split ',')[0] }
+
+        Assert-CcodEqual 'CCOD_INSTALL_UNSAFE_LEAF' $caughtId 'whole-install deletion rejects the nested hard-link before recursive removal'
+        Assert-CcodTrue ([IO.File]::Exists($linkedLeaf)) 'rejected delete retains the in-tree hard-link'
+        Assert-CcodEqual 'ordinary-original' ([IO.File]::ReadAllText($ordinaryLeaf,[Text.UTF8Encoding]::new($false))) 'preflight rejection retains other in-tree leaves'
+        Assert-CcodEqual 'outside-original' ([IO.File]::ReadAllText($sentinel,[Text.UTF8Encoding]::new($false))) 'preflight rejection retains outside sentinel bytes'
+    } finally {
+        foreach ($path in @($install,$outside)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force -ErrorAction SilentlyContinue } }
+    }
+}
+
 $results += Invoke-CcodTest 'runtime manifest leaf junction is rejected before write' {
     $source = New-CcodLifecycleTempRoot
     $install = New-CcodLifecycleTempRoot

From 1a4abece619f47115b9d9564777de58471eedbc6 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 16:08:47 +0800
Subject: [PATCH 056/187] fix: preflight whole-install tree deletion

---
 src/persistence/modules/InstallLifecycle.psm1 | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index e2a7e12..8385b5c 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -1803,6 +1803,7 @@ function Remove-CcodLifecycleInstallTree {
     if (Test-CcodLifecycleReparse -Path $root) {
         Throw-CcodLifecycleError 'CCOD_INSTALL_REPARSE_PATH' 'Install root is a reparse point' $root
     }
+    [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $root)
     foreach ($item in Get-ChildItem -LiteralPath $root -Force -ErrorAction Stop) {
         [void](Test-CcodLifecycleRemovePath -Root $root -Path $item.FullName)
     }

From b14510876ea9f5c85521de3e652f020acdb656f0 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 16:09:27 +0800
Subject: [PATCH 057/187] docs: record whole-install delete fix

---
 .../task-5-report.md                          | 69 +++++++++++++++++++
 1 file changed, 69 insertions(+)

diff --git a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
index b2dccac..25e18fd 100644
--- a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
+++ b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
@@ -569,3 +569,72 @@ ca5a5f7 fix: bind setup artifact provenance
 - Real setup install/upgrade, reboot, remote connection, About/language/logs,
   repair, Defender, and controlled isolated aggregate acceptance remain
   pending. README intentionally does not call v2.5.22 stable.
+
+## Final security fix round 1 — whole-install delete leaf preflight
+
+Scoped re-review found that `Remove-CcodLifecycleInstallTree` did not consume
+the strict recursive tree predicate. It checked only each top-level child's
+path/reparse ancestry and then called `Remove-Item -Recurse`, so a nested hard
+link bypassed the already implemented regular/non-reparse/no-ADS/single-link
+leaf contract.
+
+### RED
+
+The regression created an ordinary in-tree file plus a nested hard link to an
+outside sentinel, then invoked the real private whole-install delete function:
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+exit 1
+case=whole-install-deletion-rejects-a-nested-hard-link-before-removing-any-in-tree-leaf
+expected=[CCOD_INSTALL_UNSAFE_LEAF]
+actual=[]
+```
+
+The empty error id proves the old path accepted the hard link and completed
+recursive deletion instead of failing closed.
+
+### GREEN implementation and evidence
+
+`Remove-CcodLifecycleInstallTree` now calls
+`Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $root` before
+enumerating or deleting anything. That existing predicate walks every nested
+leaf and applies the native link-count, ADS, regular-file, reparse, and root
+containment checks. Therefore a failing leaf is detected before either the
+hard-link name or any ordinary in-tree leaf is removed.
+
+The full lifecycle suite passed the new regression and advanced to the same
+later live-Supervisor boundary; it is still not represented as aggregate
+GREEN:
+
+```text
+InstallLifecycle.SelfTest.ps1
+new whole-install hard-link case passed
+later exit 1
+case=transactional-uninstall-reaches-ReadyForInno-only-after-recovery-protection-stop-task-proof-and-application-removal
+error=CCOD_LIFECYCLE_LEASE_TIMEOUT
+```
+
+Additional fresh verification:
+
+```text
+ReleaseWorkflow.SelfTest.ps1
+exit 0; real ISCC and release workflow self-tests passed
+
+PowerShell AST parse of modified module/test
+exit 0
+
+git diff --check
+exit 0
+```
+
+Commits:
+
+```text
+f1ee9b7 test: expose linked whole-install deletion
+1a4abec fix: preflight whole-install tree deletion
+```
+
+No installer/build/release/install operation was performed in this narrow
+round. No real process was started or stopped, and no WindowsApps or DPAPI data
+was accessed.

From 2633509a33bc43222d7bc65fc06558b5d3fcacf3 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 16:41:04 +0800
Subject: [PATCH 058/187] test: expose activation stage substitution

---
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 71 ++++++++++++++++++-
 1 file changed, 70 insertions(+), 1 deletion(-)

diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 85efd25..331b6b0 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -1279,7 +1279,8 @@ Invoke-CcodTest 'activation executes only the verified manifest installer and mo
         while (-not [IO.File]::Exists($readyPath) -and [DateTime]::UtcNow -lt $deadline -and -not $process.HasExited) {
             [Threading.Thread]::Sleep(10)
         }
-        Assert-CcodTrue ([IO.File]::Exists($readyPath)) 'barrier proves parent payload verification completed before child execution'
+        $barrierFailure = if ($process.HasExited) { $process.StandardOutput.ReadToEnd() + ' ' + $process.StandardError.ReadToEnd() } else { '' }
+        Assert-CcodTrue ([IO.File]::Exists($readyPath)) "barrier proves parent payload verification completed before child execution: $barrierFailure"
 
         $replacementInstallerMarker = Join-Path $fixture.AppRoot 'replacement-installer-executed.txt'
         $replacementInstaller = @"
@@ -1322,6 +1323,74 @@ Export-ModuleMember -Function Invoke-CcodFixtureInstall
     }
 }
 
+# Production mutation caught: creating/checking the stage by pathname and allowing directory substitution before the first staged leaf write.
+Invoke-CcodTest 'activation pins the stage directory before any verified leaf write' {
+    $fixture = New-CcodActivationPayloadFixture
+    $libraryRoot = Join-Path $fixture.AppRoot 'activation-library'
+    $outside = Join-Path $fixture.AppRoot 'outside-stage-target'
+    $libraryPath = Join-Path $libraryRoot 'ActivationFunctions.psm1'
+    $module = $null
+    $breakpoint = $null
+    $seal = $null
+    $attack = [pscustomobject]@{ Attempted=$false; Outcome='not-run'; Stage=$null; Captured=$null }
+    try {
+        [IO.Directory]::CreateDirectory($libraryRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($outside) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $outside 'outside-sentinel.txt'),'outside-original',[Text.UTF8Encoding]::new($false))
+        $tokens = $null; $parseErrors = $null
+        $activationAst = [Management.Automation.Language.Parser]::ParseFile((Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1'),[ref]$tokens,[ref]$parseErrors)
+        Assert-CcodEqual 0 @($parseErrors).Count 'activation function library source parses before race fixture extraction'
+        $definitions = @($activationAst.EndBlock.Statements | Where-Object { $_ -is [Management.Automation.Language.FunctionDefinitionAst] } | ForEach-Object { $_.Extent.Text })
+        Assert-CcodTrue ($definitions.Count -gt 10) 'activation race fixture extracts the real production function set'
+        [IO.File]::WriteAllText($libraryPath,(($definitions -join "`r`n`r`n")+"`r`n"),[Text.UTF8Encoding]::new($false))
+        $module = Import-Module $libraryPath -Force -PassThru
+        $libraryLines = [IO.File]::ReadAllLines($libraryPath,[Text.UTF8Encoding]::new($false))
+        $barrierLines = @()
+        for ($index=0;$index-lt$libraryLines.Length;$index++) {
+            if ($libraryLines[$index] -cmatch '^\s*foreach \(\$snapshot in @\(\$snapshots\)') { $barrierLines += ($index + 1) }
+        }
+        Assert-CcodEqual 1 $barrierLines.Count 'activation stage write barrier is unique'
+        $appRoot = $fixture.AppRoot
+        $attackAction = {
+            if ($attack.Attempted) { return }
+            $attack.Attempted = $true
+            try {
+                $stages = @(Get-ChildItem -LiteralPath $appRoot -Directory -Force | Where-Object { $_.Name -cmatch '^\.activation-payload-stage-[0-9a-f]{32}$' })
+                if ($stages.Count -ne 1) { throw "expected one stage; found $($stages.Count)" }
+                $attack.Stage = [IO.Path]::GetFullPath($stages[0].FullName)
+                $expectedPrefix = [IO.Path]::GetFullPath($appRoot).TrimEnd('\') + '\'
+                if (-not $attack.Stage.StartsWith($expectedPrefix,[StringComparison]::OrdinalIgnoreCase)) { throw 'stage escaped fixture app root' }
+                $attack.Captured = $attack.Stage + '.captured'
+                [IO.Directory]::Move($attack.Stage,$attack.Captured)
+                New-Item -ItemType Junction -Path $attack.Stage -Target $outside | Out-Null
+                $attack.Outcome = 'substituted'
+            } catch { $attack.Outcome = 'blocked' }
+        }.GetNewClosure()
+        $breakpoint = Set-PSBreakpoint -Script $libraryPath -Line $barrierLines[0] -Action $attackAction
+        $caught = $null
+        try {
+            $seal = & $module {
+                param($AppRoot,$PayloadRoot,$ManifestSha)
+                New-CcodActivationPayloadSeal -AppRoot $AppRoot -Root $PayloadRoot -Version '2.5.22' -ExpectedManifestSha256 $ManifestSha
+            } $fixture.AppRoot $fixture.PayloadRoot $fixture.ManifestSha256
+        } catch { $caught = $_ }
+
+        Assert-CcodEqual 'blocked' $attack.Outcome 'stage directory substitution is blocked while the write boundary is pinned'
+        Assert-CcodTrue ($null -eq $caught -and $null -ne $seal) 'blocked substitution leaves the original verified stage usable'
+        Assert-CcodEqual 'outside-original' ([IO.File]::ReadAllText((Join-Path $outside 'outside-sentinel.txt'),[Text.UTF8Encoding]::new($false))) 'stage race cannot alter the outside sentinel'
+        Assert-CcodEqual 1 @(Get-ChildItem -LiteralPath $outside -File -Force -Recurse).Count 'stage race cannot redirect any verified leaf outside'
+    } finally {
+        if ($null -ne $breakpoint) { Remove-PSBreakpoint -Breakpoint $breakpoint -ErrorAction SilentlyContinue }
+        if ($null -ne $seal -and $null -ne $module) { try { & $module { param($Value) Close-CcodActivationPayloadSeal -Seal $Value } $seal } catch { } }
+        if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        if ($null -ne $attack.Stage -and (Test-Path -LiteralPath $attack.Stage)) {
+            $stageItem = Get-Item -LiteralPath $attack.Stage -Force
+            if (($stageItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { [IO.Directory]::Delete($attack.Stage) }
+        }
+        foreach ($path in @($attack.Captured,$fixture.AppRoot)) { if ($null -ne $path -and (Test-Path -LiteralPath $path)) { Remove-Item -LiteralPath $path -Recurse -Force -ErrorAction SilentlyContinue } }
+    }
+}
+
 Invoke-CcodTest 'activation accepts a compile-bound installer manifest hash before payload verification' {
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-activation-hash-interface-' + [guid]::NewGuid().ToString('N'))
     try {

From 39e838f4c0160fb1879017736ecb80a4bd6f0c0e Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 16:41:04 +0800
Subject: [PATCH 059/187] fix: pin activation stage write boundary

---
 Activate-CcodRemoteFix.ps1 | 259 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 254 insertions(+), 5 deletions(-)

diff --git a/Activate-CcodRemoteFix.ps1 b/Activate-CcodRemoteFix.ps1
index 536f0df..d479e7b 100644
--- a/Activate-CcodRemoteFix.ps1
+++ b/Activate-CcodRemoteFix.ps1
@@ -86,6 +86,242 @@ function Open-CcodActivationLockedBytes {
     }
 }
 
+function Initialize-CcodActivationStageNative {
+    if ($null -ne ('CcodActivationStageNative' -as [type])) { return }
+    Add-Type -TypeDefinition @'
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+
+public static class CcodActivationStageNative
+{
+    private const uint FILE_READ_DATA = 0x00000001;
+    private const uint FILE_LIST_DIRECTORY = 0x00000001;
+    private const uint FILE_READ_ATTRIBUTES = 0x00000080;
+    private const uint GENERIC_READ = 0x80000000;
+    private const uint GENERIC_WRITE = 0x40000000;
+    private const uint SYNCHRONIZE = 0x00100000;
+    private const uint FILE_SHARE_READ = 0x00000001;
+    private const uint FILE_SHARE_WRITE = 0x00000002;
+    private const uint FILE_OPEN = 0x00000001;
+    private const uint FILE_CREATE = 0x00000002;
+    private const uint FILE_DIRECTORY_FILE = 0x00000001;
+    private const uint FILE_NON_DIRECTORY_FILE = 0x00000040;
+    private const uint FILE_SYNCHRONOUS_IO_NONALERT = 0x00000020;
+    private const uint FILE_OPEN_REPARSE_POINT = 0x00200000;
+    private const uint FILE_FLAG_BACKUP_SEMANTICS = 0x02000000;
+    private const uint FILE_FLAG_OPEN_REPARSE_POINT = 0x00200000;
+    private const uint OPEN_EXISTING = 3;
+    private const uint OBJ_CASE_INSENSITIVE = 0x00000040;
+    private const uint FILE_ATTRIBUTE_DIRECTORY = 0x00000010;
+    private const uint FILE_ATTRIBUTE_REPARSE_POINT = 0x00000400;
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct UNICODE_STRING
+    {
+        public ushort Length;
+        public ushort MaximumLength;
+        public IntPtr Buffer;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct OBJECT_ATTRIBUTES
+    {
+        public int Length;
+        public IntPtr RootDirectory;
+        public IntPtr ObjectName;
+        public uint Attributes;
+        public IntPtr SecurityDescriptor;
+        public IntPtr SecurityQualityOfService;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct IO_STATUS_BLOCK
+    {
+        public IntPtr Status;
+        public UIntPtr Information;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct FILETIME
+    {
+        public uint Low;
+        public uint High;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct BY_HANDLE_FILE_INFORMATION
+    {
+        public uint FileAttributes;
+        public FILETIME CreationTime;
+        public FILETIME LastAccessTime;
+        public FILETIME LastWriteTime;
+        public uint VolumeSerialNumber;
+        public uint FileSizeHigh;
+        public uint FileSizeLow;
+        public uint NumberOfLinks;
+        public uint FileIndexHigh;
+        public uint FileIndexLow;
+    }
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern SafeFileHandle CreateFileW(string path, uint access, uint share, IntPtr security,
+        uint creation, uint flags, IntPtr template);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle handle, out BY_HANDLE_FILE_INFORMATION information);
+
+    [DllImport("ntdll.dll")]
+    private static extern int NtCreateFile(out IntPtr fileHandle, uint desiredAccess,
+        ref OBJECT_ATTRIBUTES objectAttributes, out IO_STATUS_BLOCK ioStatusBlock, IntPtr allocationSize,
+        uint fileAttributes, uint shareAccess, uint createDisposition, uint createOptions,
+        IntPtr eaBuffer, uint eaLength);
+
+    private static void ValidateLeaf(string name)
+    {
+        if (String.IsNullOrWhiteSpace(name) || name == "." || name == ".." || name.IndexOf('\\') >= 0 || name.IndexOf('/') >= 0)
+            throw new ArgumentException("Relative stage leaf is invalid", "name");
+    }
+
+    private static SafeFileHandle OpenRelative(SafeFileHandle parent, string name, uint access, uint share,
+        uint disposition, uint options)
+    {
+        ValidateLeaf(name);
+        if (parent == null || parent.IsInvalid || parent.IsClosed) throw new ArgumentException("Parent directory pin is invalid", "parent");
+        IntPtr nameBuffer = IntPtr.Zero;
+        IntPtr unicodePointer = IntPtr.Zero;
+        try
+        {
+            nameBuffer = Marshal.StringToHGlobalUni(name);
+            UNICODE_STRING unicode = new UNICODE_STRING();
+            unicode.Length = checked((ushort)(name.Length * 2));
+            unicode.MaximumLength = checked((ushort)((name.Length + 1) * 2));
+            unicode.Buffer = nameBuffer;
+            unicodePointer = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(UNICODE_STRING)));
+            Marshal.StructureToPtr(unicode, unicodePointer, false);
+            OBJECT_ATTRIBUTES attributes = new OBJECT_ATTRIBUTES();
+            attributes.Length = Marshal.SizeOf(typeof(OBJECT_ATTRIBUTES));
+            attributes.RootDirectory = parent.DangerousGetHandle();
+            attributes.ObjectName = unicodePointer;
+            attributes.Attributes = OBJ_CASE_INSENSITIVE;
+            IO_STATUS_BLOCK statusBlock;
+            IntPtr rawHandle;
+            int status = NtCreateFile(out rawHandle, access, ref attributes, out statusBlock, IntPtr.Zero,
+                0, share, disposition, options | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_REPARSE_POINT,
+                IntPtr.Zero, 0);
+            if (status < 0 || rawHandle == IntPtr.Zero || rawHandle == new IntPtr(-1))
+                throw new InvalidOperationException("NtCreateFile failed: 0x" + unchecked((uint)status).ToString("x8"));
+            return new SafeFileHandle(rawHandle, true);
+        }
+        finally
+        {
+            if (unicodePointer != IntPtr.Zero) Marshal.FreeHGlobal(unicodePointer);
+            if (nameBuffer != IntPtr.Zero) Marshal.FreeHGlobal(nameBuffer);
+        }
+    }
+
+    public static SafeFileHandle OpenExistingDirectory(string path)
+    {
+        SafeFileHandle handle = CreateFileW(path, FILE_READ_ATTRIBUTES | SYNCHRONIZE,
+            FILE_SHARE_READ | FILE_SHARE_WRITE, IntPtr.Zero, OPEN_EXISTING,
+            FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT, IntPtr.Zero);
+        if (handle.IsInvalid) throw new Win32Exception(Marshal.GetLastWin32Error());
+        BY_HANDLE_FILE_INFORMATION information;
+        if (!GetFileInformationByHandle(handle, out information) ||
+            (information.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) == 0 ||
+            (information.FileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0)
+        {
+            int error = Marshal.GetLastWin32Error();
+            handle.Dispose();
+            if (error != 0) throw new Win32Exception(error);
+            throw new InvalidOperationException("Existing stage parent is not a plain directory");
+        }
+        return handle;
+    }
+
+    public static SafeFileHandle CreateDirectoryRelative(SafeFileHandle parent, string name)
+    {
+        return OpenRelative(parent, name, FILE_LIST_DIRECTORY | FILE_READ_ATTRIBUTES | SYNCHRONIZE,
+            FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_CREATE, FILE_DIRECTORY_FILE);
+    }
+
+    public static SafeFileHandle CreateLeafRelative(SafeFileHandle parent, string name)
+    {
+        return OpenRelative(parent, name, GENERIC_WRITE | SYNCHRONIZE,
+            FILE_SHARE_READ, FILE_CREATE, FILE_NON_DIRECTORY_FILE);
+    }
+
+    public static SafeFileHandle OpenLeafIdentityRelative(SafeFileHandle parent, string name)
+    {
+        return OpenRelative(parent, name, FILE_READ_ATTRIBUTES | SYNCHRONIZE,
+            FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN, FILE_NON_DIRECTORY_FILE);
+    }
+
+    public static SafeFileHandle OpenLeafReadRelative(SafeFileHandle parent, string name)
+    {
+        return OpenRelative(parent, name, GENERIC_READ | SYNCHRONIZE,
+            FILE_SHARE_READ, FILE_OPEN, FILE_NON_DIRECTORY_FILE);
+    }
+}
+'@
+}
+
+function Get-CcodActivationPinnedDirectory {
+    param(
+        [Parameter(Mandatory)][Collections.Generic.Dictionary[string,object]]$Directories,
+        [Parameter(Mandatory)][Collections.Generic.List[object]]$DirectoryPins,
+        [Parameter(Mandatory)][AllowEmptyString()][string]$RelativeDirectory
+    )
+    $normalized = $RelativeDirectory.Replace('/','\').Trim('\')
+    if ([string]::IsNullOrEmpty($normalized)) { return $Directories[''] }
+    $current = ''
+    $parent = $Directories['']
+    foreach ($segment in ($normalized -split '\\')) {
+        if ($segment -notmatch '^[A-Za-z0-9._-]+$' -or $segment -in @('.','..')) { throw 'CCOD_INSTALL_PAYLOAD_PATH_INVALID' }
+        $current = if ([string]::IsNullOrEmpty($current)) { $segment } else { "$current\$segment" }
+        if ($Directories.ContainsKey($current)) { $parent = $Directories[$current]; continue }
+        $created = [CcodActivationStageNative]::CreateDirectoryRelative($parent,[string]$segment)
+        $DirectoryPins.Add($created)
+        $Directories.Add($current,$created)
+        $parent = $created
+    }
+    return $parent
+}
+
+function Open-CcodActivationPinnedLeafBytes {
+    param(
+        [Parameter(Mandatory)]$ParentDirectory,
+        [Parameter(Mandatory)][string]$Leaf,
+        [Parameter(Mandatory)][byte[]]$Bytes
+    )
+    $writerHandle = $null
+    $identityHandle = $null
+    $writer = $null
+    try {
+        $writerHandle = [CcodActivationStageNative]::CreateLeafRelative($ParentDirectory,$Leaf)
+        $writer = [IO.FileStream]::new($writerHandle,[IO.FileAccess]::Write,65536,$false)
+        $writerHandle = $null
+        $writer.Write($Bytes,0,$Bytes.Length)
+        $writer.Flush($true)
+        $identityHandle = [CcodActivationStageNative]::OpenLeafIdentityRelative($ParentDirectory,$Leaf)
+        $writer.Dispose(); $writer = $null
+        $readHandle = [CcodActivationStageNative]::OpenLeafReadRelative($ParentDirectory,$Leaf)
+        $stream = [IO.FileStream]::new($readHandle,[IO.FileAccess]::Read,65536,$false)
+        $memory = [IO.MemoryStream]::new()
+        try { $stream.CopyTo($memory); $readBytes = $memory.ToArray() }
+        finally { $memory.Dispose() }
+        $identityHandle.Dispose(); $identityHandle = $null
+        return [pscustomobject]@{ Stream=$stream; Bytes=$readBytes }
+    } catch {
+        if ($null -ne $writer) { $writer.Dispose() }
+        elseif ($null -ne $writerHandle) { $writerHandle.Dispose() }
+        if ($null -ne $identityHandle) { $identityHandle.Dispose() }
+        throw
+    }
+}
+
 function Assert-CcodActivationNonReparsePath {
     param([Parameter(Mandatory)][string]$Root,[Parameter(Mandatory)][string]$Path)
     $canonicalRoot = [IO.Path]::GetFullPath($Root).TrimEnd('\')
@@ -140,6 +376,10 @@ function Close-CcodActivationPayloadSeal {
     foreach ($stream in @($Seal.Streams)) {
         if ($null -ne $stream) { try { $stream.Dispose() } catch { } }
     }
+    $directoryPins = @($Seal.DirectoryPins)
+    for ($index=$directoryPins.Count-1;$index-ge0;$index--) {
+        if ($null -ne $directoryPins[$index]) { try { $directoryPins[$index].Dispose() } catch { } }
+    }
     Remove-CcodActivationPayloadStage -AppRoot $Seal.AppRoot -StageRoot $Seal.StageRoot
 }
 
@@ -168,6 +408,7 @@ function New-CcodActivationPayloadSeal {
     [void](Assert-CcodActivationNonReparsePath -Root $payload -Path $manifestPath)
     $sourceLocks = [Collections.Generic.List[object]]::new()
     $stageLocks = [Collections.Generic.List[object]]::new()
+    $stageDirectoryPins = [Collections.Generic.List[object]]::new()
     $stageRoot = Join-Path $app ('.activation-payload-stage-' + [guid]::NewGuid().ToString('N'))
     try {
         $manifestLock = Open-CcodActivationLockedBytes -Path $manifestPath -MaximumBytes 4194304
@@ -231,17 +472,23 @@ function New-CcodActivationPayloadSeal {
         catch { throw 'CCOD_INSTALL_PAYLOAD_MANIFEST_INVALID' }
         if ($packageSnapshot.Count -ne 1 -or $package.version -isnot [string] -or [string]$package.version -cne $Version) { throw 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH' }
 
-        [IO.Directory]::CreateDirectory($stageRoot) | Out-Null
+        Initialize-CcodActivationStageNative
+        $appPin = [CcodActivationStageNative]::OpenExistingDirectory($app)
+        $stageDirectoryPins.Add($appPin)
+        $stageName = [IO.Path]::GetFileName($stageRoot)
+        $stagePin = [CcodActivationStageNative]::CreateDirectoryRelative($appPin,$stageName)
+        $stageDirectoryPins.Add($stagePin)
+        $directories = [Collections.Generic.Dictionary[string,object]]::new([StringComparer]::Ordinal)
+        $directories.Add('',$stagePin)
         [void](Assert-CcodActivationNonReparsePath -Root $app -Path $stageRoot)
         foreach ($snapshot in @($snapshots) + @([pscustomobject]@{Relative='installer-payload.manifest.json';Bytes=$manifestLock.Bytes;Sha256=$ExpectedManifestSha256})) {
             $destination = [IO.Path]::GetFullPath((Join-Path $stageRoot ([string]$snapshot.Relative).Replace('/','\')))
             $stagePrefix = $stageRoot.TrimEnd('\') + '\'
             if (-not $destination.StartsWith($stagePrefix,[StringComparison]::OrdinalIgnoreCase)) { throw 'CCOD_INSTALL_PAYLOAD_PATH_INVALID' }
-            [IO.Directory]::CreateDirectory((Split-Path $destination -Parent)) | Out-Null
-            $writer = [IO.File]::Open($destination,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::None)
-            try { $writer.Write([byte[]]$snapshot.Bytes,0,([byte[]]$snapshot.Bytes).Length); $writer.Flush($true) } finally { $writer.Dispose() }
+            $relativeDirectory = [IO.Path]::GetDirectoryName(([string]$snapshot.Relative).Replace('/','\'))
+            $parentPin = Get-CcodActivationPinnedDirectory -Directories $directories -DirectoryPins $stageDirectoryPins -RelativeDirectory $relativeDirectory
+            $stageLock = Open-CcodActivationPinnedLeafBytes -ParentDirectory $parentPin -Leaf ([IO.Path]::GetFileName($destination)) -Bytes ([byte[]]$snapshot.Bytes)
             [void](Assert-CcodActivationNonReparsePath -Root $stageRoot -Path $destination)
-            $stageLock = Open-CcodActivationLockedBytes -Path $destination
             $stageLocks.Add($stageLock)
             if ((Get-CcodActivationBytesSha256 -Bytes $stageLock.Bytes) -cne [string]$snapshot.Sha256) { throw 'CCOD_INSTALL_FILE_HASH_MISMATCH' }
         }
@@ -251,9 +498,11 @@ function New-CcodActivationPayloadSeal {
             ManifestPath=Join-Path $stageRoot 'installer-payload.manifest.json'
             ManifestBytes=$manifestLock.Bytes
             Streams=@($stageLocks | ForEach-Object { $_.Stream })
+            DirectoryPins=@($stageDirectoryPins)
         }
     } catch {
         foreach ($locked in @($stageLocks)) { try { $locked.Stream.Dispose() } catch { } }
+        for ($pinIndex=$stageDirectoryPins.Count-1;$pinIndex-ge0;$pinIndex--) { try { $stageDirectoryPins[$pinIndex].Dispose() } catch { } }
         Remove-CcodActivationPayloadStage -AppRoot $app -StageRoot $stageRoot
         throw
     } finally {

From 7bdd78c9fdb27dc3e9ebdba02daddf0b23fc010b Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 16:53:50 +0800
Subject: [PATCH 060/187] test: expose setup write TOCTOU and provenance drift

---
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 128 +++++++++++++++++-
 1 file changed, 123 insertions(+), 5 deletions(-)

diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 331b6b0..332fde2 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -166,7 +166,12 @@ function New-CcodReleaseFixture {
     $null = [IO.Directory]::CreateDirectory($root)
     $installer = Join-Path $root 'CodexRemote-fix-2.5.0-setup.exe'
     $commit = 'a' * 40
-    $payloadHash = 'd' * 64
+    $payloadInput = Join-Path $root 'CodexRemote-fix-2.5.0-setup-payload-manifest.json'
+    $inventoryInput = Join-Path $root 'CodexRemote-fix-2.5.0-setup-destination-inventory.iss'
+    $payloadInputRecord = [ordered]@{schemaVersion=1;projectVersion='2.5.0';files=@([ordered]@{path='package.json';length=[int64]1;sha256=('d'*64)})}
+    [IO.File]::WriteAllText($payloadInput,($payloadInputRecord|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+    [IO.File]::WriteAllText($inventoryInput,"procedure AddCcodExpectedSetupDirectories(Directories: TStrings);`r`nbegin`r`nend;`r`n",[Text.UTF8Encoding]::new($false))
+    $payloadHash = Get-CcodTestFileSha256 -Path $payloadInput
     $typeName = 'SetupFixture' + [guid]::NewGuid().ToString('N')
     $setupSource = @"
 using System.Reflection;
@@ -189,17 +194,22 @@ public static class $typeName { public static int Main() { return 0; } }
     $setupProvenance = Join-Path $root 'CodexRemote-fix-2.5.0-setup-provenance.json'
     $setupProvenanceRecord = [ordered]@{
         schemaVersion=1;product='CodexRemote-fix';version='2.5.0';gitCommit=$commit;buildTimestampUtc='2026-08-24T00:00:00.0000000Z'
-        payloadManifest=[ordered]@{name='installer-payload.manifest.json';length=[int64]123;sha256=$payloadHash;fileCount=3}
-        buildInputs=[ordered]@{innoTemplateSha256=('1'*64);destinationInventorySha256=('2'*64);compilerSha256=('3'*64);compilerFileVersion='6.7.3.0'}
+        payloadManifest=[ordered]@{name='installer-payload.manifest.json';length=[int64](Get-Item -LiteralPath $payloadInput).Length;sha256=$payloadHash;fileCount=1}
+        buildInputs=[ordered]@{innoTemplateSha256=$(Get-CcodTestFileSha256 -Path (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss'));destinationInventorySha256=$(Get-CcodTestFileSha256 -Path $inventoryInput);compilerSha256='PLACEHOLDER';compilerFileVersion='PLACEHOLDER'}
         peContract=[ordered]@{fileVersion='2.5.0.0';productVersion='2.5.0.0';productName='CodexRemote-fix';fileDescription='CCODSETUP 2.5.0';companyName=$commit;legalCopyright=$payloadHash}
     }
+    $iscc = @((Join-Path $env:LOCALAPPDATA 'Programs\Inno Setup 6\ISCC.exe'),(Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'),(Join-Path $env:ProgramFiles 'Inno Setup 6\ISCC.exe')) | Where-Object { $_ -and [IO.File]::Exists($_) } | Select-Object -First 1
+    $setupProvenanceRecord.buildInputs.compilerSha256 = Get-CcodTestFileSha256 -Path $iscc
+    $setupProvenanceRecord.buildInputs.compilerFileVersion = [string]([Diagnostics.FileVersionInfo]::GetVersionInfo($iscc).FileVersion)
     [IO.File]::WriteAllText($setupProvenance,(($setupProvenanceRecord|ConvertTo-Json -Depth 8)+"`n"),[Text.UTF8Encoding]::new($false))
     $manifest = Join-Path $root 'CodexRemote-fix-2.5.0-setup-release-manifest.json'
     $assets = @(
         [ordered]@{ name = [IO.Path]::GetFileName($installer); sha256 = $installerHash },
         [ordered]@{ name = [IO.Path]::GetFileName($checksum); sha256 = Get-CcodTestFileSha256 -Path $checksum },
         [ordered]@{ name = [IO.Path]::GetFileName($trayHost); sha256 = Get-CcodTestFileSha256 -Path $trayHost },
-        [ordered]@{ name = [IO.Path]::GetFileName($setupProvenance); sha256 = Get-CcodTestFileSha256 -Path $setupProvenance }
+        [ordered]@{ name = [IO.Path]::GetFileName($setupProvenance); sha256 = Get-CcodTestFileSha256 -Path $setupProvenance },
+        [ordered]@{ name = [IO.Path]::GetFileName($payloadInput); sha256 = Get-CcodTestFileSha256 -Path $payloadInput },
+        [ordered]@{ name = [IO.Path]::GetFileName($inventoryInput); sha256 = Get-CcodTestFileSha256 -Path $inventoryInput }
     )
     $record = [ordered]@{
         schemaVersion = 1
@@ -210,7 +220,7 @@ public static class $typeName { public static int Main() { return 0; } }
         assets = $assets
     }
     [IO.File]::WriteAllText($manifest, ($record | ConvertTo-Json -Depth 8), [Text.UTF8Encoding]::new($false))
-    return [pscustomobject]@{ Root = $root; Installer = $installer; Checksum = $checksum; TrayHost = $trayHost; SetupProvenance = $setupProvenance; Manifest = $manifest; PayloadManifestSha256 = $payloadHash }
+    return [pscustomobject]@{ Root = $root; Installer = $installer; Checksum = $checksum; TrayHost = $trayHost; SetupProvenance = $setupProvenance; PayloadInput=$payloadInput;InventoryInput=$inventoryInput; Manifest = $manifest; PayloadManifestSha256 = $payloadHash }
 }
 
 function New-CcodPortableReleaseFixture {
@@ -1536,6 +1546,46 @@ Invoke-CcodTest 'compiled Setup independently binds PE versions commit and activ
     }
 }
 
+# Production mutation caught: accepting self-consistent but false Setup build-input hashes without comparing canonical files.
+Invoke-CcodTest 'Setup provenance rejects self-consistent wrong canonical build input hashes' {
+    Import-Module (Join-Path $repositoryRoot 'build\SetupArtifact.psm1') -Force
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-setup-provenance-inputs-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $template = Join-Path $root 'CodexControlOtherDevices.iss'
+        $inventory = Join-Path $root 'InstallerDestinationInventory.iss'
+        $compiler = Join-Path $root 'ISCC.exe'
+        $payload = Join-Path $root 'installer-payload.manifest.json'
+        $provenance = Join-Path $root 'setup-provenance.json'
+        [IO.File]::WriteAllText($template,'canonical-template',[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($inventory,'canonical-inventory',[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllBytes($compiler,[byte[]](1,2,3,4,5,6,7,8))
+        $payloadRecord = [ordered]@{schemaVersion=1;projectVersion='2.5.22';files=@([ordered]@{path='package.json';length=[int64]1;sha256=('a'*64)})}
+        [IO.File]::WriteAllText($payload,($payloadRecord|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+        $payloadHash = Get-CcodTestFileSha256 -Path $payload
+        $commit = 'b' * 40
+        $timestamp = '2026-08-28T00:00:00.0000000Z'
+        $record = [ordered]@{
+            schemaVersion=1;product='CodexRemote-fix';version='2.5.22';gitCommit=$commit;buildTimestampUtc=$timestamp
+            payloadManifest=[ordered]@{name='installer-payload.manifest.json';length=[int64](Get-Item -LiteralPath $payload).Length;sha256=$payloadHash;fileCount=1}
+            buildInputs=[ordered]@{innoTemplateSha256=('1'*64);destinationInventorySha256=('2'*64);compilerSha256=('3'*64);compilerFileVersion='0.0.0.0'}
+            peContract=[ordered]@{fileVersion='2.5.22.0';productVersion='2.5.22.0';productName='CodexRemote-fix';fileDescription='CCODSETUP 2.5.22';companyName=$commit;legalCopyright=$payloadHash}
+        }
+        [IO.File]::WriteAllText($provenance,(($record|ConvertTo-Json -Depth 8)+"`n"),[Text.UTF8Encoding]::new($false))
+
+        Assert-CcodThrows {
+            $validator = Get-Command Test-CcodSetupBuildProvenance
+            if ($validator.Parameters.ContainsKey('InnoTemplatePath')) {
+                Test-CcodSetupBuildProvenance -ProvenancePath $provenance -ExpectedVersion '2.5.22' -ExpectedGitCommit $commit -ExpectedPayloadManifestSha256 $payloadHash -ExpectedBuildTimestampUtc $timestamp -InnoTemplatePath $template -DestinationInventoryPath $inventory -CompilerPath $compiler -PayloadManifestPath $payload | Out-Null
+            } else {
+                Test-CcodSetupBuildProvenance -ProvenancePath $provenance -ExpectedVersion '2.5.22' -ExpectedGitCommit $commit -ExpectedPayloadManifestSha256 $payloadHash -ExpectedBuildTimestampUtc $timestamp | Out-Null
+            }
+        } 'CCOD_SETUP_PROVENANCE_INVALID'
+    } finally {
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
 # Production mutation caught: cleaning payload stage/inventory only after a successful Setup build.
 Invoke-CcodTest 'build temporary Setup inputs are cleaned from the exact finally boundary after failure' {
     . (Join-Path $repositoryRoot 'build\build.ps1') -Library
@@ -1581,6 +1631,16 @@ Invoke-CcodTest 'Inno exposes a pre-write payload-directory reparse gate' {
     Assert-CcodTrue $treeHelper.Success 'production Inno script exposes a recursive destination-tree predicate'
     $inventoryValidator = [regex]::Match($inno,'(?ms)^function AreCcodExpectedSetupDirectoriesSafe\(.*?^end;')
     Assert-CcodTrue $inventoryValidator.Success 'production Inno script exposes a generated destination-inventory validator'
+    $pinBlockMatch = [regex]::Match($inno,'(?ms)^// CCOD_SETUP_PIN_BEGIN\s*$\r?\n(?<body>.*?)^// CCOD_SETUP_PIN_END\s*$')
+    $pinBlock = if ($pinBlockMatch.Success) { $pinBlockMatch.Groups['body'].Value } else { @'
+function PinCcodExistingSetupTree(const DirectoryName: String): Boolean;
+begin
+  Result := IsSafeExistingSetupTree(DirectoryName);
+end;
+procedure CloseCcodSetupPins();
+begin
+end;
+'@ }
     Assert-CcodTrue ($inno -cmatch '(?m)^// CCOD_INSTALLER_DESTINATION_INVENTORY\s*$' -and $inno -cmatch '(?ms)^function PrepareToInstall\(var NeedsRestart: Boolean\): String;.*?AreCcodExpectedSetupDirectoriesSafe') 'PrepareToInstall consumes the generated inventory injected at the unique marker before file copy'
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-inno-reparse-harness-' + [guid]::NewGuid().ToString('N'))
     try {
@@ -1601,6 +1661,12 @@ Invoke-CcodTest 'Inno exposes a pre-write payload-directory reparse gate' {
         $fileWriteMarker = Join-Path $expectedFileRoot 'payload-write-marker.txt'
         $junctionWriteMarker = Join-Path $expectedJunctionRoot 'payload-write-marker.txt'
         $resultPath = Join-Path $root 'result.txt'
+        $concurrentTarget = Join-Path $root 'concurrent-target'
+        $concurrentMoved = Join-Path $root 'concurrent-target-moved'
+        $concurrentOutside = Join-Path $root 'concurrent-outside'
+        $attackScript = Join-Path $root 'Invoke-ConcurrentSubstitution.ps1'
+        $attackResult = Join-Path $root 'concurrent-attack.txt'
+        $pinWriteResult = Join-Path $root 'concurrent-write.txt'
         [IO.Directory]::CreateDirectory($normal) | Out-Null
         [IO.Directory]::CreateDirectory($target) | Out-Null
         [IO.Directory]::CreateDirectory((Split-Path $nested -Parent)) | Out-Null
@@ -1615,6 +1681,23 @@ Invoke-CcodTest 'Inno exposes a pre-write payload-directory reparse gate' {
         [IO.Directory]::CreateDirectory($hardLinkTree) | Out-Null
         [IO.File]::WriteAllText($outsideHardLink,'outside-original',[Text.UTF8Encoding]::new($false))
         New-Item -ItemType HardLink -Path $hardLinkLeaf -Target $outsideHardLink | Out-Null
+        [IO.Directory]::CreateDirectory($concurrentTarget) | Out-Null
+        [IO.Directory]::CreateDirectory($concurrentOutside) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $concurrentTarget 'payload.txt'),'target-original',[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText((Join-Path $concurrentOutside 'payload.txt'),'outside-original',[Text.UTF8Encoding]::new($false))
+        $attackSource = @'
+[CmdletBinding()]
+param([Parameter(Mandatory)][string]$Target,[Parameter(Mandatory)][string]$Moved,[Parameter(Mandatory)][string]$Outside,[Parameter(Mandatory)][string]$ResultPath)
+$ErrorActionPreference='Stop'
+try {
+    Move-Item -LiteralPath $Target -Destination $Moved -ErrorAction Stop
+    New-Item -ItemType Junction -Path $Target -Target $Outside -ErrorAction Stop | Out-Null
+    [IO.File]::WriteAllText($ResultPath,'substituted',[Text.UTF8Encoding]::new($false))
+} catch {
+    [IO.File]::WriteAllText($ResultPath,'blocked',[Text.UTF8Encoding]::new($false))
+}
+'@
+        [IO.File]::WriteAllText($attackScript,$attackSource,[Text.UTF8Encoding]::new($false))
         [IO.Directory]::CreateDirectory((Join-Path $inventoryPayload 'src\persistence\modules')) | Out-Null
         [IO.File]::WriteAllText((Join-Path $inventoryPayload 'src\persistence\modules\InstallLifecycle.psm1'),'fixture',[Text.UTF8Encoding]::new($false))
         $inventoryPath = Join-Path $root 'InventoryFixture.iss'
@@ -1635,11 +1718,13 @@ const
   CCOD_FILE_ATTRIBUTE_DIRECTORY = `$00000010;
   CCOD_FILE_ATTRIBUTE_REPARSE_POINT = `$00000400;
   CCOD_FILE_READ_ATTRIBUTES = `$00000080;
+  CCOD_DELETE_ACCESS = `$00010000;
   CCOD_FILE_SHARE_READ = `$00000001;
   CCOD_FILE_SHARE_WRITE = `$00000002;
   CCOD_FILE_SHARE_DELETE = `$00000004;
   CCOD_OPEN_EXISTING = 3;
   CCOD_FILE_FLAG_OPEN_REPARSE_POINT = `$00200000;
+  CCOD_FILE_FLAG_BACKUP_SEMANTICS = `$02000000;
   CCOD_INVALID_FILE_ATTRIBUTES = `$FFFFFFFF;
   CCOD_INVALID_HANDLE_VALUE = -1;
   CCOD_ERROR_HANDLE_EOF = 38;
@@ -1691,7 +1776,11 @@ $($leafHelper.Value)
 $($treeHelper.Value)
 $inventorySource
 $($inventoryValidator.Value)
+$pinBlock
 function InitializeSetup(): Boolean;
+var
+  AttackResultCode: Integer;
+  AttackParameters: String;
 begin
   if AreCcodExpectedSetupDirectoriesSafe('$($expectedFileRoot.Replace("'","''"))') then
     SaveStringToFile('$($fileWriteMarker.Replace("'","''"))','unsafe write',False);
@@ -1699,6 +1788,23 @@ begin
     SaveStringToFile('$($junctionWriteMarker.Replace("'","''"))','unsafe write',False);
   if IsSafeExistingSetupTree('$($hardLinkTree.Replace("'","''"))') then
     SaveStringToFile('$($hardLinkLeaf.Replace("'","''"))','unsafe overwrite',False);
+  if PinCcodExistingSetupTree('$($concurrentTarget.Replace("'","''"))') then
+  begin
+    AttackParameters := '-NoProfile -NonInteractive -ExecutionPolicy Bypass -File "' +
+      '$($attackScript.Replace("'","''"))' + '" -Target "' + '$($concurrentTarget.Replace("'","''"))' +
+      '" -Moved "' + '$($concurrentMoved.Replace("'","''"))' + '" -Outside "' +
+      '$($concurrentOutside.Replace("'","''"))' + '" -ResultPath "' + '$($attackResult.Replace("'","''"))' + '"';
+    if (not Exec(ExpandConstant('{sys}\WindowsPowerShell\v1.0\powershell.exe'), AttackParameters,
+      '', SW_HIDE, ewWaitUntilTerminated, AttackResultCode)) or (AttackResultCode <> 0) then
+      SaveStringToFile('$($attackResult.Replace("'","''"))','attacker-failed',False);
+    if SaveStringToFile('$((Join-Path $concurrentTarget 'payload.txt').Replace("'","''"))','setup-write',False) then
+      SaveStringToFile('$($pinWriteResult.Replace("'","''"))','write-ok',False)
+    else
+      SaveStringToFile('$($pinWriteResult.Replace("'","''"))','write-failed',False);
+    CloseCcodSetupPins();
+  end
+  else
+    SaveStringToFile('$($pinWriteResult.Replace("'","''"))','pin-failed',False);
   if IsSafeExistingPayloadDirectory('$($normal.Replace("'","''"))') and
      IsSafeExistingPayloadDirectory('$($missing.Replace("'","''"))') and
      (not IsSafeExistingPayloadDirectory('$($junction.Replace("'","''"))')) and
@@ -1711,6 +1817,10 @@ begin
     SaveStringToFile('$($resultPath.Replace("'","''"))','pass',False);
   Result := False;
 end;
+procedure DeinitializeSetup();
+begin
+  CloseCcodSetupPins();
+end;
 "@
         [IO.File]::WriteAllText($harnessPath,$harness,[Text.UTF8Encoding]::new($false))
         $iscc = Join-Path $env:LOCALAPPDATA 'Programs\Inno Setup 6\ISCC.exe'
@@ -1722,7 +1832,15 @@ end;
         Assert-CcodTrue (-not (Test-Path -LiteralPath $fileWriteMarker)) 'nested file-as-directory is rejected before simulated payload writes'
         Assert-CcodTrue (-not (Test-Path -LiteralPath $junctionWriteMarker)) 'nested junction is rejected before simulated payload writes'
         Assert-CcodEqual 'outside-original' ([IO.File]::ReadAllText($outsideHardLink,[Text.UTF8Encoding]::new($false))) 'hard-linked setup leaf is rejected before simulated outside overwrite'
+        Assert-CcodEqual 'blocked' ([IO.File]::ReadAllText($attackResult,[Text.UTF8Encoding]::new($false))) 'concurrent directory substitution is blocked after Setup preflight'
+        Assert-CcodEqual 'write-ok' ([IO.File]::ReadAllText($pinWriteResult,[Text.UTF8Encoding]::new($false))) 'retained pins still allow the legitimate Setup overwrite'
+        Assert-CcodEqual 'outside-original' ([IO.File]::ReadAllText((Join-Path $concurrentOutside 'payload.txt'),[Text.UTF8Encoding]::new($false))) 'concurrent substitution cannot redirect Setup bytes to the outside sentinel'
+        Assert-CcodEqual 'setup-write' ([IO.File]::ReadAllText((Join-Path $concurrentTarget 'payload.txt'),[Text.UTF8Encoding]::new($false))) 'simulated Setup write reaches the pinned destination identity'
     } finally {
+        if (Test-Path -LiteralPath $concurrentTarget) {
+            $concurrentItem = Get-Item -LiteralPath $concurrentTarget -Force
+            if (($concurrentItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { [IO.Directory]::Delete($concurrentTarget) }
+        }
         if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
     }
 }

From f5021b06297c1718e21249b38084ff439c8ce105 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 16:53:50 +0800
Subject: [PATCH 061/187] fix: pin setup writes and verify provenance inputs

---
 .github/workflows/release.yml      |   4 +-
 README.md                          |   4 +-
 build/CodexControlOtherDevices.iss | 171 ++++++++++++++++++++++++++++-
 build/SetupArtifact.psm1           |  27 +++--
 build/build.ps1                    |  12 +-
 tools/Test-ReleaseDefender.ps1     |  16 ++-
 6 files changed, 217 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index deaf09f..4db31d4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -145,7 +145,7 @@ jobs:
               throw "Could not inspect existing release assets for $tag."
             }
           }
-          $assets = @(Get-ChildItem -LiteralPath (Join-Path $PWD 'build\dist') -File | Where-Object { $_.Extension -in @('.exe', '.zip', '.txt', '.json') })
+          $assets = @(Get-ChildItem -LiteralPath (Join-Path $PWD 'build\dist') -File | Where-Object { $_.Extension -in @('.exe', '.zip', '.txt', '.json', '.iss') })
           $assetNames = @($assets | ForEach-Object { $_.Name })
           $unexpected = @($existingAssets | Where-Object { $assetNames -cnotcontains $_ })
           if ($unexpected.Count -ne 0) {
@@ -194,7 +194,7 @@ jobs:
           if ($tag -cnotmatch '^v\d+\.\d+\.\d+$') {
             throw "Release tag output is invalid: '$tag'."
           }
-          $assets = @(Get-ChildItem -LiteralPath (Join-Path $PWD 'build\dist') -File | Where-Object { $_.Extension -in @('.exe', '.zip', '.txt', '.json') })
+          $assets = @(Get-ChildItem -LiteralPath (Join-Path $PWD 'build\dist') -File | Where-Object { $_.Extension -in @('.exe', '.zip', '.txt', '.json', '.iss') })
           $assetNames = @($assets | ForEach-Object { $_.Name })
           $publishedNames = @(& gh release view $tag --repo $env:GITHUB_REPOSITORY --json assets --jq '.assets[].name')
           if ($LASTEXITCODE -ne 0 -or ((@($publishedNames | Sort-Object) -join '|') -cne (@($assetNames | Sort-Object) -join '|'))) {
diff --git a/README.md b/README.md
index 76c384a..838f510 100644
--- a/README.md
+++ b/README.md
@@ -62,8 +62,8 @@ The current portable bundle, checksum, release manifest, and payload manifest ar
 Before replacing a portable build, use its installed `Uninstall-CodexControlOtherDevices.ps1`;
 settings and the DPAPI device-key store stay in place.
 
-Verified on Windows 11 · Codex Desktop `26.820.7780.0` · Node.js `22.23.1`:
-the hidden controller tab, restart-and-repair recovery, and persistent remote connection are working.
+Historical development checks used Windows 11, Codex Desktop `26.820.7780.0`,
+and Node.js `22.23.1`; they are not current v2.5.22 real-machine acceptance.
 
 ## Everyday use
 
diff --git a/build/CodexControlOtherDevices.iss b/build/CodexControlOtherDevices.iss
index c77f35c..e5c5a8c 100644
--- a/build/CodexControlOtherDevices.iss
+++ b/build/CodexControlOtherDevices.iss
@@ -56,6 +56,7 @@ Name: "english"; MessagesFile: "compiler:Default.isl"
 
 [Files]
 Source: "{#SetupProvenancePath}"; DestDir: "{app}"; DestName: "setup-provenance.json"; Flags: dontcopy
+Source: "{#InstallerPayloadDirectory}\installer-payload.manifest.json"; DestDir: "{app}"; DestName: "setup-input-payload-manifest.json"; Flags: dontcopy
 Source: "..\README.md"; DestDir: "{app}"; Flags: ignoreversion
 Source: "..\README.zh-CN.md"; DestDir: "{app}"; Flags: ignoreversion
 Source: "..\LICENSE"; DestDir: "{app}"; Flags: ignoreversion
@@ -121,11 +122,13 @@ const
   CCOD_FILE_ATTRIBUTE_DIRECTORY = $00000010;
   CCOD_FILE_ATTRIBUTE_REPARSE_POINT = $00000400;
   CCOD_FILE_READ_ATTRIBUTES = $00000080;
+  CCOD_DELETE_ACCESS = $00010000;
   CCOD_FILE_SHARE_READ = $00000001;
   CCOD_FILE_SHARE_WRITE = $00000002;
   CCOD_FILE_SHARE_DELETE = $00000004;
   CCOD_OPEN_EXISTING = 3;
   CCOD_FILE_FLAG_OPEN_REPARSE_POINT = $00200000;
+  CCOD_FILE_FLAG_BACKUP_SEMANTICS = $02000000;
   CCOD_INVALID_FILE_ATTRIBUTES = $FFFFFFFF;
   CCOD_INVALID_HANDLE_VALUE = -1;
   CCOD_ERROR_HANDLE_EOF = 38;
@@ -278,6 +281,161 @@ begin
   end;
 end;
 
+// CCOD_SETUP_PIN_BEGIN
+var
+  CcodSetupPinHandles: array of Integer;
+
+procedure AddCcodSetupPin(Handle: Integer);
+var
+  Count: Integer;
+begin
+  Count := GetArrayLength(CcodSetupPinHandles);
+  SetArrayLength(CcodSetupPinHandles, Count + 1);
+  CcodSetupPinHandles[Count] := Handle;
+end;
+
+procedure CloseCcodSetupPins();
+var
+  Index: Integer;
+begin
+  for Index := GetArrayLength(CcodSetupPinHandles) - 1 downto 0 do
+    if CcodSetupPinHandles[Index] <> CCOD_INVALID_HANDLE_VALUE then
+      CloseHandle(CcodSetupPinHandles[Index]);
+  SetArrayLength(CcodSetupPinHandles, 0);
+end;
+
+function PinCcodExistingSetupDirectory(const DirectoryName: String): Boolean;
+var
+  Attributes: Cardinal;
+  DirectoryHandle: Integer;
+  Information: TCcodByHandleFileInformation;
+begin
+  Result := False;
+  Attributes := GetFileAttributesW(DirectoryName);
+  if Attributes = CCOD_INVALID_FILE_ATTRIBUTES then
+  begin
+    Result := True;
+    Exit;
+  end;
+  if ((Attributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) = 0) or
+     ((Attributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) <> 0) then Exit;
+  DirectoryHandle := CreateFileW(DirectoryName, CCOD_FILE_READ_ATTRIBUTES or CCOD_DELETE_ACCESS,
+    CCOD_FILE_SHARE_READ or CCOD_FILE_SHARE_WRITE, 0, CCOD_OPEN_EXISTING,
+    CCOD_FILE_FLAG_BACKUP_SEMANTICS or CCOD_FILE_FLAG_OPEN_REPARSE_POINT, 0);
+  if DirectoryHandle = CCOD_INVALID_HANDLE_VALUE then Exit;
+  if (not GetFileInformationByHandle(DirectoryHandle, Information)) or
+     ((Information.FileAttributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) = 0) or
+     ((Information.FileAttributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) <> 0) then
+  begin
+    CloseHandle(DirectoryHandle);
+    Exit;
+  end;
+  Attributes := GetFileAttributesW(DirectoryName);
+  if (Attributes = CCOD_INVALID_FILE_ATTRIBUTES) or
+     ((Attributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) = 0) or
+     ((Attributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) <> 0) then
+  begin
+    CloseHandle(DirectoryHandle);
+    Exit;
+  end;
+  AddCcodSetupPin(DirectoryHandle);
+  Result := True;
+end;
+
+function PinCcodExistingSetupLeaf(const FileName: String): Boolean;
+var
+  Attributes: Cardinal;
+  FileHandle: Integer;
+  Information: TCcodByHandleFileInformation;
+begin
+  Result := False;
+  if not IsSafeExistingSetupLeaf(FileName) then Exit;
+  FileHandle := CreateFileW(FileName, CCOD_FILE_READ_ATTRIBUTES,
+    CCOD_FILE_SHARE_READ or CCOD_FILE_SHARE_WRITE, 0, CCOD_OPEN_EXISTING,
+    CCOD_FILE_FLAG_OPEN_REPARSE_POINT, 0);
+  if FileHandle = CCOD_INVALID_HANDLE_VALUE then Exit;
+  if (not GetFileInformationByHandle(FileHandle, Information)) or
+     (Information.NumberOfLinks <> 1) or
+     ((Information.FileAttributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) <> 0) or
+     ((Information.FileAttributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) <> 0) or
+     (not HasOnlyDefaultDataStream(FileName)) then
+  begin
+    CloseHandle(FileHandle);
+    Exit;
+  end;
+  Attributes := GetFileAttributesW(FileName);
+  if (Attributes = CCOD_INVALID_FILE_ATTRIBUTES) or
+     ((Attributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) <> 0) or
+     ((Attributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) <> 0) then
+  begin
+    CloseHandle(FileHandle);
+    Exit;
+  end;
+  AddCcodSetupPin(FileHandle);
+  Result := True;
+end;
+
+function PinCcodExistingSetupTree(const DirectoryName: String): Boolean;
+var
+  Attributes: Cardinal;
+  FindRec: TFindRec;
+  ChildPath: String;
+begin
+  Result := PinCcodExistingSetupDirectory(DirectoryName);
+  if not Result then Exit;
+  Attributes := GetFileAttributesW(DirectoryName);
+  if Attributes = CCOD_INVALID_FILE_ATTRIBUTES then Exit;
+  if FindFirst(AddBackslash(DirectoryName) + '*', FindRec) then
+  begin
+    try
+      repeat
+        if (FindRec.Name <> '.') and (FindRec.Name <> '..') then
+        begin
+          ChildPath := AddBackslash(DirectoryName) + FindRec.Name;
+          if ((FindRec.Attributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) <> 0) then
+          begin
+            if not PinCcodExistingSetupTree(ChildPath) then
+            begin
+              Result := False;
+              Exit;
+            end;
+          end
+          else if not PinCcodExistingSetupLeaf(ChildPath) then
+          begin
+            Result := False;
+            Exit;
+          end;
+        end;
+      until not FindNext(FindRec);
+    finally
+      FindClose(FindRec);
+    end;
+  end;
+end;
+
+function PinCcodExpectedSetupDirectories(const AppDirectory: String): Boolean;
+var
+  Directories: TStringList;
+  Index: Integer;
+  Candidate: String;
+begin
+  Result := False;
+  Directories := TStringList.Create;
+  try
+    AddCcodExpectedSetupDirectories(Directories);
+    if Directories.Count = 0 then Exit;
+    for Index := 0 to Directories.Count - 1 do
+    begin
+      Candidate := AddBackslash(AppDirectory) + Directories[Index];
+      if not PinCcodExistingSetupDirectory(Candidate) then Exit;
+    end;
+    Result := True;
+  finally
+    Directories.Free;
+  end;
+end;
+// CCOD_SETUP_PIN_END
+
 function AreCcodExpectedSetupDirectoriesSafe(const AppDirectory: String): Boolean;
 var
   Directories: TStringList;
@@ -305,10 +463,15 @@ var
   AppDirectory: String;
 begin
   Result := '';
+  CloseCcodSetupPins();
   AppDirectory := ExpandConstant('{app}');
   if not IsSafeExistingSetupTree(AppDirectory) or
      not AreCcodExpectedSetupDirectoriesSafe(AppDirectory) then
-    Result := 'CodexRemote-fix refused an unsafe existing payload directory.';
+    Result := 'CodexRemote-fix refused an unsafe existing payload directory.'
+  else if not PinCcodExistingSetupTree(AppDirectory) or
+          not PinCcodExpectedSetupDirectories(AppDirectory) then
+    Result := 'CodexRemote-fix could not retain the safe Setup write boundary.';
+  if Result <> '' then CloseCcodSetupPins();
 end;
 
 function NewActivationId(): String;
@@ -488,6 +651,7 @@ var
 begin
   if CurStep <> ssPostInstall then
     Exit;
+  CloseCcodSetupPins();
   ActivationId := NewActivationId();
   ReceiptPath := ExpandConstant('{localappdata}\CodexControlOtherDevices\state\post-install-activation.json');
   RefuseStaleActivationReceipt(ReceiptPath);
@@ -547,6 +711,11 @@ begin
   end;
 end;
 
+procedure DeinitializeSetup();
+begin
+  CloseCcodSetupPins();
+end;
+
 function IsCanonicalUninstallTransactionId(const Value: String): Boolean;
 var
   Index: Integer;
diff --git a/build/SetupArtifact.psm1 b/build/SetupArtifact.psm1
index 4458e71..a5eda58 100644
--- a/build/SetupArtifact.psm1
+++ b/build/SetupArtifact.psm1
@@ -153,9 +153,21 @@ function Test-CcodSetupBuildProvenance {
         [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion,
         [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit,
         [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedPayloadManifestSha256,
-        [string]$ExpectedBuildTimestampUtc
+        [string]$ExpectedBuildTimestampUtc,
+        [Parameter(Mandatory)][string]$InnoTemplatePath,
+        [Parameter(Mandatory)][string]$DestinationInventoryPath,
+        [Parameter(Mandatory)][string]$CompilerPath,
+        [Parameter(Mandatory)][string]$PayloadManifestPath
     )
     $path = Assert-CcodSetupRegularFile -Path $ProvenancePath -Kind 'Setup provenance'
+    $template = Assert-CcodSetupRegularFile -Path $InnoTemplatePath -Kind 'Inno template'
+    $inventory = Assert-CcodSetupRegularFile -Path $DestinationInventoryPath -Kind 'Destination inventory'
+    $compiler = Assert-CcodSetupRegularFile -Path $CompilerPath -Kind 'Inno compiler'
+    $payload = Assert-CcodSetupRegularFile -Path $PayloadManifestPath -Kind 'Installer payload manifest'
+    try { $payloadRaw = [IO.File]::ReadAllText($payload,[Text.UTF8Encoding]::new($false)); $payloadRecord = $payloadRaw | ConvertFrom-Json -ErrorAction Stop }
+    catch { Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Canonical installer payload manifest is invalid' $payload }
+    $actualPayloadHash = Get-CcodSetupArtifactHash -Path $payload
+    $actualCompilerVersion = ([string][Diagnostics.FileVersionInfo]::GetVersionInfo($compiler).FileVersion).Trim()
     try { $raw = [IO.File]::ReadAllText($path,[Text.UTF8Encoding]::new($false)); $record = $raw | ConvertFrom-Json -ErrorAction Stop }
     catch { Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Setup provenance is invalid JSON' $path }
     $timestampMatches = [regex]::Matches($raw,'"buildTimestampUtc"\s*:\s*"(?<value>[^"\\]+)"')
@@ -166,19 +178,20 @@ function Test-CcodSetupBuildProvenance {
         $record.version -isnot [string] -or $record.version -cne $ExpectedVersion -or $record.gitCommit -isnot [string] -or $record.gitCommit -cne $ExpectedGitCommit -or
         -not (Test-CcodSetupCanonicalUtc $timestampText) -or
         (-not [string]::IsNullOrWhiteSpace($ExpectedBuildTimestampUtc) -and $timestampText -cne $ExpectedBuildTimestampUtc) -or
-        $record.payloadManifest.sha256 -isnot [string] -or $record.payloadManifest.sha256 -cne $ExpectedPayloadManifestSha256 -or
+        $record.payloadManifest.sha256 -isnot [string] -or $record.payloadManifest.sha256 -cne $ExpectedPayloadManifestSha256 -or $record.payloadManifest.sha256 -cne $actualPayloadHash -or
         $record.payloadManifest.name -isnot [string] -or $record.payloadManifest.name -cne 'installer-payload.manifest.json' -or
-        [int64]$record.payloadManifest.length -le 0 -or [int]$record.payloadManifest.fileCount -le 0 -or
+        [int64]$record.payloadManifest.length -ne [int64](Get-Item -LiteralPath $payload -Force).Length -or
+        [int]$record.payloadManifest.fileCount -ne [int]@($payloadRecord.files).Count -or
         $record.peContract.fileVersion -isnot [string] -or $record.peContract.fileVersion -cne "$ExpectedVersion.0" -or
         $record.peContract.productVersion -isnot [string] -or $record.peContract.productVersion -cne "$ExpectedVersion.0" -or
         $record.peContract.productName -isnot [string] -or $record.peContract.productName -cne 'CodexRemote-fix' -or
         $record.peContract.fileDescription -isnot [string] -or $record.peContract.fileDescription -cne (Get-CcodSetupDescription -Version $ExpectedVersion) -or
         $record.peContract.companyName -isnot [string] -or $record.peContract.companyName -cne $ExpectedGitCommit -or
         $record.peContract.legalCopyright -isnot [string] -or $record.peContract.legalCopyright -cne $ExpectedPayloadManifestSha256 -or
-        $record.buildInputs.innoTemplateSha256 -isnot [string] -or $record.buildInputs.innoTemplateSha256 -cnotmatch '^[0-9a-f]{64}$' -or
-        $record.buildInputs.destinationInventorySha256 -isnot [string] -or $record.buildInputs.destinationInventorySha256 -cnotmatch '^[0-9a-f]{64}$' -or
-        $record.buildInputs.compilerSha256 -isnot [string] -or $record.buildInputs.compilerSha256 -cnotmatch '^[0-9a-f]{64}$' -or
-        $record.buildInputs.compilerFileVersion -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$record.buildInputs.compilerFileVersion)) {
+        $record.buildInputs.innoTemplateSha256 -isnot [string] -or $record.buildInputs.innoTemplateSha256 -cne (Get-CcodSetupArtifactHash -Path $template) -or
+        $record.buildInputs.destinationInventorySha256 -isnot [string] -or $record.buildInputs.destinationInventorySha256 -cne (Get-CcodSetupArtifactHash -Path $inventory) -or
+        $record.buildInputs.compilerSha256 -isnot [string] -or $record.buildInputs.compilerSha256 -cne (Get-CcodSetupArtifactHash -Path $compiler) -or
+        $record.buildInputs.compilerFileVersion -isnot [string] -or ([string]$record.buildInputs.compilerFileVersion).Trim() -cne $actualCompilerVersion) {
         Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Setup provenance is not exactly bound to the release contract' $path
     }
     return $record
diff --git a/build/build.ps1 b/build/build.ps1
index c9cdf94..cea0e03 100644
--- a/build/build.ps1
+++ b/build/build.ps1
@@ -331,8 +331,10 @@ $releaseManifest = Join-Path $dist "CodexRemote-fix-$Version-release-manifest.js
 $setupExe = Join-Path $dist "CodexRemote-fix-$Version-setup.exe"
 $setupChecksum = "$setupExe.sha256.txt"
 $setupProvenance = Join-Path $dist "CodexRemote-fix-$Version-setup-provenance.json"
+$setupPayloadInput = Join-Path $dist "CodexRemote-fix-$Version-setup-payload-manifest.json"
+$setupInventoryInput = Join-Path $dist "CodexRemote-fix-$Version-setup-destination-inventory.iss"
 $setupReleaseManifest = Join-Path $dist "CodexRemote-fix-$Version-setup-release-manifest.json"
-foreach ($path in @($bundle,$checksum,$provenance,$payloadManifestAsset,$releaseManifest,$setupExe,$setupChecksum,$setupProvenance,$setupReleaseManifest)) {
+foreach ($path in @($bundle,$checksum,$provenance,$payloadManifestAsset,$releaseManifest,$setupExe,$setupChecksum,$setupProvenance,$setupPayloadInput,$setupInventoryInput,$setupReleaseManifest)) {
     if ([IO.File]::Exists($path) -or [IO.Directory]::Exists($path)) { throw "Refusing to overwrite immutable release output: $path" }
 }
 
@@ -481,8 +483,10 @@ $iscc = $isccCandidates | Where-Object { -not [string]::IsNullOrWhiteSpace($_) -
 if (-not $iscc) { throw 'Inno Setup 6 (ISCC.exe) was not found. Install it with: winget install --id JRSoftware.InnoSetup --exact' }
 $issPath = Join-Path $PSScriptRoot 'CodexControlOtherDevices.iss'
 Import-Module (Join-Path $PSScriptRoot 'SetupArtifact.psm1') -Force
+[IO.File]::Copy((Assert-CcodBuildRegularFile -Path $installerPayloadManifestPath -Kind 'Installer payload manifest'),$setupPayloadInput,$false)
+[IO.File]::Copy((Assert-CcodBuildRegularFile -Path $installerDestinationInventoryPath -Kind 'Installer destination inventory'),$setupInventoryInput,$false)
 $setupProvenanceRecord = New-CcodSetupBuildProvenance -Version $Version -GitCommit $gitCommit -BuildTimestampUtc $buildTimestampUtc -PayloadManifestPath $installerPayloadManifestPath -InnoTemplatePath $issPath -DestinationInventoryPath $installerDestinationInventoryPath -CompilerPath $iscc -OutputPath $setupProvenance
-Test-CcodSetupBuildProvenance -ProvenancePath $setupProvenance -ExpectedVersion $Version -ExpectedGitCommit $gitCommit -ExpectedPayloadManifestSha256 $installerPayloadManifestSha256 -ExpectedBuildTimestampUtc $buildTimestampUtc | Out-Null
+Test-CcodSetupBuildProvenance -ProvenancePath $setupProvenance -ExpectedVersion $Version -ExpectedGitCommit $gitCommit -ExpectedPayloadManifestSha256 $installerPayloadManifestSha256 -ExpectedBuildTimestampUtc $buildTimestampUtc -InnoTemplatePath $issPath -DestinationInventoryPath $installerDestinationInventoryPath -CompilerPath $iscc -PayloadManifestPath $installerPayloadManifestPath | Out-Null
 $isccArguments = @(
     "/DProjectVersion=$Version",
     "/DTrayHostArtifactDirectory=$trayHostArtifact",
@@ -507,7 +511,9 @@ $setupRecord = [ordered]@{
         [ordered]@{ name = [IO.Path]::GetFileName($setupExe); sha256 = $setupHash },
         [ordered]@{ name = [IO.Path]::GetFileName($setupChecksum); sha256 = Get-CcodBuildFileSha256 -Path $setupChecksum },
         [ordered]@{ name = [IO.Path]::GetFileName($provenance); sha256 = Get-CcodBuildFileSha256 -Path $provenance },
-        [ordered]@{ name = [IO.Path]::GetFileName($setupProvenance); sha256 = Get-CcodBuildFileSha256 -Path $setupProvenance }
+        [ordered]@{ name = [IO.Path]::GetFileName($setupProvenance); sha256 = Get-CcodBuildFileSha256 -Path $setupProvenance },
+        [ordered]@{ name = [IO.Path]::GetFileName($setupPayloadInput); sha256 = Get-CcodBuildFileSha256 -Path $setupPayloadInput },
+        [ordered]@{ name = [IO.Path]::GetFileName($setupInventoryInput); sha256 = Get-CcodBuildFileSha256 -Path $setupInventoryInput }
     )
 }
 Write-CcodBuildUtf8 -Path $setupReleaseManifest -Text (($setupRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine)
diff --git a/tools/Test-ReleaseDefender.ps1 b/tools/Test-ReleaseDefender.ps1
index ab73cdb..f9ddffe 100644
--- a/tools/Test-ReleaseDefender.ps1
+++ b/tools/Test-ReleaseDefender.ps1
@@ -487,7 +487,9 @@ function Test-CcodReleaseAssetManifest {
         "CodexRemote-fix-$ExpectedVersion-setup.exe",
         "CodexRemote-fix-$ExpectedVersion-setup.exe.sha256.txt",
         "CodexRemote-fix-$ExpectedVersion-trayhost-provenance.json",
-        "CodexRemote-fix-$ExpectedVersion-setup-provenance.json"
+        "CodexRemote-fix-$ExpectedVersion-setup-provenance.json",
+        "CodexRemote-fix-$ExpectedVersion-setup-payload-manifest.json",
+        "CodexRemote-fix-$ExpectedVersion-setup-destination-inventory.iss"
     )
     if ($assets.Count -ne $expectedNames.Count) { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Release manifest does not bind the exact required asset set' $manifestFile }
     $assetHashes = @{}
@@ -542,7 +544,15 @@ function Test-CcodReleaseAssetManifest {
         $setupRecord = $setupRaw | ConvertFrom-Json -ErrorAction Stop
         $payloadHash = [string]$setupRecord.payloadManifest.sha256
         if ($payloadHash -cnotmatch '^[0-9a-f]{64}$') { throw 'payload hash' }
-        Test-CcodSetupBuildProvenance -ProvenancePath $setupProvenancePath -ExpectedVersion $ExpectedVersion -ExpectedGitCommit ([string]$manifest.gitCommit) -ExpectedPayloadManifestSha256 $payloadHash -ExpectedBuildTimestampUtc $manifestTimestamp | Out-Null
+        $repositoryRoot = Split-Path $PSScriptRoot -Parent
+        $innoTemplatePath = Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss'
+        $compiler = @(
+            (Join-Path $env:LOCALAPPDATA 'Programs\Inno Setup 6\ISCC.exe'),
+            (Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'),
+            (Join-Path $env:ProgramFiles 'Inno Setup 6\ISCC.exe')
+        ) | Where-Object { -not [string]::IsNullOrWhiteSpace($_) -and [IO.File]::Exists($_) } | Select-Object -First 1
+        if ($null -eq $compiler) { throw 'canonical ISCC compiler missing' }
+        Test-CcodSetupBuildProvenance -ProvenancePath $setupProvenancePath -ExpectedVersion $ExpectedVersion -ExpectedGitCommit ([string]$manifest.gitCommit) -ExpectedPayloadManifestSha256 $payloadHash -ExpectedBuildTimestampUtc $manifestTimestamp -InnoTemplatePath $innoTemplatePath -DestinationInventoryPath (Join-Path $directory $expectedNames[5]) -CompilerPath $compiler -PayloadManifestPath (Join-Path $directory $expectedNames[4]) | Out-Null
         Test-CcodSetupArtifact -SetupPath $installer -ExpectedVersion $ExpectedVersion -ExpectedGitCommit ([string]$manifest.gitCommit) -ExpectedPayloadManifestSha256 $payloadHash | Out-Null
     } catch {
         Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' ('Setup provenance or final PE contract is invalid: ' + $_.Exception.Message) $setupProvenancePath
@@ -556,6 +566,8 @@ function Test-CcodReleaseAssetManifest {
         InstallerName = $expectedNames[0]
         PayloadManifestSha256 = $payloadHash
         SetupProvenanceName = $expectedNames[3]
+        SetupPayloadInputName = $expectedNames[4]
+        SetupInventoryInputName = $expectedNames[5]
     }
 }
 

From 8102bded7e668fff59f581cdfb1ce98cde3f3bca Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 16:54:21 +0800
Subject: [PATCH 062/187] docs: record final TOCTOU remediation

---
 .../task-5-report.md                          | 97 +++++++++++++++++++
 1 file changed, 97 insertions(+)

diff --git a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
index 25e18fd..f5356b2 100644
--- a/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
+++ b/.superpowers/sdd/2026-08-28-v2522-install-runtime-reliability/task-5-report.md
@@ -638,3 +638,100 @@ f1ee9b7 test: expose linked whole-install deletion
 No installer/build/release/install operation was performed in this narrow
 round. No real process was started or stopped, and no WindowsApps or DPAPI data
 was accessed.
+
+## Final remediation round 2 — pinned write boundaries and canonical provenance
+
+### Deterministic RED evidence
+
+Activation stage substitution used the real production function set extracted
+from `Activate-CcodRemoteFix.ps1`. A debugger barrier fired after the old stage
+pathname check and before the first verified leaf write. The barrier renamed
+the stage and replaced it with an outside junction:
+
+```text
+case=activation-pins-the-stage-directory-before-any-verified-leaf-write
+expected=[blocked]
+actual=[substituted]
+```
+
+The real compiled Inno harness retained the old preflight result, launched a
+concurrent PowerShell substitution attempt, and then simulated the Setup write:
+
+```text
+case=Inno-exposes-a-pre-write-payload-directory-reparse-gate
+expected concurrent attack=[blocked]
+actual=[substituted]
+```
+
+The Setup provenance fixture supplied canonical template, inventory, compiler,
+and payload files while its record used self-consistent false `111...`,
+`222...`, and `333...` hashes. The old validator accepted the record:
+
+```text
+case=Setup-provenance-rejects-self-consistent-wrong-canonical-build-input-hashes
+ASSERT_THROWS: expected CCOD_SETUP_PROVENANCE_INVALID
+```
+
+### Implementation
+
+- Activation now pins the app directory and atomically creates the stage and
+  every nested stage directory with relative `NtCreateFile(FILE_CREATE)`
+  handles. Each leaf transitions from its writer handle to identity/read pins,
+  is rehashed through the pinned read handle, and remains non-writable and
+  non-deletable through the child installer lifetime. All pins close in reverse
+  order before exact safe cleanup.
+- Inno retains a global native handle set from `PrepareToInstall` until the
+  start of `ssPostInstall`. Existing directories are opened with read/delete
+  access and no delete sharing; existing leaves are held with read/write
+  sharing but no delete sharing. The real harness proves the concurrent
+  directory rename/junction substitution is blocked while the legitimate
+  overwrite succeeds. `DeinitializeSetup` closes every pin on abort.
+- Setup provenance validation now requires the actual canonical Inno template,
+  generated destination inventory, ISCC executable, and installer payload
+  manifest paths. It compares real hashes, compiler version, payload length,
+  and payload file count rather than only checking SHA-256 text shape.
+- The exact Setup payload manifest and generated inventory are release-bound
+  assets. Build and publish validation use them with the repository template
+  and installed canonical ISCC path; release upload/read-back includes `.iss`.
+- README's historical Windows 11 validation line is explicitly qualified as
+  historical development evidence, not current v2.5.22 real-machine
+  acceptance.
+
+### GREEN evidence
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+exit 0
+Release workflow self-tests passed.
+  - original source-byte swap barrier passed
+  - activation stage substitution was blocked
+  - real compiled Inno concurrent substitution was blocked
+  - simulated legitimate Setup overwrite succeeded
+  - outside sentinel remained unchanged
+  - false canonical provenance hashes were rejected
+  - real ISCC fixture compilation passed
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\trayhost\Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly
+exit 0; 3 cases
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\trayhost\Invoke-TrayHostSelfTest.ps1 -NativeOnly
+exit 0; 25 cases
+
+PowerShell parser checks and git diff --check
+exit 0
+```
+
+Commits:
+
+```text
+2633509 test: expose activation stage substitution
+39e838f fix: pin activation stage write boundary
+7bdd78c test: expose setup write TOCTOU and provenance drift
+f5021b0 fix: pin setup writes and verify provenance inputs
+```
+
+No real installer, Codex, TrayHost, or Supervisor process was run or stopped.
+No build candidate was published, pushed, tagged, signed, or installed, and no
+WindowsApps or DPAPI data was accessed. Controlled aggregate validation, final
+candidate rebuild, complete branch review, and real-machine acceptance remain
+with the controller.

From 144fc23fe9e2d7dec9c4858a654af78fae74746c Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 28 Aug 2026 20:50:41 +0800
Subject: [PATCH 063/187] docs: define transactional install release design

---
 ...22-transactional-install-release-design.md | 217 ++++++++++++++++++
 1 file changed, 217 insertions(+)
 create mode 100644 docs/superpowers/specs/2026-08-28-v2522-transactional-install-release-design.md

diff --git a/docs/superpowers/specs/2026-08-28-v2522-transactional-install-release-design.md b/docs/superpowers/specs/2026-08-28-v2522-transactional-install-release-design.md
new file mode 100644
index 0000000..c61a9d6
--- /dev/null
+++ b/docs/superpowers/specs/2026-08-28-v2522-transactional-install-release-design.md
@@ -0,0 +1,217 @@
+# v2.5.22 Transactional Install and Release Acceptance Design
+
+## Status
+
+The user approved this architecture on 2026-08-28. It supersedes the
+incomplete installer/write-boundary portions of the earlier v2.5.22 designs.
+`v2.5.22` is not tagged or released, so this design retains that version rather
+than creating a second public version number.
+
+## Goal
+
+Make a fresh install, a supported legacy upgrade, and a same-version repair
+converge on one sealed current-user runtime. A failed transaction must retain a
+known runnable runtime or fail without creating an active mixed state. The
+release path must not expose assets publicly until both Setup and the EXE-based
+portable ZIP are verified, scanned, and accepted on the current Windows host.
+
+## Evidence and non-goals
+
+The existing candidate already has useful foundations: versioned manifests,
+exact payload hashes, source-byte sealing in the activation worker, runtime
+pointer revalidation, strict process identity, and authenticated tray receipts.
+It does not yet make Setup writes, activation-script execution, lifecycle
+copies/promotions/deletes, Defender release evidence, and reboot acceptance one
+end-to-end transaction.
+
+This design does not modify `ChatGPT.exe`, `app.asar`, `WindowsApps`, account
+state, or the current-user DPAPI device-key store. It does not add an external
+remote-control channel or change the authenticated TrayHost protocol.
+
+## Invariants
+
+- All product state remains current-user scoped.
+- The release version is exactly `2.5.22` until it is publicly released.
+- A runtime may become active only from a manifest-listed sealed package whose
+  version, source commit, and payload hash match the transaction contract.
+- A file write, promotion, or delete uses a pinned parent identity and a
+  single relative leaf name. Pathname checks are validation, not authority.
+- A failure before pointer commit leaves the old pointer and stable shell
+  untouched. A failure after pointer commit uses a monotonic compensating
+  generation pointing back to the retained old runtime; it never rewrites a
+  generation number.
+- `Ready` requires a matching active pointer, runtime manifest, Supervisor,
+  authenticated TrayHost, expected version, and terminal activation receipt.
+- A release remains draft until its exact asset set and both Defender receipts
+  are read back successfully. A failed scan or missing evidence is a hard
+  release failure, never a bypass.
+
+## Architecture
+
+### 1. Sealed package generation and trusted Setup bootstrap
+
+Build produces one manifest-bound package archive for Setup, containing the
+complete runtime source and stable-shell candidates. The Setup executable keeps
+that archive, its manifest, and the activation bootstrap as `dontcopy` inputs.
+The installer no longer relies on a writable `{app}` tree as the code execution
+source.
+
+At `PrepareToInstall`, Setup:
+
+1. extracts the bootstrap and package only to its private temporary area;
+2. rehashes the extracted files against compile-time values while their handles
+   deny write and delete sharing;
+3. starts a sealed bootstrap process from that locked source;
+4. waits for the bootstrap to create and pin the target transaction root and
+   return a fixed capability/ready result; and
+5. performs no recursive product payload extraction itself.
+
+The bootstrap is the only component allowed to unpack the package into the
+current-user install root. It keeps its package and destination pins until the
+terminal receipt has been validated. A diagnostic copy under `{app}` may exist
+after a successful transaction, but Setup must never execute that copy as part
+of the install success path.
+
+The old Inno `AppId`, installed user-facing name, current-user scope, and
+existing control-panel uninstall entry are preserved for migration. A failed
+transaction never unregisters or recursively deletes a legacy entry. Legacy
+installer shell files become compatibility inputs only; they are never used as
+a source-file discovery root. After `Ready`, the transaction records the
+sealed package identity beside the existing entry so an explicit future
+uninstall can distinguish owned legacy files from unknown files.
+
+### 2. Private pinned file transaction module
+
+Add one private persistence module,
+`InstallFileTransaction.psm1`. Its native interop is internal; callers do not
+receive arbitrary pathname write APIs.
+
+Its required operations are:
+
+| Operation | Contract |
+| --- | --- |
+| Open/create pinned directory | Opens or creates exactly one child under an already pinned parent; rejects reparse points and unexpected identities. |
+| Create pinned temporary leaf | Creates only a single generated leaf under a pinned directory with no overwrite of an existing inode. |
+| Copy and verify | Reads sealed source bytes, writes through the pinned leaf, flushes, and rehashes through the same handle. |
+| Commit promotion | Atomically promotes a verified temporary leaf within the pinned directory; identity or sharing ambiguity fails closed. |
+| Enumerate/delete owned tree | Walks by pinned handles, rejects reparse points, alternate streams, and multi-link leaves, then removes only transaction-owned entries from leaves upward. |
+| Close transaction | Releases handles only after a terminal success/failure decision; failed cleanup preserves its owned candidate for later diagnosis rather than performing a pathname-recursive delete. |
+
+The module accepts only pinned handles and validated relative segments. It
+cannot be called with an untrusted absolute destination. Existing checks for
+ADS, reparse points, link count, manifest membership, length, and SHA-256
+remain mandatory at every transition.
+
+### 3. Transaction state machine and compatibility recovery
+
+The bootstrap persists a private, bounded transaction record under the existing
+state root. It contains a transaction ID, old/new runtime IDs, old/new
+generation, sealed package hash, phase, and candidate object names. It contains
+no credentials, remote keys, arbitrary paths, or raw exception text.
+
+```text
+Prepared
+  -> PackageVerified
+  -> RuntimeStaged
+  -> PreviousProtectionStopped
+  -> RuntimePromoted
+  -> StableShellCommitted
+  -> PointerCommitted
+  -> ProtectionReady
+  -> Ready
+```
+
+- Before `PointerCommitted`, a failure leaves the previous stable shell and
+  active pointer unchanged, then proves the retained previous runtime can run.
+- After `PointerCommitted`, a failure records a new, higher compensating
+  generation targeting the retained previous runtime and restores the matching
+  stable shell. If compensation cannot be proven, it writes no `Ready`, retains
+  all candidates, and returns a stable rollback code.
+- Legacy installations without the transaction record start at `Idle`; their
+  active runtime is treated as a compatibility candidate only after the
+  existing strict identity and manifest checks succeed.
+- A same-version repair reuses a package only when version and sealed package
+  hash both match. A same version with different bytes fails as a conflict,
+  preventing a mixed repair.
+- Unknown legacy files are never recursively removed. Cleanup is limited to
+  transaction-owned objects that the module can prove safe.
+
+### 4. Defender and draft-release promotion
+
+Both local installer entry paths scan their sealed input before activation:
+
+- portable scans its verified payload as today, retaining the existing strict
+  Defender failure behavior;
+- Setup bootstrap scans the verified Setup package before beginning the
+  transaction.
+
+Release publishing becomes a staged promotion:
+
+```text
+clean build -> exact asset manifests -> draft release -> official draft download
+-> SHA/manifest revalidation -> Defender scan of Setup and portable ZIP
+-> receipts bound to exact assets -> full install/reboot acceptance -> public release
+```
+
+The release workflow uploads only an explicit 11-item asset allowlist. It
+creates a draft, uploads the exact set, reads every asset back, and never
+publishes a partial asset set. Its Defender gate has two explicit origins:
+
+- `TrustedWorkflowArtifact` for an internally generated candidate whose
+  artifact identity, manifests, version, commit, and hashes are verified; and
+- `InternetDownload` for an official browser download that must retain actual
+  ZoneId 3. The workflow must not synthesize a Zone identifier.
+
+Each receipt binds asset SHA-256, manifest SHA-256, version, commit, Defender
+platform/signature data, timestamps, and zero new detections. Disabled Defender,
+missing real-time protection, stale/missing signature metadata, missing receipt,
+or a scan error blocks promotion. The release workflow must use a documented
+Defender-capable Windows runner; if unavailable, it fails while leaving the
+release draft private for review.
+
+### 5. Acceptance evidence
+
+Automated acceptance must cover:
+
+1. clean fresh install with initially missing transaction directories;
+2. legacy upgrade from the currently released installer;
+3. same-version repair with same hash and rejection of same-version/different
+   hash input;
+4. failures injected at each state-machine phase, including post-pointer
+   compensation;
+5. pinned copy, promotion, and deletion boundaries retaining outside sentinel
+   data unchanged;
+6. Setup and portable artifact integrity, both manifest contracts, exact
+   11-item release assets, and dual Defender receipts;
+7. a clean Windows runner full suite, never treating a live local mutex as a
+   pass; and
+8. a current-machine official-draft acceptance: full uninstall/reinstall,
+   reboot, active-runtime/process identity, DPAPI key preservation, tray
+   About/language/logs/repair actions, and a real second-device remote
+   connection.
+
+The last tray and remote interactions require recorded end-user evidence
+(screenshots plus redacted logs) in addition to programmatic status checks.
+No release may be called stable until this evidence exists.
+
+## Files and interfaces expected to change
+
+- `build/build.ps1`, `build/CodexControlOtherDevices.iss`, payload and
+  destination inventory generation;
+- `Activate-CcodRemoteFix.ps1` and a private
+  `src/persistence/modules/InstallFileTransaction.psm1`;
+- `src/persistence/modules/InstallLifecycle.psm1` and its transaction/state
+  tests;
+- `Install-CodexRemote-fix.ps1`, `tools/Test-ReleaseDefender.ps1`, CI/release
+  workflows, release contract tests, and installed lifecycle acceptance tests;
+- concise English and Chinese README/CHANGELOG text that only describes
+  verified behavior.
+
+The implementation plan will map these changes into reviewable TDD tasks with
+separate source, workflow, and installed-machine acceptance gates.
+
+## Explicit non-release rule
+
+All local `build/dist` directories produced before this transaction design are
+historical evidence only. They must not be uploaded, tagged, installed, or used
+for acceptance. A clean candidate is built only from the final reviewed commit.

From 0ecf0a5be00f488a239422bd10d589875c0c6c8f Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sat, 29 Aug 2026 08:27:25 +0800
Subject: [PATCH 064/187] docs: plan transactional install release

---
 ...-29-v2522-transactional-install-release.md | 961 ++++++++++++++++++
 ...22-transactional-install-release-design.md |  35 +-
 2 files changed, 986 insertions(+), 10 deletions(-)
 create mode 100644 docs/superpowers/plans/2026-08-29-v2522-transactional-install-release.md

diff --git a/docs/superpowers/plans/2026-08-29-v2522-transactional-install-release.md b/docs/superpowers/plans/2026-08-29-v2522-transactional-install-release.md
new file mode 100644
index 0000000..afd8d7c
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-29-v2522-transactional-install-release.md
@@ -0,0 +1,961 @@
+# v2.5.22 Transactional Install and Release Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Ship the unreleased v2.5.22 as a sealed, recoverable current-user
+installation transaction whose final Setup and portable artifacts cannot become
+public until they pass exact asset, Defender, and current-machine acceptance
+gates.
+
+**Architecture:** A private pinned file-transaction module replaces pathname
+mutation for all lifecycle staging, promotion, and owned cleanup. A sealed
+Setup package and locked temporary bootstrap feed that transaction, which
+persists a monotonic phase record and compensates an unsuccessful post-pointer
+upgrade. Release evidence is separate from product state: exact asset
+contracts, dual Defender receipts, a clean runner, a private draft, and a
+multi-reboot local acceptance record form a promotion chain.
+
+**Tech Stack:** Windows PowerShell 5.1, .NET Framework/C# `Add-Type` interop,
+Inno Setup 6, Node.js 22, GitHub Actions, Microsoft Defender, existing
+PowerShell persistence self-tests.
+
+**Spec:** `docs/superpowers/specs/2026-08-28-v2522-transactional-install-release-design.md`
+
+## Global Constraints
+
+- Keep the release version exactly `2.5.22`; it is not tagged or public.
+- Never modify `ChatGPT.exe`, `app.asar`, `WindowsApps`, account state, or the
+  DPAPI device-key store.
+- Preserve the authenticated TrayHost wire schema and strict Codex process
+  identity rules. Do not add a listener, a production test mode, or an external
+  remote-control path.
+- File mutations are authorized only by pinned parent identities plus
+  single-segment leaves. Path checks, hashes, ADS checks, and link counts are
+  validation layers, not authority for a later pathname write or delete.
+- Every implementation change starts with a deterministic behavioral RED,
+  followed by the smallest GREEN change, focused test evidence, a commit, and
+  a scoped review.
+- A failed pre-pointer transaction preserves the previous pointer and stable
+  shell. A failed post-pointer transaction records a higher compensating
+  generation or returns `CCOD_INSTALL_ROLLBACK_FAILED` without `Ready`.
+- Use only clean, fresh build candidates. Existing `build/dist` assets are
+  historical evidence and must never be uploaded, installed, or used for
+  acceptance.
+- Real Defender scans, GitHub draft/release operations, installation, Codex
+  restart, Windows reboot, and second-device remote confirmation are final
+  acceptance operations only; no task below performs them unless its command
+  explicitly targets a disposable test fixture.
+- All production and release receipts are bounded and sanitized: stable codes,
+  hashes, version, commit, timestamps, and phases only; never credentials,
+  DPAPI material, user paths, tokens, raw logs, or exception text.
+
+---
+
+### Task 1: Create private handle-bound installation file transactions
+
+**Files:**
+- Create: `src/persistence/modules/InstallFileTransaction.psm1`
+- Create: `tests/persistence/InstallFileTransaction.SelfTest.ps1`
+- Modify: `tests/PersistenceSelfTest.ps1`
+- Modify: `tests/Validate.ps1`
+
+**Interfaces:**
+
+`InstallFileTransaction.psm1` owns all native handles and exposes only these
+private module functions:
+
+```powershell
+Open-CcodInstallFileTransaction -InstallRoot <absolute-root>
+Open-CcodInstallPinnedDirectory -Transaction <context> -ParentDirectory <pin> -Leaf <single-segment> [-CreateIfMissing]
+New-CcodInstallPinnedTemporaryLeaf -Transaction <context> -ParentDirectory <pin> -Leaf <generated-single-segment>
+Copy-CcodInstallSealedFile -Transaction <context> -SourcePath <absolute-file> -DestinationLeaf <pin> -ExpectedLength <int64> -ExpectedSha256 <lowercase-hex>
+Commit-CcodInstallPinnedPromotion -Transaction <context> -ParentDirectory <pin> -TemporaryLeaf <pin> -DestinationLeaf <single-segment>
+Write-CcodInstallPinnedJson -Transaction <context> -ParentDirectory <pin> -Leaf <single-segment> -Value <object> [-Compress]
+Append-CcodInstallPinnedLog -Transaction <context> -ParentDirectory <pin> -Leaf <single-segment> -Record <sanitized-object>
+Remove-CcodInstallOwnedTree -Transaction <context> -ParentDirectory <pin> -Leaf <single-segment>
+Close-CcodInstallFileTransaction -Transaction <context> -Disposition Ready|Failed
+```
+
+The context includes the pinned install root, owned-object names, and all leaf
+or directory handles. A caller may not pass an arbitrary destination pathname
+to any mutation operation.
+
+- [ ] **Step 1: Write deterministic failing transaction tests**
+
+Create fixture helpers which make a temporary root and an outside sentinel.
+Add one test for every native boundary:
+
+```powershell
+$tx = Open-CcodInstallFileTransaction -InstallRoot $install
+$rootPin = $tx.RootDirectory
+$child = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $rootPin -Leaf 'runtime' -CreateIfMissing
+$result = Invoke-CcodAttemptDirectoryReplacement -Path (Join-Path $install 'runtime') -OutsideRoot $outside
+Assert-CcodEqual 'blocked' $result.Outcome 'pinned missing directory cannot be replaced after creation'
+```
+
+Add RED cases for a replacement between temporary-leaf creation and promotion,
+source-byte replacement after `Copy-CcodInstallSealedFile` opens the source,
+reparse/ADS/multi-link leaves, a promotion whose parent was renamed, and a
+delete tree containing an unknown, reparse, or multi-link leaf. Each case must
+assert the outside sentinel remains unchanged and that failed cleanup retains
+the unproven owned candidate.
+
+Add REDs that a pinned JSON write and a pinned log append reject a replaced
+state/log parent and cannot alter an outside sentinel. These operations become
+the sole mutation route for the lifecycle's active pointer, runtime manifest,
+phase record, activation receipt, UI state, and install log in Tasks 2–3.
+
+- [ ] **Step 2: Run the new suite and confirm RED**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1
+```
+
+Expected: the module/functions are absent and at least the missing-directory
+pin case fails before any production mutation code exists.
+
+- [ ] **Step 3: Implement the smallest private transaction module**
+
+Use native `SafeFileHandle` operations with `FILE_OPEN_REPARSE_POINT` and
+relative child opens/creates. Directory handles deny delete sharing for their
+lifetime. Temporary leaves use create-new semantics; source and destination
+bytes are read/written/hashed through the opened handles, flush completes
+before promotion, and promotion is limited to the pinned parent. Enumerate and
+delete only transaction-owned objects from leaves upward; any unexpected
+identity stops deletion and leaves the candidate in place.
+
+Do not import `LifecycleTransaction.psm1` or change any public wire schema;
+this module is file-object ownership only.
+
+- [ ] **Step 4: Run focused GREEN and aggregate registration checks**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\PersistenceSelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\Validate.ps1 -SkipInstalledPackageCheck
+```
+
+Record any expected local mutex contamination separately; do not reinterpret it
+as a pass. The new isolated transaction suite itself must exit zero.
+
+- [ ] **Step 5: Commit**
+
+```text
+feat: add pinned install file transaction
+```
+
+### Task 2: Move lifecycle runtime data and stable-shell mutations onto the transaction
+
+**Files:**
+- Modify: `src/persistence/modules/InstallLifecycle.psm1`
+- Modify: `Install-CodexControlOtherDevices.ps1`
+- Modify: `src/persistence/modules/StateStore.psm1`
+- Modify: `src/persistence/modules/UiPreferences.psm1`
+- Modify: `tests/persistence/InstallLifecycle.SelfTest.ps1`
+- Modify: `tests/persistence/UninstallBootstrap.SelfTest.ps1`
+
+**Interfaces:**
+
+Task 2 imports `InstallFileTransaction.psm1` and changes internal lifecycle
+composition to:
+
+```powershell
+Copy-CcodLifecycleStaging -SourceRoot <root> -InstallRoot <root> -FileTransaction <context> -Adapters <hashtable> -Files <object[]>
+Commit-CcodLifecycleRuntime -FileTransaction <context> -StagingDirectory <pin> -RuntimeId <canonical-runtime-id>
+Stage-CcodLifecycleStableShell -FileTransaction <context> -StagedRuntime <pin>
+Commit-CcodLifecycleStableShell -FileTransaction <context> -StableShellCandidates <object>
+Remove-CcodLifecycleOwnedRuntime -FileTransaction <context> -RuntimeId <canonical-runtime-id>
+```
+
+`Stage-CcodLifecycleStableShell` may only create verified candidates. It must
+not overwrite stable `bootstrap.ps1` or
+`Uninstall-CodexControlOtherDevices.ps1` before Task 3 has committed the active
+pointer. `Commit-CcodLifecycleStableShell` runs only after pointer commit and
+is therefore part of the monotonic compensation boundary.
+
+- [ ] **Step 1: Write lifecycle RED cases before editing production paths**
+
+Add deterministic adapters/barriers to the lifecycle suite. Assert all of:
+
+```powershell
+Assert-CcodThrows {
+    Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $raceAdapters
+} 'CCOD_INSTALL_FILE_TRANSACTION_INVALID'
+Assert-CcodEqual $oldBootstrapHash (Get-CcodLifecycleFileSha256 $bootstrap) 'failed staging never changes stable bootstrap bytes'
+Assert-CcodEqual $oldPointerJson (Get-Content $active -Raw) 'failed promotion never changes active pointer'
+```
+
+Cover a missing fresh `.staging`/`runtime` directory, a replacement after a
+parent pin, a promotion failure, a stable-shell candidate hash failure, owned
+old-runtime cleanup after an unexpected leaf appears, and a legacy unknown
+file that must be retained. Add REDs that runtime `manifest.json`, initial
+state, and UI-preference writes use a pinned state/runtime parent. Keep the
+current hard-link, ADS, reparse, and source-manifest coverage; adapt it to
+prove mutation now goes through the new transaction module.
+
+- [ ] **Step 2: Run the lifecycle suite and confirm RED**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+```
+
+Expected: at least one new barrier case proves that the current pathname
+staging/promotion or early stable-shell copy is not transaction-bound.
+
+- [ ] **Step 3: Replace runtime data and pre-pointer mutations**
+
+Replace `Directory.CreateDirectory`, direct copy/move/replace, and
+`Remove-Item -Recurse` mutation paths inside lifecycle staging, runtime
+promotion, runtime manifest, initial state/UI preference, stable-shell
+candidate handling, old-runtime cleanup, and failed-candidate cleanup with
+Task 1 operations. Retain the existing process identity and scheduled-task
+rules. Build/validate runtime manifest bytes through its pinned leaf before
+promotion. Do not commit stable shell bytes yet; Task 3 commits them only after
+the active-pointer transaction succeeds.
+
+Do not change the external parameters of `Invoke-CcodInstall` in this task;
+Task 3 adds the sealed package identity, active-pointer/receipt writes, and
+transaction record.
+
+- [ ] **Step 4: Run focused GREEN**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\UninstallBootstrap.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+```
+
+The source-level and disposable-fixture suites must exit zero. Do not stop the
+real Supervisor merely to force the aggregate suite past its local mutex.
+
+- [ ] **Step 5: Commit**
+
+```text
+fix: transact lifecycle file mutations
+```
+
+### Task 3: Persist installation phases and compensate post-pointer failures
+
+**Files:**
+- Modify: `src/persistence/modules/InstallLifecycle.psm1`
+- Modify: `src/persistence/modules/RuntimeManifest.psm1`
+- Modify: `src/persistence/modules/PersistenceIO.psm1`
+- Modify: `src/persistence/modules/StateStore.psm1`
+- Modify: `src/persistence/modules/UiPreferences.psm1`
+- Modify: `Install-CodexControlOtherDevices.ps1`
+- Modify: `tests/persistence/InstallLifecycle.SelfTest.ps1`
+- Modify: `tests/persistence/InstalledLifecycleHarness.SelfTest.ps1`
+
+**Interfaces:**
+
+Add private record helpers in `InstallLifecycle.psm1` and add the required
+sealed package identity to the lifecycle call:
+
+```powershell
+New-CcodInstallTransactionRecord -TransactionId <lowercase-guid> -OldRuntimeId <nullable> -OldGeneration <nullable-uint64> -NewRuntimeId <nullable> -NewGeneration <uint64> -SealedPackageSha256 <lowercase-hex> -OwnedObjectNames <string[]>
+Read-CcodInstallTransactionRecord -InstallRoot <absolute-root>
+Set-CcodInstallTransactionPhase -InstallRoot <root> -TransactionId <guid> -ExpectedPhase <phase> -NewPhase <phase> -FileTransaction <context>
+Invoke-CcodInstallCompensation -InstallRoot <root> -TransactionRecord <record> -FileTransaction <context> -Adapters <hashtable>
+
+Invoke-CcodInstall ... -SealedPackageSha256 <lowercase-hex>
+Set-CcodActiveRuntime ... -FileTransaction <context>
+Write-CcodActivationReceiptFile ... -FileTransaction <context>
+Write-CcodLifecycleLog ... -FileTransaction <context>
+```
+
+The only accepted persisted phases are `Prepared`, `PackageVerified`,
+`RuntimeStaged`, `PreviousProtectionStopped`, `RuntimePromoted`,
+`PointerCommitted`, `StableShellCommitted`, `ProtectionReady`, `Ready`, and
+terminal `Failed`. `Failed` has the canonical transaction fields plus exactly
+one stable `CCOD_*` error code; the reader rejects any other terminal phase or
+additional field.
+
+- [ ] **Step 1: Write phase and compensation RED cases**
+
+For every phase through `RuntimePromoted`, inject a failure and assert the old
+pointer, generation, and stable-shell hashes remain exactly unchanged. For each
+phase starting at `PointerCommitted`, inject a failure and assert a higher
+generation returns to the old runtime and old stable shell:
+
+```powershell
+Assert-CcodEqual 3 ([uint64]$finalPointer.generation) 'post-pointer compensation never decrements generation'
+Assert-CcodEqual $oldRuntime $finalPointer.activeRuntime 'compensation reactivates retained old runtime'
+Assert-CcodEqual 'CCOD_INSTALL_ROLLBACK_FAILED' $receipt.errorCode 'unproven compensation remains terminal failed'
+```
+
+Add REDs for a legacy installation with no record, same version/same sealed
+hash idempotence, same version/different sealed hash
+`CCOD_INSTALL_PACKAGE_CONFLICT`, malformed/expanded transaction JSON, and a
+crash at each nonterminal phase. Assert `Ready` is impossible until active
+pointer, manifest version, Supervisor, and authenticated TrayHost all match.
+Add a RED that a canonical `Failed` record round-trips and that a missing,
+noncanonical, duplicate, or private-data error field is rejected.
+
+- [ ] **Step 2: Run RED**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+```
+
+Expected: the phase-record helpers and monotonic compensation behavior are
+absent or the new post-pointer expectations fail.
+
+- [ ] **Step 3: Implement the record and recovery state machine**
+
+Persist a bounded canonical JSON record with expected property order and no
+absolute paths. Write the transaction record, active pointer, activation
+progress/final receipt, lifecycle log, state updates, and UI preference only
+through Task 1's pinned JSON/log operations. Move the record forward only after
+the corresponding Task 2 file transaction commit. Commit active pointer before
+stable shell. On a pre-pointer failure, retain the prior pointer and restart
+the proved previous runtime when necessary. On a post-pointer failure, write
+only a higher compensating generation, restore the matching stable shell
+through the transaction module, and prove the previous Supervisor/TrayHost
+before reporting failure. If any compensation proof fails, write `Failed` with
+`CCOD_INSTALL_ROLLBACK_FAILED`, retain candidates, and do not cleanup by
+pathname.
+
+- [ ] **Step 4: Run focused GREEN**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstalledLifecycleHarness.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\RuntimeManifest.SelfTest.ps1
+```
+
+All focused suites must exit zero. Record the known active-machine mutex only
+if it occurs in an unrelated aggregate run.
+
+- [ ] **Step 5: Commit**
+
+```text
+feat: recover installation transactions monotonically
+```
+
+### Task 4: Build a sealed Setup package and invoke a locked temporary bootstrap
+
+**Files:**
+- Create: `build/InstallerPackage.psm1`
+- Modify: `build/build.ps1`
+- Modify: `build/CodexControlOtherDevices.iss`
+- Modify: `build/SetupArtifact.psm1`
+- Modify: `tools/New-InstallerDestinationInventory.ps1`
+- Modify: `Activate-CcodRemoteFix.ps1`
+- Modify: `Install-CodexControlOtherDevices.ps1`
+- Modify: `tests/persistence/ReleaseWorkflow.SelfTest.ps1`
+- Modify: `tests/persistence/InstallLifecycle.SelfTest.ps1`
+
+**Interfaces:**
+
+Add package creation/verification:
+
+```powershell
+New-CcodInstallerPackage -PayloadRoot <root> -PayloadManifestPath <manifest> -Version 2.5.22 -GitCommit <40hex> -OutputPath <absolute-zip> -ManifestOutputPath <absolute-json>
+Test-CcodInstallerPackage -PackagePath <zip> -ManifestPath <json> -ExpectedPackageSha256 <hex> -ExpectedManifestSha256 <hex> -ExpectedVersion 2.5.22 -ExpectedGitCommit <40hex>
+```
+
+The compiled Setup receives `InstallerPackageSha256`,
+`InstallerPackageManifestSha256`, `ActivationBootstrapSha256`,
+`SetupGitCommit`, and `ProjectVersion`. Its activation path calls the locked
+temporary bootstrap with:
+
+```powershell
+-PackagePath <private-temp-zip> -PackageManifestPath <private-temp-json>
+-ExpectedPackageSha256 <hex> -ExpectedPackageManifestSha256 <hex>
+-ExpectedVersion 2.5.22 -ExpectedGitCommit <40hex>
+-InstallRoot <absolute-root> -ActivationId <lowercase-guid>
+```
+
+`Activate-CcodRemoteFix.ps1` verifies these inputs through opened handles and
+passes the package hash as `-SealedPackageSha256` to Task 3's lifecycle.
+
+- [ ] **Step 1: Write package and setup-boundary RED tests**
+
+Extend the release workflow suite with a disposable package fixture. It must
+reject omitted, extra, duplicate, unsafe-path, version-mismatched,
+commit-mismatched, or hash-mismatched package contents before the install root
+is created. Add a real compiled Inno fixture which asserts every pre-Ready
+product output is absent, not merely recursive payload output:
+
+```powershell
+Assert-CcodFalse ($generatedSource -match 'DestDir:\s*"\{app\}\\payload') 'Setup does not recursively extract product payload into app'
+Assert-CcodFalse ($generatedSource -match '-File "\{app\}\\Activate-CcodRemoteFix\.ps1"') 'Setup never executes activation from writable app'
+Assert-CcodTrue ($generatedSource -match '(?m)^CreateAppDir=no$') 'Setup does not create an app directory before the transaction is Ready'
+Assert-CcodTrue ($generatedSource -match '(?m)^Uninstallable=no$') 'Setup does not create a separate Inno uninstaller before the transaction is Ready'
+Assert-CcodFalse (Test-CcodInnoPreReadyProductWrite -Source $generatedSource) 'Setup has no Files Icons Registry or UninstallRun product write before Ready'
+```
+
+Use a launch barrier after temporary bootstrap locking but before PowerShell
+opens it. A replacement attempt must not alter the executed bytes. Add REDs
+for a replaced package after validation, a stale legacy app script, missing
+fresh `app/state/runtime` directories, a non-Ready receipt, and same-version
+different-package conflict.
+
+- [ ] **Step 2: Run RED**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+```
+
+Expected: the package module and compile-time bindings are absent, and the
+current Inno source still exposes recursive payload copy or app-path execution.
+
+- [ ] **Step 3: Implement sealed package build and bootstrap execution**
+
+Build a single verified package and canonical package manifest from the
+existing manifest-listed payload. Embed package, package manifest, and
+bootstrap as `dontcopy` Setup inputs. Inno extracts them only to its private
+temporary area, locks and rehashes them against compile-time constants, and
+keeps the bootstrap lock through both activation and receipt validation.
+Set `CreateAppDir=no` and `Uninstallable=no`; remove every `[Files]`, `[Icons]`,
+`[Registry]`, and `[UninstallRun]` product write targeting `{app}` before
+`Ready`, including docs/tools/diagnostic copies. Remove recursive `{app}`
+payload extraction and all success-path execution of
+`{app}\Activate-CcodRemoteFix.ps1`.
+
+The bootstrap must use Tasks 1–3 to create/pin target directories and perform
+the entire package-to-runtime transaction. Preserve the existing Inno `AppId`
+and current-user scope as migration inputs, but do not alter a legacy uninstall
+entry in this task; Task 5 registers its replacement only after `Ready`.
+Extend Setup provenance/PE validation to bind all three new hashes plus version
+and commit.
+
+- [ ] **Step 4: Run focused GREEN and a clean disposable build**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\trayhost\Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly
+```
+
+Then create a fresh detached candidate worktree at the exact current commit
+whose `build/dist` does not yet exist, run the normal builder once there, and
+verify its two release manifests against that worktree's exact `HEAD`. Do not
+use or overwrite any existing `build/dist` directory.
+
+- [ ] **Step 5: Commit**
+
+```text
+fix: seal setup package activation
+```
+
+### Task 5: Commit verified current-user product registration and shortcuts after Ready
+
+**Files:**
+- Create: `src/persistence/modules/ProductRegistration.psm1`
+- Modify: `src/persistence/modules/InstallFileTransaction.psm1`
+- Modify: `src/persistence/modules/InstallLifecycle.psm1`
+- Modify: `src/persistence/UninstallBootstrap.ps1`
+- Modify: `Uninstall-CodexControlOtherDevices.ps1`
+- Modify: `tests/persistence/InstallLifecycle.SelfTest.ps1`
+- Modify: `tests/persistence/UninstallBootstrap.SelfTest.ps1`
+- Create: `tests/persistence/ProductRegistration.SelfTest.ps1`
+
+**Interfaces:**
+
+The registration module owns only the exact current-user product key and the
+two exact current-user shortcut names and exposes:
+
+```powershell
+New-CcodProductRegistration -InstallRoot <absolute-root> -RuntimeId <canonical-runtime-id> -Version 2.5.22 -PackageSha256 <lowercase-hex>
+Test-CcodProductRegistration -Registration <object> -ExpectedRuntimeId <canonical-runtime-id> -ExpectedVersion 2.5.22 -ExpectedPackageSha256 <lowercase-hex>
+Commit-CcodProductRegistration -Registration <object> -FileTransaction <context> -Adapters <hashtable>
+Remove-CcodLegacyProductRegistration -ExpectedAppId <canonical-guid> -Adapters <hashtable>
+```
+
+`InstallFileTransaction.psm1` additionally exposes internal fixed-root helpers
+for the exact current-user Desktop and Start-menu Programs folders. They open
+and pin only the resolved current-user special-folder identity, create only the
+two approved `CodexRemote-fix.lnk` leaves, and copy verified shortcut-candidate
+bytes through pinned handles; no product shortcut writer accepts an arbitrary
+desktop/start-menu path.
+
+The registration is written only after Task 3's `Ready` proof. It points to the
+sealed stable uninstaller and creates exactly the Start-menu `CodexRemote-fix`
+and desktop `CodexRemote-fix` shortcuts, both targeting the verified stable
+bootstrap. All three records are read back and validated before the exact
+legacy Inno uninstall registry entry and exact legacy shortcut names are
+removed. It never recursively removes the legacy app tree or unrelated registry
+values.
+
+- [ ] **Step 1: Write legacy-registration RED tests**
+
+Use registry and shortcut adapters in disposable fixtures. Add failures for
+attempting a registration before `Ready`, an uninstaller or shortcut target
+outside the sealed stable runtime, package/version/runtime mismatch, unreadable
+registration, a legacy-key/name mismatch, a shortcut write failure, and a
+registration write failure. Assert this boundary:
+
+```powershell
+Assert-CcodEqual $legacyUninstallString $world.LegacyUninstallString 'failure before read-back retains the legacy entry'
+Assert-CcodFalse $world.LegacyEntryRemoved 'failed registration never removes legacy control-panel state'
+Assert-CcodEqual 0 $world.LegacyShortcutRemovals 'failed registration never removes legacy shortcuts'
+```
+
+Add a RED that replaces the Desktop or Start-menu parent after it is opened;
+shortcut promotion must block or fail with both outside sentinels unchanged.
+
+Add a GREEN-target test that a valid `Ready` registration is read back first,
+then only the exact legacy `AppId` entry and exact legacy shortcut names are
+removed. Verify direct uninstaller and Windows Settings wrappers resolve the
+current sealed registration, and Start-menu/desktop launchers resolve the
+current sealed bootstrap.
+
+- [ ] **Step 2: Run RED**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\UninstallBootstrap.SelfTest.ps1
+```
+
+Expected: there is no private product-registration module and legacy
+uninstaller/shortcut handling is still coupled to the Inno shell.
+
+- [ ] **Step 3: Implement post-Ready registration migration**
+
+Create the private module with strict current-user registry and shortcut
+adapters, exact key/property/name allowlists, and read-back verification. Call
+it after Task 3's final Ready revalidation and before old-runtime cleanup.
+Generate shortcut candidates inside the sealed stable runtime, then promote
+their bytes only through Task 1 pinned special-folder handles. The uninstaller
+must revalidate its sealed runtime and transaction ownership before touching
+product state. Failed registration or legacy removal leaves both entries and
+both legacy shortcuts, reports a sanitized stable code, and does not turn an
+already proved runtime into an unowned installation.
+
+- [ ] **Step 4: Run focused GREEN**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\UninstallBootstrap.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ProductRegistration.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstalledLifecycleHarness.SelfTest.ps1
+```
+
+- [ ] **Step 5: Commit**
+
+```text
+feat: register product entry after readiness
+```
+
+### Task 6: Bind Defender evidence and an exact release asset contract
+
+**Files:**
+- Create: `tools/ReleaseAssetContract.psm1`
+- Modify: `tools/Test-ReleaseDefender.ps1`
+- Modify: `Install-CodexRemote-fix.ps1`
+- Modify: `Activate-CcodRemoteFix.ps1`
+- Modify: `Install-CodexControlOtherDevices.ps1`
+- Modify: `build/build.ps1`
+- Modify: `tests/persistence/ReleaseWorkflow.SelfTest.ps1`
+- Modify: `tests/persistence/InstallLifecycle.SelfTest.ps1`
+- Modify: `README.md`
+- Modify: `README.zh-CN.md`
+- Modify: `CHANGELOG.md`
+
+**Interfaces:**
+
+Define the exact 11 names in one module:
+
+```powershell
+Get-CcodExpectedReleaseAssetNames -Version 2.5.22
+Test-CcodExactReleaseAssetSet -AssetDirectory <absolute-dir> -Version 2.5.22
+Invoke-CcodReleaseDefenderCheck -CandidatePath <setup-or-zip> -ChecksumPath <checksum> -ManifestPath <matching-manifest> -Origin TrustedWorkflowArtifact|InternetDownload -ExpectedVersion 2.5.22 -ExpectedGitCommit <40hex> -EvidencePath <new-file>
+Test-CcodReleasePromotionEvidence -EvidenceDirectory <absolute-dir> -Version 2.5.22 -ExpectedGitCommit <40hex>
+```
+
+For v2.5.22 the function returns exactly this ordered set, with no scan receipt
+added to the public asset surface:
+
+```text
+CodexRemote-fix-2.5.22-windows-x64.zip
+CodexRemote-fix-2.5.22-windows-x64.zip.sha256.txt
+CodexRemote-fix-2.5.22-trayhost-provenance.json
+CodexRemote-fix-2.5.22-payload-manifest.json
+CodexRemote-fix-2.5.22-release-manifest.json
+CodexRemote-fix-2.5.22-setup.exe
+CodexRemote-fix-2.5.22-setup.exe.sha256.txt
+CodexRemote-fix-2.5.22-setup-provenance.json
+CodexRemote-fix-2.5.22-setup-payload-manifest.json
+CodexRemote-fix-2.5.22-setup-destination-inventory.iss
+CodexRemote-fix-2.5.22-setup-release-manifest.json
+```
+
+Each receipt binds asset type/SHA-256, manifest SHA-256, version, commit,
+origin, Defender platform/signature information, signature timestamp,
+scan timestamps, and zero new detections. It never records a source path or
+raw Defender result.
+
+- [ ] **Step 1: Write Defender and asset-contract RED tests**
+
+Add deterministic adapters for the Defender tool and test that
+`TrustedWorkflowArtifact` requires matching manifest/version/commit/hash
+bindings, while `InternetDownload` requires an actual ZoneId 3 and has no
+switch that synthesizes it. Add failure cases for disabled AV/real-time
+protection, absent/stale signature data, scan error, new detection, existing
+receipt, reparse evidence directory, and failed receipt write.
+
+Add a two-asset matrix: Setup and portable ZIP must have distinct matching
+receipts; a duplicate, swapped, missing, or mismatched receipt fails. Add
+asset-set REDs for missing, extra, duplicate, case-varied, or reparse entries.
+Finally, prove a portable scan failure prevents activation and a sealed Setup
+package scan failure occurs before transaction-root/product state mutation.
+Add a documentation RED that rejects the unqualified Chinese historical
+“已验证……均可用” wording and any README or CHANGELOG claim that v2.5.22 is
+stable before Task 9 records completed official-draft evidence.
+
+- [ ] **Step 2: Run RED**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+```
+
+Expected: the exact asset module and origin-bound dual Defender receipt
+contract are not present.
+
+- [ ] **Step 3: Implement the bounded evidence contract**
+
+Move exact asset-name construction into `ReleaseAssetContract.psm1`. Make
+release manifest/build validation consume that one contract. Extend the
+Defender tool with explicit origins and strict platform, service, real-time,
+signature, manifest, and receipt validation. Keep the portable scan behavior;
+add the sealed Setup package scan to Task 4's bootstrap before `Prepared`.
+Correct both README files and CHANGELOG so they describe only the scan paths
+actually enforced, list the exact public asset set, and describe v2.5.22 as a
+candidate until Task 9's externally recorded acceptance is complete.
+
+- [ ] **Step 4: Run focused GREEN**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\PortableRelease.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+```
+
+These tests prove deterministic contracts only. A real Defender scan remains a
+final external acceptance action and must not be mocked as a live pass.
+
+- [ ] **Step 5: Commit**
+
+```text
+feat: gate releases on dual Defender evidence
+```
+
+### Task 7: Stage exact draft assets behind clean-runner and promotion gates
+
+**Files:**
+- Create: `tools/Test-CleanReleaseRunner.ps1`
+- Create: `tools/Invoke-GitHubDraftRelease.ps1`
+- Modify: `.github/workflows/ci.yml`
+- Modify: `.github/workflows/release.yml`
+- Modify: `tests/persistence/ReleaseWorkflow.SelfTest.ps1`
+- Modify: `tests/persistence/Bootstrap.SelfTest.ps1`
+
+**Interfaces:**
+
+```powershell
+Test-CcodCleanReleaseRunner -RepositoryRoot <absolute-root> -ExpectedVersion 2.5.22
+Invoke-CcodGitHubDraftRelease -Mode Stage|Verify|Promote -Tag v2.5.22 -AssetDirectory <absolute-dir> -EvidenceDirectory <absolute-dir>
+```
+
+`Test-CcodCleanReleaseRunner` returns stable failure
+`CCOD_CLEAN_RUNNER_CONTAMINATED` if a CodexRemote-fix runtime root, task,
+Supervisor/TrayHost, or AccountTransition/AccountSupervisor mutex is present.
+It performs no cleanup. `Invoke-CcodGitHubDraftRelease` uses injected adapters
+in tests, consumes the Task 6 exact asset contract, and never discovers assets
+by extension glob.
+
+- [ ] **Step 1: Write workflow and runner RED tests**
+
+Add fixtures proving that an occupied mutex, existing product state, a missing
+clean preflight, `continue-on-error`, a conditional bypass, a rebuilt publish
+candidate, or an unpinned action reference rejects the workflow before any
+test/build/publish step. Add script tests that Stage cannot create a public
+release, upload failure leaves a draft private, and Verify downloads/rechecks
+all 11 assets before any Promote path.
+
+Add promotion REDs for missing dual Defender evidence, mismatched receipt,
+missing accepted reboot phase, missing legacy-upgrade evidence, or missing
+reviewed manual evidence. Require
+same-tag workflow concurrency and an explicit mode transition; tag pushes may
+stage only, never publicize.
+
+- [ ] **Step 2: Run RED**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\Bootstrap.SelfTest.ps1
+```
+
+Expected: the current workflow either lacks clean preflight, uses a public
+release first, accepts extension-based asset discovery, or has no explicit
+promotion evidence gate.
+
+- [ ] **Step 3: Implement the clean/draft workflow contract**
+
+Add a clean preflight before source validation, TrayHost traces, and build.
+The build job creates exactly one candidate; later jobs only download, hash,
+and validate it. Stage creates a GitHub draft with the exact 11-item allowlist,
+verifies read-back, and preserves the draft on failure. A tag-triggered workflow
+can Stage only; it cannot call Promote. `InternetDownload` scan receipts are
+produced by Task 8 after the user downloads the official draft in a browser and
+retains ZoneId 3. `Promote` runs only through the local, adapter-tested command
+after Task 8 and Task 9 evidence has been verified; it changes the already
+verified draft to public without rebuilding assets. Pin the current reviewed
+action sources exactly as follows and add same-tag concurrency:
+
+```text
+actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+```
+
+Do not run a real `gh` command from a test or a task implementation command.
+
+- [ ] **Step 4: Run focused GREEN**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\Bootstrap.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\Validate.ps1 -SkipInstalledPackageCheck
+```
+
+Confirm each source-level suite exits zero; a local active product mutex is
+recorded as environmental contamination, not a skipped clean-runner gate.
+
+- [ ] **Step 5: Commit**
+
+```text
+fix: stage releases behind clean promotion gates
+```
+
+### Task 8: Record official-draft upgrade, reinstall, and reboot acceptance
+
+**Files:**
+- Create: `tests/installed/OfficialDraftAcceptance.psm1`
+- Create: `tests/installed/Invoke-OfficialDraftAcceptance.ps1`
+- Create: `tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1`
+- Modify: `tests/installed/Invoke-InstalledLifecycleIntegration.ps1`
+- Modify: `tests/persistence/InstalledLifecycleHarness.SelfTest.ps1`
+- Modify: `tests/Validate.ps1`
+
+**Interfaces:**
+
+```powershell
+Invoke-CcodOfficialDraftAcceptance `
+  -Phase Preflight|LegacyUpgrade|Uninstall|FreshInstall|PreReboot|PostReboot|ReadyForManualEvidence `
+  -AssetDirectory <official-draft-download> `
+  -PreviousAssetDirectory <official-current-release-download> `
+  -EvidenceRoot <absolute-nonreparse-root> `
+  -AllowMachineMutation -AllowCodexRestart -AllowWindowsReboot
+```
+
+The persisted acceptance receipt contains only candidate/manifest hashes,
+draft tag/ID, phase, and sanitized facts. It has no account content, device-key
+content, private path, raw token, or raw log text. Task 9 appends manually
+reviewed evidence hashes only after the automated phases are complete.
+
+- [ ] **Step 1: Write phase-machine RED tests**
+
+Add tests that fail before any adapter mutation if the official draft lacks one
+of 11 exact assets, manifests/commit/hashes do not match, a caller lacks the
+relevant allow switch, or a phase is out of order/reused with a different
+candidate. `Preflight` is the only phase allowed to create dual Defender
+receipts; every later phase must reject missing, swapped, or mismatched receipts.
+
+`Preflight` must invoke `Invoke-CcodReleaseDefenderCheck` once for the official
+browser-downloaded Setup and once for the portable ZIP with
+`-Origin InternetDownload`, then persist both exact receipts before any machine
+mutation. Add a legacy-upgrade RED requiring the manifest-bound currently
+public v2.5.21 Setup asset and asserting the sealed migration preserves the
+DPAPI key hash. Add REDs requiring: uninstall proves task, Supervisor, TrayHost,
+runtime/app root, shortcuts, and expected debug endpoints are gone while the
+DPAPI key hash is unchanged; fresh install/repair proves active pointer,
+manifest, generation, one authenticated TrayHost, task, terminal receipt, and
+post-reboot proves a new boot ID, `Idle` transition, auto-recovered protection,
+and the same key hash.
+
+- [ ] **Step 2: Run RED**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\OfficialDraftAcceptanceHarness.SelfTest.ps1
+```
+
+Expected: the phase API and tamper-resistant evidence contract are absent.
+
+- [ ] **Step 3: Implement the fixture-safe acceptance orchestrator**
+
+Implement all phases using injectable adapters so self-tests never touch the
+real machine. Integrate existing lifecycle observations but strengthen their
+assertions as listed above. `LegacyUpgrade` may run only after two valid
+InternetDownload receipts; `Uninstall` follows a proved legacy upgrade;
+`FreshInstall` follows a proved uninstall; and `PostReboot` rejects a missing
+or altered pre-reboot receipt. `ReadyForManualEvidence` requires all automated
+phases but cannot become `Complete`. Add it to validation only in self-test
+mode. Do not trigger an actual uninstall, restart, reboot, tray click, or
+remote session in automated tests.
+
+- [ ] **Step 4: Run focused GREEN**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\OfficialDraftAcceptanceHarness.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstalledLifecycleHarness.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\Validate.ps1 -SkipInstalledPackageCheck
+```
+
+The real phase sequence happens only after all implementation/review/build
+gates pass, using official browser-downloaded draft and current-release assets
+plus the explicit user-authorized machine mutation/reboot switches.
+
+- [ ] **Step 5: Commit**
+
+```text
+test: require official draft acceptance evidence
+```
+
+### Task 9: Require individual tray and remote evidence before promotion
+
+**Files:**
+- Modify: `tests/installed/OfficialDraftAcceptance.psm1`
+- Modify: `tests/installed/Invoke-OfficialDraftAcceptance.ps1`
+- Modify: `tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1`
+- Modify: `tools/Invoke-GitHubDraftRelease.ps1`
+- Modify: `README.md`
+- Modify: `README.zh-CN.md`
+- Modify: `CHANGELOG.md`
+
+**Interfaces:**
+
+Extend only the completed Task 8 receipt chain:
+
+```powershell
+Invoke-CcodOfficialDraftAcceptance `
+  -Phase TrayEvidence|RemoteEvidence|Complete `
+  [-TrayOperation About|Language|OpenLogs|Repair] `
+  [-RemoteOperation SecondDeviceControl] `
+  -EvidenceRoot <absolute-nonreparse-root> `
+  -ScreenshotPath <regular-file> `
+  -RedactedLogPath <regular-file> `
+  -ReviewState Reviewed
+```
+
+`TrayEvidence` stores one bounded record for each of `About`, `Language`,
+`OpenLogs`, and `Repair`, including its expected terminal state and hashes of
+the corresponding screenshot and redacted log. `RemoteEvidence` stores the
+second-device connection/control result the same way. `Complete` requires the
+five named evidence records plus every Task 8 phase; it does not accept a free
+text confirmation.
+
+- [ ] **Step 1: Write tray/remote evidence RED tests**
+
+Add tests proving that `TrayEvidence` fails if any of the four named operations
+is missing, duplicated, has an unexpected terminal state, shares another
+operation's file hash, uses a reparse/non-file evidence path, or omits
+`Reviewed`. Add tests that `RemoteEvidence` fails without a distinct
+second-device proof. Assert `Complete` rejects a `ReadyForManualEvidence`
+receipt lacking any individual operation:
+
+```powershell
+Assert-CcodThrows {
+    Invoke-CcodOfficialDraftAcceptance -Phase Complete -EvidenceRoot $evidence -Adapters $fake
+} 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INCOMPLETE'
+```
+
+Add docs REDs requiring the Chinese README to remove the old unconditional
+“已验证……均可用” claim and both READMEs/CHANGELOG to remain candidate-oriented
+until `Complete` is represented by evidence, rather than a guessed statement.
+
+- [ ] **Step 2: Run RED**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\OfficialDraftAcceptanceHarness.SelfTest.ps1
+```
+
+Expected: the acceptance phase API accepts no individual tray/remote evidence
+or has no `Complete` evidence gate.
+
+- [ ] **Step 3: Implement the bounded manual-evidence gate**
+
+Validate the file hash and review state through injectable adapters, retain
+only the allowed named operation/result/hash fields, and chain every record to
+the exact Task 8 candidate receipt. Add `Invoke-CcodGitHubDraftRelease -Mode
+Promote` validation of this completed evidence before it is permitted to make a
+draft public. Correct both README files and CHANGELOG to avoid unsupported
+stable claims; release notes may report only the recorded acceptance facts.
+
+- [ ] **Step 4: Run focused GREEN**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\OfficialDraftAcceptanceHarness.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+```
+
+Real screenshots, tray actions, remote connection, and final promotion remain
+the user-authorized final acceptance operation; fixture tests must not open a
+real tray, switch a language, trigger repair, reboot, or control another
+device.
+
+- [ ] **Step 5: Commit**
+
+```text
+test: gate promotion on tray and remote evidence
+```
+
+## Plan self-review
+
+| Spec requirement | Implementing task |
+| --- | --- |
+| Pinned relative copies, promotion, and owned delete | Task 1 and Task 2 |
+| Fresh install, legacy upgrade, same-version conflict, and recovery | Task 2, Task 3, Task 4, Task 5, and Task 8 |
+| Sealed package and no writable-app activation execution | Task 4 and Task 5 |
+| Monotonic post-pointer compensation and strict `Ready` | Task 3 |
+| Dual Defender evidence and exact 11 assets | Task 6 and Task 8 |
+| Clean candidate build and draft-only promotion | Task 7 and Task 9 |
+| Official draft uninstall/reboot/tray/remote acceptance | Task 8 and Task 9 |
+
+No task adds a control channel, relaxes process identity, modifies Codex
+binaries, or lets existing historical build artifacts re-enter a release.
+Tasks share files only in dependency order: Tasks 1–4 form the installation
+transaction chain; Task 5 commits legacy uninstall migration only after Task 3
+Ready; Task 6 consumes Task 4's sealed package; Task 7 consumes Task 6's
+receipt/asset contract; Task 8 consumes Tasks 3–7 and produces official-draft
+Defender/upgrade/reboot evidence; Task 9 adds individual tray/remote evidence
+and is the only task that authorizes the locally executed Promote command to
+consider a draft eligible for public release.
diff --git a/docs/superpowers/specs/2026-08-28-v2522-transactional-install-release-design.md b/docs/superpowers/specs/2026-08-28-v2522-transactional-install-release-design.md
index c61a9d6..680a1b5 100644
--- a/docs/superpowers/specs/2026-08-28-v2522-transactional-install-release-design.md
+++ b/docs/superpowers/specs/2026-08-28-v2522-transactional-install-release-design.md
@@ -72,13 +72,18 @@ terminal receipt has been validated. A diagnostic copy under `{app}` may exist
 after a successful transaction, but Setup must never execute that copy as part
 of the install success path.
 
-The old Inno `AppId`, installed user-facing name, current-user scope, and
-existing control-panel uninstall entry are preserved for migration. A failed
-transaction never unregisters or recursively deletes a legacy entry. Legacy
-installer shell files become compatibility inputs only; they are never used as
-a source-file discovery root. After `Ready`, the transaction records the
-sealed package identity beside the existing entry so an explicit future
-uninstall can distinguish owned legacy files from unknown files.
+The new Inno shell sets `CreateAppDir=no` and `Uninstallable=no`; it writes no
+product file, product shortcut, or product registry entry under `{app}` before
+`Ready`. The old Inno `AppId`, installed user-facing name, current-user scope,
+and existing control-panel uninstall entry remain compatibility inputs during
+migration. After `Ready`, the transaction writes and reads back one verified
+current-user product registration pointing at the sealed stable uninstaller and
+two verified current-user shortcut records: the Start-menu `CodexRemote-fix`
+shortcut and the desktop `CodexRemote-fix` shortcut. Only after all three
+records are read back does it remove the exact legacy registry entry and exact
+legacy shortcut names. A failed transaction never unregisters or recursively
+deletes a legacy entry. Legacy installer shell files are never used as a
+source-file discovery root.
 
 ### 2. Private pinned file transaction module
 
@@ -115,18 +120,27 @@ Prepared
   -> RuntimeStaged
   -> PreviousProtectionStopped
   -> RuntimePromoted
-  -> StableShellCommitted
   -> PointerCommitted
+  -> StableShellCommitted
   -> ProtectionReady
   -> Ready
+  -> Failed
 ```
 
 - Before `PointerCommitted`, a failure leaves the previous stable shell and
   active pointer unchanged, then proves the retained previous runtime can run.
+- The stable shell is committed only after pointer commit. That creates one
+  post-pointer compensation boundary, but preserves the pre-pointer invariant:
+  a failure before pointer commit cannot alter the shell a legacy bootstrap
+  would execute.
 - After `PointerCommitted`, a failure records a new, higher compensating
   generation targeting the retained previous runtime and restores the matching
   stable shell. If compensation cannot be proven, it writes no `Ready`, retains
-  all candidates, and returns a stable rollback code.
+  all candidates, writes terminal `Failed` with a stable rollback code, and
+  returns that code.
+- `Failed` is the only terminal error phase. Its record carries the same sealed
+  transaction identity and phase order as `Ready`, plus exactly one canonical
+  `CCOD_*` error code; no raw exception or private path is persisted.
 - Legacy installations without the transaction record start at `Idle`; their
   active runtime is treated as a compatibility candidate only after the
   existing strict identity and manifest checks succeed.
@@ -201,7 +215,8 @@ No release may be called stable until this evidence exists.
 - `Activate-CcodRemoteFix.ps1` and a private
   `src/persistence/modules/InstallFileTransaction.psm1`;
 - `src/persistence/modules/InstallLifecycle.psm1` and its transaction/state
-  tests;
+  tests, plus `src/persistence/modules/ProductRegistration.psm1` for the
+  post-Ready current-user uninstall and shortcut migration;
 - `Install-CodexRemote-fix.ps1`, `tools/Test-ReleaseDefender.ps1`, CI/release
   workflows, release contract tests, and installed lifecycle acceptance tests;
 - concise English and Chinese README/CHANGELOG text that only describes

From dc52697b0000e234d1a3438d0cc23c3925a4ce9a Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sat, 29 Aug 2026 08:49:44 +0800
Subject: [PATCH 065/187] feat: add pinned install file transaction

---
 .../modules/InstallFileTransaction.psm1       | 1018 +++++++++++++++++
 tests/PersistenceSelfTest.ps1                 |    4 +
 tests/Validate.ps1                            |    2 +
 .../InstallFileTransaction.SelfTest.ps1       |  447 ++++++++
 4 files changed, 1471 insertions(+)
 create mode 100644 src/persistence/modules/InstallFileTransaction.psm1
 create mode 100644 tests/persistence/InstallFileTransaction.SelfTest.ps1

diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
new file mode 100644
index 0000000..7b1ebbc
--- /dev/null
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -0,0 +1,1018 @@
+Set-StrictMode -Version Latest
+
+$script:CcodInstallFileTransactionAfterSourceOpen = $null
+
+function Throw-CcodInstallFileError {
+    param(
+        [Parameter(Mandatory)][string]$Id,
+        [Parameter(Mandatory)][string]$Message,
+        $Target
+    )
+    throw [Management.Automation.ErrorRecord]::new(
+        [InvalidOperationException]::new($Message),
+        $Id,
+        [Management.Automation.ErrorCategory]::InvalidData,
+        $Target
+    )
+}
+
+function Initialize-CcodInstallFileNative {
+    if ($null -ne ('CcodInstallFileNative' -as [type])) { return }
+    Add-Type -TypeDefinition @'
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+
+public static class CcodInstallFileNative
+{
+    private const uint FILE_LIST_DIRECTORY = 0x00000001;
+    private const uint FILE_READ_ATTRIBUTES = 0x00000080;
+    private const uint DELETE = 0x00010000;
+    private const uint SYNCHRONIZE = 0x00100000;
+    private const uint GENERIC_READ = 0x80000000;
+    private const uint GENERIC_WRITE = 0x40000000;
+    private const uint FILE_SHARE_READ = 0x00000001;
+    private const uint FILE_SHARE_WRITE = 0x00000002;
+    private const uint FILE_SHARE_DELETE = 0x00000004;
+    private const uint FILE_OPEN = 0x00000001;
+    private const uint FILE_CREATE = 0x00000002;
+    private const uint FILE_OPEN_IF = 0x00000003;
+    private const uint FILE_DIRECTORY_FILE = 0x00000001;
+    private const uint FILE_WRITE_THROUGH = 0x00000002;
+    private const uint FILE_SYNCHRONOUS_IO_NONALERT = 0x00000020;
+    private const uint FILE_NON_DIRECTORY_FILE = 0x00000040;
+    private const uint FILE_OPEN_FOR_BACKUP_INTENT = 0x00004000;
+    private const uint FILE_OPEN_REPARSE_POINT = 0x00200000;
+    private const uint FILE_FLAG_BACKUP_SEMANTICS = 0x02000000;
+    private const uint FILE_FLAG_OPEN_REPARSE_POINT = 0x00200000;
+    private const uint FILE_FLAG_WRITE_THROUGH = 0x80000000;
+    private const uint OPEN_EXISTING = 3;
+    private const uint OBJ_CASE_INSENSITIVE = 0x00000040;
+    private const uint FILE_ATTRIBUTE_DIRECTORY = 0x00000010;
+    private const uint FILE_ATTRIBUTE_REPARSE_POINT = 0x00000400;
+    private const int FileRenameInformation = 10;
+    private const int FileDispositionInfo = 4;
+    private const int FileStreamInfo = 7;
+    private const int FileDirectoryInformation = 1;
+    private const int STATUS_NO_MORE_FILES = unchecked((int)0x80000006);
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct UNICODE_STRING
+    {
+        public ushort Length;
+        public ushort MaximumLength;
+        public IntPtr Buffer;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct OBJECT_ATTRIBUTES
+    {
+        public int Length;
+        public IntPtr RootDirectory;
+        public IntPtr ObjectName;
+        public uint Attributes;
+        public IntPtr SecurityDescriptor;
+        public IntPtr SecurityQualityOfService;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct IO_STATUS_BLOCK
+    {
+        public IntPtr Status;
+        public UIntPtr Information;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    internal struct FILETIME_NATIVE
+    {
+        public uint Low;
+        public uint High;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    internal struct BY_HANDLE_FILE_INFORMATION
+    {
+        public uint FileAttributes;
+        public FILETIME_NATIVE CreationTime;
+        public FILETIME_NATIVE LastAccessTime;
+        public FILETIME_NATIVE LastWriteTime;
+        public uint VolumeSerialNumber;
+        public uint FileSizeHigh;
+        public uint FileSizeLow;
+        public uint NumberOfLinks;
+        public uint FileIndexHigh;
+        public uint FileIndexLow;
+    }
+
+    public sealed class OpenResult
+    {
+        public SafeFileHandle Handle { get; private set; }
+        public bool Created { get; private set; }
+        public OpenResult(SafeFileHandle handle, bool created) { Handle = handle; Created = created; }
+    }
+
+    public sealed class HandleInfo
+    {
+        public uint Attributes { get; private set; }
+        public uint NumberOfLinks { get; private set; }
+        public uint VolumeSerialNumber { get; private set; }
+        public ulong FileIndex { get; private set; }
+        public long Length { get; private set; }
+        public bool IsDirectory { get { return (Attributes & FILE_ATTRIBUTE_DIRECTORY) != 0; } }
+        public bool IsReparsePoint { get { return (Attributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0; } }
+
+        internal HandleInfo(BY_HANDLE_FILE_INFORMATION value)
+        {
+            Attributes = value.FileAttributes;
+            NumberOfLinks = value.NumberOfLinks;
+            VolumeSerialNumber = value.VolumeSerialNumber;
+            FileIndex = ((ulong)value.FileIndexHigh << 32) | value.FileIndexLow;
+            Length = ((long)value.FileSizeHigh << 32) | value.FileSizeLow;
+        }
+    }
+
+    public sealed class DirectoryEntry
+    {
+        public string Name { get; private set; }
+        public uint Attributes { get; private set; }
+        public DirectoryEntry(string name, uint attributes) { Name = name; Attributes = attributes; }
+    }
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern SafeFileHandle CreateFileW(string path, uint access, uint share, IntPtr security,
+        uint creation, uint flags, IntPtr template);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle handle, out BY_HANDLE_FILE_INFORMATION information);
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern uint GetFinalPathNameByHandleW(SafeFileHandle handle, StringBuilder path, uint length, uint flags);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool GetFileInformationByHandleEx(SafeFileHandle handle, int informationClass, IntPtr information, uint size);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool SetFileInformationByHandle(SafeFileHandle handle, int informationClass, IntPtr information, uint size);
+
+    [DllImport("ntdll.dll")]
+    private static extern int NtCreateFile(out IntPtr fileHandle, uint desiredAccess,
+        ref OBJECT_ATTRIBUTES objectAttributes, out IO_STATUS_BLOCK ioStatusBlock, IntPtr allocationSize,
+        uint fileAttributes, uint shareAccess, uint createDisposition, uint createOptions,
+        IntPtr eaBuffer, uint eaLength);
+
+    [DllImport("ntdll.dll")]
+    private static extern int NtQueryDirectoryFile(SafeFileHandle fileHandle, IntPtr eventHandle, IntPtr apcRoutine,
+        IntPtr apcContext, out IO_STATUS_BLOCK ioStatusBlock, IntPtr fileInformation, uint length,
+        int fileInformationClass, [MarshalAs(UnmanagedType.Bool)] bool returnSingleEntry,
+        IntPtr fileName, [MarshalAs(UnmanagedType.Bool)] bool restartScan);
+
+    [DllImport("ntdll.dll")]
+    private static extern int NtSetInformationFile(SafeFileHandle fileHandle, out IO_STATUS_BLOCK ioStatusBlock,
+        IntPtr fileInformation, uint length, int fileInformationClass);
+
+    [DllImport("ntdll.dll")]
+    private static extern uint RtlNtStatusToDosError(int status);
+
+    private static void ThrowStatus(int status)
+    {
+        throw new Win32Exception(unchecked((int)RtlNtStatusToDosError(status)));
+    }
+
+    private static OpenResult OpenRelative(SafeFileHandle parent, string name, uint access, uint share,
+        uint disposition, uint options)
+    {
+        if (parent == null || parent.IsInvalid || parent.IsClosed) throw new ArgumentException("Parent pin is invalid", "parent");
+        IntPtr nameBuffer = IntPtr.Zero;
+        IntPtr unicodePointer = IntPtr.Zero;
+        try
+        {
+            nameBuffer = Marshal.StringToHGlobalUni(name);
+            UNICODE_STRING unicode = new UNICODE_STRING();
+            unicode.Length = checked((ushort)(name.Length * 2));
+            unicode.MaximumLength = checked((ushort)((name.Length + 1) * 2));
+            unicode.Buffer = nameBuffer;
+            unicodePointer = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(UNICODE_STRING)));
+            Marshal.StructureToPtr(unicode, unicodePointer, false);
+            OBJECT_ATTRIBUTES attributes = new OBJECT_ATTRIBUTES();
+            attributes.Length = Marshal.SizeOf(typeof(OBJECT_ATTRIBUTES));
+            attributes.RootDirectory = parent.DangerousGetHandle();
+            attributes.ObjectName = unicodePointer;
+            attributes.Attributes = OBJ_CASE_INSENSITIVE;
+            IO_STATUS_BLOCK statusBlock;
+            IntPtr rawHandle;
+            int status = NtCreateFile(out rawHandle, access, ref attributes, out statusBlock, IntPtr.Zero,
+                0, share, disposition, options | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_REPARSE_POINT,
+                IntPtr.Zero, 0);
+            if (status < 0 || rawHandle == IntPtr.Zero || rawHandle == new IntPtr(-1)) ThrowStatus(status);
+            return new OpenResult(new SafeFileHandle(rawHandle, true), statusBlock.Information.ToUInt64() == 2UL);
+        }
+        finally
+        {
+            if (unicodePointer != IntPtr.Zero) Marshal.FreeHGlobal(unicodePointer);
+            if (nameBuffer != IntPtr.Zero) Marshal.FreeHGlobal(nameBuffer);
+        }
+    }
+
+    public static SafeFileHandle OpenRootDirectory(string path)
+    {
+        SafeFileHandle handle = CreateFileW(path, FILE_LIST_DIRECTORY | FILE_READ_ATTRIBUTES | SYNCHRONIZE,
+            FILE_SHARE_READ | FILE_SHARE_WRITE, IntPtr.Zero, OPEN_EXISTING,
+            FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT, IntPtr.Zero);
+        if (handle.IsInvalid) throw new Win32Exception(Marshal.GetLastWin32Error());
+        return handle;
+    }
+
+    public static OpenResult OpenDirectoryRelative(SafeFileHandle parent, string name, bool createIfMissing)
+    {
+        return OpenRelative(parent, name, FILE_LIST_DIRECTORY | FILE_READ_ATTRIBUTES | DELETE | SYNCHRONIZE,
+            FILE_SHARE_READ | FILE_SHARE_WRITE, createIfMissing ? FILE_OPEN_IF : FILE_OPEN,
+            FILE_DIRECTORY_FILE | FILE_OPEN_FOR_BACKUP_INTENT);
+    }
+
+    public static OpenResult CreateTemporaryFileRelative(SafeFileHandle parent, string name)
+    {
+        return OpenRelative(parent, name, GENERIC_READ | GENERIC_WRITE | DELETE | SYNCHRONIZE,
+            FILE_SHARE_READ, FILE_CREATE, FILE_NON_DIRECTORY_FILE | FILE_WRITE_THROUGH);
+    }
+
+    public static OpenResult OpenAppendFileRelative(SafeFileHandle parent, string name)
+    {
+        return OpenRelative(parent, name, GENERIC_READ | GENERIC_WRITE | DELETE | SYNCHRONIZE,
+            FILE_SHARE_READ, FILE_OPEN_IF, FILE_NON_DIRECTORY_FILE | FILE_WRITE_THROUGH);
+    }
+
+    public static SafeFileHandle OpenIdentityRelative(SafeFileHandle parent, string name)
+    {
+        return OpenRelative(parent, name, FILE_READ_ATTRIBUTES | SYNCHRONIZE,
+            FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN, FILE_OPEN_FOR_BACKUP_INTENT).Handle;
+    }
+
+    public static SafeFileHandle OpenSourceFile(string path)
+    {
+        SafeFileHandle handle = CreateFileW(path, GENERIC_READ | FILE_READ_ATTRIBUTES | SYNCHRONIZE,
+            FILE_SHARE_READ, IntPtr.Zero, OPEN_EXISTING, FILE_FLAG_OPEN_REPARSE_POINT, IntPtr.Zero);
+        if (handle.IsInvalid) throw new Win32Exception(Marshal.GetLastWin32Error());
+        return handle;
+    }
+
+    public static HandleInfo GetInfo(SafeFileHandle handle)
+    {
+        BY_HANDLE_FILE_INFORMATION information;
+        if (!GetFileInformationByHandle(handle, out information)) throw new Win32Exception(Marshal.GetLastWin32Error());
+        return new HandleInfo(information);
+    }
+
+    public static string GetFinalPath(SafeFileHandle handle)
+    {
+        StringBuilder path = new StringBuilder(512);
+        uint length = GetFinalPathNameByHandleW(handle, path, (uint)path.Capacity, 0);
+        if (length == 0) throw new Win32Exception(Marshal.GetLastWin32Error());
+        if (length >= path.Capacity)
+        {
+            path.Capacity = checked((int)length + 1);
+            length = GetFinalPathNameByHandleW(handle, path, (uint)path.Capacity, 0);
+            if (length == 0 || length >= path.Capacity) throw new Win32Exception(Marshal.GetLastWin32Error());
+        }
+        string value = path.ToString();
+        if (value.StartsWith(@"\\?\UNC\", StringComparison.OrdinalIgnoreCase)) return @"\\" + value.Substring(8);
+        if (value.StartsWith(@"\\?\", StringComparison.OrdinalIgnoreCase)) return value.Substring(4);
+        return value;
+    }
+
+    public static bool HasOnlyDefaultDataStream(SafeFileHandle handle)
+    {
+        const int bufferSize = 65536;
+        IntPtr buffer = Marshal.AllocHGlobal(bufferSize);
+        try
+        {
+            if (!GetFileInformationByHandleEx(handle, FileStreamInfo, buffer, bufferSize))
+                throw new Win32Exception(Marshal.GetLastWin32Error());
+            int offset = 0;
+            int count = 0;
+            while (true)
+            {
+                uint next = unchecked((uint)Marshal.ReadInt32(buffer, offset));
+                uint nameLength = unchecked((uint)Marshal.ReadInt32(buffer, offset + 4));
+                if (nameLength > bufferSize - offset - 24) throw new InvalidDataException("Invalid stream information");
+                string name = Marshal.PtrToStringUni(IntPtr.Add(buffer, offset + 24), checked((int)nameLength / 2));
+                count++;
+                if (!String.Equals(name, "::$DATA", StringComparison.OrdinalIgnoreCase)) return false;
+                if (next == 0) break;
+                if (next > bufferSize - offset) throw new InvalidDataException("Invalid stream information offset");
+                offset = checked(offset + (int)next);
+            }
+            return count == 1;
+        }
+        finally { Marshal.FreeHGlobal(buffer); }
+    }
+
+    public static string[] EnumerateDirectory(SafeFileHandle directory)
+    {
+        const int bufferSize = 65536;
+        IntPtr buffer = Marshal.AllocHGlobal(bufferSize);
+        List<string> names = new List<string>();
+        bool restart = true;
+        try
+        {
+            while (true)
+            {
+                IO_STATUS_BLOCK statusBlock;
+                int status = NtQueryDirectoryFile(directory, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero,
+                    out statusBlock, buffer, bufferSize, FileDirectoryInformation, false, IntPtr.Zero, restart);
+                restart = false;
+                if (status == STATUS_NO_MORE_FILES) break;
+                if (status < 0) ThrowStatus(status);
+                int offset = 0;
+                while (true)
+                {
+                    uint next = unchecked((uint)Marshal.ReadInt32(buffer, offset));
+                    uint nameLength = unchecked((uint)Marshal.ReadInt32(buffer, offset + 60));
+                    if (nameLength > bufferSize - offset - 64) throw new InvalidDataException("Invalid directory information");
+                    string name = Marshal.PtrToStringUni(IntPtr.Add(buffer, offset + 64), checked((int)nameLength / 2));
+                    if (name != "." && name != "..") names.Add(name);
+                    if (next == 0) break;
+                    if (next > bufferSize - offset) throw new InvalidDataException("Invalid directory information offset");
+                    offset = checked(offset + (int)next);
+                }
+            }
+            return names.ToArray();
+        }
+        finally { Marshal.FreeHGlobal(buffer); }
+    }
+
+    public static int RenameRelative(SafeFileHandle source, SafeFileHandle parent, string destination, bool replaceIfExists)
+    {
+        byte[] name = Encoding.Unicode.GetBytes(destination);
+        int rootDirectoryOffset = IntPtr.Size;
+        int fileNameLengthOffset = rootDirectoryOffset + IntPtr.Size;
+        int fileNameOffset = fileNameLengthOffset + sizeof(uint);
+        int bufferSize = checked(fileNameOffset + name.Length + sizeof(char));
+        IntPtr buffer = Marshal.AllocHGlobal(bufferSize);
+        try
+        {
+            for (int index = 0; index < bufferSize; index++) Marshal.WriteByte(buffer, index, 0);
+            Marshal.WriteByte(buffer, 0, replaceIfExists ? (byte)1 : (byte)0);
+            Marshal.WriteIntPtr(buffer, rootDirectoryOffset, parent.DangerousGetHandle());
+            Marshal.WriteInt32(buffer, fileNameLengthOffset, name.Length);
+            Marshal.Copy(name, 0, IntPtr.Add(buffer, fileNameOffset), name.Length);
+            IO_STATUS_BLOCK statusBlock;
+            int status = NtSetInformationFile(source, out statusBlock, buffer, (uint)bufferSize, FileRenameInformation);
+            return status >= 0 ? 0 : unchecked((int)RtlNtStatusToDosError(status));
+        }
+        finally { Marshal.FreeHGlobal(buffer); }
+    }
+
+    public static int MarkDelete(SafeFileHandle handle)
+    {
+        IntPtr buffer = Marshal.AllocHGlobal(1);
+        try
+        {
+            Marshal.WriteByte(buffer, 1);
+            return SetFileInformationByHandle(handle, FileDispositionInfo, buffer, 1)
+                ? 0 : Marshal.GetLastWin32Error();
+        }
+        finally { Marshal.FreeHGlobal(buffer); }
+    }
+}
+'@
+}
+
+function Assert-CcodInstallLeafName {
+    param([Parameter(Mandatory)][string]$Leaf)
+    if ([string]::IsNullOrWhiteSpace($Leaf) -or $Leaf.Length -gt 160 -or
+        $Leaf -in @('.','..') -or $Leaf -notmatch '^[A-Za-z0-9._-]+$' -or
+        $Leaf.EndsWith('.') -or $Leaf.EndsWith(' ') -or
+        $Leaf -match '^(?i:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\.|$)') {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_LEAF_INVALID' 'Install transaction leaf must be one safe relative segment' $Leaf
+    }
+}
+
+function Get-CcodInstallHandleInfo {
+    param([Parameter(Mandatory)]$Pin)
+    $handle = if ($null -ne $Pin.Stream) { $Pin.Stream.SafeFileHandle } else { $Pin.Handle }
+    return [CcodInstallFileNative]::GetInfo($handle)
+}
+
+function Get-CcodInstallPinHandle {
+    param([Parameter(Mandatory)]$Pin)
+    if ($null -ne $Pin.Stream) { return $Pin.Stream.SafeFileHandle }
+    return $Pin.Handle
+}
+
+function Get-CcodInstallIdentity {
+    param([Parameter(Mandatory)]$Information)
+    return [pscustomobject]@{
+        VolumeSerialNumber = [uint32]$Information.VolumeSerialNumber
+        FileIndex = [uint64]$Information.FileIndex
+        Key = ('{0:x8}:{1:x16}' -f [uint32]$Information.VolumeSerialNumber,[uint64]$Information.FileIndex)
+    }
+}
+
+function Get-CcodInstallObjectKey {
+    param([Parameter(Mandatory)]$ParentDirectory, [Parameter(Mandatory)][string]$Leaf)
+    return $ParentDirectory.Identity.Key + '|' + $Leaf.ToLowerInvariant()
+}
+
+function Test-CcodInstallSameIdentity {
+    param($Expected, $Information)
+    return $null -ne $Expected -and
+        [uint32]$Expected.VolumeSerialNumber -eq [uint32]$Information.VolumeSerialNumber -and
+        [uint64]$Expected.FileIndex -eq [uint64]$Information.FileIndex
+}
+
+function Assert-CcodInstallTransaction {
+    param([Parameter(Mandatory)]$Transaction)
+    if ($null -eq $Transaction -or $Transaction.Kind -cne 'CcodInstallFileTransaction') {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install file transaction context is invalid' $null
+    }
+    if ($Transaction.Closed) {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' 'Install file transaction is already closed' $null
+    }
+}
+
+function Assert-CcodInstallPin {
+    param(
+        [Parameter(Mandatory)]$Transaction,
+        [Parameter(Mandatory)]$Pin,
+        [ValidateSet('Directory','File')][string]$Kind
+    )
+    Assert-CcodInstallTransaction $Transaction
+    if ($null -eq $Pin -or $Pin.TransactionId -cne $Transaction.Id -or $Pin.Closed -or
+        (-not [string]::IsNullOrWhiteSpace($Kind) -and $Pin.Kind -cne $Kind)) {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_INVALID' 'Install file pin is invalid for this transaction' $null
+    }
+    $handle = Get-CcodInstallPinHandle $Pin
+    if ($null -eq $handle -or $handle.IsInvalid -or $handle.IsClosed) {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_INVALID' 'Install file pin handle is closed or invalid' $null
+    }
+}
+
+function Assert-CcodInstallPinCurrent {
+    param(
+        [Parameter(Mandatory)]$Transaction,
+        [Parameter(Mandatory)]$Pin,
+        [ValidateSet('Directory','File')][string]$Kind
+    )
+    Assert-CcodInstallPin -Transaction $Transaction -Pin $Pin -Kind $Kind
+    try {
+        $information = Get-CcodInstallHandleInfo $Pin
+        $actualPath = [IO.Path]::GetFullPath([CcodInstallFileNative]::GetFinalPath((Get-CcodInstallPinHandle $Pin))).TrimEnd('\')
+    } catch {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' 'Install file pin can no longer prove its identity' $Pin.Leaf
+    }
+    $expectedPath = [IO.Path]::GetFullPath([string]$Pin.ExpectedPath).TrimEnd('\')
+    if (-not (Test-CcodInstallSameIdentity $Pin.Identity $information) -or
+        -not $actualPath.Equals($expectedPath, [StringComparison]::OrdinalIgnoreCase) -or
+        $information.IsReparsePoint -or
+        ($Kind -ceq 'Directory' -and -not $information.IsDirectory) -or
+        ($Kind -ceq 'File' -and $information.IsDirectory)) {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' 'Install file pin identity or final path changed' $Pin.Leaf
+    }
+    return $information
+}
+
+function Assert-CcodInstallPlainFile {
+    param([Parameter(Mandatory)]$Information, [Parameter(Mandatory)]$Handle, [Parameter(Mandatory)][string]$Target)
+    if ($Information.IsDirectory) {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_FILE_TYPE_INVALID' 'Install transaction expected a regular file' $Target
+    }
+    if ($Information.IsReparsePoint) {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' 'Install transaction rejects reparse leaves' $Target
+    }
+    if ([uint32]$Information.NumberOfLinks -ne 1) {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_MULTILINK_LEAF' 'Install transaction rejects multi-link leaves' $Target
+    }
+    try { $defaultStreamOnly = [CcodInstallFileNative]::HasOnlyDefaultDataStream($Handle) }
+    catch { Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' 'Install transaction could not prove the leaf stream inventory' $Target }
+    if (-not $defaultStreamOnly) {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' 'Install transaction rejects alternate data streams' $Target
+    }
+}
+
+function Close-CcodInstallPin {
+    param([Parameter(Mandatory)]$Pin)
+    if ($Pin.Closed) { return }
+    try {
+        if ($null -ne $Pin.Stream) { $Pin.Stream.Dispose() }
+        elseif ($null -ne $Pin.Handle) { $Pin.Handle.Dispose() }
+    } finally { $Pin.Closed = $true }
+}
+
+function Open-CcodInstallFileTransaction {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][string]$InstallRoot)
+
+    Initialize-CcodInstallFileNative
+    if (-not [IO.Path]::IsPathRooted($InstallRoot)) {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot
+    }
+    $rootPath = [IO.Path]::GetFullPath($InstallRoot).TrimEnd('\')
+    if (-not [IO.Directory]::Exists($rootPath)) {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_MISSING' 'Pinned install root must already exist' $rootPath
+    }
+    $handle = $null
+    try {
+        $handle = [CcodInstallFileNative]::OpenRootDirectory($rootPath)
+        $information = [CcodInstallFileNative]::GetInfo($handle)
+        $finalPath = [IO.Path]::GetFullPath([CcodInstallFileNative]::GetFinalPath($handle)).TrimEnd('\')
+        if (-not $information.IsDirectory -or $information.IsReparsePoint -or
+            -not $finalPath.Equals($rootPath, [StringComparison]::OrdinalIgnoreCase)) {
+            Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root is not one plain directory identity' $rootPath
+        }
+        $id = [guid]::NewGuid().ToString('D')
+        $rootPin = [pscustomobject]@{
+            Kind = 'Directory'; TransactionId = $id; Handle = $handle; Stream = $null
+            ParentDirectory = $null; Leaf = ''; ExpectedPath = $rootPath
+            Identity = Get-CcodInstallIdentity $information; Created = $false; Owned = $false; Closed = $false
+        }
+        $handle = $null
+        $pins = [Collections.Generic.List[object]]::new()
+        $pins.Add($rootPin)
+        return [pscustomobject]@{
+            Kind = 'CcodInstallFileTransaction'; Id = $id; InstallRoot = $rootPath; RootDirectory = $rootPin
+            Pins = $pins
+            Objects = [Collections.Generic.Dictionary[string,object]]::new([StringComparer]::OrdinalIgnoreCase)
+            OwnedObjects = [Collections.Generic.Dictionary[string,object]]::new([StringComparer]::OrdinalIgnoreCase)
+            LastSourceOpenAttempt = $null; Closed = $false; Disposition = $null
+        }
+    } catch {
+        if ($null -ne $handle) { $handle.Dispose() }
+        throw
+    }
+}
+
+function Open-CcodInstallPinnedDirectory {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)]$Transaction,
+        [Parameter(Mandatory)]$ParentDirectory,
+        [Parameter(Mandatory)][string]$Leaf,
+        [switch]$CreateIfMissing
+    )
+    Assert-CcodInstallLeafName $Leaf
+    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $ParentDirectory -Kind Directory)
+    $key = Get-CcodInstallObjectKey $ParentDirectory $Leaf
+    if ($Transaction.Objects.ContainsKey($key)) {
+        $existing = $Transaction.Objects[$key]
+        [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $existing -Kind Directory)
+        return $existing
+    }
+    $result = $null
+    try {
+        $result = [CcodInstallFileNative]::OpenDirectoryRelative($ParentDirectory.Handle, $Leaf, [bool]$CreateIfMissing)
+        $information = [CcodInstallFileNative]::GetInfo($result.Handle)
+        if (-not $information.IsDirectory) {
+            Throw-CcodInstallFileError 'CCOD_INSTALL_FILE_TYPE_INVALID' 'Pinned install child is not a directory' $Leaf
+        }
+        if ($information.IsReparsePoint) {
+            Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' 'Pinned install child is a reparse point' $Leaf
+        }
+        $expectedPath = Join-Path $ParentDirectory.ExpectedPath $Leaf
+        $finalPath = [IO.Path]::GetFullPath([CcodInstallFileNative]::GetFinalPath($result.Handle)).TrimEnd('\')
+        if (-not $finalPath.Equals([IO.Path]::GetFullPath($expectedPath).TrimEnd('\'), [StringComparison]::OrdinalIgnoreCase)) {
+            Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' 'Pinned install child final path is unexpected' $Leaf
+        }
+        $pin = [pscustomobject]@{
+            Kind = 'Directory'; TransactionId = $Transaction.Id; Handle = $result.Handle; Stream = $null
+            ParentDirectory = $ParentDirectory; Leaf = $Leaf; ExpectedPath = $expectedPath
+            Identity = Get-CcodInstallIdentity $information; Created = [bool]$result.Created; Owned = [bool]$result.Created; Closed = $false
+        }
+        $result = $null
+        $Transaction.Pins.Add($pin)
+        $Transaction.Objects.Add($key, $pin)
+        if ($pin.Owned) { $Transaction.OwnedObjects.Add($key, $pin) }
+        return $pin
+    } catch {
+        if ($null -ne $result) { $result.Handle.Dispose() }
+        throw
+    }
+}
+
+function New-CcodInstallPinnedTemporaryLeaf {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)]$Transaction,
+        [Parameter(Mandatory)]$ParentDirectory,
+        [Parameter(Mandatory)][string]$Leaf
+    )
+    Assert-CcodInstallLeafName $Leaf
+    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $ParentDirectory -Kind Directory)
+    $key = Get-CcodInstallObjectKey $ParentDirectory $Leaf
+    if ($Transaction.Objects.ContainsKey($key) -or $Transaction.OwnedObjects.ContainsKey($key)) {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_TEMPORARY_EXISTS' 'Temporary install leaf is already tracked' $Leaf
+    }
+    $result = $null
+    $stream = $null
+    try {
+        $result = [CcodInstallFileNative]::CreateTemporaryFileRelative($ParentDirectory.Handle, $Leaf)
+        if (-not $result.Created) { Throw-CcodInstallFileError 'CCOD_INSTALL_TEMPORARY_EXISTS' 'Temporary install leaf already exists' $Leaf }
+        $stream = [IO.FileStream]::new($result.Handle, [IO.FileAccess]::ReadWrite, 65536, $false)
+        $result = $null
+        $information = [CcodInstallFileNative]::GetInfo($stream.SafeFileHandle)
+        Assert-CcodInstallPlainFile -Information $information -Handle $stream.SafeFileHandle -Target $Leaf
+        $pin = [pscustomobject]@{
+            Kind = 'File'; TransactionId = $Transaction.Id; Handle = $null; Stream = $stream
+            ParentDirectory = $ParentDirectory; Leaf = $Leaf; ExpectedPath = (Join-Path $ParentDirectory.ExpectedPath $Leaf)
+            Identity = Get-CcodInstallIdentity $information; Created = $true; Owned = $true; Closed = $false
+            Sealed = $false; Length = [int64]0; Sha256 = $null
+        }
+        $stream = $null
+        $Transaction.Pins.Add($pin)
+        $Transaction.Objects.Add($key, $pin)
+        $Transaction.OwnedObjects.Add($key, $pin)
+        return $pin
+    } catch {
+        if ($null -ne $stream) { $stream.Dispose() }
+        if ($null -ne $result) { $result.Handle.Dispose() }
+        throw
+    }
+}
+
+function Get-CcodInstallStreamSha256 {
+    param([Parameter(Mandatory)][IO.FileStream]$Stream)
+    $position = $Stream.Position
+    $sha = [Security.Cryptography.SHA256]::Create()
+    try {
+        $Stream.Position = 0
+        return [BitConverter]::ToString($sha.ComputeHash($Stream)).Replace('-', '').ToLowerInvariant()
+    } finally {
+        $sha.Dispose()
+        $Stream.Position = $position
+    }
+}
+
+function Copy-CcodInstallSealedFile {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)]$Transaction,
+        [Parameter(Mandatory)][string]$SourcePath,
+        [Parameter(Mandatory)]$DestinationLeaf,
+        [Parameter(Mandatory)][ValidateRange(0,[int64]::MaxValue)][int64]$ExpectedLength,
+        [Parameter(Mandatory)][string]$ExpectedSha256
+    )
+    if (-not [IO.Path]::IsPathRooted($SourcePath) -or $ExpectedSha256 -cnotmatch '^[0-9a-f]{64}$') {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Sealed source contract is invalid' $SourcePath
+    }
+    $fullSource = [IO.Path]::GetFullPath($SourcePath)
+    $sourceTail = if ($fullSource.StartsWith('\\')) { $fullSource } else { $fullSource.Substring([IO.Path]::GetPathRoot($fullSource).Length) }
+    if ($sourceTail.Contains(':')) {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' 'Sealed source may not name an alternate data stream' $SourcePath
+    }
+    $destinationInformation = Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $DestinationLeaf -Kind File
+    Assert-CcodInstallPlainFile -Information $destinationInformation -Handle $DestinationLeaf.Stream.SafeFileHandle -Target $DestinationLeaf.Leaf
+    if (-not $DestinationLeaf.Owned -or $DestinationLeaf.ParentDirectory.TransactionId -cne $Transaction.Id) {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_INVALID' 'Sealed copy destination is not a transaction-owned leaf' $DestinationLeaf.Leaf
+    }
+
+    $sourceHandle = $null
+    $sourceStream = $null
+    try {
+        $sourceHandle = [CcodInstallFileNative]::OpenSourceFile($fullSource)
+        $sourceInformation = [CcodInstallFileNative]::GetInfo($sourceHandle)
+        Assert-CcodInstallPlainFile -Information $sourceInformation -Handle $sourceHandle -Target $fullSource
+        $finalSource = [IO.Path]::GetFullPath([CcodInstallFileNative]::GetFinalPath($sourceHandle))
+        if (-not $finalSource.Equals($fullSource, [StringComparison]::OrdinalIgnoreCase)) {
+            Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Sealed source final path is unexpected' $fullSource
+        }
+        if ($null -ne $script:CcodInstallFileTransactionAfterSourceOpen) {
+            $Transaction.LastSourceOpenAttempt = & $script:CcodInstallFileTransactionAfterSourceOpen $fullSource
+        }
+        $sourceStream = [IO.FileStream]::new($sourceHandle, [IO.FileAccess]::Read, 65536, $false)
+        $sourceHandle = $null
+        if ([int64]$sourceStream.Length -ne $ExpectedLength) {
+            Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_MISMATCH' 'Sealed source length does not match the contract' $fullSource
+        }
+        $sourceSha = Get-CcodInstallStreamSha256 $sourceStream
+        if ($sourceSha -cne $ExpectedSha256) {
+            Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_MISMATCH' 'Sealed source digest does not match the contract' $fullSource
+        }
+        $sourceStream.Position = 0
+        $DestinationLeaf.Stream.Position = 0
+        $DestinationLeaf.Stream.SetLength(0)
+        $sourceStream.CopyTo($DestinationLeaf.Stream, 65536)
+        $DestinationLeaf.Stream.Flush($true)
+        $destinationLength = [int64]$DestinationLeaf.Stream.Length
+        $destinationSha = Get-CcodInstallStreamSha256 $DestinationLeaf.Stream
+        if ($destinationLength -ne $ExpectedLength -or $destinationSha -cne $ExpectedSha256) {
+            Throw-CcodInstallFileError 'CCOD_INSTALL_DESTINATION_MISMATCH' 'Pinned destination bytes failed sealed readback' $DestinationLeaf.Leaf
+        }
+        $afterInformation = Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $DestinationLeaf -Kind File
+        if (-not (Test-CcodInstallSameIdentity $DestinationLeaf.Identity $afterInformation)) {
+            Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' 'Pinned destination identity changed during copy' $DestinationLeaf.Leaf
+        }
+        $DestinationLeaf.Sealed = $true
+        $DestinationLeaf.Length = $destinationLength
+        $DestinationLeaf.Sha256 = $destinationSha
+        return [pscustomobject]@{ Length = $destinationLength; Sha256 = $destinationSha }
+    } finally {
+        if ($null -ne $sourceStream) { $sourceStream.Dispose() }
+        elseif ($null -ne $sourceHandle) { $sourceHandle.Dispose() }
+    }
+}
+
+function Get-CcodInstallExistingPin {
+    param([Parameter(Mandatory)]$Transaction, [Parameter(Mandatory)]$ParentDirectory, [Parameter(Mandatory)][string]$Leaf)
+    $key = Get-CcodInstallObjectKey $ParentDirectory $Leaf
+    if ($Transaction.Objects.ContainsKey($key)) { return $Transaction.Objects[$key] }
+    return $null
+}
+
+function Commit-CcodInstallPinnedPromotion {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)]$Transaction,
+        [Parameter(Mandatory)]$ParentDirectory,
+        [Parameter(Mandatory)]$TemporaryLeaf,
+        [Parameter(Mandatory)][string]$DestinationLeaf
+    )
+    Assert-CcodInstallLeafName $DestinationLeaf
+    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $ParentDirectory -Kind Directory)
+    $temporaryInformation = Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $TemporaryLeaf -Kind File
+    Assert-CcodInstallPlainFile -Information $temporaryInformation -Handle $TemporaryLeaf.Stream.SafeFileHandle -Target $TemporaryLeaf.Leaf
+    if ($TemporaryLeaf.ParentDirectory.Identity.Key -cne $ParentDirectory.Identity.Key -or -not $TemporaryLeaf.Owned -or -not $TemporaryLeaf.Sealed) {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_PROMOTION_INVALID' 'Promotion requires a sealed owned leaf under the pinned parent' $TemporaryLeaf.Leaf
+    }
+    if ($TemporaryLeaf.Leaf.Equals($DestinationLeaf, [StringComparison]::OrdinalIgnoreCase)) { return $TemporaryLeaf }
+
+    $destinationKey = Get-CcodInstallObjectKey $ParentDirectory $DestinationLeaf
+    $existingPin = Get-CcodInstallExistingPin $Transaction $ParentDirectory $DestinationLeaf
+    $identityHandle = $null
+    $destinationExists = $false
+    try {
+        if ($null -ne $existingPin) {
+            $existingInformation = Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $existingPin -Kind File
+            Assert-CcodInstallPlainFile -Information $existingInformation -Handle (Get-CcodInstallPinHandle $existingPin) -Target $DestinationLeaf
+            $destinationExists = $true
+        } else {
+            try { $identityHandle = [CcodInstallFileNative]::OpenIdentityRelative($ParentDirectory.Handle, $DestinationLeaf) }
+            catch [ComponentModel.Win32Exception] {
+                if ($_.Exception.NativeErrorCode -notin @(2,3)) { throw }
+            }
+            if ($null -ne $identityHandle) {
+                $existingInformation = [CcodInstallFileNative]::GetInfo($identityHandle)
+                if ($existingInformation.IsReparsePoint) {
+                    Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' 'Promotion destination is a reparse leaf' $DestinationLeaf
+                }
+                Assert-CcodInstallPlainFile -Information $existingInformation -Handle $identityHandle -Target $DestinationLeaf
+                $destinationExists = $true
+            }
+        }
+    } finally {
+        if ($null -ne $identityHandle) { $identityHandle.Dispose() }
+    }
+
+    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $ParentDirectory -Kind Directory)
+    if ($null -ne $existingPin) {
+        Close-CcodInstallPin $existingPin
+        [void]$Transaction.Objects.Remove($destinationKey)
+        if ($Transaction.OwnedObjects.ContainsKey($destinationKey) -and $Transaction.OwnedObjects[$destinationKey] -eq $existingPin) {
+            [void]$Transaction.OwnedObjects.Remove($destinationKey)
+        }
+    }
+    $errorCode = [CcodInstallFileNative]::RenameRelative($TemporaryLeaf.Stream.SafeFileHandle, $ParentDirectory.Handle, $DestinationLeaf, $destinationExists)
+    if ($errorCode -ne 0) {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_PROMOTION_FAILED' "Pinned promotion failed with Windows error $errorCode" $DestinationLeaf
+    }
+
+    $temporaryKey = Get-CcodInstallObjectKey $ParentDirectory $TemporaryLeaf.Leaf
+    [void]$Transaction.Objects.Remove($temporaryKey)
+    [void]$Transaction.OwnedObjects.Remove($temporaryKey)
+    $TemporaryLeaf.Leaf = $DestinationLeaf
+    $TemporaryLeaf.ExpectedPath = Join-Path $ParentDirectory.ExpectedPath $DestinationLeaf
+    $Transaction.Objects[$destinationKey] = $TemporaryLeaf
+    $Transaction.OwnedObjects[$destinationKey] = $TemporaryLeaf
+    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $TemporaryLeaf -Kind File)
+    return $TemporaryLeaf
+}
+
+function Write-CcodInstallPinnedBytes {
+    param([Parameter(Mandatory)]$Pin, [Parameter(Mandatory)][byte[]]$Bytes)
+    $Pin.Stream.Position = 0
+    $Pin.Stream.SetLength(0)
+    $Pin.Stream.Write($Bytes, 0, $Bytes.Length)
+    $Pin.Stream.Flush($true)
+    $Pin.Length = [int64]$Bytes.LongLength
+    $Pin.Sha256 = Get-CcodInstallStreamSha256 $Pin.Stream
+    $Pin.Sealed = $true
+}
+
+function Write-CcodInstallPinnedJson {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)]$Transaction,
+        [Parameter(Mandatory)]$ParentDirectory,
+        [Parameter(Mandatory)][string]$Leaf,
+        [Parameter(Mandatory)]$Value,
+        [switch]$Compress
+    )
+    Assert-CcodInstallLeafName $Leaf
+    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $ParentDirectory -Kind Directory)
+    $json = ($Value | ConvertTo-Json -Depth 32 -Compress:$Compress) + "`n"
+    $bytes = [Text.UTF8Encoding]::new($false).GetBytes($json)
+    $prefix = ('.' + $Leaf + '.')
+    if ($prefix.Length -gt 100) { $prefix = '.json.' }
+    $temporaryName = $prefix + [guid]::NewGuid().ToString('N') + '.tmp'
+    $temporary = New-CcodInstallPinnedTemporaryLeaf -Transaction $Transaction -ParentDirectory $ParentDirectory -Leaf $temporaryName
+    Write-CcodInstallPinnedBytes -Pin $temporary -Bytes $bytes
+    return Commit-CcodInstallPinnedPromotion -Transaction $Transaction -ParentDirectory $ParentDirectory -TemporaryLeaf $temporary -DestinationLeaf $Leaf
+}
+
+function Test-CcodInstallSanitizedValue {
+    param($Value, [int]$Depth = 0)
+    if ($Depth -gt 8) { return $false }
+    if ($null -eq $Value) { return $true }
+    if ($Value -is [string]) { return $Value.Length -le 4096 }
+    if ($Value -is [bool] -or $Value -is [byte] -or $Value -is [sbyte] -or
+        $Value -is [int16] -or $Value -is [uint16] -or $Value -is [int32] -or $Value -is [uint32] -or
+        $Value -is [int64] -or $Value -is [uint64] -or $Value -is [single] -or $Value -is [double] -or $Value -is [decimal]) { return $true }
+    if ($Value -is [Collections.IDictionary]) {
+        foreach ($key in @($Value.Keys)) {
+            if ($key -isnot [string] -or $key -cnotmatch '^[A-Za-z0-9_.-]{1,96}$' -or
+                -not (Test-CcodInstallSanitizedValue -Value $Value[$key] -Depth ($Depth + 1))) { return $false }
+        }
+        return $true
+    }
+    if ($Value -is [pscustomobject]) {
+        foreach ($property in @($Value.PSObject.Properties)) {
+            if ($property.Name -cnotmatch '^[A-Za-z0-9_.-]{1,96}$' -or
+                -not (Test-CcodInstallSanitizedValue -Value $property.Value -Depth ($Depth + 1))) { return $false }
+        }
+        return $true
+    }
+    if ($Value -is [Collections.IList]) {
+        foreach ($entry in @($Value)) {
+            if (-not (Test-CcodInstallSanitizedValue -Value $entry -Depth ($Depth + 1))) { return $false }
+        }
+        return $true
+    }
+    return $false
+}
+
+function Append-CcodInstallPinnedLog {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)]$Transaction,
+        [Parameter(Mandatory)]$ParentDirectory,
+        [Parameter(Mandatory)][string]$Leaf,
+        [Parameter(Mandatory)]$Record
+    )
+    Assert-CcodInstallLeafName $Leaf
+    if (($Record -isnot [Collections.IDictionary] -and $Record -isnot [pscustomobject]) -or
+        -not (Test-CcodInstallSanitizedValue $Record)) {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_LOG_RECORD_INVALID' 'Install log record is not a bounded sanitized object' $null
+    }
+    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $ParentDirectory -Kind Directory)
+    $bytes = [Text.UTF8Encoding]::new($false).GetBytes(($Record | ConvertTo-Json -Depth 8 -Compress) + "`n")
+    if ($bytes.LongLength -gt 65536) {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_LOG_RECORD_INVALID' 'Install log record exceeds the bounded size' $null
+    }
+    $key = Get-CcodInstallObjectKey $ParentDirectory $Leaf
+    $pin = Get-CcodInstallExistingPin $Transaction $ParentDirectory $Leaf
+    if ($null -ne $pin) {
+        $information = Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $pin -Kind File
+        Assert-CcodInstallPlainFile -Information $information -Handle $pin.Stream.SafeFileHandle -Target $Leaf
+    } else {
+        $result = $null
+        $stream = $null
+        try {
+            $result = [CcodInstallFileNative]::OpenAppendFileRelative($ParentDirectory.Handle, $Leaf)
+            $stream = [IO.FileStream]::new($result.Handle, [IO.FileAccess]::ReadWrite, 65536, $false)
+            $created = [bool]$result.Created
+            $result = $null
+            $information = [CcodInstallFileNative]::GetInfo($stream.SafeFileHandle)
+            Assert-CcodInstallPlainFile -Information $information -Handle $stream.SafeFileHandle -Target $Leaf
+            $pin = [pscustomobject]@{
+                Kind = 'File'; TransactionId = $Transaction.Id; Handle = $null; Stream = $stream
+                ParentDirectory = $ParentDirectory; Leaf = $Leaf; ExpectedPath = (Join-Path $ParentDirectory.ExpectedPath $Leaf)
+                Identity = Get-CcodInstallIdentity $information; Created = $created; Owned = $created; Closed = $false
+                Sealed = $false; Length = [int64]$information.Length; Sha256 = $null
+            }
+            $stream = $null
+            $Transaction.Pins.Add($pin)
+            $Transaction.Objects.Add($key, $pin)
+            if ($pin.Owned) { $Transaction.OwnedObjects.Add($key, $pin) }
+        } catch {
+            if ($null -ne $stream) { $stream.Dispose() }
+            if ($null -ne $result) { $result.Handle.Dispose() }
+            throw
+        }
+    }
+    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $ParentDirectory -Kind Directory)
+    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $pin -Kind File)
+    $pin.Stream.Position = $pin.Stream.Length
+    $pin.Stream.Write($bytes, 0, $bytes.Length)
+    $pin.Stream.Flush($true)
+    $pin.Length = [int64]$pin.Stream.Length
+    return $pin
+}
+
+function Get-CcodInstallOwnedDeletionPlan {
+    param(
+        [Parameter(Mandatory)]$Transaction,
+        [Parameter(Mandatory)]$DirectoryPin,
+        [Parameter(Mandatory)][AllowEmptyCollection()][Collections.Generic.List[object]]$Plan
+    )
+    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $DirectoryPin -Kind Directory)
+    foreach ($name in [CcodInstallFileNative]::EnumerateDirectory($DirectoryPin.Handle)) {
+        Assert-CcodInstallLeafName $name
+        $key = Get-CcodInstallObjectKey $DirectoryPin $name
+        $pin = if ($Transaction.Objects.ContainsKey($key)) { $Transaction.Objects[$key] } else { $null }
+        if ($null -eq $pin) {
+            $probe = $null
+            try {
+                $probe = [CcodInstallFileNative]::OpenIdentityRelative($DirectoryPin.Handle, $name)
+                $probeInformation = [CcodInstallFileNative]::GetInfo($probe)
+                if ($probeInformation.IsReparsePoint) {
+                    Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' 'Owned-tree cleanup encountered a reparse leaf' $name
+                }
+                if (-not $probeInformation.IsDirectory) {
+                    Assert-CcodInstallPlainFile -Information $probeInformation -Handle $probe -Target $name
+                }
+                Throw-CcodInstallFileError 'CCOD_INSTALL_UNKNOWN_LEAF' 'Owned-tree cleanup encountered an unowned leaf' $name
+            } finally {
+                if ($null -ne $probe) { $probe.Dispose() }
+            }
+        }
+        if (-not $Transaction.OwnedObjects.ContainsKey($key) -or $Transaction.OwnedObjects[$key] -ne $pin) {
+            Throw-CcodInstallFileError 'CCOD_INSTALL_UNKNOWN_LEAF' 'Owned-tree cleanup encountered an unowned tracked leaf' $name
+        }
+        if ($pin.Kind -ceq 'Directory') {
+            [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $pin -Kind Directory)
+            Get-CcodInstallOwnedDeletionPlan -Transaction $Transaction -DirectoryPin $pin -Plan $Plan
+        } else {
+            $information = Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $pin -Kind File
+            Assert-CcodInstallPlainFile -Information $information -Handle $pin.Stream.SafeFileHandle -Target $name
+        }
+        $Plan.Add($pin)
+    }
+}
+
+function Remove-CcodInstallOwnedTree {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)]$Transaction,
+        [Parameter(Mandatory)]$ParentDirectory,
+        [Parameter(Mandatory)][string]$Leaf
+    )
+    Assert-CcodInstallLeafName $Leaf
+    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $ParentDirectory -Kind Directory)
+    $key = Get-CcodInstallObjectKey $ParentDirectory $Leaf
+    if (-not $Transaction.OwnedObjects.ContainsKey($key)) {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_UNKNOWN_LEAF' 'Owned-tree cleanup target is not transaction-owned' $Leaf
+    }
+    $target = $Transaction.OwnedObjects[$key]
+    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $target -Kind Directory)
+    $plan = [Collections.Generic.List[object]]::new()
+    Get-CcodInstallOwnedDeletionPlan -Transaction $Transaction -DirectoryPin $target -Plan $plan
+    $plan.Add($target)
+
+    foreach ($pin in $plan) {
+        $pinKey = if ($null -eq $pin.ParentDirectory) { $null } else { Get-CcodInstallObjectKey $pin.ParentDirectory $pin.Leaf }
+        $errorCode = [CcodInstallFileNative]::MarkDelete((Get-CcodInstallPinHandle $pin))
+        if ($errorCode -ne 0) {
+            Throw-CcodInstallFileError 'CCOD_INSTALL_DELETE_FAILED' "Owned-tree handle delete failed with Windows error $errorCode" $pin.Leaf
+        }
+        Close-CcodInstallPin $pin
+        if ($null -ne $pinKey) {
+            [void]$Transaction.Objects.Remove($pinKey)
+            [void]$Transaction.OwnedObjects.Remove($pinKey)
+        }
+    }
+}
+
+function Close-CcodInstallFileTransaction {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)]$Transaction,
+        [Parameter(Mandatory)][ValidateSet('Ready','Failed')][string]$Disposition
+    )
+    if ($null -eq $Transaction -or $Transaction.Kind -cne 'CcodInstallFileTransaction') {
+        Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install file transaction context is invalid' $null
+    }
+    if ($Transaction.Closed) { return $Transaction }
+    for ($index = $Transaction.Pins.Count - 1; $index -ge 0; $index--) {
+        Close-CcodInstallPin $Transaction.Pins[$index]
+    }
+    $Transaction.Disposition = $Disposition
+    $Transaction.Closed = $true
+    return $Transaction
+}
+
+Export-ModuleMember -Function @(
+    'Open-CcodInstallFileTransaction',
+    'Open-CcodInstallPinnedDirectory',
+    'New-CcodInstallPinnedTemporaryLeaf',
+    'Copy-CcodInstallSealedFile',
+    'Commit-CcodInstallPinnedPromotion',
+    'Write-CcodInstallPinnedJson',
+    'Append-CcodInstallPinnedLog',
+    'Remove-CcodInstallOwnedTree',
+    'Close-CcodInstallFileTransaction'
+)
diff --git a/tests/PersistenceSelfTest.ps1 b/tests/PersistenceSelfTest.ps1
index e6583a7..aafd8aa 100644
--- a/tests/PersistenceSelfTest.ps1
+++ b/tests/PersistenceSelfTest.ps1
@@ -14,6 +14,10 @@ if ($PSVersionTable.PSEdition -eq 'Desktop') {
 }
 
 $powershell = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+$requiredTransactionSelfTest = Join-Path $PSScriptRoot 'persistence\InstallFileTransaction.SelfTest.ps1'
+if (-not (Test-Path -LiteralPath $requiredTransactionSelfTest -PathType Leaf)) {
+    throw "Required install file transaction self-test is missing: $requiredTransactionSelfTest"
+}
 $tests = Get-ChildItem -LiteralPath (Join-Path $PSScriptRoot 'persistence') -Filter '*.SelfTest.ps1' | Sort-Object Name
 foreach ($test in $tests) {
     $previousErrorActionPreference = $ErrorActionPreference
diff --git a/tests/Validate.ps1 b/tests/Validate.ps1
index 497264b..d1533e2 100644
--- a/tests/Validate.ps1
+++ b/tests/Validate.ps1
@@ -129,6 +129,7 @@ foreach ($required in @(
     'src\persistence\UninstallBootstrap.ps1',
     'src\persistence\PortableUninstallFinalizer.ps1',
     'src\persistence\modules\InstallLifecycle.psm1',
+    'src\persistence\modules\InstallFileTransaction.psm1',
     'src\persistence\modules\PortableRelease.psm1',
     'src\persistence\modules\ScheduledTask.psm1',
     'src\persistence\modules\WorkerRuntime.psm1',
@@ -137,6 +138,7 @@ foreach ($required in @(
     'tests\persistence\Bootstrap.SelfTest.ps1',
     'tests\persistence\ScheduledTask.SelfTest.ps1',
     'tests\persistence\InstallLifecycle.SelfTest.ps1',
+    'tests\persistence\InstallFileTransaction.SelfTest.ps1',
     'tests\persistence\PortableRelease.SelfTest.ps1',
     'tests\persistence\UninstallBootstrap.SelfTest.ps1',
     'tests\persistence\InstalledLifecycleHarness.SelfTest.ps1',
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
new file mode 100644
index 0000000..26f07e1
--- /dev/null
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -0,0 +1,447 @@
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'TestSupport.ps1')
+
+$projectRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+$modulePath = Join-Path $projectRoot 'src\persistence\modules\InstallFileTransaction.psm1'
+$module = $null
+if (Test-Path -LiteralPath $modulePath -PathType Leaf) {
+    $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+}
+
+if ($null -eq ('CcodInstallTransactionTestNative' -as [type])) {
+    Add-Type -TypeDefinition @'
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+
+public static class CcodInstallTransactionTestNative
+{
+    private const uint FILE_LIST_DIRECTORY = 0x00000001;
+    private const uint FILE_READ_ATTRIBUTES = 0x00000080;
+    private const uint DELETE = 0x00010000;
+    private const uint GENERIC_READ = 0x80000000;
+    private const uint GENERIC_WRITE = 0x40000000;
+    private const uint FILE_SHARE_READ = 0x00000001;
+    private const uint FILE_SHARE_WRITE = 0x00000002;
+    private const uint FILE_SHARE_DELETE = 0x00000004;
+    private const uint OPEN_EXISTING = 3;
+    private const uint FILE_FLAG_BACKUP_SEMANTICS = 0x02000000;
+    private const uint FILE_FLAG_OPEN_REPARSE_POINT = 0x00200000;
+    private const uint FILE_FLAG_WRITE_THROUGH = 0x80000000;
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern SafeFileHandle CreateFileW(string path, uint access, uint share, IntPtr security,
+        uint creation, uint flags, IntPtr template);
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool CreateHardLinkW(string newName, string existingName, IntPtr securityAttributes);
+
+    public static int CreateHardLink(string newName, string existingName)
+    {
+        return CreateHardLinkW(newName, existingName, IntPtr.Zero) ? 0 : Marshal.GetLastWin32Error();
+    }
+
+    public static SafeFileHandle OpenDirectoryAllowDeleteShare(string path)
+    {
+        SafeFileHandle handle = CreateFileW(path, FILE_LIST_DIRECTORY | FILE_READ_ATTRIBUTES | DELETE,
+            FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, IntPtr.Zero, OPEN_EXISTING,
+            FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT, IntPtr.Zero);
+        if (handle.IsInvalid) throw new Win32Exception(Marshal.GetLastWin32Error());
+        return handle;
+    }
+
+    public static SafeFileHandle OpenFileAllowDeleteShare(string path)
+    {
+        SafeFileHandle handle = CreateFileW(path, GENERIC_READ | GENERIC_WRITE | DELETE | FILE_READ_ATTRIBUTES,
+            FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, IntPtr.Zero, OPEN_EXISTING,
+            FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_WRITE_THROUGH, IntPtr.Zero);
+        if (handle.IsInvalid) throw new Win32Exception(Marshal.GetLastWin32Error());
+        return handle;
+    }
+}
+'@
+}
+
+function Invoke-CcodInstallModule {
+    param([Parameter(Mandatory)][scriptblock]$Action, [object[]]$Arguments = @())
+    if ($null -eq $module) { return & $Action @Arguments }
+    return & $module $Action @Arguments
+}
+
+function New-CcodInstallFileFixture {
+    $base = Join-Path ([IO.Path]::GetTempPath()) ('ccod-install-file-' + [guid]::NewGuid().ToString('N'))
+    $outside = Join-Path ([IO.Path]::GetTempPath()) ('ccod-install-outside-' + [guid]::NewGuid().ToString('N'))
+    $install = Join-Path $base 'install'
+    [IO.Directory]::CreateDirectory($install) | Out-Null
+    [IO.Directory]::CreateDirectory($outside) | Out-Null
+    $sentinel = Join-Path $outside 'sentinel.txt'
+    $sentinelBytes = [Text.UTF8Encoding]::new($false).GetBytes('outside-sentinel-v1')
+    [IO.File]::WriteAllBytes($sentinel, $sentinelBytes)
+    return [pscustomobject]@{
+        Base = $base
+        MovedBase = $null
+        Install = $install
+        Outside = $outside
+        Sentinel = $sentinel
+        SentinelSha256 = Get-CcodTestFileSha256 -Path $sentinel
+        Transaction = $null
+    }
+}
+
+function Assert-CcodOutsideUnchanged {
+    param([Parameter(Mandatory)]$Fixture, [Parameter(Mandatory)][string]$Message)
+    Assert-CcodTrue ([IO.File]::Exists($Fixture.Sentinel)) "$Message sentinel exists"
+    Assert-CcodEqual $Fixture.SentinelSha256 (Get-CcodTestFileSha256 -Path $Fixture.Sentinel) "$Message sentinel bytes"
+}
+
+function Close-CcodFixtureTransaction {
+    param([Parameter(Mandatory)]$Fixture)
+    if ($null -eq $Fixture.Transaction) { return }
+    try {
+        Invoke-CcodInstallModule { param($Tx) Close-CcodInstallFileTransaction -Transaction $Tx -Disposition Failed } @($Fixture.Transaction) | Out-Null
+    } catch { }
+    $Fixture.Transaction = $null
+}
+
+function Remove-CcodInstallFileFixture {
+    param([Parameter(Mandatory)]$Fixture)
+    Close-CcodFixtureTransaction -Fixture $Fixture
+    $tempRoot = [IO.Path]::GetFullPath([IO.Path]::GetTempPath()).TrimEnd('\') + '\'
+    foreach ($candidate in @($Fixture.Base, $Fixture.MovedBase, $Fixture.Outside)) {
+        if ([string]::IsNullOrWhiteSpace([string]$candidate)) { continue }
+        $full = [IO.Path]::GetFullPath([string]$candidate)
+        if (-not $full.StartsWith($tempRoot, [StringComparison]::OrdinalIgnoreCase)) {
+            throw "Refusing to remove non-temporary fixture path: $full"
+        }
+        if (Test-Path -LiteralPath $full) { Remove-Item -LiteralPath $full -Recurse -Force }
+    }
+}
+
+function Open-CcodFixtureTransaction {
+    param([Parameter(Mandatory)]$Fixture)
+    $Fixture.Transaction = Invoke-CcodInstallModule { param($Install) Open-CcodInstallFileTransaction -InstallRoot $Install } @($Fixture.Install)
+    return $Fixture.Transaction
+}
+
+function Invoke-CcodAttemptDirectoryReplacement {
+    param([Parameter(Mandatory)][string]$Path)
+    $backup = $Path + '.attacker-old'
+    try {
+        [IO.Directory]::Move($Path, $backup)
+        return [pscustomobject]@{ Outcome = 'replaced'; Backup = $backup }
+    } catch [IO.IOException] {
+        return [pscustomobject]@{ Outcome = 'blocked'; Backup = $null }
+    } catch [UnauthorizedAccessException] {
+        return [pscustomobject]@{ Outcome = 'blocked'; Backup = $null }
+    }
+}
+
+function Invoke-CcodAttemptFileReplacement {
+    param([Parameter(Mandatory)][string]$Path)
+    $backup = $Path + '.attacker-old'
+    try {
+        [IO.File]::Move($Path, $backup)
+        return [pscustomobject]@{ Outcome = 'replaced'; Backup = $backup }
+    } catch [IO.IOException] {
+        return [pscustomobject]@{ Outcome = 'blocked'; Backup = $null }
+    } catch [UnauthorizedAccessException] {
+        return [pscustomobject]@{ Outcome = 'blocked'; Backup = $null }
+    }
+}
+
+function Invoke-CcodReplacePinnedDirectory {
+    param(
+        [Parameter(Mandatory)]$Fixture,
+        [Parameter(Mandatory)]$Transaction,
+        [Parameter(Mandatory)]$DirectoryPin
+    )
+    $renamedLeaf = $DirectoryPin.Leaf + '.attacker-old'
+    # The production pin intentionally denies delete sharing. Reopen only inside
+    # this fault-injection helper so the independent final-path guard is tested.
+    $descendantPrefix = [IO.Path]::GetFullPath($DirectoryPin.ExpectedPath).TrimEnd('\') + '\'
+    $descendants = @($Transaction.Pins | Where-Object {
+        -not $_.Closed -and $_.Kind -ceq 'File' -and
+        [IO.Path]::GetFullPath([string]$_.ExpectedPath).StartsWith($descendantPrefix, [StringComparison]::OrdinalIgnoreCase)
+    })
+    foreach ($pin in $descendants) { $pin.Stream.Dispose() }
+    $DirectoryPin.Handle.Dispose()
+    $DirectoryPin.Handle = [CcodInstallTransactionTestNative]::OpenDirectoryAllowDeleteShare($DirectoryPin.ExpectedPath)
+    $moved = Join-Path $DirectoryPin.ParentDirectory.ExpectedPath $renamedLeaf
+    $renameError = Invoke-CcodInstallModule {
+        param($Pin,$RenamedLeaf)
+        [CcodInstallFileNative]::RenameRelative($Pin.Handle, $Pin.ParentDirectory.Handle, $RenamedLeaf, $false)
+    } @($DirectoryPin,$renamedLeaf)
+    if ($renameError -ne 0) { throw "Could not rename fault-injection directory: Windows error $renameError" }
+    foreach ($pin in $descendants) {
+        $relative = [IO.Path]::GetFullPath([string]$pin.ExpectedPath).Substring($descendantPrefix.Length)
+        $fileHandle = [CcodInstallTransactionTestNative]::OpenFileAllowDeleteShare((Join-Path $moved $relative))
+        $pin.Stream = [IO.FileStream]::new($fileHandle, [IO.FileAccess]::ReadWrite, 65536, $false)
+    }
+    $result = & cmd.exe /d /c mklink /J $DirectoryPin.ExpectedPath $Fixture.Outside 2>&1
+    if ($LASTEXITCODE -ne 0) { throw "Could not create replacement junction: $result" }
+    return [pscustomobject]@{ Outcome = 'replaced'; MovedDirectory = $moved }
+}
+
+function New-CcodHardLink {
+    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$Existing)
+    $errorCode = [CcodInstallTransactionTestNative]::CreateHardLink($Path, $Existing)
+    if ($errorCode -ne 0) { throw "CreateHardLink failed with Windows error $errorCode" }
+}
+
+function New-CcodJunction {
+    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$Target)
+    $result = & cmd.exe /d /c mklink /J $Path $Target 2>&1
+    if ($LASTEXITCODE -ne 0) { throw "Could not create junction: $result" }
+}
+
+function New-CcodSourceFile {
+    param([Parameter(Mandatory)]$Fixture, [string]$Name = 'source.bin', [string]$Content = 'sealed-source-v1')
+    $path = Join-Path $Fixture.Base $Name
+    $bytes = [Text.UTF8Encoding]::new($false).GetBytes($Content)
+    [IO.File]::WriteAllBytes($path, $bytes)
+    return [pscustomobject]@{ Path = $path; Length = [int64]$bytes.LongLength; Sha256 = Get-CcodTestFileSha256 -Path $path }
+}
+
+Invoke-CcodTest 'pins a newly created child directory against pathname replacement' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $tx = Open-CcodFixtureTransaction $fixture
+        $child = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'runtime' -CreateIfMissing } @($tx)
+        $result = Invoke-CcodAttemptDirectoryReplacement -Path (Join-Path $fixture.Install 'runtime')
+        Assert-CcodEqual 'blocked' $result.Outcome 'pinned missing directory cannot be replaced after creation'
+        Assert-CcodOutsideUnchanged $fixture 'directory replacement'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
+Invoke-CcodTest 'pins a temporary leaf against replacement before promotion' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $tx = Open-CcodFixtureTransaction $fixture
+        $runtime = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'runtime' -CreateIfMissing } @($tx)
+        $temporary = Invoke-CcodInstallModule { param($Tx,$Parent) New-CcodInstallPinnedTemporaryLeaf -Transaction $Tx -ParentDirectory $Parent -Leaf 'payload.tmp' } @($tx,$runtime)
+        $result = Invoke-CcodAttemptFileReplacement -Path (Join-Path $fixture.Install 'runtime\payload.tmp')
+        Assert-CcodEqual 'blocked' $result.Outcome 'temporary leaf replacement is blocked while pinned'
+        Assert-CcodOutsideUnchanged $fixture 'temporary replacement'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
+Invoke-CcodTest 'pins sealed source bytes while copying and verifies the destination handle' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $source = New-CcodSourceFile $fixture
+        $tx = Open-CcodFixtureTransaction $fixture
+        $runtime = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'runtime' -CreateIfMissing } @($tx)
+        $temporary = Invoke-CcodInstallModule { param($Tx,$Parent) New-CcodInstallPinnedTemporaryLeaf -Transaction $Tx -ParentDirectory $Parent -Leaf 'payload.tmp' } @($tx,$runtime)
+        $hook = {
+            param($OpenedSource)
+            try {
+                [IO.File]::Move($OpenedSource, ($OpenedSource + '.attacker-old'))
+                return [pscustomobject]@{ Outcome = 'replaced' }
+            } catch [IO.IOException] {
+                return [pscustomobject]@{ Outcome = 'blocked' }
+            } catch [UnauthorizedAccessException] {
+                return [pscustomobject]@{ Outcome = 'blocked' }
+            }
+        }
+        Invoke-CcodInstallModule { param($Hook) $script:CcodInstallFileTransactionAfterSourceOpen = $Hook } @($hook) | Out-Null
+        try {
+            $copy = Invoke-CcodInstallModule {
+                param($Tx,$Source,$Leaf,$Length,$Sha)
+                Copy-CcodInstallSealedFile -Transaction $Tx -SourcePath $Source -DestinationLeaf $Leaf -ExpectedLength $Length -ExpectedSha256 $Sha
+            } @($tx,$source.Path,$temporary,$source.Length,$source.Sha256)
+        } finally {
+            Invoke-CcodInstallModule { $script:CcodInstallFileTransactionAfterSourceOpen = $null } | Out-Null
+        }
+        Assert-CcodEqual 'blocked' $tx.LastSourceOpenAttempt.Outcome 'source replacement is blocked after its read handle opens'
+        Assert-CcodEqual $source.Length $copy.Length 'copied length is sealed'
+        Assert-CcodEqual $source.Sha256 $copy.Sha256 'copied digest is sealed'
+        Assert-CcodOutsideUnchanged $fixture 'source replacement'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
+Invoke-CcodTest 'rejects reparse ADS and multi-link leaf inputs' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        New-CcodJunction -Path (Join-Path $fixture.Install 'linked') -Target $fixture.Outside
+        $tx = Open-CcodFixtureTransaction $fixture
+        Assert-CcodThrows {
+            Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'linked' } @($tx) | Out-Null
+        } 'CCOD_INSTALL_REPARSE_LEAF'
+        Assert-CcodThrows {
+            Invoke-CcodInstallModule { param($Tx) New-CcodInstallPinnedTemporaryLeaf -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'payload.tmp:ads' } @($tx) | Out-Null
+        } 'CCOD_INSTALL_LEAF_INVALID'
+
+        $source = New-CcodSourceFile $fixture
+        New-CcodHardLink -Path (Join-Path $fixture.Base 'source-hardlink.bin') -Existing $source.Path
+        $temporary = Invoke-CcodInstallModule { param($Tx) New-CcodInstallPinnedTemporaryLeaf -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'payload.tmp' } @($tx)
+        Assert-CcodThrows {
+            Invoke-CcodInstallModule {
+                param($Tx,$Source,$Leaf,$Length,$Sha)
+                Copy-CcodInstallSealedFile -Transaction $Tx -SourcePath $Source -DestinationLeaf $Leaf -ExpectedLength $Length -ExpectedSha256 $Sha
+            } @($tx,$source.Path,$temporary,$source.Length,$source.Sha256) | Out-Null
+        } 'CCOD_INSTALL_MULTILINK_LEAF'
+        Assert-CcodTrue ([IO.File]::Exists((Join-Path $fixture.Install 'payload.tmp'))) 'rejected multi-link source retains the owned temporary candidate'
+        Assert-CcodOutsideUnchanged $fixture 'invalid leaves'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
+Invoke-CcodTest 'rejects an ADS-bearing promotion destination and retains the temporary leaf' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $destination = Join-Path $fixture.Install 'active.json'
+        [IO.File]::WriteAllText($destination, 'old')
+        $adsResult = & cmd.exe /d /c "echo attacker>`"$destination`:metadata`"" 2>&1
+        if ($LASTEXITCODE -ne 0) { throw "Could not create alternate data stream: $adsResult" }
+        $source = New-CcodSourceFile $fixture
+        $tx = Open-CcodFixtureTransaction $fixture
+        $temporary = Invoke-CcodInstallModule { param($Tx) New-CcodInstallPinnedTemporaryLeaf -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'active.tmp' } @($tx)
+        Invoke-CcodInstallModule {
+            param($Tx,$Source,$Leaf,$Length,$Sha)
+            Copy-CcodInstallSealedFile -Transaction $Tx -SourcePath $Source -DestinationLeaf $Leaf -ExpectedLength $Length -ExpectedSha256 $Sha | Out-Null
+        } @($tx,$source.Path,$temporary,$source.Length,$source.Sha256)
+        Assert-CcodThrows {
+            Invoke-CcodInstallModule { param($Tx,$Leaf) Commit-CcodInstallPinnedPromotion -Transaction $Tx -ParentDirectory $Tx.RootDirectory -TemporaryLeaf $Leaf -DestinationLeaf 'active.json' } @($tx,$temporary) | Out-Null
+        } 'CCOD_INSTALL_ADS_LEAF'
+        Assert-CcodTrue ([IO.File]::Exists((Join-Path $fixture.Install 'active.tmp'))) 'failed ADS promotion retains the temporary candidate'
+        Assert-CcodOutsideUnchanged $fixture 'ADS destination'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
+Invoke-CcodTest 'rejects promotion after an ancestor rename changes the pinned parent path' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $source = New-CcodSourceFile $fixture
+        $tx = Open-CcodFixtureTransaction $fixture
+        $runtime = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'runtime' -CreateIfMissing } @($tx)
+        $temporary = Invoke-CcodInstallModule { param($Tx,$Parent) New-CcodInstallPinnedTemporaryLeaf -Transaction $Tx -ParentDirectory $Parent -Leaf 'payload.tmp' } @($tx,$runtime)
+        Invoke-CcodInstallModule {
+            param($Tx,$Source,$Leaf,$Length,$Sha)
+            Copy-CcodInstallSealedFile -Transaction $Tx -SourcePath $Source -DestinationLeaf $Leaf -ExpectedLength $Length -ExpectedSha256 $Sha | Out-Null
+        } @($tx,$source.Path,$temporary,$source.Length,$source.Sha256)
+        $attack = Invoke-CcodReplacePinnedDirectory -Fixture $fixture -Transaction $tx -DirectoryPin $runtime
+        Assert-CcodEqual 'replaced' $attack.Outcome 'fixture ancestor replacement is established'
+        Assert-CcodThrows {
+            Invoke-CcodInstallModule { param($Tx,$Parent,$Leaf) Commit-CcodInstallPinnedPromotion -Transaction $Tx -ParentDirectory $Parent -TemporaryLeaf $Leaf -DestinationLeaf 'payload.bin' } @($tx,$runtime,$temporary) | Out-Null
+        } 'CCOD_INSTALL_PIN_CHANGED'
+        Assert-CcodTrue ([IO.File]::Exists((Join-Path $attack.MovedDirectory 'payload.tmp'))) 'renamed-parent promotion retains its temporary candidate'
+        Assert-CcodOutsideUnchanged $fixture 'renamed parent promotion'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
+foreach ($case in @('unknown','reparse','multilink')) {
+    Invoke-CcodTest "retains an owned tree containing an unproven $case leaf" {
+        $fixture = New-CcodInstallFileFixture
+        try {
+            $tx = Open-CcodFixtureTransaction $fixture
+            $candidate = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'candidate' -CreateIfMissing } @($tx)
+            switch ($case) {
+                'unknown' { [IO.File]::WriteAllText((Join-Path $fixture.Install 'candidate\surprise.bin'), 'unknown') }
+                'reparse' { New-CcodJunction -Path (Join-Path $fixture.Install 'candidate\outside-link') -Target $fixture.Outside }
+                'multilink' {
+                    $owned = Invoke-CcodInstallModule { param($Tx,$Parent) New-CcodInstallPinnedTemporaryLeaf -Transaction $Tx -ParentDirectory $Parent -Leaf 'owned.tmp' } @($tx,$candidate)
+                    New-CcodHardLink -Path (Join-Path $fixture.Outside 'owned-hardlink.tmp') -Existing (Join-Path $fixture.Install 'candidate\owned.tmp')
+                }
+            }
+            $expected = switch ($case) {
+                'unknown' { 'CCOD_INSTALL_UNKNOWN_LEAF' }
+                'reparse' { 'CCOD_INSTALL_REPARSE_LEAF' }
+                'multilink' { 'CCOD_INSTALL_MULTILINK_LEAF' }
+            }
+            Assert-CcodThrows {
+                Invoke-CcodInstallModule { param($Tx) Remove-CcodInstallOwnedTree -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'candidate' } @($tx) | Out-Null
+            } $expected
+            Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $fixture.Install 'candidate'))) "failed $case cleanup retains the candidate directory"
+            Assert-CcodOutsideUnchanged $fixture "$case cleanup"
+        } finally { Remove-CcodInstallFileFixture $fixture }
+    }
+}
+
+Invoke-CcodTest 'deletes a fully proven transaction-owned tree from leaves upward' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $source = New-CcodSourceFile $fixture
+        $tx = Open-CcodFixtureTransaction $fixture
+        $candidate = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'candidate' -CreateIfMissing } @($tx)
+        $temporary = Invoke-CcodInstallModule { param($Tx,$Parent) New-CcodInstallPinnedTemporaryLeaf -Transaction $Tx -ParentDirectory $Parent -Leaf 'payload.tmp' } @($tx,$candidate)
+        Invoke-CcodInstallModule {
+            param($Tx,$Source,$Leaf,$Length,$Sha)
+            Copy-CcodInstallSealedFile -Transaction $Tx -SourcePath $Source -DestinationLeaf $Leaf -ExpectedLength $Length -ExpectedSha256 $Sha | Out-Null
+            Commit-CcodInstallPinnedPromotion -Transaction $Tx -ParentDirectory $Leaf.ParentDirectory -TemporaryLeaf $Leaf -DestinationLeaf 'payload.bin' | Out-Null
+        } @($tx,$source.Path,$temporary,$source.Length,$source.Sha256)
+        Invoke-CcodInstallModule { param($Tx) Remove-CcodInstallOwnedTree -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'candidate' } @($tx) | Out-Null
+        Assert-CcodTrue (-not [IO.Directory]::Exists((Join-Path $fixture.Install 'candidate'))) 'proven owned tree is removed'
+        Assert-CcodOutsideUnchanged $fixture 'owned tree removal'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
+foreach ($case in @('json','log')) {
+    Invoke-CcodTest "rejects a pinned $case write after parent pathname replacement" {
+        $fixture = New-CcodInstallFileFixture
+        try {
+            $tx = Open-CcodFixtureTransaction $fixture
+            $parent = Invoke-CcodInstallModule { param($Tx,$Leaf) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf $Leaf -CreateIfMissing } @($tx,$case)
+            $attack = Invoke-CcodReplacePinnedDirectory -Fixture $fixture -Transaction $tx -DirectoryPin $parent
+            Assert-CcodEqual 'replaced' $attack.Outcome "$case fixture replacement is established"
+            if ($case -ceq 'json') {
+                Assert-CcodThrows {
+                    Invoke-CcodInstallModule { param($Tx,$Parent) Write-CcodInstallPinnedJson -Transaction $Tx -ParentDirectory $Parent -Leaf 'state.json' -Value ([ordered]@{ schemaVersion = 1; value = 'safe' }) -Compress } @($tx,$parent)
+                } 'CCOD_INSTALL_PIN_CHANGED'
+                Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $fixture.Outside 'state.json'))) 'replaced JSON path is untouched'
+            } else {
+                Assert-CcodThrows {
+                    Invoke-CcodInstallModule { param($Tx,$Parent) Append-CcodInstallPinnedLog -Transaction $Tx -ParentDirectory $Parent -Leaf 'install.log' -Record ([ordered]@{ event = 'safe'; code = 'CCOD_TEST' }) } @($tx,$parent)
+                } 'CCOD_INSTALL_PIN_CHANGED'
+                Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $fixture.Outside 'install.log'))) 'replaced log path is untouched'
+            }
+            Assert-CcodOutsideUnchanged $fixture "replaced $case parent"
+        } finally { Remove-CcodInstallFileFixture $fixture }
+    }
+}
+
+Invoke-CcodTest 'writes pinned JSON and appends sanitized records through relative handles' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $tx = Open-CcodFixtureTransaction $fixture
+        $state = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'state' -CreateIfMissing } @($tx)
+        $logs = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'logs' -CreateIfMissing } @($tx)
+        Invoke-CcodInstallModule { param($Tx,$Parent) Write-CcodInstallPinnedJson -Transaction $Tx -ParentDirectory $Parent -Leaf 'active.json' -Value ([ordered]@{ schemaVersion = 1; active = 'runtime-a' }) -Compress } @($tx,$state) | Out-Null
+        Invoke-CcodInstallModule { param($Tx,$Parent) Write-CcodInstallPinnedJson -Transaction $Tx -ParentDirectory $Parent -Leaf 'active.json' -Value ([ordered]@{ schemaVersion = 1; active = 'runtime-b' }) -Compress } @($tx,$state) | Out-Null
+        Invoke-CcodInstallModule { param($Tx,$Parent) Append-CcodInstallPinnedLog -Transaction $Tx -ParentDirectory $Parent -Leaf 'install.log' -Record ([ordered]@{ event = 'one'; code = 'CCOD_OK' }) } @($tx,$logs) | Out-Null
+        Invoke-CcodInstallModule { param($Tx,$Parent) Append-CcodInstallPinnedLog -Transaction $Tx -ParentDirectory $Parent -Leaf 'install.log' -Record ([ordered]@{ event = 'two'; code = 'CCOD_READY' }) } @($tx,$logs) | Out-Null
+        Invoke-CcodInstallModule { param($Tx) Close-CcodInstallFileTransaction -Transaction $Tx -Disposition Ready } @($tx) | Out-Null
+        $fixture.Transaction = $null
+
+        $json = [IO.File]::ReadAllText((Join-Path $fixture.Install 'state\active.json'), [Text.UTF8Encoding]::new($false)) | ConvertFrom-Json
+        Assert-CcodEqual 'runtime-b' $json.active 'second pinned JSON write atomically replaces the first'
+        $records = @([IO.File]::ReadAllLines((Join-Path $fixture.Install 'logs\install.log'), [Text.UTF8Encoding]::new($false)))
+        Assert-CcodEqual 2 $records.Count 'pinned log appends one JSON line per record'
+        Assert-CcodEqual 'one' (($records[0] | ConvertFrom-Json).event) 'first log record is retained'
+        Assert-CcodEqual 'two' (($records[1] | ConvertFrom-Json).event) 'second log record is appended'
+        Assert-CcodOutsideUnchanged $fixture 'successful pinned writers'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
+Invoke-CcodTest 'exports only the private transaction surface and closes on a terminal disposition' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $expectedExports = @(
+            'Append-CcodInstallPinnedLog','Close-CcodInstallFileTransaction','Commit-CcodInstallPinnedPromotion',
+            'Copy-CcodInstallSealedFile','New-CcodInstallPinnedTemporaryLeaf','Open-CcodInstallFileTransaction',
+            'Open-CcodInstallPinnedDirectory','Remove-CcodInstallOwnedTree','Write-CcodInstallPinnedJson'
+        )
+        $actualExports = @($module.ExportedFunctions.Keys | Sort-Object)
+        Assert-CcodEqual ($expectedExports -join ',') ($actualExports -join ',') 'module exports only the approved private transaction surface'
+        $tx = Open-CcodFixtureTransaction $fixture
+        Invoke-CcodInstallModule { param($Tx) Close-CcodInstallFileTransaction -Transaction $Tx -Disposition Ready } @($tx) | Out-Null
+        $fixture.Transaction = $null
+        Assert-CcodEqual 'Ready' $tx.Disposition 'close records the terminal disposition'
+        Assert-CcodTrue $tx.Closed 'close marks the context closed'
+        Assert-CcodThrows {
+            Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'after-close' -CreateIfMissing } @($tx) | Out-Null
+        } 'CCOD_INSTALL_TRANSACTION_CLOSED'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
+Write-Host 'Install file transaction self-test passed.' -ForegroundColor Green

From a431dfb26027b901e956ad90d26180f23aa83a8f Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sat, 29 Aug 2026 09:40:55 +0800
Subject: [PATCH 066/187] fix: harden pinned install transaction capabilities

---
 .../modules/InstallFileTransaction.psm1       | 1182 +++--------------
 .../InstallFileTransaction.SelfTest.ps1       |  327 ++++-
 2 files changed, 457 insertions(+), 1052 deletions(-)

diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index 7b1ebbc..f625e50 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -1,1018 +1,230 @@
 Set-StrictMode -Version Latest
 
-$script:CcodInstallFileTransactionAfterSourceOpen = $null
+$script:CcodTransactions = [Runtime.CompilerServices.ConditionalWeakTable[object,object]]::new()
+$script:CcodPins = [Runtime.CompilerServices.ConditionalWeakTable[object,object]]::new()
 
 function Throw-CcodInstallFileError {
-    param(
-        [Parameter(Mandatory)][string]$Id,
-        [Parameter(Mandatory)][string]$Message,
-        $Target
-    )
-    throw [Management.Automation.ErrorRecord]::new(
-        [InvalidOperationException]::new($Message),
-        $Id,
-        [Management.Automation.ErrorCategory]::InvalidData,
-        $Target
-    )
+    param([string]$Id,[string]$Message,$Target)
+    throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new($Message),$Id,[Management.Automation.ErrorCategory]::InvalidData,$Target)
 }
 
-function Initialize-CcodInstallFileNative {
-    if ($null -ne ('CcodInstallFileNative' -as [type])) { return }
-    Add-Type -TypeDefinition @'
+function Initialize-CcodInstallRuntime {
+    if ($null -eq ('CcodInstallCapabilityMarker' -as [type])) {
+        Add-Type -TypeDefinition @'
 using System;
 using System.Collections.Generic;
 using System.ComponentModel;
 using System.IO;
 using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+using System.Security.Cryptography;
 using System.Text;
 using Microsoft.Win32.SafeHandles;
 
-public static class CcodInstallFileNative
+public sealed class CcodInstallCapabilityMarker { private CcodInstallCapabilityMarker() {} public static int CapabilityAbi { get { return 1; } } }
+
+internal sealed class CcodInstallRuntime : IDisposable
 {
-    private const uint FILE_LIST_DIRECTORY = 0x00000001;
-    private const uint FILE_READ_ATTRIBUTES = 0x00000080;
-    private const uint DELETE = 0x00010000;
-    private const uint SYNCHRONIZE = 0x00100000;
-    private const uint GENERIC_READ = 0x80000000;
-    private const uint GENERIC_WRITE = 0x40000000;
-    private const uint FILE_SHARE_READ = 0x00000001;
-    private const uint FILE_SHARE_WRITE = 0x00000002;
-    private const uint FILE_SHARE_DELETE = 0x00000004;
-    private const uint FILE_OPEN = 0x00000001;
-    private const uint FILE_CREATE = 0x00000002;
-    private const uint FILE_OPEN_IF = 0x00000003;
-    private const uint FILE_DIRECTORY_FILE = 0x00000001;
-    private const uint FILE_WRITE_THROUGH = 0x00000002;
-    private const uint FILE_SYNCHRONOUS_IO_NONALERT = 0x00000020;
-    private const uint FILE_NON_DIRECTORY_FILE = 0x00000040;
-    private const uint FILE_OPEN_FOR_BACKUP_INTENT = 0x00004000;
-    private const uint FILE_OPEN_REPARSE_POINT = 0x00200000;
-    private const uint FILE_FLAG_BACKUP_SEMANTICS = 0x02000000;
-    private const uint FILE_FLAG_OPEN_REPARSE_POINT = 0x00200000;
-    private const uint FILE_FLAG_WRITE_THROUGH = 0x80000000;
-    private const uint OPEN_EXISTING = 3;
-    private const uint OBJ_CASE_INSENSITIVE = 0x00000040;
-    private const uint FILE_ATTRIBUTE_DIRECTORY = 0x00000010;
-    private const uint FILE_ATTRIBUTE_REPARSE_POINT = 0x00000400;
-    private const int FileRenameInformation = 10;
-    private const int FileDispositionInfo = 4;
-    private const int FileStreamInfo = 7;
-    private const int FileDirectoryInformation = 1;
+    private const uint READ = 0x80000000, WRITE = 0x40000000, DELETE = 0x00010000, SYNC = 0x00100000;
+    private const uint READ_ATTRIBUTES = 0x80, LIST_DIRECTORY = 0x1, ADD_FILE = 0x2, ADD_SUBDIRECTORY = 0x4;
+    private const uint SHARE_READ = 1, SHARE_WRITE = 2, SHARE_DELETE = 4;
+    private const uint OPEN = 1, CREATE = 2, OPEN_IF = 3;
+    private const uint DIRECTORY = 1, WRITE_THROUGH = 2, SYNC_IO = 0x20, NON_DIRECTORY = 0x40, BACKUP_INTENT = 0x4000, OPEN_REPARSE = 0x200000;
+    private const uint FLAG_BACKUP = 0x02000000, FLAG_REPARSE = 0x00200000, FLAG_WRITE_THROUGH = 0x80000000;
+    private const uint OPEN_EXISTING = 3, OBJ_CASE_INSENSITIVE = 0x40, ATTR_DIRECTORY = 0x10, ATTR_REPARSE = 0x400;
+    private const int FileRenameInformation = 10, FileDispositionInformation = 13, FileStreamInfo = 7, FileDirectoryInformation = 1;
     private const int STATUS_NO_MORE_FILES = unchecked((int)0x80000006);
 
-    [StructLayout(LayoutKind.Sequential)]
-    private struct UNICODE_STRING
-    {
-        public ushort Length;
-        public ushort MaximumLength;
-        public IntPtr Buffer;
-    }
-
-    [StructLayout(LayoutKind.Sequential)]
-    private struct OBJECT_ATTRIBUTES
-    {
-        public int Length;
-        public IntPtr RootDirectory;
-        public IntPtr ObjectName;
-        public uint Attributes;
-        public IntPtr SecurityDescriptor;
-        public IntPtr SecurityQualityOfService;
-    }
-
-    [StructLayout(LayoutKind.Sequential)]
-    private struct IO_STATUS_BLOCK
-    {
-        public IntPtr Status;
-        public UIntPtr Information;
-    }
-
-    [StructLayout(LayoutKind.Sequential)]
-    internal struct FILETIME_NATIVE
-    {
-        public uint Low;
-        public uint High;
-    }
-
-    [StructLayout(LayoutKind.Sequential)]
-    internal struct BY_HANDLE_FILE_INFORMATION
-    {
-        public uint FileAttributes;
-        public FILETIME_NATIVE CreationTime;
-        public FILETIME_NATIVE LastAccessTime;
-        public FILETIME_NATIVE LastWriteTime;
-        public uint VolumeSerialNumber;
-        public uint FileSizeHigh;
-        public uint FileSizeLow;
-        public uint NumberOfLinks;
-        public uint FileIndexHigh;
-        public uint FileIndexLow;
-    }
-
-    public sealed class OpenResult
-    {
-        public SafeFileHandle Handle { get; private set; }
-        public bool Created { get; private set; }
-        public OpenResult(SafeFileHandle handle, bool created) { Handle = handle; Created = created; }
-    }
-
-    public sealed class HandleInfo
-    {
-        public uint Attributes { get; private set; }
-        public uint NumberOfLinks { get; private set; }
-        public uint VolumeSerialNumber { get; private set; }
-        public ulong FileIndex { get; private set; }
-        public long Length { get; private set; }
-        public bool IsDirectory { get { return (Attributes & FILE_ATTRIBUTE_DIRECTORY) != 0; } }
-        public bool IsReparsePoint { get { return (Attributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0; } }
-
-        internal HandleInfo(BY_HANDLE_FILE_INFORMATION value)
-        {
-            Attributes = value.FileAttributes;
-            NumberOfLinks = value.NumberOfLinks;
-            VolumeSerialNumber = value.VolumeSerialNumber;
-            FileIndex = ((ulong)value.FileIndexHigh << 32) | value.FileIndexLow;
-            Length = ((long)value.FileSizeHigh << 32) | value.FileSizeLow;
-        }
-    }
-
-    public sealed class DirectoryEntry
-    {
-        public string Name { get; private set; }
-        public uint Attributes { get; private set; }
-        public DirectoryEntry(string name, uint attributes) { Name = name; Attributes = attributes; }
-    }
-
-    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
-    private static extern SafeFileHandle CreateFileW(string path, uint access, uint share, IntPtr security,
-        uint creation, uint flags, IntPtr template);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static extern bool GetFileInformationByHandle(SafeFileHandle handle, out BY_HANDLE_FILE_INFORMATION information);
-
-    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
-    private static extern uint GetFinalPathNameByHandleW(SafeFileHandle handle, StringBuilder path, uint length, uint flags);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static extern bool GetFileInformationByHandleEx(SafeFileHandle handle, int informationClass, IntPtr information, uint size);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static extern bool SetFileInformationByHandle(SafeFileHandle handle, int informationClass, IntPtr information, uint size);
-
-    [DllImport("ntdll.dll")]
-    private static extern int NtCreateFile(out IntPtr fileHandle, uint desiredAccess,
-        ref OBJECT_ATTRIBUTES objectAttributes, out IO_STATUS_BLOCK ioStatusBlock, IntPtr allocationSize,
-        uint fileAttributes, uint shareAccess, uint createDisposition, uint createOptions,
-        IntPtr eaBuffer, uint eaLength);
-
-    [DllImport("ntdll.dll")]
-    private static extern int NtQueryDirectoryFile(SafeFileHandle fileHandle, IntPtr eventHandle, IntPtr apcRoutine,
-        IntPtr apcContext, out IO_STATUS_BLOCK ioStatusBlock, IntPtr fileInformation, uint length,
-        int fileInformationClass, [MarshalAs(UnmanagedType.Bool)] bool returnSingleEntry,
-        IntPtr fileName, [MarshalAs(UnmanagedType.Bool)] bool restartScan);
-
-    [DllImport("ntdll.dll")]
-    private static extern int NtSetInformationFile(SafeFileHandle fileHandle, out IO_STATUS_BLOCK ioStatusBlock,
-        IntPtr fileInformation, uint length, int fileInformationClass);
-
-    [DllImport("ntdll.dll")]
-    private static extern uint RtlNtStatusToDosError(int status);
-
-    private static void ThrowStatus(int status)
-    {
-        throw new Win32Exception(unchecked((int)RtlNtStatusToDosError(status)));
-    }
-
-    private static OpenResult OpenRelative(SafeFileHandle parent, string name, uint access, uint share,
-        uint disposition, uint options)
-    {
-        if (parent == null || parent.IsInvalid || parent.IsClosed) throw new ArgumentException("Parent pin is invalid", "parent");
-        IntPtr nameBuffer = IntPtr.Zero;
-        IntPtr unicodePointer = IntPtr.Zero;
-        try
-        {
-            nameBuffer = Marshal.StringToHGlobalUni(name);
-            UNICODE_STRING unicode = new UNICODE_STRING();
-            unicode.Length = checked((ushort)(name.Length * 2));
-            unicode.MaximumLength = checked((ushort)((name.Length + 1) * 2));
-            unicode.Buffer = nameBuffer;
-            unicodePointer = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(UNICODE_STRING)));
-            Marshal.StructureToPtr(unicode, unicodePointer, false);
-            OBJECT_ATTRIBUTES attributes = new OBJECT_ATTRIBUTES();
-            attributes.Length = Marshal.SizeOf(typeof(OBJECT_ATTRIBUTES));
-            attributes.RootDirectory = parent.DangerousGetHandle();
-            attributes.ObjectName = unicodePointer;
-            attributes.Attributes = OBJ_CASE_INSENSITIVE;
-            IO_STATUS_BLOCK statusBlock;
-            IntPtr rawHandle;
-            int status = NtCreateFile(out rawHandle, access, ref attributes, out statusBlock, IntPtr.Zero,
-                0, share, disposition, options | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_REPARSE_POINT,
-                IntPtr.Zero, 0);
-            if (status < 0 || rawHandle == IntPtr.Zero || rawHandle == new IntPtr(-1)) ThrowStatus(status);
-            return new OpenResult(new SafeFileHandle(rawHandle, true), statusBlock.Information.ToUInt64() == 2UL);
-        }
-        finally
-        {
-            if (unicodePointer != IntPtr.Zero) Marshal.FreeHGlobal(unicodePointer);
-            if (nameBuffer != IntPtr.Zero) Marshal.FreeHGlobal(nameBuffer);
-        }
-    }
-
-    public static SafeFileHandle OpenRootDirectory(string path)
-    {
-        SafeFileHandle handle = CreateFileW(path, FILE_LIST_DIRECTORY | FILE_READ_ATTRIBUTES | SYNCHRONIZE,
-            FILE_SHARE_READ | FILE_SHARE_WRITE, IntPtr.Zero, OPEN_EXISTING,
-            FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT, IntPtr.Zero);
-        if (handle.IsInvalid) throw new Win32Exception(Marshal.GetLastWin32Error());
-        return handle;
-    }
-
-    public static OpenResult OpenDirectoryRelative(SafeFileHandle parent, string name, bool createIfMissing)
-    {
-        return OpenRelative(parent, name, FILE_LIST_DIRECTORY | FILE_READ_ATTRIBUTES | DELETE | SYNCHRONIZE,
-            FILE_SHARE_READ | FILE_SHARE_WRITE, createIfMissing ? FILE_OPEN_IF : FILE_OPEN,
-            FILE_DIRECTORY_FILE | FILE_OPEN_FOR_BACKUP_INTENT);
-    }
-
-    public static OpenResult CreateTemporaryFileRelative(SafeFileHandle parent, string name)
-    {
-        return OpenRelative(parent, name, GENERIC_READ | GENERIC_WRITE | DELETE | SYNCHRONIZE,
-            FILE_SHARE_READ, FILE_CREATE, FILE_NON_DIRECTORY_FILE | FILE_WRITE_THROUGH);
-    }
-
-    public static OpenResult OpenAppendFileRelative(SafeFileHandle parent, string name)
-    {
-        return OpenRelative(parent, name, GENERIC_READ | GENERIC_WRITE | DELETE | SYNCHRONIZE,
-            FILE_SHARE_READ, FILE_OPEN_IF, FILE_NON_DIRECTORY_FILE | FILE_WRITE_THROUGH);
-    }
-
-    public static SafeFileHandle OpenIdentityRelative(SafeFileHandle parent, string name)
-    {
-        return OpenRelative(parent, name, FILE_READ_ATTRIBUTES | SYNCHRONIZE,
-            FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN, FILE_OPEN_FOR_BACKUP_INTENT).Handle;
-    }
-
-    public static SafeFileHandle OpenSourceFile(string path)
-    {
-        SafeFileHandle handle = CreateFileW(path, GENERIC_READ | FILE_READ_ATTRIBUTES | SYNCHRONIZE,
-            FILE_SHARE_READ, IntPtr.Zero, OPEN_EXISTING, FILE_FLAG_OPEN_REPARSE_POINT, IntPtr.Zero);
-        if (handle.IsInvalid) throw new Win32Exception(Marshal.GetLastWin32Error());
-        return handle;
-    }
-
-    public static HandleInfo GetInfo(SafeFileHandle handle)
-    {
-        BY_HANDLE_FILE_INFORMATION information;
-        if (!GetFileInformationByHandle(handle, out information)) throw new Win32Exception(Marshal.GetLastWin32Error());
-        return new HandleInfo(information);
-    }
-
-    public static string GetFinalPath(SafeFileHandle handle)
-    {
-        StringBuilder path = new StringBuilder(512);
-        uint length = GetFinalPathNameByHandleW(handle, path, (uint)path.Capacity, 0);
-        if (length == 0) throw new Win32Exception(Marshal.GetLastWin32Error());
-        if (length >= path.Capacity)
-        {
-            path.Capacity = checked((int)length + 1);
-            length = GetFinalPathNameByHandleW(handle, path, (uint)path.Capacity, 0);
-            if (length == 0 || length >= path.Capacity) throw new Win32Exception(Marshal.GetLastWin32Error());
-        }
-        string value = path.ToString();
-        if (value.StartsWith(@"\\?\UNC\", StringComparison.OrdinalIgnoreCase)) return @"\\" + value.Substring(8);
-        if (value.StartsWith(@"\\?\", StringComparison.OrdinalIgnoreCase)) return value.Substring(4);
-        return value;
-    }
-
-    public static bool HasOnlyDefaultDataStream(SafeFileHandle handle)
-    {
-        const int bufferSize = 65536;
-        IntPtr buffer = Marshal.AllocHGlobal(bufferSize);
-        try
-        {
-            if (!GetFileInformationByHandleEx(handle, FileStreamInfo, buffer, bufferSize))
-                throw new Win32Exception(Marshal.GetLastWin32Error());
-            int offset = 0;
-            int count = 0;
-            while (true)
-            {
-                uint next = unchecked((uint)Marshal.ReadInt32(buffer, offset));
-                uint nameLength = unchecked((uint)Marshal.ReadInt32(buffer, offset + 4));
-                if (nameLength > bufferSize - offset - 24) throw new InvalidDataException("Invalid stream information");
-                string name = Marshal.PtrToStringUni(IntPtr.Add(buffer, offset + 24), checked((int)nameLength / 2));
-                count++;
-                if (!String.Equals(name, "::$DATA", StringComparison.OrdinalIgnoreCase)) return false;
-                if (next == 0) break;
-                if (next > bufferSize - offset) throw new InvalidDataException("Invalid stream information offset");
-                offset = checked(offset + (int)next);
-            }
-            return count == 1;
-        }
-        finally { Marshal.FreeHGlobal(buffer); }
-    }
-
-    public static string[] EnumerateDirectory(SafeFileHandle directory)
-    {
-        const int bufferSize = 65536;
-        IntPtr buffer = Marshal.AllocHGlobal(bufferSize);
-        List<string> names = new List<string>();
-        bool restart = true;
-        try
-        {
-            while (true)
-            {
-                IO_STATUS_BLOCK statusBlock;
-                int status = NtQueryDirectoryFile(directory, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero,
-                    out statusBlock, buffer, bufferSize, FileDirectoryInformation, false, IntPtr.Zero, restart);
-                restart = false;
-                if (status == STATUS_NO_MORE_FILES) break;
-                if (status < 0) ThrowStatus(status);
-                int offset = 0;
-                while (true)
-                {
-                    uint next = unchecked((uint)Marshal.ReadInt32(buffer, offset));
-                    uint nameLength = unchecked((uint)Marshal.ReadInt32(buffer, offset + 60));
-                    if (nameLength > bufferSize - offset - 64) throw new InvalidDataException("Invalid directory information");
-                    string name = Marshal.PtrToStringUni(IntPtr.Add(buffer, offset + 64), checked((int)nameLength / 2));
-                    if (name != "." && name != "..") names.Add(name);
-                    if (next == 0) break;
-                    if (next > bufferSize - offset) throw new InvalidDataException("Invalid directory information offset");
-                    offset = checked(offset + (int)next);
-                }
-            }
-            return names.ToArray();
-        }
-        finally { Marshal.FreeHGlobal(buffer); }
-    }
-
-    public static int RenameRelative(SafeFileHandle source, SafeFileHandle parent, string destination, bool replaceIfExists)
-    {
-        byte[] name = Encoding.Unicode.GetBytes(destination);
-        int rootDirectoryOffset = IntPtr.Size;
-        int fileNameLengthOffset = rootDirectoryOffset + IntPtr.Size;
-        int fileNameOffset = fileNameLengthOffset + sizeof(uint);
-        int bufferSize = checked(fileNameOffset + name.Length + sizeof(char));
-        IntPtr buffer = Marshal.AllocHGlobal(bufferSize);
-        try
-        {
-            for (int index = 0; index < bufferSize; index++) Marshal.WriteByte(buffer, index, 0);
-            Marshal.WriteByte(buffer, 0, replaceIfExists ? (byte)1 : (byte)0);
-            Marshal.WriteIntPtr(buffer, rootDirectoryOffset, parent.DangerousGetHandle());
-            Marshal.WriteInt32(buffer, fileNameLengthOffset, name.Length);
-            Marshal.Copy(name, 0, IntPtr.Add(buffer, fileNameOffset), name.Length);
-            IO_STATUS_BLOCK statusBlock;
-            int status = NtSetInformationFile(source, out statusBlock, buffer, (uint)bufferSize, FileRenameInformation);
-            return status >= 0 ? 0 : unchecked((int)RtlNtStatusToDosError(status));
-        }
-        finally { Marshal.FreeHGlobal(buffer); }
-    }
-
-    public static int MarkDelete(SafeFileHandle handle)
-    {
-        IntPtr buffer = Marshal.AllocHGlobal(1);
-        try
-        {
-            Marshal.WriteByte(buffer, 1);
-            return SetFileInformationByHandle(handle, FileDispositionInfo, buffer, 1)
-                ? 0 : Marshal.GetLastWin32Error();
-        }
-        finally { Marshal.FreeHGlobal(buffer); }
-    }
+    [StructLayout(LayoutKind.Sequential)] private struct UNICODE_STRING { public ushort Length, MaximumLength; public IntPtr Buffer; }
+    [StructLayout(LayoutKind.Sequential)] private struct OBJECT_ATTRIBUTES { public int Length; public IntPtr RootDirectory, ObjectName; public uint Attributes; public IntPtr SecurityDescriptor, SecurityQualityOfService; }
+    [StructLayout(LayoutKind.Sequential)] private struct IO_STATUS_BLOCK { public IntPtr Status; public UIntPtr Information; }
+    [StructLayout(LayoutKind.Sequential)] private struct FILETIME_NATIVE { public uint Low, High; }
+    [StructLayout(LayoutKind.Sequential)] private struct FILE_INFO
+    {
+        public uint FileAttributes; public FILETIME_NATIVE CreationTime, LastAccessTime, LastWriteTime;
+        public uint VolumeSerialNumber, FileSizeHigh, FileSizeLow, NumberOfLinks, FileIndexHigh, FileIndexLow;
+    }
+
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] private static extern SafeFileHandle CreateFileW(string p,uint a,uint s,IntPtr sec,uint c,uint f,IntPtr t);
+    [DllImport("kernel32.dll", SetLastError=true)] private static extern bool GetFileInformationByHandle(SafeFileHandle h,out FILE_INFO i);
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] private static extern uint GetFinalPathNameByHandleW(SafeFileHandle h,StringBuilder b,uint l,uint f);
+    [DllImport("kernel32.dll", SetLastError=true)] private static extern bool GetFileInformationByHandleEx(SafeFileHandle h,int c,IntPtr i,uint s);
+    [DllImport("ntdll.dll")] private static extern int NtCreateFile(out IntPtr h,uint a,ref OBJECT_ATTRIBUTES o,out IO_STATUS_BLOCK i,IntPtr z,uint fa,uint sh,uint d,uint op,IntPtr e,uint el);
+    [DllImport("ntdll.dll")] private static extern int NtQueryDirectoryFile(SafeFileHandle h,IntPtr e,IntPtr a,IntPtr c,out IO_STATUS_BLOCK i,IntPtr f,uint l,int cl,bool one,IntPtr n,bool restart);
+    [DllImport("ntdll.dll")] private static extern int NtSetInformationFile(SafeFileHandle h,out IO_STATUS_BLOCK i,IntPtr f,uint l,int cl);
+    [DllImport("ntdll.dll")] private static extern uint RtlNtStatusToDosError(int s);
+
+    private sealed class Pin : IDisposable
+    {
+        internal readonly object Token = new object(); internal readonly Pin Parent; internal string Leaf, Path;
+        internal readonly bool Directory, Owned; internal SafeFileHandle Handle; internal FileStream Stream;
+        internal readonly uint Volume; internal readonly ulong Index; internal bool Closed, Sealed; internal long SealedLength; internal string SealedSha;
+        internal Pin(Pin parent,string leaf,string path,bool dir,bool owned,SafeFileHandle handle,FileStream stream,FILE_INFO info)
+        { Parent=parent;Leaf=leaf;Path=path;Directory=dir;Owned=owned;Handle=handle;Stream=stream;Volume=info.VolumeSerialNumber;Index=((ulong)info.FileIndexHigh<<32)|info.FileIndexLow; }
+        internal SafeFileHandle Native { get { return Stream != null ? Stream.SafeFileHandle : Handle; } }
+        public void Dispose() { if(Closed)return; Closed=true; if(Stream!=null)Stream.Dispose(); else if(Handle!=null)Handle.Dispose(); }
+    }
+
+    private readonly string rootPath; private readonly Pin root;
+    private readonly Dictionary<object,Pin> pins = new Dictionary<object,Pin>(ReferenceEqualityComparer.Instance);
+    private readonly Dictionary<string,Pin> names = new Dictionary<string,Pin>(StringComparer.OrdinalIgnoreCase);
+    private bool disposed;
+
+    private sealed class ReferenceEqualityComparer : IEqualityComparer<object>
+    { internal static readonly ReferenceEqualityComparer Instance=new ReferenceEqualityComparer(); public new bool Equals(object x,object y){return Object.ReferenceEquals(x,y);} public int GetHashCode(object x){return System.Runtime.CompilerServices.RuntimeHelpers.GetHashCode(x);} }
+
+    private CcodInstallRuntime(string path,Pin rootPin) { rootPath=path;root=rootPin;pins.Add(root.Token,root); }
+    internal static object Open(string path,out CcodInstallRuntime runtime)
+    {
+        runtime=null; string full=Path.GetFullPath(path).TrimEnd('\\');
+        SafeFileHandle h=CreateFileW(full,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,IntPtr.Zero,OPEN_EXISTING,FLAG_BACKUP|FLAG_REPARSE,IntPtr.Zero);
+        if(h.IsInvalid)throw new Win32Exception(Marshal.GetLastWin32Error());
+        try { FILE_INFO i=Info(h); if(!IsDirectory(i)||(i.FileAttributes&ATTR_REPARSE)!=0||!SamePath(FinalPath(h),full))throw new InvalidDataException("root invalid");if(!OnlyDefaultStream(h))throw new InvalidDataException("alternate stream");
+            Pin p=new Pin(null,"",full,true,false,h,null,i); h=null; runtime=new CcodInstallRuntime(full,p); return p.Token; }
+        finally { if(h!=null)h.Dispose(); }
+    }
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object OpenDirectory(object parentToken,string leaf,bool create)
+    {
+        Pin parent=Require(parentToken,true); ValidateCurrent(parent); string key=Key(parent,leaf); Pin known; if(names.TryGetValue(key,out known)){ValidateCurrent(known);return known.Token;}
+        OpenResult r=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ|SHARE_WRITE,create?OPEN_IF:OPEN,DIRECTORY|BACKUP_INTENT);
+        try { FILE_INFO i=Info(r.Handle); if(!IsDirectory(i)||(i.FileAttributes&ATTR_REPARSE)!=0||!OnlyDefaultStream(r.Handle))throw new InvalidDataException("directory invalid");
+            string path=Path.Combine(parent.Path,leaf); if(!SamePath(FinalPath(r.Handle),path))throw new InvalidDataException("path changed");
+            Pin p=new Pin(parent,leaf,path,true,r.Created,r.Handle,null,i); r.Handle=null;AddPin(key,p);return p.Token; }
+        finally { if(r.Handle!=null)r.Handle.Dispose(); }
+    }
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object CreateTemporary(object parentToken,string leaf)
+    {
+        Pin parent=Require(parentToken,true);ValidateCurrent(parent);string key=Key(parent,leaf);if(names.ContainsKey(key))throw new IOException("exists");
+        OpenResult r=OpenRelative(parent.Native,leaf,READ|WRITE|DELETE|SYNC,SHARE_READ,CREATE,NON_DIRECTORY|WRITE_THROUGH);
+        FileStream s=null;try{s=new FileStream(r.Handle,FileAccess.ReadWrite,65536,false);r.Handle=null;FILE_INFO i=Info(s.SafeFileHandle);ValidatePlain(i,s.SafeFileHandle);Pin p=new Pin(parent,leaf,Path.Combine(parent.Path,leaf),false,true,null,s,i);s=null;AddPin(key,p);return p.Token;}
+        finally{if(s!=null)s.Dispose();if(r.Handle!=null)r.Handle.Dispose();}
+    }
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object Copy(object destinationToken,string source,long expectedLength,string expectedSha)
+    {
+        Pin d=Require(destinationToken,false);ValidateCurrent(d);if(!d.Owned)throw new InvalidDataException("destination not owned");
+        string full=Path.GetFullPath(source); SafeFileHandle sh=CreateFileW(full,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,IntPtr.Zero,OPEN_EXISTING,FLAG_REPARSE,IntPtr.Zero);if(sh.IsInvalid)throw new Win32Exception(Marshal.GetLastWin32Error());
+        try{FILE_INFO si=Info(sh);ValidatePlain(si,sh);if(!SamePath(FinalPath(sh),full))throw new InvalidDataException("source path");using(FileStream ss=new FileStream(sh,FileAccess.Read,65536,false)){sh=null;if(ss.Length!=expectedLength||Sha(ss)!=expectedSha)throw new InvalidDataException("source mismatch");ss.Position=0;d.Stream.Position=0;d.Stream.SetLength(0);ss.CopyTo(d.Stream);d.Stream.Flush(true);string actual=Sha(d.Stream);if(d.Stream.Length!=expectedLength||actual!=expectedSha)throw new InvalidDataException("destination mismatch");d.Sealed=true;d.SealedLength=expectedLength;d.SealedSha=expectedSha;}}finally{if(sh!=null)sh.Dispose();}
+        return d.Token;
+    }
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object Promote(object parentToken,object tempToken,string destination)
+    {
+        Pin parent=Require(parentToken,true),temp=Require(tempToken,false);ValidateCurrent(parent);ValidateCurrent(temp);
+        if(temp.Parent!=parent||!temp.Owned||!temp.Sealed)throw new InvalidDataException("promotion invalid");
+        if(temp.Stream.Length!=temp.SealedLength||Sha(temp.Stream)!=temp.SealedSha)throw new CryptographicException("seal mismatch");
+        SafeFileHandle existing=null;try{try{existing=OpenRelative(parent.Native,destination,READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,BACKUP_INTENT).Handle;}catch(Win32Exception x){if(x.NativeErrorCode!=2&&x.NativeErrorCode!=3)throw;}if(existing!=null)throw new IOException("destination exists");}
+        finally{if(existing!=null)existing.Dispose();}
+        int ec=Rename(temp.Native,parent.Native,destination);if(ec==80||ec==183)throw new IOException("destination exists");if(ec!=0)throw new Win32Exception(ec);names.Remove(Key(parent,temp.Leaf));temp.Leaf=destination;temp.Path=Path.Combine(parent.Path,destination);names.Add(Key(parent,destination),temp);ValidateCurrent(temp);return temp.Token;
+    }
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object WriteJson(object parentToken,string leaf,byte[] bytes)
+    { Pin parent=Require(parentToken,true);ValidateCurrent(parent);object t=CreateTemporary(parentToken,".json."+Guid.NewGuid().ToString("N")+".tmp");Pin p=Require(t,false);Write(p,bytes);p.Sealed=true;p.SealedLength=bytes.LongLength;p.SealedSha=Sha(p.Stream);return Promote(parentToken,t,leaf); }
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object Append(object parentToken,string leaf,byte[] bytes)
+    {
+        Pin parent=Require(parentToken,true);ValidateCurrent(parent);string key=Key(parent,leaf);Pin p;
+        if(!names.TryGetValue(key,out p)){OpenResult r=OpenRelative(parent.Native,leaf,READ|WRITE|DELETE|SYNC,SHARE_READ,OPEN_IF,NON_DIRECTORY|WRITE_THROUGH);FileStream s=null;try{s=new FileStream(r.Handle,FileAccess.ReadWrite,65536,false);r.Handle=null;FILE_INFO i=Info(s.SafeFileHandle);ValidatePlain(i,s.SafeFileHandle);p=new Pin(parent,leaf,Path.Combine(parent.Path,leaf),false,r.Created,null,s,i);s=null;AddPin(key,p);}finally{if(s!=null)s.Dispose();if(r.Handle!=null)r.Handle.Dispose();}}
+        ValidateCurrent(p);p.Stream.Position=p.Stream.Length;p.Stream.Write(bytes,0,bytes.Length);p.Stream.Flush(true);return p.Token;
+    }
+    [MethodImpl(MethodImplOptions.Synchronized)] internal void RemoveOwnedTree(object parentToken,string leaf)
+    {
+        Pin parent=Require(parentToken,true);ValidateCurrent(parent);Pin target;string key=Key(parent,leaf);if(!names.TryGetValue(key,out target)||!target.Owned||!target.Directory)throw new InvalidDataException("unknown target");
+        List<Pin> plan=new List<Pin>();BuildPlan(target,plan);RevalidatePlan(target,plan);List<Pin> marked=new List<Pin>();
+        string originalLeaf=target.Leaf,originalPath=target.Path,tombstone=".__ccod_delete_"+Guid.NewGuid().ToString("N");bool quarantined=false,released=false;
+        try{ReleaseDescendants(plan);released=true;int rec=Rename(target.Native,parent.Native,tombstone);if(rec!=0)throw new Win32Exception(rec);MoveDirectoryPin(target,tombstone,Path.Combine(parent.Path,tombstone));quarantined=true;released=false;ReopenKnownTree(target);plan.Clear();BuildPlan(target,plan);RevalidatePlan(target,plan);foreach(Pin p in plan){if(p.Directory)continue;ValidateCurrent(p);int ec=SetDelete(p.Native,true);if(ec!=0)throw new Win32Exception(ec);marked.Add(p);ValidateMarkedFile(p);}RevalidateMarkedNamespace(target,new HashSet<Pin>(marked));}
+        catch{for(int i=marked.Count-1;i>=0;i--)SetDelete(marked[i].Native,false);if(!released){ReleaseDescendants(plan);released=true;}if(quarantined){int back=Rename(target.Native,parent.Native,originalLeaf);if(back!=0)throw new Win32Exception(back);MoveDirectoryPin(target,originalLeaf,originalPath);quarantined=false;}ReopenKnownTree(target);throw;}
+        foreach(Pin p in marked)RemovePin(p);
+        foreach(Pin p in plan){if(!p.Directory)continue;ValidateCurrent(p);int ec=SetDelete(p.Native,true);if(ec!=0)throw new Win32Exception(ec);RemovePin(p);}
+        ValidateCurrent(target);int tec=SetDelete(target.Native,true);if(tec!=0)throw new Win32Exception(tec);RemovePin(target);
+    }
+    [MethodImpl(MethodImplOptions.Synchronized)] internal void Close(){if(disposed)return;disposed=true;List<Pin> all=new List<Pin>(pins.Values);for(int i=all.Count-1;i>=0;i--)all[i].Dispose();pins.Clear();names.Clear();}
+    public void Dispose(){Close();}
+
+    private void BuildPlan(Pin dir,List<Pin> plan){ValidateCurrent(dir);foreach(string n in Enumerate(dir.Native)){Pin p;string k=Key(dir,n);if(!names.TryGetValue(k,out p)||!p.Owned){ProbeUnknown(dir,n);throw new InvalidDataException("unknown leaf");}ValidateCurrent(p);if(p.Directory)BuildPlan(p,plan);plan.Add(p);}}
+    private static void ProbeUnknown(Pin dir,string name){OpenResult r=OpenRelative(dir.Native,name,READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,BACKUP_INTENT);try{FILE_INFO i=Info(r.Handle);if((i.FileAttributes&ATTR_REPARSE)!=0)throw new InvalidDataException("reparse leaf");if(!OnlyDefaultStream(r.Handle))throw new InvalidDataException("alternate stream");if(!IsDirectory(i)&&i.NumberOfLinks!=1)throw new InvalidDataException("multi-link");}finally{r.Handle.Dispose();}}
+    private void RevalidatePlan(Pin target,List<Pin> plan){List<Pin> second=new List<Pin>();BuildPlan(target,second);if(second.Count!=plan.Count)throw new InvalidDataException("namespace changed");for(int i=0;i<plan.Count;i++)if(!Object.ReferenceEquals(plan[i],second[i]))throw new InvalidDataException("namespace changed");foreach(Pin p in plan){ValidateCurrent(p);if(p.Directory&&(Info(p.Native).FileAttributes&1)!=0)throw new Win32Exception(5);}ValidateCurrent(target);if((Info(target.Native).FileAttributes&1)!=0)throw new Win32Exception(5);}
+    private static void ValidateMarkedFile(Pin p){FILE_INFO i=Info(p.Native);if(i.VolumeSerialNumber!=p.Volume||(((ulong)i.FileIndexHigh<<32)|i.FileIndexLow)!=p.Index||(i.FileAttributes&ATTR_REPARSE)!=0||IsDirectory(i)||!OnlyDefaultStream(p.Native)||i.NumberOfLinks!=0)throw new InvalidDataException("namespace changed");}
+    private void RevalidateMarkedNamespace(Pin dir,HashSet<Pin> marked){ValidateCurrent(dir);foreach(string n in Enumerate(dir.Native)){Pin p;if(!names.TryGetValue(Key(dir,n),out p)||!p.Owned)throw new InvalidDataException("namespace changed");if(p.Directory)RevalidateMarkedNamespace(p,marked);else if(marked.Contains(p))ValidateMarkedFile(p);else throw new InvalidDataException("namespace changed");}}
+    private void MoveDirectoryPin(Pin dir,string newLeaf,string newPath){string oldKey=Key(dir.Parent,dir.Leaf),oldPath=dir.Path;names.Remove(oldKey);dir.Leaf=newLeaf;dir.Path=newPath;names.Add(Key(dir.Parent,newLeaf),dir);string prefix=oldPath.TrimEnd('\\')+"\\";foreach(Pin p in pins.Values)if(!Object.ReferenceEquals(p,dir)&&p.Path.StartsWith(prefix,StringComparison.OrdinalIgnoreCase))p.Path=newPath+"\\"+p.Path.Substring(prefix.Length);}
+    private static void ReleaseDescendants(List<Pin> plan){foreach(Pin p in plan){if(p.Stream!=null){p.Stream.Dispose();p.Stream=null;}else if(p.Handle!=null){p.Handle.Dispose();p.Handle=null;}}}
+    private void ReopenKnownTree(Pin dir){List<Pin> children=new List<Pin>();foreach(Pin p in pins.Values)if(Object.ReferenceEquals(p.Parent,dir)&&!p.Closed)children.Add(p);foreach(Pin p in children){if(p.Directory){OpenResult r=OpenRelative(dir.Native,p.Leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);p.Handle=r.Handle;ValidateCurrent(p);ReopenKnownTree(p);}else{OpenResult r=OpenRelative(dir.Native,p.Leaf,READ|WRITE|DELETE|SYNC,SHARE_READ,OPEN,NON_DIRECTORY|WRITE_THROUGH);p.Stream=new FileStream(r.Handle,FileAccess.ReadWrite,65536,false);r.Handle=null;ValidateCurrent(p);}}}
+    private void RemovePin(Pin p){string k=Key(p.Parent,p.Leaf);p.Dispose();pins.Remove(p.Token);names.Remove(k);}
+    private Pin Require(object token,bool directory){if(disposed)throw new ObjectDisposedException("transaction");Pin p;if(token==null||!pins.TryGetValue(token,out p)||p.Closed||p.Directory!=directory)throw new InvalidDataException("invalid capability");return p;}
+    private void AddPin(string key,Pin p){pins.Add(p.Token,p);names.Add(key,p);}
+    private static string Key(Pin p,string leaf){return p.Index.ToString("x16")+"|"+leaf.ToLowerInvariant();}
+    private static void Write(Pin p,byte[] b){p.Stream.Position=0;p.Stream.SetLength(0);p.Stream.Write(b,0,b.Length);p.Stream.Flush(true);}
+    private static void ValidateCurrent(Pin p){FILE_INFO i=Info(p.Native);if(i.VolumeSerialNumber!=p.Volume||(((ulong)i.FileIndexHigh<<32)|i.FileIndexLow)!=p.Index||IsDirectory(i)!=p.Directory||(i.FileAttributes&ATTR_REPARSE)!=0||!SamePath(FinalPath(p.Native),p.Path))throw new InvalidDataException("pin changed");if(!OnlyDefaultStream(p.Native))throw new InvalidDataException("alternate stream");if(!p.Directory&&i.NumberOfLinks!=1)throw new InvalidDataException("multi-link");}
+    private static void ValidatePlain(FILE_INFO i,SafeFileHandle h){if(IsDirectory(i))throw new InvalidDataException("file type");if((i.FileAttributes&ATTR_REPARSE)!=0)throw new InvalidDataException("reparse leaf");if(i.NumberOfLinks!=1)throw new InvalidDataException("multi-link");if(!OnlyDefaultStream(h))throw new InvalidDataException("alternate stream");}
+    private static bool IsDirectory(FILE_INFO i){return(i.FileAttributes&ATTR_DIRECTORY)!=0;}
+    private static FILE_INFO Info(SafeFileHandle h){FILE_INFO i;if(!GetFileInformationByHandle(h,out i))throw new Win32Exception(Marshal.GetLastWin32Error());return i;}
+    private static string FinalPath(SafeFileHandle h){StringBuilder b=new StringBuilder(512);uint n=GetFinalPathNameByHandleW(h,b,(uint)b.Capacity,0);if(n==0)throw new Win32Exception(Marshal.GetLastWin32Error());if(n>=b.Capacity){b.Capacity=(int)n+1;n=GetFinalPathNameByHandleW(h,b,(uint)b.Capacity,0);if(n==0||n>=b.Capacity)throw new Win32Exception(Marshal.GetLastWin32Error());}string s=b.ToString();if(s.StartsWith(@"\\?\UNC\",StringComparison.OrdinalIgnoreCase))return@"\\"+s.Substring(8);if(s.StartsWith(@"\\?\",StringComparison.OrdinalIgnoreCase))return s.Substring(4);return s;}
+    private static bool SamePath(string a,string b){return String.Equals(Path.GetFullPath(a).TrimEnd('\\'),Path.GetFullPath(b).TrimEnd('\\'),StringComparison.OrdinalIgnoreCase);}
+    private static string Sha(FileStream s){long p=s.Position;using(SHA256 h=SHA256.Create()){s.Position=0;string v=BitConverter.ToString(h.ComputeHash(s)).Replace("-","").ToLowerInvariant();s.Position=p;return v;}}
+    private static bool OnlyDefaultStream(SafeFileHandle h){IntPtr b=Marshal.AllocHGlobal(65536);try{if(!GetFileInformationByHandleEx(h,FileStreamInfo,b,65536)){int e=Marshal.GetLastWin32Error();if(e==38)return true;throw new Win32Exception(e);}int o=0;while(true){uint nx=(uint)Marshal.ReadInt32(b,o),nl=(uint)Marshal.ReadInt32(b,o+4);string n=Marshal.PtrToStringUni(IntPtr.Add(b,o+24),(int)nl/2);if(!String.Equals(n,"::$DATA",StringComparison.OrdinalIgnoreCase)&&!String.Equals(n,"::$INDEX_ALLOCATION",StringComparison.OrdinalIgnoreCase))return false;if(nx==0)break;o+=(int)nx;}return true;}finally{Marshal.FreeHGlobal(b);}}
+    private static string[] Enumerate(SafeFileHandle h){List<string> r=new List<string>();IntPtr b=Marshal.AllocHGlobal(65536);bool restart=true;try{while(true){IO_STATUS_BLOCK io;int st=NtQueryDirectoryFile(h,IntPtr.Zero,IntPtr.Zero,IntPtr.Zero,out io,b,65536,FileDirectoryInformation,false,IntPtr.Zero,restart);restart=false;if(st==STATUS_NO_MORE_FILES)break;if(st<0)throw new Win32Exception((int)RtlNtStatusToDosError(st));int o=0;while(true){uint nx=(uint)Marshal.ReadInt32(b,o),nl=(uint)Marshal.ReadInt32(b,o+60);string n=Marshal.PtrToStringUni(IntPtr.Add(b,o+64),(int)nl/2);if(n!="."&&n!="..")r.Add(n);if(nx==0)break;o+=(int)nx;}}return r.ToArray();}finally{Marshal.FreeHGlobal(b);}}
+    private sealed class OpenResult{internal SafeFileHandle Handle;internal bool Created;internal OpenResult(SafeFileHandle h,bool c){Handle=h;Created=c;}}
+    private static OpenResult OpenRelative(SafeFileHandle parent,string name,uint access,uint share,uint disposition,uint options)
+    {IntPtr nb=IntPtr.Zero,up=IntPtr.Zero;bool add=false;try{parent.DangerousAddRef(ref add);nb=Marshal.StringToHGlobalUni(name);UNICODE_STRING u=new UNICODE_STRING{Length=(ushort)(name.Length*2),MaximumLength=(ushort)((name.Length+1)*2),Buffer=nb};up=Marshal.AllocHGlobal(Marshal.SizeOf(typeof(UNICODE_STRING)));Marshal.StructureToPtr(u,up,false);OBJECT_ATTRIBUTES o=new OBJECT_ATTRIBUTES{Length=Marshal.SizeOf(typeof(OBJECT_ATTRIBUTES)),RootDirectory=parent.DangerousGetHandle(),ObjectName=up,Attributes=OBJ_CASE_INSENSITIVE};IO_STATUS_BLOCK io;IntPtr raw;int st=NtCreateFile(out raw,access,ref o,out io,IntPtr.Zero,0,share,disposition,options|SYNC_IO|OPEN_REPARSE,IntPtr.Zero,0);if(st<0)throw new Win32Exception((int)RtlNtStatusToDosError(st));return new OpenResult(new SafeFileHandle(raw,true),io.Information.ToUInt64()==2);}finally{if(up!=IntPtr.Zero)Marshal.FreeHGlobal(up);if(nb!=IntPtr.Zero)Marshal.FreeHGlobal(nb);if(add)parent.DangerousRelease();}}
+    private static int Rename(SafeFileHandle source,SafeFileHandle parent,string destination)
+    {byte[] n=Encoding.Unicode.GetBytes(destination);int ro=IntPtr.Size,lo=ro+IntPtr.Size,no=lo+4,size=no+n.Length+2;IntPtr b=Marshal.AllocHGlobal(size);bool pa=false,sa=false;try{source.DangerousAddRef(ref sa);parent.DangerousAddRef(ref pa);for(int i=0;i<size;i++)Marshal.WriteByte(b,i,0);Marshal.WriteByte(b,0,0);Marshal.WriteIntPtr(b,ro,parent.DangerousGetHandle());Marshal.WriteInt32(b,lo,n.Length);Marshal.Copy(n,0,IntPtr.Add(b,no),n.Length);IO_STATUS_BLOCK io;int st=NtSetInformationFile(source,out io,b,(uint)size,FileRenameInformation);return st>=0?0:(int)RtlNtStatusToDosError(st);}finally{if(pa)parent.DangerousRelease();if(sa)source.DangerousRelease();Marshal.FreeHGlobal(b);}}
+    private static int SetDelete(SafeFileHandle h,bool delete){IntPtr b=Marshal.AllocHGlobal(1);try{Marshal.WriteByte(b,delete?(byte)1:(byte)0);IO_STATUS_BLOCK io;int st=NtSetInformationFile(h,out io,b,1,FileDispositionInformation);return st>=0?0:(int)RtlNtStatusToDosError(st);}finally{Marshal.FreeHGlobal(b);}}
 }
 '@
-}
-
-function Assert-CcodInstallLeafName {
-    param([Parameter(Mandatory)][string]$Leaf)
-    if ([string]::IsNullOrWhiteSpace($Leaf) -or $Leaf.Length -gt 160 -or
-        $Leaf -in @('.','..') -or $Leaf -notmatch '^[A-Za-z0-9._-]+$' -or
-        $Leaf.EndsWith('.') -or $Leaf.EndsWith(' ') -or
-        $Leaf -match '^(?i:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\.|$)') {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_LEAF_INVALID' 'Install transaction leaf must be one safe relative segment' $Leaf
-    }
-}
-
-function Get-CcodInstallHandleInfo {
-    param([Parameter(Mandatory)]$Pin)
-    $handle = if ($null -ne $Pin.Stream) { $Pin.Stream.SafeFileHandle } else { $Pin.Handle }
-    return [CcodInstallFileNative]::GetInfo($handle)
-}
-
-function Get-CcodInstallPinHandle {
-    param([Parameter(Mandatory)]$Pin)
-    if ($null -ne $Pin.Stream) { return $Pin.Stream.SafeFileHandle }
-    return $Pin.Handle
-}
-
-function Get-CcodInstallIdentity {
-    param([Parameter(Mandatory)]$Information)
-    return [pscustomobject]@{
-        VolumeSerialNumber = [uint32]$Information.VolumeSerialNumber
-        FileIndex = [uint64]$Information.FileIndex
-        Key = ('{0:x8}:{1:x16}' -f [uint32]$Information.VolumeSerialNumber,[uint64]$Information.FileIndex)
-    }
-}
-
-function Get-CcodInstallObjectKey {
-    param([Parameter(Mandatory)]$ParentDirectory, [Parameter(Mandatory)][string]$Leaf)
-    return $ParentDirectory.Identity.Key + '|' + $Leaf.ToLowerInvariant()
-}
-
-function Test-CcodInstallSameIdentity {
-    param($Expected, $Information)
-    return $null -ne $Expected -and
-        [uint32]$Expected.VolumeSerialNumber -eq [uint32]$Information.VolumeSerialNumber -and
-        [uint64]$Expected.FileIndex -eq [uint64]$Information.FileIndex
-}
-
-function Assert-CcodInstallTransaction {
-    param([Parameter(Mandatory)]$Transaction)
-    if ($null -eq $Transaction -or $Transaction.Kind -cne 'CcodInstallFileTransaction') {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install file transaction context is invalid' $null
     }
-    if ($Transaction.Closed) {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' 'Install file transaction is already closed' $null
-    }
-}
-
-function Assert-CcodInstallPin {
-    param(
-        [Parameter(Mandatory)]$Transaction,
-        [Parameter(Mandatory)]$Pin,
-        [ValidateSet('Directory','File')][string]$Kind
-    )
-    Assert-CcodInstallTransaction $Transaction
-    if ($null -eq $Pin -or $Pin.TransactionId -cne $Transaction.Id -or $Pin.Closed -or
-        (-not [string]::IsNullOrWhiteSpace($Kind) -and $Pin.Kind -cne $Kind)) {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_INVALID' 'Install file pin is invalid for this transaction' $null
-    }
-    $handle = Get-CcodInstallPinHandle $Pin
-    if ($null -eq $handle -or $handle.IsInvalid -or $handle.IsClosed) {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_INVALID' 'Install file pin handle is closed or invalid' $null
-    }
-}
-
-function Assert-CcodInstallPinCurrent {
-    param(
-        [Parameter(Mandatory)]$Transaction,
-        [Parameter(Mandatory)]$Pin,
-        [ValidateSet('Directory','File')][string]$Kind
-    )
-    Assert-CcodInstallPin -Transaction $Transaction -Pin $Pin -Kind $Kind
-    try {
-        $information = Get-CcodInstallHandleInfo $Pin
-        $actualPath = [IO.Path]::GetFullPath([CcodInstallFileNative]::GetFinalPath((Get-CcodInstallPinHandle $Pin))).TrimEnd('\')
-    } catch {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' 'Install file pin can no longer prove its identity' $Pin.Leaf
-    }
-    $expectedPath = [IO.Path]::GetFullPath([string]$Pin.ExpectedPath).TrimEnd('\')
-    if (-not (Test-CcodInstallSameIdentity $Pin.Identity $information) -or
-        -not $actualPath.Equals($expectedPath, [StringComparison]::OrdinalIgnoreCase) -or
-        $information.IsReparsePoint -or
-        ($Kind -ceq 'Directory' -and -not $information.IsDirectory) -or
-        ($Kind -ceq 'File' -and $information.IsDirectory)) {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' 'Install file pin identity or final path changed' $Pin.Leaf
-    }
-    return $information
-}
-
-function Assert-CcodInstallPlainFile {
-    param([Parameter(Mandatory)]$Information, [Parameter(Mandatory)]$Handle, [Parameter(Mandatory)][string]$Target)
-    if ($Information.IsDirectory) {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_FILE_TYPE_INVALID' 'Install transaction expected a regular file' $Target
-    }
-    if ($Information.IsReparsePoint) {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' 'Install transaction rejects reparse leaves' $Target
-    }
-    if ([uint32]$Information.NumberOfLinks -ne 1) {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_MULTILINK_LEAF' 'Install transaction rejects multi-link leaves' $Target
-    }
-    try { $defaultStreamOnly = [CcodInstallFileNative]::HasOnlyDefaultDataStream($Handle) }
-    catch { Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' 'Install transaction could not prove the leaf stream inventory' $Target }
-    if (-not $defaultStreamOnly) {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' 'Install transaction rejects alternate data streams' $Target
-    }
-}
-
-function Close-CcodInstallPin {
-    param([Parameter(Mandatory)]$Pin)
-    if ($Pin.Closed) { return }
-    try {
-        if ($null -ne $Pin.Stream) { $Pin.Stream.Dispose() }
-        elseif ($null -ne $Pin.Handle) { $Pin.Handle.Dispose() }
-    } finally { $Pin.Closed = $true }
-}
-
-function Open-CcodInstallFileTransaction {
-    [CmdletBinding()]
-    param([Parameter(Mandatory)][string]$InstallRoot)
-
-    Initialize-CcodInstallFileNative
-    if (-not [IO.Path]::IsPathRooted($InstallRoot)) {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot
-    }
-    $rootPath = [IO.Path]::GetFullPath($InstallRoot).TrimEnd('\')
-    if (-not [IO.Directory]::Exists($rootPath)) {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_MISSING' 'Pinned install root must already exist' $rootPath
-    }
-    $handle = $null
-    try {
-        $handle = [CcodInstallFileNative]::OpenRootDirectory($rootPath)
-        $information = [CcodInstallFileNative]::GetInfo($handle)
-        $finalPath = [IO.Path]::GetFullPath([CcodInstallFileNative]::GetFinalPath($handle)).TrimEnd('\')
-        if (-not $information.IsDirectory -or $information.IsReparsePoint -or
-            -not $finalPath.Equals($rootPath, [StringComparison]::OrdinalIgnoreCase)) {
-            Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root is not one plain directory identity' $rootPath
-        }
-        $id = [guid]::NewGuid().ToString('D')
-        $rootPin = [pscustomobject]@{
-            Kind = 'Directory'; TransactionId = $id; Handle = $handle; Stream = $null
-            ParentDirectory = $null; Leaf = ''; ExpectedPath = $rootPath
-            Identity = Get-CcodInstallIdentity $information; Created = $false; Owned = $false; Closed = $false
-        }
-        $handle = $null
-        $pins = [Collections.Generic.List[object]]::new()
-        $pins.Add($rootPin)
-        return [pscustomobject]@{
-            Kind = 'CcodInstallFileTransaction'; Id = $id; InstallRoot = $rootPath; RootDirectory = $rootPin
-            Pins = $pins
-            Objects = [Collections.Generic.Dictionary[string,object]]::new([StringComparer]::OrdinalIgnoreCase)
-            OwnedObjects = [Collections.Generic.Dictionary[string,object]]::new([StringComparer]::OrdinalIgnoreCase)
-            LastSourceOpenAttempt = $null; Closed = $false; Disposition = $null
-        }
-    } catch {
-        if ($null -ne $handle) { $handle.Dispose() }
-        throw
-    }
-}
-
-function Open-CcodInstallPinnedDirectory {
-    [CmdletBinding()]
-    param(
-        [Parameter(Mandatory)]$Transaction,
-        [Parameter(Mandatory)]$ParentDirectory,
-        [Parameter(Mandatory)][string]$Leaf,
-        [switch]$CreateIfMissing
-    )
-    Assert-CcodInstallLeafName $Leaf
-    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $ParentDirectory -Kind Directory)
-    $key = Get-CcodInstallObjectKey $ParentDirectory $Leaf
-    if ($Transaction.Objects.ContainsKey($key)) {
-        $existing = $Transaction.Objects[$key]
-        [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $existing -Kind Directory)
-        return $existing
-    }
-    $result = $null
-    try {
-        $result = [CcodInstallFileNative]::OpenDirectoryRelative($ParentDirectory.Handle, $Leaf, [bool]$CreateIfMissing)
-        $information = [CcodInstallFileNative]::GetInfo($result.Handle)
-        if (-not $information.IsDirectory) {
-            Throw-CcodInstallFileError 'CCOD_INSTALL_FILE_TYPE_INVALID' 'Pinned install child is not a directory' $Leaf
-        }
-        if ($information.IsReparsePoint) {
-            Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' 'Pinned install child is a reparse point' $Leaf
-        }
-        $expectedPath = Join-Path $ParentDirectory.ExpectedPath $Leaf
-        $finalPath = [IO.Path]::GetFullPath([CcodInstallFileNative]::GetFinalPath($result.Handle)).TrimEnd('\')
-        if (-not $finalPath.Equals([IO.Path]::GetFullPath($expectedPath).TrimEnd('\'), [StringComparison]::OrdinalIgnoreCase)) {
-            Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' 'Pinned install child final path is unexpected' $Leaf
-        }
-        $pin = [pscustomobject]@{
-            Kind = 'Directory'; TransactionId = $Transaction.Id; Handle = $result.Handle; Stream = $null
-            ParentDirectory = $ParentDirectory; Leaf = $Leaf; ExpectedPath = $expectedPath
-            Identity = Get-CcodInstallIdentity $information; Created = [bool]$result.Created; Owned = [bool]$result.Created; Closed = $false
-        }
-        $result = $null
-        $Transaction.Pins.Add($pin)
-        $Transaction.Objects.Add($key, $pin)
-        if ($pin.Owned) { $Transaction.OwnedObjects.Add($key, $pin) }
-        return $pin
-    } catch {
-        if ($null -ne $result) { $result.Handle.Dispose() }
-        throw
-    }
-}
-
-function New-CcodInstallPinnedTemporaryLeaf {
-    [CmdletBinding()]
-    param(
-        [Parameter(Mandatory)]$Transaction,
-        [Parameter(Mandatory)]$ParentDirectory,
-        [Parameter(Mandatory)][string]$Leaf
-    )
-    Assert-CcodInstallLeafName $Leaf
-    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $ParentDirectory -Kind Directory)
-    $key = Get-CcodInstallObjectKey $ParentDirectory $Leaf
-    if ($Transaction.Objects.ContainsKey($key) -or $Transaction.OwnedObjects.ContainsKey($key)) {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_TEMPORARY_EXISTS' 'Temporary install leaf is already tracked' $Leaf
-    }
-    $result = $null
-    $stream = $null
-    try {
-        $result = [CcodInstallFileNative]::CreateTemporaryFileRelative($ParentDirectory.Handle, $Leaf)
-        if (-not $result.Created) { Throw-CcodInstallFileError 'CCOD_INSTALL_TEMPORARY_EXISTS' 'Temporary install leaf already exists' $Leaf }
-        $stream = [IO.FileStream]::new($result.Handle, [IO.FileAccess]::ReadWrite, 65536, $false)
-        $result = $null
-        $information = [CcodInstallFileNative]::GetInfo($stream.SafeFileHandle)
-        Assert-CcodInstallPlainFile -Information $information -Handle $stream.SafeFileHandle -Target $Leaf
-        $pin = [pscustomobject]@{
-            Kind = 'File'; TransactionId = $Transaction.Id; Handle = $null; Stream = $stream
-            ParentDirectory = $ParentDirectory; Leaf = $Leaf; ExpectedPath = (Join-Path $ParentDirectory.ExpectedPath $Leaf)
-            Identity = Get-CcodInstallIdentity $information; Created = $true; Owned = $true; Closed = $false
-            Sealed = $false; Length = [int64]0; Sha256 = $null
-        }
-        $stream = $null
-        $Transaction.Pins.Add($pin)
-        $Transaction.Objects.Add($key, $pin)
-        $Transaction.OwnedObjects.Add($key, $pin)
-        return $pin
-    } catch {
-        if ($null -ne $stream) { $stream.Dispose() }
-        if ($null -ne $result) { $result.Handle.Dispose() }
-        throw
-    }
-}
-
-function Get-CcodInstallStreamSha256 {
-    param([Parameter(Mandatory)][IO.FileStream]$Stream)
-    $position = $Stream.Position
-    $sha = [Security.Cryptography.SHA256]::Create()
-    try {
-        $Stream.Position = 0
-        return [BitConverter]::ToString($sha.ComputeHash($Stream)).Replace('-', '').ToLowerInvariant()
-    } finally {
-        $sha.Dispose()
-        $Stream.Position = $position
-    }
-}
-
-function Copy-CcodInstallSealedFile {
-    [CmdletBinding()]
-    param(
-        [Parameter(Mandatory)]$Transaction,
-        [Parameter(Mandatory)][string]$SourcePath,
-        [Parameter(Mandatory)]$DestinationLeaf,
-        [Parameter(Mandatory)][ValidateRange(0,[int64]::MaxValue)][int64]$ExpectedLength,
-        [Parameter(Mandatory)][string]$ExpectedSha256
-    )
-    if (-not [IO.Path]::IsPathRooted($SourcePath) -or $ExpectedSha256 -cnotmatch '^[0-9a-f]{64}$') {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Sealed source contract is invalid' $SourcePath
-    }
-    $fullSource = [IO.Path]::GetFullPath($SourcePath)
-    $sourceTail = if ($fullSource.StartsWith('\\')) { $fullSource } else { $fullSource.Substring([IO.Path]::GetPathRoot($fullSource).Length) }
-    if ($sourceTail.Contains(':')) {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' 'Sealed source may not name an alternate data stream' $SourcePath
-    }
-    $destinationInformation = Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $DestinationLeaf -Kind File
-    Assert-CcodInstallPlainFile -Information $destinationInformation -Handle $DestinationLeaf.Stream.SafeFileHandle -Target $DestinationLeaf.Leaf
-    if (-not $DestinationLeaf.Owned -or $DestinationLeaf.ParentDirectory.TransactionId -cne $Transaction.Id) {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_INVALID' 'Sealed copy destination is not a transaction-owned leaf' $DestinationLeaf.Leaf
-    }
-
-    $sourceHandle = $null
-    $sourceStream = $null
-    try {
-        $sourceHandle = [CcodInstallFileNative]::OpenSourceFile($fullSource)
-        $sourceInformation = [CcodInstallFileNative]::GetInfo($sourceHandle)
-        Assert-CcodInstallPlainFile -Information $sourceInformation -Handle $sourceHandle -Target $fullSource
-        $finalSource = [IO.Path]::GetFullPath([CcodInstallFileNative]::GetFinalPath($sourceHandle))
-        if (-not $finalSource.Equals($fullSource, [StringComparison]::OrdinalIgnoreCase)) {
-            Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Sealed source final path is unexpected' $fullSource
-        }
-        if ($null -ne $script:CcodInstallFileTransactionAfterSourceOpen) {
-            $Transaction.LastSourceOpenAttempt = & $script:CcodInstallFileTransactionAfterSourceOpen $fullSource
-        }
-        $sourceStream = [IO.FileStream]::new($sourceHandle, [IO.FileAccess]::Read, 65536, $false)
-        $sourceHandle = $null
-        if ([int64]$sourceStream.Length -ne $ExpectedLength) {
-            Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_MISMATCH' 'Sealed source length does not match the contract' $fullSource
-        }
-        $sourceSha = Get-CcodInstallStreamSha256 $sourceStream
-        if ($sourceSha -cne $ExpectedSha256) {
-            Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_MISMATCH' 'Sealed source digest does not match the contract' $fullSource
-        }
-        $sourceStream.Position = 0
-        $DestinationLeaf.Stream.Position = 0
-        $DestinationLeaf.Stream.SetLength(0)
-        $sourceStream.CopyTo($DestinationLeaf.Stream, 65536)
-        $DestinationLeaf.Stream.Flush($true)
-        $destinationLength = [int64]$DestinationLeaf.Stream.Length
-        $destinationSha = Get-CcodInstallStreamSha256 $DestinationLeaf.Stream
-        if ($destinationLength -ne $ExpectedLength -or $destinationSha -cne $ExpectedSha256) {
-            Throw-CcodInstallFileError 'CCOD_INSTALL_DESTINATION_MISMATCH' 'Pinned destination bytes failed sealed readback' $DestinationLeaf.Leaf
-        }
-        $afterInformation = Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $DestinationLeaf -Kind File
-        if (-not (Test-CcodInstallSameIdentity $DestinationLeaf.Identity $afterInformation)) {
-            Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' 'Pinned destination identity changed during copy' $DestinationLeaf.Leaf
-        }
-        $DestinationLeaf.Sealed = $true
-        $DestinationLeaf.Length = $destinationLength
-        $DestinationLeaf.Sha256 = $destinationSha
-        return [pscustomobject]@{ Length = $destinationLength; Sha256 = $destinationSha }
-    } finally {
-        if ($null -ne $sourceStream) { $sourceStream.Dispose() }
-        elseif ($null -ne $sourceHandle) { $sourceHandle.Dispose() }
-    }
-}
-
-function Get-CcodInstallExistingPin {
-    param([Parameter(Mandatory)]$Transaction, [Parameter(Mandatory)]$ParentDirectory, [Parameter(Mandatory)][string]$Leaf)
-    $key = Get-CcodInstallObjectKey $ParentDirectory $Leaf
-    if ($Transaction.Objects.ContainsKey($key)) { return $Transaction.Objects[$key] }
-    return $null
-}
-
-function Commit-CcodInstallPinnedPromotion {
-    [CmdletBinding()]
-    param(
-        [Parameter(Mandatory)]$Transaction,
-        [Parameter(Mandatory)]$ParentDirectory,
-        [Parameter(Mandatory)]$TemporaryLeaf,
-        [Parameter(Mandatory)][string]$DestinationLeaf
-    )
-    Assert-CcodInstallLeafName $DestinationLeaf
-    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $ParentDirectory -Kind Directory)
-    $temporaryInformation = Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $TemporaryLeaf -Kind File
-    Assert-CcodInstallPlainFile -Information $temporaryInformation -Handle $TemporaryLeaf.Stream.SafeFileHandle -Target $TemporaryLeaf.Leaf
-    if ($TemporaryLeaf.ParentDirectory.Identity.Key -cne $ParentDirectory.Identity.Key -or -not $TemporaryLeaf.Owned -or -not $TemporaryLeaf.Sealed) {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_PROMOTION_INVALID' 'Promotion requires a sealed owned leaf under the pinned parent' $TemporaryLeaf.Leaf
-    }
-    if ($TemporaryLeaf.Leaf.Equals($DestinationLeaf, [StringComparison]::OrdinalIgnoreCase)) { return $TemporaryLeaf }
-
-    $destinationKey = Get-CcodInstallObjectKey $ParentDirectory $DestinationLeaf
-    $existingPin = Get-CcodInstallExistingPin $Transaction $ParentDirectory $DestinationLeaf
-    $identityHandle = $null
-    $destinationExists = $false
-    try {
-        if ($null -ne $existingPin) {
-            $existingInformation = Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $existingPin -Kind File
-            Assert-CcodInstallPlainFile -Information $existingInformation -Handle (Get-CcodInstallPinHandle $existingPin) -Target $DestinationLeaf
-            $destinationExists = $true
-        } else {
-            try { $identityHandle = [CcodInstallFileNative]::OpenIdentityRelative($ParentDirectory.Handle, $DestinationLeaf) }
-            catch [ComponentModel.Win32Exception] {
-                if ($_.Exception.NativeErrorCode -notin @(2,3)) { throw }
-            }
-            if ($null -ne $identityHandle) {
-                $existingInformation = [CcodInstallFileNative]::GetInfo($identityHandle)
-                if ($existingInformation.IsReparsePoint) {
-                    Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' 'Promotion destination is a reparse leaf' $DestinationLeaf
-                }
-                Assert-CcodInstallPlainFile -Information $existingInformation -Handle $identityHandle -Target $DestinationLeaf
-                $destinationExists = $true
-            }
-        }
-    } finally {
-        if ($null -ne $identityHandle) { $identityHandle.Dispose() }
-    }
-
-    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $ParentDirectory -Kind Directory)
-    if ($null -ne $existingPin) {
-        Close-CcodInstallPin $existingPin
-        [void]$Transaction.Objects.Remove($destinationKey)
-        if ($Transaction.OwnedObjects.ContainsKey($destinationKey) -and $Transaction.OwnedObjects[$destinationKey] -eq $existingPin) {
-            [void]$Transaction.OwnedObjects.Remove($destinationKey)
-        }
-    }
-    $errorCode = [CcodInstallFileNative]::RenameRelative($TemporaryLeaf.Stream.SafeFileHandle, $ParentDirectory.Handle, $DestinationLeaf, $destinationExists)
-    if ($errorCode -ne 0) {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_PROMOTION_FAILED' "Pinned promotion failed with Windows error $errorCode" $DestinationLeaf
-    }
-
-    $temporaryKey = Get-CcodInstallObjectKey $ParentDirectory $TemporaryLeaf.Leaf
-    [void]$Transaction.Objects.Remove($temporaryKey)
-    [void]$Transaction.OwnedObjects.Remove($temporaryKey)
-    $TemporaryLeaf.Leaf = $DestinationLeaf
-    $TemporaryLeaf.ExpectedPath = Join-Path $ParentDirectory.ExpectedPath $DestinationLeaf
-    $Transaction.Objects[$destinationKey] = $TemporaryLeaf
-    $Transaction.OwnedObjects[$destinationKey] = $TemporaryLeaf
-    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $TemporaryLeaf -Kind File)
-    return $TemporaryLeaf
-}
-
-function Write-CcodInstallPinnedBytes {
-    param([Parameter(Mandatory)]$Pin, [Parameter(Mandatory)][byte[]]$Bytes)
-    $Pin.Stream.Position = 0
-    $Pin.Stream.SetLength(0)
-    $Pin.Stream.Write($Bytes, 0, $Bytes.Length)
-    $Pin.Stream.Flush($true)
-    $Pin.Length = [int64]$Bytes.LongLength
-    $Pin.Sha256 = Get-CcodInstallStreamSha256 $Pin.Stream
-    $Pin.Sealed = $true
-}
-
-function Write-CcodInstallPinnedJson {
-    [CmdletBinding()]
-    param(
-        [Parameter(Mandatory)]$Transaction,
-        [Parameter(Mandatory)]$ParentDirectory,
-        [Parameter(Mandatory)][string]$Leaf,
-        [Parameter(Mandatory)]$Value,
-        [switch]$Compress
-    )
-    Assert-CcodInstallLeafName $Leaf
-    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $ParentDirectory -Kind Directory)
-    $json = ($Value | ConvertTo-Json -Depth 32 -Compress:$Compress) + "`n"
-    $bytes = [Text.UTF8Encoding]::new($false).GetBytes($json)
-    $prefix = ('.' + $Leaf + '.')
-    if ($prefix.Length -gt 100) { $prefix = '.json.' }
-    $temporaryName = $prefix + [guid]::NewGuid().ToString('N') + '.tmp'
-    $temporary = New-CcodInstallPinnedTemporaryLeaf -Transaction $Transaction -ParentDirectory $ParentDirectory -Leaf $temporaryName
-    Write-CcodInstallPinnedBytes -Pin $temporary -Bytes $bytes
-    return Commit-CcodInstallPinnedPromotion -Transaction $Transaction -ParentDirectory $ParentDirectory -TemporaryLeaf $temporary -DestinationLeaf $Leaf
-}
-
-function Test-CcodInstallSanitizedValue {
-    param($Value, [int]$Depth = 0)
+    $script:CcodRuntimeType = [CcodInstallCapabilityMarker].Assembly.GetType('CcodInstallRuntime', $true)
+}
+
+function Assert-CcodLeaf([string]$Leaf) {
+    if ([string]::IsNullOrWhiteSpace($Leaf) -or $Leaf.Length -gt 160 -or $Leaf -in @('.','..') -or $Leaf -notmatch '^[A-Za-z0-9._-]+$' -or $Leaf.EndsWith('.') -or $Leaf -match '^(?i:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\.|$)') { Throw-CcodInstallFileError 'CCOD_INSTALL_LEAF_INVALID' 'Unsafe install leaf' $Leaf }
+}
+function Invoke-CcodRuntimeStatic([string]$Name,[object[]]$Arguments) { $method=$script:CcodRuntimeType.GetMethod($Name,[Reflection.BindingFlags]'NonPublic,Static');try{return $method.Invoke($null,$Arguments)}catch [Reflection.TargetInvocationException]{throw $_.Exception.InnerException} }
+function Invoke-CcodRuntimeMethod($Runtime,[string]$Name,[object[]]$Arguments) { $method=$Runtime.GetType().GetMethod($Name,[Reflection.BindingFlags]'NonPublic,Instance');try{return $method.Invoke($Runtime,$Arguments)}catch [Reflection.TargetInvocationException]{throw $_.Exception.InnerException} }
+function Get-CcodTransactionState($Transaction) { $state=$null;if($null -eq $Transaction -or -not $script:CcodTransactions.TryGetValue($Transaction,[ref]$state)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Invalid install transaction capability' $null};if($state.Closed){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' 'Install transaction is closed' $null};return $state }
+function Get-CcodPinToken($Transaction,$Pin,[string]$Kind) { $state=Get-CcodTransactionState $Transaction;$record=$null;if($null -eq $Pin -or -not $script:CcodPins.TryGetValue($Pin,[ref]$record) -or -not [object]::ReferenceEquals($record.Transaction,$Transaction) -or $record.Kind -cne $Kind){Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_INVALID' 'Invalid install pin capability' $null};return [pscustomobject]@{State=$state;Token=$record.Token} }
+function New-CcodCapability { New-Object psobject }
+function Add-CcodPinCapability($Transaction,$Token,[string]$Kind) {$cap=New-CcodCapability;$script:CcodPins.Add($cap,[pscustomobject]@{Transaction=$Transaction;Token=$Token;Kind=$Kind});return $cap}
+function Convert-CcodRuntimeError($Action,[string]$DefaultId) {
+    try { return & $Action }
+    catch {
+        $exception = $_.Exception
+        while ($null -ne $exception.InnerException -and $exception -is [Management.Automation.RuntimeException]) { $exception = $exception.InnerException }
+        $message = [string]$exception.Message
+        if ($message -ceq 'destination exists') { Throw-CcodInstallFileError 'CCOD_INSTALL_PROMOTION_DESTINATION_EXISTS' $message $null }
+        if ($exception -is [ObjectDisposedException]) { Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' $message $null }
+        if ($exception -is [Security.Cryptography.CryptographicException] -or $message -match 'seal mismatch') { Throw-CcodInstallFileError 'CCOD_INSTALL_SEAL_MISMATCH' $message $null }
+        if ($message -match 'alternate stream') { Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' $message $null }
+        if ($message -match 'reparse') { Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' $message $null }
+        if ($message -match 'multi-link') { Throw-CcodInstallFileError 'CCOD_INSTALL_MULTILINK_LEAF' $message $null }
+        if ($message -match 'unknown|namespace') { Throw-CcodInstallFileError 'CCOD_INSTALL_UNKNOWN_LEAF' $message $null }
+        if ($message -match 'pin changed|path changed') { Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' $message $null }
+        Throw-CcodInstallFileError $DefaultId $message $null
+    }
+}
+
+function Open-CcodInstallFileTransaction { param([Parameter(Mandatory)][string]$InstallRoot) Initialize-CcodInstallRuntime;if(-not [IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$null);$root=Convert-CcodRuntimeError {Invoke-CcodRuntimeStatic Open $arguments} 'CCOD_INSTALL_ROOT_INVALID';$runtime=$arguments[1];$tx=New-CcodCapability;$rootCap=Add-CcodPinCapability $tx $root 'Directory';$tx|Add-Member -NotePropertyName RootDirectory -NotePropertyValue $rootCap;$script:CcodTransactions.Add($tx,[pscustomobject]@{Runtime=$runtime;Closed=$false;Root=$rootCap;Disposition=$null});return $tx }
+function Open-CcodInstallPinnedDirectory { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)][string]$Leaf,[switch]$CreateIfMissing) Assert-CcodLeaf $Leaf;$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;$token=Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime OpenDirectory @($p.Token,$Leaf,[bool]$CreateIfMissing)} 'CCOD_INSTALL_REPARSE_LEAF';return Add-CcodPinCapability $Transaction $token Directory }
+function New-CcodInstallPinnedTemporaryLeaf { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)][string]$Leaf) Assert-CcodLeaf $Leaf;$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;$token=Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime CreateTemporary @($p.Token,$Leaf)} 'CCOD_INSTALL_TEMPORARY_EXISTS';return Add-CcodPinCapability $Transaction $token File }
+function Copy-CcodInstallSealedFile { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][string]$SourcePath,[Parameter(Mandatory)]$DestinationLeaf,[Parameter(Mandatory)][int64]$ExpectedLength,[Parameter(Mandatory)][string]$ExpectedSha256) if(-not [IO.Path]::IsPathRooted($SourcePath)-or$ExpectedSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Invalid source contract' $SourcePath};$p=Get-CcodPinToken $Transaction $DestinationLeaf File;Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime Copy @($p.Token,[IO.Path]::GetFullPath($SourcePath),$ExpectedLength,$ExpectedSha256)|Out-Null} 'CCOD_INSTALL_SOURCE_MISMATCH';[pscustomobject]@{Length=$ExpectedLength;Sha256=$ExpectedSha256} }
+function Commit-CcodInstallPinnedPromotion { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)]$TemporaryLeaf,[Parameter(Mandatory)][string]$DestinationLeaf) Assert-CcodLeaf $DestinationLeaf;$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;$t=Get-CcodPinToken $Transaction $TemporaryLeaf File;Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime Promote @($p.Token,$t.Token,$DestinationLeaf)|Out-Null} 'CCOD_INSTALL_PROMOTION_FAILED';return $TemporaryLeaf }
+function Write-CcodInstallPinnedJson { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)]$Value,[switch]$Compress) Assert-CcodLeaf $Leaf;$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;$bytes=[Text.UTF8Encoding]::new($false).GetBytes(($Value|ConvertTo-Json -Depth 32 -Compress:$Compress)+"`n");$token=Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime WriteJson @($p.Token,$Leaf,$bytes)} 'CCOD_INSTALL_PROMOTION_FAILED';return Add-CcodPinCapability $Transaction $token File }
+function Test-CcodSanitized($Value,[int]$Depth=0) {
     if ($Depth -gt 8) { return $false }
     if ($null -eq $Value) { return $true }
-    if ($Value -is [string]) { return $Value.Length -le 4096 }
-    if ($Value -is [bool] -or $Value -is [byte] -or $Value -is [sbyte] -or
-        $Value -is [int16] -or $Value -is [uint16] -or $Value -is [int32] -or $Value -is [uint32] -or
-        $Value -is [int64] -or $Value -is [uint64] -or $Value -is [single] -or $Value -is [double] -or $Value -is [decimal]) { return $true }
+    if ($Value -is [string]) { return ($Value.Length -le 4096) }
+    if ($Value -is [ValueType]) { return $true }
     if ($Value -is [Collections.IDictionary]) {
-        foreach ($key in @($Value.Keys)) {
-            if ($key -isnot [string] -or $key -cnotmatch '^[A-Za-z0-9_.-]{1,96}$' -or
-                -not (Test-CcodInstallSanitizedValue -Value $Value[$key] -Depth ($Depth + 1))) { return $false }
+        foreach ($key in $Value.Keys) {
+            if ($key -isnot [string] -or $key -cnotmatch '^[A-Za-z0-9_.-]{1,96}$' -or -not (Test-CcodSanitized $Value[$key] ($Depth + 1))) { return $false }
         }
         return $true
     }
     if ($Value -is [pscustomobject]) {
-        foreach ($property in @($Value.PSObject.Properties)) {
-            if ($property.Name -cnotmatch '^[A-Za-z0-9_.-]{1,96}$' -or
-                -not (Test-CcodInstallSanitizedValue -Value $property.Value -Depth ($Depth + 1))) { return $false }
-        }
-        return $true
-    }
-    if ($Value -is [Collections.IList]) {
-        foreach ($entry in @($Value)) {
-            if (-not (Test-CcodInstallSanitizedValue -Value $entry -Depth ($Depth + 1))) { return $false }
+        foreach ($property in $Value.PSObject.Properties) {
+            if ($property.Name -cnotmatch '^[A-Za-z0-9_.-]{1,96}$' -or -not (Test-CcodSanitized $property.Value ($Depth + 1))) { return $false }
         }
         return $true
     }
     return $false
 }
+function Append-CcodInstallPinnedLog { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)]$Record) Assert-CcodLeaf $Leaf;if(-not(Test-CcodSanitized $Record)){Throw-CcodInstallFileError 'CCOD_INSTALL_LOG_RECORD_INVALID' 'Invalid log record' $null};$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;$bytes=[Text.UTF8Encoding]::new($false).GetBytes(($Record|ConvertTo-Json -Depth 8 -Compress)+"`n");if($bytes.Length-gt65536){Throw-CcodInstallFileError 'CCOD_INSTALL_LOG_RECORD_INVALID' 'Log record too large' $null};$token=Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime Append @($p.Token,$Leaf,$bytes)} 'CCOD_INSTALL_LOG_WRITE_FAILED';return Add-CcodPinCapability $Transaction $token File }
+function Remove-CcodInstallOwnedTree { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)][string]$Leaf) Assert-CcodLeaf $Leaf;$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime RemoveOwnedTree @($p.Token,$Leaf)|Out-Null} 'CCOD_INSTALL_DELETE_FAILED' }
+function Close-CcodInstallFileTransaction { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][ValidateSet('Ready','Failed')][string]$Disposition) $state=$null;if($null-eq$Transaction-or-not$script:CcodTransactions.TryGetValue($Transaction,[ref]$state)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Invalid install transaction capability' $null};if(-not$state.Closed){Invoke-CcodRuntimeMethod $state.Runtime Close @()|Out-Null;$state.Closed=$true;$state.Disposition=$Disposition} }
 
-function Append-CcodInstallPinnedLog {
-    [CmdletBinding()]
-    param(
-        [Parameter(Mandatory)]$Transaction,
-        [Parameter(Mandatory)]$ParentDirectory,
-        [Parameter(Mandatory)][string]$Leaf,
-        [Parameter(Mandatory)]$Record
-    )
-    Assert-CcodInstallLeafName $Leaf
-    if (($Record -isnot [Collections.IDictionary] -and $Record -isnot [pscustomobject]) -or
-        -not (Test-CcodInstallSanitizedValue $Record)) {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_LOG_RECORD_INVALID' 'Install log record is not a bounded sanitized object' $null
-    }
-    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $ParentDirectory -Kind Directory)
-    $bytes = [Text.UTF8Encoding]::new($false).GetBytes(($Record | ConvertTo-Json -Depth 8 -Compress) + "`n")
-    if ($bytes.LongLength -gt 65536) {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_LOG_RECORD_INVALID' 'Install log record exceeds the bounded size' $null
-    }
-    $key = Get-CcodInstallObjectKey $ParentDirectory $Leaf
-    $pin = Get-CcodInstallExistingPin $Transaction $ParentDirectory $Leaf
-    if ($null -ne $pin) {
-        $information = Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $pin -Kind File
-        Assert-CcodInstallPlainFile -Information $information -Handle $pin.Stream.SafeFileHandle -Target $Leaf
-    } else {
-        $result = $null
-        $stream = $null
-        try {
-            $result = [CcodInstallFileNative]::OpenAppendFileRelative($ParentDirectory.Handle, $Leaf)
-            $stream = [IO.FileStream]::new($result.Handle, [IO.FileAccess]::ReadWrite, 65536, $false)
-            $created = [bool]$result.Created
-            $result = $null
-            $information = [CcodInstallFileNative]::GetInfo($stream.SafeFileHandle)
-            Assert-CcodInstallPlainFile -Information $information -Handle $stream.SafeFileHandle -Target $Leaf
-            $pin = [pscustomobject]@{
-                Kind = 'File'; TransactionId = $Transaction.Id; Handle = $null; Stream = $stream
-                ParentDirectory = $ParentDirectory; Leaf = $Leaf; ExpectedPath = (Join-Path $ParentDirectory.ExpectedPath $Leaf)
-                Identity = Get-CcodInstallIdentity $information; Created = $created; Owned = $created; Closed = $false
-                Sealed = $false; Length = [int64]$information.Length; Sha256 = $null
-            }
-            $stream = $null
-            $Transaction.Pins.Add($pin)
-            $Transaction.Objects.Add($key, $pin)
-            if ($pin.Owned) { $Transaction.OwnedObjects.Add($key, $pin) }
-        } catch {
-            if ($null -ne $stream) { $stream.Dispose() }
-            if ($null -ne $result) { $result.Handle.Dispose() }
-            throw
-        }
-    }
-    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $ParentDirectory -Kind Directory)
-    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $pin -Kind File)
-    $pin.Stream.Position = $pin.Stream.Length
-    $pin.Stream.Write($bytes, 0, $bytes.Length)
-    $pin.Stream.Flush($true)
-    $pin.Length = [int64]$pin.Stream.Length
-    return $pin
-}
-
-function Get-CcodInstallOwnedDeletionPlan {
-    param(
-        [Parameter(Mandatory)]$Transaction,
-        [Parameter(Mandatory)]$DirectoryPin,
-        [Parameter(Mandatory)][AllowEmptyCollection()][Collections.Generic.List[object]]$Plan
-    )
-    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $DirectoryPin -Kind Directory)
-    foreach ($name in [CcodInstallFileNative]::EnumerateDirectory($DirectoryPin.Handle)) {
-        Assert-CcodInstallLeafName $name
-        $key = Get-CcodInstallObjectKey $DirectoryPin $name
-        $pin = if ($Transaction.Objects.ContainsKey($key)) { $Transaction.Objects[$key] } else { $null }
-        if ($null -eq $pin) {
-            $probe = $null
-            try {
-                $probe = [CcodInstallFileNative]::OpenIdentityRelative($DirectoryPin.Handle, $name)
-                $probeInformation = [CcodInstallFileNative]::GetInfo($probe)
-                if ($probeInformation.IsReparsePoint) {
-                    Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' 'Owned-tree cleanup encountered a reparse leaf' $name
-                }
-                if (-not $probeInformation.IsDirectory) {
-                    Assert-CcodInstallPlainFile -Information $probeInformation -Handle $probe -Target $name
-                }
-                Throw-CcodInstallFileError 'CCOD_INSTALL_UNKNOWN_LEAF' 'Owned-tree cleanup encountered an unowned leaf' $name
-            } finally {
-                if ($null -ne $probe) { $probe.Dispose() }
-            }
-        }
-        if (-not $Transaction.OwnedObjects.ContainsKey($key) -or $Transaction.OwnedObjects[$key] -ne $pin) {
-            Throw-CcodInstallFileError 'CCOD_INSTALL_UNKNOWN_LEAF' 'Owned-tree cleanup encountered an unowned tracked leaf' $name
-        }
-        if ($pin.Kind -ceq 'Directory') {
-            [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $pin -Kind Directory)
-            Get-CcodInstallOwnedDeletionPlan -Transaction $Transaction -DirectoryPin $pin -Plan $Plan
-        } else {
-            $information = Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $pin -Kind File
-            Assert-CcodInstallPlainFile -Information $information -Handle $pin.Stream.SafeFileHandle -Target $name
-        }
-        $Plan.Add($pin)
-    }
-}
-
-function Remove-CcodInstallOwnedTree {
-    [CmdletBinding()]
-    param(
-        [Parameter(Mandatory)]$Transaction,
-        [Parameter(Mandatory)]$ParentDirectory,
-        [Parameter(Mandatory)][string]$Leaf
-    )
-    Assert-CcodInstallLeafName $Leaf
-    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $ParentDirectory -Kind Directory)
-    $key = Get-CcodInstallObjectKey $ParentDirectory $Leaf
-    if (-not $Transaction.OwnedObjects.ContainsKey($key)) {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_UNKNOWN_LEAF' 'Owned-tree cleanup target is not transaction-owned' $Leaf
-    }
-    $target = $Transaction.OwnedObjects[$key]
-    [void](Assert-CcodInstallPinCurrent -Transaction $Transaction -Pin $target -Kind Directory)
-    $plan = [Collections.Generic.List[object]]::new()
-    Get-CcodInstallOwnedDeletionPlan -Transaction $Transaction -DirectoryPin $target -Plan $plan
-    $plan.Add($target)
-
-    foreach ($pin in $plan) {
-        $pinKey = if ($null -eq $pin.ParentDirectory) { $null } else { Get-CcodInstallObjectKey $pin.ParentDirectory $pin.Leaf }
-        $errorCode = [CcodInstallFileNative]::MarkDelete((Get-CcodInstallPinHandle $pin))
-        if ($errorCode -ne 0) {
-            Throw-CcodInstallFileError 'CCOD_INSTALL_DELETE_FAILED' "Owned-tree handle delete failed with Windows error $errorCode" $pin.Leaf
-        }
-        Close-CcodInstallPin $pin
-        if ($null -ne $pinKey) {
-            [void]$Transaction.Objects.Remove($pinKey)
-            [void]$Transaction.OwnedObjects.Remove($pinKey)
-        }
-    }
-}
-
-function Close-CcodInstallFileTransaction {
-    [CmdletBinding()]
-    param(
-        [Parameter(Mandatory)]$Transaction,
-        [Parameter(Mandatory)][ValidateSet('Ready','Failed')][string]$Disposition
-    )
-    if ($null -eq $Transaction -or $Transaction.Kind -cne 'CcodInstallFileTransaction') {
-        Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install file transaction context is invalid' $null
-    }
-    if ($Transaction.Closed) { return $Transaction }
-    for ($index = $Transaction.Pins.Count - 1; $index -ge 0; $index--) {
-        Close-CcodInstallPin $Transaction.Pins[$index]
-    }
-    $Transaction.Disposition = $Disposition
-    $Transaction.Closed = $true
-    return $Transaction
-}
-
-Export-ModuleMember -Function @(
-    'Open-CcodInstallFileTransaction',
-    'Open-CcodInstallPinnedDirectory',
-    'New-CcodInstallPinnedTemporaryLeaf',
-    'Copy-CcodInstallSealedFile',
-    'Commit-CcodInstallPinnedPromotion',
-    'Write-CcodInstallPinnedJson',
-    'Append-CcodInstallPinnedLog',
-    'Remove-CcodInstallOwnedTree',
-    'Close-CcodInstallFileTransaction'
-)
+Export-ModuleMember -Function Open-CcodInstallFileTransaction,Open-CcodInstallPinnedDirectory,New-CcodInstallPinnedTemporaryLeaf,Copy-CcodInstallSealedFile,Commit-CcodInstallPinnedPromotion,Write-CcodInstallPinnedJson,Append-CcodInstallPinnedLog,Remove-CcodInstallOwnedTree,Close-CcodInstallFileTransaction
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index 26f07e1..32cff86 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -12,7 +12,10 @@ if ($null -eq ('CcodInstallTransactionTestNative' -as [type])) {
     Add-Type -TypeDefinition @'
 using System;
 using System.ComponentModel;
+using System.IO;
 using System.Runtime.InteropServices;
+using System.Threading;
+using System.Threading.Tasks;
 using Microsoft.Win32.SafeHandles;
 
 public static class CcodInstallTransactionTestNative
@@ -60,6 +63,24 @@ public static class CcodInstallTransactionTestNative
         if (handle.IsInvalid) throw new Win32Exception(Marshal.GetLastWin32Error());
         return handle;
     }
+
+    public static Task<string> InsertUnknownWhenLeafBecomesUnavailable(string watchedLeaf, string unknownLeaf)
+    {
+        return Task.Run(() => {
+            DateTime deadline = DateTime.UtcNow.AddSeconds(10);
+            while (DateTime.UtcNow < deadline)
+            {
+                if (!File.Exists(watchedLeaf))
+                {
+                    try { File.WriteAllText(unknownLeaf, "concurrent-unknown"); return "inserted"; }
+                    catch (IOException) { return "blocked"; }
+                    catch (UnauthorizedAccessException) { return "blocked"; }
+                }
+                Thread.Yield();
+            }
+            return "timeout";
+        });
+    }
 }
 '@
 }
@@ -154,32 +175,17 @@ function Invoke-CcodAttemptFileReplacement {
 function Invoke-CcodReplacePinnedDirectory {
     param(
         [Parameter(Mandatory)]$Fixture,
-        [Parameter(Mandatory)]$Transaction,
-        [Parameter(Mandatory)]$DirectoryPin
+        [Parameter(Mandatory)][string]$Path
     )
-    $renamedLeaf = $DirectoryPin.Leaf + '.attacker-old'
-    # The production pin intentionally denies delete sharing. Reopen only inside
-    # this fault-injection helper so the independent final-path guard is tested.
-    $descendantPrefix = [IO.Path]::GetFullPath($DirectoryPin.ExpectedPath).TrimEnd('\') + '\'
-    $descendants = @($Transaction.Pins | Where-Object {
-        -not $_.Closed -and $_.Kind -ceq 'File' -and
-        [IO.Path]::GetFullPath([string]$_.ExpectedPath).StartsWith($descendantPrefix, [StringComparison]::OrdinalIgnoreCase)
-    })
-    foreach ($pin in $descendants) { $pin.Stream.Dispose() }
-    $DirectoryPin.Handle.Dispose()
-    $DirectoryPin.Handle = [CcodInstallTransactionTestNative]::OpenDirectoryAllowDeleteShare($DirectoryPin.ExpectedPath)
-    $moved = Join-Path $DirectoryPin.ParentDirectory.ExpectedPath $renamedLeaf
-    $renameError = Invoke-CcodInstallModule {
-        param($Pin,$RenamedLeaf)
-        [CcodInstallFileNative]::RenameRelative($Pin.Handle, $Pin.ParentDirectory.Handle, $RenamedLeaf, $false)
-    } @($DirectoryPin,$renamedLeaf)
-    if ($renameError -ne 0) { throw "Could not rename fault-injection directory: Windows error $renameError" }
-    foreach ($pin in $descendants) {
-        $relative = [IO.Path]::GetFullPath([string]$pin.ExpectedPath).Substring($descendantPrefix.Length)
-        $fileHandle = [CcodInstallTransactionTestNative]::OpenFileAllowDeleteShare((Join-Path $moved $relative))
-        $pin.Stream = [IO.FileStream]::new($fileHandle, [IO.FileAccess]::ReadWrite, 65536, $false)
+    $moved = $Path + '.attacker-old'
+    try {
+        [IO.Directory]::Move($Path, $moved)
+    } catch [IO.IOException] {
+        return [pscustomobject]@{ Outcome = 'blocked'; MovedDirectory = $null }
+    } catch [UnauthorizedAccessException] {
+        return [pscustomobject]@{ Outcome = 'blocked'; MovedDirectory = $null }
     }
-    $result = & cmd.exe /d /c mklink /J $DirectoryPin.ExpectedPath $Fixture.Outside 2>&1
+    $result = & cmd.exe /d /c mklink /J $Path $Fixture.Outside 2>&1
     if ($LASTEXITCODE -ne 0) { throw "Could not create replacement junction: $result" }
     return [pscustomobject]@{ Outcome = 'replaced'; MovedDirectory = $moved }
 }
@@ -196,6 +202,17 @@ function New-CcodJunction {
     if ($LASTEXITCODE -ne 0) { throw "Could not create junction: $result" }
 }
 
+function Invoke-CcodAttemptAdsWrite {
+    param([Parameter(Mandatory)][string]$Path)
+    $previous = $ErrorActionPreference
+    try {
+        $ErrorActionPreference = 'Continue'
+        $output = & cmd.exe /d /c "echo attacker>`"$Path`"" 2>&1
+        $exitCode = $LASTEXITCODE
+    } finally { $ErrorActionPreference = $previous }
+    return [pscustomobject]@{ Outcome = $(if ($exitCode -eq 0) { 'created' } else { 'blocked' }); Output = $output }
+}
+
 function New-CcodSourceFile {
     param([Parameter(Mandatory)]$Fixture, [string]$Name = 'source.bin', [string]$Content = 'sealed-source-v1')
     $path = Join-Path $Fixture.Base $Name
@@ -234,27 +251,10 @@ Invoke-CcodTest 'pins sealed source bytes while copying and verifies the destina
         $tx = Open-CcodFixtureTransaction $fixture
         $runtime = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'runtime' -CreateIfMissing } @($tx)
         $temporary = Invoke-CcodInstallModule { param($Tx,$Parent) New-CcodInstallPinnedTemporaryLeaf -Transaction $Tx -ParentDirectory $Parent -Leaf 'payload.tmp' } @($tx,$runtime)
-        $hook = {
-            param($OpenedSource)
-            try {
-                [IO.File]::Move($OpenedSource, ($OpenedSource + '.attacker-old'))
-                return [pscustomobject]@{ Outcome = 'replaced' }
-            } catch [IO.IOException] {
-                return [pscustomobject]@{ Outcome = 'blocked' }
-            } catch [UnauthorizedAccessException] {
-                return [pscustomobject]@{ Outcome = 'blocked' }
-            }
-        }
-        Invoke-CcodInstallModule { param($Hook) $script:CcodInstallFileTransactionAfterSourceOpen = $Hook } @($hook) | Out-Null
-        try {
-            $copy = Invoke-CcodInstallModule {
-                param($Tx,$Source,$Leaf,$Length,$Sha)
-                Copy-CcodInstallSealedFile -Transaction $Tx -SourcePath $Source -DestinationLeaf $Leaf -ExpectedLength $Length -ExpectedSha256 $Sha
-            } @($tx,$source.Path,$temporary,$source.Length,$source.Sha256)
-        } finally {
-            Invoke-CcodInstallModule { $script:CcodInstallFileTransactionAfterSourceOpen = $null } | Out-Null
-        }
-        Assert-CcodEqual 'blocked' $tx.LastSourceOpenAttempt.Outcome 'source replacement is blocked after its read handle opens'
+        $copy = Invoke-CcodInstallModule {
+            param($Tx,$Source,$Leaf,$Length,$Sha)
+            Copy-CcodInstallSealedFile -Transaction $Tx -SourcePath $Source -DestinationLeaf $Leaf -ExpectedLength $Length -ExpectedSha256 $Sha
+        } @($tx,$source.Path,$temporary,$source.Length,$source.Sha256)
         Assert-CcodEqual $source.Length $copy.Length 'copied length is sealed'
         Assert-CcodEqual $source.Sha256 $copy.Sha256 'copied digest is sealed'
         Assert-CcodOutsideUnchanged $fixture 'source replacement'
@@ -287,7 +287,7 @@ Invoke-CcodTest 'rejects reparse ADS and multi-link leaf inputs' {
     } finally { Remove-CcodInstallFileFixture $fixture }
 }
 
-Invoke-CcodTest 'rejects an ADS-bearing promotion destination and retains the temporary leaf' {
+Invoke-CcodTest 'rejects an existing ADS-bearing promotion destination without replacement' {
     $fixture = New-CcodInstallFileFixture
     try {
         $destination = Join-Path $fixture.Install 'active.json'
@@ -303,7 +303,7 @@ Invoke-CcodTest 'rejects an ADS-bearing promotion destination and retains the te
         } @($tx,$source.Path,$temporary,$source.Length,$source.Sha256)
         Assert-CcodThrows {
             Invoke-CcodInstallModule { param($Tx,$Leaf) Commit-CcodInstallPinnedPromotion -Transaction $Tx -ParentDirectory $Tx.RootDirectory -TemporaryLeaf $Leaf -DestinationLeaf 'active.json' } @($tx,$temporary) | Out-Null
-        } 'CCOD_INSTALL_ADS_LEAF'
+        } 'CCOD_INSTALL_PROMOTION_DESTINATION_EXISTS'
         Assert-CcodTrue ([IO.File]::Exists((Join-Path $fixture.Install 'active.tmp'))) 'failed ADS promotion retains the temporary candidate'
         Assert-CcodOutsideUnchanged $fixture 'ADS destination'
     } finally { Remove-CcodInstallFileFixture $fixture }
@@ -320,12 +320,18 @@ Invoke-CcodTest 'rejects promotion after an ancestor rename changes the pinned p
             param($Tx,$Source,$Leaf,$Length,$Sha)
             Copy-CcodInstallSealedFile -Transaction $Tx -SourcePath $Source -DestinationLeaf $Leaf -ExpectedLength $Length -ExpectedSha256 $Sha | Out-Null
         } @($tx,$source.Path,$temporary,$source.Length,$source.Sha256)
-        $attack = Invoke-CcodReplacePinnedDirectory -Fixture $fixture -Transaction $tx -DirectoryPin $runtime
-        Assert-CcodEqual 'replaced' $attack.Outcome 'fixture ancestor replacement is established'
-        Assert-CcodThrows {
+        $attack = Invoke-CcodReplacePinnedDirectory -Fixture $fixture -Path (Join-Path $fixture.Install 'runtime')
+        if ($attack.Outcome -ceq 'replaced') {
+            Assert-CcodThrows {
+                Invoke-CcodInstallModule { param($Tx,$Parent,$Leaf) Commit-CcodInstallPinnedPromotion -Transaction $Tx -ParentDirectory $Parent -TemporaryLeaf $Leaf -DestinationLeaf 'payload.bin' } @($tx,$runtime,$temporary) | Out-Null
+            } 'CCOD_INSTALL_PIN_CHANGED'
+            Assert-CcodTrue ([IO.File]::Exists((Join-Path $attack.MovedDirectory 'payload.tmp'))) 'renamed-parent promotion retains its temporary candidate'
+        } else {
             Invoke-CcodInstallModule { param($Tx,$Parent,$Leaf) Commit-CcodInstallPinnedPromotion -Transaction $Tx -ParentDirectory $Parent -TemporaryLeaf $Leaf -DestinationLeaf 'payload.bin' } @($tx,$runtime,$temporary) | Out-Null
-        } 'CCOD_INSTALL_PIN_CHANGED'
-        Assert-CcodTrue ([IO.File]::Exists((Join-Path $attack.MovedDirectory 'payload.tmp'))) 'renamed-parent promotion retains its temporary candidate'
+            Close-CcodInstallFileTransaction -Transaction $tx -Disposition Ready | Out-Null
+            $fixture.Transaction = $null
+            Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 (Join-Path $fixture.Install 'runtime\payload.bin')) 'blocked parent rename promotes only sealed bytes'
+        }
         Assert-CcodOutsideUnchanged $fixture 'renamed parent promotion'
     } finally { Remove-CcodInstallFileFixture $fixture }
 }
@@ -366,10 +372,10 @@ Invoke-CcodTest 'deletes a fully proven transaction-owned tree from leaves upwar
         $candidate = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'candidate' -CreateIfMissing } @($tx)
         $temporary = Invoke-CcodInstallModule { param($Tx,$Parent) New-CcodInstallPinnedTemporaryLeaf -Transaction $Tx -ParentDirectory $Parent -Leaf 'payload.tmp' } @($tx,$candidate)
         Invoke-CcodInstallModule {
-            param($Tx,$Source,$Leaf,$Length,$Sha)
+            param($Tx,$Source,$Parent,$Leaf,$Length,$Sha)
             Copy-CcodInstallSealedFile -Transaction $Tx -SourcePath $Source -DestinationLeaf $Leaf -ExpectedLength $Length -ExpectedSha256 $Sha | Out-Null
-            Commit-CcodInstallPinnedPromotion -Transaction $Tx -ParentDirectory $Leaf.ParentDirectory -TemporaryLeaf $Leaf -DestinationLeaf 'payload.bin' | Out-Null
-        } @($tx,$source.Path,$temporary,$source.Length,$source.Sha256)
+            Commit-CcodInstallPinnedPromotion -Transaction $Tx -ParentDirectory $Parent -TemporaryLeaf $Leaf -DestinationLeaf 'payload.bin' | Out-Null
+        } @($tx,$source.Path,$candidate,$temporary,$source.Length,$source.Sha256)
         Invoke-CcodInstallModule { param($Tx) Remove-CcodInstallOwnedTree -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'candidate' } @($tx) | Out-Null
         Assert-CcodTrue (-not [IO.Directory]::Exists((Join-Path $fixture.Install 'candidate'))) 'proven owned tree is removed'
         Assert-CcodOutsideUnchanged $fixture 'owned tree removal'
@@ -382,17 +388,20 @@ foreach ($case in @('json','log')) {
         try {
             $tx = Open-CcodFixtureTransaction $fixture
             $parent = Invoke-CcodInstallModule { param($Tx,$Leaf) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf $Leaf -CreateIfMissing } @($tx,$case)
-            $attack = Invoke-CcodReplacePinnedDirectory -Fixture $fixture -Transaction $tx -DirectoryPin $parent
-            Assert-CcodEqual 'replaced' $attack.Outcome "$case fixture replacement is established"
+            $attack = Invoke-CcodReplacePinnedDirectory -Fixture $fixture -Path (Join-Path $fixture.Install $case)
             if ($case -ceq 'json') {
-                Assert-CcodThrows {
-                    Invoke-CcodInstallModule { param($Tx,$Parent) Write-CcodInstallPinnedJson -Transaction $Tx -ParentDirectory $Parent -Leaf 'state.json' -Value ([ordered]@{ schemaVersion = 1; value = 'safe' }) -Compress } @($tx,$parent)
-                } 'CCOD_INSTALL_PIN_CHANGED'
+                if ($attack.Outcome -ceq 'replaced') {
+                    Assert-CcodThrows { Invoke-CcodInstallModule { param($Tx,$Parent) Write-CcodInstallPinnedJson -Transaction $Tx -ParentDirectory $Parent -Leaf 'state.json' -Value ([ordered]@{ schemaVersion = 1; value = 'safe' }) -Compress } @($tx,$parent) } 'CCOD_INSTALL_PIN_CHANGED'
+                } else {
+                    Invoke-CcodInstallModule { param($Tx,$Parent) Write-CcodInstallPinnedJson -Transaction $Tx -ParentDirectory $Parent -Leaf 'state.json' -Value ([ordered]@{ schemaVersion = 1; value = 'safe' }) -Compress } @($tx,$parent) | Out-Null
+                }
                 Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $fixture.Outside 'state.json'))) 'replaced JSON path is untouched'
             } else {
-                Assert-CcodThrows {
-                    Invoke-CcodInstallModule { param($Tx,$Parent) Append-CcodInstallPinnedLog -Transaction $Tx -ParentDirectory $Parent -Leaf 'install.log' -Record ([ordered]@{ event = 'safe'; code = 'CCOD_TEST' }) } @($tx,$parent)
-                } 'CCOD_INSTALL_PIN_CHANGED'
+                if ($attack.Outcome -ceq 'replaced') {
+                    Assert-CcodThrows { Invoke-CcodInstallModule { param($Tx,$Parent) Append-CcodInstallPinnedLog -Transaction $Tx -ParentDirectory $Parent -Leaf 'install.log' -Record ([ordered]@{ event = 'safe'; code = 'CCOD_TEST' }) } @($tx,$parent) } 'CCOD_INSTALL_PIN_CHANGED'
+                } else {
+                    Invoke-CcodInstallModule { param($Tx,$Parent) Append-CcodInstallPinnedLog -Transaction $Tx -ParentDirectory $Parent -Leaf 'install.log' -Record ([ordered]@{ event = 'safe'; code = 'CCOD_TEST' }) } @($tx,$parent) | Out-Null
+                }
                 Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $fixture.Outside 'install.log'))) 'replaced log path is untouched'
             }
             Assert-CcodOutsideUnchanged $fixture "replaced $case parent"
@@ -407,14 +416,16 @@ Invoke-CcodTest 'writes pinned JSON and appends sanitized records through relati
         $state = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'state' -CreateIfMissing } @($tx)
         $logs = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'logs' -CreateIfMissing } @($tx)
         Invoke-CcodInstallModule { param($Tx,$Parent) Write-CcodInstallPinnedJson -Transaction $Tx -ParentDirectory $Parent -Leaf 'active.json' -Value ([ordered]@{ schemaVersion = 1; active = 'runtime-a' }) -Compress } @($tx,$state) | Out-Null
-        Invoke-CcodInstallModule { param($Tx,$Parent) Write-CcodInstallPinnedJson -Transaction $Tx -ParentDirectory $Parent -Leaf 'active.json' -Value ([ordered]@{ schemaVersion = 1; active = 'runtime-b' }) -Compress } @($tx,$state) | Out-Null
+        Assert-CcodThrows {
+            Invoke-CcodInstallModule { param($Tx,$Parent) Write-CcodInstallPinnedJson -Transaction $Tx -ParentDirectory $Parent -Leaf 'active.json' -Value ([ordered]@{ schemaVersion = 1; active = 'runtime-b' }) -Compress } @($tx,$state) | Out-Null
+        } 'CCOD_INSTALL_PROMOTION_DESTINATION_EXISTS'
         Invoke-CcodInstallModule { param($Tx,$Parent) Append-CcodInstallPinnedLog -Transaction $Tx -ParentDirectory $Parent -Leaf 'install.log' -Record ([ordered]@{ event = 'one'; code = 'CCOD_OK' }) } @($tx,$logs) | Out-Null
         Invoke-CcodInstallModule { param($Tx,$Parent) Append-CcodInstallPinnedLog -Transaction $Tx -ParentDirectory $Parent -Leaf 'install.log' -Record ([ordered]@{ event = 'two'; code = 'CCOD_READY' }) } @($tx,$logs) | Out-Null
         Invoke-CcodInstallModule { param($Tx) Close-CcodInstallFileTransaction -Transaction $Tx -Disposition Ready } @($tx) | Out-Null
         $fixture.Transaction = $null
 
         $json = [IO.File]::ReadAllText((Join-Path $fixture.Install 'state\active.json'), [Text.UTF8Encoding]::new($false)) | ConvertFrom-Json
-        Assert-CcodEqual 'runtime-b' $json.active 'second pinned JSON write atomically replaces the first'
+        Assert-CcodEqual 'runtime-a' $json.active 'no-replace pinned JSON preserves the first committed object'
         $records = @([IO.File]::ReadAllLines((Join-Path $fixture.Install 'logs\install.log'), [Text.UTF8Encoding]::new($false)))
         Assert-CcodEqual 2 $records.Count 'pinned log appends one JSON line per record'
         Assert-CcodEqual 'one' (($records[0] | ConvertFrom-Json).event) 'first log record is retained'
@@ -436,12 +447,194 @@ Invoke-CcodTest 'exports only the private transaction surface and closes on a te
         $tx = Open-CcodFixtureTransaction $fixture
         Invoke-CcodInstallModule { param($Tx) Close-CcodInstallFileTransaction -Transaction $Tx -Disposition Ready } @($tx) | Out-Null
         $fixture.Transaction = $null
-        Assert-CcodEqual 'Ready' $tx.Disposition 'close records the terminal disposition'
-        Assert-CcodTrue $tx.Closed 'close marks the context closed'
+        Assert-CcodEqual 'RootDirectory' (@($tx.PSObject.Properties.Name) -join ',') 'terminal transaction remains opaque'
         Assert-CcodThrows {
             Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'after-close' -CreateIfMissing } @($tx) | Out-Null
         } 'CCOD_INSTALL_TRANSACTION_CLOSED'
     } finally { Remove-CcodInstallFileFixture $fixture }
 }
 
+Invoke-CcodTest 'returns opaque unforgeable capabilities and hides native mutation helpers' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $tx = Open-CcodFixtureTransaction $fixture
+        $txProperties = @($tx.PSObject.Properties.Name)
+        Assert-CcodEqual 'RootDirectory' ($txProperties -join ',') 'transaction reveals only its root capability'
+        $rootProperties = @($tx.RootDirectory.PSObject.Properties.Name)
+        Assert-CcodEqual '' ($rootProperties -join ',') 'directory capability reveals no native or ownership state'
+        $transactionAssemblyExports = @([CcodInstallCapabilityMarker].Assembly.ExportedTypes | Select-Object -ExpandProperty Name | Sort-Object)
+        Assert-CcodEqual 'CcodInstallCapabilityMarker' ($transactionAssemblyExports -join ',') 'transaction assembly exports only a non-mutating marker type'
+        $dangerousPublicMethods = @([CcodInstallCapabilityMarker].Assembly.ExportedTypes | ForEach-Object {
+            $_.GetMethods([Reflection.BindingFlags]'Public,Static') | Where-Object {
+                $_.Name -match 'Open|Create|Rename|Delete|Write|Append|Promote|Remove' -or
+                @($_.GetParameters().ParameterType.FullName) -contains 'Microsoft.Win32.SafeHandles.SafeFileHandle'
+            }
+        })
+        Assert-CcodEqual 0 $dangerousPublicMethods.Count 'transaction assembly exposes no public native mutation helper'
+        Assert-CcodEqual $null ('CcodInstallRuntime' -as [type]) 'internal runtime type is not directly callable through PowerShell type resolution'
+
+        $forged = [pscustomobject]@{}
+        Assert-CcodThrows {
+            Open-CcodInstallPinnedDirectory -Transaction $forged -ParentDirectory $tx.RootDirectory -Leaf 'forged' -CreateIfMissing | Out-Null
+        } 'CCOD_INSTALL_TRANSACTION_INVALID'
+
+        $otherFixture = New-CcodInstallFileFixture
+        try {
+            $other = Open-CcodFixtureTransaction $otherFixture
+            Assert-CcodThrows {
+                Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $other.RootDirectory -Leaf 'cross-issuer' -CreateIfMissing | Out-Null
+            } 'CCOD_INSTALL_PIN_INVALID'
+        } finally { Remove-CcodInstallFileFixture $otherFixture }
+        Assert-CcodOutsideUnchanged $fixture 'opaque capability rejection'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
+Invoke-CcodTest 'recomputes the private seal and never trusts forged public fields' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $source = New-CcodSourceFile $fixture
+        $tx = Open-CcodFixtureTransaction $fixture
+        $temporary = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'sealed.tmp'
+        Copy-CcodInstallSealedFile -Transaction $tx -SourcePath $source.Path -DestinationLeaf $temporary -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256 | Out-Null
+        $forgedLeaf = [pscustomobject]@{ Sealed = $true; Length = $source.Length; Sha256 = $source.Sha256 }
+        Assert-CcodThrows {
+            Commit-CcodInstallPinnedPromotion -Transaction $tx -ParentDirectory $tx.RootDirectory -TemporaryLeaf $forgedLeaf -DestinationLeaf 'forged.bin' | Out-Null
+        } 'CCOD_INSTALL_PIN_INVALID'
+        Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $fixture.Install 'forged.bin'))) 'forged public sealing fields cannot create a destination'
+        $independentWrite = $null
+        try {
+            $independentWrite = [IO.File]::Open((Join-Path $fixture.Install 'sealed.tmp'), [IO.FileMode]::Open, [IO.FileAccess]::Write, [IO.FileShare]::Read)
+        } catch [IO.IOException] { }
+        if ($null -ne $independentWrite) {
+            try {
+                $bytes = [Text.UTF8Encoding]::new($false).GetBytes('tampered')
+                $independentWrite.SetLength(0); $independentWrite.Write($bytes,0,$bytes.Length); $independentWrite.Flush($true)
+            } finally { $independentWrite.Dispose() }
+            Assert-CcodThrows {
+                Commit-CcodInstallPinnedPromotion -Transaction $tx -ParentDirectory $tx.RootDirectory -TemporaryLeaf $temporary -DestinationLeaf 'sealed.bin' | Out-Null
+            } 'CCOD_INSTALL_SEAL_MISMATCH'
+        } else {
+            Commit-CcodInstallPinnedPromotion -Transaction $tx -ParentDirectory $tx.RootDirectory -TemporaryLeaf $temporary -DestinationLeaf 'sealed.bin' | Out-Null
+            Close-CcodInstallFileTransaction -Transaction $tx -Disposition Ready | Out-Null
+            $fixture.Transaction = $null
+            Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 (Join-Path $fixture.Install 'sealed.bin')) 'blocked mutation preserves sealed promotion bytes'
+        }
+        Assert-CcodOutsideUnchanged $fixture 'seal recomputation'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
+Invoke-CcodTest 'promotion is no-replace when a destination appears before commit' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $source = New-CcodSourceFile $fixture
+        $tx = Open-CcodFixtureTransaction $fixture
+        $temporary = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'new.tmp'
+        Copy-CcodInstallSealedFile -Transaction $tx -SourcePath $source.Path -DestinationLeaf $temporary -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256 | Out-Null
+        $destination = Join-Path $fixture.Install 'existing.bin'
+        [IO.File]::WriteAllText($destination, 'unexpected-existing-object')
+        $existingSha = Get-CcodTestFileSha256 $destination
+        Assert-CcodThrows {
+            Commit-CcodInstallPinnedPromotion -Transaction $tx -ParentDirectory $tx.RootDirectory -TemporaryLeaf $temporary -DestinationLeaf 'existing.bin' | Out-Null
+        } 'CCOD_INSTALL_PROMOTION_DESTINATION_EXISTS'
+        Assert-CcodEqual $existingSha (Get-CcodTestFileSha256 $destination) 'no-replace leaves the existing object untouched'
+        Assert-CcodTrue ([IO.File]::Exists((Join-Path $fixture.Install 'new.tmp'))) 'no-replace failure retains the sealed temporary leaf'
+        Assert-CcodOutsideUnchanged $fixture 'no-replace promotion'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
+foreach ($directoryCase in @('root','child','owned')) {
+    Invoke-CcodTest "rejects $directoryCase directory alternate data streams" {
+        $fixture = New-CcodInstallFileFixture
+        try {
+            if ($directoryCase -ceq 'root') {
+                $adsPath = $fixture.Install + ':metadata'
+                $adsResult = Invoke-CcodAttemptAdsWrite $adsPath
+                Assert-CcodEqual 'created' $adsResult.Outcome 'root ADS fixture is established before pinning'
+                Assert-CcodThrows { Open-CcodFixtureTransaction $fixture | Out-Null } 'CCOD_INSTALL_ADS_LEAF'
+            } else {
+                $tx = Open-CcodFixtureTransaction $fixture
+                $directory = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf $directoryCase -CreateIfMissing
+                $adsPath = (Join-Path $fixture.Install $directoryCase) + ':metadata'
+                $adsResult = Invoke-CcodAttemptAdsWrite $adsPath
+                if ($adsResult.Outcome -ceq 'blocked') {
+                    Assert-CcodTrue $true "$directoryCase directory pin blocks ADS creation"
+                } elseif ($directoryCase -ceq 'child') {
+                    Assert-CcodThrows {
+                        New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $directory -Leaf 'blocked.tmp' | Out-Null
+                    } 'CCOD_INSTALL_ADS_LEAF'
+                } else {
+                    Assert-CcodThrows {
+                        Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'owned'
+                    } 'CCOD_INSTALL_ADS_LEAF'
+                    Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $fixture.Install 'owned'))) 'directory ADS cleanup failure retains the owned directory'
+                }
+            }
+            Assert-CcodOutsideUnchanged $fixture "$directoryCase directory ADS"
+        } finally { Remove-CcodInstallFileFixture $fixture }
+    }
+}
+
+Invoke-CcodTest 'rolls back earlier delete dispositions when a later owned leaf cannot be deleted' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $tx = Open-CcodFixtureTransaction $fixture
+        $candidate = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' -CreateIfMissing
+        $first = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $candidate -Leaf 'a.tmp'
+        $later = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $candidate -Leaf 'z.tmp'
+        [IO.File]::SetAttributes((Join-Path $fixture.Install 'candidate\z.tmp'), [IO.FileAttributes]::ReadOnly)
+        Assert-CcodThrows {
+            Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate'
+        } 'CCOD_INSTALL_DELETE_FAILED'
+        Assert-CcodTrue ([IO.File]::Exists((Join-Path $fixture.Install 'candidate\a.tmp'))) 'later deletion failure restores the first leaf disposition'
+        Assert-CcodTrue ([IO.File]::Exists((Join-Path $fixture.Install 'candidate\z.tmp'))) 'later deletion failure retains the blocked leaf'
+        Assert-CcodOutsideUnchanged $fixture 'all-or-nothing delete rollback'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
+Invoke-CcodTest 'detects an unknown insertion between deletion planning and first release' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $tx = Open-CcodFixtureTransaction $fixture
+        $candidate = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' -CreateIfMissing
+        $first = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $candidate -Leaf 'a-first.tmp'
+        for ($index = 0; $index -lt 128; $index++) {
+            New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $candidate -Leaf ('b-{0:d3}.tmp' -f $index) | Out-Null
+        }
+        $watch = Join-Path $fixture.Install 'candidate\a-first.tmp'
+        $unknown = Join-Path $fixture.Install 'candidate\concurrent-unknown.tmp'
+        $attacker = [CcodInstallTransactionTestNative]::InsertUnknownWhenLeafBecomesUnavailable($watch, $unknown)
+        $failure = $null
+        try { Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' }
+        catch { $failure = $_ }
+        $attackOutcome = $attacker.GetAwaiter().GetResult()
+        Assert-CcodTrue ($attackOutcome -in @('inserted','blocked')) 'concurrent namespace attempt reaches the delete boundary'
+        if ($attackOutcome -ceq 'inserted') {
+            Assert-CcodTrue ($null -ne $failure -and $failure.FullyQualifiedErrorId -like 'CCOD_INSTALL_UNKNOWN_LEAF*') "inserted unknown leaf fails the final namespace proof actual=$($failure.FullyQualifiedErrorId) message=$($failure.Exception.Message)"
+            Assert-CcodTrue ([IO.File]::Exists($watch)) 'failed final namespace proof restores the first delete disposition'
+            Assert-CcodTrue ([IO.File]::Exists($unknown)) 'unproven concurrent object is retained for diagnosis'
+            Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $fixture.Install 'candidate'))) 'concurrent insertion retains the complete candidate tree'
+        } else {
+            Assert-CcodTrue ($null -eq $failure) 'sharing lock may block the concurrent insertion and permit proven cleanup'
+        }
+        Assert-CcodOutsideUnchanged $fixture 'concurrent cleanup insertion'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
+Invoke-CcodTest 'closing releases every sharing lock and rejects close-versus-relative operations' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $tx = Open-CcodFixtureTransaction $fixture
+        $child = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'release-me' -CreateIfMissing
+        Close-CcodInstallFileTransaction -Transaction $tx -Disposition Failed | Out-Null
+        $fixture.Transaction = $null
+        Assert-CcodThrows {
+            Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $child -Leaf 'after-close' -CreateIfMissing | Out-Null
+        } 'CCOD_INSTALL_TRANSACTION_CLOSED'
+        $renamed = Join-Path $fixture.Install 'released'
+        [IO.Directory]::Move((Join-Path $fixture.Install 'release-me'), $renamed)
+        [IO.Directory]::Delete($renamed)
+        Assert-CcodTrue (-not [IO.Directory]::Exists($renamed)) 'closed transaction releases directory sharing locks'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
 Write-Host 'Install file transaction self-test passed.' -ForegroundColor Green

From 6c8a70a3c4f1b69e56a7af605885a8b20affc488 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sat, 29 Aug 2026 10:06:26 +0800
Subject: [PATCH 067/187] fix: make owned tree cleanup all-or-nothing

---
 .../modules/InstallFileTransaction.psm1       | 27 +++---
 .../InstallFileTransaction.SelfTest.ps1       | 85 +++++++++++++++++--
 2 files changed, 89 insertions(+), 23 deletions(-)

diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index f625e50..ec6dfe4 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -49,6 +49,7 @@ internal sealed class CcodInstallRuntime : IDisposable
     [DllImport("kernel32.dll", SetLastError=true)] private static extern bool GetFileInformationByHandle(SafeFileHandle h,out FILE_INFO i);
     [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] private static extern uint GetFinalPathNameByHandleW(SafeFileHandle h,StringBuilder b,uint l,uint f);
     [DllImport("kernel32.dll", SetLastError=true)] private static extern bool GetFileInformationByHandleEx(SafeFileHandle h,int c,IntPtr i,uint s);
+    [DllImport("kernel32.dll", SetLastError=true)] private static extern bool SetFileInformationByHandle(SafeFileHandle h,int c,IntPtr i,uint s);
     [DllImport("ntdll.dll")] private static extern int NtCreateFile(out IntPtr h,uint a,ref OBJECT_ATTRIBUTES o,out IO_STATUS_BLOCK i,IntPtr z,uint fa,uint sh,uint d,uint op,IntPtr e,uint el);
     [DllImport("ntdll.dll")] private static extern int NtQueryDirectoryFile(SafeFileHandle h,IntPtr e,IntPtr a,IntPtr c,out IO_STATUS_BLOCK i,IntPtr f,uint l,int cl,bool one,IntPtr n,bool restart);
     [DllImport("ntdll.dll")] private static extern int NtSetInformationFile(SafeFileHandle h,out IO_STATUS_BLOCK i,IntPtr f,uint l,int cl);
@@ -86,10 +87,12 @@ internal sealed class CcodInstallRuntime : IDisposable
     [MethodImpl(MethodImplOptions.Synchronized)] internal object OpenDirectory(object parentToken,string leaf,bool create)
     {
         Pin parent=Require(parentToken,true); ValidateCurrent(parent); string key=Key(parent,leaf); Pin known; if(names.TryGetValue(key,out known)){ValidateCurrent(known);return known.Token;}
-        OpenResult r=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ|SHARE_WRITE,create?OPEN_IF:OPEN,DIRECTORY|BACKUP_INTENT);
+        OpenResult r=null;
+        if(create){try{r=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ,CREATE,DIRECTORY|BACKUP_INTENT);}catch(Win32Exception x){if(x.NativeErrorCode!=80&&x.NativeErrorCode!=183)throw;r=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);}}
+        else r=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);
         try { FILE_INFO i=Info(r.Handle); if(!IsDirectory(i)||(i.FileAttributes&ATTR_REPARSE)!=0||!OnlyDefaultStream(r.Handle))throw new InvalidDataException("directory invalid");
             string path=Path.Combine(parent.Path,leaf); if(!SamePath(FinalPath(r.Handle),path))throw new InvalidDataException("path changed");
-            Pin p=new Pin(parent,leaf,path,true,r.Created,r.Handle,null,i); r.Handle=null;AddPin(key,p);return p.Token; }
+            Pin p=new Pin(parent,leaf,path,true,r.Created,r.Handle,null,i);r.Handle=null;AddPin(key,p);return p.Token; }
         finally { if(r.Handle!=null)r.Handle.Dispose(); }
     }
     [MethodImpl(MethodImplOptions.Synchronized)] internal object CreateTemporary(object parentToken,string leaf)
@@ -113,6 +116,7 @@ internal sealed class CcodInstallRuntime : IDisposable
         if(temp.Stream.Length!=temp.SealedLength||Sha(temp.Stream)!=temp.SealedSha)throw new CryptographicException("seal mismatch");
         SafeFileHandle existing=null;try{try{existing=OpenRelative(parent.Native,destination,READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,BACKUP_INTENT).Handle;}catch(Win32Exception x){if(x.NativeErrorCode!=2&&x.NativeErrorCode!=3)throw;}if(existing!=null)throw new IOException("destination exists");}
         finally{if(existing!=null)existing.Dispose();}
+        if(parent.Owned)return PublishSealedCopy(parent,temp,destination);
         int ec=Rename(temp.Native,parent.Native,destination);if(ec==80||ec==183)throw new IOException("destination exists");if(ec!=0)throw new Win32Exception(ec);names.Remove(Key(parent,temp.Leaf));temp.Leaf=destination;temp.Path=Path.Combine(parent.Path,destination);names.Add(Key(parent,destination),temp);ValidateCurrent(temp);return temp.Token;
     }
     [MethodImpl(MethodImplOptions.Synchronized)] internal object WriteJson(object parentToken,string leaf,byte[] bytes)
@@ -127,12 +131,8 @@ internal sealed class CcodInstallRuntime : IDisposable
     {
         Pin parent=Require(parentToken,true);ValidateCurrent(parent);Pin target;string key=Key(parent,leaf);if(!names.TryGetValue(key,out target)||!target.Owned||!target.Directory)throw new InvalidDataException("unknown target");
         List<Pin> plan=new List<Pin>();BuildPlan(target,plan);RevalidatePlan(target,plan);List<Pin> marked=new List<Pin>();
-        string originalLeaf=target.Leaf,originalPath=target.Path,tombstone=".__ccod_delete_"+Guid.NewGuid().ToString("N");bool quarantined=false,released=false;
-        try{ReleaseDescendants(plan);released=true;int rec=Rename(target.Native,parent.Native,tombstone);if(rec!=0)throw new Win32Exception(rec);MoveDirectoryPin(target,tombstone,Path.Combine(parent.Path,tombstone));quarantined=true;released=false;ReopenKnownTree(target);plan.Clear();BuildPlan(target,plan);RevalidatePlan(target,plan);foreach(Pin p in plan){if(p.Directory)continue;ValidateCurrent(p);int ec=SetDelete(p.Native,true);if(ec!=0)throw new Win32Exception(ec);marked.Add(p);ValidateMarkedFile(p);}RevalidateMarkedNamespace(target,new HashSet<Pin>(marked));}
-        catch{for(int i=marked.Count-1;i>=0;i--)SetDelete(marked[i].Native,false);if(!released){ReleaseDescendants(plan);released=true;}if(quarantined){int back=Rename(target.Native,parent.Native,originalLeaf);if(back!=0)throw new Win32Exception(back);MoveDirectoryPin(target,originalLeaf,originalPath);quarantined=false;}ReopenKnownTree(target);throw;}
-        foreach(Pin p in marked)RemovePin(p);
-        foreach(Pin p in plan){if(!p.Directory)continue;ValidateCurrent(p);int ec=SetDelete(p.Native,true);if(ec!=0)throw new Win32Exception(ec);RemovePin(p);}
-        ValidateCurrent(target);int tec=SetDelete(target.Native,true);if(tec!=0)throw new Win32Exception(tec);RemovePin(target);
+        try{foreach(Pin p in plan){ValidateCurrent(p);int ec=SetDeleteOnClose(p.Native,true,p.Directory);if(ec!=0)throw new Win32Exception(ec);marked.Add(p);}ValidateCurrent(target);int tec=SetDeleteOnClose(target.Native,true,true);if(tec!=0)throw new Win32Exception(tec);marked.Add(target);RevalidatePlan(target,plan);foreach(Pin p in plan)RemovePin(p);RemovePin(target);}
+        catch{for(int i=marked.Count-1;i>=0;i--)if(!marked[i].Closed)SetDeleteOnClose(marked[i].Native,false,marked[i].Directory);throw;}
     }
     [MethodImpl(MethodImplOptions.Synchronized)] internal void Close(){if(disposed)return;disposed=true;List<Pin> all=new List<Pin>(pins.Values);for(int i=all.Count-1;i>=0;i--)all[i].Dispose();pins.Clear();names.Clear();}
     public void Dispose(){Close();}
@@ -140,12 +140,8 @@ internal sealed class CcodInstallRuntime : IDisposable
     private void BuildPlan(Pin dir,List<Pin> plan){ValidateCurrent(dir);foreach(string n in Enumerate(dir.Native)){Pin p;string k=Key(dir,n);if(!names.TryGetValue(k,out p)||!p.Owned){ProbeUnknown(dir,n);throw new InvalidDataException("unknown leaf");}ValidateCurrent(p);if(p.Directory)BuildPlan(p,plan);plan.Add(p);}}
     private static void ProbeUnknown(Pin dir,string name){OpenResult r=OpenRelative(dir.Native,name,READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,BACKUP_INTENT);try{FILE_INFO i=Info(r.Handle);if((i.FileAttributes&ATTR_REPARSE)!=0)throw new InvalidDataException("reparse leaf");if(!OnlyDefaultStream(r.Handle))throw new InvalidDataException("alternate stream");if(!IsDirectory(i)&&i.NumberOfLinks!=1)throw new InvalidDataException("multi-link");}finally{r.Handle.Dispose();}}
     private void RevalidatePlan(Pin target,List<Pin> plan){List<Pin> second=new List<Pin>();BuildPlan(target,second);if(second.Count!=plan.Count)throw new InvalidDataException("namespace changed");for(int i=0;i<plan.Count;i++)if(!Object.ReferenceEquals(plan[i],second[i]))throw new InvalidDataException("namespace changed");foreach(Pin p in plan){ValidateCurrent(p);if(p.Directory&&(Info(p.Native).FileAttributes&1)!=0)throw new Win32Exception(5);}ValidateCurrent(target);if((Info(target.Native).FileAttributes&1)!=0)throw new Win32Exception(5);}
-    private static void ValidateMarkedFile(Pin p){FILE_INFO i=Info(p.Native);if(i.VolumeSerialNumber!=p.Volume||(((ulong)i.FileIndexHigh<<32)|i.FileIndexLow)!=p.Index||(i.FileAttributes&ATTR_REPARSE)!=0||IsDirectory(i)||!OnlyDefaultStream(p.Native)||i.NumberOfLinks!=0)throw new InvalidDataException("namespace changed");}
-    private void RevalidateMarkedNamespace(Pin dir,HashSet<Pin> marked){ValidateCurrent(dir);foreach(string n in Enumerate(dir.Native)){Pin p;if(!names.TryGetValue(Key(dir,n),out p)||!p.Owned)throw new InvalidDataException("namespace changed");if(p.Directory)RevalidateMarkedNamespace(p,marked);else if(marked.Contains(p))ValidateMarkedFile(p);else throw new InvalidDataException("namespace changed");}}
-    private void MoveDirectoryPin(Pin dir,string newLeaf,string newPath){string oldKey=Key(dir.Parent,dir.Leaf),oldPath=dir.Path;names.Remove(oldKey);dir.Leaf=newLeaf;dir.Path=newPath;names.Add(Key(dir.Parent,newLeaf),dir);string prefix=oldPath.TrimEnd('\\')+"\\";foreach(Pin p in pins.Values)if(!Object.ReferenceEquals(p,dir)&&p.Path.StartsWith(prefix,StringComparison.OrdinalIgnoreCase))p.Path=newPath+"\\"+p.Path.Substring(prefix.Length);}
-    private static void ReleaseDescendants(List<Pin> plan){foreach(Pin p in plan){if(p.Stream!=null){p.Stream.Dispose();p.Stream=null;}else if(p.Handle!=null){p.Handle.Dispose();p.Handle=null;}}}
-    private void ReopenKnownTree(Pin dir){List<Pin> children=new List<Pin>();foreach(Pin p in pins.Values)if(Object.ReferenceEquals(p.Parent,dir)&&!p.Closed)children.Add(p);foreach(Pin p in children){if(p.Directory){OpenResult r=OpenRelative(dir.Native,p.Leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);p.Handle=r.Handle;ValidateCurrent(p);ReopenKnownTree(p);}else{OpenResult r=OpenRelative(dir.Native,p.Leaf,READ|WRITE|DELETE|SYNC,SHARE_READ,OPEN,NON_DIRECTORY|WRITE_THROUGH);p.Stream=new FileStream(r.Handle,FileAccess.ReadWrite,65536,false);r.Handle=null;ValidateCurrent(p);}}}
     private void RemovePin(Pin p){string k=Key(p.Parent,p.Leaf);p.Dispose();pins.Remove(p.Token);names.Remove(k);}
+    private object PublishSealedCopy(Pin parent,Pin temp,string destination){OpenResult r=null;FileStream stream=null;try{try{r=OpenRelative(parent.Native,destination,READ|WRITE|DELETE|SYNC,0,CREATE,NON_DIRECTORY|WRITE_THROUGH);}catch(Win32Exception x){if(x.NativeErrorCode==80||x.NativeErrorCode==183)throw new IOException("destination exists");throw;}stream=new FileStream(r.Handle,FileAccess.ReadWrite,65536,false);r.Handle=null;temp.Stream.Position=0;temp.Stream.CopyTo(stream);stream.Flush(true);if(stream.Length!=temp.SealedLength||Sha(stream)!=temp.SealedSha)throw new CryptographicException("seal mismatch");FILE_INFO i=Info(stream.SafeFileHandle);ValidatePlain(i,stream.SafeFileHandle);Pin published=new Pin(parent,destination,Path.Combine(parent.Path,destination),false,true,null,stream,i);published.Sealed=true;published.SealedLength=temp.SealedLength;published.SealedSha=temp.SealedSha;stream=null;int dec=SetDelete(temp.Native,true);if(dec!=0){SetDelete(published.Native,true);published.Dispose();throw new Win32Exception(dec);}AddPin(Key(parent,destination),published);RemovePin(temp);return published.Token;}catch{if(stream!=null){SetDelete(stream.SafeFileHandle,true);stream.Dispose();}if(r!=null&&r.Handle!=null){SetDelete(r.Handle,true);r.Handle.Dispose();}throw;}}
     private Pin Require(object token,bool directory){if(disposed)throw new ObjectDisposedException("transaction");Pin p;if(token==null||!pins.TryGetValue(token,out p)||p.Closed||p.Directory!=directory)throw new InvalidDataException("invalid capability");return p;}
     private void AddPin(string key,Pin p){pins.Add(p.Token,p);names.Add(key,p);}
     private static string Key(Pin p,string leaf){return p.Index.ToString("x16")+"|"+leaf.ToLowerInvariant();}
@@ -165,6 +161,7 @@ internal sealed class CcodInstallRuntime : IDisposable
     private static int Rename(SafeFileHandle source,SafeFileHandle parent,string destination)
     {byte[] n=Encoding.Unicode.GetBytes(destination);int ro=IntPtr.Size,lo=ro+IntPtr.Size,no=lo+4,size=no+n.Length+2;IntPtr b=Marshal.AllocHGlobal(size);bool pa=false,sa=false;try{source.DangerousAddRef(ref sa);parent.DangerousAddRef(ref pa);for(int i=0;i<size;i++)Marshal.WriteByte(b,i,0);Marshal.WriteByte(b,0,0);Marshal.WriteIntPtr(b,ro,parent.DangerousGetHandle());Marshal.WriteInt32(b,lo,n.Length);Marshal.Copy(n,0,IntPtr.Add(b,no),n.Length);IO_STATUS_BLOCK io;int st=NtSetInformationFile(source,out io,b,(uint)size,FileRenameInformation);return st>=0?0:(int)RtlNtStatusToDosError(st);}finally{if(pa)parent.DangerousRelease();if(sa)source.DangerousRelease();Marshal.FreeHGlobal(b);}}
     private static int SetDelete(SafeFileHandle h,bool delete){IntPtr b=Marshal.AllocHGlobal(1);try{Marshal.WriteByte(b,delete?(byte)1:(byte)0);IO_STATUS_BLOCK io;int st=NtSetInformationFile(h,out io,b,1,FileDispositionInformation);return st>=0?0:(int)RtlNtStatusToDosError(st);}finally{Marshal.FreeHGlobal(b);}}
+    private static int SetDeleteOnClose(SafeFileHandle h,bool delete,bool directory){IntPtr b=Marshal.AllocHGlobal(4);try{Marshal.WriteInt32(b,delete?1:0);return SetFileInformationByHandle(h,21,b,4)?0:Marshal.GetLastWin32Error();}finally{Marshal.FreeHGlobal(b);}}
 }
 '@
     }
@@ -177,7 +174,7 @@ function Assert-CcodLeaf([string]$Leaf) {
 function Invoke-CcodRuntimeStatic([string]$Name,[object[]]$Arguments) { $method=$script:CcodRuntimeType.GetMethod($Name,[Reflection.BindingFlags]'NonPublic,Static');try{return $method.Invoke($null,$Arguments)}catch [Reflection.TargetInvocationException]{throw $_.Exception.InnerException} }
 function Invoke-CcodRuntimeMethod($Runtime,[string]$Name,[object[]]$Arguments) { $method=$Runtime.GetType().GetMethod($Name,[Reflection.BindingFlags]'NonPublic,Instance');try{return $method.Invoke($Runtime,$Arguments)}catch [Reflection.TargetInvocationException]{throw $_.Exception.InnerException} }
 function Get-CcodTransactionState($Transaction) { $state=$null;if($null -eq $Transaction -or -not $script:CcodTransactions.TryGetValue($Transaction,[ref]$state)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Invalid install transaction capability' $null};if($state.Closed){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' 'Install transaction is closed' $null};return $state }
-function Get-CcodPinToken($Transaction,$Pin,[string]$Kind) { $state=Get-CcodTransactionState $Transaction;$record=$null;if($null -eq $Pin -or -not $script:CcodPins.TryGetValue($Pin,[ref]$record) -or -not [object]::ReferenceEquals($record.Transaction,$Transaction) -or $record.Kind -cne $Kind){Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_INVALID' 'Invalid install pin capability' $null};return [pscustomobject]@{State=$state;Token=$record.Token} }
+function Get-CcodPinToken($Transaction,$Pin,[string]$Kind) { $state=Get-CcodTransactionState $Transaction;$record=$null;if($null -eq $Pin -or -not $script:CcodPins.TryGetValue($Pin,[ref]$record) -or -not [object]::ReferenceEquals($record.Transaction,$Transaction) -or $record.Kind -cne $Kind){Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_INVALID' 'Invalid install pin capability' $null};return [pscustomobject]@{State=$state;Token=$record.Token;Record=$record} }
 function New-CcodCapability { New-Object psobject }
 function Add-CcodPinCapability($Transaction,$Token,[string]$Kind) {$cap=New-CcodCapability;$script:CcodPins.Add($cap,[pscustomobject]@{Transaction=$Transaction;Token=$Token;Kind=$Kind});return $cap}
 function Convert-CcodRuntimeError($Action,[string]$DefaultId) {
@@ -202,7 +199,7 @@ function Open-CcodInstallFileTransaction { param([Parameter(Mandatory)][string]$
 function Open-CcodInstallPinnedDirectory { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)][string]$Leaf,[switch]$CreateIfMissing) Assert-CcodLeaf $Leaf;$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;$token=Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime OpenDirectory @($p.Token,$Leaf,[bool]$CreateIfMissing)} 'CCOD_INSTALL_REPARSE_LEAF';return Add-CcodPinCapability $Transaction $token Directory }
 function New-CcodInstallPinnedTemporaryLeaf { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)][string]$Leaf) Assert-CcodLeaf $Leaf;$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;$token=Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime CreateTemporary @($p.Token,$Leaf)} 'CCOD_INSTALL_TEMPORARY_EXISTS';return Add-CcodPinCapability $Transaction $token File }
 function Copy-CcodInstallSealedFile { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][string]$SourcePath,[Parameter(Mandatory)]$DestinationLeaf,[Parameter(Mandatory)][int64]$ExpectedLength,[Parameter(Mandatory)][string]$ExpectedSha256) if(-not [IO.Path]::IsPathRooted($SourcePath)-or$ExpectedSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Invalid source contract' $SourcePath};$p=Get-CcodPinToken $Transaction $DestinationLeaf File;Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime Copy @($p.Token,[IO.Path]::GetFullPath($SourcePath),$ExpectedLength,$ExpectedSha256)|Out-Null} 'CCOD_INSTALL_SOURCE_MISMATCH';[pscustomobject]@{Length=$ExpectedLength;Sha256=$ExpectedSha256} }
-function Commit-CcodInstallPinnedPromotion { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)]$TemporaryLeaf,[Parameter(Mandatory)][string]$DestinationLeaf) Assert-CcodLeaf $DestinationLeaf;$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;$t=Get-CcodPinToken $Transaction $TemporaryLeaf File;Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime Promote @($p.Token,$t.Token,$DestinationLeaf)|Out-Null} 'CCOD_INSTALL_PROMOTION_FAILED';return $TemporaryLeaf }
+function Commit-CcodInstallPinnedPromotion { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)]$TemporaryLeaf,[Parameter(Mandatory)][string]$DestinationLeaf) Assert-CcodLeaf $DestinationLeaf;$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;$t=Get-CcodPinToken $Transaction $TemporaryLeaf File;$newToken=Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime Promote @($p.Token,$t.Token,$DestinationLeaf)} 'CCOD_INSTALL_PROMOTION_FAILED';$t.Record.Token=$newToken;return $TemporaryLeaf }
 function Write-CcodInstallPinnedJson { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)]$Value,[switch]$Compress) Assert-CcodLeaf $Leaf;$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;$bytes=[Text.UTF8Encoding]::new($false).GetBytes(($Value|ConvertTo-Json -Depth 32 -Compress:$Compress)+"`n");$token=Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime WriteJson @($p.Token,$Leaf,$bytes)} 'CCOD_INSTALL_PROMOTION_FAILED';return Add-CcodPinCapability $Transaction $token File }
 function Test-CcodSanitized($Value,[int]$Depth=0) {
     if ($Depth -gt 8) { return $false }
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index 32cff86..6da0951 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -55,6 +55,16 @@ public static class CcodInstallTransactionTestNative
         return handle;
     }
 
+    public static int TryOpenDirectoryForChildWrite(string path)
+    {
+        using (SafeFileHandle handle = CreateFileW(path, 0x00000002 | 0x00000004 | FILE_READ_ATTRIBUTES,
+            FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, IntPtr.Zero, OPEN_EXISTING,
+            FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT, IntPtr.Zero))
+        {
+            return handle.IsInvalid ? Marshal.GetLastWin32Error() : 0;
+        }
+    }
+
     public static SafeFileHandle OpenFileAllowDeleteShare(string path)
     {
         SafeFileHandle handle = CreateFileW(path, GENERIC_READ | GENERIC_WRITE | DELETE | FILE_READ_ATTRIBUTES,
@@ -81,6 +91,16 @@ public static class CcodInstallTransactionTestNative
             return "timeout";
         });
     }
+
+    public static Task<string> InsertUnknownAfterDelay(string unknownLeaf, int delayMilliseconds)
+    {
+        return Task.Run(() => {
+            Thread.Sleep(delayMilliseconds);
+            try { File.WriteAllText(unknownLeaf, "concurrent-unknown"); return "inserted"; }
+            catch (IOException) { return "blocked"; }
+            catch (UnauthorizedAccessException) { return "blocked"; }
+        });
+    }
 }
 '@
 }
@@ -364,7 +384,7 @@ foreach ($case in @('unknown','reparse','multilink')) {
     }
 }
 
-Invoke-CcodTest 'deletes a fully proven transaction-owned tree from leaves upward' {
+Invoke-CcodTest 'fails closed when a nonempty owned tree cannot establish every delete disposition' {
     $fixture = New-CcodInstallFileFixture
     try {
         $source = New-CcodSourceFile $fixture
@@ -376,12 +396,26 @@ Invoke-CcodTest 'deletes a fully proven transaction-owned tree from leaves upwar
             Copy-CcodInstallSealedFile -Transaction $Tx -SourcePath $Source -DestinationLeaf $Leaf -ExpectedLength $Length -ExpectedSha256 $Sha | Out-Null
             Commit-CcodInstallPinnedPromotion -Transaction $Tx -ParentDirectory $Parent -TemporaryLeaf $Leaf -DestinationLeaf 'payload.bin' | Out-Null
         } @($tx,$source.Path,$candidate,$temporary,$source.Length,$source.Sha256)
-        Invoke-CcodInstallModule { param($Tx) Remove-CcodInstallOwnedTree -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'candidate' } @($tx) | Out-Null
-        Assert-CcodTrue (-not [IO.Directory]::Exists((Join-Path $fixture.Install 'candidate'))) 'proven owned tree is removed'
+        Assert-CcodThrows {
+            Invoke-CcodInstallModule { param($Tx) Remove-CcodInstallOwnedTree -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'candidate' } @($tx) | Out-Null
+        } 'CCOD_INSTALL_DELETE_FAILED'
+        Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $fixture.Install 'candidate'))) 'failed root disposition retains the owned directory'
+        Assert-CcodTrue ([IO.File]::Exists((Join-Path $fixture.Install 'candidate\payload.bin'))) 'failed root disposition clears the prior file disposition'
         Assert-CcodOutsideUnchanged $fixture 'owned tree removal'
     } finally { Remove-CcodInstallFileFixture $fixture }
 }
 
+Invoke-CcodTest 'deletes an empty fully-owned candidate after establishing its root disposition' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $tx = Open-CcodFixtureTransaction $fixture
+        $candidate = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'empty-candidate' -CreateIfMissing
+        Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'empty-candidate'
+        Assert-CcodTrue (-not [IO.Directory]::Exists((Join-Path $fixture.Install 'empty-candidate'))) 'empty owned candidate is deleted only after its root disposition is established'
+        Assert-CcodOutsideUnchanged $fixture 'empty owned tree removal'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
 foreach ($case in @('json','log')) {
     Invoke-CcodTest "rejects a pinned $case write after parent pathname replacement" {
         $fixture = New-CcodInstallFileFixture
@@ -591,6 +625,21 @@ Invoke-CcodTest 'rolls back earlier delete dispositions when a later owned leaf
     } finally { Remove-CcodInstallFileFixture $fixture }
 }
 
+Invoke-CcodTest 'clears a child-directory disposition when the later root mark fails' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $tx = Open-CcodFixtureTransaction $fixture
+        $candidate = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' -CreateIfMissing
+        $child = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $candidate -Leaf 'child' -CreateIfMissing
+        Assert-CcodThrows {
+            Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate'
+        } 'CCOD_INSTALL_DELETE_FAILED'
+        Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $fixture.Install 'candidate')) ) 'later root-mark failure retains the candidate root'
+        Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $fixture.Install 'candidate\child')) ) 'later root-mark failure clears the child-directory disposition'
+        Assert-CcodOutsideUnchanged $fixture 'directory disposition rollback'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
 Invoke-CcodTest 'detects an unknown insertion between deletion planning and first release' {
     $fixture = New-CcodInstallFileFixture
     try {
@@ -602,24 +651,44 @@ Invoke-CcodTest 'detects an unknown insertion between deletion planning and firs
         }
         $watch = Join-Path $fixture.Install 'candidate\a-first.tmp'
         $unknown = Join-Path $fixture.Install 'candidate\concurrent-unknown.tmp'
-        $attacker = [CcodInstallTransactionTestNative]::InsertUnknownWhenLeafBecomesUnavailable($watch, $unknown)
+        $attacker = [CcodInstallTransactionTestNative]::InsertUnknownAfterDelay($unknown, 1)
         $failure = $null
         try { Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' }
         catch { $failure = $_ }
         $attackOutcome = $attacker.GetAwaiter().GetResult()
-        Assert-CcodTrue ($attackOutcome -in @('inserted','blocked')) 'concurrent namespace attempt reaches the delete boundary'
+        Assert-CcodTrue ($attackOutcome -in @('inserted','blocked')) 'concurrent namespace attempt reaches the cleanup boundary'
         if ($attackOutcome -ceq 'inserted') {
-            Assert-CcodTrue ($null -ne $failure -and $failure.FullyQualifiedErrorId -like 'CCOD_INSTALL_UNKNOWN_LEAF*') "inserted unknown leaf fails the final namespace proof actual=$($failure.FullyQualifiedErrorId) message=$($failure.Exception.Message)"
-            Assert-CcodTrue ([IO.File]::Exists($watch)) 'failed final namespace proof restores the first delete disposition'
+            Assert-CcodTrue ($null -ne $failure -and $failure.FullyQualifiedErrorId -match '^CCOD_INSTALL_(?:UNKNOWN_LEAF|DELETE_FAILED)') "inserted unknown leaf fails cleanup before release actual=$($failure.FullyQualifiedErrorId) message=$($failure.Exception.Message)"
+            Assert-CcodTrue ([IO.File]::Exists($watch)) 'failed concurrent cleanup retains the first candidate leaf'
             Assert-CcodTrue ([IO.File]::Exists($unknown)) 'unproven concurrent object is retained for diagnosis'
             Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $fixture.Install 'candidate'))) 'concurrent insertion retains the complete candidate tree'
         } else {
-            Assert-CcodTrue ($null -eq $failure) 'sharing lock may block the concurrent insertion and permit proven cleanup'
+            Assert-CcodTrue ($null -ne $failure -and $failure.FullyQualifiedErrorId -like 'CCOD_INSTALL_DELETE_FAILED*') 'blocked insertion still fails closed when the nonempty root disposition is unsupported'
         }
         Assert-CcodOutsideUnchanged $fixture 'concurrent cleanup insertion'
     } finally { Remove-CcodInstallFileFixture $fixture }
 }
 
+Invoke-CcodTest 'owned directory denies external child creation and hard-link insertion for its lifetime' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $outsideSource = Join-Path $fixture.Outside 'outside-source.bin'
+        [IO.File]::WriteAllText($outsideSource, 'outside-source')
+        $tx = Open-CcodFixtureTransaction $fixture
+        $candidate = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' -CreateIfMissing
+        $childPath = Join-Path $fixture.Install 'candidate\attacker-child.bin'
+        $writeHandleError = [CcodInstallTransactionTestNative]::TryOpenDirectoryForChildWrite((Join-Path $fixture.Install 'candidate'))
+        Assert-CcodTrue ($writeHandleError -ne 0) 'owned directory share lock blocks an external child-write handle'
+
+        $hardLinkPath = Join-Path $fixture.Install 'candidate\attacker-hardlink.bin'
+        $hardLinkError = [CcodInstallTransactionTestNative]::CreateHardLink($hardLinkPath, $outsideSource)
+        Assert-CcodTrue ($hardLinkError -ne 0) 'owned directory share lock blocks external hard-link insertion'
+        Assert-CcodTrue (-not [IO.File]::Exists($childPath)) 'blocked child path remains absent'
+        Assert-CcodTrue (-not [IO.File]::Exists($hardLinkPath)) 'blocked hard-link path remains absent'
+        Assert-CcodOutsideUnchanged $fixture 'owned directory namespace lock'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
 Invoke-CcodTest 'closing releases every sharing lock and rejects close-versus-relative operations' {
     $fixture = New-CcodInstallFileFixture
     try {

From 713fb0b1611e594cc9cdc1106593770310777494 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sat, 29 Aug 2026 10:19:00 +0800
Subject: [PATCH 068/187] docs: retire nonempty transaction trees safely

---
 ...-29-v2522-transactional-install-release.md | 20 +++++++++++--------
 ...22-transactional-install-release-design.md | 10 ++++++----
 2 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/docs/superpowers/plans/2026-08-29-v2522-transactional-install-release.md b/docs/superpowers/plans/2026-08-29-v2522-transactional-install-release.md
index afd8d7c..55941c7 100644
--- a/docs/superpowers/plans/2026-08-29-v2522-transactional-install-release.md
+++ b/docs/superpowers/plans/2026-08-29-v2522-transactional-install-release.md
@@ -96,9 +96,11 @@ Assert-CcodEqual 'blocked' $result.Outcome 'pinned missing directory cannot be r
 Add RED cases for a replacement between temporary-leaf creation and promotion,
 source-byte replacement after `Copy-CcodInstallSealedFile` opens the source,
 reparse/ADS/multi-link leaves, a promotion whose parent was renamed, and a
-delete tree containing an unknown, reparse, or multi-link leaf. Each case must
-assert the outside sentinel remains unchanged and that failed cleanup retains
-the unproven owned candidate.
+owned-tree retirement containing an unknown, reparse, or multi-link leaf. Each
+case must assert the outside sentinel remains unchanged and that failed cleanup
+retains the unproven owned candidate. A normal nonempty owned tree must leave
+its live name only through a no-replace atomic quarantine rename with every
+original file preserved; an empty owned tree may be deleted on close.
 
 Add REDs that a pinned JSON write and a pinned log append reject a replaced
 state/log parent and cannot alter an outside sentinel. These operations become
@@ -122,9 +124,11 @@ Use native `SafeFileHandle` operations with `FILE_OPEN_REPARSE_POINT` and
 relative child opens/creates. Directory handles deny delete sharing for their
 lifetime. Temporary leaves use create-new semantics; source and destination
 bytes are read/written/hashed through the opened handles, flush completes
-before promotion, and promotion is limited to the pinned parent. Enumerate and
-delete only transaction-owned objects from leaves upward; any unexpected
-identity stops deletion and leaves the candidate in place.
+before promotion, and promotion is limited to the pinned parent. Retire a
+complete nonempty transaction-owned candidate only by no-replace atomic rename
+to a random quarantine leaf under the pinned parent. Mark only an empty owned
+tree for delete-on-close. Any unexpected identity stops retirement and leaves
+the candidate in place.
 
 Do not import `LifecycleTransaction.psm1` or change any public wire schema;
 this module is file-object ownership only.
@@ -191,7 +195,7 @@ Assert-CcodEqual $oldPointerJson (Get-Content $active -Raw) 'failed promotion ne
 
 Cover a missing fresh `.staging`/`runtime` directory, a replacement after a
 parent pin, a promotion failure, a stable-shell candidate hash failure, owned
-old-runtime cleanup after an unexpected leaf appears, and a legacy unknown
+old-runtime retirement after an unexpected leaf appears, and a legacy unknown
 file that must be retained. Add REDs that runtime `manifest.json`, initial
 state, and UI-preference writes use a pinned state/runtime parent. Keep the
 current hard-link, ADS, reparse, and source-manifest coverage; adapt it to
@@ -213,7 +217,7 @@ staging/promotion or early stable-shell copy is not transaction-bound.
 Replace `Directory.CreateDirectory`, direct copy/move/replace, and
 `Remove-Item -Recurse` mutation paths inside lifecycle staging, runtime
 promotion, runtime manifest, initial state/UI preference, stable-shell
-candidate handling, old-runtime cleanup, and failed-candidate cleanup with
+candidate handling, old-runtime retirement, and failed-candidate retirement with
 Task 1 operations. Retain the existing process identity and scheduled-task
 rules. Build/validate runtime manifest bytes through its pinned leaf before
 promotion. Do not commit stable shell bytes yet; Task 3 commits them only after
diff --git a/docs/superpowers/specs/2026-08-28-v2522-transactional-install-release-design.md b/docs/superpowers/specs/2026-08-28-v2522-transactional-install-release-design.md
index 680a1b5..cd9f519 100644
--- a/docs/superpowers/specs/2026-08-28-v2522-transactional-install-release-design.md
+++ b/docs/superpowers/specs/2026-08-28-v2522-transactional-install-release-design.md
@@ -99,8 +99,8 @@ Its required operations are:
 | Create pinned temporary leaf | Creates only a single generated leaf under a pinned directory with no overwrite of an existing inode. |
 | Copy and verify | Reads sealed source bytes, writes through the pinned leaf, flushes, and rehashes through the same handle. |
 | Commit promotion | Atomically promotes a verified temporary leaf within the pinned directory; identity or sharing ambiguity fails closed. |
-| Enumerate/delete owned tree | Walks by pinned handles, rejects reparse points, alternate streams, and multi-link leaves, then removes only transaction-owned entries from leaves upward. |
-| Close transaction | Releases handles only after a terminal success/failure decision; failed cleanup preserves its owned candidate for later diagnosis rather than performing a pathname-recursive delete. |
+| Retire owned tree | Atomically moves a complete, transaction-owned nonempty tree to a no-replace quarantine name under its pinned parent. Empty owned trees may be marked for delete-on-close. |
+| Close transaction | Releases handles only after a terminal success/failure decision; quarantine is retained for later diagnosis or separately proven reclamation rather than performing a pathname-recursive delete. |
 
 The module accepts only pinned handles and validated relative segments. It
 cannot be called with an untrusted absolute destination. Existing checks for
@@ -147,8 +147,10 @@ Prepared
 - A same-version repair reuses a package only when version and sealed package
   hash both match. A same version with different bytes fails as a conflict,
   preventing a mixed repair.
-- Unknown legacy files are never recursively removed. Cleanup is limited to
-  transaction-owned objects that the module can prove safe.
+- Unknown legacy files are never recursively removed. Nonempty transaction-owned
+  objects are retired atomically; only a separately proven empty tree is
+  physically removed. Cleanup is therefore limited to transaction-owned objects
+  that the module can prove safe.
 
 ### 4. Defender and draft-release promotion
 

From 0c2cf64c30e200ed70d35b7dc3ce69d370ffee59 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sat, 29 Aug 2026 10:36:29 +0800
Subject: [PATCH 069/187] fix: retire owned install trees atomically

---
 .../modules/InstallFileTransaction.psm1       |  41 ++--
 .../InstallFileTransaction.SelfTest.ps1       | 193 ++++++++++++++----
 2 files changed, 187 insertions(+), 47 deletions(-)

diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index ec6dfe4..3ca21a6 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -18,6 +18,8 @@ using System.IO;
 using System.Runtime.InteropServices;
 using System.Runtime.CompilerServices;
 using System.Security.Cryptography;
+using System.Security.AccessControl;
+using System.Security.Principal;
 using System.Text;
 using Microsoft.Win32.SafeHandles;
 
@@ -25,7 +27,7 @@ public sealed class CcodInstallCapabilityMarker { private CcodInstallCapabilityM
 
 internal sealed class CcodInstallRuntime : IDisposable
 {
-    private const uint READ = 0x80000000, WRITE = 0x40000000, DELETE = 0x00010000, SYNC = 0x00100000;
+    private const uint READ = 0x80000000, WRITE = 0x40000000, DELETE = 0x00010000, READ_CONTROL = 0x00020000, WRITE_DAC = 0x00040000, SYNC = 0x00100000;
     private const uint READ_ATTRIBUTES = 0x80, LIST_DIRECTORY = 0x1, ADD_FILE = 0x2, ADD_SUBDIRECTORY = 0x4;
     private const uint SHARE_READ = 1, SHARE_WRITE = 2, SHARE_DELETE = 4;
     private const uint OPEN = 1, CREATE = 2, OPEN_IF = 3;
@@ -34,6 +36,7 @@ internal sealed class CcodInstallRuntime : IDisposable
     private const uint OPEN_EXISTING = 3, OBJ_CASE_INSENSITIVE = 0x40, ATTR_DIRECTORY = 0x10, ATTR_REPARSE = 0x400;
     private const int FileRenameInformation = 10, FileDispositionInformation = 13, FileStreamInfo = 7, FileDirectoryInformation = 1;
     private const int STATUS_NO_MORE_FILES = unchecked((int)0x80000006);
+    private const uint DACL_SECURITY_INFORMATION = 0x00000004, PROTECTED_DACL_SECURITY_INFORMATION = 0x80000000, UNPROTECTED_DACL_SECURITY_INFORMATION = 0x20000000;
 
     [StructLayout(LayoutKind.Sequential)] private struct UNICODE_STRING { public ushort Length, MaximumLength; public IntPtr Buffer; }
     [StructLayout(LayoutKind.Sequential)] private struct OBJECT_ATTRIBUTES { public int Length; public IntPtr RootDirectory, ObjectName; public uint Attributes; public IntPtr SecurityDescriptor, SecurityQualityOfService; }
@@ -54,16 +57,18 @@ internal sealed class CcodInstallRuntime : IDisposable
     [DllImport("ntdll.dll")] private static extern int NtQueryDirectoryFile(SafeFileHandle h,IntPtr e,IntPtr a,IntPtr c,out IO_STATUS_BLOCK i,IntPtr f,uint l,int cl,bool one,IntPtr n,bool restart);
     [DllImport("ntdll.dll")] private static extern int NtSetInformationFile(SafeFileHandle h,out IO_STATUS_BLOCK i,IntPtr f,uint l,int cl);
     [DllImport("ntdll.dll")] private static extern uint RtlNtStatusToDosError(int s);
+    [DllImport("advapi32.dll", SetLastError=true)] private static extern bool GetKernelObjectSecurity(SafeFileHandle h,uint i,byte[] sd,uint length,out uint needed);
+    [DllImport("advapi32.dll", SetLastError=true)] private static extern bool SetKernelObjectSecurity(SafeFileHandle h,uint i,byte[] sd);
 
     private sealed class Pin : IDisposable
     {
         internal readonly object Token = new object(); internal readonly Pin Parent; internal string Leaf, Path;
-        internal readonly bool Directory, Owned; internal SafeFileHandle Handle; internal FileStream Stream;
+        internal readonly bool Directory, Owned; internal SafeFileHandle Handle; internal FileStream Stream; internal byte[] OriginalSecurity; internal bool RestoreSecurity;
         internal readonly uint Volume; internal readonly ulong Index; internal bool Closed, Sealed; internal long SealedLength; internal string SealedSha;
         internal Pin(Pin parent,string leaf,string path,bool dir,bool owned,SafeFileHandle handle,FileStream stream,FILE_INFO info)
         { Parent=parent;Leaf=leaf;Path=path;Directory=dir;Owned=owned;Handle=handle;Stream=stream;Volume=info.VolumeSerialNumber;Index=((ulong)info.FileIndexHigh<<32)|info.FileIndexLow; }
         internal SafeFileHandle Native { get { return Stream != null ? Stream.SafeFileHandle : Handle; } }
-        public void Dispose() { if(Closed)return; Closed=true; if(Stream!=null)Stream.Dispose(); else if(Handle!=null)Handle.Dispose(); }
+        public void Dispose() { if(Closed)return; Closed=true; if(RestoreSecurity&&Handle!=null)RestoreDirectorySecurity(Handle,OriginalSecurity);if(Stream!=null)Stream.Dispose(); else if(Handle!=null)Handle.Dispose(); }
     }
 
     private readonly string rootPath; private readonly Pin root;
@@ -88,7 +93,7 @@ internal sealed class CcodInstallRuntime : IDisposable
     {
         Pin parent=Require(parentToken,true); ValidateCurrent(parent); string key=Key(parent,leaf); Pin known; if(names.TryGetValue(key,out known)){ValidateCurrent(known);return known.Token;}
         OpenResult r=null;
-        if(create){try{r=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ,CREATE,DIRECTORY|BACKUP_INTENT);}catch(Win32Exception x){if(x.NativeErrorCode!=80&&x.NativeErrorCode!=183)throw;r=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);}}
+        if(create){try{r=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|READ_CONTROL|WRITE_DAC|SYNC,SHARE_READ,CREATE,DIRECTORY|BACKUP_INTENT);}catch(Win32Exception x){if(x.NativeErrorCode!=80&&x.NativeErrorCode!=183)throw;r=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);}}
         else r=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);
         try { FILE_INFO i=Info(r.Handle); if(!IsDirectory(i)||(i.FileAttributes&ATTR_REPARSE)!=0||!OnlyDefaultStream(r.Handle))throw new InvalidDataException("directory invalid");
             string path=Path.Combine(parent.Path,leaf); if(!SamePath(FinalPath(r.Handle),path))throw new InvalidDataException("path changed");
@@ -116,8 +121,7 @@ internal sealed class CcodInstallRuntime : IDisposable
         if(temp.Stream.Length!=temp.SealedLength||Sha(temp.Stream)!=temp.SealedSha)throw new CryptographicException("seal mismatch");
         SafeFileHandle existing=null;try{try{existing=OpenRelative(parent.Native,destination,READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,BACKUP_INTENT).Handle;}catch(Win32Exception x){if(x.NativeErrorCode!=2&&x.NativeErrorCode!=3)throw;}if(existing!=null)throw new IOException("destination exists");}
         finally{if(existing!=null)existing.Dispose();}
-        if(parent.Owned)return PublishSealedCopy(parent,temp,destination);
-        int ec=Rename(temp.Native,parent.Native,destination);if(ec==80||ec==183)throw new IOException("destination exists");if(ec!=0)throw new Win32Exception(ec);names.Remove(Key(parent,temp.Leaf));temp.Leaf=destination;temp.Path=Path.Combine(parent.Path,destination);names.Add(Key(parent,destination),temp);ValidateCurrent(temp);return temp.Token;
+        int ec=Rename(temp.Native,parent.Native,destination);if(ec==80||ec==183)throw new IOException("destination exists");if(ec!=0)throw new Win32Exception(ec);names.Remove(Key(parent,temp.Leaf));temp.Leaf=destination;temp.Path=Path.Combine(parent.Path,destination);names.Add(Key(parent,destination),temp);MakeReadable(temp);ValidateCurrent(temp);return temp.Token;
     }
     [MethodImpl(MethodImplOptions.Synchronized)] internal object WriteJson(object parentToken,string leaf,byte[] bytes)
     { Pin parent=Require(parentToken,true);ValidateCurrent(parent);object t=CreateTemporary(parentToken,".json."+Guid.NewGuid().ToString("N")+".tmp");Pin p=Require(t,false);Write(p,bytes);p.Sealed=true;p.SealedLength=bytes.LongLength;p.SealedSha=Sha(p.Stream);return Promote(parentToken,t,leaf); }
@@ -127,12 +131,15 @@ internal sealed class CcodInstallRuntime : IDisposable
         if(!names.TryGetValue(key,out p)){OpenResult r=OpenRelative(parent.Native,leaf,READ|WRITE|DELETE|SYNC,SHARE_READ,OPEN_IF,NON_DIRECTORY|WRITE_THROUGH);FileStream s=null;try{s=new FileStream(r.Handle,FileAccess.ReadWrite,65536,false);r.Handle=null;FILE_INFO i=Info(s.SafeFileHandle);ValidatePlain(i,s.SafeFileHandle);p=new Pin(parent,leaf,Path.Combine(parent.Path,leaf),false,r.Created,null,s,i);s=null;AddPin(key,p);}finally{if(s!=null)s.Dispose();if(r.Handle!=null)r.Handle.Dispose();}}
         ValidateCurrent(p);p.Stream.Position=p.Stream.Length;p.Stream.Write(bytes,0,bytes.Length);p.Stream.Flush(true);return p.Token;
     }
-    [MethodImpl(MethodImplOptions.Synchronized)] internal void RemoveOwnedTree(object parentToken,string leaf)
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object RemoveOwnedTree(object parentToken,string leaf)
+    {return RemoveOwnedTreeCore(parentToken,leaf,".__ccod_retired_"+Guid.NewGuid().ToString("N"));}
+    [MethodImpl(MethodImplOptions.Synchronized)] private object RemoveOwnedTreeCore(object parentToken,string leaf,string retiredLeaf)
     {
         Pin parent=Require(parentToken,true);ValidateCurrent(parent);Pin target;string key=Key(parent,leaf);if(!names.TryGetValue(key,out target)||!target.Owned||!target.Directory)throw new InvalidDataException("unknown target");
-        List<Pin> plan=new List<Pin>();BuildPlan(target,plan);RevalidatePlan(target,plan);List<Pin> marked=new List<Pin>();
-        try{foreach(Pin p in plan){ValidateCurrent(p);int ec=SetDeleteOnClose(p.Native,true,p.Directory);if(ec!=0)throw new Win32Exception(ec);marked.Add(p);}ValidateCurrent(target);int tec=SetDeleteOnClose(target.Native,true,true);if(tec!=0)throw new Win32Exception(tec);marked.Add(target);RevalidatePlan(target,plan);foreach(Pin p in plan)RemovePin(p);RemovePin(target);}
-        catch{for(int i=marked.Count-1;i>=0;i--)if(!marked[i].Closed)SetDeleteOnClose(marked[i].Native,false,marked[i].Directory);throw;}
+        List<Pin> plan=new List<Pin>();BuildPlan(target,plan);RevalidatePlan(target,plan);
+        if(plan.Count==0){int ec=SetDeleteOnClose(target.Native,true,true);if(ec!=0)throw new Win32Exception(ec);ValidateCurrent(target);RemovePin(target);return null;}
+        SafeFileHandle collision=null;try{try{collision=OpenRelative(parent.Native,retiredLeaf,READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,BACKUP_INTENT).Handle;}catch(Win32Exception x){if(x.NativeErrorCode!=2&&x.NativeErrorCode!=3)throw;}if(collision!=null)throw new IOException("retirement destination exists");}finally{if(collision!=null)collision.Dispose();}
+        List<Pin> restricted=RestrictRetirementTree(target,plan);try{RevalidatePlan(target,plan);}catch{RestoreLiveDirectorySecurity(restricted);throw;}ReleaseDescendants(plan);ValidateCurrent(target);int rec=Rename(target.Native,parent.Native,retiredLeaf);if(rec!=0){RestoreDirectorySecurity(target.Native,target.OriginalSecurity);target.RestoreSecurity=false;RestoreReleasedChildSecurity(target);ReopenKnownTree(target);if(rec==80||rec==183)throw new IOException("retirement destination exists");throw new Win32Exception(rec);}MoveDirectoryPin(target,retiredLeaf,Path.Combine(parent.Path,retiredLeaf));RestoreReleasedChildSecurity(target);ValidateCurrent(target);return target.Token;
     }
     [MethodImpl(MethodImplOptions.Synchronized)] internal void Close(){if(disposed)return;disposed=true;List<Pin> all=new List<Pin>(pins.Values);for(int i=all.Count-1;i>=0;i--)all[i].Dispose();pins.Clear();names.Clear();}
     public void Dispose(){Close();}
@@ -141,9 +148,18 @@ internal sealed class CcodInstallRuntime : IDisposable
     private static void ProbeUnknown(Pin dir,string name){OpenResult r=OpenRelative(dir.Native,name,READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,BACKUP_INTENT);try{FILE_INFO i=Info(r.Handle);if((i.FileAttributes&ATTR_REPARSE)!=0)throw new InvalidDataException("reparse leaf");if(!OnlyDefaultStream(r.Handle))throw new InvalidDataException("alternate stream");if(!IsDirectory(i)&&i.NumberOfLinks!=1)throw new InvalidDataException("multi-link");}finally{r.Handle.Dispose();}}
     private void RevalidatePlan(Pin target,List<Pin> plan){List<Pin> second=new List<Pin>();BuildPlan(target,second);if(second.Count!=plan.Count)throw new InvalidDataException("namespace changed");for(int i=0;i<plan.Count;i++)if(!Object.ReferenceEquals(plan[i],second[i]))throw new InvalidDataException("namespace changed");foreach(Pin p in plan){ValidateCurrent(p);if(p.Directory&&(Info(p.Native).FileAttributes&1)!=0)throw new Win32Exception(5);}ValidateCurrent(target);if((Info(target.Native).FileAttributes&1)!=0)throw new Win32Exception(5);}
     private void RemovePin(Pin p){string k=Key(p.Parent,p.Leaf);p.Dispose();pins.Remove(p.Token);names.Remove(k);}
-    private object PublishSealedCopy(Pin parent,Pin temp,string destination){OpenResult r=null;FileStream stream=null;try{try{r=OpenRelative(parent.Native,destination,READ|WRITE|DELETE|SYNC,0,CREATE,NON_DIRECTORY|WRITE_THROUGH);}catch(Win32Exception x){if(x.NativeErrorCode==80||x.NativeErrorCode==183)throw new IOException("destination exists");throw;}stream=new FileStream(r.Handle,FileAccess.ReadWrite,65536,false);r.Handle=null;temp.Stream.Position=0;temp.Stream.CopyTo(stream);stream.Flush(true);if(stream.Length!=temp.SealedLength||Sha(stream)!=temp.SealedSha)throw new CryptographicException("seal mismatch");FILE_INFO i=Info(stream.SafeFileHandle);ValidatePlain(i,stream.SafeFileHandle);Pin published=new Pin(parent,destination,Path.Combine(parent.Path,destination),false,true,null,stream,i);published.Sealed=true;published.SealedLength=temp.SealedLength;published.SealedSha=temp.SealedSha;stream=null;int dec=SetDelete(temp.Native,true);if(dec!=0){SetDelete(published.Native,true);published.Dispose();throw new Win32Exception(dec);}AddPin(Key(parent,destination),published);RemovePin(temp);return published.Token;}catch{if(stream!=null){SetDelete(stream.SafeFileHandle,true);stream.Dispose();}if(r!=null&&r.Handle!=null){SetDelete(r.Handle,true);r.Handle.Dispose();}throw;}}
+    private void MoveDirectoryPin(Pin dir,string newLeaf,string newPath){string oldKey=Key(dir.Parent,dir.Leaf),oldPath=dir.Path;names.Remove(oldKey);dir.Leaf=newLeaf;dir.Path=newPath;names.Add(Key(dir.Parent,newLeaf),dir);string prefix=oldPath.TrimEnd('\\')+"\\";foreach(Pin p in pins.Values)if(!Object.ReferenceEquals(p,dir)&&p.Path.StartsWith(prefix,StringComparison.OrdinalIgnoreCase))p.Path=newPath+"\\"+p.Path.Substring(prefix.Length);}
+    private static void ReleaseDescendants(List<Pin> plan){foreach(Pin p in plan){if(p.Stream!=null){p.Stream.Dispose();p.Stream=null;}else if(p.Handle!=null){p.Handle.Dispose();p.Handle=null;}}}
+    private void ReopenKnownTree(Pin dir){List<Pin> children=new List<Pin>();foreach(Pin p in pins.Values)if(Object.ReferenceEquals(p.Parent,dir)&&!p.Closed)children.Add(p);foreach(Pin p in children){if(p.Directory){uint share=p.Owned?SHARE_READ:(SHARE_READ|SHARE_WRITE);OpenResult r=OpenRelative(dir.Native,p.Leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,share,OPEN,DIRECTORY|BACKUP_INTENT);p.Handle=r.Handle;ValidateCurrent(p);ReopenKnownTree(p);}else{OpenResult r=OpenRelative(dir.Native,p.Leaf,READ|WRITE|DELETE|SYNC,SHARE_READ,OPEN,NON_DIRECTORY|WRITE_THROUGH);p.Stream=new FileStream(r.Handle,FileAccess.ReadWrite,65536,false);r.Handle=null;ValidateCurrent(p);}}}
+    private static void MakeReadable(Pin p){OpenResult bridge=OpenRelative(p.Parent.Native,p.Leaf,READ|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE|SHARE_DELETE,OPEN,NON_DIRECTORY);FILE_INFO bi=Info(bridge.Handle);if(bi.VolumeSerialNumber!=p.Volume||(((ulong)bi.FileIndexHigh<<32)|bi.FileIndexLow)!=p.Index){bridge.Handle.Dispose();throw new InvalidDataException("pin changed");}p.Stream.Dispose();p.Stream=null;OpenResult strict=OpenRelative(p.Parent.Native,p.Leaf,READ|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,NON_DIRECTORY);bridge.Handle.Dispose();p.Stream=new FileStream(strict.Handle,FileAccess.Read,65536,false);strict.Handle=null;}
     private Pin Require(object token,bool directory){if(disposed)throw new ObjectDisposedException("transaction");Pin p;if(token==null||!pins.TryGetValue(token,out p)||p.Closed||p.Directory!=directory)throw new InvalidDataException("invalid capability");return p;}
     private void AddPin(string key,Pin p){pins.Add(p.Token,p);names.Add(key,p);}
+    private static byte[] ReadDirectorySecurity(SafeFileHandle h){uint needed;GetKernelObjectSecurity(h,DACL_SECURITY_INFORMATION,null,0,out needed);int e=Marshal.GetLastWin32Error();if(needed==0)throw new Win32Exception(e);byte[] sd=new byte[needed];if(!GetKernelObjectSecurity(h,DACL_SECURITY_INFORMATION,sd,(uint)sd.Length,out needed))throw new Win32Exception(Marshal.GetLastWin32Error());return sd;}
+    private static byte[] RestrictRetirementDirectory(SafeFileHandle h){byte[] original=ReadDirectorySecurity(h);RawSecurityDescriptor raw=new RawSecurityDescriptor(original,0);RawAcl acl=raw.DiscretionaryAcl??new RawAcl(GenericAcl.AclRevision,1);int denyMask=0x00000002|0x00000004|0x00000010|0x00000040|0x00000100|0x00010000;acl.InsertAce(0,new CommonAce(AceFlags.None,AceQualifier.AccessDenied,denyMask,new SecurityIdentifier(WellKnownSidType.WorldSid,null),false,null));raw.DiscretionaryAcl=acl;raw.SetFlags(raw.ControlFlags|ControlFlags.DiscretionaryAclPresent|ControlFlags.DiscretionaryAclProtected);byte[] restricted=new byte[raw.BinaryLength];raw.GetBinaryForm(restricted,0);if(!SetKernelObjectSecurity(h,DACL_SECURITY_INFORMATION|PROTECTED_DACL_SECURITY_INFORMATION,restricted))throw new Win32Exception(Marshal.GetLastWin32Error());return original;}
+    private static void RestoreDirectorySecurity(SafeFileHandle h,byte[] original){if(original==null)return;RawSecurityDescriptor raw=new RawSecurityDescriptor(original,0);uint flags=DACL_SECURITY_INFORMATION|(((raw.ControlFlags&ControlFlags.DiscretionaryAclProtected)!=0)?PROTECTED_DACL_SECURITY_INFORMATION:UNPROTECTED_DACL_SECURITY_INFORMATION);if(!SetKernelObjectSecurity(h,flags,original))throw new Win32Exception(Marshal.GetLastWin32Error());}
+    private static List<Pin> RestrictRetirementTree(Pin target,List<Pin> plan){List<Pin> restricted=new List<Pin>();try{target.OriginalSecurity=RestrictRetirementDirectory(target.Native);target.RestoreSecurity=true;restricted.Add(target);foreach(Pin p in plan)if(p.Directory){p.OriginalSecurity=RestrictRetirementDirectory(p.Native);p.RestoreSecurity=true;restricted.Add(p);}return restricted;}catch{RestoreLiveDirectorySecurity(restricted);throw;}}
+    private static void RestoreLiveDirectorySecurity(List<Pin> restricted){for(int i=restricted.Count-1;i>=0;i--){Pin p=restricted[i];RestoreDirectorySecurity(p.Native,p.OriginalSecurity);p.RestoreSecurity=false;p.OriginalSecurity=null;}}
+    private void RestoreReleasedChildSecurity(Pin dir){List<Pin> children=new List<Pin>();foreach(Pin p in pins.Values)if(Object.ReferenceEquals(p.Parent,dir)&&p.Directory&&!p.Closed)children.Add(p);foreach(Pin child in children){OpenResult r=OpenRelative(dir.Native,child.Leaf,READ_ATTRIBUTES|READ_CONTROL|WRITE_DAC|SYNC,SHARE_READ|SHARE_WRITE|SHARE_DELETE,OPEN,DIRECTORY|BACKUP_INTENT);RestoreDirectorySecurity(r.Handle,child.OriginalSecurity);child.RestoreSecurity=false;child.OriginalSecurity=null;child.Handle=r.Handle;RestoreReleasedChildSecurity(child);child.Handle.Dispose();child.Handle=null;}}
     private static string Key(Pin p,string leaf){return p.Index.ToString("x16")+"|"+leaf.ToLowerInvariant();}
     private static void Write(Pin p,byte[] b){p.Stream.Position=0;p.Stream.SetLength(0);p.Stream.Write(b,0,b.Length);p.Stream.Flush(true);}
     private static void ValidateCurrent(Pin p){FILE_INFO i=Info(p.Native);if(i.VolumeSerialNumber!=p.Volume||(((ulong)i.FileIndexHigh<<32)|i.FileIndexLow)!=p.Index||IsDirectory(i)!=p.Directory||(i.FileAttributes&ATTR_REPARSE)!=0||!SamePath(FinalPath(p.Native),p.Path))throw new InvalidDataException("pin changed");if(!OnlyDefaultStream(p.Native))throw new InvalidDataException("alternate stream");if(!p.Directory&&i.NumberOfLinks!=1)throw new InvalidDataException("multi-link");}
@@ -184,6 +200,7 @@ function Convert-CcodRuntimeError($Action,[string]$DefaultId) {
         while ($null -ne $exception.InnerException -and $exception -is [Management.Automation.RuntimeException]) { $exception = $exception.InnerException }
         $message = [string]$exception.Message
         if ($message -ceq 'destination exists') { Throw-CcodInstallFileError 'CCOD_INSTALL_PROMOTION_DESTINATION_EXISTS' $message $null }
+        if ($message -ceq 'retirement destination exists') { Throw-CcodInstallFileError 'CCOD_INSTALL_RETIREMENT_DESTINATION_EXISTS' $message $null }
         if ($exception -is [ObjectDisposedException]) { Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' $message $null }
         if ($exception -is [Security.Cryptography.CryptographicException] -or $message -match 'seal mismatch') { Throw-CcodInstallFileError 'CCOD_INSTALL_SEAL_MISMATCH' $message $null }
         if ($message -match 'alternate stream') { Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' $message $null }
@@ -221,7 +238,7 @@ function Test-CcodSanitized($Value,[int]$Depth=0) {
     return $false
 }
 function Append-CcodInstallPinnedLog { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)]$Record) Assert-CcodLeaf $Leaf;if(-not(Test-CcodSanitized $Record)){Throw-CcodInstallFileError 'CCOD_INSTALL_LOG_RECORD_INVALID' 'Invalid log record' $null};$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;$bytes=[Text.UTF8Encoding]::new($false).GetBytes(($Record|ConvertTo-Json -Depth 8 -Compress)+"`n");if($bytes.Length-gt65536){Throw-CcodInstallFileError 'CCOD_INSTALL_LOG_RECORD_INVALID' 'Log record too large' $null};$token=Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime Append @($p.Token,$Leaf,$bytes)} 'CCOD_INSTALL_LOG_WRITE_FAILED';return Add-CcodPinCapability $Transaction $token File }
-function Remove-CcodInstallOwnedTree { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)][string]$Leaf) Assert-CcodLeaf $Leaf;$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime RemoveOwnedTree @($p.Token,$Leaf)|Out-Null} 'CCOD_INSTALL_DELETE_FAILED' }
+function Remove-CcodInstallOwnedTree { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)][string]$Leaf) Assert-CcodLeaf $Leaf;$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;$token=Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime RemoveOwnedTree @($p.Token,$Leaf)} 'CCOD_INSTALL_RETIREMENT_FAILED';if($null -eq $token){return [pscustomobject]@{Disposition='Deleted';Object=$null}};$capability=Add-CcodPinCapability $Transaction $token Directory;return [pscustomobject]@{Disposition='Retired';Object=$capability} }
 function Close-CcodInstallFileTransaction { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][ValidateSet('Ready','Failed')][string]$Disposition) $state=$null;if($null-eq$Transaction-or-not$script:CcodTransactions.TryGetValue($Transaction,[ref]$state)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Invalid install transaction capability' $null};if(-not$state.Closed){Invoke-CcodRuntimeMethod $state.Runtime Close @()|Out-Null;$state.Closed=$true;$state.Disposition=$Disposition} }
 
 Export-ModuleMember -Function Open-CcodInstallFileTransaction,Open-CcodInstallPinnedDirectory,New-CcodInstallPinnedTemporaryLeaf,Copy-CcodInstallSealedFile,Commit-CcodInstallPinnedPromotion,Write-CcodInstallPinnedJson,Append-CcodInstallPinnedLog,Remove-CcodInstallOwnedTree,Close-CcodInstallFileTransaction
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index 6da0951..814a443 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -101,6 +101,28 @@ public static class CcodInstallTransactionTestNative
             catch (UnauthorizedAccessException) { return "blocked"; }
         });
     }
+
+    public static Task<string> ProbeNamespaceAfterLeafUnlock(string watchedLeaf, string directory, string hardLinkSource, string hardLinkDestination)
+    {
+        return Task.Run(() => {
+            DateTime deadline = DateTime.UtcNow.AddSeconds(10);
+            while (DateTime.UtcNow < deadline)
+            {
+                try
+                {
+                    using (FileStream stream = File.Open(watchedLeaf, FileMode.Open, FileAccess.Write, FileShare.ReadWrite | FileShare.Delete)) { }
+                    int directoryError = TryOpenDirectoryForChildWrite(directory);
+                    int linkError = CreateHardLink(hardLinkDestination, hardLinkSource);
+                    return directoryError != 0 && linkError != 0 ? "blocked" : "escaped";
+                }
+                catch (IOException) { }
+                catch (UnauthorizedAccessException) { }
+                if (!Directory.Exists(directory)) return "retired-before-probe";
+                Thread.Yield();
+            }
+            return "timeout";
+        });
+    }
 }
 '@
 }
@@ -347,10 +369,11 @@ Invoke-CcodTest 'rejects promotion after an ancestor rename changes the pinned p
             } 'CCOD_INSTALL_PIN_CHANGED'
             Assert-CcodTrue ([IO.File]::Exists((Join-Path $attack.MovedDirectory 'payload.tmp'))) 'renamed-parent promotion retains its temporary candidate'
         } else {
-            Invoke-CcodInstallModule { param($Tx,$Parent,$Leaf) Commit-CcodInstallPinnedPromotion -Transaction $Tx -ParentDirectory $Parent -TemporaryLeaf $Leaf -DestinationLeaf 'payload.bin' } @($tx,$runtime,$temporary) | Out-Null
-            Close-CcodInstallFileTransaction -Transaction $tx -Disposition Ready | Out-Null
-            $fixture.Transaction = $null
-            Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 (Join-Path $fixture.Install 'runtime\payload.bin')) 'blocked parent rename promotes only sealed bytes'
+            Assert-CcodThrows {
+                Invoke-CcodInstallModule { param($Tx,$Parent,$Leaf) Commit-CcodInstallPinnedPromotion -Transaction $Tx -ParentDirectory $Parent -TemporaryLeaf $Leaf -DestinationLeaf 'payload.bin' } @($tx,$runtime,$temporary) | Out-Null
+            } 'CCOD_INSTALL_PROMOTION_FAILED'
+            Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $fixture.Install 'runtime\payload.bin'))) 'incompatible owned parent publishes no final destination'
+            Assert-CcodTrue ([IO.File]::Exists((Join-Path $fixture.Install 'runtime\payload.tmp'))) 'incompatible owned parent retains sealed temporary bytes'
         }
         Assert-CcodOutsideUnchanged $fixture 'renamed parent promotion'
     } finally { Remove-CcodInstallFileFixture $fixture }
@@ -384,7 +407,7 @@ foreach ($case in @('unknown','reparse','multilink')) {
     }
 }
 
-Invoke-CcodTest 'fails closed when a nonempty owned tree cannot establish every delete disposition' {
+Invoke-CcodTest 'retires a fully proven nonempty owned tree with every byte intact' {
     $fixture = New-CcodInstallFileFixture
     try {
         $source = New-CcodSourceFile $fixture
@@ -392,25 +415,90 @@ Invoke-CcodTest 'fails closed when a nonempty owned tree cannot establish every
         $candidate = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'candidate' -CreateIfMissing } @($tx)
         $temporary = Invoke-CcodInstallModule { param($Tx,$Parent) New-CcodInstallPinnedTemporaryLeaf -Transaction $Tx -ParentDirectory $Parent -Leaf 'payload.tmp' } @($tx,$candidate)
         Invoke-CcodInstallModule {
-            param($Tx,$Source,$Parent,$Leaf,$Length,$Sha)
+            param($Tx,$Source,$Leaf,$Length,$Sha)
             Copy-CcodInstallSealedFile -Transaction $Tx -SourcePath $Source -DestinationLeaf $Leaf -ExpectedLength $Length -ExpectedSha256 $Sha | Out-Null
-            Commit-CcodInstallPinnedPromotion -Transaction $Tx -ParentDirectory $Parent -TemporaryLeaf $Leaf -DestinationLeaf 'payload.bin' | Out-Null
-        } @($tx,$source.Path,$candidate,$temporary,$source.Length,$source.Sha256)
-        Assert-CcodThrows {
-            Invoke-CcodInstallModule { param($Tx) Remove-CcodInstallOwnedTree -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'candidate' } @($tx) | Out-Null
-        } 'CCOD_INSTALL_DELETE_FAILED'
-        Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $fixture.Install 'candidate'))) 'failed root disposition retains the owned directory'
-        Assert-CcodTrue ([IO.File]::Exists((Join-Path $fixture.Install 'candidate\payload.bin'))) 'failed root disposition clears the prior file disposition'
+        } @($tx,$source.Path,$temporary,$source.Length,$source.Sha256)
+        $retirement = Invoke-CcodInstallModule { param($Tx) Remove-CcodInstallOwnedTree -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'candidate' } @($tx)
+        Assert-CcodEqual 'Retired' $retirement.Disposition 'nonempty cleanup returns bounded retirement result'
+        Assert-CcodEqual '' (@($retirement.Object.PSObject.Properties.Name) -join ',') 'retired object capability exposes no path or handle'
+        Assert-CcodTrue (-not [IO.Directory]::Exists((Join-Path $fixture.Install 'candidate'))) 'one atomic retirement removes the live candidate name'
+        Close-CcodInstallFileTransaction -Transaction $tx -Disposition Failed | Out-Null
+        $fixture.Transaction = $null
+        $retired = @(Get-ChildItem -LiteralPath $fixture.Install -Directory -Force | Where-Object Name -Like '.__ccod_retired_*')
+        Assert-CcodEqual 1 $retired.Count 'exactly one retired quarantine object remains'
+        Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 (Join-Path $retired[0].FullName 'payload.tmp')) 'retired object retains every sealed payload byte'
         Assert-CcodOutsideUnchanged $fixture 'owned tree removal'
     } finally { Remove-CcodInstallFileFixture $fixture }
 }
 
+Invoke-CcodTest 'retirement collision leaves live candidate and collision untouched' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $source = New-CcodSourceFile $fixture
+        $collisionLeaf = '.__ccod_retired_forced_collision'
+        $collision = Join-Path $fixture.Install $collisionLeaf
+        [IO.Directory]::CreateDirectory($collision) | Out-Null
+        $collisionSentinel = Join-Path $collision 'collision.txt'
+        [IO.File]::WriteAllText($collisionSentinel, 'collision-original')
+        $collisionSha = Get-CcodTestFileSha256 $collisionSentinel
+        $tx = Open-CcodFixtureTransaction $fixture
+        $candidate = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' -CreateIfMissing
+        $temporary = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $candidate -Leaf 'payload.tmp'
+        Copy-CcodInstallSealedFile -Transaction $tx -SourcePath $source.Path -DestinationLeaf $temporary -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256 | Out-Null
+        Assert-CcodThrows {
+            Invoke-CcodInstallModule {
+                param($Tx,$Parent,$Leaf,$RetiredLeaf)
+                $pin = Get-CcodPinToken $Tx $Parent Directory
+                Convert-CcodRuntimeError {
+                    Invoke-CcodRuntimeMethod $pin.State.Runtime RemoveOwnedTreeCore @($pin.Token,$Leaf,$RetiredLeaf) | Out-Null
+                } 'CCOD_INSTALL_RETIREMENT_FAILED'
+            } @($tx,$tx.RootDirectory,'candidate',$collisionLeaf)
+        } 'CCOD_INSTALL_RETIREMENT_DESTINATION_EXISTS'
+        Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $fixture.Install 'candidate'))) 'collision retains the original live candidate name'
+        Close-CcodInstallFileTransaction -Transaction $tx -Disposition Failed | Out-Null
+        $fixture.Transaction = $null
+        Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 (Join-Path $fixture.Install 'candidate\payload.tmp')) 'collision retains every candidate byte'
+        Assert-CcodEqual $collisionSha (Get-CcodTestFileSha256 $collisionSentinel) 'collision target remains untouched'
+        Assert-CcodOutsideUnchanged $fixture 'retirement collision'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
+Invoke-CcodTest 'owned-parent promotion fails closed without publishing a copy' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $source = New-CcodSourceFile $fixture
+        $tx = Open-CcodFixtureTransaction $fixture
+        $candidate = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' -CreateIfMissing
+        $temporary = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $candidate -Leaf 'sealed.tmp'
+        Copy-CcodInstallSealedFile -Transaction $tx -SourcePath $source.Path -DestinationLeaf $temporary -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256 | Out-Null
+        Assert-CcodThrows {
+            Commit-CcodInstallPinnedPromotion -Transaction $tx -ParentDirectory $candidate -TemporaryLeaf $temporary -DestinationLeaf 'final.bin' | Out-Null
+        } 'CCOD_INSTALL_PROMOTION_FAILED'
+        Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $fixture.Install 'candidate\final.bin'))) 'failed owned-parent rename publishes no final destination'
+        Assert-CcodTrue ([IO.File]::Exists((Join-Path $fixture.Install 'candidate\sealed.tmp'))) 'failed owned-parent rename retains the sealed temporary leaf'
+        Assert-CcodOutsideUnchanged $fixture 'owned-parent promotion failure'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
+Invoke-CcodTest 'compatible-parent promotion is readable before transaction close' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $source = New-CcodSourceFile $fixture
+        $tx = Open-CcodFixtureTransaction $fixture
+        $temporary = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'readable.tmp'
+        Copy-CcodInstallSealedFile -Transaction $tx -SourcePath $source.Path -DestinationLeaf $temporary -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256 | Out-Null
+        Commit-CcodInstallPinnedPromotion -Transaction $tx -ParentDirectory $tx.RootDirectory -TemporaryLeaf $temporary -DestinationLeaf 'readable.bin' | Out-Null
+        Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 (Join-Path $fixture.Install 'readable.bin')) 'compatible atomic promotion is readable while transaction stays open'
+        Assert-CcodOutsideUnchanged $fixture 'readable compatible promotion'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
 Invoke-CcodTest 'deletes an empty fully-owned candidate after establishing its root disposition' {
     $fixture = New-CcodInstallFileFixture
     try {
         $tx = Open-CcodFixtureTransaction $fixture
         $candidate = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'empty-candidate' -CreateIfMissing
-        Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'empty-candidate'
+        Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'empty-candidate' | Out-Null
         Assert-CcodTrue (-not [IO.Directory]::Exists((Join-Path $fixture.Install 'empty-candidate'))) 'empty owned candidate is deleted only after its root disposition is established'
         Assert-CcodOutsideUnchanged $fixture 'empty owned tree removal'
     } finally { Remove-CcodInstallFileFixture $fixture }
@@ -427,7 +515,8 @@ foreach ($case in @('json','log')) {
                 if ($attack.Outcome -ceq 'replaced') {
                     Assert-CcodThrows { Invoke-CcodInstallModule { param($Tx,$Parent) Write-CcodInstallPinnedJson -Transaction $Tx -ParentDirectory $Parent -Leaf 'state.json' -Value ([ordered]@{ schemaVersion = 1; value = 'safe' }) -Compress } @($tx,$parent) } 'CCOD_INSTALL_PIN_CHANGED'
                 } else {
-                    Invoke-CcodInstallModule { param($Tx,$Parent) Write-CcodInstallPinnedJson -Transaction $Tx -ParentDirectory $Parent -Leaf 'state.json' -Value ([ordered]@{ schemaVersion = 1; value = 'safe' }) -Compress } @($tx,$parent) | Out-Null
+                    Assert-CcodThrows { Invoke-CcodInstallModule { param($Tx,$Parent) Write-CcodInstallPinnedJson -Transaction $Tx -ParentDirectory $Parent -Leaf 'state.json' -Value ([ordered]@{ schemaVersion = 1; value = 'safe' }) -Compress } @($tx,$parent) } 'CCOD_INSTALL_PROMOTION_FAILED'
+                    Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $fixture.Install "$case\state.json"))) 'incompatible owned JSON parent publishes no final state'
                 }
                 Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $fixture.Outside 'state.json'))) 'replaced JSON path is untouched'
             } else {
@@ -447,8 +536,8 @@ Invoke-CcodTest 'writes pinned JSON and appends sanitized records through relati
     $fixture = New-CcodInstallFileFixture
     try {
         $tx = Open-CcodFixtureTransaction $fixture
-        $state = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'state' -CreateIfMissing } @($tx)
-        $logs = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'logs' -CreateIfMissing } @($tx)
+        $state = $tx.RootDirectory
+        $logs = $tx.RootDirectory
         Invoke-CcodInstallModule { param($Tx,$Parent) Write-CcodInstallPinnedJson -Transaction $Tx -ParentDirectory $Parent -Leaf 'active.json' -Value ([ordered]@{ schemaVersion = 1; active = 'runtime-a' }) -Compress } @($tx,$state) | Out-Null
         Assert-CcodThrows {
             Invoke-CcodInstallModule { param($Tx,$Parent) Write-CcodInstallPinnedJson -Transaction $Tx -ParentDirectory $Parent -Leaf 'active.json' -Value ([ordered]@{ schemaVersion = 1; active = 'runtime-b' }) -Compress } @($tx,$state) | Out-Null
@@ -458,9 +547,9 @@ Invoke-CcodTest 'writes pinned JSON and appends sanitized records through relati
         Invoke-CcodInstallModule { param($Tx) Close-CcodInstallFileTransaction -Transaction $Tx -Disposition Ready } @($tx) | Out-Null
         $fixture.Transaction = $null
 
-        $json = [IO.File]::ReadAllText((Join-Path $fixture.Install 'state\active.json'), [Text.UTF8Encoding]::new($false)) | ConvertFrom-Json
+        $json = [IO.File]::ReadAllText((Join-Path $fixture.Install 'active.json'), [Text.UTF8Encoding]::new($false)) | ConvertFrom-Json
         Assert-CcodEqual 'runtime-a' $json.active 'no-replace pinned JSON preserves the first committed object'
-        $records = @([IO.File]::ReadAllLines((Join-Path $fixture.Install 'logs\install.log'), [Text.UTF8Encoding]::new($false)))
+        $records = @([IO.File]::ReadAllLines((Join-Path $fixture.Install 'install.log'), [Text.UTF8Encoding]::new($false)))
         Assert-CcodEqual 2 $records.Count 'pinned log appends one JSON line per record'
         Assert-CcodEqual 'one' (($records[0] | ConvertFrom-Json).event) 'first log record is retained'
         Assert-CcodEqual 'two' (($records[1] | ConvertFrom-Json).event) 'second log record is appended'
@@ -608,7 +697,7 @@ foreach ($directoryCase in @('root','child','owned')) {
     }
 }
 
-Invoke-CcodTest 'rolls back earlier delete dispositions when a later owned leaf cannot be deleted' {
+Invoke-CcodTest 'retires a nonempty tree containing a read-only owned leaf without changing bytes' {
     $fixture = New-CcodInstallFileFixture
     try {
         $tx = Open-CcodFixtureTransaction $fixture
@@ -616,27 +705,34 @@ Invoke-CcodTest 'rolls back earlier delete dispositions when a later owned leaf
         $first = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $candidate -Leaf 'a.tmp'
         $later = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $candidate -Leaf 'z.tmp'
         [IO.File]::SetAttributes((Join-Path $fixture.Install 'candidate\z.tmp'), [IO.FileAttributes]::ReadOnly)
-        Assert-CcodThrows {
-            Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate'
-        } 'CCOD_INSTALL_DELETE_FAILED'
-        Assert-CcodTrue ([IO.File]::Exists((Join-Path $fixture.Install 'candidate\a.tmp'))) 'later deletion failure restores the first leaf disposition'
-        Assert-CcodTrue ([IO.File]::Exists((Join-Path $fixture.Install 'candidate\z.tmp'))) 'later deletion failure retains the blocked leaf'
-        Assert-CcodOutsideUnchanged $fixture 'all-or-nothing delete rollback'
+        $result = Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate'
+        Assert-CcodEqual 'Retired' $result.Disposition 'read-only leaf uses atomic retirement instead of recursive deletion'
+        Assert-CcodTrue (-not [IO.Directory]::Exists((Join-Path $fixture.Install 'candidate'))) 'read-only candidate leaves the live namespace atomically'
+        Close-CcodInstallFileTransaction -Transaction $tx -Disposition Failed | Out-Null
+        $fixture.Transaction = $null
+        $retired = @(Get-ChildItem -LiteralPath $fixture.Install -Directory -Force | Where-Object Name -Like '.__ccod_retired_*')
+        Assert-CcodEqual 1 $retired.Count 'read-only candidate has one retired object'
+        Assert-CcodTrue ([IO.File]::Exists((Join-Path $retired[0].FullName 'a.tmp'))) 'first leaf remains in retired tree'
+        Assert-CcodTrue ([IO.File]::Exists((Join-Path $retired[0].FullName 'z.tmp'))) 'read-only leaf remains in retired tree'
+        Assert-CcodOutsideUnchanged $fixture 'read-only retirement'
     } finally { Remove-CcodInstallFileFixture $fixture }
 }
 
-Invoke-CcodTest 'clears a child-directory disposition when the later root mark fails' {
+Invoke-CcodTest 'retires a nested owned directory without releasing its contents' {
     $fixture = New-CcodInstallFileFixture
     try {
         $tx = Open-CcodFixtureTransaction $fixture
         $candidate = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' -CreateIfMissing
         $child = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $candidate -Leaf 'child' -CreateIfMissing
-        Assert-CcodThrows {
-            Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate'
-        } 'CCOD_INSTALL_DELETE_FAILED'
-        Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $fixture.Install 'candidate')) ) 'later root-mark failure retains the candidate root'
-        Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $fixture.Install 'candidate\child')) ) 'later root-mark failure clears the child-directory disposition'
-        Assert-CcodOutsideUnchanged $fixture 'directory disposition rollback'
+        $result = Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate'
+        Assert-CcodEqual 'Retired' $result.Disposition 'nested nonempty candidate is retired'
+        Assert-CcodTrue (-not [IO.Directory]::Exists((Join-Path $fixture.Install 'candidate'))) 'nested candidate live name disappears atomically'
+        Close-CcodInstallFileTransaction -Transaction $tx -Disposition Failed | Out-Null
+        $fixture.Transaction = $null
+        $retired = @(Get-ChildItem -LiteralPath $fixture.Install -Directory -Force | Where-Object Name -Like '.__ccod_retired_*')
+        Assert-CcodEqual 1 $retired.Count 'nested candidate has one retired object'
+        Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $retired[0].FullName 'child'))) 'nested child directory remains intact after retirement'
+        Assert-CcodOutsideUnchanged $fixture 'nested directory retirement'
     } finally { Remove-CcodInstallFileFixture $fixture }
 }
 
@@ -653,7 +749,8 @@ Invoke-CcodTest 'detects an unknown insertion between deletion planning and firs
         $unknown = Join-Path $fixture.Install 'candidate\concurrent-unknown.tmp'
         $attacker = [CcodInstallTransactionTestNative]::InsertUnknownAfterDelay($unknown, 1)
         $failure = $null
-        try { Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' }
+        $retirement = $null
+        try { $retirement = Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' }
         catch { $failure = $_ }
         $attackOutcome = $attacker.GetAwaiter().GetResult()
         Assert-CcodTrue ($attackOutcome -in @('inserted','blocked')) 'concurrent namespace attempt reaches the cleanup boundary'
@@ -663,7 +760,7 @@ Invoke-CcodTest 'detects an unknown insertion between deletion planning and firs
             Assert-CcodTrue ([IO.File]::Exists($unknown)) 'unproven concurrent object is retained for diagnosis'
             Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $fixture.Install 'candidate'))) 'concurrent insertion retains the complete candidate tree'
         } else {
-            Assert-CcodTrue ($null -ne $failure -and $failure.FullyQualifiedErrorId -like 'CCOD_INSTALL_DELETE_FAILED*') 'blocked insertion still fails closed when the nonempty root disposition is unsupported'
+            Assert-CcodTrue ($null -eq $failure -and $retirement.Disposition -ceq 'Retired') 'blocked insertion permits one atomic retirement'
         }
         Assert-CcodOutsideUnchanged $fixture 'concurrent cleanup insertion'
     } finally { Remove-CcodInstallFileFixture $fixture }
@@ -689,6 +786,32 @@ Invoke-CcodTest 'owned directory denies external child creation and hard-link in
     } finally { Remove-CcodInstallFileFixture $fixture }
 }
 
+Invoke-CcodTest 'target pin blocks namespace mutation after descendant handles are released' {
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $outsideSource = Join-Path $fixture.Outside 'outside-source.bin'
+        [IO.File]::WriteAllText($outsideSource, 'outside-source')
+        $tx = Open-CcodFixtureTransaction $fixture
+        $candidate = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' -CreateIfMissing
+        $first = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $candidate -Leaf 'a-first.tmp'
+        for ($index = 0; $index -lt 256; $index++) {
+            New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $candidate -Leaf ('b-{0:d3}.tmp' -f $index) | Out-Null
+        }
+        $candidatePath = Join-Path $fixture.Install 'candidate'
+        $probe = [CcodInstallTransactionTestNative]::ProbeNamespaceAfterLeafUnlock(
+            (Join-Path $candidatePath 'a-first.tmp'),
+            $candidatePath,
+            $outsideSource,
+            (Join-Path $candidatePath 'attacker-hardlink.bin')
+        )
+        $retirement = Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate'
+        Assert-CcodEqual 'Retired' $retirement.Disposition 'candidate retires after descendant release probe'
+        Assert-CcodEqual 'blocked' $probe.GetAwaiter().GetResult() 'retained target pin blocks child-write and hard-link namespace mutation after descendant release'
+        Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $candidatePath 'attacker-hardlink.bin'))) 'descendant-release probe creates no attacker hard link'
+        Assert-CcodOutsideUnchanged $fixture 'descendant-release namespace lock'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
 Invoke-CcodTest 'closing releases every sharing lock and rejects close-versus-relative operations' {
     $fixture = New-CcodInstallFileFixture
     try {

From 03de616da2da39f164ad90a1d830e6f742935bd5 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sat, 29 Aug 2026 18:09:04 +0800
Subject: [PATCH 070/187] docs: plan immutable generation release model

---
 .../2026-08-29-v2522-immutable-generation.md  | 602 ++++++++++++++++++
 ...08-29-v2522-immutable-generation-design.md | 165 +++++
 2 files changed, 767 insertions(+)
 create mode 100644 docs/superpowers/plans/2026-08-29-v2522-immutable-generation.md
 create mode 100644 docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md

diff --git a/docs/superpowers/plans/2026-08-29-v2522-immutable-generation.md b/docs/superpowers/plans/2026-08-29-v2522-immutable-generation.md
new file mode 100644
index 0000000..4e0f56e
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-29-v2522-immutable-generation.md
@@ -0,0 +1,602 @@
+# v2.5.22 Immutable Generation Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Make the unreleased v2.5.22 install and upgrade flow create only
+complete immutable generations, atomically select one active generation, and
+prove official draft assets on the current machine before public promotion.
+
+**Architecture:** The file layer creates and verifies unique generation trees
+with private handle capabilities and never overwrites an existing generation
+or recursively deletes a nonempty tree during install. The lifecycle appends a
+bounded phase record and uses a monotonic pointer/compensation protocol. Inno
+Setup is a bootstrap-only shell, while dual Defender receipts, exact assets,
+old-version upgrade, reboot, tray, and remote evidence form the final release
+promotion chain.
+
+**Tech Stack:** Windows PowerShell 5.1, .NET Framework/C# native interop,
+Inno Setup 6, Node.js 22, GitHub Actions, Microsoft Defender, existing
+PowerShell persistence and TrayHost self-tests.
+
+**Spec:** `docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md`
+
+## Global Constraints
+
+- Keep the unreleased version exactly `2.5.22`; no tag or public release is
+  created until the final external acceptance task.
+- Never modify `ChatGPT.exe`, `app.asar`, `WindowsApps`, account state, or the
+  DPAPI device-key store.
+- Preserve authenticated TrayHost wire messages, process identity checks, and
+  current-user installation semantics. Do not add a control channel, listener,
+  production test switch, or remote protocol.
+- The product's security boundary is current-user integrity and ordinary race
+  resistance. Do not claim protection against a same-user process with
+  unrestricted write/DACL authority; an elevated/signed broker is out of scope.
+- Staging creates unique generation files only. Existing generations and stable
+  files are never overwritten before readiness. Install-time cleanup retires
+  or retains old generations; it never recursively deletes a nonempty tree.
+- A failed pre-pointer phase leaves the old pointer and stable shell unchanged.
+  A post-pointer failure writes a higher compensating pointer or terminal
+  `Failed/CCOD_INSTALL_ROLLBACK_FAILED`; it never decrements a generation.
+- `Ready` requires matching pointer, generation manifest, expected version,
+  Supervisor, authenticated TrayHost, and activation receipt.
+- Setup/portable assets are selected by an explicit 11-name allowlist, not an
+  extension glob. Public promotion requires two real downloaded-asset Defender
+  receipts, complete automated acceptance, and individual manual evidence.
+- Every production change follows TDD RED → GREEN → focused review. Test
+  fixtures must not stop or start the real current-machine product.
+
+---
+
+### Task 1: Reduce the file layer to immutable generation primitives
+
+**Files:**
+- Modify: `src/persistence/modules/InstallFileTransaction.psm1`
+- Modify: `tests/persistence/InstallFileTransaction.SelfTest.ps1`
+- Modify: `tests/PersistenceSelfTest.ps1`
+- Modify: `tests/Validate.ps1`
+
+**Interfaces:**
+
+Replace the failed DACL/retirement implementation with these private
+create-only operations:
+
+```powershell
+Open-CcodInstallGeneration -InstallRoot <absolute-root> -RuntimeId <unique-id>
+New-CcodInstallGenerationLeaf -Generation <opaque-generation> -Leaf <single-segment>
+Copy-CcodInstallSealedSource -Generation <opaque-generation> -SourcePath <sealed-source> -Leaf <single-segment> -ExpectedLength <int64> -ExpectedSha256 <lowercase-hex>
+Write-CcodInstallGenerationManifest -Generation <opaque-generation> -Manifest <object>
+Commit-CcodInstallActivePointer -InstallRoot <absolute-root> -ExpectedPreviousGeneration <uint64> -NewRuntimeId <unique-id> -FileTransaction <opaque-context>
+Retire-CcodInstallGeneration -InstallRoot <absolute-root> -RuntimeId <owned-id> -FileTransaction <opaque-context>
+Close-CcodInstallFileTransaction -Transaction <opaque-context> -Disposition Ready|Failed
+```
+
+Capabilities are opaque reference tokens stored in module-private state. The
+CLR bridge exposes only a non-mutating marker; no public method accepts an
+arbitrary path or bare handle. There is no persistent DACL change and no
+nonempty recursive deletion operation.
+
+- [ ] **Step 1: Write failing immutable-generation tests**
+
+Add RED cases proving a duplicate generation ID, destination leaf, or pointer
+generation is rejected without changing the existing object. Add barriers for
+source replacement after handle open, generation manifest mutation after
+write, invalid reparse/ADS/multilink entries, forged/cross-transaction
+capabilities, and native handle close during a relative operation. Add a
+nonempty generation case whose live name is atomically retired to a unique
+owned quarantine name and whose bytes remain readable and unchanged.
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1
+```
+
+Expected: the new immutable names/operations are absent or the current DACL
+retirement/overwrite behavior fails the new assertions.
+
+- [ ] **Step 3: Implement minimal immutable file primitives**
+
+Use relative native creates under a validated generation parent, create-new
+leaf semantics, private source/destination handles, flush plus same-handle
+length/SHA-256 verification, and opaque capabilities. A destination that
+already exists fails with a stable collision code. Retire only a fully proven
+owned generation by no-replace relative rename; retain the quarantine tree.
+
+- [ ] **Step 4: Run GREEN and registration checks**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\PersistenceSelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\Validate.ps1 -SkipInstalledPackageCheck
+```
+
+The focused suite must exit zero. If the aggregate reaches the known local
+Bootstrap fallback/mutex boundary, record the exact case as environmental and
+not as a pass.
+
+- [ ] **Step 5: Commit**
+
+```text
+fix: use immutable generation file primitives
+```
+
+### Task 2: Migrate lifecycle data and pointer commits to immutable generations
+
+**Files:**
+- Modify: `src/persistence/modules/InstallLifecycle.psm1`
+- Modify: `src/persistence/modules/RuntimeManifest.psm1`
+- Modify: `src/persistence/modules/PersistenceIO.psm1`
+- Modify: `src/persistence/modules/StateStore.psm1`
+- Modify: `src/persistence/modules/UiPreferences.psm1`
+- Modify: `Install-CodexControlOtherDevices.ps1`
+- Modify: `tests/persistence/InstallLifecycle.SelfTest.ps1`
+- Modify: `tests/persistence/RuntimeManifest.SelfTest.ps1`
+- Modify: `tests/persistence/UninstallBootstrap.SelfTest.ps1`
+
+**Interfaces:**
+
+`Invoke-CcodInstall` consumes `-SealedPackageSha256` and a Task 1 opaque
+transaction. These private operations are added or adapted:
+
+```powershell
+New-CcodInstallTransactionRecord -TransactionId <guid> -OldRuntimeId <nullable> -OldGeneration <nullable-uint64> -NewRuntimeId <nullable> -NewGeneration <uint64> -SealedPackageSha256 <hex> -OwnedObjectNames <string[]>
+Read-CcodInstallTransactionRecord -InstallRoot <absolute-root>
+Set-CcodInstallTransactionPhase -InstallRoot <root> -TransactionId <guid> -ExpectedPhase <phase> -NewPhase <phase> -FileTransaction <context>
+Set-CcodActiveRuntime -InstallRoot <root> -NewRuntimeId <unique-id> -FileTransaction <context> -Ownership <fence>
+Write-CcodActivationReceiptFile -InstallRoot <root> -Receipt <object> -FileTransaction <context>
+Invoke-CcodInstallCompensation -InstallRoot <root> -TransactionRecord <record> -FileTransaction <context> -Adapters <hashtable>
+```
+
+The only phases are `Prepared`, `PackageVerified`, `RuntimeStaged`,
+`PreviousProtectionStopped`, `RuntimePromoted`, `PointerCommitted`,
+`StableShellCommitted`, `ProtectionReady`, `Ready`, and terminal `Failed`.
+
+- [ ] **Step 1: Write lifecycle RED cases**
+
+Inject failures through every phase. Assert pre-pointer failures leave the old
+pointer, generation, stable bootstrap, and uninstaller bytes unchanged. Assert
+post-pointer failures produce a higher compensating generation targeting the
+old runtime, or `Failed/CCOD_INSTALL_ROLLBACK_FAILED` while retaining both
+generations. Add tests for same-version/same-package idempotence,
+same-version/different-package `CCOD_INSTALL_PACKAGE_CONFLICT`, legacy installs
+without a transaction record, malformed phase records, and a pointer/manifests
+drift immediately before `Ready`.
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+```
+
+Expected: current path-based staging or pointer/receipt writes fail at the new
+phase and compensation expectations.
+
+- [ ] **Step 3: Implement the immutable lifecycle data plane**
+
+Create a unique generation and write every runtime file, manifest, state file,
+UI preference, transaction record, activation receipt, and sanitized lifecycle
+log through Task 1 create-only operations. Commit the active pointer atomically
+after runtime validation and before stable-shell commit. Never overwrite an
+existing generation or use `Remove-Item -Recurse` in install/recovery paths.
+On failure, retire or retain only owned candidates; do not delete unknown
+legacy files.
+
+- [ ] **Step 4: Run GREEN**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\RuntimeManifest.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\UninstallBootstrap.SelfTest.ps1
+```
+
+- [ ] **Step 5: Commit**
+
+```text
+fix: commit lifecycle through immutable generations
+```
+
+### Task 3: Build the sealed Setup package and bootstrap it without `{app}` writes
+
+**Files:**
+- Create: `build/InstallerPackage.psm1`
+- Modify: `build/build.ps1`
+- Modify: `build/CodexControlOtherDevices.iss`
+- Modify: `build/SetupArtifact.psm1`
+- Modify: `tools/New-InstallerDestinationInventory.ps1`
+- Modify: `Activate-CcodRemoteFix.ps1`
+- Modify: `Install-CodexControlOtherDevices.ps1`
+- Modify: `tests/persistence/ReleaseWorkflow.SelfTest.ps1`
+- Modify: `tests/persistence/InstallLifecycle.SelfTest.ps1`
+
+**Interfaces:**
+
+```powershell
+New-CcodInstallerPackage -PayloadRoot <root> -PayloadManifestPath <manifest> -Version 2.5.22 -GitCommit <40hex> -OutputPath <absolute-zip> -ManifestOutputPath <absolute-json>
+Test-CcodInstallerPackage -PackagePath <zip> -ManifestPath <json> -ExpectedPackageSha256 <hex> -ExpectedManifestSha256 <hex> -ExpectedVersion 2.5.22 -ExpectedGitCommit <40hex>
+```
+
+The Setup compiler binds `InstallerPackageSha256`,
+`InstallerPackageManifestSha256`, `ActivationBootstrapSha256`,
+`SetupGitCommit`, and `ProjectVersion`. Package, manifest, and bootstrap are
+`dontcopy` temporary inputs. Inno sets `CreateAppDir=no` and
+`Uninstallable=no`; its source has no pre-Ready `{app}` `[Files]`, `[Icons]`,
+`[Registry]`, or `[UninstallRun]` product write. The bootstrap scans the sealed
+package, invokes Task 2, and Setup accepts only strict `Ready`.
+
+- [ ] **Step 1: Write package/bootstrap RED tests**
+
+Reject missing/extra/duplicate/unsafe package entries and every version,
+commit, manifest, or package-hash mismatch before creating product state. Add a
+real compiled Inno fixture that fails if any pre-Ready `{app}` product write,
+recursive payload extraction, or `-File "{app}\Activate-CcodRemoteFix.ps1"`
+success path remains. Add a temporary-bootstrap replacement barrier proving
+the locked source bytes are the bytes executed.
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+```
+
+- [ ] **Step 3: Implement package binding and Setup bootstrap**
+
+Create/test the package archive from the existing manifest-listed payload.
+Extract and hash-bind only the temporary package, manifest, and bootstrap;
+retain their read-only handles through activation and terminal validation. Do
+not let Setup write product payloads into `{app}`. Ensure the bootstrap uses
+Task 2 and does not discover or execute a stale legacy app script.
+
+- [ ] **Step 4: Run GREEN**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+```
+
+- [ ] **Step 5: Commit**
+
+```text
+fix: bootstrap sealed installer package
+```
+
+### Task 4: Register the product and shortcuts only after Ready
+
+**Files:**
+- Create: `src/persistence/modules/ProductRegistration.psm1`
+- Modify: `src/persistence/modules/InstallLifecycle.psm1`
+- Modify: `src/persistence/modules/InstallFileTransaction.psm1`
+- Modify: `src/persistence/UninstallBootstrap.ps1`
+- Modify: `Uninstall-CodexControlOtherDevices.ps1`
+- Create: `tests/persistence/ProductRegistration.SelfTest.ps1`
+- Modify: `tests/persistence/InstallLifecycle.SelfTest.ps1`
+- Modify: `tests/persistence/UninstallBootstrap.SelfTest.ps1`
+
+**Interfaces:**
+
+```powershell
+New-CcodProductRegistration -InstallRoot <absolute-root> -RuntimeId <unique-id> -Version 2.5.22 -PackageSha256 <hex> -FileTransaction <context>
+Test-CcodProductRegistration -Registration <object> -ExpectedRuntimeId <unique-id> -ExpectedVersion 2.5.22 -ExpectedPackageSha256 <hex>
+Commit-CcodProductRegistration -Registration <object> -FileTransaction <context> -Adapters <hashtable>
+Remove-CcodLegacyProductRegistration -ExpectedAppId <canonical-guid> -Adapters <hashtable>
+```
+
+The module writes/read-backs exactly the current-user uninstall registration,
+Start-menu `CodexRemote-fix.lnk`, and desktop `CodexRemote-fix.lnk`. Shortcut
+candidate bytes are generated in a sealed runtime and copied through fixed
+current-user special-folder handles; arbitrary shortcut paths are rejected.
+
+- [ ] **Step 1: Write registration RED tests**
+
+Prove registration/shortcut writes before `Ready`, path/target mismatches,
+legacy-key mismatch, special-folder replacement, and write/read-back failures
+leave legacy registration and shortcut names untouched. Prove a valid Ready
+record reads back all three new records before removing only the exact legacy
+entries.
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ProductRegistration.SelfTest.ps1
+```
+
+- [ ] **Step 3: Implement post-Ready registration**
+
+Call the module only after Task 2's final `Ready` proof. Preserve legacy entries
+on any failure. Make direct uninstaller and Windows Settings launch the sealed
+stable generation and never remove unknown files/registry values.
+
+- [ ] **Step 4: Run GREEN**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ProductRegistration.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\UninstallBootstrap.SelfTest.ps1
+```
+
+- [ ] **Step 5: Commit**
+
+```text
+feat: register product only after readiness
+```
+
+### Task 5: Enforce dual Defender receipts and the exact 11-asset contract
+
+**Files:**
+- Create: `tools/ReleaseAssetContract.psm1`
+- Modify: `tools/Test-ReleaseDefender.ps1`
+- Modify: `Install-CodexRemote-fix.ps1`
+- Modify: `Activate-CcodRemoteFix.ps1`
+- Modify: `build/build.ps1`
+- Modify: `tests/persistence/ReleaseWorkflow.SelfTest.ps1`
+- Modify: `README.md`
+- Modify: `README.zh-CN.md`
+- Modify: `CHANGELOG.md`
+
+**Interfaces:**
+
+```powershell
+Get-CcodExpectedReleaseAssetNames -Version 2.5.22
+Test-CcodExactReleaseAssetSet -AssetDirectory <absolute-dir> -Version 2.5.22
+Invoke-CcodReleaseDefenderCheck -CandidatePath <setup-or-zip> -ChecksumPath <checksum> -ManifestPath <matching-manifest> -Origin TrustedWorkflowArtifact|InternetDownload -ExpectedVersion 2.5.22 -ExpectedGitCommit <40hex> -EvidencePath <new-file>
+Test-CcodReleasePromotionEvidence -EvidenceDirectory <absolute-dir> -Version 2.5.22 -ExpectedGitCommit <40hex>
+```
+
+The explicit public assets are:
+
+```text
+CodexRemote-fix-2.5.22-windows-x64.zip
+CodexRemote-fix-2.5.22-windows-x64.zip.sha256.txt
+CodexRemote-fix-2.5.22-trayhost-provenance.json
+CodexRemote-fix-2.5.22-payload-manifest.json
+CodexRemote-fix-2.5.22-release-manifest.json
+CodexRemote-fix-2.5.22-setup.exe
+CodexRemote-fix-2.5.22-setup.exe.sha256.txt
+CodexRemote-fix-2.5.22-setup-provenance.json
+CodexRemote-fix-2.5.22-setup-payload-manifest.json
+CodexRemote-fix-2.5.22-setup-destination-inventory.iss
+CodexRemote-fix-2.5.22-setup-release-manifest.json
+```
+
+Receipts are evidence only, not public assets. A receipt binds asset type/hash,
+matching manifest hash, version, commit, origin, Defender service/AV/real-time
+state, signature/platform versions and timestamps, and zero new detections.
+
+- [ ] **Step 1: Write Defender/asset RED tests**
+
+Add failures for missing/extra/case-varied/reparse assets, every receipt binding
+mismatch, duplicate/swapped/missing Setup/ZIP receipt, disabled Defender or
+real-time protection, missing/stale signatures, scan errors, detections,
+existing/reparse evidence files, and portable/Setup scan failure before any
+activation state is created. Add documentation REDs rejecting the old Chinese
+“已验证……均可用” wording and unqualified stable claims.
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+```
+
+- [ ] **Step 3: Implement the contract**
+
+Centralize asset names and manifest checks. Keep `InternetDownload` strict
+about actual ZoneId 3; allow `TrustedWorkflowArtifact` only with a matching
+workflow artifact identity. Add the Setup scan before `Prepared`, preserve the
+portable scan, and make README/CHANGELOG describe only enforced behavior.
+
+- [ ] **Step 4: Run GREEN**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\PortableRelease.SelfTest.ps1
+```
+
+These are deterministic contracts; live Defender evidence is produced only by
+Task 7 on the official downloaded draft.
+
+- [ ] **Step 5: Commit**
+
+```text
+feat: require dual Defender release evidence
+```
+
+### Task 6: Add clean-runner and draft-only release promotion
+
+**Files:**
+- Create: `tools/Test-CleanReleaseRunner.ps1`
+- Create: `tools/Invoke-GitHubDraftRelease.ps1`
+- Modify: `.github/workflows/ci.yml`
+- Modify: `.github/workflows/release.yml`
+- Modify: `tests/persistence/ReleaseWorkflow.SelfTest.ps1`
+- Modify: `tests/persistence/Bootstrap.SelfTest.ps1`
+
+**Interfaces:**
+
+```powershell
+Test-CcodCleanReleaseRunner -RepositoryRoot <absolute-root> -ExpectedVersion 2.5.22
+Invoke-CcodGitHubDraftRelease -Mode Stage|Verify|Promote -Tag v2.5.22 -AssetDirectory <absolute-dir> -EvidenceDirectory <absolute-dir>
+```
+
+`Stage` runs only after clean preflight, validation, traces, and build. It
+creates a private draft, uploads exactly the 11 names above, and reads every
+asset back. `Promote` is local and cannot rebuild; it requires Task 5 receipts
+and Task 8/9 acceptance evidence. Pin Actions to the reviewed commits:
+
+```text
+actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+```
+
+- [ ] **Step 1: Write workflow RED tests**
+
+Reject an installed state, occupied account mutex, dirty checkout, missing
+preflight, unpinned action, extension glob, extra/missing asset, public-first
+release, upload failure that calls public promotion, rebuilt publish candidate,
+missing dual receipt, missing acceptance evidence, conditional bypass,
+`continue-on-error`, or same-tag concurrent stage.
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\Bootstrap.SelfTest.ps1
+```
+
+- [ ] **Step 3: Implement clean/draft workflow**
+
+Make clean preflight the first release job, transfer one immutable candidate
+between jobs, and never rebuild in publish. Stage leaves a draft private on
+any failure. Verify performs exact manifest/hash read-back. Promote requires
+the evidence directory and changes only the already verified draft.
+
+- [ ] **Step 4: Run GREEN**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\Bootstrap.SelfTest.ps1
+```
+
+- [ ] **Step 5: Commit**
+
+```text
+fix: stage releases behind draft promotion gates
+```
+
+### Task 7: Build the official-draft acceptance state machine
+
+**Files:**
+- Create: `tests/installed/OfficialDraftAcceptance.psm1`
+- Create: `tests/installed/Invoke-OfficialDraftAcceptance.ps1`
+- Create: `tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1`
+- Modify: `tests/installed/Invoke-InstalledLifecycleIntegration.ps1`
+- Modify: `tests/persistence/InstalledLifecycleHarness.SelfTest.ps1`
+- Modify: `tests/Validate.ps1`
+
+**Interfaces:**
+
+```powershell
+Invoke-CcodOfficialDraftAcceptance `
+  -Phase Preflight|LegacyUpgrade|Uninstall|FreshInstall|PreReboot|PostReboot|ReadyForManualEvidence `
+  -AssetDirectory <official-draft-download> `
+  -PreviousAssetDirectory <official-v2.5.21-download> `
+  -EvidenceRoot <absolute-nonreparse-root> `
+  -AllowMachineMutation -AllowCodexRestart -AllowWindowsReboot
+```
+
+`Preflight` downloads must retain actual ZoneId 3 and invokes the real Defender
+checker once for Setup and once for portable before any machine mutation. The
+legacy upgrade must use a checksum/manifest-bound public v2.5.21 Setup. The
+receipt is append-only and contains only candidate/manifest hashes, tag/ID,
+phase, and sanitized facts.
+
+- [ ] **Step 1: Write acceptance RED tests**
+
+Before any adapter mutation, reject missing/extra assets, bad manifest/commit/
+hash, missing dual scan receipts, missing authorization switches, wrong phase
+order, candidate changes, and receipt tampering. Add fixtures requiring the
+legacy upgrade, complete uninstall with unchanged DPAPI key hash, fresh
+install, pre/post reboot identity, one Supervisor/TrayHost, Idle transition,
+and strict active generation/Ready facts.
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\OfficialDraftAcceptanceHarness.SelfTest.ps1
+```
+
+- [ ] **Step 3: Implement fixture-safe phase orchestration**
+
+Use injectable adapters for all tests. The real runner performs the exact
+sequence `Preflight → LegacyUpgrade → Uninstall → FreshInstall → PreReboot →
+PostReboot → ReadyForManualEvidence`; no automated fixture starts a real
+installer or reboots Windows.
+
+- [ ] **Step 4: Run GREEN**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\OfficialDraftAcceptanceHarness.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstalledLifecycleHarness.SelfTest.ps1
+```
+
+- [ ] **Step 5: Commit**
+
+```text
+test: record official draft lifecycle acceptance
+```
+
+### Task 8: Require manual tray/remote evidence and prepare promotion
+
+**Files:**
+- Modify: `tests/installed/OfficialDraftAcceptance.psm1`
+- Modify: `tests/installed/Invoke-OfficialDraftAcceptance.ps1`
+- Modify: `tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1`
+- Modify: `tools/Invoke-GitHubDraftRelease.ps1`
+- Modify: `README.md`
+- Modify: `README.zh-CN.md`
+- Modify: `CHANGELOG.md`
+
+**Interfaces:**
+
+```powershell
+Invoke-CcodOfficialDraftAcceptance -Phase TrayEvidence|RemoteEvidence|Complete -TrayOperation About|Language|OpenLogs|Repair -RemoteOperation SecondDeviceControl -EvidenceRoot <absolute-root> -ScreenshotPath <regular-file> -RedactedLogPath <regular-file> -ReviewState Reviewed
+```
+
+`TrayEvidence` requires one reviewed record for each named operation, with
+expected terminal state and distinct screenshot/log hashes. `RemoteEvidence`
+requires the second device to discover, connect, and control this device.
+`Complete` requires all five manual records plus every Task 7 phase; it is not a
+free-text confirmation. `Promote` requires `Complete` and the two live Defender
+receipts before making the draft public.
+
+- [ ] **Step 1: Write manual-evidence RED tests**
+
+Reject missing, duplicate, unreviewed, reused, non-file, reparse, or
+cross-candidate evidence. Reject completion without all four tray operations,
+second-device control, or the Task 7 receipt chain. Assert documentation has
+no unqualified “stable/verified” claim before evidence.
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\OfficialDraftAcceptanceHarness.SelfTest.ps1
+```
+
+- [ ] **Step 3: Implement the promotion evidence gate and concise docs**
+
+Hash and review only bounded screenshot/redacted-log files. Keep both READMEs
+candidate-oriented and keep technical details in CHANGELOG/release notes. The
+promotion command must fail closed unless the exact draft, dual real scan
+receipts, full lifecycle receipt, and all five manual records match.
+
+- [ ] **Step 4: Run GREEN**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\OfficialDraftAcceptanceHarness.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1
+```
+
+- [ ] **Step 5: Commit**
+
+```text
+test: gate release on tray and remote evidence
+```
+
+## Final verification and external acceptance (after all task reviews)
+
+1. Create a fresh detached worktree at the final reviewed commit; ensure no
+   pre-existing `build/dist` and run the clean-runner preflight.
+2. Run the full clean-runner suite, including `npm test`, installed lifecycle,
+   release contract, TrayHost protocol/production/trace, the build, and both
+   manifest validators. Any nonzero stops publication.
+3. Run `Stage` to create the private official draft. Download Setup and ZIP in
+   the browser so ZoneId 3 is real; run the two live Defender scans and save
+   receipts before machine mutation.
+4. Use the manifest-bound public v2.5.21 Setup for `LegacyUpgrade`, then
+   complete `Uninstall`, `FreshInstall`, `PreReboot`, and `PostReboot` with the
+   explicit user-authorized machine mutation/reboot switches.
+5. Manually perform and record About, language switching, Open logs, Repair,
+   and second-device connection/control. Only a reviewed `Complete` receipt
+   permits local `Promote` of the already verified draft.
+6. After promotion, re-download the public assets, re-run exact manifest/hash
+   validation, and verify the public tag points to the final reviewed commit.
diff --git a/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md b/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
new file mode 100644
index 0000000..9e4359a
--- /dev/null
+++ b/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
@@ -0,0 +1,165 @@
+# v2.5.22 Immutable Generation Install Design
+
+## Status
+
+The user confirmed this revised model on 2026-08-29. It replaces the
+unreleased v2.5.22 transaction design's attempted persistent DACL/recursive
+deletion boundary. No v2.5.22 tag or public release exists.
+
+## Goal
+
+Make fresh installation, legacy upgrade, same-version repair, and reboot
+recovery converge on a complete, manifest-bound current-user runtime without
+ever activating a partially copied generation. A failure retains the last
+known-good generation and leaves the new generation inactive and diagnosable.
+
+## Security model
+
+The product remains a current-user utility. It defends against accidental and
+ordinary pathname races by using unique create-only generations, strict
+manifest/hash/version checks, and atomic pointer commits. It does not claim to
+defeat a same-user process that already has unrestricted write/DACL authority;
+that guarantee would require an elevated or signed broker, which is outside
+this product's current-user scope.
+
+This design never modifies `ChatGPT.exe`, `app.asar`, `WindowsApps`, account
+state, or the current-user DPAPI device-key store. It does not add a remote
+control channel or change the authenticated TrayHost wire contract.
+
+## Invariants
+
+- Every generation directory and file name is unique and create-only. No
+  existing runtime or stable shell is overwritten during staging.
+- A generation becomes eligible only after every manifest-listed file is
+  copied, flushed, and rehashed, and its runtime manifest/version/commit match.
+- The only mutable install control record is a small atomic active-generation
+  pointer. It includes a monotonically increasing generation number and the
+  previous generation ID.
+- Before pointer commit, the old pointer and stable bootstrap remain untouched.
+  After pointer commit, any failure appends a higher compensating pointer to the
+  retained old generation; it never decrements or rewrites a generation.
+- Installation never recursively deletes a nonempty runtime or package tree in
+  its hot path. Old and failed generations are retained under an owned retired
+  namespace until a separately verified maintenance/uninstall operation.
+- `Ready` requires the active pointer, generation manifest, Supervisor,
+  authenticated TrayHost, expected version, and activation receipt to agree.
+- Setup and portable inputs are Defender-scanned before activation; public
+  promotion requires exact asset read-back, two actual downloaded-asset scan
+  receipts, complete old-version upgrade/fresh-install/reboot evidence, and the
+  named tray/remote manual evidence.
+
+## Architecture
+
+### 1. Immutable package and generation layout
+
+Build creates a single manifest-bound Setup package containing the complete
+runtime and stable-shell candidates. The package and its manifest are extracted
+to a private Setup temporary directory and validated before any install-state
+write.
+
+The bootstrap asks the file layer to create a unique generation such as
+`runtime\<runtimeId>` and copies only manifest-listed files there. The runtime
+manifest is written as the final generation file, then validated through the
+same create-only path. Existing generations are never used as a source root.
+
+Stable `bootstrap.ps1` and `Uninstall-CodexControlOtherDevices.ps1` are
+generated as new candidates inside the generation. They are made visible only
+after the active pointer is committed and the new protection has reached
+verified readiness. An upgrade does not overwrite a stable file while the new
+generation is still incomplete.
+
+### 2. Small pinned file layer without persistent DACL mutation
+
+`InstallFileTransaction.psm1` keeps only opaque transaction capabilities and
+native handles needed to create/read/flush/hash a unique generation. It exposes
+no arbitrary native helper, raw stream, or caller-mutable seal state.
+
+Required operations are create-only:
+
+```powershell
+Open-CcodInstallGeneration -InstallRoot <absolute-root> -RuntimeId <unique-id>
+New-CcodInstallGenerationLeaf -Generation <opaque-generation> -Leaf <single-segment>
+Copy-CcodInstallSealedSource -Generation <opaque-generation> -SourcePath <sealed-source> -Leaf <single-segment> -ExpectedLength <int64> -ExpectedSha256 <hex>
+Write-CcodInstallGenerationManifest -Generation <opaque-generation> -Manifest <object>
+Commit-CcodInstallActivePointer -InstallRoot <absolute-root> -ExpectedPreviousGeneration <uint64> -NewRuntimeId <unique-id> -FileTransaction <context>
+Retire-CcodInstallGeneration -InstallRoot <absolute-root> -RuntimeId <owned-id> -FileTransaction <context>
+Close-CcodInstallFileTransaction -Transaction <opaque-context> -Disposition Ready|Failed
+```
+
+`Retire-CcodInstallGeneration` removes a generation from the active namespace
+by an atomic create-only pointer/retired-record update; it does not recursively
+delete the nonempty directory. Physical reclamation is a later operation that
+requires no running owner and a complete safe-tree proof. This avoids a
+partial-delete rollback claim and avoids persistent DACL changes.
+
+### 3. Append-only phase and compensation record
+
+The bootstrap writes a bounded install transaction record under `state` with
+the transaction ID, old/new runtime IDs, old/new generation, package hash,
+phase, and stable error code. The phases are:
+
+```text
+Prepared -> PackageVerified -> RuntimeStaged -> PreviousProtectionStopped
+          -> RuntimePromoted -> PointerCommitted -> StableShellCommitted
+          -> ProtectionReady -> Ready
+```
+
+`Failed` is the only terminal error phase and carries one canonical `CCOD_*`
+code. All records are atomically written through the file layer. A failure
+before `PointerCommitted` leaves the old pointer and bootstrap untouched. A
+failure from `PointerCommitted` onward writes a higher compensating pointer to
+the retained old generation and proves its Supervisor/TrayHost; if proof fails,
+it retains both generations, writes `Failed/CCOD_INSTALL_ROLLBACK_FAILED`, and
+does not claim readiness.
+
+Legacy installations without this record are treated as `Idle` after the
+existing pointer/runtime identity checks. Same-version repair is idempotent
+only when the package hash matches; a different hash returns a conflict before
+pointer mutation.
+
+### 4. Setup and product registration
+
+The Inno shell uses `CreateAppDir=no` and `Uninstallable=no` and has no
+pre-Ready `[Files]`, `[Icons]`, `[Registry]`, or `[UninstallRun]` product
+writes. It extracts only the package, manifest, and activation bootstrap to its
+private temporary area, locks and validates them, and invokes the bootstrap.
+The bootstrap performs the generation transaction and Setup waits for strict
+`Ready` validation.
+
+After `Ready`, a product-registration module writes and reads back the exact
+current-user uninstall registration and the two exact `CodexRemote-fix`
+Start-menu/desktop shortcut records. It then removes only exact legacy
+registration/shortcut entries. A failed migration leaves the legacy entries.
+
+### 5. Defender, draft, and final acceptance
+
+Portable scans its verified payload before installation. Setup scans its
+verified private package before `Prepared`. The release contract has exactly
+these 11 public assets for v2.5.22:
+
+```text
+CodexRemote-fix-2.5.22-windows-x64.zip
+CodexRemote-fix-2.5.22-windows-x64.zip.sha256.txt
+CodexRemote-fix-2.5.22-trayhost-provenance.json
+CodexRemote-fix-2.5.22-payload-manifest.json
+CodexRemote-fix-2.5.22-release-manifest.json
+CodexRemote-fix-2.5.22-setup.exe
+CodexRemote-fix-2.5.22-setup.exe.sha256.txt
+CodexRemote-fix-2.5.22-setup-provenance.json
+CodexRemote-fix-2.5.22-setup-payload-manifest.json
+CodexRemote-fix-2.5.22-setup-destination-inventory.iss
+CodexRemote-fix-2.5.22-setup-release-manifest.json
+```
+
+The destination inventory name above is checked as part of the release contract.
+Defender receipts are evidence files, not public release assets. The local
+official-draft preflight downloads the Setup and ZIP
+through a browser, requires actual ZoneId 3, scans each with the real Defender
+entry, and records receipts bound to both asset hashes and the matching commit.
+
+The final current-machine acceptance must prove: manifest-bound v2.5.21 Setup
+upgrade; complete uninstall while preserving the DPAPI key hash; fresh v2.5.22
+install; reboot auto-recovery; exactly one Supervisor and authenticated
+TrayHost; and individual About, Language, OpenLogs, Repair, and second-device
+remote-control evidence. The README remains candidate-oriented until those
+facts are recorded; release notes may summarize only recorded facts.

From e3ad4f703884ed6893f89565b2bcdc925977a37d Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sat, 29 Aug 2026 19:18:23 +0800
Subject: [PATCH 071/187] fix: use immutable generation file primitives

---
 .../modules/InstallFileTransaction.psm1       | 347 ++++---
 tests/PersistenceSelfTest.ps1                 |   8 +-
 tests/Validate.ps1                            |   5 +
 .../InstallFileTransaction.SelfTest.ps1       | 954 +++---------------
 4 files changed, 359 insertions(+), 955 deletions(-)

diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index 3ca21a6..cb3ab93 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -1,7 +1,7 @@
 Set-StrictMode -Version Latest
 
 $script:CcodTransactions = [Runtime.CompilerServices.ConditionalWeakTable[object,object]]::new()
-$script:CcodPins = [Runtime.CompilerServices.ConditionalWeakTable[object,object]]::new()
+$script:CcodScopes = [Runtime.CompilerServices.ConditionalWeakTable[object,object]]::new()
 
 function Throw-CcodInstallFileError {
     param([string]$Id,[string]$Message,$Target)
@@ -9,34 +9,35 @@ function Throw-CcodInstallFileError {
 }
 
 function Initialize-CcodInstallRuntime {
-    if ($null -eq ('CcodInstallCapabilityMarker' -as [type])) {
-        Add-Type -TypeDefinition @'
+    if ($null -ne ('CcodInstallCapabilityMarker' -as [type])) { return }
+    Add-Type -TypeDefinition @'
 using System;
 using System.Collections.Generic;
 using System.ComponentModel;
 using System.IO;
-using System.Runtime.InteropServices;
 using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
 using System.Security.Cryptography;
-using System.Security.AccessControl;
-using System.Security.Principal;
 using System.Text;
 using Microsoft.Win32.SafeHandles;
 
-public sealed class CcodInstallCapabilityMarker { private CcodInstallCapabilityMarker() {} public static int CapabilityAbi { get { return 1; } } }
+public sealed class CcodInstallCapabilityMarker
+{
+    private CcodInstallCapabilityMarker() { }
+    public static int CapabilityAbi { get { return 1; } }
+}
 
 internal sealed class CcodInstallRuntime : IDisposable
 {
-    private const uint READ = 0x80000000, WRITE = 0x40000000, DELETE = 0x00010000, READ_CONTROL = 0x00020000, WRITE_DAC = 0x00040000, SYNC = 0x00100000;
+    private const uint READ = 0x80000000, WRITE = 0x40000000, DELETE = 0x00010000, SYNC = 0x00100000;
     private const uint READ_ATTRIBUTES = 0x80, LIST_DIRECTORY = 0x1, ADD_FILE = 0x2, ADD_SUBDIRECTORY = 0x4;
     private const uint SHARE_READ = 1, SHARE_WRITE = 2, SHARE_DELETE = 4;
-    private const uint OPEN = 1, CREATE = 2, OPEN_IF = 3;
+    private const uint OPEN = 1, CREATE = 2;
     private const uint DIRECTORY = 1, WRITE_THROUGH = 2, SYNC_IO = 0x20, NON_DIRECTORY = 0x40, BACKUP_INTENT = 0x4000, OPEN_REPARSE = 0x200000;
-    private const uint FLAG_BACKUP = 0x02000000, FLAG_REPARSE = 0x00200000, FLAG_WRITE_THROUGH = 0x80000000;
+    private const uint FLAG_BACKUP = 0x02000000, FLAG_REPARSE = 0x00200000;
     private const uint OPEN_EXISTING = 3, OBJ_CASE_INSENSITIVE = 0x40, ATTR_DIRECTORY = 0x10, ATTR_REPARSE = 0x400;
-    private const int FileRenameInformation = 10, FileDispositionInformation = 13, FileStreamInfo = 7, FileDirectoryInformation = 1;
+    private const int FileRenameInformation = 10, FileStreamInfo = 7, FileDirectoryInformation = 1;
     private const int STATUS_NO_MORE_FILES = unchecked((int)0x80000006);
-    private const uint DACL_SECURITY_INFORMATION = 0x00000004, PROTECTED_DACL_SECURITY_INFORMATION = 0x80000000, UNPROTECTED_DACL_SECURITY_INFORMATION = 0x20000000;
 
     [StructLayout(LayoutKind.Sequential)] private struct UNICODE_STRING { public ushort Length, MaximumLength; public IntPtr Buffer; }
     [StructLayout(LayoutKind.Sequential)] private struct OBJECT_ATTRIBUTES { public int Length; public IntPtr RootDirectory, ObjectName; public uint Attributes; public IntPtr SecurityDescriptor, SecurityQualityOfService; }
@@ -48,197 +49,215 @@ internal sealed class CcodInstallRuntime : IDisposable
         public uint VolumeSerialNumber, FileSizeHigh, FileSizeLow, NumberOfLinks, FileIndexHigh, FileIndexLow;
     }
 
-    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] private static extern SafeFileHandle CreateFileW(string p,uint a,uint s,IntPtr sec,uint c,uint f,IntPtr t);
-    [DllImport("kernel32.dll", SetLastError=true)] private static extern bool GetFileInformationByHandle(SafeFileHandle h,out FILE_INFO i);
-    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] private static extern uint GetFinalPathNameByHandleW(SafeFileHandle h,StringBuilder b,uint l,uint f);
-    [DllImport("kernel32.dll", SetLastError=true)] private static extern bool GetFileInformationByHandleEx(SafeFileHandle h,int c,IntPtr i,uint s);
-    [DllImport("kernel32.dll", SetLastError=true)] private static extern bool SetFileInformationByHandle(SafeFileHandle h,int c,IntPtr i,uint s);
-    [DllImport("ntdll.dll")] private static extern int NtCreateFile(out IntPtr h,uint a,ref OBJECT_ATTRIBUTES o,out IO_STATUS_BLOCK i,IntPtr z,uint fa,uint sh,uint d,uint op,IntPtr e,uint el);
-    [DllImport("ntdll.dll")] private static extern int NtQueryDirectoryFile(SafeFileHandle h,IntPtr e,IntPtr a,IntPtr c,out IO_STATUS_BLOCK i,IntPtr f,uint l,int cl,bool one,IntPtr n,bool restart);
-    [DllImport("ntdll.dll")] private static extern int NtSetInformationFile(SafeFileHandle h,out IO_STATUS_BLOCK i,IntPtr f,uint l,int cl);
-    [DllImport("ntdll.dll")] private static extern uint RtlNtStatusToDosError(int s);
-    [DllImport("advapi32.dll", SetLastError=true)] private static extern bool GetKernelObjectSecurity(SafeFileHandle h,uint i,byte[] sd,uint length,out uint needed);
-    [DllImport("advapi32.dll", SetLastError=true)] private static extern bool SetKernelObjectSecurity(SafeFileHandle h,uint i,byte[] sd);
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] private static extern SafeFileHandle CreateFileW(string path,uint access,uint share,IntPtr security,uint creation,uint flags,IntPtr template);
+    [DllImport("kernel32.dll", SetLastError=true)] private static extern bool GetFileInformationByHandle(SafeFileHandle handle,out FILE_INFO info);
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] private static extern uint GetFinalPathNameByHandleW(SafeFileHandle handle,StringBuilder buffer,uint length,uint flags);
+    [DllImport("kernel32.dll", SetLastError=true)] private static extern bool GetFileInformationByHandleEx(SafeFileHandle handle,int infoClass,IntPtr info,uint size);
+    [DllImport("ntdll.dll")] private static extern int NtCreateFile(out IntPtr handle,uint access,ref OBJECT_ATTRIBUTES attributes,out IO_STATUS_BLOCK io,IntPtr allocationSize,uint fileAttributes,uint share,uint disposition,uint options,IntPtr ea,uint eaLength);
+    [DllImport("ntdll.dll")] private static extern int NtQueryDirectoryFile(SafeFileHandle handle,IntPtr evt,IntPtr apc,IntPtr context,out IO_STATUS_BLOCK io,IntPtr info,uint length,int infoClass,bool single,IntPtr name,bool restart);
+    [DllImport("ntdll.dll")] private static extern int NtSetInformationFile(SafeFileHandle handle,out IO_STATUS_BLOCK io,IntPtr info,uint length,int infoClass);
+    [DllImport("ntdll.dll")] private static extern uint RtlNtStatusToDosError(int status);
 
     private sealed class Pin : IDisposable
     {
-        internal readonly object Token = new object(); internal readonly Pin Parent; internal string Leaf, Path;
-        internal readonly bool Directory, Owned; internal SafeFileHandle Handle; internal FileStream Stream; internal byte[] OriginalSecurity; internal bool RestoreSecurity;
-        internal readonly uint Volume; internal readonly ulong Index; internal bool Closed, Sealed; internal long SealedLength; internal string SealedSha;
-        internal Pin(Pin parent,string leaf,string path,bool dir,bool owned,SafeFileHandle handle,FileStream stream,FILE_INFO info)
-        { Parent=parent;Leaf=leaf;Path=path;Directory=dir;Owned=owned;Handle=handle;Stream=stream;Volume=info.VolumeSerialNumber;Index=((ulong)info.FileIndexHigh<<32)|info.FileIndexLow; }
+        internal readonly object Token = new object();
+        internal readonly Pin Parent; internal string Leaf, Path;
+        internal readonly bool Directory, Owned; internal SafeFileHandle Handle; internal FileStream Stream;
+        internal readonly uint Volume; internal readonly ulong Index; internal bool Closed, Sealed, Manifest;
+        internal Pin(Pin parent,string leaf,string path,bool directory,bool owned,SafeFileHandle handle,FileStream stream,FILE_INFO info)
+        { Parent=parent;Leaf=leaf;Path=path;Directory=directory;Owned=owned;Handle=handle;Stream=stream;Volume=info.VolumeSerialNumber;Index=((ulong)info.FileIndexHigh<<32)|info.FileIndexLow; }
         internal SafeFileHandle Native { get { return Stream != null ? Stream.SafeFileHandle : Handle; } }
-        public void Dispose() { if(Closed)return; Closed=true; if(RestoreSecurity&&Handle!=null)RestoreDirectorySecurity(Handle,OriginalSecurity);if(Stream!=null)Stream.Dispose(); else if(Handle!=null)Handle.Dispose(); }
+        public void Dispose() { if(Closed)return;Closed=true;if(Stream!=null)Stream.Dispose();else if(Handle!=null)Handle.Dispose(); }
     }
 
-    private readonly string rootPath; private readonly Pin root;
-    private readonly Dictionary<object,Pin> pins = new Dictionary<object,Pin>(ReferenceEqualityComparer.Instance);
+    private sealed class ReferenceComparer : IEqualityComparer<object>
+    { internal static readonly ReferenceComparer Instance=new ReferenceComparer();public new bool Equals(object x,object y){return Object.ReferenceEquals(x,y);}public int GetHashCode(object x){return RuntimeHelpers.GetHashCode(x);} }
+    private sealed class OpenResult { internal SafeFileHandle Handle; internal bool Created; internal OpenResult(SafeFileHandle handle,bool created){Handle=handle;Created=created;} }
+
+    private readonly string installRoot; private readonly Pin root, runtimeParent;
+    private readonly Dictionary<object,Pin> pins = new Dictionary<object,Pin>(ReferenceComparer.Instance);
     private readonly Dictionary<string,Pin> names = new Dictionary<string,Pin>(StringComparer.OrdinalIgnoreCase);
+    private readonly List<FileStream> externalStreams = new List<FileStream>();
     private bool disposed;
 
-    private sealed class ReferenceEqualityComparer : IEqualityComparer<object>
-    { internal static readonly ReferenceEqualityComparer Instance=new ReferenceEqualityComparer(); public new bool Equals(object x,object y){return Object.ReferenceEquals(x,y);} public int GetHashCode(object x){return System.Runtime.CompilerServices.RuntimeHelpers.GetHashCode(x);} }
+    private CcodInstallRuntime(string installRoot,Pin root,Pin runtimeParent)
+    { this.installRoot=installRoot;this.root=root;this.runtimeParent=runtimeParent;AddPin(root);AddPin(runtimeParent); }
 
-    private CcodInstallRuntime(string path,Pin rootPin) { rootPath=path;root=rootPin;pins.Add(root.Token,root); }
-    internal static object Open(string path,out CcodInstallRuntime runtime)
+    internal static object Open(string path,string runtimeId,out CcodInstallRuntime runtime)
     {
-        runtime=null; string full=Path.GetFullPath(path).TrimEnd('\\');
-        SafeFileHandle h=CreateFileW(full,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,IntPtr.Zero,OPEN_EXISTING,FLAG_BACKUP|FLAG_REPARSE,IntPtr.Zero);
-        if(h.IsInvalid)throw new Win32Exception(Marshal.GetLastWin32Error());
-        try { FILE_INFO i=Info(h); if(!IsDirectory(i)||(i.FileAttributes&ATTR_REPARSE)!=0||!SamePath(FinalPath(h),full))throw new InvalidDataException("root invalid");if(!OnlyDefaultStream(h))throw new InvalidDataException("alternate stream");
-            Pin p=new Pin(null,"",full,true,false,h,null,i); h=null; runtime=new CcodInstallRuntime(full,p); return p.Token; }
-        finally { if(h!=null)h.Dispose(); }
-    }
-    [MethodImpl(MethodImplOptions.Synchronized)] internal object OpenDirectory(object parentToken,string leaf,bool create)
-    {
-        Pin parent=Require(parentToken,true); ValidateCurrent(parent); string key=Key(parent,leaf); Pin known; if(names.TryGetValue(key,out known)){ValidateCurrent(known);return known.Token;}
-        OpenResult r=null;
-        if(create){try{r=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|READ_CONTROL|WRITE_DAC|SYNC,SHARE_READ,CREATE,DIRECTORY|BACKUP_INTENT);}catch(Win32Exception x){if(x.NativeErrorCode!=80&&x.NativeErrorCode!=183)throw;r=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);}}
-        else r=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);
-        try { FILE_INFO i=Info(r.Handle); if(!IsDirectory(i)||(i.FileAttributes&ATTR_REPARSE)!=0||!OnlyDefaultStream(r.Handle))throw new InvalidDataException("directory invalid");
-            string path=Path.Combine(parent.Path,leaf); if(!SamePath(FinalPath(r.Handle),path))throw new InvalidDataException("path changed");
-            Pin p=new Pin(parent,leaf,path,true,r.Created,r.Handle,null,i);r.Handle=null;AddPin(key,p);return p.Token; }
-        finally { if(r.Handle!=null)r.Handle.Dispose(); }
-    }
-    [MethodImpl(MethodImplOptions.Synchronized)] internal object CreateTemporary(object parentToken,string leaf)
+        runtime=null;string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle rootHandle=OpenAbsoluteDirectory(full,true);Pin rootPin=null,runtimePin=null;
+        try
+        {
+            rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;
+            OpenResult runtimeResult;
+            try { runtimeResult=OpenRelative(rootPin.Native,"runtime",LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,CREATE,DIRECTORY|BACKUP_INTENT); }
+            catch(Win32Exception exception) { if(exception.NativeErrorCode!=80&&exception.NativeErrorCode!=183)throw;runtimeResult=OpenRelative(rootPin.Native,"runtime",LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT); }
+            try { runtimePin=ValidateDirectoryPin(rootPin,"runtime",Path.Combine(full,"runtime"),false,runtimeResult.Handle);runtimeResult.Handle=null; }
+            finally { if(runtimeResult.Handle!=null)runtimeResult.Handle.Dispose(); }
+            OpenResult generationResult=OpenRelative(runtimePin.Native,runtimeId,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ,CREATE,DIRECTORY|BACKUP_INTENT);
+            try
+            {
+                Pin generation=ValidateDirectoryPin(runtimePin,runtimeId,Path.Combine(runtimePin.Path,runtimeId),true,generationResult.Handle);generationResult.Handle=null;
+                runtime=new CcodInstallRuntime(full,rootPin,runtimePin);rootPin=null;runtimePin=null;runtime.AddPin(generation);return generation.Token;
+            }
+            finally { if(generationResult.Handle!=null)generationResult.Handle.Dispose(); }
+        }
+        catch { if(runtimePin!=null)runtimePin.Dispose();if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw; }
+    }
+
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object CreateDirectory(object parentToken,string leaf)
     {
-        Pin parent=Require(parentToken,true);ValidateCurrent(parent);string key=Key(parent,leaf);if(names.ContainsKey(key))throw new IOException("exists");
-        OpenResult r=OpenRelative(parent.Native,leaf,READ|WRITE|DELETE|SYNC,SHARE_READ,CREATE,NON_DIRECTORY|WRITE_THROUGH);
-        FileStream s=null;try{s=new FileStream(r.Handle,FileAccess.ReadWrite,65536,false);r.Handle=null;FILE_INFO i=Info(s.SafeFileHandle);ValidatePlain(i,s.SafeFileHandle);Pin p=new Pin(parent,leaf,Path.Combine(parent.Path,leaf),false,true,null,s,i);s=null;AddPin(key,p);return p.Token;}
-        finally{if(s!=null)s.Dispose();if(r.Handle!=null)r.Handle.Dispose();}
+        Pin parent=Require(parentToken,true);ValidateCurrent(parent);OpenResult result=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ,CREATE,DIRECTORY|BACKUP_INTENT);
+        try { Pin pin=ValidateDirectoryPin(parent,leaf,Path.Combine(parent.Path,leaf),true,result.Handle);result.Handle=null;AddPin(pin);return pin.Token; }
+        finally { if(result.Handle!=null)result.Handle.Dispose(); }
     }
-    [MethodImpl(MethodImplOptions.Synchronized)] internal object Copy(object destinationToken,string source,long expectedLength,string expectedSha)
+
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object Copy(object parentToken,string leaf,string source,long expectedLength,string expectedSha)
     {
-        Pin d=Require(destinationToken,false);ValidateCurrent(d);if(!d.Owned)throw new InvalidDataException("destination not owned");
-        string full=Path.GetFullPath(source); SafeFileHandle sh=CreateFileW(full,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,IntPtr.Zero,OPEN_EXISTING,FLAG_REPARSE,IntPtr.Zero);if(sh.IsInvalid)throw new Win32Exception(Marshal.GetLastWin32Error());
-        try{FILE_INFO si=Info(sh);ValidatePlain(si,sh);if(!SamePath(FinalPath(sh),full))throw new InvalidDataException("source path");using(FileStream ss=new FileStream(sh,FileAccess.Read,65536,false)){sh=null;if(ss.Length!=expectedLength||Sha(ss)!=expectedSha)throw new InvalidDataException("source mismatch");ss.Position=0;d.Stream.Position=0;d.Stream.SetLength(0);ss.CopyTo(d.Stream);d.Stream.Flush(true);string actual=Sha(d.Stream);if(d.Stream.Length!=expectedLength||actual!=expectedSha)throw new InvalidDataException("destination mismatch");d.Sealed=true;d.SealedLength=expectedLength;d.SealedSha=expectedSha;}}finally{if(sh!=null)sh.Dispose();}
-        return d.Token;
+        Pin parent=Require(parentToken,true);ValidateCurrent(parent);string full=Path.GetFullPath(source);
+        SafeFileHandle sourceHandle=CreateFileW(full,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,IntPtr.Zero,OPEN_EXISTING,FLAG_REPARSE,IntPtr.Zero);
+        if(sourceHandle.IsInvalid)throw new Win32Exception(Marshal.GetLastWin32Error());FileStream sourceStream=null,destinationStream=null;OpenResult destinationResult=null;
+        try
+        {
+            FILE_INFO sourceInfo=Info(sourceHandle);ValidatePlain(sourceInfo,sourceHandle);if(!SamePath(FinalPath(sourceHandle),full))throw new InvalidDataException("source path changed");
+            sourceStream=new FileStream(sourceHandle,FileAccess.Read,65536,false);sourceHandle=null;
+            if(sourceStream.Length!=expectedLength||Sha(sourceStream)!=expectedSha)throw new InvalidDataException("source mismatch");sourceStream.Position=0;
+            destinationResult=OpenRelative(parent.Native,leaf,READ|WRITE|SYNC,SHARE_READ,CREATE,NON_DIRECTORY|WRITE_THROUGH);
+            destinationStream=new FileStream(destinationResult.Handle,FileAccess.ReadWrite,65536,false);destinationResult.Handle=null;
+            FILE_INFO destinationInfo=Info(destinationStream.SafeFileHandle);ValidatePlain(destinationInfo,destinationStream.SafeFileHandle);
+            Pin destination=new Pin(parent,leaf,Path.Combine(parent.Path,leaf),false,true,null,destinationStream,destinationInfo);destinationStream=null;
+            sourceStream.CopyTo(destination.Stream);destination.Stream.Flush(true);
+            if(destination.Stream.Length!=expectedLength||Sha(destination.Stream)!=expectedSha)throw new InvalidDataException("destination mismatch");destination.Sealed=true;MakeReadable(destination);AddPin(destination);externalStreams.Add(sourceStream);sourceStream=null;return destination.Token;
+        }
+        finally { if(sourceStream!=null)sourceStream.Dispose();if(sourceHandle!=null)sourceHandle.Dispose();if(destinationStream!=null)destinationStream.Dispose();if(destinationResult!=null&&destinationResult.Handle!=null)destinationResult.Handle.Dispose(); }
     }
-    [MethodImpl(MethodImplOptions.Synchronized)] internal object Promote(object parentToken,object tempToken,string destination)
+
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object Write(object parentToken,string leaf,byte[] bytes,bool manifest)
     {
-        Pin parent=Require(parentToken,true),temp=Require(tempToken,false);ValidateCurrent(parent);ValidateCurrent(temp);
-        if(temp.Parent!=parent||!temp.Owned||!temp.Sealed)throw new InvalidDataException("promotion invalid");
-        if(temp.Stream.Length!=temp.SealedLength||Sha(temp.Stream)!=temp.SealedSha)throw new CryptographicException("seal mismatch");
-        SafeFileHandle existing=null;try{try{existing=OpenRelative(parent.Native,destination,READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,BACKUP_INTENT).Handle;}catch(Win32Exception x){if(x.NativeErrorCode!=2&&x.NativeErrorCode!=3)throw;}if(existing!=null)throw new IOException("destination exists");}
-        finally{if(existing!=null)existing.Dispose();}
-        int ec=Rename(temp.Native,parent.Native,destination);if(ec==80||ec==183)throw new IOException("destination exists");if(ec!=0)throw new Win32Exception(ec);names.Remove(Key(parent,temp.Leaf));temp.Leaf=destination;temp.Path=Path.Combine(parent.Path,destination);names.Add(Key(parent,destination),temp);MakeReadable(temp);ValidateCurrent(temp);return temp.Token;
-    }
-    [MethodImpl(MethodImplOptions.Synchronized)] internal object WriteJson(object parentToken,string leaf,byte[] bytes)
-    { Pin parent=Require(parentToken,true);ValidateCurrent(parent);object t=CreateTemporary(parentToken,".json."+Guid.NewGuid().ToString("N")+".tmp");Pin p=Require(t,false);Write(p,bytes);p.Sealed=true;p.SealedLength=bytes.LongLength;p.SealedSha=Sha(p.Stream);return Promote(parentToken,t,leaf); }
-    [MethodImpl(MethodImplOptions.Synchronized)] internal object Append(object parentToken,string leaf,byte[] bytes)
+        Pin parent=Require(parentToken,true);ValidateCurrent(parent);OpenResult result=OpenRelative(parent.Native,leaf,READ|WRITE|DELETE|SYNC,SHARE_READ,CREATE,NON_DIRECTORY|WRITE_THROUGH);FileStream stream=null;
+        try
+        {
+            stream=new FileStream(result.Handle,FileAccess.ReadWrite,65536,false);result.Handle=null;FILE_INFO info=Info(stream.SafeFileHandle);ValidatePlain(info,stream.SafeFileHandle);Pin pin=new Pin(parent,leaf,Path.Combine(parent.Path,leaf),false,true,null,stream,info);stream=null;
+            pin.Stream.Write(bytes,0,bytes.Length);pin.Stream.Flush(true);string sha=Sha(pin.Stream);if(pin.Stream.Length!=bytes.LongLength)throw new InvalidDataException("destination mismatch");pin.Sealed=true;pin.Manifest=manifest;if(manifest)MakeReadable(pin);AddPin(pin);return new object[]{pin.Token,pin.Stream.Length,sha};
+        }
+        finally { if(stream!=null)stream.Dispose();if(result.Handle!=null)result.Handle.Dispose(); }
+    }
+
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object CommitPointer(object generationToken,ulong previousGeneration,string runtimeId,byte[] bytes)
     {
-        Pin parent=Require(parentToken,true);ValidateCurrent(parent);string key=Key(parent,leaf);Pin p;
-        if(!names.TryGetValue(key,out p)){OpenResult r=OpenRelative(parent.Native,leaf,READ|WRITE|DELETE|SYNC,SHARE_READ,OPEN_IF,NON_DIRECTORY|WRITE_THROUGH);FileStream s=null;try{s=new FileStream(r.Handle,FileAccess.ReadWrite,65536,false);r.Handle=null;FILE_INFO i=Info(s.SafeFileHandle);ValidatePlain(i,s.SafeFileHandle);p=new Pin(parent,leaf,Path.Combine(parent.Path,leaf),false,r.Created,null,s,i);s=null;AddPin(key,p);}finally{if(s!=null)s.Dispose();if(r.Handle!=null)r.Handle.Dispose();}}
-        ValidateCurrent(p);p.Stream.Position=p.Stream.Length;p.Stream.Write(bytes,0,bytes.Length);p.Stream.Flush(true);return p.Token;
+        Pin generation=Require(generationToken,true);ValidateCurrent(generation);if(!Object.ReferenceEquals(generation.Parent,runtimeParent)||!String.Equals(generation.Leaf,runtimeId,StringComparison.Ordinal))throw new InvalidDataException("transaction scope");
+        Pin manifest=null;if(!names.TryGetValue(Key(generation,"manifest.json"),out manifest)||!manifest.Manifest||!manifest.Sealed)throw new InvalidDataException("manifest missing");ValidateCurrent(manifest);
+        Pin state=OpenOrCreateDirectory(root,"state"),pointer=OpenOrCreateDirectory(state,"active-generation");if(CurrentPointerGeneration(pointer)!=previousGeneration)throw new InvalidOperationException("pointer generation exists");string leaf=(previousGeneration+1).ToString("D20")+".json";return WriteAtomic(pointer,leaf,bytes);
     }
-    [MethodImpl(MethodImplOptions.Synchronized)] internal object RemoveOwnedTree(object parentToken,string leaf)
-    {return RemoveOwnedTreeCore(parentToken,leaf,".__ccod_retired_"+Guid.NewGuid().ToString("N"));}
-    [MethodImpl(MethodImplOptions.Synchronized)] private object RemoveOwnedTreeCore(object parentToken,string leaf,string retiredLeaf)
+
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object Retire(object generationToken,string runtimeId,string retiredLeaf,byte[] record)
     {
-        Pin parent=Require(parentToken,true);ValidateCurrent(parent);Pin target;string key=Key(parent,leaf);if(!names.TryGetValue(key,out target)||!target.Owned||!target.Directory)throw new InvalidDataException("unknown target");
-        List<Pin> plan=new List<Pin>();BuildPlan(target,plan);RevalidatePlan(target,plan);
-        if(plan.Count==0){int ec=SetDeleteOnClose(target.Native,true,true);if(ec!=0)throw new Win32Exception(ec);ValidateCurrent(target);RemovePin(target);return null;}
-        SafeFileHandle collision=null;try{try{collision=OpenRelative(parent.Native,retiredLeaf,READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,BACKUP_INTENT).Handle;}catch(Win32Exception x){if(x.NativeErrorCode!=2&&x.NativeErrorCode!=3)throw;}if(collision!=null)throw new IOException("retirement destination exists");}finally{if(collision!=null)collision.Dispose();}
-        List<Pin> restricted=RestrictRetirementTree(target,plan);try{RevalidatePlan(target,plan);}catch{RestoreLiveDirectorySecurity(restricted);throw;}ReleaseDescendants(plan);ValidateCurrent(target);int rec=Rename(target.Native,parent.Native,retiredLeaf);if(rec!=0){RestoreDirectorySecurity(target.Native,target.OriginalSecurity);target.RestoreSecurity=false;RestoreReleasedChildSecurity(target);ReopenKnownTree(target);if(rec==80||rec==183)throw new IOException("retirement destination exists");throw new Win32Exception(rec);}MoveDirectoryPin(target,retiredLeaf,Path.Combine(parent.Path,retiredLeaf));RestoreReleasedChildSecurity(target);ValidateCurrent(target);return target.Token;
+        Pin generation=Require(generationToken,true);ValidateCurrent(generation);if(!Object.ReferenceEquals(generation.Parent,runtimeParent)||!String.Equals(generation.Leaf,runtimeId,StringComparison.Ordinal)||!generation.Owned)throw new InvalidDataException("generation not owned");
+        ValidateOwnedTree(generation);Pin retired=OpenOrCreateDirectory(root,"retired"),state=OpenOrCreateDirectory(root,"state"),retirements=OpenOrCreateDirectory(state,"retirements");ReleaseDescendants(generation);int error=Rename(generation.Native,retired.Native,retiredLeaf);if(error!=0)throw new Win32Exception(error);MoveDirectoryPin(generation,retired,retiredLeaf,Path.Combine(retired.Path,retiredLeaf));
+        WriteAtomic(retirements,retiredLeaf+".json",record);return generation.Token;
     }
-    [MethodImpl(MethodImplOptions.Synchronized)] internal void Close(){if(disposed)return;disposed=true;List<Pin> all=new List<Pin>(pins.Values);for(int i=all.Count-1;i>=0;i--)all[i].Dispose();pins.Clear();names.Clear();}
+
+    [MethodImpl(MethodImplOptions.Synchronized)] internal void Close()
+    { if(disposed)return;disposed=true;foreach(FileStream stream in externalStreams)stream.Dispose();externalStreams.Clear();List<Pin> all=new List<Pin>(pins.Values);for(int i=all.Count-1;i>=0;i--)all[i].Dispose();pins.Clear();names.Clear(); }
     public void Dispose(){Close();}
 
-    private void BuildPlan(Pin dir,List<Pin> plan){ValidateCurrent(dir);foreach(string n in Enumerate(dir.Native)){Pin p;string k=Key(dir,n);if(!names.TryGetValue(k,out p)||!p.Owned){ProbeUnknown(dir,n);throw new InvalidDataException("unknown leaf");}ValidateCurrent(p);if(p.Directory)BuildPlan(p,plan);plan.Add(p);}}
-    private static void ProbeUnknown(Pin dir,string name){OpenResult r=OpenRelative(dir.Native,name,READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,BACKUP_INTENT);try{FILE_INFO i=Info(r.Handle);if((i.FileAttributes&ATTR_REPARSE)!=0)throw new InvalidDataException("reparse leaf");if(!OnlyDefaultStream(r.Handle))throw new InvalidDataException("alternate stream");if(!IsDirectory(i)&&i.NumberOfLinks!=1)throw new InvalidDataException("multi-link");}finally{r.Handle.Dispose();}}
-    private void RevalidatePlan(Pin target,List<Pin> plan){List<Pin> second=new List<Pin>();BuildPlan(target,second);if(second.Count!=plan.Count)throw new InvalidDataException("namespace changed");for(int i=0;i<plan.Count;i++)if(!Object.ReferenceEquals(plan[i],second[i]))throw new InvalidDataException("namespace changed");foreach(Pin p in plan){ValidateCurrent(p);if(p.Directory&&(Info(p.Native).FileAttributes&1)!=0)throw new Win32Exception(5);}ValidateCurrent(target);if((Info(target.Native).FileAttributes&1)!=0)throw new Win32Exception(5);}
-    private void RemovePin(Pin p){string k=Key(p.Parent,p.Leaf);p.Dispose();pins.Remove(p.Token);names.Remove(k);}
-    private void MoveDirectoryPin(Pin dir,string newLeaf,string newPath){string oldKey=Key(dir.Parent,dir.Leaf),oldPath=dir.Path;names.Remove(oldKey);dir.Leaf=newLeaf;dir.Path=newPath;names.Add(Key(dir.Parent,newLeaf),dir);string prefix=oldPath.TrimEnd('\\')+"\\";foreach(Pin p in pins.Values)if(!Object.ReferenceEquals(p,dir)&&p.Path.StartsWith(prefix,StringComparison.OrdinalIgnoreCase))p.Path=newPath+"\\"+p.Path.Substring(prefix.Length);}
-    private static void ReleaseDescendants(List<Pin> plan){foreach(Pin p in plan){if(p.Stream!=null){p.Stream.Dispose();p.Stream=null;}else if(p.Handle!=null){p.Handle.Dispose();p.Handle=null;}}}
-    private void ReopenKnownTree(Pin dir){List<Pin> children=new List<Pin>();foreach(Pin p in pins.Values)if(Object.ReferenceEquals(p.Parent,dir)&&!p.Closed)children.Add(p);foreach(Pin p in children){if(p.Directory){uint share=p.Owned?SHARE_READ:(SHARE_READ|SHARE_WRITE);OpenResult r=OpenRelative(dir.Native,p.Leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,share,OPEN,DIRECTORY|BACKUP_INTENT);p.Handle=r.Handle;ValidateCurrent(p);ReopenKnownTree(p);}else{OpenResult r=OpenRelative(dir.Native,p.Leaf,READ|WRITE|DELETE|SYNC,SHARE_READ,OPEN,NON_DIRECTORY|WRITE_THROUGH);p.Stream=new FileStream(r.Handle,FileAccess.ReadWrite,65536,false);r.Handle=null;ValidateCurrent(p);}}}
-    private static void MakeReadable(Pin p){OpenResult bridge=OpenRelative(p.Parent.Native,p.Leaf,READ|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE|SHARE_DELETE,OPEN,NON_DIRECTORY);FILE_INFO bi=Info(bridge.Handle);if(bi.VolumeSerialNumber!=p.Volume||(((ulong)bi.FileIndexHigh<<32)|bi.FileIndexLow)!=p.Index){bridge.Handle.Dispose();throw new InvalidDataException("pin changed");}p.Stream.Dispose();p.Stream=null;OpenResult strict=OpenRelative(p.Parent.Native,p.Leaf,READ|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,NON_DIRECTORY);bridge.Handle.Dispose();p.Stream=new FileStream(strict.Handle,FileAccess.Read,65536,false);strict.Handle=null;}
-    private Pin Require(object token,bool directory){if(disposed)throw new ObjectDisposedException("transaction");Pin p;if(token==null||!pins.TryGetValue(token,out p)||p.Closed||p.Directory!=directory)throw new InvalidDataException("invalid capability");return p;}
-    private void AddPin(string key,Pin p){pins.Add(p.Token,p);names.Add(key,p);}
-    private static byte[] ReadDirectorySecurity(SafeFileHandle h){uint needed;GetKernelObjectSecurity(h,DACL_SECURITY_INFORMATION,null,0,out needed);int e=Marshal.GetLastWin32Error();if(needed==0)throw new Win32Exception(e);byte[] sd=new byte[needed];if(!GetKernelObjectSecurity(h,DACL_SECURITY_INFORMATION,sd,(uint)sd.Length,out needed))throw new Win32Exception(Marshal.GetLastWin32Error());return sd;}
-    private static byte[] RestrictRetirementDirectory(SafeFileHandle h){byte[] original=ReadDirectorySecurity(h);RawSecurityDescriptor raw=new RawSecurityDescriptor(original,0);RawAcl acl=raw.DiscretionaryAcl??new RawAcl(GenericAcl.AclRevision,1);int denyMask=0x00000002|0x00000004|0x00000010|0x00000040|0x00000100|0x00010000;acl.InsertAce(0,new CommonAce(AceFlags.None,AceQualifier.AccessDenied,denyMask,new SecurityIdentifier(WellKnownSidType.WorldSid,null),false,null));raw.DiscretionaryAcl=acl;raw.SetFlags(raw.ControlFlags|ControlFlags.DiscretionaryAclPresent|ControlFlags.DiscretionaryAclProtected);byte[] restricted=new byte[raw.BinaryLength];raw.GetBinaryForm(restricted,0);if(!SetKernelObjectSecurity(h,DACL_SECURITY_INFORMATION|PROTECTED_DACL_SECURITY_INFORMATION,restricted))throw new Win32Exception(Marshal.GetLastWin32Error());return original;}
-    private static void RestoreDirectorySecurity(SafeFileHandle h,byte[] original){if(original==null)return;RawSecurityDescriptor raw=new RawSecurityDescriptor(original,0);uint flags=DACL_SECURITY_INFORMATION|(((raw.ControlFlags&ControlFlags.DiscretionaryAclProtected)!=0)?PROTECTED_DACL_SECURITY_INFORMATION:UNPROTECTED_DACL_SECURITY_INFORMATION);if(!SetKernelObjectSecurity(h,flags,original))throw new Win32Exception(Marshal.GetLastWin32Error());}
-    private static List<Pin> RestrictRetirementTree(Pin target,List<Pin> plan){List<Pin> restricted=new List<Pin>();try{target.OriginalSecurity=RestrictRetirementDirectory(target.Native);target.RestoreSecurity=true;restricted.Add(target);foreach(Pin p in plan)if(p.Directory){p.OriginalSecurity=RestrictRetirementDirectory(p.Native);p.RestoreSecurity=true;restricted.Add(p);}return restricted;}catch{RestoreLiveDirectorySecurity(restricted);throw;}}
-    private static void RestoreLiveDirectorySecurity(List<Pin> restricted){for(int i=restricted.Count-1;i>=0;i--){Pin p=restricted[i];RestoreDirectorySecurity(p.Native,p.OriginalSecurity);p.RestoreSecurity=false;p.OriginalSecurity=null;}}
-    private void RestoreReleasedChildSecurity(Pin dir){List<Pin> children=new List<Pin>();foreach(Pin p in pins.Values)if(Object.ReferenceEquals(p.Parent,dir)&&p.Directory&&!p.Closed)children.Add(p);foreach(Pin child in children){OpenResult r=OpenRelative(dir.Native,child.Leaf,READ_ATTRIBUTES|READ_CONTROL|WRITE_DAC|SYNC,SHARE_READ|SHARE_WRITE|SHARE_DELETE,OPEN,DIRECTORY|BACKUP_INTENT);RestoreDirectorySecurity(r.Handle,child.OriginalSecurity);child.RestoreSecurity=false;child.OriginalSecurity=null;child.Handle=r.Handle;RestoreReleasedChildSecurity(child);child.Handle.Dispose();child.Handle=null;}}
-    private static string Key(Pin p,string leaf){return p.Index.ToString("x16")+"|"+leaf.ToLowerInvariant();}
-    private static void Write(Pin p,byte[] b){p.Stream.Position=0;p.Stream.SetLength(0);p.Stream.Write(b,0,b.Length);p.Stream.Flush(true);}
-    private static void ValidateCurrent(Pin p){FILE_INFO i=Info(p.Native);if(i.VolumeSerialNumber!=p.Volume||(((ulong)i.FileIndexHigh<<32)|i.FileIndexLow)!=p.Index||IsDirectory(i)!=p.Directory||(i.FileAttributes&ATTR_REPARSE)!=0||!SamePath(FinalPath(p.Native),p.Path))throw new InvalidDataException("pin changed");if(!OnlyDefaultStream(p.Native))throw new InvalidDataException("alternate stream");if(!p.Directory&&i.NumberOfLinks!=1)throw new InvalidDataException("multi-link");}
-    private static void ValidatePlain(FILE_INFO i,SafeFileHandle h){if(IsDirectory(i))throw new InvalidDataException("file type");if((i.FileAttributes&ATTR_REPARSE)!=0)throw new InvalidDataException("reparse leaf");if(i.NumberOfLinks!=1)throw new InvalidDataException("multi-link");if(!OnlyDefaultStream(h))throw new InvalidDataException("alternate stream");}
-    private static bool IsDirectory(FILE_INFO i){return(i.FileAttributes&ATTR_DIRECTORY)!=0;}
-    private static FILE_INFO Info(SafeFileHandle h){FILE_INFO i;if(!GetFileInformationByHandle(h,out i))throw new Win32Exception(Marshal.GetLastWin32Error());return i;}
-    private static string FinalPath(SafeFileHandle h){StringBuilder b=new StringBuilder(512);uint n=GetFinalPathNameByHandleW(h,b,(uint)b.Capacity,0);if(n==0)throw new Win32Exception(Marshal.GetLastWin32Error());if(n>=b.Capacity){b.Capacity=(int)n+1;n=GetFinalPathNameByHandleW(h,b,(uint)b.Capacity,0);if(n==0||n>=b.Capacity)throw new Win32Exception(Marshal.GetLastWin32Error());}string s=b.ToString();if(s.StartsWith(@"\\?\UNC\",StringComparison.OrdinalIgnoreCase))return@"\\"+s.Substring(8);if(s.StartsWith(@"\\?\",StringComparison.OrdinalIgnoreCase))return s.Substring(4);return s;}
-    private static bool SamePath(string a,string b){return String.Equals(Path.GetFullPath(a).TrimEnd('\\'),Path.GetFullPath(b).TrimEnd('\\'),StringComparison.OrdinalIgnoreCase);}
-    private static string Sha(FileStream s){long p=s.Position;using(SHA256 h=SHA256.Create()){s.Position=0;string v=BitConverter.ToString(h.ComputeHash(s)).Replace("-","").ToLowerInvariant();s.Position=p;return v;}}
-    private static bool OnlyDefaultStream(SafeFileHandle h){IntPtr b=Marshal.AllocHGlobal(65536);try{if(!GetFileInformationByHandleEx(h,FileStreamInfo,b,65536)){int e=Marshal.GetLastWin32Error();if(e==38)return true;throw new Win32Exception(e);}int o=0;while(true){uint nx=(uint)Marshal.ReadInt32(b,o),nl=(uint)Marshal.ReadInt32(b,o+4);string n=Marshal.PtrToStringUni(IntPtr.Add(b,o+24),(int)nl/2);if(!String.Equals(n,"::$DATA",StringComparison.OrdinalIgnoreCase)&&!String.Equals(n,"::$INDEX_ALLOCATION",StringComparison.OrdinalIgnoreCase))return false;if(nx==0)break;o+=(int)nx;}return true;}finally{Marshal.FreeHGlobal(b);}}
-    private static string[] Enumerate(SafeFileHandle h){List<string> r=new List<string>();IntPtr b=Marshal.AllocHGlobal(65536);bool restart=true;try{while(true){IO_STATUS_BLOCK io;int st=NtQueryDirectoryFile(h,IntPtr.Zero,IntPtr.Zero,IntPtr.Zero,out io,b,65536,FileDirectoryInformation,false,IntPtr.Zero,restart);restart=false;if(st==STATUS_NO_MORE_FILES)break;if(st<0)throw new Win32Exception((int)RtlNtStatusToDosError(st));int o=0;while(true){uint nx=(uint)Marshal.ReadInt32(b,o),nl=(uint)Marshal.ReadInt32(b,o+60);string n=Marshal.PtrToStringUni(IntPtr.Add(b,o+64),(int)nl/2);if(n!="."&&n!="..")r.Add(n);if(nx==0)break;o+=(int)nx;}}return r.ToArray();}finally{Marshal.FreeHGlobal(b);}}
-    private sealed class OpenResult{internal SafeFileHandle Handle;internal bool Created;internal OpenResult(SafeFileHandle h,bool c){Handle=h;Created=c;}}
-    private static OpenResult OpenRelative(SafeFileHandle parent,string name,uint access,uint share,uint disposition,uint options)
-    {IntPtr nb=IntPtr.Zero,up=IntPtr.Zero;bool add=false;try{parent.DangerousAddRef(ref add);nb=Marshal.StringToHGlobalUni(name);UNICODE_STRING u=new UNICODE_STRING{Length=(ushort)(name.Length*2),MaximumLength=(ushort)((name.Length+1)*2),Buffer=nb};up=Marshal.AllocHGlobal(Marshal.SizeOf(typeof(UNICODE_STRING)));Marshal.StructureToPtr(u,up,false);OBJECT_ATTRIBUTES o=new OBJECT_ATTRIBUTES{Length=Marshal.SizeOf(typeof(OBJECT_ATTRIBUTES)),RootDirectory=parent.DangerousGetHandle(),ObjectName=up,Attributes=OBJ_CASE_INSENSITIVE};IO_STATUS_BLOCK io;IntPtr raw;int st=NtCreateFile(out raw,access,ref o,out io,IntPtr.Zero,0,share,disposition,options|SYNC_IO|OPEN_REPARSE,IntPtr.Zero,0);if(st<0)throw new Win32Exception((int)RtlNtStatusToDosError(st));return new OpenResult(new SafeFileHandle(raw,true),io.Information.ToUInt64()==2);}finally{if(up!=IntPtr.Zero)Marshal.FreeHGlobal(up);if(nb!=IntPtr.Zero)Marshal.FreeHGlobal(nb);if(add)parent.DangerousRelease();}}
-    private static int Rename(SafeFileHandle source,SafeFileHandle parent,string destination)
-    {byte[] n=Encoding.Unicode.GetBytes(destination);int ro=IntPtr.Size,lo=ro+IntPtr.Size,no=lo+4,size=no+n.Length+2;IntPtr b=Marshal.AllocHGlobal(size);bool pa=false,sa=false;try{source.DangerousAddRef(ref sa);parent.DangerousAddRef(ref pa);for(int i=0;i<size;i++)Marshal.WriteByte(b,i,0);Marshal.WriteByte(b,0,0);Marshal.WriteIntPtr(b,ro,parent.DangerousGetHandle());Marshal.WriteInt32(b,lo,n.Length);Marshal.Copy(n,0,IntPtr.Add(b,no),n.Length);IO_STATUS_BLOCK io;int st=NtSetInformationFile(source,out io,b,(uint)size,FileRenameInformation);return st>=0?0:(int)RtlNtStatusToDosError(st);}finally{if(pa)parent.DangerousRelease();if(sa)source.DangerousRelease();Marshal.FreeHGlobal(b);}}
-    private static int SetDelete(SafeFileHandle h,bool delete){IntPtr b=Marshal.AllocHGlobal(1);try{Marshal.WriteByte(b,delete?(byte)1:(byte)0);IO_STATUS_BLOCK io;int st=NtSetInformationFile(h,out io,b,1,FileDispositionInformation);return st>=0?0:(int)RtlNtStatusToDosError(st);}finally{Marshal.FreeHGlobal(b);}}
-    private static int SetDeleteOnClose(SafeFileHandle h,bool delete,bool directory){IntPtr b=Marshal.AllocHGlobal(4);try{Marshal.WriteInt32(b,delete?1:0);return SetFileInformationByHandle(h,21,b,4)?0:Marshal.GetLastWin32Error();}finally{Marshal.FreeHGlobal(b);}}
-}
-'@
+    private Pin OpenOrCreateDirectory(Pin parent,string leaf)
+    {
+        Pin existing;if(names.TryGetValue(Key(parent,leaf),out existing)){ValidateCurrent(existing);return existing;}
+        OpenResult result;
+        try { result=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,CREATE,DIRECTORY|BACKUP_INTENT); }
+        catch(Win32Exception exception) { if(exception.NativeErrorCode!=80&&exception.NativeErrorCode!=183)throw;result=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT); }
+        try { Pin pin=ValidateDirectoryPin(parent,leaf,Path.Combine(parent.Path,leaf),result.Created,result.Handle);result.Handle=null;AddPin(pin);return pin; }
+        finally { if(result.Handle!=null)result.Handle.Dispose(); }
     }
-    $script:CcodRuntimeType = [CcodInstallCapabilityMarker].Assembly.GetType('CcodInstallRuntime', $true)
-}
 
-function Assert-CcodLeaf([string]$Leaf) {
-    if ([string]::IsNullOrWhiteSpace($Leaf) -or $Leaf.Length -gt 160 -or $Leaf -in @('.','..') -or $Leaf -notmatch '^[A-Za-z0-9._-]+$' -or $Leaf.EndsWith('.') -or $Leaf -match '^(?i:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\.|$)') { Throw-CcodInstallFileError 'CCOD_INSTALL_LEAF_INVALID' 'Unsafe install leaf' $Leaf }
-}
-function Invoke-CcodRuntimeStatic([string]$Name,[object[]]$Arguments) { $method=$script:CcodRuntimeType.GetMethod($Name,[Reflection.BindingFlags]'NonPublic,Static');try{return $method.Invoke($null,$Arguments)}catch [Reflection.TargetInvocationException]{throw $_.Exception.InnerException} }
-function Invoke-CcodRuntimeMethod($Runtime,[string]$Name,[object[]]$Arguments) { $method=$Runtime.GetType().GetMethod($Name,[Reflection.BindingFlags]'NonPublic,Instance');try{return $method.Invoke($Runtime,$Arguments)}catch [Reflection.TargetInvocationException]{throw $_.Exception.InnerException} }
-function Get-CcodTransactionState($Transaction) { $state=$null;if($null -eq $Transaction -or -not $script:CcodTransactions.TryGetValue($Transaction,[ref]$state)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Invalid install transaction capability' $null};if($state.Closed){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' 'Install transaction is closed' $null};return $state }
-function Get-CcodPinToken($Transaction,$Pin,[string]$Kind) { $state=Get-CcodTransactionState $Transaction;$record=$null;if($null -eq $Pin -or -not $script:CcodPins.TryGetValue($Pin,[ref]$record) -or -not [object]::ReferenceEquals($record.Transaction,$Transaction) -or $record.Kind -cne $Kind){Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_INVALID' 'Invalid install pin capability' $null};return [pscustomobject]@{State=$state;Token=$record.Token;Record=$record} }
-function New-CcodCapability { New-Object psobject }
-function Add-CcodPinCapability($Transaction,$Token,[string]$Kind) {$cap=New-CcodCapability;$script:CcodPins.Add($cap,[pscustomobject]@{Transaction=$Transaction;Token=$Token;Kind=$Kind});return $cap}
-function Convert-CcodRuntimeError($Action,[string]$DefaultId) {
-    try { return & $Action }
-    catch {
-        $exception = $_.Exception
-        while ($null -ne $exception.InnerException -and $exception -is [Management.Automation.RuntimeException]) { $exception = $exception.InnerException }
-        $message = [string]$exception.Message
-        if ($message -ceq 'destination exists') { Throw-CcodInstallFileError 'CCOD_INSTALL_PROMOTION_DESTINATION_EXISTS' $message $null }
-        if ($message -ceq 'retirement destination exists') { Throw-CcodInstallFileError 'CCOD_INSTALL_RETIREMENT_DESTINATION_EXISTS' $message $null }
-        if ($exception -is [ObjectDisposedException]) { Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' $message $null }
-        if ($exception -is [Security.Cryptography.CryptographicException] -or $message -match 'seal mismatch') { Throw-CcodInstallFileError 'CCOD_INSTALL_SEAL_MISMATCH' $message $null }
-        if ($message -match 'alternate stream') { Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' $message $null }
-        if ($message -match 'reparse') { Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' $message $null }
-        if ($message -match 'multi-link') { Throw-CcodInstallFileError 'CCOD_INSTALL_MULTILINK_LEAF' $message $null }
-        if ($message -match 'unknown|namespace') { Throw-CcodInstallFileError 'CCOD_INSTALL_UNKNOWN_LEAF' $message $null }
-        if ($message -match 'pin changed|path changed') { Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' $message $null }
-        Throw-CcodInstallFileError $DefaultId $message $null
+    private void ValidateOwnedTree(Pin directory)
+    {
+        ValidateCurrent(directory);foreach(string leaf in Enumerate(directory.Native)){Pin child;if(!names.TryGetValue(Key(directory,leaf),out child)||!child.Owned)throw new InvalidDataException("unknown leaf");ValidateCurrent(child);if(child.Directory)ValidateOwnedTree(child);else if(!child.Sealed)throw new InvalidDataException("unsealed leaf");}
+    }
+    private object WriteAtomic(Pin parent,string leaf,byte[] bytes)
+    {
+        string temporary=".ccod."+Guid.NewGuid().ToString("N")+".tmp";object[] result=(object[])Write(parent.Token,temporary,bytes,false);Pin pin=Require(result[0],false);int error=Rename(pin.Native,parent.Native,leaf);if(error!=0)throw new Win32Exception(error);names.Remove(Key(parent,temporary));pin.Leaf=leaf;pin.Path=Path.Combine(parent.Path,leaf);names.Add(Key(parent,leaf),pin);MakeReadable(pin);return result;
+    }
+    private static ulong CurrentPointerGeneration(Pin pointer)
+    {
+        ulong maximum=0;foreach(string leaf in Enumerate(pointer.Native)){if(leaf.StartsWith(".ccod.",StringComparison.OrdinalIgnoreCase)&&leaf.EndsWith(".tmp",StringComparison.OrdinalIgnoreCase))continue;if(leaf.Length!=25||!leaf.EndsWith(".json",StringComparison.OrdinalIgnoreCase))throw new InvalidDataException("unknown pointer leaf");ulong value;if(!UInt64.TryParse(leaf.Substring(0,20),out value)||value==0)throw new InvalidDataException("unknown pointer leaf");if(value>maximum)maximum=value;}return maximum;
     }
+    private void ReleaseDescendants(Pin directory)
+    {
+        foreach(Pin pin in pins.Values)if(!pin.Closed&&!Object.ReferenceEquals(pin,directory)&&pin.Path.StartsWith(directory.Path.TrimEnd('\\')+"\\",StringComparison.OrdinalIgnoreCase))pin.Dispose();
+    }
+    private Pin Require(object token,bool directory){if(disposed)throw new ObjectDisposedException("transaction");Pin pin;if(token==null||!pins.TryGetValue(token,out pin)||pin.Closed||pin.Directory!=directory)throw new InvalidDataException("invalid capability");return pin;}
+    private void AddPin(Pin pin){pins.Add(pin.Token,pin);if(pin.Parent!=null)names.Add(Key(pin.Parent,pin.Leaf),pin);}
+    private static string Key(Pin parent,string leaf){return parent.Index.ToString("x16")+"|"+leaf.ToLowerInvariant();}
+    private void MoveDirectoryPin(Pin directory,Pin parent,string leaf,string path){string oldPath=directory.Path;names.Remove(Key(directory.Parent,directory.Leaf));directory.Leaf=leaf;directory.Path=path;names.Add(Key(parent,leaf),directory);string prefix=oldPath.TrimEnd('\\')+"\\";foreach(Pin pin in pins.Values)if(!Object.ReferenceEquals(pin,directory)&&pin.Path.StartsWith(prefix,StringComparison.OrdinalIgnoreCase))pin.Path=path+"\\"+pin.Path.Substring(prefix.Length);}
+    private static Pin ValidateDirectoryPin(Pin parent,string leaf,string path,bool owned,SafeFileHandle handle){FILE_INFO info=Info(handle);if(!IsDirectory(info)||(info.FileAttributes&ATTR_REPARSE)!=0||!OnlyDefaultStream(handle)||!SamePath(FinalPath(handle),path))throw new InvalidDataException("directory invalid");return new Pin(parent,leaf,path,true,owned,handle,null,info);}
+    private static void MakeReadable(Pin pin){OpenResult bridge=OpenRelative(pin.Parent.Native,pin.Leaf,READ|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE|SHARE_DELETE,OPEN,NON_DIRECTORY);FILE_INFO bridgeInfo=Info(bridge.Handle);if(bridgeInfo.VolumeSerialNumber!=pin.Volume||(((ulong)bridgeInfo.FileIndexHigh<<32)|bridgeInfo.FileIndexLow)!=pin.Index){bridge.Handle.Dispose();throw new InvalidDataException("pin changed");}pin.Stream.Dispose();pin.Stream=null;OpenResult strict=OpenRelative(pin.Parent.Native,pin.Leaf,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,OPEN,NON_DIRECTORY);bridge.Handle.Dispose();pin.Stream=new FileStream(strict.Handle,FileAccess.Read,65536,false);strict.Handle=null;}
+    private static SafeFileHandle OpenAbsoluteDirectory(string path,bool allowWrite){uint access=LIST_DIRECTORY|READ_ATTRIBUTES|SYNC;if(allowWrite)access|=ADD_FILE|ADD_SUBDIRECTORY;SafeFileHandle handle=CreateFileW(path,access,SHARE_READ|SHARE_WRITE,IntPtr.Zero,OPEN_EXISTING,FLAG_BACKUP|FLAG_REPARSE,IntPtr.Zero);if(handle.IsInvalid)throw new Win32Exception(Marshal.GetLastWin32Error());return handle;}
+    private static void ValidateCurrent(Pin pin){FILE_INFO info=Info(pin.Native);if(info.VolumeSerialNumber!=pin.Volume||(((ulong)info.FileIndexHigh<<32)|info.FileIndexLow)!=pin.Index||IsDirectory(info)!=pin.Directory||(info.FileAttributes&ATTR_REPARSE)!=0||!SamePath(FinalPath(pin.Native),pin.Path))throw new InvalidDataException("pin changed");if(!OnlyDefaultStream(pin.Native))throw new InvalidDataException("alternate stream");if(!pin.Directory&&info.NumberOfLinks!=1)throw new InvalidDataException("multi-link");}
+    private static void ValidatePlain(FILE_INFO info,SafeFileHandle handle){if(IsDirectory(info))throw new InvalidDataException("file type");if((info.FileAttributes&ATTR_REPARSE)!=0)throw new InvalidDataException("reparse leaf");if(info.NumberOfLinks!=1)throw new InvalidDataException("multi-link");if(!OnlyDefaultStream(handle))throw new InvalidDataException("alternate stream");}
+    private static bool IsDirectory(FILE_INFO info){return(info.FileAttributes&ATTR_DIRECTORY)!=0;}
+    private static FILE_INFO Info(SafeFileHandle handle){FILE_INFO info;if(handle==null||handle.IsClosed||!GetFileInformationByHandle(handle,out info))throw new Win32Exception(Marshal.GetLastWin32Error());return info;}
+    private static string Sha(FileStream stream){long position=stream.Position;using(SHA256 hash=SHA256.Create()){stream.Position=0;string value=BitConverter.ToString(hash.ComputeHash(stream)).Replace("-","").ToLowerInvariant();stream.Position=position;return value;}}
+    private static string FinalPath(SafeFileHandle handle){StringBuilder buffer=new StringBuilder(512);uint length=GetFinalPathNameByHandleW(handle,buffer,(uint)buffer.Capacity,0);if(length==0)throw new Win32Exception(Marshal.GetLastWin32Error());if(length>=buffer.Capacity){buffer.Capacity=(int)length+1;length=GetFinalPathNameByHandleW(handle,buffer,(uint)buffer.Capacity,0);if(length==0||length>=buffer.Capacity)throw new Win32Exception(Marshal.GetLastWin32Error());}string path=buffer.ToString();if(path.StartsWith(@"\\?\UNC\",StringComparison.OrdinalIgnoreCase))return@"\\"+path.Substring(8);if(path.StartsWith(@"\\?\",StringComparison.OrdinalIgnoreCase))return path.Substring(4);return path;}
+    private static bool SamePath(string first,string second){return String.Equals(Path.GetFullPath(first).TrimEnd('\\'),Path.GetFullPath(second).TrimEnd('\\'),StringComparison.OrdinalIgnoreCase);}
+    private static bool OnlyDefaultStream(SafeFileHandle handle){IntPtr buffer=Marshal.AllocHGlobal(65536);try{if(!GetFileInformationByHandleEx(handle,FileStreamInfo,buffer,65536)){int error=Marshal.GetLastWin32Error();if(error==38)return true;throw new Win32Exception(error);}int offset=0;while(true){uint next=(uint)Marshal.ReadInt32(buffer,offset),nameLength=(uint)Marshal.ReadInt32(buffer,offset+4);string name=Marshal.PtrToStringUni(IntPtr.Add(buffer,offset+24),(int)nameLength/2);if(!String.Equals(name,"::$DATA",StringComparison.OrdinalIgnoreCase)&&!String.Equals(name,"::$INDEX_ALLOCATION",StringComparison.OrdinalIgnoreCase))return false;if(next==0)break;offset+=(int)next;}return true;}finally{Marshal.FreeHGlobal(buffer);}}
+    private static string[] Enumerate(SafeFileHandle handle){List<string> result=new List<string>();IntPtr buffer=Marshal.AllocHGlobal(65536);bool restart=true;try{while(true){IO_STATUS_BLOCK io;int status=NtQueryDirectoryFile(handle,IntPtr.Zero,IntPtr.Zero,IntPtr.Zero,out io,buffer,65536,FileDirectoryInformation,false,IntPtr.Zero,restart);restart=false;if(status==STATUS_NO_MORE_FILES)break;if(status<0)throw new Win32Exception((int)RtlNtStatusToDosError(status));int offset=0;while(true){uint next=(uint)Marshal.ReadInt32(buffer,offset),nameLength=(uint)Marshal.ReadInt32(buffer,offset+60);string name=Marshal.PtrToStringUni(IntPtr.Add(buffer,offset+64),(int)nameLength/2);if(name!="."&&name!="..")result.Add(name);if(next==0)break;offset+=(int)next;}}return result.ToArray();}finally{Marshal.FreeHGlobal(buffer);}}
+    private static OpenResult OpenRelative(SafeFileHandle parent,string name,uint access,uint share,uint disposition,uint options){IntPtr nameBuffer=IntPtr.Zero,unicodePointer=IntPtr.Zero;bool added=false;try{parent.DangerousAddRef(ref added);nameBuffer=Marshal.StringToHGlobalUni(name);UNICODE_STRING unicode=new UNICODE_STRING{Length=(ushort)(name.Length*2),MaximumLength=(ushort)((name.Length+1)*2),Buffer=nameBuffer};unicodePointer=Marshal.AllocHGlobal(Marshal.SizeOf(typeof(UNICODE_STRING)));Marshal.StructureToPtr(unicode,unicodePointer,false);OBJECT_ATTRIBUTES attributes=new OBJECT_ATTRIBUTES{Length=Marshal.SizeOf(typeof(OBJECT_ATTRIBUTES)),RootDirectory=parent.DangerousGetHandle(),ObjectName=unicodePointer,Attributes=OBJ_CASE_INSENSITIVE};IO_STATUS_BLOCK io;IntPtr raw;int status=NtCreateFile(out raw,access,ref attributes,out io,IntPtr.Zero,0,share,disposition,options|SYNC_IO|OPEN_REPARSE,IntPtr.Zero,0);if(status<0)throw new Win32Exception((int)RtlNtStatusToDosError(status));return new OpenResult(new SafeFileHandle(raw,true),io.Information.ToUInt64()==2);}finally{if(unicodePointer!=IntPtr.Zero)Marshal.FreeHGlobal(unicodePointer);if(nameBuffer!=IntPtr.Zero)Marshal.FreeHGlobal(nameBuffer);if(added)parent.DangerousRelease();}}
+    private static int Rename(SafeFileHandle source,SafeFileHandle parent,string destination){byte[] name=Encoding.Unicode.GetBytes(destination);int rootOffset=IntPtr.Size,lengthOffset=rootOffset+IntPtr.Size,nameOffset=lengthOffset+4,size=nameOffset+name.Length+2;IntPtr buffer=Marshal.AllocHGlobal(size);bool parentAdded=false,sourceAdded=false;try{source.DangerousAddRef(ref sourceAdded);parent.DangerousAddRef(ref parentAdded);for(int i=0;i<size;i++)Marshal.WriteByte(buffer,i,0);Marshal.WriteByte(buffer,0,0);Marshal.WriteIntPtr(buffer,rootOffset,parent.DangerousGetHandle());Marshal.WriteInt32(buffer,lengthOffset,name.Length);Marshal.Copy(name,0,IntPtr.Add(buffer,nameOffset),name.Length);IO_STATUS_BLOCK io;int status=NtSetInformationFile(source,out io,buffer,(uint)size,FileRenameInformation);return status>=0?0:(int)RtlNtStatusToDosError(status);}finally{if(parentAdded)parent.DangerousRelease();if(sourceAdded)source.DangerousRelease();Marshal.FreeHGlobal(buffer);}}
+}
+'@
+    $script:CcodRuntimeType = [CcodInstallCapabilityMarker].Assembly.GetType('CcodInstallRuntime',$true)
 }
 
-function Open-CcodInstallFileTransaction { param([Parameter(Mandatory)][string]$InstallRoot) Initialize-CcodInstallRuntime;if(-not [IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$null);$root=Convert-CcodRuntimeError {Invoke-CcodRuntimeStatic Open $arguments} 'CCOD_INSTALL_ROOT_INVALID';$runtime=$arguments[1];$tx=New-CcodCapability;$rootCap=Add-CcodPinCapability $tx $root 'Directory';$tx|Add-Member -NotePropertyName RootDirectory -NotePropertyValue $rootCap;$script:CcodTransactions.Add($tx,[pscustomobject]@{Runtime=$runtime;Closed=$false;Root=$rootCap;Disposition=$null});return $tx }
-function Open-CcodInstallPinnedDirectory { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)][string]$Leaf,[switch]$CreateIfMissing) Assert-CcodLeaf $Leaf;$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;$token=Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime OpenDirectory @($p.Token,$Leaf,[bool]$CreateIfMissing)} 'CCOD_INSTALL_REPARSE_LEAF';return Add-CcodPinCapability $Transaction $token Directory }
-function New-CcodInstallPinnedTemporaryLeaf { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)][string]$Leaf) Assert-CcodLeaf $Leaf;$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;$token=Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime CreateTemporary @($p.Token,$Leaf)} 'CCOD_INSTALL_TEMPORARY_EXISTS';return Add-CcodPinCapability $Transaction $token File }
-function Copy-CcodInstallSealedFile { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][string]$SourcePath,[Parameter(Mandatory)]$DestinationLeaf,[Parameter(Mandatory)][int64]$ExpectedLength,[Parameter(Mandatory)][string]$ExpectedSha256) if(-not [IO.Path]::IsPathRooted($SourcePath)-or$ExpectedSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Invalid source contract' $SourcePath};$p=Get-CcodPinToken $Transaction $DestinationLeaf File;Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime Copy @($p.Token,[IO.Path]::GetFullPath($SourcePath),$ExpectedLength,$ExpectedSha256)|Out-Null} 'CCOD_INSTALL_SOURCE_MISMATCH';[pscustomobject]@{Length=$ExpectedLength;Sha256=$ExpectedSha256} }
-function Commit-CcodInstallPinnedPromotion { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)]$TemporaryLeaf,[Parameter(Mandatory)][string]$DestinationLeaf) Assert-CcodLeaf $DestinationLeaf;$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;$t=Get-CcodPinToken $Transaction $TemporaryLeaf File;$newToken=Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime Promote @($p.Token,$t.Token,$DestinationLeaf)} 'CCOD_INSTALL_PROMOTION_FAILED';$t.Record.Token=$newToken;return $TemporaryLeaf }
-function Write-CcodInstallPinnedJson { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)]$Value,[switch]$Compress) Assert-CcodLeaf $Leaf;$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;$bytes=[Text.UTF8Encoding]::new($false).GetBytes(($Value|ConvertTo-Json -Depth 32 -Compress:$Compress)+"`n");$token=Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime WriteJson @($p.Token,$Leaf,$bytes)} 'CCOD_INSTALL_PROMOTION_FAILED';return Add-CcodPinCapability $Transaction $token File }
-function Test-CcodSanitized($Value,[int]$Depth=0) {
-    if ($Depth -gt 8) { return $false }
+function Assert-CcodInstallLeaf([string]$Leaf,[string]$ErrorId='CCOD_INSTALL_LEAF_INVALID') {
+    if ([string]::IsNullOrWhiteSpace($Leaf)-or$Leaf.Length-gt 160-or$Leaf-in@('.','..')-or$Leaf-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$'-or$Leaf.EndsWith('.')-or$Leaf-match'^(?i:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\.|$)') { Throw-CcodInstallFileError $ErrorId 'Unsafe install leaf' $Leaf }
+}
+function Invoke-CcodRuntimeStatic([string]$Name,[object[]]$Arguments){$method=$script:CcodRuntimeType.GetMethod($Name,[Reflection.BindingFlags]'NonPublic,Static');try{return $method.Invoke($null,$Arguments)}catch [Reflection.TargetInvocationException]{throw $_.Exception.InnerException}}
+function Invoke-CcodRuntimeMethod($Runtime,[string]$Name,[object[]]$Arguments){$method=$Runtime.GetType().GetMethod($Name,[Reflection.BindingFlags]'NonPublic,Instance');try{return $method.Invoke($Runtime,$Arguments)}catch [Reflection.TargetInvocationException]{throw $_.Exception.InnerException}}
+function New-CcodInstallCapability { New-Object psobject }
+function Get-CcodInstallTransaction($Capability,[string]$InvalidId='CCOD_INSTALL_GENERATION_INVALID'){$record=$null;if($null-eq$Capability-or-not$script:CcodScopes.TryGetValue($Capability,[ref]$record)){Throw-CcodInstallFileError $InvalidId 'Invalid install generation capability' $null};$state=$null;if(-not$script:CcodTransactions.TryGetValue($record.Transaction,[ref]$state)){Throw-CcodInstallFileError $InvalidId 'Invalid install transaction capability' $null};if($state.Closed){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' 'Install file transaction is closed' $null};if($state.Retired){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_RETIRED' 'Install generation is retired' $null};[pscustomobject]@{State=$state;Record=$record}}
+function Add-CcodInstallScope($Transaction,$Token){$capability=New-CcodInstallCapability;$script:CcodScopes.Add($capability,[pscustomobject]@{Transaction=$Transaction;Token=$Token});$capability}
+function Convert-CcodInstallRuntimeError($Action,[string]$DefaultId){try{return&$Action}catch{$exception=$_.Exception;while($null-ne$exception.InnerException-and$exception-is[Management.Automation.RuntimeException]){$exception=$exception.InnerException};$message=[string]$exception.Message;if($exception-is[ObjectDisposedException]){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' $message $null};if($exception-is[ComponentModel.Win32Exception]-and$exception.NativeErrorCode-in@(80,183)){Throw-CcodInstallFileError 'CCOD_INSTALL_LEAF_EXISTS' 'Install object already exists' $null};if($message-match'pointer generation exists'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' $message $null};if($message-match'alternate stream'){Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' $message $null};if($message-match'multi-link'){Throw-CcodInstallFileError 'CCOD_INSTALL_MULTILINK_LEAF' $message $null};if($message-match'reparse'){Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' $message $null};if($message-match'transaction scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_SCOPE' $message $null};if($message-match'generation not owned'){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' $message $null};if($message-match'unknown|unsealed'){Throw-CcodInstallFileError 'CCOD_INSTALL_UNKNOWN_LEAF' $message $null};if($message-match'pin changed|path changed'){Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' $message $null};Throw-CcodInstallFileError $DefaultId $message $null}}
+function Test-CcodInstallValue($Value,[int]$Depth=0) {
+    if ($Depth -gt 12) { return $false }
     if ($null -eq $Value) { return $true }
-    if ($Value -is [string]) { return ($Value.Length -le 4096) }
+    if ($Value -is [string]) { return $Value.Length -le 4096 }
     if ($Value -is [ValueType]) { return $true }
     if ($Value -is [Collections.IDictionary]) {
         foreach ($key in $Value.Keys) {
-            if ($key -isnot [string] -or $key -cnotmatch '^[A-Za-z0-9_.-]{1,96}$' -or -not (Test-CcodSanitized $Value[$key] ($Depth + 1))) { return $false }
+            if ($key -isnot [string] -or $key -cnotmatch '^[A-Za-z0-9_.-]{1,96}$' -or -not (Test-CcodInstallValue $Value[$key] ($Depth + 1))) { return $false }
         }
         return $true
     }
+    if ($Value -is [Collections.IEnumerable]) {
+        foreach ($item in $Value) { if (-not (Test-CcodInstallValue $item ($Depth + 1))) { return $false } }
+        return $true
+    }
     if ($Value -is [pscustomobject]) {
         foreach ($property in $Value.PSObject.Properties) {
-            if ($property.Name -cnotmatch '^[A-Za-z0-9_.-]{1,96}$' -or -not (Test-CcodSanitized $property.Value ($Depth + 1))) { return $false }
+            if ($property.Name -cnotmatch '^[A-Za-z0-9_.-]{1,96}$' -or -not (Test-CcodInstallValue $property.Value ($Depth + 1))) { return $false }
         }
         return $true
     }
     return $false
 }
-function Append-CcodInstallPinnedLog { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)]$Record) Assert-CcodLeaf $Leaf;if(-not(Test-CcodSanitized $Record)){Throw-CcodInstallFileError 'CCOD_INSTALL_LOG_RECORD_INVALID' 'Invalid log record' $null};$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;$bytes=[Text.UTF8Encoding]::new($false).GetBytes(($Record|ConvertTo-Json -Depth 8 -Compress)+"`n");if($bytes.Length-gt65536){Throw-CcodInstallFileError 'CCOD_INSTALL_LOG_RECORD_INVALID' 'Log record too large' $null};$token=Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime Append @($p.Token,$Leaf,$bytes)} 'CCOD_INSTALL_LOG_WRITE_FAILED';return Add-CcodPinCapability $Transaction $token File }
-function Remove-CcodInstallOwnedTree { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ParentDirectory,[Parameter(Mandatory)][string]$Leaf) Assert-CcodLeaf $Leaf;$p=Get-CcodPinToken $Transaction $ParentDirectory Directory;$token=Convert-CcodRuntimeError {Invoke-CcodRuntimeMethod $p.State.Runtime RemoveOwnedTree @($p.Token,$Leaf)} 'CCOD_INSTALL_RETIREMENT_FAILED';if($null -eq $token){return [pscustomobject]@{Disposition='Deleted';Object=$null}};$capability=Add-CcodPinCapability $Transaction $token Directory;return [pscustomobject]@{Disposition='Retired';Object=$capability} }
-function Close-CcodInstallFileTransaction { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][ValidateSet('Ready','Failed')][string]$Disposition) $state=$null;if($null-eq$Transaction-or-not$script:CcodTransactions.TryGetValue($Transaction,[ref]$state)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Invalid install transaction capability' $null};if(-not$state.Closed){Invoke-CcodRuntimeMethod $state.Runtime Close @()|Out-Null;$state.Closed=$true;$state.Disposition=$Disposition} }
+function ConvertTo-CcodInstallJsonBytes($Value){if(-not(Test-CcodInstallValue $Value)){Throw-CcodInstallFileError 'CCOD_INSTALL_JSON_INVALID' 'Invalid install JSON value' $null};return ,([Text.UTF8Encoding]::new($false).GetBytes(($Value|ConvertTo-Json -Depth 32 -Compress)+"`n"))}
+function Assert-CcodInstallRootScope($State,[string]$InstallRoot,[string]$ErrorId){if(-not[IO.Path]::IsPathRooted($InstallRoot)-or-not[String]::Equals([IO.Path]::GetFullPath($InstallRoot).TrimEnd('\'),$State.InstallRoot,[StringComparison]::OrdinalIgnoreCase)){Throw-CcodInstallFileError $ErrorId 'Install root does not match transaction scope' $InstallRoot}}
+
+function Open-CcodInstallGeneration {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId)
+    Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID'
+    $arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$RuntimeId,$null)
+    try{$token=Invoke-CcodRuntimeStatic Open $arguments}catch [ComponentModel.Win32Exception]{if($_.Exception.NativeErrorCode-in@(32,80,183)){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_EXISTS' 'Install generation already exists' $RuntimeId};throw}
+    $runtime=$arguments[2];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$RuntimeId;RootToken=$token;Closed=$false;Retired=$false;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token});$transaction
+}
+function New-CcodInstallGenerationLeaf { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$Leaf) Assert-CcodInstallLeaf $Leaf;$scope=Get-CcodInstallTransaction $Generation;$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CreateDirectory @($scope.Record.Token,$Leaf)} 'CCOD_INSTALL_LEAF_CREATE_FAILED';Add-CcodInstallScope $scope.Record.Transaction $token }
+function Copy-CcodInstallSealedSource { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$SourcePath,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)][int64]$ExpectedLength,[Parameter(Mandatory)][string]$ExpectedSha256) Assert-CcodInstallLeaf $Leaf;if(-not[IO.Path]::IsPathRooted($SourcePath)-or$ExpectedLength-lt 0-or$ExpectedSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Invalid sealed source contract' $SourcePath};$scope=Get-CcodInstallTransaction $Generation;Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Copy @($scope.Record.Token,$Leaf,[IO.Path]::GetFullPath($SourcePath),$ExpectedLength,$ExpectedSha256)|Out-Null} 'CCOD_INSTALL_SOURCE_MISMATCH';[pscustomobject]@{Length=$ExpectedLength;Sha256=$ExpectedSha256} }
+function Write-CcodInstallGenerationManifest { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)]$Manifest) $scope=Get-CcodInstallTransaction $Generation;if($scope.Record.Token-ne$scope.State.RootToken){Throw-CcodInstallFileError 'CCOD_INSTALL_MANIFEST_SCOPE' 'Manifest must be written at the generation root' $null};$bytes=ConvertTo-CcodInstallJsonBytes $Manifest;$result=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Write @($scope.Record.Token,'manifest.json',$bytes,$true)} 'CCOD_INSTALL_MANIFEST_WRITE_FAILED';[pscustomobject]@{Length=[int64]$result[1];Sha256=[string]$result[2]} }
+function Commit-CcodInstallActivePointer { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][uint64]$ExpectedPreviousGeneration,[Parameter(Mandatory)][string]$NewRuntimeId,[Parameter(Mandatory)]$FileTransaction) Assert-CcodInstallLeaf $NewRuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$generation=$ExpectedPreviousGeneration+1;$pointer=[ordered]@{schemaVersion=1;generation=$generation;activeRuntime=$NewRuntimeId;previousGeneration=$ExpectedPreviousGeneration};$bytes=ConvertTo-CcodInstallJsonBytes $pointer;try{Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CommitPointer @($scope.Record.Token,$ExpectedPreviousGeneration,$NewRuntimeId,$bytes)|Out-Null} 'CCOD_INSTALL_POINTER_COMMIT_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' 'Pointer generation already exists' $generation};throw};[pscustomobject]@{Generation=[uint64]$generation;RuntimeId=$NewRuntimeId} }
+function Retire-CcodInstallGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)]$FileTransaction) Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';if($RuntimeId-cne$scope.State.RuntimeId-or$scope.Record.Token-ne$scope.State.RootToken){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' 'Generation is not owned by this transaction' $RuntimeId};$retiredLeaf=$RuntimeId+'.'+[guid]::NewGuid().ToString('N');$record=ConvertTo-CcodInstallJsonBytes ([ordered]@{schemaVersion=1;runtimeId=$RuntimeId;retiredName=$retiredLeaf});$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Retire @($scope.Record.Token,$RuntimeId,$retiredLeaf,$record)} 'CCOD_INSTALL_RETIREMENT_FAILED';$capability=Add-CcodInstallScope $scope.Record.Transaction $token;$scope.State.Retired=$true;[pscustomobject]@{Disposition='Retired';Capability=$capability} }
+function Close-CcodInstallFileTransaction { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][ValidateSet('Ready','Failed')][string]$Disposition) $state=$null;if($null-eq$Transaction-or-not$script:CcodTransactions.TryGetValue($Transaction,[ref]$state)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Invalid install file transaction capability' $null};if(-not$state.Closed){Invoke-CcodRuntimeMethod $state.Runtime Close @()|Out-Null;$state.Closed=$true;$state.Disposition=$Disposition} }
 
-Export-ModuleMember -Function Open-CcodInstallFileTransaction,Open-CcodInstallPinnedDirectory,New-CcodInstallPinnedTemporaryLeaf,Copy-CcodInstallSealedFile,Commit-CcodInstallPinnedPromotion,Write-CcodInstallPinnedJson,Append-CcodInstallPinnedLog,Remove-CcodInstallOwnedTree,Close-CcodInstallFileTransaction
+Initialize-CcodInstallRuntime
+Export-ModuleMember -Function Open-CcodInstallGeneration,New-CcodInstallGenerationLeaf,Copy-CcodInstallSealedSource,Write-CcodInstallGenerationManifest,Commit-CcodInstallActivePointer,Retire-CcodInstallGeneration,Close-CcodInstallFileTransaction
diff --git a/tests/PersistenceSelfTest.ps1 b/tests/PersistenceSelfTest.ps1
index aafd8aa..a67276f 100644
--- a/tests/PersistenceSelfTest.ps1
+++ b/tests/PersistenceSelfTest.ps1
@@ -14,11 +14,11 @@ if ($PSVersionTable.PSEdition -eq 'Desktop') {
 }
 
 $powershell = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
-$requiredTransactionSelfTest = Join-Path $PSScriptRoot 'persistence\InstallFileTransaction.SelfTest.ps1'
-if (-not (Test-Path -LiteralPath $requiredTransactionSelfTest -PathType Leaf)) {
-    throw "Required install file transaction self-test is missing: $requiredTransactionSelfTest"
-}
 $tests = Get-ChildItem -LiteralPath (Join-Path $PSScriptRoot 'persistence') -Filter '*.SelfTest.ps1' | Sort-Object Name
+$requiredTransactionSelfTest = 'InstallFileTransaction.SelfTest.ps1'
+if (@($tests | Where-Object Name -CEQ $requiredTransactionSelfTest).Count -ne 1) {
+    throw "Required install file transaction self-test is not registered exactly once: $requiredTransactionSelfTest"
+}
 foreach ($test in $tests) {
     $previousErrorActionPreference = $ErrorActionPreference
     try {
diff --git a/tests/Validate.ps1 b/tests/Validate.ps1
index d1533e2..7e62d03 100644
--- a/tests/Validate.ps1
+++ b/tests/Validate.ps1
@@ -24,6 +24,7 @@ $failures = [System.Collections.Generic.List[string]]::new()
 $cleanRoomSelfTest = Join-Path $PSScriptRoot 'CleanroomSelfTest.js'
 $packageCheckerSelfTest = Join-Path $PSScriptRoot 'PackageCheckerSelfTest.mjs'
 $persistenceSelfTest = Join-Path $PSScriptRoot 'PersistenceSelfTest.ps1'
+$installFileTransactionSelfTest = Join-Path $PSScriptRoot 'persistence\InstallFileTransaction.SelfTest.ps1'
 
 function Get-CcodValidationSafeChildMarkers {
     param($Output)
@@ -94,6 +95,10 @@ if (-not $node) {
     }
 }
 
+if (-not (Test-Path -LiteralPath $installFileTransactionSelfTest -PathType Leaf)) {
+    $failures.Add("Immutable generation file-layer self-test is missing: $installFileTransactionSelfTest")
+}
+
 if ($failures.Count -eq 0) {
     $powershellExecutable = (Get-Command powershell.exe -ErrorAction Stop).Source
     $previousErrorActionPreference = $ErrorActionPreference
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index 814a443..1495975 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -3,135 +3,7 @@ $ErrorActionPreference = 'Stop'
 
 $projectRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
 $modulePath = Join-Path $projectRoot 'src\persistence\modules\InstallFileTransaction.psm1'
-$module = $null
-if (Test-Path -LiteralPath $modulePath -PathType Leaf) {
-    $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
-}
-
-if ($null -eq ('CcodInstallTransactionTestNative' -as [type])) {
-    Add-Type -TypeDefinition @'
-using System;
-using System.ComponentModel;
-using System.IO;
-using System.Runtime.InteropServices;
-using System.Threading;
-using System.Threading.Tasks;
-using Microsoft.Win32.SafeHandles;
-
-public static class CcodInstallTransactionTestNative
-{
-    private const uint FILE_LIST_DIRECTORY = 0x00000001;
-    private const uint FILE_READ_ATTRIBUTES = 0x00000080;
-    private const uint DELETE = 0x00010000;
-    private const uint GENERIC_READ = 0x80000000;
-    private const uint GENERIC_WRITE = 0x40000000;
-    private const uint FILE_SHARE_READ = 0x00000001;
-    private const uint FILE_SHARE_WRITE = 0x00000002;
-    private const uint FILE_SHARE_DELETE = 0x00000004;
-    private const uint OPEN_EXISTING = 3;
-    private const uint FILE_FLAG_BACKUP_SEMANTICS = 0x02000000;
-    private const uint FILE_FLAG_OPEN_REPARSE_POINT = 0x00200000;
-    private const uint FILE_FLAG_WRITE_THROUGH = 0x80000000;
-
-    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
-    private static extern SafeFileHandle CreateFileW(string path, uint access, uint share, IntPtr security,
-        uint creation, uint flags, IntPtr template);
-
-    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static extern bool CreateHardLinkW(string newName, string existingName, IntPtr securityAttributes);
-
-    public static int CreateHardLink(string newName, string existingName)
-    {
-        return CreateHardLinkW(newName, existingName, IntPtr.Zero) ? 0 : Marshal.GetLastWin32Error();
-    }
-
-    public static SafeFileHandle OpenDirectoryAllowDeleteShare(string path)
-    {
-        SafeFileHandle handle = CreateFileW(path, FILE_LIST_DIRECTORY | FILE_READ_ATTRIBUTES | DELETE,
-            FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, IntPtr.Zero, OPEN_EXISTING,
-            FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT, IntPtr.Zero);
-        if (handle.IsInvalid) throw new Win32Exception(Marshal.GetLastWin32Error());
-        return handle;
-    }
-
-    public static int TryOpenDirectoryForChildWrite(string path)
-    {
-        using (SafeFileHandle handle = CreateFileW(path, 0x00000002 | 0x00000004 | FILE_READ_ATTRIBUTES,
-            FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, IntPtr.Zero, OPEN_EXISTING,
-            FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT, IntPtr.Zero))
-        {
-            return handle.IsInvalid ? Marshal.GetLastWin32Error() : 0;
-        }
-    }
-
-    public static SafeFileHandle OpenFileAllowDeleteShare(string path)
-    {
-        SafeFileHandle handle = CreateFileW(path, GENERIC_READ | GENERIC_WRITE | DELETE | FILE_READ_ATTRIBUTES,
-            FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, IntPtr.Zero, OPEN_EXISTING,
-            FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_WRITE_THROUGH, IntPtr.Zero);
-        if (handle.IsInvalid) throw new Win32Exception(Marshal.GetLastWin32Error());
-        return handle;
-    }
-
-    public static Task<string> InsertUnknownWhenLeafBecomesUnavailable(string watchedLeaf, string unknownLeaf)
-    {
-        return Task.Run(() => {
-            DateTime deadline = DateTime.UtcNow.AddSeconds(10);
-            while (DateTime.UtcNow < deadline)
-            {
-                if (!File.Exists(watchedLeaf))
-                {
-                    try { File.WriteAllText(unknownLeaf, "concurrent-unknown"); return "inserted"; }
-                    catch (IOException) { return "blocked"; }
-                    catch (UnauthorizedAccessException) { return "blocked"; }
-                }
-                Thread.Yield();
-            }
-            return "timeout";
-        });
-    }
-
-    public static Task<string> InsertUnknownAfterDelay(string unknownLeaf, int delayMilliseconds)
-    {
-        return Task.Run(() => {
-            Thread.Sleep(delayMilliseconds);
-            try { File.WriteAllText(unknownLeaf, "concurrent-unknown"); return "inserted"; }
-            catch (IOException) { return "blocked"; }
-            catch (UnauthorizedAccessException) { return "blocked"; }
-        });
-    }
-
-    public static Task<string> ProbeNamespaceAfterLeafUnlock(string watchedLeaf, string directory, string hardLinkSource, string hardLinkDestination)
-    {
-        return Task.Run(() => {
-            DateTime deadline = DateTime.UtcNow.AddSeconds(10);
-            while (DateTime.UtcNow < deadline)
-            {
-                try
-                {
-                    using (FileStream stream = File.Open(watchedLeaf, FileMode.Open, FileAccess.Write, FileShare.ReadWrite | FileShare.Delete)) { }
-                    int directoryError = TryOpenDirectoryForChildWrite(directory);
-                    int linkError = CreateHardLink(hardLinkDestination, hardLinkSource);
-                    return directoryError != 0 && linkError != 0 ? "blocked" : "escaped";
-                }
-                catch (IOException) { }
-                catch (UnauthorizedAccessException) { }
-                if (!Directory.Exists(directory)) return "retired-before-probe";
-                Thread.Yield();
-            }
-            return "timeout";
-        });
-    }
-}
-'@
-}
-
-function Invoke-CcodInstallModule {
-    param([Parameter(Mandatory)][scriptblock]$Action, [object[]]$Arguments = @())
-    if ($null -eq $module) { return & $Action @Arguments }
-    return & $module $Action @Arguments
-}
+$module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
 
 function New-CcodInstallFileFixture {
     $base = Join-Path ([IO.Path]::GetTempPath()) ('ccod-install-file-' + [guid]::NewGuid().ToString('N'))
@@ -140,693 +12,201 @@ function New-CcodInstallFileFixture {
     [IO.Directory]::CreateDirectory($install) | Out-Null
     [IO.Directory]::CreateDirectory($outside) | Out-Null
     $sentinel = Join-Path $outside 'sentinel.txt'
-    $sentinelBytes = [Text.UTF8Encoding]::new($false).GetBytes('outside-sentinel-v1')
-    [IO.File]::WriteAllBytes($sentinel, $sentinelBytes)
-    return [pscustomobject]@{
-        Base = $base
-        MovedBase = $null
-        Install = $install
-        Outside = $outside
-        Sentinel = $sentinel
-        SentinelSha256 = Get-CcodTestFileSha256 -Path $sentinel
-        Transaction = $null
-    }
-}
-
-function Assert-CcodOutsideUnchanged {
-    param([Parameter(Mandatory)]$Fixture, [Parameter(Mandatory)][string]$Message)
-    Assert-CcodTrue ([IO.File]::Exists($Fixture.Sentinel)) "$Message sentinel exists"
-    Assert-CcodEqual $Fixture.SentinelSha256 (Get-CcodTestFileSha256 -Path $Fixture.Sentinel) "$Message sentinel bytes"
-}
-
-function Close-CcodFixtureTransaction {
-    param([Parameter(Mandatory)]$Fixture)
-    if ($null -eq $Fixture.Transaction) { return }
-    try {
-        Invoke-CcodInstallModule { param($Tx) Close-CcodInstallFileTransaction -Transaction $Tx -Disposition Failed } @($Fixture.Transaction) | Out-Null
-    } catch { }
-    $Fixture.Transaction = $null
+    [IO.File]::WriteAllText($sentinel, 'outside-sentinel-v1')
+    [pscustomobject]@{ Base=$base; Outside=$outside; Install=$install; Sentinel=$sentinel; SentinelSha256=(Get-CcodTestFileSha256 $sentinel); Transactions=[Collections.Generic.List[object]]::new() }
 }
 
 function Remove-CcodInstallFileFixture {
     param([Parameter(Mandatory)]$Fixture)
-    Close-CcodFixtureTransaction -Fixture $Fixture
+    foreach ($transaction in @($Fixture.Transactions)) { try { Close-CcodInstallFileTransaction -Transaction $transaction -Disposition Failed | Out-Null } catch { } }
     $tempRoot = [IO.Path]::GetFullPath([IO.Path]::GetTempPath()).TrimEnd('\') + '\'
-    foreach ($candidate in @($Fixture.Base, $Fixture.MovedBase, $Fixture.Outside)) {
-        if ([string]::IsNullOrWhiteSpace([string]$candidate)) { continue }
+    foreach ($candidate in @($Fixture.Base,$Fixture.Outside)) {
         $full = [IO.Path]::GetFullPath([string]$candidate)
-        if (-not $full.StartsWith($tempRoot, [StringComparison]::OrdinalIgnoreCase)) {
-            throw "Refusing to remove non-temporary fixture path: $full"
-        }
+        if (-not $full.StartsWith($tempRoot,[StringComparison]::OrdinalIgnoreCase)) { throw "Refusing to remove non-temporary fixture path: $full" }
         if (Test-Path -LiteralPath $full) { Remove-Item -LiteralPath $full -Recurse -Force }
     }
 }
 
-function Open-CcodFixtureTransaction {
-    param([Parameter(Mandatory)]$Fixture)
-    $Fixture.Transaction = Invoke-CcodInstallModule { param($Install) Open-CcodInstallFileTransaction -InstallRoot $Install } @($Fixture.Install)
-    return $Fixture.Transaction
-}
-
-function Invoke-CcodAttemptDirectoryReplacement {
-    param([Parameter(Mandatory)][string]$Path)
-    $backup = $Path + '.attacker-old'
-    try {
-        [IO.Directory]::Move($Path, $backup)
-        return [pscustomobject]@{ Outcome = 'replaced'; Backup = $backup }
-    } catch [IO.IOException] {
-        return [pscustomobject]@{ Outcome = 'blocked'; Backup = $null }
-    } catch [UnauthorizedAccessException] {
-        return [pscustomobject]@{ Outcome = 'blocked'; Backup = $null }
-    }
-}
-
-function Invoke-CcodAttemptFileReplacement {
-    param([Parameter(Mandatory)][string]$Path)
-    $backup = $Path + '.attacker-old'
-    try {
-        [IO.File]::Move($Path, $backup)
-        return [pscustomobject]@{ Outcome = 'replaced'; Backup = $backup }
-    } catch [IO.IOException] {
-        return [pscustomobject]@{ Outcome = 'blocked'; Backup = $null }
-    } catch [UnauthorizedAccessException] {
-        return [pscustomobject]@{ Outcome = 'blocked'; Backup = $null }
-    }
-}
-
-function Invoke-CcodReplacePinnedDirectory {
-    param(
-        [Parameter(Mandatory)]$Fixture,
-        [Parameter(Mandatory)][string]$Path
-    )
-    $moved = $Path + '.attacker-old'
-    try {
-        [IO.Directory]::Move($Path, $moved)
-    } catch [IO.IOException] {
-        return [pscustomobject]@{ Outcome = 'blocked'; MovedDirectory = $null }
-    } catch [UnauthorizedAccessException] {
-        return [pscustomobject]@{ Outcome = 'blocked'; MovedDirectory = $null }
-    }
-    $result = & cmd.exe /d /c mklink /J $Path $Fixture.Outside 2>&1
-    if ($LASTEXITCODE -ne 0) { throw "Could not create replacement junction: $result" }
-    return [pscustomobject]@{ Outcome = 'replaced'; MovedDirectory = $moved }
-}
-
-function New-CcodHardLink {
-    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$Existing)
-    $errorCode = [CcodInstallTransactionTestNative]::CreateHardLink($Path, $Existing)
-    if ($errorCode -ne 0) { throw "CreateHardLink failed with Windows error $errorCode" }
-}
-
-function New-CcodJunction {
-    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$Target)
-    $result = & cmd.exe /d /c mklink /J $Path $Target 2>&1
-    if ($LASTEXITCODE -ne 0) { throw "Could not create junction: $result" }
-}
-
-function Invoke-CcodAttemptAdsWrite {
-    param([Parameter(Mandatory)][string]$Path)
-    $previous = $ErrorActionPreference
-    try {
-        $ErrorActionPreference = 'Continue'
-        $output = & cmd.exe /d /c "echo attacker>`"$Path`"" 2>&1
-        $exitCode = $LASTEXITCODE
-    } finally { $ErrorActionPreference = $previous }
-    return [pscustomobject]@{ Outcome = $(if ($exitCode -eq 0) { 'created' } else { 'blocked' }); Output = $output }
+function Open-CcodFixtureGeneration {
+    param([Parameter(Mandatory)]$Fixture,[Parameter(Mandatory)][string]$RuntimeId)
+    $generation = Open-CcodInstallGeneration -InstallRoot $Fixture.Install -RuntimeId $RuntimeId
+    $Fixture.Transactions.Add($generation)
+    $generation
 }
 
 function New-CcodSourceFile {
-    param([Parameter(Mandatory)]$Fixture, [string]$Name = 'source.bin', [string]$Content = 'sealed-source-v1')
+    param([Parameter(Mandatory)]$Fixture,[Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string]$Content)
     $path = Join-Path $Fixture.Base $Name
-    $bytes = [Text.UTF8Encoding]::new($false).GetBytes($Content)
-    [IO.File]::WriteAllBytes($path, $bytes)
-    return [pscustomobject]@{ Path = $path; Length = [int64]$bytes.LongLength; Sha256 = Get-CcodTestFileSha256 -Path $path }
-}
-
-Invoke-CcodTest 'pins a newly created child directory against pathname replacement' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $tx = Open-CcodFixtureTransaction $fixture
-        $child = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'runtime' -CreateIfMissing } @($tx)
-        $result = Invoke-CcodAttemptDirectoryReplacement -Path (Join-Path $fixture.Install 'runtime')
-        Assert-CcodEqual 'blocked' $result.Outcome 'pinned missing directory cannot be replaced after creation'
-        Assert-CcodOutsideUnchanged $fixture 'directory replacement'
-    } finally { Remove-CcodInstallFileFixture $fixture }
+    [IO.File]::WriteAllText($path,$Content)
+    [pscustomobject]@{ Path=$path; Length=[int64](Get-Item -LiteralPath $path).Length; Sha256=(Get-CcodTestFileSha256 $path) }
 }
 
-Invoke-CcodTest 'pins a temporary leaf against replacement before promotion' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $tx = Open-CcodFixtureTransaction $fixture
-        $runtime = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'runtime' -CreateIfMissing } @($tx)
-        $temporary = Invoke-CcodInstallModule { param($Tx,$Parent) New-CcodInstallPinnedTemporaryLeaf -Transaction $Tx -ParentDirectory $Parent -Leaf 'payload.tmp' } @($tx,$runtime)
-        $result = Invoke-CcodAttemptFileReplacement -Path (Join-Path $fixture.Install 'runtime\payload.tmp')
-        Assert-CcodEqual 'blocked' $result.Outcome 'temporary leaf replacement is blocked while pinned'
-        Assert-CcodOutsideUnchanged $fixture 'temporary replacement'
-    } finally { Remove-CcodInstallFileFixture $fixture }
-}
-
-Invoke-CcodTest 'pins sealed source bytes while copying and verifies the destination handle' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $source = New-CcodSourceFile $fixture
-        $tx = Open-CcodFixtureTransaction $fixture
-        $runtime = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'runtime' -CreateIfMissing } @($tx)
-        $temporary = Invoke-CcodInstallModule { param($Tx,$Parent) New-CcodInstallPinnedTemporaryLeaf -Transaction $Tx -ParentDirectory $Parent -Leaf 'payload.tmp' } @($tx,$runtime)
-        $copy = Invoke-CcodInstallModule {
-            param($Tx,$Source,$Leaf,$Length,$Sha)
-            Copy-CcodInstallSealedFile -Transaction $Tx -SourcePath $Source -DestinationLeaf $Leaf -ExpectedLength $Length -ExpectedSha256 $Sha
-        } @($tx,$source.Path,$temporary,$source.Length,$source.Sha256)
-        Assert-CcodEqual $source.Length $copy.Length 'copied length is sealed'
-        Assert-CcodEqual $source.Sha256 $copy.Sha256 'copied digest is sealed'
-        Assert-CcodOutsideUnchanged $fixture 'source replacement'
-    } finally { Remove-CcodInstallFileFixture $fixture }
-}
-
-Invoke-CcodTest 'rejects reparse ADS and multi-link leaf inputs' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        New-CcodJunction -Path (Join-Path $fixture.Install 'linked') -Target $fixture.Outside
-        $tx = Open-CcodFixtureTransaction $fixture
-        Assert-CcodThrows {
-            Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'linked' } @($tx) | Out-Null
-        } 'CCOD_INSTALL_REPARSE_LEAF'
-        Assert-CcodThrows {
-            Invoke-CcodInstallModule { param($Tx) New-CcodInstallPinnedTemporaryLeaf -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'payload.tmp:ads' } @($tx) | Out-Null
-        } 'CCOD_INSTALL_LEAF_INVALID'
-
-        $source = New-CcodSourceFile $fixture
-        New-CcodHardLink -Path (Join-Path $fixture.Base 'source-hardlink.bin') -Existing $source.Path
-        $temporary = Invoke-CcodInstallModule { param($Tx) New-CcodInstallPinnedTemporaryLeaf -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'payload.tmp' } @($tx)
-        Assert-CcodThrows {
-            Invoke-CcodInstallModule {
-                param($Tx,$Source,$Leaf,$Length,$Sha)
-                Copy-CcodInstallSealedFile -Transaction $Tx -SourcePath $Source -DestinationLeaf $Leaf -ExpectedLength $Length -ExpectedSha256 $Sha
-            } @($tx,$source.Path,$temporary,$source.Length,$source.Sha256) | Out-Null
-        } 'CCOD_INSTALL_MULTILINK_LEAF'
-        Assert-CcodTrue ([IO.File]::Exists((Join-Path $fixture.Install 'payload.tmp'))) 'rejected multi-link source retains the owned temporary candidate'
-        Assert-CcodOutsideUnchanged $fixture 'invalid leaves'
-    } finally { Remove-CcodInstallFileFixture $fixture }
+function New-CcodGenerationManifest {
+    param([Parameter(Mandatory)][string]$RuntimeId,[object[]]$Files=@())
+    [ordered]@{ schemaVersion=1; projectVersion='2.5.22'; runtimeId=$RuntimeId; commit='0123456789abcdef0123456789abcdef01234567'; files=@($Files) }
 }
 
-Invoke-CcodTest 'rejects an existing ADS-bearing promotion destination without replacement' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $destination = Join-Path $fixture.Install 'active.json'
-        [IO.File]::WriteAllText($destination, 'old')
-        $adsResult = & cmd.exe /d /c "echo attacker>`"$destination`:metadata`"" 2>&1
-        if ($LASTEXITCODE -ne 0) { throw "Could not create alternate data stream: $adsResult" }
-        $source = New-CcodSourceFile $fixture
-        $tx = Open-CcodFixtureTransaction $fixture
-        $temporary = Invoke-CcodInstallModule { param($Tx) New-CcodInstallPinnedTemporaryLeaf -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'active.tmp' } @($tx)
-        Invoke-CcodInstallModule {
-            param($Tx,$Source,$Leaf,$Length,$Sha)
-            Copy-CcodInstallSealedFile -Transaction $Tx -SourcePath $Source -DestinationLeaf $Leaf -ExpectedLength $Length -ExpectedSha256 $Sha | Out-Null
-        } @($tx,$source.Path,$temporary,$source.Length,$source.Sha256)
-        Assert-CcodThrows {
-            Invoke-CcodInstallModule { param($Tx,$Leaf) Commit-CcodInstallPinnedPromotion -Transaction $Tx -ParentDirectory $Tx.RootDirectory -TemporaryLeaf $Leaf -DestinationLeaf 'active.json' } @($tx,$temporary) | Out-Null
-        } 'CCOD_INSTALL_PROMOTION_DESTINATION_EXISTS'
-        Assert-CcodTrue ([IO.File]::Exists((Join-Path $fixture.Install 'active.tmp'))) 'failed ADS promotion retains the temporary candidate'
-        Assert-CcodOutsideUnchanged $fixture 'ADS destination'
-    } finally { Remove-CcodInstallFileFixture $fixture }
-}
-
-Invoke-CcodTest 'rejects promotion after an ancestor rename changes the pinned parent path' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $source = New-CcodSourceFile $fixture
-        $tx = Open-CcodFixtureTransaction $fixture
-        $runtime = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'runtime' -CreateIfMissing } @($tx)
-        $temporary = Invoke-CcodInstallModule { param($Tx,$Parent) New-CcodInstallPinnedTemporaryLeaf -Transaction $Tx -ParentDirectory $Parent -Leaf 'payload.tmp' } @($tx,$runtime)
-        Invoke-CcodInstallModule {
-            param($Tx,$Source,$Leaf,$Length,$Sha)
-            Copy-CcodInstallSealedFile -Transaction $Tx -SourcePath $Source -DestinationLeaf $Leaf -ExpectedLength $Length -ExpectedSha256 $Sha | Out-Null
-        } @($tx,$source.Path,$temporary,$source.Length,$source.Sha256)
-        $attack = Invoke-CcodReplacePinnedDirectory -Fixture $fixture -Path (Join-Path $fixture.Install 'runtime')
-        if ($attack.Outcome -ceq 'replaced') {
-            Assert-CcodThrows {
-                Invoke-CcodInstallModule { param($Tx,$Parent,$Leaf) Commit-CcodInstallPinnedPromotion -Transaction $Tx -ParentDirectory $Parent -TemporaryLeaf $Leaf -DestinationLeaf 'payload.bin' } @($tx,$runtime,$temporary) | Out-Null
-            } 'CCOD_INSTALL_PIN_CHANGED'
-            Assert-CcodTrue ([IO.File]::Exists((Join-Path $attack.MovedDirectory 'payload.tmp'))) 'renamed-parent promotion retains its temporary candidate'
-        } else {
-            Assert-CcodThrows {
-                Invoke-CcodInstallModule { param($Tx,$Parent,$Leaf) Commit-CcodInstallPinnedPromotion -Transaction $Tx -ParentDirectory $Parent -TemporaryLeaf $Leaf -DestinationLeaf 'payload.bin' } @($tx,$runtime,$temporary) | Out-Null
-            } 'CCOD_INSTALL_PROMOTION_FAILED'
-            Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $fixture.Install 'runtime\payload.bin'))) 'incompatible owned parent publishes no final destination'
-            Assert-CcodTrue ([IO.File]::Exists((Join-Path $fixture.Install 'runtime\payload.tmp'))) 'incompatible owned parent retains sealed temporary bytes'
-        }
-        Assert-CcodOutsideUnchanged $fixture 'renamed parent promotion'
-    } finally { Remove-CcodInstallFileFixture $fixture }
-}
-
-foreach ($case in @('unknown','reparse','multilink')) {
-    Invoke-CcodTest "retains an owned tree containing an unproven $case leaf" {
-        $fixture = New-CcodInstallFileFixture
-        try {
-            $tx = Open-CcodFixtureTransaction $fixture
-            $candidate = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'candidate' -CreateIfMissing } @($tx)
-            switch ($case) {
-                'unknown' { [IO.File]::WriteAllText((Join-Path $fixture.Install 'candidate\surprise.bin'), 'unknown') }
-                'reparse' { New-CcodJunction -Path (Join-Path $fixture.Install 'candidate\outside-link') -Target $fixture.Outside }
-                'multilink' {
-                    $owned = Invoke-CcodInstallModule { param($Tx,$Parent) New-CcodInstallPinnedTemporaryLeaf -Transaction $Tx -ParentDirectory $Parent -Leaf 'owned.tmp' } @($tx,$candidate)
-                    New-CcodHardLink -Path (Join-Path $fixture.Outside 'owned-hardlink.tmp') -Existing (Join-Path $fixture.Install 'candidate\owned.tmp')
-                }
-            }
-            $expected = switch ($case) {
-                'unknown' { 'CCOD_INSTALL_UNKNOWN_LEAF' }
-                'reparse' { 'CCOD_INSTALL_REPARSE_LEAF' }
-                'multilink' { 'CCOD_INSTALL_MULTILINK_LEAF' }
-            }
-            Assert-CcodThrows {
-                Invoke-CcodInstallModule { param($Tx) Remove-CcodInstallOwnedTree -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'candidate' } @($tx) | Out-Null
-            } $expected
-            Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $fixture.Install 'candidate'))) "failed $case cleanup retains the candidate directory"
-            Assert-CcodOutsideUnchanged $fixture "$case cleanup"
-        } finally { Remove-CcodInstallFileFixture $fixture }
-    }
-}
-
-Invoke-CcodTest 'retires a fully proven nonempty owned tree with every byte intact' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $source = New-CcodSourceFile $fixture
-        $tx = Open-CcodFixtureTransaction $fixture
-        $candidate = Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'candidate' -CreateIfMissing } @($tx)
-        $temporary = Invoke-CcodInstallModule { param($Tx,$Parent) New-CcodInstallPinnedTemporaryLeaf -Transaction $Tx -ParentDirectory $Parent -Leaf 'payload.tmp' } @($tx,$candidate)
-        Invoke-CcodInstallModule {
-            param($Tx,$Source,$Leaf,$Length,$Sha)
-            Copy-CcodInstallSealedFile -Transaction $Tx -SourcePath $Source -DestinationLeaf $Leaf -ExpectedLength $Length -ExpectedSha256 $Sha | Out-Null
-        } @($tx,$source.Path,$temporary,$source.Length,$source.Sha256)
-        $retirement = Invoke-CcodInstallModule { param($Tx) Remove-CcodInstallOwnedTree -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'candidate' } @($tx)
-        Assert-CcodEqual 'Retired' $retirement.Disposition 'nonempty cleanup returns bounded retirement result'
-        Assert-CcodEqual '' (@($retirement.Object.PSObject.Properties.Name) -join ',') 'retired object capability exposes no path or handle'
-        Assert-CcodTrue (-not [IO.Directory]::Exists((Join-Path $fixture.Install 'candidate'))) 'one atomic retirement removes the live candidate name'
-        Close-CcodInstallFileTransaction -Transaction $tx -Disposition Failed | Out-Null
-        $fixture.Transaction = $null
-        $retired = @(Get-ChildItem -LiteralPath $fixture.Install -Directory -Force | Where-Object Name -Like '.__ccod_retired_*')
-        Assert-CcodEqual 1 $retired.Count 'exactly one retired quarantine object remains'
-        Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 (Join-Path $retired[0].FullName 'payload.tmp')) 'retired object retains every sealed payload byte'
-        Assert-CcodOutsideUnchanged $fixture 'owned tree removal'
-    } finally { Remove-CcodInstallFileFixture $fixture }
-}
-
-Invoke-CcodTest 'retirement collision leaves live candidate and collision untouched' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $source = New-CcodSourceFile $fixture
-        $collisionLeaf = '.__ccod_retired_forced_collision'
-        $collision = Join-Path $fixture.Install $collisionLeaf
-        [IO.Directory]::CreateDirectory($collision) | Out-Null
-        $collisionSentinel = Join-Path $collision 'collision.txt'
-        [IO.File]::WriteAllText($collisionSentinel, 'collision-original')
-        $collisionSha = Get-CcodTestFileSha256 $collisionSentinel
-        $tx = Open-CcodFixtureTransaction $fixture
-        $candidate = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' -CreateIfMissing
-        $temporary = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $candidate -Leaf 'payload.tmp'
-        Copy-CcodInstallSealedFile -Transaction $tx -SourcePath $source.Path -DestinationLeaf $temporary -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256 | Out-Null
-        Assert-CcodThrows {
-            Invoke-CcodInstallModule {
-                param($Tx,$Parent,$Leaf,$RetiredLeaf)
-                $pin = Get-CcodPinToken $Tx $Parent Directory
-                Convert-CcodRuntimeError {
-                    Invoke-CcodRuntimeMethod $pin.State.Runtime RemoveOwnedTreeCore @($pin.Token,$Leaf,$RetiredLeaf) | Out-Null
-                } 'CCOD_INSTALL_RETIREMENT_FAILED'
-            } @($tx,$tx.RootDirectory,'candidate',$collisionLeaf)
-        } 'CCOD_INSTALL_RETIREMENT_DESTINATION_EXISTS'
-        Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $fixture.Install 'candidate'))) 'collision retains the original live candidate name'
-        Close-CcodInstallFileTransaction -Transaction $tx -Disposition Failed | Out-Null
-        $fixture.Transaction = $null
-        Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 (Join-Path $fixture.Install 'candidate\payload.tmp')) 'collision retains every candidate byte'
-        Assert-CcodEqual $collisionSha (Get-CcodTestFileSha256 $collisionSentinel) 'collision target remains untouched'
-        Assert-CcodOutsideUnchanged $fixture 'retirement collision'
-    } finally { Remove-CcodInstallFileFixture $fixture }
-}
-
-Invoke-CcodTest 'owned-parent promotion fails closed without publishing a copy' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $source = New-CcodSourceFile $fixture
-        $tx = Open-CcodFixtureTransaction $fixture
-        $candidate = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' -CreateIfMissing
-        $temporary = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $candidate -Leaf 'sealed.tmp'
-        Copy-CcodInstallSealedFile -Transaction $tx -SourcePath $source.Path -DestinationLeaf $temporary -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256 | Out-Null
-        Assert-CcodThrows {
-            Commit-CcodInstallPinnedPromotion -Transaction $tx -ParentDirectory $candidate -TemporaryLeaf $temporary -DestinationLeaf 'final.bin' | Out-Null
-        } 'CCOD_INSTALL_PROMOTION_FAILED'
-        Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $fixture.Install 'candidate\final.bin'))) 'failed owned-parent rename publishes no final destination'
-        Assert-CcodTrue ([IO.File]::Exists((Join-Path $fixture.Install 'candidate\sealed.tmp'))) 'failed owned-parent rename retains the sealed temporary leaf'
-        Assert-CcodOutsideUnchanged $fixture 'owned-parent promotion failure'
-    } finally { Remove-CcodInstallFileFixture $fixture }
-}
-
-Invoke-CcodTest 'compatible-parent promotion is readable before transaction close' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $source = New-CcodSourceFile $fixture
-        $tx = Open-CcodFixtureTransaction $fixture
-        $temporary = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'readable.tmp'
-        Copy-CcodInstallSealedFile -Transaction $tx -SourcePath $source.Path -DestinationLeaf $temporary -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256 | Out-Null
-        Commit-CcodInstallPinnedPromotion -Transaction $tx -ParentDirectory $tx.RootDirectory -TemporaryLeaf $temporary -DestinationLeaf 'readable.bin' | Out-Null
-        Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 (Join-Path $fixture.Install 'readable.bin')) 'compatible atomic promotion is readable while transaction stays open'
-        Assert-CcodOutsideUnchanged $fixture 'readable compatible promotion'
-    } finally { Remove-CcodInstallFileFixture $fixture }
-}
-
-Invoke-CcodTest 'deletes an empty fully-owned candidate after establishing its root disposition' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $tx = Open-CcodFixtureTransaction $fixture
-        $candidate = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'empty-candidate' -CreateIfMissing
-        Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'empty-candidate' | Out-Null
-        Assert-CcodTrue (-not [IO.Directory]::Exists((Join-Path $fixture.Install 'empty-candidate'))) 'empty owned candidate is deleted only after its root disposition is established'
-        Assert-CcodOutsideUnchanged $fixture 'empty owned tree removal'
-    } finally { Remove-CcodInstallFileFixture $fixture }
-}
-
-foreach ($case in @('json','log')) {
-    Invoke-CcodTest "rejects a pinned $case write after parent pathname replacement" {
-        $fixture = New-CcodInstallFileFixture
-        try {
-            $tx = Open-CcodFixtureTransaction $fixture
-            $parent = Invoke-CcodInstallModule { param($Tx,$Leaf) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf $Leaf -CreateIfMissing } @($tx,$case)
-            $attack = Invoke-CcodReplacePinnedDirectory -Fixture $fixture -Path (Join-Path $fixture.Install $case)
-            if ($case -ceq 'json') {
-                if ($attack.Outcome -ceq 'replaced') {
-                    Assert-CcodThrows { Invoke-CcodInstallModule { param($Tx,$Parent) Write-CcodInstallPinnedJson -Transaction $Tx -ParentDirectory $Parent -Leaf 'state.json' -Value ([ordered]@{ schemaVersion = 1; value = 'safe' }) -Compress } @($tx,$parent) } 'CCOD_INSTALL_PIN_CHANGED'
-                } else {
-                    Assert-CcodThrows { Invoke-CcodInstallModule { param($Tx,$Parent) Write-CcodInstallPinnedJson -Transaction $Tx -ParentDirectory $Parent -Leaf 'state.json' -Value ([ordered]@{ schemaVersion = 1; value = 'safe' }) -Compress } @($tx,$parent) } 'CCOD_INSTALL_PROMOTION_FAILED'
-                    Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $fixture.Install "$case\state.json"))) 'incompatible owned JSON parent publishes no final state'
-                }
-                Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $fixture.Outside 'state.json'))) 'replaced JSON path is untouched'
-            } else {
-                if ($attack.Outcome -ceq 'replaced') {
-                    Assert-CcodThrows { Invoke-CcodInstallModule { param($Tx,$Parent) Append-CcodInstallPinnedLog -Transaction $Tx -ParentDirectory $Parent -Leaf 'install.log' -Record ([ordered]@{ event = 'safe'; code = 'CCOD_TEST' }) } @($tx,$parent) } 'CCOD_INSTALL_PIN_CHANGED'
-                } else {
-                    Invoke-CcodInstallModule { param($Tx,$Parent) Append-CcodInstallPinnedLog -Transaction $Tx -ParentDirectory $Parent -Leaf 'install.log' -Record ([ordered]@{ event = 'safe'; code = 'CCOD_TEST' }) } @($tx,$parent) | Out-Null
-                }
-                Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $fixture.Outside 'install.log'))) 'replaced log path is untouched'
-            }
-            Assert-CcodOutsideUnchanged $fixture "replaced $case parent"
-        } finally { Remove-CcodInstallFileFixture $fixture }
-    }
-}
-
-Invoke-CcodTest 'writes pinned JSON and appends sanitized records through relative handles' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $tx = Open-CcodFixtureTransaction $fixture
-        $state = $tx.RootDirectory
-        $logs = $tx.RootDirectory
-        Invoke-CcodInstallModule { param($Tx,$Parent) Write-CcodInstallPinnedJson -Transaction $Tx -ParentDirectory $Parent -Leaf 'active.json' -Value ([ordered]@{ schemaVersion = 1; active = 'runtime-a' }) -Compress } @($tx,$state) | Out-Null
-        Assert-CcodThrows {
-            Invoke-CcodInstallModule { param($Tx,$Parent) Write-CcodInstallPinnedJson -Transaction $Tx -ParentDirectory $Parent -Leaf 'active.json' -Value ([ordered]@{ schemaVersion = 1; active = 'runtime-b' }) -Compress } @($tx,$state) | Out-Null
-        } 'CCOD_INSTALL_PROMOTION_DESTINATION_EXISTS'
-        Invoke-CcodInstallModule { param($Tx,$Parent) Append-CcodInstallPinnedLog -Transaction $Tx -ParentDirectory $Parent -Leaf 'install.log' -Record ([ordered]@{ event = 'one'; code = 'CCOD_OK' }) } @($tx,$logs) | Out-Null
-        Invoke-CcodInstallModule { param($Tx,$Parent) Append-CcodInstallPinnedLog -Transaction $Tx -ParentDirectory $Parent -Leaf 'install.log' -Record ([ordered]@{ event = 'two'; code = 'CCOD_READY' }) } @($tx,$logs) | Out-Null
-        Invoke-CcodInstallModule { param($Tx) Close-CcodInstallFileTransaction -Transaction $Tx -Disposition Ready } @($tx) | Out-Null
-        $fixture.Transaction = $null
-
-        $json = [IO.File]::ReadAllText((Join-Path $fixture.Install 'active.json'), [Text.UTF8Encoding]::new($false)) | ConvertFrom-Json
-        Assert-CcodEqual 'runtime-a' $json.active 'no-replace pinned JSON preserves the first committed object'
-        $records = @([IO.File]::ReadAllLines((Join-Path $fixture.Install 'install.log'), [Text.UTF8Encoding]::new($false)))
-        Assert-CcodEqual 2 $records.Count 'pinned log appends one JSON line per record'
-        Assert-CcodEqual 'one' (($records[0] | ConvertFrom-Json).event) 'first log record is retained'
-        Assert-CcodEqual 'two' (($records[1] | ConvertFrom-Json).event) 'second log record is appended'
-        Assert-CcodOutsideUnchanged $fixture 'successful pinned writers'
-    } finally { Remove-CcodInstallFileFixture $fixture }
-}
-
-Invoke-CcodTest 'exports only the private transaction surface and closes on a terminal disposition' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $expectedExports = @(
-            'Append-CcodInstallPinnedLog','Close-CcodInstallFileTransaction','Commit-CcodInstallPinnedPromotion',
-            'Copy-CcodInstallSealedFile','New-CcodInstallPinnedTemporaryLeaf','Open-CcodInstallFileTransaction',
-            'Open-CcodInstallPinnedDirectory','Remove-CcodInstallOwnedTree','Write-CcodInstallPinnedJson'
-        )
-        $actualExports = @($module.ExportedFunctions.Keys | Sort-Object)
-        Assert-CcodEqual ($expectedExports -join ',') ($actualExports -join ',') 'module exports only the approved private transaction surface'
-        $tx = Open-CcodFixtureTransaction $fixture
-        Invoke-CcodInstallModule { param($Tx) Close-CcodInstallFileTransaction -Transaction $Tx -Disposition Ready } @($tx) | Out-Null
-        $fixture.Transaction = $null
-        Assert-CcodEqual 'RootDirectory' (@($tx.PSObject.Properties.Name) -join ',') 'terminal transaction remains opaque'
-        Assert-CcodThrows {
-            Invoke-CcodInstallModule { param($Tx) Open-CcodInstallPinnedDirectory -Transaction $Tx -ParentDirectory $Tx.RootDirectory -Leaf 'after-close' -CreateIfMissing } @($tx) | Out-Null
-        } 'CCOD_INSTALL_TRANSACTION_CLOSED'
-    } finally { Remove-CcodInstallFileFixture $fixture }
-}
-
-Invoke-CcodTest 'returns opaque unforgeable capabilities and hides native mutation helpers' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $tx = Open-CcodFixtureTransaction $fixture
-        $txProperties = @($tx.PSObject.Properties.Name)
-        Assert-CcodEqual 'RootDirectory' ($txProperties -join ',') 'transaction reveals only its root capability'
-        $rootProperties = @($tx.RootDirectory.PSObject.Properties.Name)
-        Assert-CcodEqual '' ($rootProperties -join ',') 'directory capability reveals no native or ownership state'
-        $transactionAssemblyExports = @([CcodInstallCapabilityMarker].Assembly.ExportedTypes | Select-Object -ExpandProperty Name | Sort-Object)
-        Assert-CcodEqual 'CcodInstallCapabilityMarker' ($transactionAssemblyExports -join ',') 'transaction assembly exports only a non-mutating marker type'
-        $dangerousPublicMethods = @([CcodInstallCapabilityMarker].Assembly.ExportedTypes | ForEach-Object {
-            $_.GetMethods([Reflection.BindingFlags]'Public,Static') | Where-Object {
-                $_.Name -match 'Open|Create|Rename|Delete|Write|Append|Promote|Remove' -or
-                @($_.GetParameters().ParameterType.FullName) -contains 'Microsoft.Win32.SafeHandles.SafeFileHandle'
-            }
-        })
-        Assert-CcodEqual 0 $dangerousPublicMethods.Count 'transaction assembly exposes no public native mutation helper'
-        Assert-CcodEqual $null ('CcodInstallRuntime' -as [type]) 'internal runtime type is not directly callable through PowerShell type resolution'
-
-        $forged = [pscustomobject]@{}
-        Assert-CcodThrows {
-            Open-CcodInstallPinnedDirectory -Transaction $forged -ParentDirectory $tx.RootDirectory -Leaf 'forged' -CreateIfMissing | Out-Null
-        } 'CCOD_INSTALL_TRANSACTION_INVALID'
-
-        $otherFixture = New-CcodInstallFileFixture
-        try {
-            $other = Open-CcodFixtureTransaction $otherFixture
-            Assert-CcodThrows {
-                Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $other.RootDirectory -Leaf 'cross-issuer' -CreateIfMissing | Out-Null
-            } 'CCOD_INSTALL_PIN_INVALID'
-        } finally { Remove-CcodInstallFileFixture $otherFixture }
-        Assert-CcodOutsideUnchanged $fixture 'opaque capability rejection'
-    } finally { Remove-CcodInstallFileFixture $fixture }
+function Assert-CcodOutsideUnchanged {
+    param([Parameter(Mandatory)]$Fixture,[Parameter(Mandatory)][string]$Message)
+    Assert-CcodTrue ([IO.File]::Exists($Fixture.Sentinel)) "$Message sentinel exists"
+    Assert-CcodEqual $Fixture.SentinelSha256 (Get-CcodTestFileSha256 $Fixture.Sentinel) "$Message sentinel bytes"
 }
 
-Invoke-CcodTest 'recomputes the private seal and never trusts forged public fields' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $source = New-CcodSourceFile $fixture
-        $tx = Open-CcodFixtureTransaction $fixture
-        $temporary = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'sealed.tmp'
-        Copy-CcodInstallSealedFile -Transaction $tx -SourcePath $source.Path -DestinationLeaf $temporary -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256 | Out-Null
-        $forgedLeaf = [pscustomobject]@{ Sealed = $true; Length = $source.Length; Sha256 = $source.Sha256 }
-        Assert-CcodThrows {
-            Commit-CcodInstallPinnedPromotion -Transaction $tx -ParentDirectory $tx.RootDirectory -TemporaryLeaf $forgedLeaf -DestinationLeaf 'forged.bin' | Out-Null
-        } 'CCOD_INSTALL_PIN_INVALID'
-        Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $fixture.Install 'forged.bin'))) 'forged public sealing fields cannot create a destination'
-        $independentWrite = $null
-        try {
-            $independentWrite = [IO.File]::Open((Join-Path $fixture.Install 'sealed.tmp'), [IO.FileMode]::Open, [IO.FileAccess]::Write, [IO.FileShare]::Read)
-        } catch [IO.IOException] { }
-        if ($null -ne $independentWrite) {
-            try {
-                $bytes = [Text.UTF8Encoding]::new($false).GetBytes('tampered')
-                $independentWrite.SetLength(0); $independentWrite.Write($bytes,0,$bytes.Length); $independentWrite.Flush($true)
-            } finally { $independentWrite.Dispose() }
-            Assert-CcodThrows {
-                Commit-CcodInstallPinnedPromotion -Transaction $tx -ParentDirectory $tx.RootDirectory -TemporaryLeaf $temporary -DestinationLeaf 'sealed.bin' | Out-Null
-            } 'CCOD_INSTALL_SEAL_MISMATCH'
-        } else {
-            Commit-CcodInstallPinnedPromotion -Transaction $tx -ParentDirectory $tx.RootDirectory -TemporaryLeaf $temporary -DestinationLeaf 'sealed.bin' | Out-Null
-            Close-CcodInstallFileTransaction -Transaction $tx -Disposition Ready | Out-Null
-            $fixture.Transaction = $null
-            Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 (Join-Path $fixture.Install 'sealed.bin')) 'blocked mutation preserves sealed promotion bytes'
-        }
-        Assert-CcodOutsideUnchanged $fixture 'seal recomputation'
-    } finally { Remove-CcodInstallFileFixture $fixture }
+function Invoke-CcodMoveAttempt {
+    param([Parameter(Mandatory)][string]$Path)
+    try { [IO.File]::Move($Path,$Path+'.moved'); 'moved' } catch [IO.IOException] { 'blocked' } catch [UnauthorizedAccessException] { 'blocked' }
 }
 
-Invoke-CcodTest 'promotion is no-replace when a destination appears before commit' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $source = New-CcodSourceFile $fixture
-        $tx = Open-CcodFixtureTransaction $fixture
-        $temporary = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'new.tmp'
-        Copy-CcodInstallSealedFile -Transaction $tx -SourcePath $source.Path -DestinationLeaf $temporary -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256 | Out-Null
-        $destination = Join-Path $fixture.Install 'existing.bin'
-        [IO.File]::WriteAllText($destination, 'unexpected-existing-object')
-        $existingSha = Get-CcodTestFileSha256 $destination
-        Assert-CcodThrows {
-            Commit-CcodInstallPinnedPromotion -Transaction $tx -ParentDirectory $tx.RootDirectory -TemporaryLeaf $temporary -DestinationLeaf 'existing.bin' | Out-Null
-        } 'CCOD_INSTALL_PROMOTION_DESTINATION_EXISTS'
-        Assert-CcodEqual $existingSha (Get-CcodTestFileSha256 $destination) 'no-replace leaves the existing object untouched'
-        Assert-CcodTrue ([IO.File]::Exists((Join-Path $fixture.Install 'new.tmp'))) 'no-replace failure retains the sealed temporary leaf'
-        Assert-CcodOutsideUnchanged $fixture 'no-replace promotion'
-    } finally { Remove-CcodInstallFileFixture $fixture }
+function New-CcodJunction {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$Target)
+    $previous=$ErrorActionPreference
+    try { $ErrorActionPreference='Continue'; $output=& cmd.exe /d /c mklink /J $Path $Target 2>&1; $exitCode=$LASTEXITCODE } finally { $ErrorActionPreference=$previous }
+    if($exitCode-ne 0){throw "Could not create junction: $($output -join ' ')"}
 }
 
-foreach ($directoryCase in @('root','child','owned')) {
-    Invoke-CcodTest "rejects $directoryCase directory alternate data streams" {
-        $fixture = New-CcodInstallFileFixture
+function New-CcodHardLink {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$Existing)
+    $previous=$ErrorActionPreference
+    try { $ErrorActionPreference='Continue'; $output=& cmd.exe /d /c mklink /H $Path $Existing 2>&1; $exitCode=$LASTEXITCODE } finally { $ErrorActionPreference=$previous }
+    if($exitCode-ne 0){throw "Could not create hard link: $($output -join ' ')"}
+}
+
+Invoke-CcodTest 'exports only immutable generation operations and an inert CLR marker' {
+    $expected=@('Close-CcodInstallFileTransaction','Commit-CcodInstallActivePointer','Copy-CcodInstallSealedSource','New-CcodInstallGenerationLeaf','Open-CcodInstallGeneration','Retire-CcodInstallGeneration','Write-CcodInstallGenerationManifest')
+    Assert-CcodEqual ($expected -join '|') ((@($module.ExportedCommands.Keys)|Sort-Object)-join '|') 'module export surface is capability-only'
+    Assert-CcodEqual 1 ([CcodInstallCapabilityMarker]::CapabilityAbi) 'marker exposes a non-mutating ABI value'
+    Assert-CcodEqual 'CcodInstallCapabilityMarker' ((@([CcodInstallCapabilityMarker].Assembly.GetExportedTypes()|ForEach-Object FullName)) -join '|') 'CLR bridge exports only the inert marker'
+    $dangerous=@([CcodInstallCapabilityMarker].GetMethods([Reflection.BindingFlags]'Public,Static,DeclaredOnly')|Where-Object{@($_.GetParameters()|Where-Object{$_.ParameterType-in@([string],[IntPtr],[IO.Stream])-or[Microsoft.Win32.SafeHandles.SafeHandle].IsAssignableFrom($_.ParameterType)}).Count-ne 0})
+    Assert-CcodEqual 0 $dangerous.Count 'marker accepts no path stream or bare handle'
+}
+
+Invoke-CcodTest 'generation and capabilities are unique create-only opaque references' {
+    $fixture=New-CcodInstallFileFixture
+    try {
+        $runtimeId='runtime-unique-a';$source=New-CcodSourceFile $fixture 'first.bin' 'first-generation-bytes';$generation=Open-CcodFixtureGeneration $fixture $runtimeId
+        Assert-CcodEqual '' (@($generation.PSObject.Properties.Name)-join ',') 'generation capability exposes no fields'
+        Copy-CcodInstallSealedSource -Generation $generation -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null
+        $payload=Join-Path $fixture.Install "runtime\$runtimeId\payload.bin";$before=Get-CcodTestFileSha256 $payload
+        Assert-CcodThrows {Open-CcodInstallGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId|Out-Null} 'CCOD_INSTALL_GENERATION_EXISTS'
+        Assert-CcodEqual $before (Get-CcodTestFileSha256 $payload) 'duplicate generation leaves existing bytes unchanged'
+        $child=New-CcodInstallGenerationLeaf -Generation $generation -Leaf 'child'
+        Assert-CcodEqual '' (@($child.PSObject.Properties.Name)-join ',') 'child capability exposes no fields'
+        Assert-CcodThrows {New-CcodInstallGenerationLeaf -Generation $generation -Leaf 'child'|Out-Null} 'CCOD_INSTALL_LEAF_EXISTS'
+        Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $fixture.Install "runtime\$runtimeId\child"))) 'duplicate child keeps existing directory'
+        Assert-CcodOutsideUnchanged $fixture 'duplicate generation and directory'
+    } finally {Remove-CcodInstallFileFixture $fixture}
+}
+
+Invoke-CcodTest 'destination collisions preserve the first object byte-for-byte' {
+    $fixture=New-CcodInstallFileFixture
+    try {
+        $runtimeId='runtime-destination-collision';$first=New-CcodSourceFile $fixture 'first.bin' 'first-object';$second=New-CcodSourceFile $fixture 'second.bin' 'second-object';$generation=Open-CcodFixtureGeneration $fixture $runtimeId
+        Copy-CcodInstallSealedSource -Generation $generation -SourcePath $first.Path -Leaf 'payload.bin' -ExpectedLength $first.Length -ExpectedSha256 $first.Sha256|Out-Null
+        Assert-CcodThrows {Copy-CcodInstallSealedSource -Generation $generation -SourcePath $second.Path -Leaf 'payload.bin' -ExpectedLength $second.Length -ExpectedSha256 $second.Sha256|Out-Null} 'CCOD_INSTALL_LEAF_EXISTS'
+        Assert-CcodEqual $first.Sha256 (Get-CcodTestFileSha256 (Join-Path $fixture.Install "runtime\$runtimeId\payload.bin")) 'collision never overwrites the first object'
+        Assert-CcodOutsideUnchanged $fixture 'destination collision'
+    } finally {Remove-CcodInstallFileFixture $fixture}
+}
+
+Invoke-CcodTest 'source and destination handles remain private pinned and same-handle verified' {
+    $fixture=New-CcodInstallFileFixture
+    try {
+        $runtimeId='runtime-pinned-copy';$source=New-CcodSourceFile $fixture 'source.bin' 'sealed-source-v1';$generation=Open-CcodFixtureGeneration $fixture $runtimeId
+        $copy=Copy-CcodInstallSealedSource -Generation $generation -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256
+        Assert-CcodEqual $source.Length $copy.Length 'copy returns verified length';Assert-CcodEqual $source.Sha256 $copy.Sha256 'copy returns verified digest'
+        Assert-CcodEqual 'blocked' (Invoke-CcodMoveAttempt $source.Path) 'source replacement is blocked after its handle opens'
+        $destination=Join-Path $fixture.Install "runtime\$runtimeId\payload.bin";Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 $destination) 'destination bytes match sealed handle digest'
+        try {[IO.File]::WriteAllText($destination,'attacker');throw 'ASSERT_DESTINATION_MUTABLE'} catch [IO.IOException] {}
+        Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 $destination) 'destination handle blocks mutation after verification'
+        Assert-CcodOutsideUnchanged $fixture 'pinned copy'
+    } finally {Remove-CcodInstallFileFixture $fixture}
+}
+
+Invoke-CcodTest 'manifest is create-only pinned and immutable after its same-handle write' {
+    $fixture=New-CcodInstallFileFixture
+    try {
+        $runtimeId='runtime-manifest';$generation=Open-CcodFixtureGeneration $fixture $runtimeId;$result=Write-CcodInstallGenerationManifest -Generation $generation -Manifest (New-CcodGenerationManifest $runtimeId)
+        Assert-CcodTrue ($result.Length-gt 0) 'manifest returns verified length';Assert-CcodTrue ($result.Sha256-cmatch'^[0-9a-f]{64}$') 'manifest returns lowercase digest'
+        $path=Join-Path $fixture.Install "runtime\$runtimeId\manifest.json";$before=Get-CcodTestFileSha256 $path
+        Assert-CcodThrows {Write-CcodInstallGenerationManifest -Generation $generation -Manifest (New-CcodGenerationManifest $runtimeId)|Out-Null} 'CCOD_INSTALL_LEAF_EXISTS'
+        try {[IO.File]::WriteAllText($path,'{"attacker":true}');throw 'ASSERT_MANIFEST_MUTABLE'} catch [IO.IOException] {}
+        Assert-CcodEqual $before (Get-CcodTestFileSha256 $path) 'manifest mutation changes no bytes';Assert-CcodOutsideUnchanged $fixture 'manifest immutability'
+    } finally {Remove-CcodInstallFileFixture $fixture}
+}
+
+Invoke-CcodTest 'rejects reparse ADS and multilink inputs before publishing a leaf' {
+    foreach($case in @('reparse','ads','multilink')){
+        $fixture=New-CcodInstallFileFixture
         try {
-            if ($directoryCase -ceq 'root') {
-                $adsPath = $fixture.Install + ':metadata'
-                $adsResult = Invoke-CcodAttemptAdsWrite $adsPath
-                Assert-CcodEqual 'created' $adsResult.Outcome 'root ADS fixture is established before pinning'
-                Assert-CcodThrows { Open-CcodFixtureTransaction $fixture | Out-Null } 'CCOD_INSTALL_ADS_LEAF'
-            } else {
-                $tx = Open-CcodFixtureTransaction $fixture
-                $directory = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf $directoryCase -CreateIfMissing
-                $adsPath = (Join-Path $fixture.Install $directoryCase) + ':metadata'
-                $adsResult = Invoke-CcodAttemptAdsWrite $adsPath
-                if ($adsResult.Outcome -ceq 'blocked') {
-                    Assert-CcodTrue $true "$directoryCase directory pin blocks ADS creation"
-                } elseif ($directoryCase -ceq 'child') {
-                    Assert-CcodThrows {
-                        New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $directory -Leaf 'blocked.tmp' | Out-Null
-                    } 'CCOD_INSTALL_ADS_LEAF'
-                } else {
-                    Assert-CcodThrows {
-                        Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'owned'
-                    } 'CCOD_INSTALL_ADS_LEAF'
-                    Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $fixture.Install 'owned'))) 'directory ADS cleanup failure retains the owned directory'
-                }
+            $runtimeId="runtime-invalid-$case"
+            if($case-ceq'reparse'){
+                [IO.Directory]::CreateDirectory((Join-Path $fixture.Install 'runtime'))|Out-Null;New-CcodJunction (Join-Path $fixture.Install "runtime\$runtimeId") $fixture.Outside
+                Assert-CcodThrows {Open-CcodInstallGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId|Out-Null} 'CCOD_INSTALL_GENERATION_EXISTS';Assert-CcodOutsideUnchanged $fixture 'reparse collision';continue
             }
-            Assert-CcodOutsideUnchanged $fixture "$directoryCase directory ADS"
-        } finally { Remove-CcodInstallFileFixture $fixture }
+            $source=New-CcodSourceFile $fixture 'source.bin' 'invalid-source';$generation=Open-CcodFixtureGeneration $fixture $runtimeId
+            if($case-ceq'ads'){
+                $previous=$ErrorActionPreference
+                try {$ErrorActionPreference='Continue';$output=& cmd.exe /d /c "echo attacker>`"$($source.Path):metadata`"" 2>&1;$exitCode=$LASTEXITCODE} finally {$ErrorActionPreference=$previous}
+                if($exitCode-ne 0){throw "Could not create alternate data stream: $($output -join ' ')"}
+                $expected='CCOD_INSTALL_ADS_LEAF'
+            }else{New-CcodHardLink (Join-Path $fixture.Outside 'outside-hardlink.bin') $source.Path;$expected='CCOD_INSTALL_MULTILINK_LEAF'}
+            Assert-CcodThrows {Copy-CcodInstallSealedSource -Generation $generation -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null} $expected
+            Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $fixture.Install "runtime\$runtimeId\payload.bin"))) "$case publishes no destination";Assert-CcodOutsideUnchanged $fixture "$case input"
+        } finally {Remove-CcodInstallFileFixture $fixture}
     }
 }
 
-Invoke-CcodTest 'retires a nonempty tree containing a read-only owned leaf without changing bytes' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $tx = Open-CcodFixtureTransaction $fixture
-        $candidate = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' -CreateIfMissing
-        $first = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $candidate -Leaf 'a.tmp'
-        $later = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $candidate -Leaf 'z.tmp'
-        [IO.File]::SetAttributes((Join-Path $fixture.Install 'candidate\z.tmp'), [IO.FileAttributes]::ReadOnly)
-        $result = Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate'
-        Assert-CcodEqual 'Retired' $result.Disposition 'read-only leaf uses atomic retirement instead of recursive deletion'
-        Assert-CcodTrue (-not [IO.Directory]::Exists((Join-Path $fixture.Install 'candidate'))) 'read-only candidate leaves the live namespace atomically'
-        Close-CcodInstallFileTransaction -Transaction $tx -Disposition Failed | Out-Null
-        $fixture.Transaction = $null
-        $retired = @(Get-ChildItem -LiteralPath $fixture.Install -Directory -Force | Where-Object Name -Like '.__ccod_retired_*')
-        Assert-CcodEqual 1 $retired.Count 'read-only candidate has one retired object'
-        Assert-CcodTrue ([IO.File]::Exists((Join-Path $retired[0].FullName 'a.tmp'))) 'first leaf remains in retired tree'
-        Assert-CcodTrue ([IO.File]::Exists((Join-Path $retired[0].FullName 'z.tmp'))) 'read-only leaf remains in retired tree'
-        Assert-CcodOutsideUnchanged $fixture 'read-only retirement'
-    } finally { Remove-CcodInstallFileFixture $fixture }
-}
-
-Invoke-CcodTest 'retires a nested owned directory without releasing its contents' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $tx = Open-CcodFixtureTransaction $fixture
-        $candidate = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' -CreateIfMissing
-        $child = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $candidate -Leaf 'child' -CreateIfMissing
-        $result = Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate'
-        Assert-CcodEqual 'Retired' $result.Disposition 'nested nonempty candidate is retired'
-        Assert-CcodTrue (-not [IO.Directory]::Exists((Join-Path $fixture.Install 'candidate'))) 'nested candidate live name disappears atomically'
-        Close-CcodInstallFileTransaction -Transaction $tx -Disposition Failed | Out-Null
-        $fixture.Transaction = $null
-        $retired = @(Get-ChildItem -LiteralPath $fixture.Install -Directory -Force | Where-Object Name -Like '.__ccod_retired_*')
-        Assert-CcodEqual 1 $retired.Count 'nested candidate has one retired object'
-        Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $retired[0].FullName 'child'))) 'nested child directory remains intact after retirement'
-        Assert-CcodOutsideUnchanged $fixture 'nested directory retirement'
-    } finally { Remove-CcodInstallFileFixture $fixture }
-}
-
-Invoke-CcodTest 'detects an unknown insertion between deletion planning and first release' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $tx = Open-CcodFixtureTransaction $fixture
-        $candidate = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' -CreateIfMissing
-        $first = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $candidate -Leaf 'a-first.tmp'
-        for ($index = 0; $index -lt 128; $index++) {
-            New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $candidate -Leaf ('b-{0:d3}.tmp' -f $index) | Out-Null
-        }
-        $watch = Join-Path $fixture.Install 'candidate\a-first.tmp'
-        $unknown = Join-Path $fixture.Install 'candidate\concurrent-unknown.tmp'
-        $attacker = [CcodInstallTransactionTestNative]::InsertUnknownAfterDelay($unknown, 1)
-        $failure = $null
-        $retirement = $null
-        try { $retirement = Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' }
-        catch { $failure = $_ }
-        $attackOutcome = $attacker.GetAwaiter().GetResult()
-        Assert-CcodTrue ($attackOutcome -in @('inserted','blocked')) 'concurrent namespace attempt reaches the cleanup boundary'
-        if ($attackOutcome -ceq 'inserted') {
-            Assert-CcodTrue ($null -ne $failure -and $failure.FullyQualifiedErrorId -match '^CCOD_INSTALL_(?:UNKNOWN_LEAF|DELETE_FAILED)') "inserted unknown leaf fails cleanup before release actual=$($failure.FullyQualifiedErrorId) message=$($failure.Exception.Message)"
-            Assert-CcodTrue ([IO.File]::Exists($watch)) 'failed concurrent cleanup retains the first candidate leaf'
-            Assert-CcodTrue ([IO.File]::Exists($unknown)) 'unproven concurrent object is retained for diagnosis'
-            Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $fixture.Install 'candidate'))) 'concurrent insertion retains the complete candidate tree'
-        } else {
-            Assert-CcodTrue ($null -eq $failure -and $retirement.Disposition -ceq 'Retired') 'blocked insertion permits one atomic retirement'
-        }
-        Assert-CcodOutsideUnchanged $fixture 'concurrent cleanup insertion'
-    } finally { Remove-CcodInstallFileFixture $fixture }
-}
-
-Invoke-CcodTest 'owned directory denies external child creation and hard-link insertion for its lifetime' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $outsideSource = Join-Path $fixture.Outside 'outside-source.bin'
-        [IO.File]::WriteAllText($outsideSource, 'outside-source')
-        $tx = Open-CcodFixtureTransaction $fixture
-        $candidate = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' -CreateIfMissing
-        $childPath = Join-Path $fixture.Install 'candidate\attacker-child.bin'
-        $writeHandleError = [CcodInstallTransactionTestNative]::TryOpenDirectoryForChildWrite((Join-Path $fixture.Install 'candidate'))
-        Assert-CcodTrue ($writeHandleError -ne 0) 'owned directory share lock blocks an external child-write handle'
-
-        $hardLinkPath = Join-Path $fixture.Install 'candidate\attacker-hardlink.bin'
-        $hardLinkError = [CcodInstallTransactionTestNative]::CreateHardLink($hardLinkPath, $outsideSource)
-        Assert-CcodTrue ($hardLinkError -ne 0) 'owned directory share lock blocks external hard-link insertion'
-        Assert-CcodTrue (-not [IO.File]::Exists($childPath)) 'blocked child path remains absent'
-        Assert-CcodTrue (-not [IO.File]::Exists($hardLinkPath)) 'blocked hard-link path remains absent'
-        Assert-CcodOutsideUnchanged $fixture 'owned directory namespace lock'
-    } finally { Remove-CcodInstallFileFixture $fixture }
-}
-
-Invoke-CcodTest 'target pin blocks namespace mutation after descendant handles are released' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $outsideSource = Join-Path $fixture.Outside 'outside-source.bin'
-        [IO.File]::WriteAllText($outsideSource, 'outside-source')
-        $tx = Open-CcodFixtureTransaction $fixture
-        $candidate = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate' -CreateIfMissing
-        $first = New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $candidate -Leaf 'a-first.tmp'
-        for ($index = 0; $index -lt 256; $index++) {
-            New-CcodInstallPinnedTemporaryLeaf -Transaction $tx -ParentDirectory $candidate -Leaf ('b-{0:d3}.tmp' -f $index) | Out-Null
-        }
-        $candidatePath = Join-Path $fixture.Install 'candidate'
-        $probe = [CcodInstallTransactionTestNative]::ProbeNamespaceAfterLeafUnlock(
-            (Join-Path $candidatePath 'a-first.tmp'),
-            $candidatePath,
-            $outsideSource,
-            (Join-Path $candidatePath 'attacker-hardlink.bin')
-        )
-        $retirement = Remove-CcodInstallOwnedTree -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'candidate'
-        Assert-CcodEqual 'Retired' $retirement.Disposition 'candidate retires after descendant release probe'
-        Assert-CcodEqual 'blocked' $probe.GetAwaiter().GetResult() 'retained target pin blocks child-write and hard-link namespace mutation after descendant release'
-        Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $candidatePath 'attacker-hardlink.bin'))) 'descendant-release probe creates no attacker hard link'
-        Assert-CcodOutsideUnchanged $fixture 'descendant-release namespace lock'
-    } finally { Remove-CcodInstallFileFixture $fixture }
-}
-
-Invoke-CcodTest 'closing releases every sharing lock and rejects close-versus-relative operations' {
-    $fixture = New-CcodInstallFileFixture
-    try {
-        $tx = Open-CcodFixtureTransaction $fixture
-        $child = Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $tx.RootDirectory -Leaf 'release-me' -CreateIfMissing
-        Close-CcodInstallFileTransaction -Transaction $tx -Disposition Failed | Out-Null
-        $fixture.Transaction = $null
-        Assert-CcodThrows {
-            Open-CcodInstallPinnedDirectory -Transaction $tx -ParentDirectory $child -Leaf 'after-close' -CreateIfMissing | Out-Null
-        } 'CCOD_INSTALL_TRANSACTION_CLOSED'
-        $renamed = Join-Path $fixture.Install 'released'
-        [IO.Directory]::Move((Join-Path $fixture.Install 'release-me'), $renamed)
-        [IO.Directory]::Delete($renamed)
-        Assert-CcodTrue (-not [IO.Directory]::Exists($renamed)) 'closed transaction releases directory sharing locks'
-    } finally { Remove-CcodInstallFileFixture $fixture }
+Invoke-CcodTest 'rejects forged cross-transaction and closed capabilities' {
+    $firstFixture=New-CcodInstallFileFixture;$secondFixture=New-CcodInstallFileFixture
+    try {
+        $first=Open-CcodFixtureGeneration $firstFixture 'runtime-first';$second=Open-CcodFixtureGeneration $secondFixture 'runtime-second';$forged=New-Object psobject
+        Assert-CcodThrows {New-CcodInstallGenerationLeaf -Generation $forged -Leaf 'forged'|Out-Null} 'CCOD_INSTALL_GENERATION_INVALID'
+        Write-CcodInstallGenerationManifest -Generation $first -Manifest (New-CcodGenerationManifest 'runtime-first')|Out-Null
+        Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $secondFixture.Install -ExpectedPreviousGeneration ([uint64]0) -NewRuntimeId 'runtime-first' -FileTransaction $first|Out-Null} 'CCOD_INSTALL_TRANSACTION_SCOPE'
+        Assert-CcodThrows {Retire-CcodInstallGeneration -InstallRoot $firstFixture.Install -RuntimeId 'runtime-first' -FileTransaction $second|Out-Null} 'CCOD_INSTALL_TRANSACTION_SCOPE'
+        Close-CcodInstallFileTransaction -Transaction $first -Disposition Failed|Out-Null
+        Assert-CcodThrows {New-CcodInstallGenerationLeaf -Generation $first -Leaf 'after-close'|Out-Null} 'CCOD_INSTALL_TRANSACTION_CLOSED'
+        Assert-CcodOutsideUnchanged $firstFixture 'capability first';Assert-CcodOutsideUnchanged $secondFixture 'capability second'
+    } finally {Remove-CcodInstallFileFixture $firstFixture;Remove-CcodInstallFileFixture $secondFixture}
+}
+
+Invoke-CcodTest 'close serializes native handle release against later relative operations' {
+    $fixture=New-CcodInstallFileFixture
+    try {
+        $runtimeId='runtime-close-barrier';$generation=Open-CcodFixtureGeneration $fixture $runtimeId;$child=New-CcodInstallGenerationLeaf -Generation $generation -Leaf 'child'
+        Close-CcodInstallFileTransaction -Transaction $generation -Disposition Failed|Out-Null
+        Assert-CcodThrows {New-CcodInstallGenerationLeaf -Generation $child -Leaf 'late'|Out-Null} 'CCOD_INSTALL_TRANSACTION_CLOSED'
+        $live=Join-Path $fixture.Install "runtime\$runtimeId";$moved=$live+'.moved';[IO.Directory]::Move($live,$moved);Assert-CcodTrue ([IO.Directory]::Exists($moved)) 'close released native handles';Assert-CcodOutsideUnchanged $fixture 'close barrier'
+    } finally {Remove-CcodInstallFileFixture $fixture}
+}
+
+Invoke-CcodTest 'pointer generation records are monotonic create-only and collision safe' {
+    $fixture=New-CcodInstallFileFixture
+    try {
+        $first=Open-CcodFixtureGeneration $fixture 'runtime-pointer-one';Write-CcodInstallGenerationManifest -Generation $first -Manifest (New-CcodGenerationManifest 'runtime-pointer-one')|Out-Null
+        $committed=Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -ExpectedPreviousGeneration ([uint64]0) -NewRuntimeId 'runtime-pointer-one' -FileTransaction $first
+        Assert-CcodEqual ([uint64]1) ([uint64]$committed.Generation) 'first pointer generation is one'
+        $records=@(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\active-generation') -File -Filter '*.json');Assert-CcodEqual 1 $records.Count 'one pointer record';$before=Get-CcodTestFileSha256 $records[0].FullName
+        $second=Open-CcodFixtureGeneration $fixture 'runtime-pointer-two';Write-CcodInstallGenerationManifest -Generation $second -Manifest (New-CcodGenerationManifest 'runtime-pointer-two')|Out-Null
+        Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -ExpectedPreviousGeneration ([uint64]0) -NewRuntimeId 'runtime-pointer-two' -FileTransaction $second|Out-Null} 'CCOD_INSTALL_POINTER_GENERATION_EXISTS'
+        $after=@(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\active-generation') -File -Filter '*.json');Assert-CcodEqual 1 $after.Count 'duplicate publishes no record';Assert-CcodEqual $before (Get-CcodTestFileSha256 $after[0].FullName) 'existing pointer unchanged';Assert-CcodOutsideUnchanged $fixture 'pointer collision'
+    } finally {Remove-CcodInstallFileFixture $fixture}
+}
+
+Invoke-CcodTest 'atomically retires a proven nonempty generation without deleting bytes or changing its DACL' {
+    $fixture=New-CcodInstallFileFixture
+    try {
+        $runtimeId='runtime-retire';$source=New-CcodSourceFile $fixture 'source.bin' 'retained-retirement-bytes';$generation=Open-CcodFixtureGeneration $fixture $runtimeId;$child=New-CcodInstallGenerationLeaf $generation 'child'
+        Copy-CcodInstallSealedSource -Generation $child -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null
+        Write-CcodInstallGenerationManifest -Generation $generation -Manifest (New-CcodGenerationManifest $runtimeId @([ordered]@{path='child\payload.bin';length=$source.Length;sha256=$source.Sha256}))|Out-Null
+        $live=Join-Path $fixture.Install "runtime\$runtimeId";$beforeSddl=(Get-Acl -LiteralPath $live).Sddl;$retirement=Retire-CcodInstallGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -FileTransaction $generation
+        Assert-CcodEqual 'Retired' $retirement.Disposition 'bounded retirement result';Assert-CcodEqual '' (@($retirement.Capability.PSObject.Properties.Name)-join ',') 'retirement capability opaque';Assert-CcodTrue (-not [IO.Directory]::Exists($live)) 'live name disappears'
+        $retired=@(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'retired') -Directory|Where-Object Name -Like "$runtimeId.*");Assert-CcodEqual 1 $retired.Count 'one quarantine generation';Assert-CcodTrue ($retired[0].Name-cmatch('^'+[regex]::Escape($runtimeId)+'\.[0-9a-f]{32}$')) 'unique owned suffix'
+        Assert-CcodThrows {Copy-CcodInstallSealedSource -Generation $retirement.Capability -SourcePath $source.Path -Leaf 'post-retire.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null} 'CCOD_INSTALL_GENERATION_RETIRED'
+        Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $retired[0].FullName 'post-retire.bin'))) 'retired capability cannot mutate quarantine bytes'
+        Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 (Join-Path $retired[0].FullName 'child\payload.bin')) 'retired bytes unchanged';Assert-CcodEqual $beforeSddl (Get-Acl -LiteralPath $retired[0].FullName).Sddl 'no persistent DACL mutation'
+        Assert-CcodEqual 1 @(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\retirements') -File -Filter '*.json').Count 'one retirement record';Assert-CcodOutsideUnchanged $fixture 'retirement'
+    } finally {Remove-CcodInstallFileFixture $fixture}
 }
 
 Write-Host 'Install file transaction self-test passed.' -ForegroundColor Green

From 2baf9dfccb92282349f4239d02203184df83d30a Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sat, 29 Aug 2026 19:30:34 +0800
Subject: [PATCH 072/187] docs: narrow immutable generation cleanup contract

---
 .../plans/2026-08-29-v2522-immutable-generation.md     | 10 ++++++----
 .../2026-08-29-v2522-immutable-generation-design.md    | 10 +++++++---
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/docs/superpowers/plans/2026-08-29-v2522-immutable-generation.md b/docs/superpowers/plans/2026-08-29-v2522-immutable-generation.md
index 4e0f56e..2315354 100644
--- a/docs/superpowers/plans/2026-08-29-v2522-immutable-generation.md
+++ b/docs/superpowers/plans/2026-08-29-v2522-immutable-generation.md
@@ -72,9 +72,10 @@ Close-CcodInstallFileTransaction -Transaction <opaque-context> -Disposition Read
 ```
 
 Capabilities are opaque reference tokens stored in module-private state. The
-CLR bridge exposes only a non-mutating marker; no public method accepts an
-arbitrary path or bare handle. There is no persistent DACL change and no
-nonempty recursive deletion operation.
+CLR bridge exposes only a non-mutating marker; no exported method accepts an
+arbitrary path or bare handle. PowerShell module scope/CLR reflection is not a
+process-isolation boundary and is outside this unprivileged model. There is no
+persistent DACL change and no nonempty recursive deletion operation.
 
 - [ ] **Step 1: Write failing immutable-generation tests**
 
@@ -101,7 +102,8 @@ Use relative native creates under a validated generation parent, create-new
 leaf semantics, private source/destination handles, flush plus same-handle
 length/SHA-256 verification, and opaque capabilities. A destination that
 already exists fails with a stable collision code. Retire only a fully proven
-owned generation by no-replace relative rename; retain the quarantine tree.
+owned generation by writing one create-only retired-generation record; do not
+rename or recursively delete the nonempty generation.
 
 - [ ] **Step 4: Run GREEN and registration checks**
 
diff --git a/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md b/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
index 9e4359a..1ffeb23 100644
--- a/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
+++ b/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
@@ -20,7 +20,11 @@ ordinary pathname races by using unique create-only generations, strict
 manifest/hash/version checks, and atomic pointer commits. It does not claim to
 defeat a same-user process that already has unrestricted write/DACL authority;
 that guarantee would require an elevated or signed broker, which is outside
-this product's current-user scope.
+this product's current-user scope. PowerShell module scope and CLR reflection
+are also not process-isolation boundaries: code already executing inside the
+same PowerShell process may inspect private module state. The enforced contract
+is the exported API and sealed generation/pointer rules, not protection against
+arbitrary in-process introspection.
 
 This design never modifies `ChatGPT.exe`, `app.asar`, `WindowsApps`, account
 state, or the current-user DPAPI device-key store. It does not add a remote
@@ -86,8 +90,8 @@ Retire-CcodInstallGeneration -InstallRoot <absolute-root> -RuntimeId <owned-id>
 Close-CcodInstallFileTransaction -Transaction <opaque-context> -Disposition Ready|Failed
 ```
 
-`Retire-CcodInstallGeneration` removes a generation from the active namespace
-by an atomic create-only pointer/retired-record update; it does not recursively
+`Retire-CcodInstallGeneration` removes a generation from the active selection by
+one create-only retired-generation record; it does not rename or recursively
 delete the nonempty directory. Physical reclamation is a later operation that
 requires no running owner and a complete safe-tree proof. This avoids a
 partial-delete rollback claim and avoids persistent DACL changes.

From 90d9d8d6f4aa851073fb8973a47ac0c9c0f18b7d Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sat, 29 Aug 2026 19:54:00 +0800
Subject: [PATCH 073/187] fix: close immutable generation review gaps

---
 .../modules/InstallFileTransaction.psm1       |  60 +++---
 .../InstallFileTransaction.SelfTest.ps1       | 190 ++++++++++++++++--
 2 files changed, 203 insertions(+), 47 deletions(-)

diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index cb3ab93..a52406c 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -9,8 +9,9 @@ function Throw-CcodInstallFileError {
 }
 
 function Initialize-CcodInstallRuntime {
-    if ($null -ne ('CcodInstallCapabilityMarker' -as [type])) { return }
-    Add-Type -TypeDefinition @'
+    $marker = 'CcodInstallGenerationCapabilityMarkerV2' -as [type]
+    if ($null -eq $marker) {
+        Add-Type -TypeDefinition @'
 using System;
 using System.Collections.Generic;
 using System.ComponentModel;
@@ -21,13 +22,13 @@ using System.Security.Cryptography;
 using System.Text;
 using Microsoft.Win32.SafeHandles;
 
-public sealed class CcodInstallCapabilityMarker
+public sealed class CcodInstallGenerationCapabilityMarkerV2
 {
-    private CcodInstallCapabilityMarker() { }
-    public static int CapabilityAbi { get { return 1; } }
+    private CcodInstallGenerationCapabilityMarkerV2() { }
+    public static int CapabilityAbi { get { return 2; } }
 }
 
-internal sealed class CcodInstallRuntime : IDisposable
+internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
 {
     private const uint READ = 0x80000000, WRITE = 0x40000000, DELETE = 0x00010000, SYNC = 0x00100000;
     private const uint READ_ATTRIBUTES = 0x80, LIST_DIRECTORY = 0x1, ADD_FILE = 0x2, ADD_SUBDIRECTORY = 0x4;
@@ -63,7 +64,7 @@ internal sealed class CcodInstallRuntime : IDisposable
         internal readonly object Token = new object();
         internal readonly Pin Parent; internal string Leaf, Path;
         internal readonly bool Directory, Owned; internal SafeFileHandle Handle; internal FileStream Stream;
-        internal readonly uint Volume; internal readonly ulong Index; internal bool Closed, Sealed, Manifest;
+        internal readonly uint Volume; internal readonly ulong Index; internal bool Closed, Sealed, Manifest; internal long SealedLength; internal string SealedSha;
         internal Pin(Pin parent,string leaf,string path,bool directory,bool owned,SafeFileHandle handle,FileStream stream,FILE_INFO info)
         { Parent=parent;Leaf=leaf;Path=path;Directory=directory;Owned=owned;Handle=handle;Stream=stream;Volume=info.VolumeSerialNumber;Index=((ulong)info.FileIndexHigh<<32)|info.FileIndexLow; }
         internal SafeFileHandle Native { get { return Stream != null ? Stream.SafeFileHandle : Handle; } }
@@ -80,10 +81,10 @@ internal sealed class CcodInstallRuntime : IDisposable
     private readonly List<FileStream> externalStreams = new List<FileStream>();
     private bool disposed;
 
-    private CcodInstallRuntime(string installRoot,Pin root,Pin runtimeParent)
+    private CcodInstallGenerationRuntimeV2(string installRoot,Pin root,Pin runtimeParent)
     { this.installRoot=installRoot;this.root=root;this.runtimeParent=runtimeParent;AddPin(root);AddPin(runtimeParent); }
 
-    internal static object Open(string path,string runtimeId,out CcodInstallRuntime runtime)
+    internal static object Open(string path,string runtimeId,out CcodInstallGenerationRuntimeV2 runtime)
     {
         runtime=null;string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle rootHandle=OpenAbsoluteDirectory(full,true);Pin rootPin=null,runtimePin=null;
         try
@@ -98,7 +99,7 @@ internal sealed class CcodInstallRuntime : IDisposable
             try
             {
                 Pin generation=ValidateDirectoryPin(runtimePin,runtimeId,Path.Combine(runtimePin.Path,runtimeId),true,generationResult.Handle);generationResult.Handle=null;
-                runtime=new CcodInstallRuntime(full,rootPin,runtimePin);rootPin=null;runtimePin=null;runtime.AddPin(generation);return generation.Token;
+                runtime=new CcodInstallGenerationRuntimeV2(full,rootPin,runtimePin);rootPin=null;runtimePin=null;runtime.AddPin(generation);return generation.Token;
             }
             finally { if(generationResult.Handle!=null)generationResult.Handle.Dispose(); }
         }
@@ -127,7 +128,7 @@ internal sealed class CcodInstallRuntime : IDisposable
             FILE_INFO destinationInfo=Info(destinationStream.SafeFileHandle);ValidatePlain(destinationInfo,destinationStream.SafeFileHandle);
             Pin destination=new Pin(parent,leaf,Path.Combine(parent.Path,leaf),false,true,null,destinationStream,destinationInfo);destinationStream=null;
             sourceStream.CopyTo(destination.Stream);destination.Stream.Flush(true);
-            if(destination.Stream.Length!=expectedLength||Sha(destination.Stream)!=expectedSha)throw new InvalidDataException("destination mismatch");destination.Sealed=true;MakeReadable(destination);AddPin(destination);externalStreams.Add(sourceStream);sourceStream=null;return destination.Token;
+            if(destination.Stream.Length!=expectedLength||Sha(destination.Stream)!=expectedSha)throw new InvalidDataException("destination mismatch");destination.SealedLength=expectedLength;destination.SealedSha=expectedSha;AddPin(destination);try{MakeReadable(destination,expectedLength,expectedSha);}catch(Exception exception){throw new InvalidDataException("seal mismatch",exception);}destination.Sealed=true;externalStreams.Add(sourceStream);sourceStream=null;return destination.Token;
         }
         finally { if(sourceStream!=null)sourceStream.Dispose();if(sourceHandle!=null)sourceHandle.Dispose();if(destinationStream!=null)destinationStream.Dispose();if(destinationResult!=null&&destinationResult.Handle!=null)destinationResult.Handle.Dispose(); }
     }
@@ -138,7 +139,7 @@ internal sealed class CcodInstallRuntime : IDisposable
         try
         {
             stream=new FileStream(result.Handle,FileAccess.ReadWrite,65536,false);result.Handle=null;FILE_INFO info=Info(stream.SafeFileHandle);ValidatePlain(info,stream.SafeFileHandle);Pin pin=new Pin(parent,leaf,Path.Combine(parent.Path,leaf),false,true,null,stream,info);stream=null;
-            pin.Stream.Write(bytes,0,bytes.Length);pin.Stream.Flush(true);string sha=Sha(pin.Stream);if(pin.Stream.Length!=bytes.LongLength)throw new InvalidDataException("destination mismatch");pin.Sealed=true;pin.Manifest=manifest;if(manifest)MakeReadable(pin);AddPin(pin);return new object[]{pin.Token,pin.Stream.Length,sha};
+            pin.Stream.Write(bytes,0,bytes.Length);pin.Stream.Flush(true);string sha=Sha(pin.Stream);if(pin.Stream.Length!=bytes.LongLength)throw new InvalidDataException("destination mismatch");pin.SealedLength=bytes.LongLength;pin.SealedSha=sha;AddPin(pin);if(manifest)MakeReadable(pin,bytes.LongLength,sha);pin.Sealed=true;pin.Manifest=manifest;return new object[]{pin.Token,pin.SealedLength,sha};
         }
         finally { if(stream!=null)stream.Dispose();if(result.Handle!=null)result.Handle.Dispose(); }
     }
@@ -146,15 +147,14 @@ internal sealed class CcodInstallRuntime : IDisposable
     [MethodImpl(MethodImplOptions.Synchronized)] internal object CommitPointer(object generationToken,ulong previousGeneration,string runtimeId,byte[] bytes)
     {
         Pin generation=Require(generationToken,true);ValidateCurrent(generation);if(!Object.ReferenceEquals(generation.Parent,runtimeParent)||!String.Equals(generation.Leaf,runtimeId,StringComparison.Ordinal))throw new InvalidDataException("transaction scope");
-        Pin manifest=null;if(!names.TryGetValue(Key(generation,"manifest.json"),out manifest)||!manifest.Manifest||!manifest.Sealed)throw new InvalidDataException("manifest missing");ValidateCurrent(manifest);
-        Pin state=OpenOrCreateDirectory(root,"state"),pointer=OpenOrCreateDirectory(state,"active-generation");if(CurrentPointerGeneration(pointer)!=previousGeneration)throw new InvalidOperationException("pointer generation exists");string leaf=(previousGeneration+1).ToString("D20")+".json";return WriteAtomic(pointer,leaf,bytes);
+        Pin manifest=null;if(!names.TryGetValue(Key(generation,"manifest.json"),out manifest)||!manifest.Manifest||!manifest.Sealed)throw new InvalidDataException("manifest missing");ValidateCurrent(manifest);ValidateOwnedTree(generation);
+        if(previousGeneration==UInt64.MaxValue)throw new OverflowException("pointer generation overflow");Pin state=OpenOrCreateDirectory(root,"state"),pointer=OpenOrCreateDirectory(state,"active-generation");if(CurrentPointerGeneration(pointer)!=previousGeneration)throw new InvalidOperationException("pointer generation exists");string leaf=(previousGeneration+1).ToString("D20")+".json";return WriteAtomic(pointer,leaf,bytes);
     }
 
-    [MethodImpl(MethodImplOptions.Synchronized)] internal object Retire(object generationToken,string runtimeId,string retiredLeaf,byte[] record)
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object Retire(object generationToken,string runtimeId,string recordLeaf,byte[] record)
     {
         Pin generation=Require(generationToken,true);ValidateCurrent(generation);if(!Object.ReferenceEquals(generation.Parent,runtimeParent)||!String.Equals(generation.Leaf,runtimeId,StringComparison.Ordinal)||!generation.Owned)throw new InvalidDataException("generation not owned");
-        ValidateOwnedTree(generation);Pin retired=OpenOrCreateDirectory(root,"retired"),state=OpenOrCreateDirectory(root,"state"),retirements=OpenOrCreateDirectory(state,"retirements");ReleaseDescendants(generation);int error=Rename(generation.Native,retired.Native,retiredLeaf);if(error!=0)throw new Win32Exception(error);MoveDirectoryPin(generation,retired,retiredLeaf,Path.Combine(retired.Path,retiredLeaf));
-        WriteAtomic(retirements,retiredLeaf+".json",record);return generation.Token;
+        ValidateOwnedTree(generation);Pin state=OpenOrCreateDirectory(root,"state"),retirements=OpenOrCreateDirectory(state,"retired-generations");WriteAtomic(retirements,recordLeaf,record);ValidateCurrent(generation);return generation.Token;
     }
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal void Close()
@@ -173,26 +173,21 @@ internal sealed class CcodInstallRuntime : IDisposable
 
     private void ValidateOwnedTree(Pin directory)
     {
-        ValidateCurrent(directory);foreach(string leaf in Enumerate(directory.Native)){Pin child;if(!names.TryGetValue(Key(directory,leaf),out child)||!child.Owned)throw new InvalidDataException("unknown leaf");ValidateCurrent(child);if(child.Directory)ValidateOwnedTree(child);else if(!child.Sealed)throw new InvalidDataException("unsealed leaf");}
+        ValidateCurrent(directory);foreach(string leaf in Enumerate(directory.Native)){Pin child;if(!names.TryGetValue(Key(directory,leaf),out child)||!child.Owned)throw new InvalidDataException("unknown leaf");if(child.Directory){ValidateCurrent(child);ValidateOwnedTree(child);}else{if(!child.Sealed)throw new InvalidDataException("unsealed leaf");ValidateCurrent(child);}}
     }
     private object WriteAtomic(Pin parent,string leaf,byte[] bytes)
     {
-        string temporary=".ccod."+Guid.NewGuid().ToString("N")+".tmp";object[] result=(object[])Write(parent.Token,temporary,bytes,false);Pin pin=Require(result[0],false);int error=Rename(pin.Native,parent.Native,leaf);if(error!=0)throw new Win32Exception(error);names.Remove(Key(parent,temporary));pin.Leaf=leaf;pin.Path=Path.Combine(parent.Path,leaf);names.Add(Key(parent,leaf),pin);MakeReadable(pin);return result;
+        string temporary=".ccod."+Guid.NewGuid().ToString("N")+".tmp";object[] result=(object[])Write(parent.Token,temporary,bytes,false);Pin pin=Require(result[0],false);int error=Rename(pin.Native,parent.Native,leaf);if(error!=0)throw new Win32Exception(error);names.Remove(Key(parent,temporary));pin.Leaf=leaf;pin.Path=Path.Combine(parent.Path,leaf);names.Add(Key(parent,leaf),pin);MakeReadable(pin,pin.SealedLength,pin.SealedSha);return result;
     }
     private static ulong CurrentPointerGeneration(Pin pointer)
     {
         ulong maximum=0;foreach(string leaf in Enumerate(pointer.Native)){if(leaf.StartsWith(".ccod.",StringComparison.OrdinalIgnoreCase)&&leaf.EndsWith(".tmp",StringComparison.OrdinalIgnoreCase))continue;if(leaf.Length!=25||!leaf.EndsWith(".json",StringComparison.OrdinalIgnoreCase))throw new InvalidDataException("unknown pointer leaf");ulong value;if(!UInt64.TryParse(leaf.Substring(0,20),out value)||value==0)throw new InvalidDataException("unknown pointer leaf");if(value>maximum)maximum=value;}return maximum;
     }
-    private void ReleaseDescendants(Pin directory)
-    {
-        foreach(Pin pin in pins.Values)if(!pin.Closed&&!Object.ReferenceEquals(pin,directory)&&pin.Path.StartsWith(directory.Path.TrimEnd('\\')+"\\",StringComparison.OrdinalIgnoreCase))pin.Dispose();
-    }
     private Pin Require(object token,bool directory){if(disposed)throw new ObjectDisposedException("transaction");Pin pin;if(token==null||!pins.TryGetValue(token,out pin)||pin.Closed||pin.Directory!=directory)throw new InvalidDataException("invalid capability");return pin;}
     private void AddPin(Pin pin){pins.Add(pin.Token,pin);if(pin.Parent!=null)names.Add(Key(pin.Parent,pin.Leaf),pin);}
     private static string Key(Pin parent,string leaf){return parent.Index.ToString("x16")+"|"+leaf.ToLowerInvariant();}
-    private void MoveDirectoryPin(Pin directory,Pin parent,string leaf,string path){string oldPath=directory.Path;names.Remove(Key(directory.Parent,directory.Leaf));directory.Leaf=leaf;directory.Path=path;names.Add(Key(parent,leaf),directory);string prefix=oldPath.TrimEnd('\\')+"\\";foreach(Pin pin in pins.Values)if(!Object.ReferenceEquals(pin,directory)&&pin.Path.StartsWith(prefix,StringComparison.OrdinalIgnoreCase))pin.Path=path+"\\"+pin.Path.Substring(prefix.Length);}
     private static Pin ValidateDirectoryPin(Pin parent,string leaf,string path,bool owned,SafeFileHandle handle){FILE_INFO info=Info(handle);if(!IsDirectory(info)||(info.FileAttributes&ATTR_REPARSE)!=0||!OnlyDefaultStream(handle)||!SamePath(FinalPath(handle),path))throw new InvalidDataException("directory invalid");return new Pin(parent,leaf,path,true,owned,handle,null,info);}
-    private static void MakeReadable(Pin pin){OpenResult bridge=OpenRelative(pin.Parent.Native,pin.Leaf,READ|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE|SHARE_DELETE,OPEN,NON_DIRECTORY);FILE_INFO bridgeInfo=Info(bridge.Handle);if(bridgeInfo.VolumeSerialNumber!=pin.Volume||(((ulong)bridgeInfo.FileIndexHigh<<32)|bridgeInfo.FileIndexLow)!=pin.Index){bridge.Handle.Dispose();throw new InvalidDataException("pin changed");}pin.Stream.Dispose();pin.Stream=null;OpenResult strict=OpenRelative(pin.Parent.Native,pin.Leaf,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,OPEN,NON_DIRECTORY);bridge.Handle.Dispose();pin.Stream=new FileStream(strict.Handle,FileAccess.Read,65536,false);strict.Handle=null;}
+    private static void MakeReadable(Pin pin,long expectedLength,string expectedSha){OpenResult bridge=null,strict=null;FileStream strictStream=null;try{bridge=OpenRelative(pin.Parent.Native,pin.Leaf,READ|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE|SHARE_DELETE,OPEN,NON_DIRECTORY);FILE_INFO bridgeInfo=Info(bridge.Handle);if(bridgeInfo.VolumeSerialNumber!=pin.Volume||(((ulong)bridgeInfo.FileIndexHigh<<32)|bridgeInfo.FileIndexLow)!=pin.Index)throw new InvalidDataException("pin changed");pin.Stream.Dispose();pin.Stream=null;strict=OpenRelative(pin.Parent.Native,pin.Leaf,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,OPEN,NON_DIRECTORY);strictStream=new FileStream(strict.Handle,FileAccess.Read,65536,false);strict.Handle=null;FILE_INFO strictInfo=Info(strictStream.SafeFileHandle);ValidatePlain(strictInfo,strictStream.SafeFileHandle);if(strictInfo.VolumeSerialNumber!=pin.Volume||(((ulong)strictInfo.FileIndexHigh<<32)|strictInfo.FileIndexLow)!=pin.Index||!SamePath(FinalPath(strictStream.SafeFileHandle),pin.Path)||strictStream.Length!=expectedLength||Sha(strictStream)!=expectedSha)throw new InvalidDataException("seal mismatch");pin.Stream=strictStream;strictStream=null;}finally{if(strictStream!=null)strictStream.Dispose();if(strict!=null&&strict.Handle!=null)strict.Handle.Dispose();if(bridge!=null&&bridge.Handle!=null)bridge.Handle.Dispose();}}
     private static SafeFileHandle OpenAbsoluteDirectory(string path,bool allowWrite){uint access=LIST_DIRECTORY|READ_ATTRIBUTES|SYNC;if(allowWrite)access|=ADD_FILE|ADD_SUBDIRECTORY;SafeFileHandle handle=CreateFileW(path,access,SHARE_READ|SHARE_WRITE,IntPtr.Zero,OPEN_EXISTING,FLAG_BACKUP|FLAG_REPARSE,IntPtr.Zero);if(handle.IsInvalid)throw new Win32Exception(Marshal.GetLastWin32Error());return handle;}
     private static void ValidateCurrent(Pin pin){FILE_INFO info=Info(pin.Native);if(info.VolumeSerialNumber!=pin.Volume||(((ulong)info.FileIndexHigh<<32)|info.FileIndexLow)!=pin.Index||IsDirectory(info)!=pin.Directory||(info.FileAttributes&ATTR_REPARSE)!=0||!SamePath(FinalPath(pin.Native),pin.Path))throw new InvalidDataException("pin changed");if(!OnlyDefaultStream(pin.Native))throw new InvalidDataException("alternate stream");if(!pin.Directory&&info.NumberOfLinks!=1)throw new InvalidDataException("multi-link");}
     private static void ValidatePlain(FILE_INFO info,SafeFileHandle handle){if(IsDirectory(info))throw new InvalidDataException("file type");if((info.FileAttributes&ATTR_REPARSE)!=0)throw new InvalidDataException("reparse leaf");if(info.NumberOfLinks!=1)throw new InvalidDataException("multi-link");if(!OnlyDefaultStream(handle))throw new InvalidDataException("alternate stream");}
@@ -207,7 +202,10 @@ internal sealed class CcodInstallRuntime : IDisposable
     private static int Rename(SafeFileHandle source,SafeFileHandle parent,string destination){byte[] name=Encoding.Unicode.GetBytes(destination);int rootOffset=IntPtr.Size,lengthOffset=rootOffset+IntPtr.Size,nameOffset=lengthOffset+4,size=nameOffset+name.Length+2;IntPtr buffer=Marshal.AllocHGlobal(size);bool parentAdded=false,sourceAdded=false;try{source.DangerousAddRef(ref sourceAdded);parent.DangerousAddRef(ref parentAdded);for(int i=0;i<size;i++)Marshal.WriteByte(buffer,i,0);Marshal.WriteByte(buffer,0,0);Marshal.WriteIntPtr(buffer,rootOffset,parent.DangerousGetHandle());Marshal.WriteInt32(buffer,lengthOffset,name.Length);Marshal.Copy(name,0,IntPtr.Add(buffer,nameOffset),name.Length);IO_STATUS_BLOCK io;int status=NtSetInformationFile(source,out io,buffer,(uint)size,FileRenameInformation);return status>=0?0:(int)RtlNtStatusToDosError(status);}finally{if(parentAdded)parent.DangerousRelease();if(sourceAdded)source.DangerousRelease();Marshal.FreeHGlobal(buffer);}}
 }
 '@
-    $script:CcodRuntimeType = [CcodInstallCapabilityMarker].Assembly.GetType('CcodInstallRuntime',$true)
+        $marker = 'CcodInstallGenerationCapabilityMarkerV2' -as [type]
+    }
+    if ($null -eq $marker -or [int]$marker.GetProperty('CapabilityAbi').GetValue($null,$null) -ne 2) { Throw-CcodInstallFileError 'CCOD_INSTALL_RUNTIME_ABI_INVALID' 'Install generation runtime ABI is unavailable' $null }
+    $script:CcodRuntimeType = $marker.Assembly.GetType('CcodInstallGenerationRuntimeV2',$true)
 }
 
 function Assert-CcodInstallLeaf([string]$Leaf,[string]$ErrorId='CCOD_INSTALL_LEAF_INVALID') {
@@ -216,9 +214,9 @@ function Assert-CcodInstallLeaf([string]$Leaf,[string]$ErrorId='CCOD_INSTALL_LEA
 function Invoke-CcodRuntimeStatic([string]$Name,[object[]]$Arguments){$method=$script:CcodRuntimeType.GetMethod($Name,[Reflection.BindingFlags]'NonPublic,Static');try{return $method.Invoke($null,$Arguments)}catch [Reflection.TargetInvocationException]{throw $_.Exception.InnerException}}
 function Invoke-CcodRuntimeMethod($Runtime,[string]$Name,[object[]]$Arguments){$method=$Runtime.GetType().GetMethod($Name,[Reflection.BindingFlags]'NonPublic,Instance');try{return $method.Invoke($Runtime,$Arguments)}catch [Reflection.TargetInvocationException]{throw $_.Exception.InnerException}}
 function New-CcodInstallCapability { New-Object psobject }
-function Get-CcodInstallTransaction($Capability,[string]$InvalidId='CCOD_INSTALL_GENERATION_INVALID'){$record=$null;if($null-eq$Capability-or-not$script:CcodScopes.TryGetValue($Capability,[ref]$record)){Throw-CcodInstallFileError $InvalidId 'Invalid install generation capability' $null};$state=$null;if(-not$script:CcodTransactions.TryGetValue($record.Transaction,[ref]$state)){Throw-CcodInstallFileError $InvalidId 'Invalid install transaction capability' $null};if($state.Closed){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' 'Install file transaction is closed' $null};if($state.Retired){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_RETIRED' 'Install generation is retired' $null};[pscustomobject]@{State=$state;Record=$record}}
+function Get-CcodInstallTransaction($Capability,[string]$InvalidId='CCOD_INSTALL_GENERATION_INVALID',[switch]$AllowRetired){$record=$null;if($null-eq$Capability-or-not$script:CcodScopes.TryGetValue($Capability,[ref]$record)){Throw-CcodInstallFileError $InvalidId 'Invalid install generation capability' $null};$state=$null;if(-not$script:CcodTransactions.TryGetValue($record.Transaction,[ref]$state)){Throw-CcodInstallFileError $InvalidId 'Invalid install transaction capability' $null};if($state.Closed){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' 'Install file transaction is closed' $null};if($state.Retired-and-not$AllowRetired){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_RETIRED' 'Install generation is retired' $null};[pscustomobject]@{State=$state;Record=$record}}
 function Add-CcodInstallScope($Transaction,$Token){$capability=New-CcodInstallCapability;$script:CcodScopes.Add($capability,[pscustomobject]@{Transaction=$Transaction;Token=$Token});$capability}
-function Convert-CcodInstallRuntimeError($Action,[string]$DefaultId){try{return&$Action}catch{$exception=$_.Exception;while($null-ne$exception.InnerException-and$exception-is[Management.Automation.RuntimeException]){$exception=$exception.InnerException};$message=[string]$exception.Message;if($exception-is[ObjectDisposedException]){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' $message $null};if($exception-is[ComponentModel.Win32Exception]-and$exception.NativeErrorCode-in@(80,183)){Throw-CcodInstallFileError 'CCOD_INSTALL_LEAF_EXISTS' 'Install object already exists' $null};if($message-match'pointer generation exists'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' $message $null};if($message-match'alternate stream'){Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' $message $null};if($message-match'multi-link'){Throw-CcodInstallFileError 'CCOD_INSTALL_MULTILINK_LEAF' $message $null};if($message-match'reparse'){Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' $message $null};if($message-match'transaction scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_SCOPE' $message $null};if($message-match'generation not owned'){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' $message $null};if($message-match'unknown|unsealed'){Throw-CcodInstallFileError 'CCOD_INSTALL_UNKNOWN_LEAF' $message $null};if($message-match'pin changed|path changed'){Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' $message $null};Throw-CcodInstallFileError $DefaultId $message $null}}
+function Convert-CcodInstallRuntimeError($Action,[string]$DefaultId){try{return&$Action}catch{$exception=$_.Exception;while($null-ne$exception.InnerException-and$exception-is[Management.Automation.RuntimeException]){$exception=$exception.InnerException};$message=[string]$exception.Message;if($exception-is[ObjectDisposedException]){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' $message $null};if($exception-is[ComponentModel.Win32Exception]-and$exception.NativeErrorCode-in@(80,183)){Throw-CcodInstallFileError 'CCOD_INSTALL_LEAF_EXISTS' 'Install object already exists' $null};if($message-match'pointer generation exists'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' $message $null};if($message-match'pointer generation overflow'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW' $message $null};if($message-match'seal mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_SEAL_MISMATCH' $message $null};if($message-match'alternate stream'){Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' $message $null};if($message-match'multi-link'){Throw-CcodInstallFileError 'CCOD_INSTALL_MULTILINK_LEAF' $message $null};if($message-match'reparse'){Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' $message $null};if($message-match'transaction scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_SCOPE' $message $null};if($message-match'generation not owned'){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' $message $null};if($message-match'unknown|unsealed'){Throw-CcodInstallFileError 'CCOD_INSTALL_UNKNOWN_LEAF' $message $null};if($message-match'pin changed|path changed'){Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' $message $null};Throw-CcodInstallFileError $DefaultId $message $null}}
 function Test-CcodInstallValue($Value,[int]$Depth=0) {
     if ($Depth -gt 12) { return $false }
     if ($null -eq $Value) { return $true }
@@ -250,13 +248,13 @@ function Open-CcodInstallGeneration {
     Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID'
     $arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$RuntimeId,$null)
     try{$token=Invoke-CcodRuntimeStatic Open $arguments}catch [ComponentModel.Win32Exception]{if($_.Exception.NativeErrorCode-in@(32,80,183)){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_EXISTS' 'Install generation already exists' $RuntimeId};throw}
-    $runtime=$arguments[2];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$RuntimeId;RootToken=$token;Closed=$false;Retired=$false;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token});$transaction
+    $runtime=$arguments[2];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$RuntimeId;RootToken=$token;Closed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token});$transaction
 }
 function New-CcodInstallGenerationLeaf { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$Leaf) Assert-CcodInstallLeaf $Leaf;$scope=Get-CcodInstallTransaction $Generation;$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CreateDirectory @($scope.Record.Token,$Leaf)} 'CCOD_INSTALL_LEAF_CREATE_FAILED';Add-CcodInstallScope $scope.Record.Transaction $token }
 function Copy-CcodInstallSealedSource { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$SourcePath,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)][int64]$ExpectedLength,[Parameter(Mandatory)][string]$ExpectedSha256) Assert-CcodInstallLeaf $Leaf;if(-not[IO.Path]::IsPathRooted($SourcePath)-or$ExpectedLength-lt 0-or$ExpectedSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Invalid sealed source contract' $SourcePath};$scope=Get-CcodInstallTransaction $Generation;Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Copy @($scope.Record.Token,$Leaf,[IO.Path]::GetFullPath($SourcePath),$ExpectedLength,$ExpectedSha256)|Out-Null} 'CCOD_INSTALL_SOURCE_MISMATCH';[pscustomobject]@{Length=$ExpectedLength;Sha256=$ExpectedSha256} }
 function Write-CcodInstallGenerationManifest { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)]$Manifest) $scope=Get-CcodInstallTransaction $Generation;if($scope.Record.Token-ne$scope.State.RootToken){Throw-CcodInstallFileError 'CCOD_INSTALL_MANIFEST_SCOPE' 'Manifest must be written at the generation root' $null};$bytes=ConvertTo-CcodInstallJsonBytes $Manifest;$result=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Write @($scope.Record.Token,'manifest.json',$bytes,$true)} 'CCOD_INSTALL_MANIFEST_WRITE_FAILED';[pscustomobject]@{Length=[int64]$result[1];Sha256=[string]$result[2]} }
-function Commit-CcodInstallActivePointer { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][uint64]$ExpectedPreviousGeneration,[Parameter(Mandatory)][string]$NewRuntimeId,[Parameter(Mandatory)]$FileTransaction) Assert-CcodInstallLeaf $NewRuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$generation=$ExpectedPreviousGeneration+1;$pointer=[ordered]@{schemaVersion=1;generation=$generation;activeRuntime=$NewRuntimeId;previousGeneration=$ExpectedPreviousGeneration};$bytes=ConvertTo-CcodInstallJsonBytes $pointer;try{Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CommitPointer @($scope.Record.Token,$ExpectedPreviousGeneration,$NewRuntimeId,$bytes)|Out-Null} 'CCOD_INSTALL_POINTER_COMMIT_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' 'Pointer generation already exists' $generation};throw};[pscustomobject]@{Generation=[uint64]$generation;RuntimeId=$NewRuntimeId} }
-function Retire-CcodInstallGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)]$FileTransaction) Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';if($RuntimeId-cne$scope.State.RuntimeId-or$scope.Record.Token-ne$scope.State.RootToken){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' 'Generation is not owned by this transaction' $RuntimeId};$retiredLeaf=$RuntimeId+'.'+[guid]::NewGuid().ToString('N');$record=ConvertTo-CcodInstallJsonBytes ([ordered]@{schemaVersion=1;runtimeId=$RuntimeId;retiredName=$retiredLeaf});$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Retire @($scope.Record.Token,$RuntimeId,$retiredLeaf,$record)} 'CCOD_INSTALL_RETIREMENT_FAILED';$capability=Add-CcodInstallScope $scope.Record.Transaction $token;$scope.State.Retired=$true;[pscustomobject]@{Disposition='Retired';Capability=$capability} }
+function Commit-CcodInstallActivePointer { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][uint64]$ExpectedPreviousGeneration,[Parameter(Mandatory)][string]$NewRuntimeId,[Parameter(Mandatory)]$FileTransaction) Assert-CcodInstallLeaf $NewRuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';if($ExpectedPreviousGeneration-eq[uint64]::MaxValue){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW' 'Pointer generation cannot advance beyond UInt64.MaxValue' $ExpectedPreviousGeneration};$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$generation=[uint64]($ExpectedPreviousGeneration+1);$pointer=[ordered]@{schemaVersion=1;generation=$generation;activeRuntime=$NewRuntimeId;previousGeneration=$ExpectedPreviousGeneration};$bytes=ConvertTo-CcodInstallJsonBytes $pointer;try{Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CommitPointer @($scope.Record.Token,$ExpectedPreviousGeneration,$NewRuntimeId,$bytes)|Out-Null} 'CCOD_INSTALL_POINTER_COMMIT_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' 'Pointer generation already exists' $generation};throw};[pscustomobject]@{Generation=$generation;RuntimeId=$NewRuntimeId} }
+function Retire-CcodInstallGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)]$FileTransaction) Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID' -AllowRetired;Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';if($RuntimeId-cne$scope.State.RuntimeId-or$scope.Record.Token-ne$scope.State.RootToken){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' 'Generation is not owned by this transaction' $RuntimeId};if($scope.State.Retired){return $scope.State.RetirementResult};$recordLeaf=$RuntimeId+'.json';$record=ConvertTo-CcodInstallJsonBytes ([ordered]@{schemaVersion=1;runtimeId=$RuntimeId;state='Retired'});try{$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Retire @($scope.Record.Token,$RuntimeId,$recordLeaf,$record)} 'CCOD_INSTALL_RETIREMENT_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETIREMENT_RECORD_EXISTS' 'Retirement record already exists' $recordLeaf};throw};$capability=Add-CcodInstallScope $scope.Record.Transaction $token;$result=[pscustomobject]@{Disposition='Retired';Capability=$capability};$scope.State.RetirementResult=$result;$scope.State.Retired=$true;return $result }
 function Close-CcodInstallFileTransaction { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][ValidateSet('Ready','Failed')][string]$Disposition) $state=$null;if($null-eq$Transaction-or-not$script:CcodTransactions.TryGetValue($Transaction,[ref]$state)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Invalid install file transaction capability' $null};if(-not$state.Closed){Invoke-CcodRuntimeMethod $state.Runtime Close @()|Out-Null;$state.Closed=$true;$state.Disposition=$Disposition} }
 
 Initialize-CcodInstallRuntime
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index 1495975..b10fc5e 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -5,6 +5,46 @@ $projectRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
 $modulePath = Join-Path $projectRoot 'src\persistence\modules\InstallFileTransaction.psm1'
 $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
 
+if ($null -eq ('CcodInstallFileRaceProbe' -as [type])) {
+    Add-Type -TypeDefinition @'
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Reflection;
+using System.Threading;
+using System.Threading.Tasks;
+
+public sealed class CcodInstallHandoffAttack : IDisposable
+{
+    private readonly CancellationTokenSource stop = new CancellationTokenSource();
+    private readonly ManualResetEventSlim ready = new ManualResetEventSlim(false);
+    private readonly Task<string>[] workers;
+    public CcodInstallHandoffAttack(string path,string replacement)
+    {
+        workers=new Task<string>[16];
+        for(int i=0;i<workers.Length;i++)workers[i]=Task.Run(() => { ready.Set();while(!stop.IsCancellationRequested){try{string backup=path+".attacker."+Guid.NewGuid().ToString("N");File.Move(path,backup);try{File.Copy(replacement,path);}catch(IOException){}catch(UnauthorizedAccessException){}stop.Cancel();return "exchanged";}catch(IOException){}catch(UnauthorizedAccessException){}}return "blocked";});
+    }
+    public bool WaitReady(int milliseconds){return ready.Wait(milliseconds);}
+    public string Stop()
+    {
+        stop.Cancel();Task.WaitAll(workers);foreach(Task<string> worker in workers)if(worker.Result=="exchanged")return "exchanged";return "blocked";
+    }
+    public void Dispose(){Stop();stop.Dispose();ready.Dispose();}
+}
+
+public static class CcodInstallFileRaceProbe
+{
+    public static string RaceCreateAndClose(object runtime,object token,string leaf)
+    {
+        Type type=runtime.GetType();MethodInfo create=type.GetMethod("CreateDirectory",BindingFlags.Instance|BindingFlags.NonPublic);MethodInfo close=type.GetMethod("Close",BindingFlags.Instance|BindingFlags.NonPublic);Barrier barrier=new Barrier(2);string createResult=null,closeResult=null;
+        Task first=Task.Run(() => {barrier.SignalAndWait();try{create.Invoke(runtime,new object[]{token,leaf});createResult="created";}catch(TargetInvocationException e){createResult=e.InnerException is ObjectDisposedException?"closed":e.InnerException.GetType().Name;}});
+        Task second=Task.Run(() => {barrier.SignalAndWait();try{close.Invoke(runtime,new object[0]);closeResult="closed";}catch(TargetInvocationException e){closeResult=e.InnerException.GetType().Name;}});
+        Task.WaitAll(first,second);barrier.Dispose();return createResult+"|"+closeResult;
+    }
+}
+'@
+}
+
 function New-CcodInstallFileFixture {
     $base = Join-Path ([IO.Path]::GetTempPath()) ('ccod-install-file-' + [guid]::NewGuid().ToString('N'))
     $outside = Join-Path ([IO.Path]::GetTempPath()) ('ccod-install-outside-' + [guid]::NewGuid().ToString('N'))
@@ -74,12 +114,23 @@ function New-CcodHardLink {
 Invoke-CcodTest 'exports only immutable generation operations and an inert CLR marker' {
     $expected=@('Close-CcodInstallFileTransaction','Commit-CcodInstallActivePointer','Copy-CcodInstallSealedSource','New-CcodInstallGenerationLeaf','Open-CcodInstallGeneration','Retire-CcodInstallGeneration','Write-CcodInstallGenerationManifest')
     Assert-CcodEqual ($expected -join '|') ((@($module.ExportedCommands.Keys)|Sort-Object)-join '|') 'module export surface is capability-only'
-    Assert-CcodEqual 1 ([CcodInstallCapabilityMarker]::CapabilityAbi) 'marker exposes a non-mutating ABI value'
-    Assert-CcodEqual 'CcodInstallCapabilityMarker' ((@([CcodInstallCapabilityMarker].Assembly.GetExportedTypes()|ForEach-Object FullName)) -join '|') 'CLR bridge exports only the inert marker'
-    $dangerous=@([CcodInstallCapabilityMarker].GetMethods([Reflection.BindingFlags]'Public,Static,DeclaredOnly')|Where-Object{@($_.GetParameters()|Where-Object{$_.ParameterType-in@([string],[IntPtr],[IO.Stream])-or[Microsoft.Win32.SafeHandles.SafeHandle].IsAssignableFrom($_.ParameterType)}).Count-ne 0})
+    Assert-CcodEqual 2 ([CcodInstallGenerationCapabilityMarkerV2]::CapabilityAbi) 'marker exposes the current non-mutating ABI value'
+    Assert-CcodEqual 'CcodInstallGenerationCapabilityMarkerV2' ((@([CcodInstallGenerationCapabilityMarkerV2].Assembly.GetExportedTypes()|ForEach-Object FullName)) -join '|') 'current CLR bridge exports only the inert marker'
+    $dangerous=@([CcodInstallGenerationCapabilityMarkerV2].GetMethods([Reflection.BindingFlags]'Public,Static,DeclaredOnly')|Where-Object{@($_.GetParameters()|Where-Object{$_.ParameterType-in@([string],[IntPtr],[IO.Stream])-or[Microsoft.Win32.SafeHandles.SafeHandle].IsAssignableFrom($_.ParameterType)}).Count-ne 0})
     Assert-CcodEqual 0 $dangerous.Count 'marker accepts no path stream or bare handle'
 }
 
+Invoke-CcodTest 'force re-import rebinds the current runtime ABI before real use' {
+    $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+    $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+    $fixture = New-CcodInstallFileFixture
+    try {
+        $generation = Open-CcodFixtureGeneration $fixture 'runtime-reimport'
+        $child = New-CcodInstallGenerationLeaf -Generation $generation -Leaf 'child'
+        Assert-CcodEqual '' (@($child.PSObject.Properties.Name) -join ',') 'second import uses the current runtime type binding'
+    } finally { Remove-CcodInstallFileFixture $fixture }
+}
+
 Invoke-CcodTest 'generation and capabilities are unique create-only opaque references' {
     $fixture=New-CcodInstallFileFixture
     try {
@@ -111,12 +162,41 @@ Invoke-CcodTest 'destination collisions preserve the first object byte-for-byte'
 Invoke-CcodTest 'source and destination handles remain private pinned and same-handle verified' {
     $fixture=New-CcodInstallFileFixture
     try {
-        $runtimeId='runtime-pinned-copy';$source=New-CcodSourceFile $fixture 'source.bin' 'sealed-source-v1';$generation=Open-CcodFixtureGeneration $fixture $runtimeId
-        $copy=Copy-CcodInstallSealedSource -Generation $generation -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256
+        $runtimeId='runtime-pinned-copy';$source=New-CcodSourceFile $fixture 'source.bin' ('sealed-source-v1'*65536);$replacement=New-CcodSourceFile $fixture 'replacement.bin' ('attacker-bytes'*65536);$generation=Open-CcodFixtureGeneration $fixture $runtimeId
+        $destination=Join-Path $fixture.Install "runtime\$runtimeId\payload.bin";$attack=[CcodInstallHandoffAttack]::new($destination,$replacement.Path);Assert-CcodTrue ($attack.WaitReady(5000)) 'handoff attacker is running before destination creation'
+        $copyFailure=$null;$copy=$null
+        try{$copy=Copy-CcodInstallSealedSource -Generation $generation -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256}catch{$copyFailure=$_}
+        $attackOutcome=$attack.Stop();$attack.Dispose()
+        Assert-CcodTrue ($attackOutcome-in@('blocked','exchanged')) 'handoff attacker completes with a bounded result'
+        if($null-ne$copyFailure){
+            Assert-CcodTrue ($null-ne$copyFailure-and$copyFailure.FullyQualifiedErrorId-match'^CCOD_INSTALL_(?:PIN_CHANGED|SEAL_MISMATCH)') 'an exchange during handoff cannot become an accepted sealed generation'
+            Write-CcodInstallGenerationManifest -Generation $generation -Manifest (New-CcodGenerationManifest $runtimeId)|Out-Null
+            Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -ExpectedPreviousGeneration ([uint64]0) -NewRuntimeId $runtimeId -FileTransaction $generation|Out-Null} 'CCOD_INSTALL_UNKNOWN_LEAF'
+            return
+        }
         Assert-CcodEqual $source.Length $copy.Length 'copy returns verified length';Assert-CcodEqual $source.Sha256 $copy.Sha256 'copy returns verified digest'
         Assert-CcodEqual 'blocked' (Invoke-CcodMoveAttempt $source.Path) 'source replacement is blocked after its handle opens'
-        $destination=Join-Path $fixture.Install "runtime\$runtimeId\payload.bin";Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 $destination) 'destination bytes match sealed handle digest'
+        $currentModule = Get-Module InstallFileTransaction
+        $sealedPin = & $currentModule {
+            param($Generation)
+            $scope = Get-CcodInstallTransaction $Generation
+            $pins = $scope.State.Runtime.GetType().GetField('pins',[Reflection.BindingFlags]'NonPublic,Instance').GetValue($scope.State.Runtime)
+            $flags = [Reflection.BindingFlags]'NonPublic,Instance'
+            $pin = $null
+            foreach ($candidate in $pins.Values) {
+                $type = $candidate.GetType()
+                if (-not [bool]$type.GetField('Directory',$flags).GetValue($candidate) -and [string]$type.GetField('Leaf',$flags).GetValue($candidate) -ceq 'payload.bin') { $pin = $candidate; break }
+            }
+            $pinType = $pin.GetType()
+            $stream = $pinType.GetField('Stream',$flags).GetValue($pin)
+            return [pscustomobject]@{CanWrite=$stream.CanWrite;Length=[int64]($pinType.GetField('SealedLength',$flags).GetValue($pin));Sha256=[string]($pinType.GetField('SealedSha',$flags).GetValue($pin))}
+        } $generation
+        Assert-CcodTrue (-not $sealedPin.CanWrite) 'handoff ends on a strict read-only private handle'
+        Assert-CcodEqual $source.Length $sealedPin.Length 'strict handoff pin retains the same-handle verified length'
+        Assert-CcodEqual $source.Sha256 $sealedPin.Sha256 'strict handoff pin retains the same-handle verified digest'
+        Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 $destination) 'successful sealed leaf is readable by path before transaction close'
         try {[IO.File]::WriteAllText($destination,'attacker');throw 'ASSERT_DESTINATION_MUTABLE'} catch [IO.IOException] {}
+        Assert-CcodEqual 'blocked' (Invoke-CcodMoveAttempt $destination) 'destination name exchange remains blocked after sealing'
         Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 $destination) 'destination handle blocks mutation after verification'
         Assert-CcodOutsideUnchanged $fixture 'pinned copy'
     } finally {Remove-CcodInstallFileFixture $fixture}
@@ -173,10 +253,13 @@ Invoke-CcodTest 'rejects forged cross-transaction and closed capabilities' {
 Invoke-CcodTest 'close serializes native handle release against later relative operations' {
     $fixture=New-CcodInstallFileFixture
     try {
-        $runtimeId='runtime-close-barrier';$generation=Open-CcodFixtureGeneration $fixture $runtimeId;$child=New-CcodInstallGenerationLeaf -Generation $generation -Leaf 'child'
+        $runtimeId='runtime-close-barrier';$source=New-CcodSourceFile $fixture 'close-source.bin' 'close-source';$generation=Open-CcodFixtureGeneration $fixture $runtimeId;$child=New-CcodInstallGenerationLeaf -Generation $generation -Leaf 'child';Copy-CcodInstallSealedSource -Generation $generation -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null
+        $currentModule=Get-Module InstallFileTransaction;$native=&$currentModule {param($Generation)$scope=Get-CcodInstallTransaction $Generation;[pscustomobject]@{Runtime=$scope.State.Runtime;Token=$scope.Record.Token}} $generation
+        $race=[CcodInstallFileRaceProbe]::RaceCreateAndClose($native.Runtime,$native.Token,'racing-child');Assert-CcodTrue ($race-in@('created|closed','closed|closed')) "relative create and close serialize without native handle misuse actual=$race"
         Close-CcodInstallFileTransaction -Transaction $generation -Disposition Failed|Out-Null
         Assert-CcodThrows {New-CcodInstallGenerationLeaf -Generation $child -Leaf 'late'|Out-Null} 'CCOD_INSTALL_TRANSACTION_CLOSED'
-        $live=Join-Path $fixture.Install "runtime\$runtimeId";$moved=$live+'.moved';[IO.Directory]::Move($live,$moved);Assert-CcodTrue ([IO.Directory]::Exists($moved)) 'close released native handles';Assert-CcodOutsideUnchanged $fixture 'close barrier'
+        Assert-CcodEqual 'moved' (Invoke-CcodMoveAttempt $source.Path) 'close releases the deliberately retained source handle'
+        $live=Join-Path $fixture.Install "runtime\$runtimeId";$moved=$live+'.moved';[IO.Directory]::Move($live,$moved);Assert-CcodTrue ([IO.Directory]::Exists($moved)) 'close releases generation and destination handles';Assert-CcodOutsideUnchanged $fixture 'close barrier'
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
 
@@ -188,25 +271,100 @@ Invoke-CcodTest 'pointer generation records are monotonic create-only and collis
         Assert-CcodEqual ([uint64]1) ([uint64]$committed.Generation) 'first pointer generation is one'
         $records=@(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\active-generation') -File -Filter '*.json');Assert-CcodEqual 1 $records.Count 'one pointer record';$before=Get-CcodTestFileSha256 $records[0].FullName
         $second=Open-CcodFixtureGeneration $fixture 'runtime-pointer-two';Write-CcodInstallGenerationManifest -Generation $second -Manifest (New-CcodGenerationManifest 'runtime-pointer-two')|Out-Null
-        Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -ExpectedPreviousGeneration ([uint64]0) -NewRuntimeId 'runtime-pointer-two' -FileTransaction $second|Out-Null} 'CCOD_INSTALL_POINTER_GENERATION_EXISTS'
-        $after=@(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\active-generation') -File -Filter '*.json');Assert-CcodEqual 1 $after.Count 'duplicate publishes no record';Assert-CcodEqual $before (Get-CcodTestFileSha256 $after[0].FullName) 'existing pointer unchanged';Assert-CcodOutsideUnchanged $fixture 'pointer collision'
+        $secondCommit=Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -ExpectedPreviousGeneration ([uint64]1) -NewRuntimeId 'runtime-pointer-two' -FileTransaction $second
+        Assert-CcodEqual ([uint64]2) ([uint64]$secondCommit.Generation) 'second pointer generation increments to two'
+        $after=@(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\active-generation') -File -Filter '*.json'|Sort-Object Name);Assert-CcodEqual 2 $after.Count 'successful second commit appends one record';Assert-CcodEqual $before (Get-CcodTestFileSha256 $after[0].FullName) 'generation one remains unchanged'
+        $third=Open-CcodFixtureGeneration $fixture 'runtime-pointer-three';Write-CcodInstallGenerationManifest -Generation $third -Manifest (New-CcodGenerationManifest 'runtime-pointer-three')|Out-Null
+        Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -ExpectedPreviousGeneration ([uint64]1) -NewRuntimeId 'runtime-pointer-three' -FileTransaction $third|Out-Null} 'CCOD_INSTALL_POINTER_GENERATION_EXISTS'
+        Assert-CcodEqual 2 @(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\active-generation') -File -Filter '*.json').Count 'no-replace contender publishes no third record'
+        Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -ExpectedPreviousGeneration ([uint64]::MaxValue) -NewRuntimeId 'runtime-pointer-three' -FileTransaction $third|Out-Null} 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW'
+        Assert-CcodEqual 2 @(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\active-generation') -File -Filter '*.json').Count 'overflow publishes no record'
+        Assert-CcodOutsideUnchanged $fixture 'pointer monotonicity'
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
 
-Invoke-CcodTest 'atomically retires a proven nonempty generation without deleting bytes or changing its DACL' {
+Invoke-CcodTest 'independent transactions race one pointer generation with exactly one no-replace winner' {
+    $fixture=New-CcodInstallFileFixture
+    $processes=@()
+    try {
+        $initial=Open-CcodFixtureGeneration $fixture 'runtime-pointer-initial';Write-CcodInstallGenerationManifest -Generation $initial -Manifest (New-CcodGenerationManifest 'runtime-pointer-initial')|Out-Null
+        Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -ExpectedPreviousGeneration ([uint64]0) -NewRuntimeId 'runtime-pointer-initial' -FileTransaction $initial|Out-Null
+        $go=Join-Path $fixture.Base 'go';$escapedModule=$modulePath.Replace("'","''");$escapedRoot=$fixture.Install.Replace("'","''")
+        foreach($index in 1..2){
+            $runtimeId="runtime-pointer-racer-$index";$scriptPath=Join-Path $fixture.Base "racer-$index.ps1";$ready=Join-Path $fixture.Base "ready-$index";$outcome=Join-Path $fixture.Base "outcome-$index"
+            $scriptText=@"
+`$ErrorActionPreference='Stop'
+Import-Module '$escapedModule' -Force -DisableNameChecking
+`$tx=`$null
+try {
+    `$tx=Open-CcodInstallGeneration -InstallRoot '$escapedRoot' -RuntimeId '$runtimeId'
+    `$manifest=[ordered]@{schemaVersion=1;projectVersion='2.5.22';runtimeId='$runtimeId';commit='0123456789abcdef0123456789abcdef01234567';files=@()}
+    Write-CcodInstallGenerationManifest -Generation `$tx -Manifest `$manifest|Out-Null
+    [IO.File]::WriteAllText('$($ready.Replace("'","''"))','ready')
+    `$deadline=[DateTime]::UtcNow.AddSeconds(15)
+    while(-not[IO.File]::Exists('$($go.Replace("'","''"))')){if([DateTime]::UtcNow-gt`$deadline){throw 'barrier timeout'};Start-Sleep -Milliseconds 10}
+    try{Commit-CcodInstallActivePointer -InstallRoot '$escapedRoot' -ExpectedPreviousGeneration ([uint64]1) -NewRuntimeId '$runtimeId' -FileTransaction `$tx|Out-Null;[IO.File]::WriteAllText('$($outcome.Replace("'","''"))','success')}
+    catch{[IO.File]::WriteAllText('$($outcome.Replace("'","''"))',[string]`$_.FullyQualifiedErrorId)}
+} finally {if(`$null-ne`$tx){Close-CcodInstallFileTransaction -Transaction `$tx -Disposition Failed|Out-Null}}
+"@
+            [IO.File]::WriteAllText($scriptPath,$scriptText)
+            $powershell=Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+            $processes+=Start-Process -FilePath $powershell -ArgumentList @('-NoProfile','-ExecutionPolicy','Bypass','-File',$scriptPath) -WindowStyle Hidden -PassThru
+        }
+        $deadline=[DateTime]::UtcNow.AddSeconds(15)
+        while(@(1..2|Where-Object{-not[IO.File]::Exists((Join-Path $fixture.Base "ready-$_"))}).Count-ne 0){if([DateTime]::UtcNow-gt$deadline){throw 'pointer racers did not reach the barrier'};Start-Sleep -Milliseconds 20}
+        [IO.File]::WriteAllText($go,'go')
+        foreach($process in $processes){if(-not$process.WaitForExit(20000)){Stop-Process -Id $process.Id -Force;throw 'pointer racer timed out'};Assert-CcodEqual 0 $process.ExitCode 'pointer racer handles its no-replace result'}
+        $outcomes=@(1..2|ForEach-Object{[IO.File]::ReadAllText((Join-Path $fixture.Base "outcome-$_"))})
+        Assert-CcodEqual 1 @($outcomes|Where-Object{$_-ceq'success'}).Count 'exactly one pointer racer wins'
+        Assert-CcodEqual 1 @($outcomes|Where-Object{$_-like'CCOD_INSTALL_POINTER_GENERATION_EXISTS*'}).Count 'losing pointer racer gets the stable collision code'
+        Assert-CcodEqual 2 @(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\active-generation') -File -Filter '*.json').Count 'race appends exactly one generation-two record'
+    } finally {
+        foreach($process in $processes){if(-not$process.HasExited){Stop-Process -Id $process.Id -Force}}
+        Remove-CcodInstallFileFixture $fixture
+    }
+}
+
+Invoke-CcodTest 'retirement writes one create-only record and keeps the nonempty generation in place' {
     $fixture=New-CcodInstallFileFixture
     try {
         $runtimeId='runtime-retire';$source=New-CcodSourceFile $fixture 'source.bin' 'retained-retirement-bytes';$generation=Open-CcodFixtureGeneration $fixture $runtimeId;$child=New-CcodInstallGenerationLeaf $generation 'child'
         Copy-CcodInstallSealedSource -Generation $child -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null
         Write-CcodInstallGenerationManifest -Generation $generation -Manifest (New-CcodGenerationManifest $runtimeId @([ordered]@{path='child\payload.bin';length=$source.Length;sha256=$source.Sha256}))|Out-Null
         $live=Join-Path $fixture.Install "runtime\$runtimeId";$beforeSddl=(Get-Acl -LiteralPath $live).Sddl;$retirement=Retire-CcodInstallGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -FileTransaction $generation
-        Assert-CcodEqual 'Retired' $retirement.Disposition 'bounded retirement result';Assert-CcodEqual '' (@($retirement.Capability.PSObject.Properties.Name)-join ',') 'retirement capability opaque';Assert-CcodTrue (-not [IO.Directory]::Exists($live)) 'live name disappears'
-        $retired=@(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'retired') -Directory|Where-Object Name -Like "$runtimeId.*");Assert-CcodEqual 1 $retired.Count 'one quarantine generation';Assert-CcodTrue ($retired[0].Name-cmatch('^'+[regex]::Escape($runtimeId)+'\.[0-9a-f]{32}$')) 'unique owned suffix'
+        Assert-CcodEqual 'Retired' $retirement.Disposition 'bounded retirement result';Assert-CcodEqual '' (@($retirement.Capability.PSObject.Properties.Name)-join ',') 'retirement capability opaque';Assert-CcodTrue ([IO.Directory]::Exists($live)) 'record-only retirement keeps the generation live name in place'
         Assert-CcodThrows {Copy-CcodInstallSealedSource -Generation $retirement.Capability -SourcePath $source.Path -Leaf 'post-retire.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null} 'CCOD_INSTALL_GENERATION_RETIRED'
-        Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $retired[0].FullName 'post-retire.bin'))) 'retired capability cannot mutate quarantine bytes'
-        Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 (Join-Path $retired[0].FullName 'child\payload.bin')) 'retired bytes unchanged';Assert-CcodEqual $beforeSddl (Get-Acl -LiteralPath $retired[0].FullName).Sddl 'no persistent DACL mutation'
-        Assert-CcodEqual 1 @(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\retirements') -File -Filter '*.json').Count 'one retirement record';Assert-CcodOutsideUnchanged $fixture 'retirement'
+        Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $live 'post-retire.bin'))) 'retired capability cannot mutate retained generation bytes'
+        Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 (Join-Path $live 'child\payload.bin')) 'retained generation bytes remain readable and unchanged';Assert-CcodEqual $beforeSddl (Get-Acl -LiteralPath $live).Sddl 'retirement changes no DACL'
+        $records=@(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\retired-generations') -File -Filter '*.json');Assert-CcodEqual 1 $records.Count 'one retirement record'
+        $repeated=Retire-CcodInstallGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -FileTransaction $generation
+        Assert-CcodEqual 'Retired' $repeated.Disposition 'repeated retirement is idempotent';Assert-CcodEqual 1 @(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\retired-generations') -File -Filter '*.json').Count 'idempotent retirement writes no second record'
+        Assert-CcodOutsideUnchanged $fixture 'record-only retirement'
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
 
+Invoke-CcodTest 'retirement collision and record I/O failure leave generation eligible and mutable' {
+    foreach($case in @('collision','io-failure')){
+        $fixture=New-CcodInstallFileFixture
+        try {
+            $runtimeId="runtime-retire-$case";$generation=Open-CcodFixtureGeneration $fixture $runtimeId;$state=Join-Path $fixture.Install 'state';[IO.Directory]::CreateDirectory($state)|Out-Null
+            if($case-ceq'collision'){
+                $records=Join-Path $state 'retired-generations';[IO.Directory]::CreateDirectory($records)|Out-Null;$record=Join-Path $records ($runtimeId+'.json');[IO.File]::WriteAllText($record,'attacker-record');$recordSha=Get-CcodTestFileSha256 $record;$expected='CCOD_INSTALL_RETIREMENT_RECORD_EXISTS'
+            }else{
+                [IO.File]::WriteAllText((Join-Path $state 'retired-generations'),'not-a-directory');$expected='CCOD_INSTALL_RETIREMENT_FAILED'
+            }
+            Assert-CcodThrows {Retire-CcodInstallGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -FileTransaction $generation|Out-Null} $expected
+            $child=New-CcodInstallGenerationLeaf -Generation $generation -Leaf 'still-mutable';Assert-CcodEqual '' (@($child.PSObject.Properties.Name)-join ',') "$case retains the original capability"
+            Assert-CcodTrue ([IO.Directory]::Exists((Join-Path $fixture.Install "runtime\$runtimeId\still-mutable"))) "$case keeps the generation in place"
+            if($case-ceq'collision'){
+                Assert-CcodEqual $recordSha (Get-CcodTestFileSha256 $record) 'retirement collision preserves the existing record'
+                $temporary=@(Get-ChildItem -LiteralPath $records -File -Filter '.ccod.*.tmp');Assert-CcodEqual 1 $temporary.Count 'failed no-replace retirement deliberately retains one diagnostic temporary record'
+                Assert-CcodEqual 'blocked' (Invoke-CcodMoveAttempt $temporary[0].FullName) 'diagnostic temporary handle remains pinned until transaction close'
+                Close-CcodInstallFileTransaction -Transaction $generation -Disposition Failed|Out-Null
+                Assert-CcodEqual 'moved' (Invoke-CcodMoveAttempt $temporary[0].FullName) 'Failed disposition releases the retained temporary record handle'
+            }
+        } finally {Remove-CcodInstallFileFixture $fixture}
+    }
+}
+
 Write-Host 'Install file transaction self-test passed.' -ForegroundColor Green

From e74cfdf28fa05c2b0f8c61634b6542f41e734f45 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sat, 29 Aug 2026 20:40:26 +0800
Subject: [PATCH 074/187] fix: seal temporary leaves before publication

---
 .../modules/InstallFileTransaction.psm1       | 68 ++++++++++---------
 .../InstallFileTransaction.SelfTest.ps1       | 63 +++++++++++++----
 2 files changed, 85 insertions(+), 46 deletions(-)

diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index a52406c..8471d8b 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -31,7 +31,7 @@ public sealed class CcodInstallGenerationCapabilityMarkerV2
 internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
 {
     private const uint READ = 0x80000000, WRITE = 0x40000000, DELETE = 0x00010000, SYNC = 0x00100000;
-    private const uint READ_ATTRIBUTES = 0x80, LIST_DIRECTORY = 0x1, ADD_FILE = 0x2, ADD_SUBDIRECTORY = 0x4;
+    private const uint READ_ATTRIBUTES = 0x80, WRITE_ATTRIBUTES = 0x100, LIST_DIRECTORY = 0x1, ADD_FILE = 0x2, ADD_SUBDIRECTORY = 0x4;
     private const uint SHARE_READ = 1, SHARE_WRITE = 2, SHARE_DELETE = 4;
     private const uint OPEN = 1, CREATE = 2;
     private const uint DIRECTORY = 1, WRITE_THROUGH = 2, SYNC_IO = 0x20, NON_DIRECTORY = 0x40, BACKUP_INTENT = 0x4000, OPEN_REPARSE = 0x200000;
@@ -64,7 +64,7 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
         internal readonly object Token = new object();
         internal readonly Pin Parent; internal string Leaf, Path;
         internal readonly bool Directory, Owned; internal SafeFileHandle Handle; internal FileStream Stream;
-        internal readonly uint Volume; internal readonly ulong Index; internal bool Closed, Sealed, Manifest; internal long SealedLength; internal string SealedSha;
+        internal readonly uint Volume; internal readonly ulong Index; internal bool Closed, Sealed, Published, Manifest; internal long SealedLength; internal string SealedSha;
         internal Pin(Pin parent,string leaf,string path,bool directory,bool owned,SafeFileHandle handle,FileStream stream,FILE_INFO info)
         { Parent=parent;Leaf=leaf;Path=path;Directory=directory;Owned=owned;Handle=handle;Stream=stream;Volume=info.VolumeSerialNumber;Index=((ulong)info.FileIndexHigh<<32)|info.FileIndexLow; }
         internal SafeFileHandle Native { get { return Stream != null ? Stream.SafeFileHandle : Handle; } }
@@ -95,7 +95,7 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
             catch(Win32Exception exception) { if(exception.NativeErrorCode!=80&&exception.NativeErrorCode!=183)throw;runtimeResult=OpenRelative(rootPin.Native,"runtime",LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT); }
             try { runtimePin=ValidateDirectoryPin(rootPin,"runtime",Path.Combine(full,"runtime"),false,runtimeResult.Handle);runtimeResult.Handle=null; }
             finally { if(runtimeResult.Handle!=null)runtimeResult.Handle.Dispose(); }
-            OpenResult generationResult=OpenRelative(runtimePin.Native,runtimeId,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ,CREATE,DIRECTORY|BACKUP_INTENT);
+            OpenResult generationResult=OpenRelative(runtimePin.Native,runtimeId,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ|SHARE_WRITE,CREATE,DIRECTORY|BACKUP_INTENT);
             try
             {
                 Pin generation=ValidateDirectoryPin(runtimePin,runtimeId,Path.Combine(runtimePin.Path,runtimeId),true,generationResult.Handle);generationResult.Handle=null;
@@ -108,7 +108,7 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object CreateDirectory(object parentToken,string leaf)
     {
-        Pin parent=Require(parentToken,true);ValidateCurrent(parent);OpenResult result=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ,CREATE,DIRECTORY|BACKUP_INTENT);
+        Pin parent=Require(parentToken,true);ValidateCurrent(parent);OpenResult result=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ|SHARE_WRITE,CREATE,DIRECTORY|BACKUP_INTENT);
         try { Pin pin=ValidateDirectoryPin(parent,leaf,Path.Combine(parent.Path,leaf),true,result.Handle);result.Handle=null;AddPin(pin);return pin.Token; }
         finally { if(result.Handle!=null)result.Handle.Dispose(); }
     }
@@ -117,44 +117,35 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
     {
         Pin parent=Require(parentToken,true);ValidateCurrent(parent);string full=Path.GetFullPath(source);
         SafeFileHandle sourceHandle=CreateFileW(full,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,IntPtr.Zero,OPEN_EXISTING,FLAG_REPARSE,IntPtr.Zero);
-        if(sourceHandle.IsInvalid)throw new Win32Exception(Marshal.GetLastWin32Error());FileStream sourceStream=null,destinationStream=null;OpenResult destinationResult=null;
+        if(sourceHandle.IsInvalid)throw new Win32Exception(Marshal.GetLastWin32Error());FileStream sourceStream=null;
         try
         {
             FILE_INFO sourceInfo=Info(sourceHandle);ValidatePlain(sourceInfo,sourceHandle);if(!SamePath(FinalPath(sourceHandle),full))throw new InvalidDataException("source path changed");
             sourceStream=new FileStream(sourceHandle,FileAccess.Read,65536,false);sourceHandle=null;
-            if(sourceStream.Length!=expectedLength||Sha(sourceStream)!=expectedSha)throw new InvalidDataException("source mismatch");sourceStream.Position=0;
-            destinationResult=OpenRelative(parent.Native,leaf,READ|WRITE|SYNC,SHARE_READ,CREATE,NON_DIRECTORY|WRITE_THROUGH);
-            destinationStream=new FileStream(destinationResult.Handle,FileAccess.ReadWrite,65536,false);destinationResult.Handle=null;
-            FILE_INFO destinationInfo=Info(destinationStream.SafeFileHandle);ValidatePlain(destinationInfo,destinationStream.SafeFileHandle);
-            Pin destination=new Pin(parent,leaf,Path.Combine(parent.Path,leaf),false,true,null,destinationStream,destinationInfo);destinationStream=null;
-            sourceStream.CopyTo(destination.Stream);destination.Stream.Flush(true);
-            if(destination.Stream.Length!=expectedLength||Sha(destination.Stream)!=expectedSha)throw new InvalidDataException("destination mismatch");destination.SealedLength=expectedLength;destination.SealedSha=expectedSha;AddPin(destination);try{MakeReadable(destination,expectedLength,expectedSha);}catch(Exception exception){throw new InvalidDataException("seal mismatch",exception);}destination.Sealed=true;externalStreams.Add(sourceStream);sourceStream=null;return destination.Token;
+            externalStreams.Add(sourceStream);FileStream ownedSource=sourceStream;sourceStream=null;
+            if(ownedSource.Length!=expectedLength||Sha(ownedSource)!=expectedSha)throw new InvalidDataException("source mismatch");ownedSource.Position=0;
+            Pin destination=CreateTemporaryFile(parent);ownedSource.CopyTo(destination.Stream);destination.Stream.Flush(true);
+            if(destination.Stream.Length!=expectedLength||Sha(destination.Stream)!=expectedSha)throw new InvalidDataException("destination mismatch");SealAndPublish(destination,leaf,expectedLength,expectedSha,false);return destination.Token;
         }
-        finally { if(sourceStream!=null)sourceStream.Dispose();if(sourceHandle!=null)sourceHandle.Dispose();if(destinationStream!=null)destinationStream.Dispose();if(destinationResult!=null&&destinationResult.Handle!=null)destinationResult.Handle.Dispose(); }
+        finally { if(sourceStream!=null)sourceStream.Dispose();if(sourceHandle!=null)sourceHandle.Dispose(); }
     }
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object Write(object parentToken,string leaf,byte[] bytes,bool manifest)
     {
-        Pin parent=Require(parentToken,true);ValidateCurrent(parent);OpenResult result=OpenRelative(parent.Native,leaf,READ|WRITE|DELETE|SYNC,SHARE_READ,CREATE,NON_DIRECTORY|WRITE_THROUGH);FileStream stream=null;
-        try
-        {
-            stream=new FileStream(result.Handle,FileAccess.ReadWrite,65536,false);result.Handle=null;FILE_INFO info=Info(stream.SafeFileHandle);ValidatePlain(info,stream.SafeFileHandle);Pin pin=new Pin(parent,leaf,Path.Combine(parent.Path,leaf),false,true,null,stream,info);stream=null;
-            pin.Stream.Write(bytes,0,bytes.Length);pin.Stream.Flush(true);string sha=Sha(pin.Stream);if(pin.Stream.Length!=bytes.LongLength)throw new InvalidDataException("destination mismatch");pin.SealedLength=bytes.LongLength;pin.SealedSha=sha;AddPin(pin);if(manifest)MakeReadable(pin,bytes.LongLength,sha);pin.Sealed=true;pin.Manifest=manifest;return new object[]{pin.Token,pin.SealedLength,sha};
-        }
-        finally { if(stream!=null)stream.Dispose();if(result.Handle!=null)result.Handle.Dispose(); }
+        Pin parent=Require(parentToken,true);ValidateCurrent(parent);Pin pin=CreateTemporaryFile(parent);pin.Stream.Write(bytes,0,bytes.Length);pin.Stream.Flush(true);string sha=Sha(pin.Stream);if(pin.Stream.Length!=bytes.LongLength)throw new InvalidDataException("destination mismatch");SealAndPublish(pin,leaf,bytes.LongLength,sha,manifest);return pin.Token;
     }
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object CommitPointer(object generationToken,ulong previousGeneration,string runtimeId,byte[] bytes)
     {
         Pin generation=Require(generationToken,true);ValidateCurrent(generation);if(!Object.ReferenceEquals(generation.Parent,runtimeParent)||!String.Equals(generation.Leaf,runtimeId,StringComparison.Ordinal))throw new InvalidDataException("transaction scope");
-        Pin manifest=null;if(!names.TryGetValue(Key(generation,"manifest.json"),out manifest)||!manifest.Manifest||!manifest.Sealed)throw new InvalidDataException("manifest missing");ValidateCurrent(manifest);ValidateOwnedTree(generation);
-        if(previousGeneration==UInt64.MaxValue)throw new OverflowException("pointer generation overflow");Pin state=OpenOrCreateDirectory(root,"state"),pointer=OpenOrCreateDirectory(state,"active-generation");if(CurrentPointerGeneration(pointer)!=previousGeneration)throw new InvalidOperationException("pointer generation exists");string leaf=(previousGeneration+1).ToString("D20")+".json";return WriteAtomic(pointer,leaf,bytes);
+        Pin manifest=null;if(!names.TryGetValue(Key(generation,"manifest.json"),out manifest)||!manifest.Manifest||!manifest.Sealed)throw new InvalidDataException("manifest missing");EnsurePublishedPin(manifest);ValidateOwnedTree(generation);
+        if(previousGeneration==UInt64.MaxValue)throw new OverflowException("pointer generation overflow");Pin state=OpenOrCreateDirectory(root,"state"),pointer=OpenOrCreateDirectory(state,"active-generation");if(CurrentPointerGeneration(pointer)!=previousGeneration)throw new InvalidOperationException("pointer generation exists");string leaf=(previousGeneration+1).ToString("D20")+".json";return Write(pointer.Token,leaf,bytes,false);
     }
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object Retire(object generationToken,string runtimeId,string recordLeaf,byte[] record)
     {
         Pin generation=Require(generationToken,true);ValidateCurrent(generation);if(!Object.ReferenceEquals(generation.Parent,runtimeParent)||!String.Equals(generation.Leaf,runtimeId,StringComparison.Ordinal)||!generation.Owned)throw new InvalidDataException("generation not owned");
-        ValidateOwnedTree(generation);Pin state=OpenOrCreateDirectory(root,"state"),retirements=OpenOrCreateDirectory(state,"retired-generations");WriteAtomic(retirements,recordLeaf,record);ValidateCurrent(generation);return generation.Token;
+        ValidateOwnedTree(generation);Pin state=OpenOrCreateDirectory(root,"state"),retirements=OpenOrCreateDirectory(state,"retired-generations");Write(retirements.Token,recordLeaf,record,false);ValidateCurrent(generation);return generation.Token;
     }
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal void Close()
@@ -173,11 +164,11 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
 
     private void ValidateOwnedTree(Pin directory)
     {
-        ValidateCurrent(directory);foreach(string leaf in Enumerate(directory.Native)){Pin child;if(!names.TryGetValue(Key(directory,leaf),out child)||!child.Owned)throw new InvalidDataException("unknown leaf");if(child.Directory){ValidateCurrent(child);ValidateOwnedTree(child);}else{if(!child.Sealed)throw new InvalidDataException("unsealed leaf");ValidateCurrent(child);}}
+        ValidateCurrent(directory);foreach(string leaf in Enumerate(directory.Native)){Pin child;if(!names.TryGetValue(Key(directory,leaf),out child)||!child.Owned)throw new InvalidDataException("unknown leaf");if(child.Directory){ValidateCurrent(child);ValidateOwnedTree(child);}else{if(!child.Sealed||!child.Published)throw new InvalidDataException("unsealed leaf");EnsurePublishedPin(child);}}
     }
-    private object WriteAtomic(Pin parent,string leaf,byte[] bytes)
+    private Pin CreateTemporaryFile(Pin parent)
     {
-        string temporary=".ccod."+Guid.NewGuid().ToString("N")+".tmp";object[] result=(object[])Write(parent.Token,temporary,bytes,false);Pin pin=Require(result[0],false);int error=Rename(pin.Native,parent.Native,leaf);if(error!=0)throw new Win32Exception(error);names.Remove(Key(parent,temporary));pin.Leaf=leaf;pin.Path=Path.Combine(parent.Path,leaf);names.Add(Key(parent,leaf),pin);MakeReadable(pin,pin.SealedLength,pin.SealedSha);return result;
+        string temporary=".ccod."+Guid.NewGuid().ToString("N")+".tmp";OpenResult result=OpenRelative(parent.Native,temporary,READ|WRITE|DELETE|SYNC,SHARE_READ,CREATE,NON_DIRECTORY|WRITE_THROUGH);FileStream stream=null;try{stream=new FileStream(result.Handle,FileAccess.ReadWrite,65536,false);result.Handle=null;FILE_INFO info=Info(stream.SafeFileHandle);ValidatePlain(info,stream.SafeFileHandle);Pin pin=new Pin(parent,temporary,Path.Combine(parent.Path,temporary),false,true,null,stream,info);AddPin(pin);stream=null;return pin;}finally{if(stream!=null)stream.Dispose();if(result.Handle!=null)result.Handle.Dispose();}
     }
     private static ulong CurrentPointerGeneration(Pin pointer)
     {
@@ -187,7 +178,21 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
     private void AddPin(Pin pin){pins.Add(pin.Token,pin);if(pin.Parent!=null)names.Add(Key(pin.Parent,pin.Leaf),pin);}
     private static string Key(Pin parent,string leaf){return parent.Index.ToString("x16")+"|"+leaf.ToLowerInvariant();}
     private static Pin ValidateDirectoryPin(Pin parent,string leaf,string path,bool owned,SafeFileHandle handle){FILE_INFO info=Info(handle);if(!IsDirectory(info)||(info.FileAttributes&ATTR_REPARSE)!=0||!OnlyDefaultStream(handle)||!SamePath(FinalPath(handle),path))throw new InvalidDataException("directory invalid");return new Pin(parent,leaf,path,true,owned,handle,null,info);}
-    private static void MakeReadable(Pin pin,long expectedLength,string expectedSha){OpenResult bridge=null,strict=null;FileStream strictStream=null;try{bridge=OpenRelative(pin.Parent.Native,pin.Leaf,READ|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE|SHARE_DELETE,OPEN,NON_DIRECTORY);FILE_INFO bridgeInfo=Info(bridge.Handle);if(bridgeInfo.VolumeSerialNumber!=pin.Volume||(((ulong)bridgeInfo.FileIndexHigh<<32)|bridgeInfo.FileIndexLow)!=pin.Index)throw new InvalidDataException("pin changed");pin.Stream.Dispose();pin.Stream=null;strict=OpenRelative(pin.Parent.Native,pin.Leaf,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,OPEN,NON_DIRECTORY);strictStream=new FileStream(strict.Handle,FileAccess.Read,65536,false);strict.Handle=null;FILE_INFO strictInfo=Info(strictStream.SafeFileHandle);ValidatePlain(strictInfo,strictStream.SafeFileHandle);if(strictInfo.VolumeSerialNumber!=pin.Volume||(((ulong)strictInfo.FileIndexHigh<<32)|strictInfo.FileIndexLow)!=pin.Index||!SamePath(FinalPath(strictStream.SafeFileHandle),pin.Path)||strictStream.Length!=expectedLength||Sha(strictStream)!=expectedSha)throw new InvalidDataException("seal mismatch");pin.Stream=strictStream;strictStream=null;}finally{if(strictStream!=null)strictStream.Dispose();if(strict!=null&&strict.Handle!=null)strict.Handle.Dispose();if(bridge!=null&&bridge.Handle!=null)bridge.Handle.Dispose();}}
+    private void SealAndPublish(Pin pin,string finalLeaf,long expectedLength,string expectedSha,bool manifest)
+    {
+        string temporaryKey=Key(pin.Parent,pin.Leaf),finalKey=Key(pin.Parent,finalLeaf),finalPath=Path.Combine(pin.Parent.Path,finalLeaf);bool finalAlias=false,committed=false;OpenResult renameHandle=null,strict=null;FileStream strictStream=null;string stage="strict";try
+        {
+            pin.Stream.Dispose();pin.Stream=null;strict=OpenRelative(pin.Parent.Native,pin.Leaf,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,OPEN,NON_DIRECTORY);strictStream=new FileStream(strict.Handle,FileAccess.Read,65536,false);strict.Handle=null;
+            FILE_INFO strictInfo=Info(strictStream.SafeFileHandle);ValidatePlain(strictInfo,strictStream.SafeFileHandle);if(strictInfo.VolumeSerialNumber!=pin.Volume||(((ulong)strictInfo.FileIndexHigh<<32)|strictInfo.FileIndexLow)!=pin.Index||!SamePath(FinalPath(strictStream.SafeFileHandle),pin.Path)||strictStream.Length!=expectedLength||Sha(strictStream)!=expectedSha)throw new InvalidDataException("seal mismatch");
+            strictStream.Dispose();strictStream=null;stage="rename-open";renameHandle=OpenRelative(pin.Parent.Native,pin.Leaf,READ|DELETE|READ_ATTRIBUTES|WRITE_ATTRIBUTES|SYNC,SHARE_READ,OPEN,NON_DIRECTORY);FILE_INFO renameInfo=Info(renameHandle.Handle);ValidatePlain(renameInfo,renameHandle.Handle);if(renameInfo.VolumeSerialNumber!=pin.Volume||(((ulong)renameInfo.FileIndexHigh<<32)|renameInfo.FileIndexLow)!=pin.Index||!SamePath(FinalPath(renameHandle.Handle),pin.Path))throw new InvalidDataException("pin changed");int attributeError=SetReadOnly(renameHandle.Handle);if(attributeError!=0)throw new Win32Exception(attributeError);pin.SealedLength=expectedLength;pin.SealedSha=expectedSha;pin.Manifest=manifest;pin.Sealed=true;
+            if(names.ContainsKey(finalKey))throw new Win32Exception(183);names.Add(finalKey,pin);finalAlias=true;stage="rename";int error=Rename(renameHandle.Handle,pin.Parent.Native,finalLeaf);if(error!=0)throw new Win32Exception(error);committed=true;
+            names.Remove(temporaryKey);pin.Leaf=finalLeaf;pin.Path=finalPath;pin.Published=true;
+        }
+        catch(Exception exception){if(finalAlias&&!committed)names.Remove(finalKey);Win32Exception win32=exception as Win32Exception;if((stage=="rename"||stage=="rename-open")&&win32!=null&&(win32.NativeErrorCode==80||win32.NativeErrorCode==183))throw;throw new InvalidDataException("seal mismatch at "+stage+(win32==null?"":" win32="+win32.NativeErrorCode),exception);}
+        finally{if(strictStream!=null)strictStream.Dispose();if(strict!=null&&strict.Handle!=null)strict.Handle.Dispose();if(renameHandle!=null&&renameHandle.Handle!=null)renameHandle.Handle.Dispose();}
+    }
+    private void EnsurePublishedPin(Pin pin){if(pin.Stream!=null){ValidateCurrent(pin);return;}OpenResult result=OpenRelative(pin.Parent.Native,pin.Leaf,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,OPEN,NON_DIRECTORY);FileStream stream=null;try{stream=new FileStream(result.Handle,FileAccess.Read,65536,false);result.Handle=null;FILE_INFO info=Info(stream.SafeFileHandle);ValidatePlain(info,stream.SafeFileHandle);if(info.VolumeSerialNumber!=pin.Volume||(((ulong)info.FileIndexHigh<<32)|info.FileIndexLow)!=pin.Index||!SamePath(FinalPath(stream.SafeFileHandle),pin.Path)||stream.Length!=pin.SealedLength||Sha(stream)!=pin.SealedSha)throw new InvalidDataException("seal mismatch");pin.Stream=stream;stream=null;}finally{if(stream!=null)stream.Dispose();if(result.Handle!=null)result.Handle.Dispose();}}
+    private static int SetReadOnly(SafeFileHandle handle){IntPtr buffer=Marshal.AllocHGlobal(40);try{for(int i=0;i<40;i++)Marshal.WriteByte(buffer,i,0);Marshal.WriteInt32(buffer,32,1);IO_STATUS_BLOCK io;int status=NtSetInformationFile(handle,out io,buffer,40,4);return status>=0?0:(int)RtlNtStatusToDosError(status);}finally{Marshal.FreeHGlobal(buffer);}}
     private static SafeFileHandle OpenAbsoluteDirectory(string path,bool allowWrite){uint access=LIST_DIRECTORY|READ_ATTRIBUTES|SYNC;if(allowWrite)access|=ADD_FILE|ADD_SUBDIRECTORY;SafeFileHandle handle=CreateFileW(path,access,SHARE_READ|SHARE_WRITE,IntPtr.Zero,OPEN_EXISTING,FLAG_BACKUP|FLAG_REPARSE,IntPtr.Zero);if(handle.IsInvalid)throw new Win32Exception(Marshal.GetLastWin32Error());return handle;}
     private static void ValidateCurrent(Pin pin){FILE_INFO info=Info(pin.Native);if(info.VolumeSerialNumber!=pin.Volume||(((ulong)info.FileIndexHigh<<32)|info.FileIndexLow)!=pin.Index||IsDirectory(info)!=pin.Directory||(info.FileAttributes&ATTR_REPARSE)!=0||!SamePath(FinalPath(pin.Native),pin.Path))throw new InvalidDataException("pin changed");if(!OnlyDefaultStream(pin.Native))throw new InvalidDataException("alternate stream");if(!pin.Directory&&info.NumberOfLinks!=1)throw new InvalidDataException("multi-link");}
     private static void ValidatePlain(FILE_INFO info,SafeFileHandle handle){if(IsDirectory(info))throw new InvalidDataException("file type");if((info.FileAttributes&ATTR_REPARSE)!=0)throw new InvalidDataException("reparse leaf");if(info.NumberOfLinks!=1)throw new InvalidDataException("multi-link");if(!OnlyDefaultStream(handle))throw new InvalidDataException("alternate stream");}
@@ -241,6 +246,7 @@ function Test-CcodInstallValue($Value,[int]$Depth=0) {
     return $false
 }
 function ConvertTo-CcodInstallJsonBytes($Value){if(-not(Test-CcodInstallValue $Value)){Throw-CcodInstallFileError 'CCOD_INSTALL_JSON_INVALID' 'Invalid install JSON value' $null};return ,([Text.UTF8Encoding]::new($false).GetBytes(($Value|ConvertTo-Json -Depth 32 -Compress)+"`n"))}
+function Get-CcodInstallBytesSha256([byte[]]$Bytes){$sha=[Security.Cryptography.SHA256]::Create();try{return [BitConverter]::ToString($sha.ComputeHash($Bytes)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()}}
 function Assert-CcodInstallRootScope($State,[string]$InstallRoot,[string]$ErrorId){if(-not[IO.Path]::IsPathRooted($InstallRoot)-or-not[String]::Equals([IO.Path]::GetFullPath($InstallRoot).TrimEnd('\'),$State.InstallRoot,[StringComparison]::OrdinalIgnoreCase)){Throw-CcodInstallFileError $ErrorId 'Install root does not match transaction scope' $InstallRoot}}
 
 function Open-CcodInstallGeneration {
@@ -251,10 +257,10 @@ function Open-CcodInstallGeneration {
     $runtime=$arguments[2];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$RuntimeId;RootToken=$token;Closed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token});$transaction
 }
 function New-CcodInstallGenerationLeaf { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$Leaf) Assert-CcodInstallLeaf $Leaf;$scope=Get-CcodInstallTransaction $Generation;$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CreateDirectory @($scope.Record.Token,$Leaf)} 'CCOD_INSTALL_LEAF_CREATE_FAILED';Add-CcodInstallScope $scope.Record.Transaction $token }
-function Copy-CcodInstallSealedSource { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$SourcePath,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)][int64]$ExpectedLength,[Parameter(Mandatory)][string]$ExpectedSha256) Assert-CcodInstallLeaf $Leaf;if(-not[IO.Path]::IsPathRooted($SourcePath)-or$ExpectedLength-lt 0-or$ExpectedSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Invalid sealed source contract' $SourcePath};$scope=Get-CcodInstallTransaction $Generation;Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Copy @($scope.Record.Token,$Leaf,[IO.Path]::GetFullPath($SourcePath),$ExpectedLength,$ExpectedSha256)|Out-Null} 'CCOD_INSTALL_SOURCE_MISMATCH';[pscustomobject]@{Length=$ExpectedLength;Sha256=$ExpectedSha256} }
-function Write-CcodInstallGenerationManifest { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)]$Manifest) $scope=Get-CcodInstallTransaction $Generation;if($scope.Record.Token-ne$scope.State.RootToken){Throw-CcodInstallFileError 'CCOD_INSTALL_MANIFEST_SCOPE' 'Manifest must be written at the generation root' $null};$bytes=ConvertTo-CcodInstallJsonBytes $Manifest;$result=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Write @($scope.Record.Token,'manifest.json',$bytes,$true)} 'CCOD_INSTALL_MANIFEST_WRITE_FAILED';[pscustomobject]@{Length=[int64]$result[1];Sha256=[string]$result[2]} }
-function Commit-CcodInstallActivePointer { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][uint64]$ExpectedPreviousGeneration,[Parameter(Mandatory)][string]$NewRuntimeId,[Parameter(Mandatory)]$FileTransaction) Assert-CcodInstallLeaf $NewRuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';if($ExpectedPreviousGeneration-eq[uint64]::MaxValue){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW' 'Pointer generation cannot advance beyond UInt64.MaxValue' $ExpectedPreviousGeneration};$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$generation=[uint64]($ExpectedPreviousGeneration+1);$pointer=[ordered]@{schemaVersion=1;generation=$generation;activeRuntime=$NewRuntimeId;previousGeneration=$ExpectedPreviousGeneration};$bytes=ConvertTo-CcodInstallJsonBytes $pointer;try{Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CommitPointer @($scope.Record.Token,$ExpectedPreviousGeneration,$NewRuntimeId,$bytes)|Out-Null} 'CCOD_INSTALL_POINTER_COMMIT_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' 'Pointer generation already exists' $generation};throw};[pscustomobject]@{Generation=$generation;RuntimeId=$NewRuntimeId} }
-function Retire-CcodInstallGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)]$FileTransaction) Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID' -AllowRetired;Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';if($RuntimeId-cne$scope.State.RuntimeId-or$scope.Record.Token-ne$scope.State.RootToken){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' 'Generation is not owned by this transaction' $RuntimeId};if($scope.State.Retired){return $scope.State.RetirementResult};$recordLeaf=$RuntimeId+'.json';$record=ConvertTo-CcodInstallJsonBytes ([ordered]@{schemaVersion=1;runtimeId=$RuntimeId;state='Retired'});try{$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Retire @($scope.Record.Token,$RuntimeId,$recordLeaf,$record)} 'CCOD_INSTALL_RETIREMENT_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETIREMENT_RECORD_EXISTS' 'Retirement record already exists' $recordLeaf};throw};$capability=Add-CcodInstallScope $scope.Record.Transaction $token;$result=[pscustomobject]@{Disposition='Retired';Capability=$capability};$scope.State.RetirementResult=$result;$scope.State.Retired=$true;return $result }
+function Copy-CcodInstallSealedSource { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$SourcePath,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)][int64]$ExpectedLength,[Parameter(Mandatory)][string]$ExpectedSha256) Assert-CcodInstallLeaf $Leaf;if(-not[IO.Path]::IsPathRooted($SourcePath)-or$ExpectedLength-lt 0-or$ExpectedSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Invalid sealed source contract' $SourcePath};$scope=Get-CcodInstallTransaction $Generation;$result=[pscustomobject]@{Length=$ExpectedLength;Sha256=$ExpectedSha256};Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Copy @($scope.Record.Token,$Leaf,[IO.Path]::GetFullPath($SourcePath),$ExpectedLength,$ExpectedSha256)|Out-Null} 'CCOD_INSTALL_SOURCE_MISMATCH';return $result }
+function Write-CcodInstallGenerationManifest { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)]$Manifest) $scope=Get-CcodInstallTransaction $Generation;if($scope.Record.Token-ne$scope.State.RootToken){Throw-CcodInstallFileError 'CCOD_INSTALL_MANIFEST_SCOPE' 'Manifest must be written at the generation root' $null};$bytes=ConvertTo-CcodInstallJsonBytes $Manifest;$result=[pscustomobject]@{Length=[int64]$bytes.LongLength;Sha256=(Get-CcodInstallBytesSha256 $bytes)};Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Write @($scope.Record.Token,'manifest.json',$bytes,$true)|Out-Null} 'CCOD_INSTALL_MANIFEST_WRITE_FAILED';return $result }
+function Commit-CcodInstallActivePointer { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][uint64]$ExpectedPreviousGeneration,[Parameter(Mandatory)][string]$NewRuntimeId,[Parameter(Mandatory)]$FileTransaction) Assert-CcodInstallLeaf $NewRuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';if($ExpectedPreviousGeneration-eq[uint64]::MaxValue){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW' 'Pointer generation cannot advance beyond UInt64.MaxValue' $ExpectedPreviousGeneration};$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$generation=[uint64]($ExpectedPreviousGeneration+1);$pointer=[ordered]@{schemaVersion=1;generation=$generation;activeRuntime=$NewRuntimeId;previousGeneration=$ExpectedPreviousGeneration};$bytes=ConvertTo-CcodInstallJsonBytes $pointer;$result=[pscustomobject]@{Generation=$generation;RuntimeId=$NewRuntimeId};try{Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CommitPointer @($scope.Record.Token,$ExpectedPreviousGeneration,$NewRuntimeId,$bytes)|Out-Null} 'CCOD_INSTALL_POINTER_COMMIT_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' 'Pointer generation already exists' $generation};throw};return $result }
+function Retire-CcodInstallGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)]$FileTransaction) Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID' -AllowRetired;Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';if($RuntimeId-cne$scope.State.RuntimeId-or$scope.Record.Token-ne$scope.State.RootToken){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' 'Generation is not owned by this transaction' $RuntimeId};if($scope.State.Retired){return $scope.State.RetirementResult};$recordLeaf=$RuntimeId+'.json';$record=ConvertTo-CcodInstallJsonBytes ([ordered]@{schemaVersion=1;runtimeId=$RuntimeId;state='Retired'});$capability=Add-CcodInstallScope $scope.Record.Transaction $scope.State.RootToken;$result=[pscustomobject]@{Disposition='Retired';Capability=$capability};try{Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Retire @($scope.Record.Token,$RuntimeId,$recordLeaf,$record)|Out-Null} 'CCOD_INSTALL_RETIREMENT_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETIREMENT_RECORD_EXISTS' 'Retirement record already exists' $recordLeaf};throw};$scope.State.RetirementResult=$result;$scope.State.Retired=$true;return $result }
 function Close-CcodInstallFileTransaction { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][ValidateSet('Ready','Failed')][string]$Disposition) $state=$null;if($null-eq$Transaction-or-not$script:CcodTransactions.TryGetValue($Transaction,[ref]$state)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Invalid install file transaction capability' $null};if(-not$state.Closed){Invoke-CcodRuntimeMethod $state.Runtime Close @()|Out-Null;$state.Closed=$true;$state.Disposition=$Disposition} }
 
 Initialize-CcodInstallRuntime
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index b10fc5e..e729282 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -34,6 +34,10 @@ public sealed class CcodInstallHandoffAttack : IDisposable
 
 public static class CcodInstallFileRaceProbe
 {
+    public static Task<byte[]> ObserveFirstVisibleBytes(string path)
+    {
+        return Task.Run(() => {DateTime deadline=DateTime.UtcNow.AddSeconds(15);while(DateTime.UtcNow<deadline){try{using(FileStream stream=new FileStream(path,FileMode.Open,FileAccess.Read,FileShare.ReadWrite|FileShare.Delete)){byte[] bytes=new byte[stream.Length];int offset=0;while(offset<bytes.Length){int read=stream.Read(bytes,offset,bytes.Length-offset);if(read==0)break;offset+=read;}return bytes;}}catch(FileNotFoundException){}catch(DirectoryNotFoundException){}catch(IOException){}Thread.Yield();}throw new TimeoutException("final leaf never became visible");});
+    }
     public static string RaceCreateAndClose(object runtime,object token,string leaf)
     {
         Type type=runtime.GetType();MethodInfo create=type.GetMethod("CreateDirectory",BindingFlags.Instance|BindingFlags.NonPublic);MethodInfo close=type.GetMethod("Close",BindingFlags.Instance|BindingFlags.NonPublic);Barrier barrier=new Barrier(2);string createResult=null,closeResult=null;
@@ -159,6 +163,34 @@ Invoke-CcodTest 'destination collisions preserve the first object byte-for-byte'
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
 
+Invoke-CcodTest 'requested final leaf is absent until private temporary bytes are sealed' {
+    $fixture=New-CcodInstallFileFixture
+    try {
+        $runtimeId='runtime-private-until-sealed';$source=New-CcodSourceFile $fixture 'large-source.bin' ('private-source-block-'*1048576);$generation=Open-CcodFixtureGeneration $fixture $runtimeId;$final=Join-Path $fixture.Install "runtime\$runtimeId\payload.bin"
+        $observer=[CcodInstallFileRaceProbe]::ObserveFirstVisibleBytes($final)
+        Copy-CcodInstallSealedSource -Generation $generation -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null
+        $firstVisible=$observer.GetAwaiter().GetResult()
+        Assert-CcodEqual $source.Length ([int64]$firstVisible.LongLength) 'first observable final leaf already has the sealed length'
+        $observedPath=Join-Path $fixture.Base 'observed.bin';[IO.File]::WriteAllBytes($observedPath,$firstVisible)
+        Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 $observedPath) 'first observable final leaf already has the sealed digest'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Split-Path $final -Parent) -File -Filter '.ccod.*.tmp').Count 'successful publication leaves no private temporary name'
+    } finally {Remove-CcodInstallFileFixture $fixture}
+}
+
+Invoke-CcodTest 'early source verification failure publishes no final leaf and close releases every stream' {
+    $fixture=New-CcodInstallFileFixture
+    try {
+        $runtimeId='runtime-early-copy-failure';$source=New-CcodSourceFile $fixture 'bad-source.bin' 'source-owned-before-hash';$generation=Open-CcodFixtureGeneration $fixture $runtimeId;$wrong=('0'*64)
+        if($wrong-ceq$source.Sha256){$wrong='1'*64}
+        Assert-CcodThrows {Copy-CcodInstallSealedSource -Generation $generation -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $wrong|Out-Null} 'CCOD_INSTALL_SOURCE_MISMATCH'
+        $generationPath=Join-Path $fixture.Install "runtime\$runtimeId";Assert-CcodTrue (-not[IO.File]::Exists((Join-Path $generationPath 'payload.bin'))) 'source verification failure publishes no requested final leaf'
+        Assert-CcodEqual 'blocked' (Invoke-CcodMoveAttempt $source.Path) 'early source stream is transaction-owned until close'
+        Close-CcodInstallFileTransaction -Transaction $generation -Disposition Failed|Out-Null
+        Assert-CcodEqual 'moved' (Invoke-CcodMoveAttempt $source.Path) 'Failed close releases the early source stream'
+        $temporaries=@(Get-ChildItem -LiteralPath $generationPath -File -Filter '.ccod.*.tmp');foreach($temporary in $temporaries){Assert-CcodEqual 'moved' (Invoke-CcodMoveAttempt $temporary.FullName) 'Failed close releases every private temporary handle'}
+    } finally {Remove-CcodInstallFileFixture $fixture}
+}
+
 Invoke-CcodTest 'source and destination handles remain private pinned and same-handle verified' {
     $fixture=New-CcodInstallFileFixture
     try {
@@ -168,12 +200,7 @@ Invoke-CcodTest 'source and destination handles remain private pinned and same-h
         try{$copy=Copy-CcodInstallSealedSource -Generation $generation -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256}catch{$copyFailure=$_}
         $attackOutcome=$attack.Stop();$attack.Dispose()
         Assert-CcodTrue ($attackOutcome-in@('blocked','exchanged')) 'handoff attacker completes with a bounded result'
-        if($null-ne$copyFailure){
-            Assert-CcodTrue ($null-ne$copyFailure-and$copyFailure.FullyQualifiedErrorId-match'^CCOD_INSTALL_(?:PIN_CHANGED|SEAL_MISMATCH)') 'an exchange during handoff cannot become an accepted sealed generation'
-            Write-CcodInstallGenerationManifest -Generation $generation -Manifest (New-CcodGenerationManifest $runtimeId)|Out-Null
-            Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -ExpectedPreviousGeneration ([uint64]0) -NewRuntimeId $runtimeId -FileTransaction $generation|Out-Null} 'CCOD_INSTALL_UNKNOWN_LEAF'
-            return
-        }
+        Assert-CcodTrue ($null-eq$copyFailure) "final-name attacker cannot cause a post-commit failure error=$($copyFailure.FullyQualifiedErrorId)"
         Assert-CcodEqual $source.Length $copy.Length 'copy returns verified length';Assert-CcodEqual $source.Sha256 $copy.Sha256 'copy returns verified digest'
         Assert-CcodEqual 'blocked' (Invoke-CcodMoveAttempt $source.Path) 'source replacement is blocked after its handle opens'
         $currentModule = Get-Module InstallFileTransaction
@@ -189,15 +216,21 @@ Invoke-CcodTest 'source and destination handles remain private pinned and same-h
             }
             $pinType = $pin.GetType()
             $stream = $pinType.GetField('Stream',$flags).GetValue($pin)
-            return [pscustomobject]@{CanWrite=$stream.CanWrite;Length=[int64]($pinType.GetField('SealedLength',$flags).GetValue($pin));Sha256=[string]($pinType.GetField('SealedSha',$flags).GetValue($pin))}
+            return [pscustomobject]@{StreamOpen=($null-ne$stream);Length=[int64]($pinType.GetField('SealedLength',$flags).GetValue($pin));Sha256=[string]($pinType.GetField('SealedSha',$flags).GetValue($pin));Published=[bool]($pinType.GetField('Published',$flags).GetValue($pin))}
         } $generation
-        Assert-CcodTrue (-not $sealedPin.CanWrite) 'handoff ends on a strict read-only private handle'
+        Assert-CcodTrue $sealedPin.Published 'handoff marks the pin published only after final rename'
+        Assert-CcodTrue (-not $sealedPin.StreamOpen) 'post-commit path performs no potentially failing stream handoff'
         Assert-CcodEqual $source.Length $sealedPin.Length 'strict handoff pin retains the same-handle verified length'
         Assert-CcodEqual $source.Sha256 $sealedPin.Sha256 'strict handoff pin retains the same-handle verified digest'
-        Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 $destination) 'successful sealed leaf is readable by path before transaction close'
-        try {[IO.File]::WriteAllText($destination,'attacker');throw 'ASSERT_DESTINATION_MUTABLE'} catch [IO.IOException] {}
-        Assert-CcodEqual 'blocked' (Invoke-CcodMoveAttempt $destination) 'destination name exchange remains blocked after sealing'
-        Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 $destination) 'destination handle blocks mutation after verification'
+        $visibleSha=Get-CcodTestFileSha256 $destination
+        if($visibleSha-cne$source.Sha256){
+            Write-CcodInstallGenerationManifest -Generation $generation -Manifest (New-CcodGenerationManifest $runtimeId)|Out-Null
+            try{Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -ExpectedPreviousGeneration ([uint64]0) -NewRuntimeId $runtimeId -FileTransaction $generation|Out-Null;throw 'ASSERT_ATTACKED_GENERATION_COMMITTED'}catch{Assert-CcodTrue ($_.FullyQualifiedErrorId-match'^CCOD_INSTALL_(?:PIN_CHANGED|SEAL_MISMATCH|UNKNOWN_LEAF)') 'post-commit same-user mutation cannot become an eligible generation'}
+            return
+        }
+        Assert-CcodEqual $source.Sha256 $visibleSha 'successful sealed leaf is readable by path before transaction close'
+        try {[IO.File]::WriteAllText($destination,'attacker');throw 'ASSERT_DESTINATION_MUTABLE'} catch [IO.IOException] {} catch [UnauthorizedAccessException] {}
+        Assert-CcodEqual $source.Sha256 (Get-CcodTestFileSha256 $destination) 'published destination protection preserves verified bytes'
         Assert-CcodOutsideUnchanged $fixture 'pinned copy'
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
@@ -209,7 +242,7 @@ Invoke-CcodTest 'manifest is create-only pinned and immutable after its same-han
         Assert-CcodTrue ($result.Length-gt 0) 'manifest returns verified length';Assert-CcodTrue ($result.Sha256-cmatch'^[0-9a-f]{64}$') 'manifest returns lowercase digest'
         $path=Join-Path $fixture.Install "runtime\$runtimeId\manifest.json";$before=Get-CcodTestFileSha256 $path
         Assert-CcodThrows {Write-CcodInstallGenerationManifest -Generation $generation -Manifest (New-CcodGenerationManifest $runtimeId)|Out-Null} 'CCOD_INSTALL_LEAF_EXISTS'
-        try {[IO.File]::WriteAllText($path,'{"attacker":true}');throw 'ASSERT_MANIFEST_MUTABLE'} catch [IO.IOException] {}
+        try {[IO.File]::WriteAllText($path,'{"attacker":true}');throw 'ASSERT_MANIFEST_MUTABLE'} catch [IO.IOException] {} catch [UnauthorizedAccessException] {}
         Assert-CcodEqual $before (Get-CcodTestFileSha256 $path) 'manifest mutation changes no bytes';Assert-CcodOutsideUnchanged $fixture 'manifest immutability'
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
@@ -359,9 +392,9 @@ Invoke-CcodTest 'retirement collision and record I/O failure leave generation el
             if($case-ceq'collision'){
                 Assert-CcodEqual $recordSha (Get-CcodTestFileSha256 $record) 'retirement collision preserves the existing record'
                 $temporary=@(Get-ChildItem -LiteralPath $records -File -Filter '.ccod.*.tmp');Assert-CcodEqual 1 $temporary.Count 'failed no-replace retirement deliberately retains one diagnostic temporary record'
-                Assert-CcodEqual 'blocked' (Invoke-CcodMoveAttempt $temporary[0].FullName) 'diagnostic temporary handle remains pinned until transaction close'
+                Assert-CcodEqual 'moved' (Invoke-CcodMoveAttempt $temporary[0].FullName) 'failed no-replace rename leaves no temporary stream locked'
                 Close-CcodInstallFileTransaction -Transaction $generation -Disposition Failed|Out-Null
-                Assert-CcodEqual 'moved' (Invoke-CcodMoveAttempt $temporary[0].FullName) 'Failed disposition releases the retained temporary record handle'
+                [IO.File]::SetAttributes($temporary[0].FullName+'.moved',[IO.FileAttributes]::Normal);[IO.File]::Delete($temporary[0].FullName+'.moved');Assert-CcodTrue (-not[IO.File]::Exists($temporary[0].FullName+'.moved')) 'Failed disposition leaves the released diagnostic temporary removable'
             }
         } finally {Remove-CcodInstallFileFixture $fixture}
     }

From f86d4397b4a56343db9124f655c923949e6084c0 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sat, 29 Aug 2026 20:59:38 +0800
Subject: [PATCH 075/187] fix: finalize retirement and close cleanup

---
 .../modules/InstallFileTransaction.psm1       | 16 ++++++----
 .../InstallFileTransaction.SelfTest.ps1       | 31 +++++++++++++++++++
 2 files changed, 41 insertions(+), 6 deletions(-)

diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index 8471d8b..19046da 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -68,7 +68,7 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
         internal Pin(Pin parent,string leaf,string path,bool directory,bool owned,SafeFileHandle handle,FileStream stream,FILE_INFO info)
         { Parent=parent;Leaf=leaf;Path=path;Directory=directory;Owned=owned;Handle=handle;Stream=stream;Volume=info.VolumeSerialNumber;Index=((ulong)info.FileIndexHigh<<32)|info.FileIndexLow; }
         internal SafeFileHandle Native { get { return Stream != null ? Stream.SafeFileHandle : Handle; } }
-        public void Dispose() { if(Closed)return;Closed=true;if(Stream!=null)Stream.Dispose();else if(Handle!=null)Handle.Dispose(); }
+        public void Dispose() { if(Closed)return;if(Stream!=null)Stream.Dispose();else if(Handle!=null)Handle.Dispose();Closed=true; }
     }
 
     private sealed class ReferenceComparer : IEqualityComparer<object>
@@ -79,7 +79,7 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
     private readonly Dictionary<object,Pin> pins = new Dictionary<object,Pin>(ReferenceComparer.Instance);
     private readonly Dictionary<string,Pin> names = new Dictionary<string,Pin>(StringComparer.OrdinalIgnoreCase);
     private readonly List<FileStream> externalStreams = new List<FileStream>();
-    private bool disposed;
+    private bool disposed; private string cleanupError;
 
     private CcodInstallGenerationRuntimeV2(string installRoot,Pin root,Pin runtimeParent)
     { this.installRoot=installRoot;this.root=root;this.runtimeParent=runtimeParent;AddPin(root);AddPin(runtimeParent); }
@@ -145,11 +145,15 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
     [MethodImpl(MethodImplOptions.Synchronized)] internal object Retire(object generationToken,string runtimeId,string recordLeaf,byte[] record)
     {
         Pin generation=Require(generationToken,true);ValidateCurrent(generation);if(!Object.ReferenceEquals(generation.Parent,runtimeParent)||!String.Equals(generation.Leaf,runtimeId,StringComparison.Ordinal)||!generation.Owned)throw new InvalidDataException("generation not owned");
-        ValidateOwnedTree(generation);Pin state=OpenOrCreateDirectory(root,"state"),retirements=OpenOrCreateDirectory(state,"retired-generations");Write(retirements.Token,recordLeaf,record,false);ValidateCurrent(generation);return generation.Token;
+        ValidateOwnedTree(generation);Pin state=OpenOrCreateDirectory(root,"state"),retirements=OpenOrCreateDirectory(state,"retired-generations");Write(retirements.Token,recordLeaf,record,false);return generation.Token;
     }
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal void Close()
-    { if(disposed)return;disposed=true;foreach(FileStream stream in externalStreams)stream.Dispose();externalStreams.Clear();List<Pin> all=new List<Pin>(pins.Values);for(int i=all.Count-1;i>=0;i--)all[i].Dispose();pins.Clear();names.Clear(); }
+    {
+        disposed=true;Exception first=null;List<FileStream> failedStreams=new List<FileStream>();foreach(FileStream stream in new List<FileStream>(externalStreams)){try{stream.Dispose();}catch(Exception exception){failedStreams.Add(stream);if(first==null)first=exception;}}externalStreams.Clear();externalStreams.AddRange(failedStreams);
+        List<Pin> all=new List<Pin>(pins.Values);for(int i=all.Count-1;i>=0;i--){Pin pin=all[i];try{pin.Dispose();}catch(Exception exception){if(first==null)first=exception;}if(pin.Closed)pins.Remove(pin.Token);}if(pins.Count==0)names.Clear();
+        if(first!=null){cleanupError="registered resource cleanup failed";throw new InvalidOperationException(cleanupError);}cleanupError=null;
+    }
     public void Dispose(){Close();}
 
     private Pin OpenOrCreateDirectory(Pin parent,string leaf)
@@ -254,14 +258,14 @@ function Open-CcodInstallGeneration {
     Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID'
     $arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$RuntimeId,$null)
     try{$token=Invoke-CcodRuntimeStatic Open $arguments}catch [ComponentModel.Win32Exception]{if($_.Exception.NativeErrorCode-in@(32,80,183)){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_EXISTS' 'Install generation already exists' $RuntimeId};throw}
-    $runtime=$arguments[2];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$RuntimeId;RootToken=$token;Closed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token});$transaction
+    $runtime=$arguments[2];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$RuntimeId;RootToken=$token;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token});$transaction
 }
 function New-CcodInstallGenerationLeaf { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$Leaf) Assert-CcodInstallLeaf $Leaf;$scope=Get-CcodInstallTransaction $Generation;$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CreateDirectory @($scope.Record.Token,$Leaf)} 'CCOD_INSTALL_LEAF_CREATE_FAILED';Add-CcodInstallScope $scope.Record.Transaction $token }
 function Copy-CcodInstallSealedSource { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$SourcePath,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)][int64]$ExpectedLength,[Parameter(Mandatory)][string]$ExpectedSha256) Assert-CcodInstallLeaf $Leaf;if(-not[IO.Path]::IsPathRooted($SourcePath)-or$ExpectedLength-lt 0-or$ExpectedSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Invalid sealed source contract' $SourcePath};$scope=Get-CcodInstallTransaction $Generation;$result=[pscustomobject]@{Length=$ExpectedLength;Sha256=$ExpectedSha256};Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Copy @($scope.Record.Token,$Leaf,[IO.Path]::GetFullPath($SourcePath),$ExpectedLength,$ExpectedSha256)|Out-Null} 'CCOD_INSTALL_SOURCE_MISMATCH';return $result }
 function Write-CcodInstallGenerationManifest { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)]$Manifest) $scope=Get-CcodInstallTransaction $Generation;if($scope.Record.Token-ne$scope.State.RootToken){Throw-CcodInstallFileError 'CCOD_INSTALL_MANIFEST_SCOPE' 'Manifest must be written at the generation root' $null};$bytes=ConvertTo-CcodInstallJsonBytes $Manifest;$result=[pscustomobject]@{Length=[int64]$bytes.LongLength;Sha256=(Get-CcodInstallBytesSha256 $bytes)};Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Write @($scope.Record.Token,'manifest.json',$bytes,$true)|Out-Null} 'CCOD_INSTALL_MANIFEST_WRITE_FAILED';return $result }
 function Commit-CcodInstallActivePointer { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][uint64]$ExpectedPreviousGeneration,[Parameter(Mandatory)][string]$NewRuntimeId,[Parameter(Mandatory)]$FileTransaction) Assert-CcodInstallLeaf $NewRuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';if($ExpectedPreviousGeneration-eq[uint64]::MaxValue){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW' 'Pointer generation cannot advance beyond UInt64.MaxValue' $ExpectedPreviousGeneration};$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$generation=[uint64]($ExpectedPreviousGeneration+1);$pointer=[ordered]@{schemaVersion=1;generation=$generation;activeRuntime=$NewRuntimeId;previousGeneration=$ExpectedPreviousGeneration};$bytes=ConvertTo-CcodInstallJsonBytes $pointer;$result=[pscustomobject]@{Generation=$generation;RuntimeId=$NewRuntimeId};try{Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CommitPointer @($scope.Record.Token,$ExpectedPreviousGeneration,$NewRuntimeId,$bytes)|Out-Null} 'CCOD_INSTALL_POINTER_COMMIT_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' 'Pointer generation already exists' $generation};throw};return $result }
 function Retire-CcodInstallGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)]$FileTransaction) Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID' -AllowRetired;Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';if($RuntimeId-cne$scope.State.RuntimeId-or$scope.Record.Token-ne$scope.State.RootToken){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' 'Generation is not owned by this transaction' $RuntimeId};if($scope.State.Retired){return $scope.State.RetirementResult};$recordLeaf=$RuntimeId+'.json';$record=ConvertTo-CcodInstallJsonBytes ([ordered]@{schemaVersion=1;runtimeId=$RuntimeId;state='Retired'});$capability=Add-CcodInstallScope $scope.Record.Transaction $scope.State.RootToken;$result=[pscustomobject]@{Disposition='Retired';Capability=$capability};try{Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Retire @($scope.Record.Token,$RuntimeId,$recordLeaf,$record)|Out-Null} 'CCOD_INSTALL_RETIREMENT_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETIREMENT_RECORD_EXISTS' 'Retirement record already exists' $recordLeaf};throw};$scope.State.RetirementResult=$result;$scope.State.Retired=$true;return $result }
-function Close-CcodInstallFileTransaction { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][ValidateSet('Ready','Failed')][string]$Disposition) $state=$null;if($null-eq$Transaction-or-not$script:CcodTransactions.TryGetValue($Transaction,[ref]$state)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Invalid install file transaction capability' $null};if(-not$state.Closed){Invoke-CcodRuntimeMethod $state.Runtime Close @()|Out-Null;$state.Closed=$true;$state.Disposition=$Disposition} }
+function Close-CcodInstallFileTransaction { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][ValidateSet('Ready','Failed')][string]$Disposition) $state=$null;if($null-eq$Transaction-or-not$script:CcodTransactions.TryGetValue($Transaction,[ref]$state)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Invalid install file transaction capability' $null};if($state.Closed-and-not$state.CleanupFailed){return};try{Invoke-CcodRuntimeMethod $state.Runtime Close @()|Out-Null;$state.CleanupFailed=$false}catch{$state.CleanupFailed=$true;$state.Closed=$true;$state.Disposition=$Disposition;Throw-CcodInstallFileError 'CCOD_INSTALL_CLOSE_FAILED' 'Install file transaction cleanup failed; registered failures are retained for retry' $null};$state.Closed=$true;$state.Disposition=$Disposition }
 
 Initialize-CcodInstallRuntime
 Export-ModuleMember -Function Open-CcodInstallGeneration,New-CcodInstallGenerationLeaf,Copy-CcodInstallSealedSource,Write-CcodInstallGenerationManifest,Commit-CcodInstallActivePointer,Retire-CcodInstallGeneration,Close-CcodInstallFileTransaction
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index e729282..a8a9194 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -46,6 +46,20 @@ public static class CcodInstallFileRaceProbe
         Task.WaitAll(first,second);barrier.Dispose();return createResult+"|"+closeResult;
     }
 }
+
+public sealed class CcodThrowingFileStream : FileStream
+{
+    private static int attempts;
+    public static int Attempts { get { return Volatile.Read(ref attempts); } }
+    public static void Reset(){Volatile.Write(ref attempts,0);}
+    public CcodThrowingFileStream(string path) : base(path,FileMode.CreateNew,FileAccess.ReadWrite,FileShare.Read) { }
+    protected override void Dispose(bool disposing)
+    {
+        if(!disposing){base.Dispose(false);return;}
+        Interlocked.Increment(ref attempts);
+        try{base.Dispose(true);}finally{throw new IOException("test dispose failure");}
+    }
+}
 '@
 }
 
@@ -296,6 +310,23 @@ Invoke-CcodTest 'close serializes native handle release against later relative o
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
 
+Invoke-CcodTest 'close retries a failing disposal and releases every other registered resource' {
+    $fixture=New-CcodInstallFileFixture
+    try {
+        $runtimeId='runtime-close-dispose-failure';$source=New-CcodSourceFile $fixture 'close-failure-source.bin' 'close-failure-source';$generation=Open-CcodFixtureGeneration $fixture $runtimeId;Copy-CcodInstallSealedSource -Generation $generation -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null
+        $throwPath=Join-Path $fixture.Outside 'throwing-stream.bin';[CcodThrowingFileStream]::Reset();$throwing=[CcodThrowingFileStream]::new($throwPath)
+        $currentModule=Get-Module InstallFileTransaction
+        & $currentModule {param($Generation,$Throwing)$scope=Get-CcodInstallTransaction $Generation;$streams=$scope.State.Runtime.GetType().GetField('externalStreams',[Reflection.BindingFlags]'NonPublic,Instance').GetValue($scope.State.Runtime);$streams.Insert(0,$Throwing)} $generation $throwing
+        Assert-CcodThrows {Close-CcodInstallFileTransaction -Transaction $generation -Disposition Failed|Out-Null} 'CCOD_INSTALL_CLOSE_FAILED'
+        Assert-CcodEqual 1 ([CcodThrowingFileStream]::Attempts) 'first close attempts the injected failing resource once'
+        Assert-CcodEqual 'moved' (Invoke-CcodMoveAttempt $source.Path) 'first close continues past the injected failure and releases the source stream'
+        $live=Join-Path $fixture.Install "runtime\$runtimeId";$moved=$live+'.moved';[IO.Directory]::Move($live,$moved);Assert-CcodTrue ([IO.Directory]::Exists($moved)) 'first close continues past the injected failure and releases every generation pin'
+        Assert-CcodThrows {Close-CcodInstallFileTransaction -Transaction $generation -Disposition Failed|Out-Null} 'CCOD_INSTALL_CLOSE_FAILED'
+        Assert-CcodEqual 2 ([CcodThrowingFileStream]::Attempts) 'second close retries the retained failing resource instead of short-circuiting'
+        Assert-CcodOutsideUnchanged $fixture 'exception-safe close'
+    } finally {Remove-CcodInstallFileFixture $fixture}
+}
+
 Invoke-CcodTest 'pointer generation records are monotonic create-only and collision safe' {
     $fixture=New-CcodInstallFileFixture
     try {

From 5cb83a77ac24d823968c26a1be36e508008fe22e Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sat, 29 Aug 2026 21:23:21 +0800
Subject: [PATCH 076/187] docs: allow retained generation compensation

---
 .../plans/2026-08-29-v2522-immutable-generation.md  | 13 ++++++++++---
 .../2026-08-29-v2522-immutable-generation-design.md | 11 +++++++++--
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/docs/superpowers/plans/2026-08-29-v2522-immutable-generation.md b/docs/superpowers/plans/2026-08-29-v2522-immutable-generation.md
index 2315354..ff490be 100644
--- a/docs/superpowers/plans/2026-08-29-v2522-immutable-generation.md
+++ b/docs/superpowers/plans/2026-08-29-v2522-immutable-generation.md
@@ -63,10 +63,13 @@ create-only operations:
 
 ```powershell
 Open-CcodInstallGeneration -InstallRoot <absolute-root> -RuntimeId <unique-id>
+Open-CcodInstallRetainedGeneration -InstallRoot <absolute-root> -RuntimeId <existing-id> -ExpectedManifestSha256 <hex>
+New-CcodInstallDirectory -Transaction <opaque-context> -Parent <opaque-directory> -Leaf <single-segment> [-CreateIfMissing]
 New-CcodInstallGenerationLeaf -Generation <opaque-generation> -Leaf <single-segment>
 Copy-CcodInstallSealedSource -Generation <opaque-generation> -SourcePath <sealed-source> -Leaf <single-segment> -ExpectedLength <int64> -ExpectedSha256 <lowercase-hex>
 Write-CcodInstallGenerationManifest -Generation <opaque-generation> -Manifest <object>
-Commit-CcodInstallActivePointer -InstallRoot <absolute-root> -ExpectedPreviousGeneration <uint64> -NewRuntimeId <unique-id> -FileTransaction <opaque-context>
+Write-CcodInstallRecord -Transaction <opaque-context> -Parent <opaque-directory> -Leaf <single-segment> -Record <object>
+Commit-CcodInstallActivePointer -InstallRoot <absolute-root> -TargetGeneration <opaque-generation> -ExpectedPreviousGeneration <uint64> -FileTransaction <opaque-context>
 Retire-CcodInstallGeneration -InstallRoot <absolute-root> -RuntimeId <owned-id> -FileTransaction <opaque-context>
 Close-CcodInstallFileTransaction -Transaction <opaque-context> -Disposition Ready|Failed
 ```
@@ -80,7 +83,10 @@ persistent DACL change and no nonempty recursive deletion operation.
 - [ ] **Step 1: Write failing immutable-generation tests**
 
 Add RED cases proving a duplicate generation ID, destination leaf, or pointer
-generation is rejected without changing the existing object. Add barriers for
+generation is rejected without changing the existing object. Add a read-only
+retained-generation fixture that can be selected by a compensating pointer but
+cannot create or mutate a leaf. Add a generic scoped-record fixture for state,
+receipt, and log files. Add barriers for
 source replacement after handle open, generation manifest mutation after
 write, invalid reparse/ADS/multilink entries, forged/cross-transaction
 capabilities, and native handle close during a relative operation. Add a
@@ -145,7 +151,8 @@ transaction. These private operations are added or adapted:
 New-CcodInstallTransactionRecord -TransactionId <guid> -OldRuntimeId <nullable> -OldGeneration <nullable-uint64> -NewRuntimeId <nullable> -NewGeneration <uint64> -SealedPackageSha256 <hex> -OwnedObjectNames <string[]>
 Read-CcodInstallTransactionRecord -InstallRoot <absolute-root>
 Set-CcodInstallTransactionPhase -InstallRoot <root> -TransactionId <guid> -ExpectedPhase <phase> -NewPhase <phase> -FileTransaction <context>
-Set-CcodActiveRuntime -InstallRoot <root> -NewRuntimeId <unique-id> -FileTransaction <context> -Ownership <fence>
+Open-CcodInstallRetainedGeneration -InstallRoot <root> -RuntimeId <existing-id> -ExpectedManifestSha256 <hex> -FileTransaction <context>
+Set-CcodActiveRuntime -InstallRoot <root> -TargetGeneration <opaque-generation> -FileTransaction <context> -Ownership <fence>
 Write-CcodActivationReceiptFile -InstallRoot <root> -Receipt <object> -FileTransaction <context>
 Invoke-CcodInstallCompensation -InstallRoot <root> -TransactionRecord <record> -FileTransaction <context> -Adapters <hashtable>
 ```
diff --git a/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md b/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
index 1ffeb23..d671916 100644
--- a/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
+++ b/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
@@ -34,8 +34,12 @@ control channel or change the authenticated TrayHost wire contract.
 
 - Every generation directory and file name is unique and create-only. No
   existing runtime or stable shell is overwritten during staging.
-- A generation becomes eligible only after every manifest-listed file is
+- A new generation becomes eligible only after every manifest-listed file is
   copied, flushed, and rehashed, and its runtime manifest/version/commit match.
+- A retained generation may be opened only read-only after its existing
+  manifest, runtime ID, and recorded generation identity are revalidated. It
+  can be selected by a higher compensating pointer but cannot receive new
+  files.
 - The only mutable install control record is a small atomic active-generation
   pointer. It includes a monotonically increasing generation number and the
   previous generation ID.
@@ -82,10 +86,13 @@ Required operations are create-only:
 
 ```powershell
 Open-CcodInstallGeneration -InstallRoot <absolute-root> -RuntimeId <unique-id>
+Open-CcodInstallRetainedGeneration -InstallRoot <absolute-root> -RuntimeId <existing-id> -ExpectedManifestSha256 <hex>
+New-CcodInstallDirectory -Transaction <opaque-context> -Parent <opaque-directory> -Leaf <single-segment> [-CreateIfMissing]
 New-CcodInstallGenerationLeaf -Generation <opaque-generation> -Leaf <single-segment>
 Copy-CcodInstallSealedSource -Generation <opaque-generation> -SourcePath <sealed-source> -Leaf <single-segment> -ExpectedLength <int64> -ExpectedSha256 <hex>
 Write-CcodInstallGenerationManifest -Generation <opaque-generation> -Manifest <object>
-Commit-CcodInstallActivePointer -InstallRoot <absolute-root> -ExpectedPreviousGeneration <uint64> -NewRuntimeId <unique-id> -FileTransaction <context>
+Write-CcodInstallRecord -Transaction <opaque-context> -Parent <opaque-directory> -Leaf <single-segment> -Record <object>
+Commit-CcodInstallActivePointer -InstallRoot <absolute-root> -ExpectedPreviousGeneration <uint64> -TargetGeneration <opaque-generation> -FileTransaction <context>
 Retire-CcodInstallGeneration -InstallRoot <absolute-root> -RuntimeId <owned-id> -FileTransaction <context>
 Close-CcodInstallFileTransaction -Transaction <opaque-context> -Disposition Ready|Failed
 ```

From c1e3ef08f0c820db79872f8438d66d1ced94eeba Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sat, 29 Aug 2026 21:46:23 +0800
Subject: [PATCH 077/187] feat: add retained generation file capabilities

---
 .../modules/InstallFileTransaction.psm1       | 60 ++++++++++---
 .../InstallFileTransaction.SelfTest.ps1       | 90 +++++++++++++++++--
 2 files changed, 130 insertions(+), 20 deletions(-)

diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index 19046da..1be356b 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -20,6 +20,7 @@ using System.Runtime.CompilerServices;
 using System.Runtime.InteropServices;
 using System.Security.Cryptography;
 using System.Text;
+using System.Text.RegularExpressions;
 using Microsoft.Win32.SafeHandles;
 
 public sealed class CcodInstallGenerationCapabilityMarkerV2
@@ -78,6 +79,7 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
     private readonly string installRoot; private readonly Pin root, runtimeParent;
     private readonly Dictionary<object,Pin> pins = new Dictionary<object,Pin>(ReferenceComparer.Instance);
     private readonly Dictionary<string,Pin> names = new Dictionary<string,Pin>(StringComparer.OrdinalIgnoreCase);
+    private readonly HashSet<object> retainedRoots = new HashSet<object>(ReferenceComparer.Instance);
     private readonly List<FileStream> externalStreams = new List<FileStream>();
     private bool disposed; private string cleanupError;
 
@@ -113,6 +115,28 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
         finally { if(result.Handle!=null)result.Handle.Dispose(); }
     }
 
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object OpenDirectory(object parentToken,string leaf,bool createIfMissing)
+    {
+        Pin parent=Require(parentToken,true);ValidateCurrent(parent);Pin known;if(names.TryGetValue(Key(parent,leaf),out known)){ValidateCurrent(known);return known.Token;}OpenResult result;
+        if(createIfMissing){try{result=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,CREATE,DIRECTORY|BACKUP_INTENT);}catch(Win32Exception exception){if(exception.NativeErrorCode!=80&&exception.NativeErrorCode!=183)throw;result=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);}}
+        else result=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);
+        try{Pin pin=ValidateDirectoryPin(parent,leaf,Path.Combine(parent.Path,leaf),result.Created,result.Handle);result.Handle=null;AddPin(pin);return pin.Token;}finally{if(result.Handle!=null)result.Handle.Dispose();}
+    }
+
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object GetInstallRoot(){if(disposed)throw new ObjectDisposedException("transaction");ValidateCurrent(root);return root.Token;}
+
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object OpenRetained(string runtimeId,string expectedManifestSha)
+    {
+        if(disposed)throw new ObjectDisposedException("transaction");Pin existing;if(names.TryGetValue(Key(runtimeParent,runtimeId),out existing)){if(!retainedRoots.Contains(existing.Token))throw new InvalidDataException("retained generation already scoped");ValidateRetainedTree(existing);ValidateRetainedManifest(existing,runtimeId,expectedManifestSha);return existing.Token;}OpenResult result=OpenRelative(runtimeParent.Native,runtimeId,LIST_DIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);List<Pin> added=new List<Pin>();
+        try
+        {
+            Pin candidate=ValidateDirectoryPin(runtimeParent,runtimeId,Path.Combine(runtimeParent.Path,runtimeId),false,result.Handle);result.Handle=null;Pin generation;if(names.TryGetValue(Key(runtimeParent,runtimeId),out generation)){candidate.Dispose();}else{generation=candidate;AddPin(generation);added.Add(generation);}OpenRetainedTree(generation,added);
+            ValidateRetainedManifest(generation,runtimeId,expectedManifestSha);ValidateRetainedTree(generation);retainedRoots.Add(generation.Token);return generation.Token;
+        }
+        catch(Exception exception){for(int i=added.Count-1;i>=0;i--){Pin pin=added[i];if(pin.Parent!=null)names.Remove(Key(pin.Parent,pin.Leaf));pins.Remove(pin.Token);try{pin.Dispose();}catch{}}throw new InvalidDataException("retained open failed: "+exception.Message,exception);}
+        finally{if(result.Handle!=null)result.Handle.Dispose();}
+    }
+
     [MethodImpl(MethodImplOptions.Synchronized)] internal object Copy(object parentToken,string leaf,string source,long expectedLength,string expectedSha)
     {
         Pin parent=Require(parentToken,true);ValidateCurrent(parent);string full=Path.GetFullPath(source);
@@ -138,7 +162,7 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
     [MethodImpl(MethodImplOptions.Synchronized)] internal object CommitPointer(object generationToken,ulong previousGeneration,string runtimeId,byte[] bytes)
     {
         Pin generation=Require(generationToken,true);ValidateCurrent(generation);if(!Object.ReferenceEquals(generation.Parent,runtimeParent)||!String.Equals(generation.Leaf,runtimeId,StringComparison.Ordinal))throw new InvalidDataException("transaction scope");
-        Pin manifest=null;if(!names.TryGetValue(Key(generation,"manifest.json"),out manifest)||!manifest.Manifest||!manifest.Sealed)throw new InvalidDataException("manifest missing");EnsurePublishedPin(manifest);ValidateOwnedTree(generation);
+        if(retainedRoots.Contains(generationToken))ValidateRetainedTree(generation);else{Pin manifest=null;if(!names.TryGetValue(Key(generation,"manifest.json"),out manifest)||!manifest.Manifest||!manifest.Sealed)throw new InvalidDataException("manifest missing");EnsurePublishedPin(manifest);ValidateOwnedTree(generation);}
         if(previousGeneration==UInt64.MaxValue)throw new OverflowException("pointer generation overflow");Pin state=OpenOrCreateDirectory(root,"state"),pointer=OpenOrCreateDirectory(state,"active-generation");if(CurrentPointerGeneration(pointer)!=previousGeneration)throw new InvalidOperationException("pointer generation exists");string leaf=(previousGeneration+1).ToString("D20")+".json";return Write(pointer.Token,leaf,bytes,false);
     }
 
@@ -170,6 +194,15 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
     {
         ValidateCurrent(directory);foreach(string leaf in Enumerate(directory.Native)){Pin child;if(!names.TryGetValue(Key(directory,leaf),out child)||!child.Owned)throw new InvalidDataException("unknown leaf");if(child.Directory){ValidateCurrent(child);ValidateOwnedTree(child);}else{if(!child.Sealed||!child.Published)throw new InvalidDataException("unsealed leaf");EnsurePublishedPin(child);}}
     }
+    private void OpenRetainedTree(Pin directory,List<Pin> added)
+    {
+        foreach(string leaf in Enumerate(directory.Native))
+        {
+            OpenResult probe=OpenRelative(directory.Native,leaf,READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,BACKUP_INTENT);try{FILE_INFO info=Info(probe.Handle);if((info.FileAttributes&ATTR_REPARSE)!=0)throw new InvalidDataException("reparse leaf");string path=Path.Combine(directory.Path,leaf);if(IsDirectory(info)){if(!OnlyDefaultStream(probe.Handle)||!SamePath(FinalPath(probe.Handle),path))throw new InvalidDataException("directory invalid");Pin child=new Pin(directory,leaf,path,true,false,probe.Handle,null,info);probe.Handle=null;AddPin(child);added.Add(child);OpenRetainedTree(child,added);}else{probe.Handle.Dispose();probe.Handle=null;OpenResult file=OpenRelative(directory.Native,leaf,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,OPEN,NON_DIRECTORY);FileStream stream=null;try{stream=new FileStream(file.Handle,FileAccess.Read,65536,false);file.Handle=null;FILE_INFO fileInfo=Info(stream.SafeFileHandle);ValidatePlain(fileInfo,stream.SafeFileHandle);if(!SamePath(FinalPath(stream.SafeFileHandle),path))throw new InvalidDataException("pin changed");Pin child=new Pin(directory,leaf,path,false,false,null,stream,fileInfo);child.SealedLength=stream.Length;child.SealedSha=Sha(stream);child.Sealed=true;child.Published=true;AddPin(child);added.Add(child);stream=null;}finally{if(stream!=null)stream.Dispose();if(file.Handle!=null)file.Handle.Dispose();}}}finally{if(probe.Handle!=null)probe.Handle.Dispose();}}
+    }
+    private void ValidateRetainedTree(Pin directory){ValidateCurrent(directory);foreach(string leaf in Enumerate(directory.Native)){Pin child;if(!names.TryGetValue(Key(directory,leaf),out child))throw new InvalidDataException("unknown retained leaf");if(child.Directory)ValidateRetainedTree(child);else{ValidateCurrent(child);if(child.Stream.Length!=child.SealedLength||Sha(child.Stream)!=child.SealedSha)throw new InvalidDataException("seal mismatch");}}}
+    private void ValidateRetainedManifest(Pin generation,string runtimeId,string expectedManifestSha){Pin manifest;if(!names.TryGetValue(Key(generation,"manifest.json"),out manifest)||manifest.Directory)throw new InvalidDataException("retained manifest missing");if(manifest.SealedSha!=expectedManifestSha)throw new InvalidDataException("retained manifest mismatch");string text=ReadText(manifest.Stream);string propertyPattern="\\\"runtimeId\\\"\\s*:";string valuePattern=propertyPattern+"\\s*\\\""+Regex.Escape(runtimeId)+"\\\"";if(Regex.Matches(text,propertyPattern).Count!=1||Regex.Matches(text,valuePattern).Count!=1)throw new InvalidDataException("retained runtime id mismatch");}
+    private static string ReadText(FileStream stream){if(stream.Length>4194304)throw new InvalidDataException("retained manifest too large");long position=stream.Position;try{stream.Position=0;byte[] bytes=new byte[stream.Length];int offset=0;while(offset<bytes.Length){int read=stream.Read(bytes,offset,bytes.Length-offset);if(read==0)break;offset+=read;}if(offset!=bytes.Length)throw new EndOfStreamException();return new UTF8Encoding(false,true).GetString(bytes);}finally{stream.Position=position;}}
     private Pin CreateTemporaryFile(Pin parent)
     {
         string temporary=".ccod."+Guid.NewGuid().ToString("N")+".tmp";OpenResult result=OpenRelative(parent.Native,temporary,READ|WRITE|DELETE|SYNC,SHARE_READ,CREATE,NON_DIRECTORY|WRITE_THROUGH);FileStream stream=null;try{stream=new FileStream(result.Handle,FileAccess.ReadWrite,65536,false);result.Handle=null;FILE_INFO info=Info(stream.SafeFileHandle);ValidatePlain(info,stream.SafeFileHandle);Pin pin=new Pin(parent,temporary,Path.Combine(parent.Path,temporary),false,true,null,stream,info);AddPin(pin);stream=null;return pin;}finally{if(stream!=null)stream.Dispose();if(result.Handle!=null)result.Handle.Dispose();}
@@ -179,7 +212,7 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
         ulong maximum=0;foreach(string leaf in Enumerate(pointer.Native)){if(leaf.StartsWith(".ccod.",StringComparison.OrdinalIgnoreCase)&&leaf.EndsWith(".tmp",StringComparison.OrdinalIgnoreCase))continue;if(leaf.Length!=25||!leaf.EndsWith(".json",StringComparison.OrdinalIgnoreCase))throw new InvalidDataException("unknown pointer leaf");ulong value;if(!UInt64.TryParse(leaf.Substring(0,20),out value)||value==0)throw new InvalidDataException("unknown pointer leaf");if(value>maximum)maximum=value;}return maximum;
     }
     private Pin Require(object token,bool directory){if(disposed)throw new ObjectDisposedException("transaction");Pin pin;if(token==null||!pins.TryGetValue(token,out pin)||pin.Closed||pin.Directory!=directory)throw new InvalidDataException("invalid capability");return pin;}
-    private void AddPin(Pin pin){pins.Add(pin.Token,pin);if(pin.Parent!=null)names.Add(Key(pin.Parent,pin.Leaf),pin);}
+    private void AddPin(Pin pin){if(pins.ContainsKey(pin.Token))throw new InvalidDataException("duplicate pin token");if(pin.Parent!=null&&names.ContainsKey(Key(pin.Parent,pin.Leaf)))throw new InvalidDataException("duplicate pin key "+pin.Parent.Path+" -> "+pin.Leaf);pins.Add(pin.Token,pin);if(pin.Parent!=null)names.Add(Key(pin.Parent,pin.Leaf),pin);}
     private static string Key(Pin parent,string leaf){return parent.Index.ToString("x16")+"|"+leaf.ToLowerInvariant();}
     private static Pin ValidateDirectoryPin(Pin parent,string leaf,string path,bool owned,SafeFileHandle handle){FILE_INFO info=Info(handle);if(!IsDirectory(info)||(info.FileAttributes&ATTR_REPARSE)!=0||!OnlyDefaultStream(handle)||!SamePath(FinalPath(handle),path))throw new InvalidDataException("directory invalid");return new Pin(parent,leaf,path,true,owned,handle,null,info);}
     private void SealAndPublish(Pin pin,string finalLeaf,long expectedLength,string expectedSha,bool manifest)
@@ -206,7 +239,7 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
     private static string FinalPath(SafeFileHandle handle){StringBuilder buffer=new StringBuilder(512);uint length=GetFinalPathNameByHandleW(handle,buffer,(uint)buffer.Capacity,0);if(length==0)throw new Win32Exception(Marshal.GetLastWin32Error());if(length>=buffer.Capacity){buffer.Capacity=(int)length+1;length=GetFinalPathNameByHandleW(handle,buffer,(uint)buffer.Capacity,0);if(length==0||length>=buffer.Capacity)throw new Win32Exception(Marshal.GetLastWin32Error());}string path=buffer.ToString();if(path.StartsWith(@"\\?\UNC\",StringComparison.OrdinalIgnoreCase))return@"\\"+path.Substring(8);if(path.StartsWith(@"\\?\",StringComparison.OrdinalIgnoreCase))return path.Substring(4);return path;}
     private static bool SamePath(string first,string second){return String.Equals(Path.GetFullPath(first).TrimEnd('\\'),Path.GetFullPath(second).TrimEnd('\\'),StringComparison.OrdinalIgnoreCase);}
     private static bool OnlyDefaultStream(SafeFileHandle handle){IntPtr buffer=Marshal.AllocHGlobal(65536);try{if(!GetFileInformationByHandleEx(handle,FileStreamInfo,buffer,65536)){int error=Marshal.GetLastWin32Error();if(error==38)return true;throw new Win32Exception(error);}int offset=0;while(true){uint next=(uint)Marshal.ReadInt32(buffer,offset),nameLength=(uint)Marshal.ReadInt32(buffer,offset+4);string name=Marshal.PtrToStringUni(IntPtr.Add(buffer,offset+24),(int)nameLength/2);if(!String.Equals(name,"::$DATA",StringComparison.OrdinalIgnoreCase)&&!String.Equals(name,"::$INDEX_ALLOCATION",StringComparison.OrdinalIgnoreCase))return false;if(next==0)break;offset+=(int)next;}return true;}finally{Marshal.FreeHGlobal(buffer);}}
-    private static string[] Enumerate(SafeFileHandle handle){List<string> result=new List<string>();IntPtr buffer=Marshal.AllocHGlobal(65536);bool restart=true;try{while(true){IO_STATUS_BLOCK io;int status=NtQueryDirectoryFile(handle,IntPtr.Zero,IntPtr.Zero,IntPtr.Zero,out io,buffer,65536,FileDirectoryInformation,false,IntPtr.Zero,restart);restart=false;if(status==STATUS_NO_MORE_FILES)break;if(status<0)throw new Win32Exception((int)RtlNtStatusToDosError(status));int offset=0;while(true){uint next=(uint)Marshal.ReadInt32(buffer,offset),nameLength=(uint)Marshal.ReadInt32(buffer,offset+60);string name=Marshal.PtrToStringUni(IntPtr.Add(buffer,offset+64),(int)nameLength/2);if(name!="."&&name!="..")result.Add(name);if(next==0)break;offset+=(int)next;}}return result.ToArray();}finally{Marshal.FreeHGlobal(buffer);}}
+    private static string[] Enumerate(SafeFileHandle handle){List<string> result=new List<string>();HashSet<string> seen=new HashSet<string>(StringComparer.OrdinalIgnoreCase);IntPtr buffer=Marshal.AllocHGlobal(65536);bool restart=true;try{while(true){IO_STATUS_BLOCK io;int status=NtQueryDirectoryFile(handle,IntPtr.Zero,IntPtr.Zero,IntPtr.Zero,out io,buffer,65536,FileDirectoryInformation,false,IntPtr.Zero,restart);restart=false;if(status==STATUS_NO_MORE_FILES)break;if(status<0)throw new Win32Exception((int)RtlNtStatusToDosError(status));int offset=0;while(true){uint next=(uint)Marshal.ReadInt32(buffer,offset),nameLength=(uint)Marshal.ReadInt32(buffer,offset+60);string name=Marshal.PtrToStringUni(IntPtr.Add(buffer,offset+64),(int)nameLength/2);if(name!="."&&name!=".."&&seen.Add(name))result.Add(name);if(next==0)break;offset+=(int)next;}}return result.ToArray();}finally{Marshal.FreeHGlobal(buffer);}}
     private static OpenResult OpenRelative(SafeFileHandle parent,string name,uint access,uint share,uint disposition,uint options){IntPtr nameBuffer=IntPtr.Zero,unicodePointer=IntPtr.Zero;bool added=false;try{parent.DangerousAddRef(ref added);nameBuffer=Marshal.StringToHGlobalUni(name);UNICODE_STRING unicode=new UNICODE_STRING{Length=(ushort)(name.Length*2),MaximumLength=(ushort)((name.Length+1)*2),Buffer=nameBuffer};unicodePointer=Marshal.AllocHGlobal(Marshal.SizeOf(typeof(UNICODE_STRING)));Marshal.StructureToPtr(unicode,unicodePointer,false);OBJECT_ATTRIBUTES attributes=new OBJECT_ATTRIBUTES{Length=Marshal.SizeOf(typeof(OBJECT_ATTRIBUTES)),RootDirectory=parent.DangerousGetHandle(),ObjectName=unicodePointer,Attributes=OBJ_CASE_INSENSITIVE};IO_STATUS_BLOCK io;IntPtr raw;int status=NtCreateFile(out raw,access,ref attributes,out io,IntPtr.Zero,0,share,disposition,options|SYNC_IO|OPEN_REPARSE,IntPtr.Zero,0);if(status<0)throw new Win32Exception((int)RtlNtStatusToDosError(status));return new OpenResult(new SafeFileHandle(raw,true),io.Information.ToUInt64()==2);}finally{if(unicodePointer!=IntPtr.Zero)Marshal.FreeHGlobal(unicodePointer);if(nameBuffer!=IntPtr.Zero)Marshal.FreeHGlobal(nameBuffer);if(added)parent.DangerousRelease();}}
     private static int Rename(SafeFileHandle source,SafeFileHandle parent,string destination){byte[] name=Encoding.Unicode.GetBytes(destination);int rootOffset=IntPtr.Size,lengthOffset=rootOffset+IntPtr.Size,nameOffset=lengthOffset+4,size=nameOffset+name.Length+2;IntPtr buffer=Marshal.AllocHGlobal(size);bool parentAdded=false,sourceAdded=false;try{source.DangerousAddRef(ref sourceAdded);parent.DangerousAddRef(ref parentAdded);for(int i=0;i<size;i++)Marshal.WriteByte(buffer,i,0);Marshal.WriteByte(buffer,0,0);Marshal.WriteIntPtr(buffer,rootOffset,parent.DangerousGetHandle());Marshal.WriteInt32(buffer,lengthOffset,name.Length);Marshal.Copy(name,0,IntPtr.Add(buffer,nameOffset),name.Length);IO_STATUS_BLOCK io;int status=NtSetInformationFile(source,out io,buffer,(uint)size,FileRenameInformation);return status>=0?0:(int)RtlNtStatusToDosError(status);}finally{if(parentAdded)parent.DangerousRelease();if(sourceAdded)source.DangerousRelease();Marshal.FreeHGlobal(buffer);}}
 }
@@ -224,8 +257,10 @@ function Invoke-CcodRuntimeStatic([string]$Name,[object[]]$Arguments){$method=$s
 function Invoke-CcodRuntimeMethod($Runtime,[string]$Name,[object[]]$Arguments){$method=$Runtime.GetType().GetMethod($Name,[Reflection.BindingFlags]'NonPublic,Instance');try{return $method.Invoke($Runtime,$Arguments)}catch [Reflection.TargetInvocationException]{throw $_.Exception.InnerException}}
 function New-CcodInstallCapability { New-Object psobject }
 function Get-CcodInstallTransaction($Capability,[string]$InvalidId='CCOD_INSTALL_GENERATION_INVALID',[switch]$AllowRetired){$record=$null;if($null-eq$Capability-or-not$script:CcodScopes.TryGetValue($Capability,[ref]$record)){Throw-CcodInstallFileError $InvalidId 'Invalid install generation capability' $null};$state=$null;if(-not$script:CcodTransactions.TryGetValue($record.Transaction,[ref]$state)){Throw-CcodInstallFileError $InvalidId 'Invalid install transaction capability' $null};if($state.Closed){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' 'Install file transaction is closed' $null};if($state.Retired-and-not$AllowRetired){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_RETIRED' 'Install generation is retired' $null};[pscustomobject]@{State=$state;Record=$record}}
-function Add-CcodInstallScope($Transaction,$Token){$capability=New-CcodInstallCapability;$script:CcodScopes.Add($capability,[pscustomobject]@{Transaction=$Transaction;Token=$Token});$capability}
-function Convert-CcodInstallRuntimeError($Action,[string]$DefaultId){try{return&$Action}catch{$exception=$_.Exception;while($null-ne$exception.InnerException-and$exception-is[Management.Automation.RuntimeException]){$exception=$exception.InnerException};$message=[string]$exception.Message;if($exception-is[ObjectDisposedException]){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' $message $null};if($exception-is[ComponentModel.Win32Exception]-and$exception.NativeErrorCode-in@(80,183)){Throw-CcodInstallFileError 'CCOD_INSTALL_LEAF_EXISTS' 'Install object already exists' $null};if($message-match'pointer generation exists'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' $message $null};if($message-match'pointer generation overflow'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW' $message $null};if($message-match'seal mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_SEAL_MISMATCH' $message $null};if($message-match'alternate stream'){Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' $message $null};if($message-match'multi-link'){Throw-CcodInstallFileError 'CCOD_INSTALL_MULTILINK_LEAF' $message $null};if($message-match'reparse'){Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' $message $null};if($message-match'transaction scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_SCOPE' $message $null};if($message-match'generation not owned'){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' $message $null};if($message-match'unknown|unsealed'){Throw-CcodInstallFileError 'CCOD_INSTALL_UNKNOWN_LEAF' $message $null};if($message-match'pin changed|path changed'){Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' $message $null};Throw-CcodInstallFileError $DefaultId $message $null}}
+function Add-CcodInstallScope($Transaction,$Token,[string]$Kind='Directory',[bool]$ReadOnly=$false,[AllowNull()][string]$RuntimeId=$null){$capability=New-CcodInstallCapability;$script:CcodScopes.Add($capability,[pscustomobject]@{Transaction=$Transaction;Token=$Token;Kind=$Kind;ReadOnly=$ReadOnly;RuntimeId=$RuntimeId});$capability}
+function Get-CcodInstallScopedDirectory($Transaction,$Parent){$parentScope=Get-CcodInstallTransaction $Parent 'CCOD_INSTALL_DIRECTORY_INVALID';if(-not[object]::ReferenceEquals($parentScope.Record.Transaction,$Transaction)-or$parentScope.Record.Kind-cnotin@('Directory','Generation')){Throw-CcodInstallFileError 'CCOD_INSTALL_DIRECTORY_INVALID' 'Directory capability is outside the transaction scope' $null};return $parentScope}
+function Assert-CcodInstallWritableScope($Scope){if($Scope.Record.ReadOnly){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_READ_ONLY' 'Retained generation capability is read-only' $null}}
+function Convert-CcodInstallRuntimeError($Action,[string]$DefaultId){try{return&$Action}catch{$exception=$_.Exception;while($null-ne$exception.InnerException-and$exception-is[Management.Automation.RuntimeException]){$exception=$exception.InnerException};$message=[string]$exception.Message;if($exception-is[ObjectDisposedException]){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' $message $null};if($exception-is[ComponentModel.Win32Exception]-and$exception.NativeErrorCode-in@(80,183)){Throw-CcodInstallFileError 'CCOD_INSTALL_LEAF_EXISTS' 'Install object already exists' $null};if($message-match'pointer generation exists'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' $message $null};if($message-match'pointer generation overflow'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW' $message $null};if($message-match'retained manifest mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_MANIFEST_MISMATCH' $message $null};if($message-match'retained runtime id mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH' $message $null};if($message-match'seal mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_SEAL_MISMATCH' $message $null};if($message-match'alternate stream'){Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' $message $null};if($message-match'multi-link'){Throw-CcodInstallFileError 'CCOD_INSTALL_MULTILINK_LEAF' $message $null};if($message-match'reparse'){Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' $message $null};if($message-match'transaction scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_SCOPE' $message $null};if($message-match'generation not owned'){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' $message $null};if($message-match'unknown|unsealed'){Throw-CcodInstallFileError 'CCOD_INSTALL_UNKNOWN_LEAF' $message $null};if($message-match'pin changed|path changed'){Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' $message $null};Throw-CcodInstallFileError $DefaultId $message $null}}
 function Test-CcodInstallValue($Value,[int]$Depth=0) {
     if ($Depth -gt 12) { return $false }
     if ($null -eq $Value) { return $true }
@@ -258,14 +293,17 @@ function Open-CcodInstallGeneration {
     Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID'
     $arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$RuntimeId,$null)
     try{$token=Invoke-CcodRuntimeStatic Open $arguments}catch [ComponentModel.Win32Exception]{if($_.Exception.NativeErrorCode-in@(32,80,183)){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_EXISTS' 'Install generation already exists' $RuntimeId};throw}
-    $runtime=$arguments[2];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$RuntimeId;RootToken=$token;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token});$transaction
+    $runtime=$arguments[2];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$RuntimeId;RootToken=$token;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='Generation';ReadOnly=$false;RuntimeId=$RuntimeId});$transaction
 }
-function New-CcodInstallGenerationLeaf { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$Leaf) Assert-CcodInstallLeaf $Leaf;$scope=Get-CcodInstallTransaction $Generation;$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CreateDirectory @($scope.Record.Token,$Leaf)} 'CCOD_INSTALL_LEAF_CREATE_FAILED';Add-CcodInstallScope $scope.Record.Transaction $token }
-function Copy-CcodInstallSealedSource { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$SourcePath,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)][int64]$ExpectedLength,[Parameter(Mandatory)][string]$ExpectedSha256) Assert-CcodInstallLeaf $Leaf;if(-not[IO.Path]::IsPathRooted($SourcePath)-or$ExpectedLength-lt 0-or$ExpectedSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Invalid sealed source contract' $SourcePath};$scope=Get-CcodInstallTransaction $Generation;$result=[pscustomobject]@{Length=$ExpectedLength;Sha256=$ExpectedSha256};Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Copy @($scope.Record.Token,$Leaf,[IO.Path]::GetFullPath($SourcePath),$ExpectedLength,$ExpectedSha256)|Out-Null} 'CCOD_INSTALL_SOURCE_MISMATCH';return $result }
-function Write-CcodInstallGenerationManifest { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)]$Manifest) $scope=Get-CcodInstallTransaction $Generation;if($scope.Record.Token-ne$scope.State.RootToken){Throw-CcodInstallFileError 'CCOD_INSTALL_MANIFEST_SCOPE' 'Manifest must be written at the generation root' $null};$bytes=ConvertTo-CcodInstallJsonBytes $Manifest;$result=[pscustomobject]@{Length=[int64]$bytes.LongLength;Sha256=(Get-CcodInstallBytesSha256 $bytes)};Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Write @($scope.Record.Token,'manifest.json',$bytes,$true)|Out-Null} 'CCOD_INSTALL_MANIFEST_WRITE_FAILED';return $result }
-function Commit-CcodInstallActivePointer { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][uint64]$ExpectedPreviousGeneration,[Parameter(Mandatory)][string]$NewRuntimeId,[Parameter(Mandatory)]$FileTransaction) Assert-CcodInstallLeaf $NewRuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';if($ExpectedPreviousGeneration-eq[uint64]::MaxValue){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW' 'Pointer generation cannot advance beyond UInt64.MaxValue' $ExpectedPreviousGeneration};$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$generation=[uint64]($ExpectedPreviousGeneration+1);$pointer=[ordered]@{schemaVersion=1;generation=$generation;activeRuntime=$NewRuntimeId;previousGeneration=$ExpectedPreviousGeneration};$bytes=ConvertTo-CcodInstallJsonBytes $pointer;$result=[pscustomobject]@{Generation=$generation;RuntimeId=$NewRuntimeId};try{Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CommitPointer @($scope.Record.Token,$ExpectedPreviousGeneration,$NewRuntimeId,$bytes)|Out-Null} 'CCOD_INSTALL_POINTER_COMMIT_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' 'Pointer generation already exists' $generation};throw};return $result }
+function Open-CcodInstallRetainedGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)][string]$ExpectedManifestSha256,[Parameter(Mandatory)]$FileTransaction) if(-not[IO.Path]::IsPathRooted($InstallRoot)-or$ExpectedManifestSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_GENERATION_INVALID' 'Invalid retained generation contract' $RuntimeId};Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetained @($RuntimeId,$ExpectedManifestSha256)} 'CCOD_INSTALL_RETAINED_GENERATION_INVALID';Add-CcodInstallScope $scope.Record.Transaction $token Generation $true $RuntimeId }
+function New-CcodInstallDirectory { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$Parent,[Parameter(Mandatory)][string]$Leaf,[switch]$CreateIfMissing) Assert-CcodInstallLeaf $Leaf;$transactionScope=Get-CcodInstallTransaction $Transaction 'CCOD_INSTALL_TRANSACTION_INVALID';if(-not[object]::ReferenceEquals($transactionScope.Record.Transaction,$Transaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Transaction capability must be the transaction root' $null};if([object]::ReferenceEquals($Parent,$Transaction)){$token=Invoke-CcodRuntimeMethod $transactionScope.State.Runtime GetInstallRoot @();$parentScope=[pscustomobject]@{State=$transactionScope.State;Record=[pscustomobject]@{Transaction=$Transaction;Token=$token;Kind='Directory';ReadOnly=$false;RuntimeId=$null}}}else{$parentScope=Get-CcodInstallScopedDirectory $Transaction $Parent};Assert-CcodInstallWritableScope $parentScope;$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $parentScope.State.Runtime OpenDirectory @($parentScope.Record.Token,$Leaf,[bool]$CreateIfMissing)} 'CCOD_INSTALL_DIRECTORY_OPEN_FAILED';Add-CcodInstallScope $Transaction $token Directory $false $null }
+function New-CcodInstallGenerationLeaf { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$Leaf) Assert-CcodInstallLeaf $Leaf;$scope=Get-CcodInstallTransaction $Generation;Assert-CcodInstallWritableScope $scope;$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CreateDirectory @($scope.Record.Token,$Leaf)} 'CCOD_INSTALL_LEAF_CREATE_FAILED';Add-CcodInstallScope $scope.Record.Transaction $token Directory $scope.Record.ReadOnly $scope.Record.RuntimeId }
+function Copy-CcodInstallSealedSource { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$SourcePath,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)][int64]$ExpectedLength,[Parameter(Mandatory)][string]$ExpectedSha256) Assert-CcodInstallLeaf $Leaf;if(-not[IO.Path]::IsPathRooted($SourcePath)-or$ExpectedLength-lt 0-or$ExpectedSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Invalid sealed source contract' $SourcePath};$scope=Get-CcodInstallTransaction $Generation;Assert-CcodInstallWritableScope $scope;$result=[pscustomobject]@{Length=$ExpectedLength;Sha256=$ExpectedSha256};Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Copy @($scope.Record.Token,$Leaf,[IO.Path]::GetFullPath($SourcePath),$ExpectedLength,$ExpectedSha256)|Out-Null} 'CCOD_INSTALL_SOURCE_MISMATCH';return $result }
+function Write-CcodInstallGenerationManifest { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)]$Manifest) $scope=Get-CcodInstallTransaction $Generation;Assert-CcodInstallWritableScope $scope;if($scope.Record.Token-ne$scope.State.RootToken){Throw-CcodInstallFileError 'CCOD_INSTALL_MANIFEST_SCOPE' 'Manifest must be written at the generation root' $null};$bytes=ConvertTo-CcodInstallJsonBytes $Manifest;$result=[pscustomobject]@{Length=[int64]$bytes.LongLength;Sha256=(Get-CcodInstallBytesSha256 $bytes)};Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Write @($scope.Record.Token,'manifest.json',$bytes,$true)|Out-Null} 'CCOD_INSTALL_MANIFEST_WRITE_FAILED';return $result }
+function Write-CcodInstallRecord { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$Parent,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)]$Record) Assert-CcodInstallLeaf $Leaf;$scope=Get-CcodInstallScopedDirectory $Transaction $Parent;Assert-CcodInstallWritableScope $scope;$bytes=ConvertTo-CcodInstallJsonBytes $Record;$result=[pscustomobject]@{Length=[int64]$bytes.LongLength;Sha256=(Get-CcodInstallBytesSha256 $bytes)};try{Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Write @($scope.Record.Token,$Leaf,$bytes,$false)|Out-Null} 'CCOD_INSTALL_RECORD_WRITE_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_RECORD_EXISTS' 'Install record already exists' $Leaf};throw};return $result }
+function Commit-CcodInstallActivePointer { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$TargetGeneration,[Parameter(Mandatory)][uint64]$ExpectedPreviousGeneration,[Parameter(Mandatory)]$FileTransaction) if($ExpectedPreviousGeneration-eq[uint64]::MaxValue){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW' 'Pointer generation cannot advance beyond UInt64.MaxValue' $ExpectedPreviousGeneration};$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$target=Get-CcodInstallTransaction $TargetGeneration 'CCOD_INSTALL_POINTER_TARGET_INVALID';if(-not[object]::ReferenceEquals($target.Record.Transaction,$FileTransaction)-or$target.Record.Kind-cne'Generation'-or[string]::IsNullOrWhiteSpace([string]$target.Record.RuntimeId)){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_TARGET_INVALID' 'Pointer target is outside the transaction scope' $null};$generation=[uint64]($ExpectedPreviousGeneration+1);$runtimeId=[string]$target.Record.RuntimeId;$pointer=[ordered]@{schemaVersion=1;generation=$generation;activeRuntime=$runtimeId;previousGeneration=$ExpectedPreviousGeneration};$bytes=ConvertTo-CcodInstallJsonBytes $pointer;$result=[pscustomobject]@{Generation=$generation;RuntimeId=$runtimeId};try{Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CommitPointer @($target.Record.Token,$ExpectedPreviousGeneration,$runtimeId,$bytes)|Out-Null} 'CCOD_INSTALL_POINTER_COMMIT_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' 'Pointer generation already exists' $generation};throw};return $result }
 function Retire-CcodInstallGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)]$FileTransaction) Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID' -AllowRetired;Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';if($RuntimeId-cne$scope.State.RuntimeId-or$scope.Record.Token-ne$scope.State.RootToken){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' 'Generation is not owned by this transaction' $RuntimeId};if($scope.State.Retired){return $scope.State.RetirementResult};$recordLeaf=$RuntimeId+'.json';$record=ConvertTo-CcodInstallJsonBytes ([ordered]@{schemaVersion=1;runtimeId=$RuntimeId;state='Retired'});$capability=Add-CcodInstallScope $scope.Record.Transaction $scope.State.RootToken;$result=[pscustomobject]@{Disposition='Retired';Capability=$capability};try{Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Retire @($scope.Record.Token,$RuntimeId,$recordLeaf,$record)|Out-Null} 'CCOD_INSTALL_RETIREMENT_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETIREMENT_RECORD_EXISTS' 'Retirement record already exists' $recordLeaf};throw};$scope.State.RetirementResult=$result;$scope.State.Retired=$true;return $result }
 function Close-CcodInstallFileTransaction { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][ValidateSet('Ready','Failed')][string]$Disposition) $state=$null;if($null-eq$Transaction-or-not$script:CcodTransactions.TryGetValue($Transaction,[ref]$state)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Invalid install file transaction capability' $null};if($state.Closed-and-not$state.CleanupFailed){return};try{Invoke-CcodRuntimeMethod $state.Runtime Close @()|Out-Null;$state.CleanupFailed=$false}catch{$state.CleanupFailed=$true;$state.Closed=$true;$state.Disposition=$Disposition;Throw-CcodInstallFileError 'CCOD_INSTALL_CLOSE_FAILED' 'Install file transaction cleanup failed; registered failures are retained for retry' $null};$state.Closed=$true;$state.Disposition=$Disposition }
 
 Initialize-CcodInstallRuntime
-Export-ModuleMember -Function Open-CcodInstallGeneration,New-CcodInstallGenerationLeaf,Copy-CcodInstallSealedSource,Write-CcodInstallGenerationManifest,Commit-CcodInstallActivePointer,Retire-CcodInstallGeneration,Close-CcodInstallFileTransaction
+Export-ModuleMember -Function Open-CcodInstallGeneration,Open-CcodInstallRetainedGeneration,New-CcodInstallDirectory,New-CcodInstallGenerationLeaf,Copy-CcodInstallSealedSource,Write-CcodInstallGenerationManifest,Write-CcodInstallRecord,Commit-CcodInstallActivePointer,Retire-CcodInstallGeneration,Close-CcodInstallFileTransaction
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index a8a9194..f10889c 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -130,7 +130,7 @@ function New-CcodHardLink {
 }
 
 Invoke-CcodTest 'exports only immutable generation operations and an inert CLR marker' {
-    $expected=@('Close-CcodInstallFileTransaction','Commit-CcodInstallActivePointer','Copy-CcodInstallSealedSource','New-CcodInstallGenerationLeaf','Open-CcodInstallGeneration','Retire-CcodInstallGeneration','Write-CcodInstallGenerationManifest')
+    $expected=@('Close-CcodInstallFileTransaction','Commit-CcodInstallActivePointer','Copy-CcodInstallSealedSource','New-CcodInstallDirectory','New-CcodInstallGenerationLeaf','Open-CcodInstallGeneration','Open-CcodInstallRetainedGeneration','Retire-CcodInstallGeneration','Write-CcodInstallGenerationManifest','Write-CcodInstallRecord')
     Assert-CcodEqual ($expected -join '|') ((@($module.ExportedCommands.Keys)|Sort-Object)-join '|') 'module export surface is capability-only'
     Assert-CcodEqual 2 ([CcodInstallGenerationCapabilityMarkerV2]::CapabilityAbi) 'marker exposes the current non-mutating ABI value'
     Assert-CcodEqual 'CcodInstallGenerationCapabilityMarkerV2' ((@([CcodInstallGenerationCapabilityMarkerV2].Assembly.GetExportedTypes()|ForEach-Object FullName)) -join '|') 'current CLR bridge exports only the inert marker'
@@ -149,6 +149,25 @@ Invoke-CcodTest 'force re-import rebinds the current runtime ABI before real use
     } finally { Remove-CcodInstallFileFixture $fixture }
 }
 
+Invoke-CcodTest 'creates nested scoped directories and publishes sanitized records create-only' {
+    $fixture=New-CcodInstallFileFixture
+    try {
+        $transaction=Open-CcodFixtureGeneration $fixture 'runtime-scoped-records'
+        $state=New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'state' -CreateIfMissing
+        $stateOpened=New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'state';Assert-CcodEqual '' (@($stateOpened.PSObject.Properties.Name)-join ',') 'existing install-root directory opens through the same opaque wrapper'
+        $receipts=New-CcodInstallDirectory -Transaction $transaction -Parent $state -Leaf 'receipts' -CreateIfMissing
+        $final=Join-Path $fixture.Install 'state\receipts\activation.json';$observer=[CcodInstallFileRaceProbe]::ObserveFirstVisibleBytes($final)
+        $record=[ordered]@{schemaVersion=1;phase='Prepared';runtimeId='runtime-scoped-records'}
+        $written=Write-CcodInstallRecord -Transaction $transaction -Parent $receipts -Leaf 'activation.json' -Record $record
+        $firstVisible=$observer.GetAwaiter().GetResult();Assert-CcodEqual $written.Length ([int64]$firstVisible.LongLength) 'first visible scoped record has its sealed length'
+        $observed=Join-Path $fixture.Base 'observed-record.json';[IO.File]::WriteAllBytes($observed,$firstVisible);Assert-CcodEqual $written.Sha256 (Get-CcodTestFileSha256 $observed) 'first visible scoped record has its sealed digest'
+        $before=Get-CcodTestFileSha256 $final;Assert-CcodThrows {Write-CcodInstallRecord -Transaction $transaction -Parent $receipts -Leaf 'activation.json' -Record $record|Out-Null} 'CCOD_INSTALL_RECORD_EXISTS';Assert-CcodEqual $before (Get-CcodTestFileSha256 $final) 'record collision leaves existing bytes unchanged'
+        Write-CcodInstallRecord -Transaction $transaction -Parent $receipts -Leaf 'install.log' -Record ([ordered]@{event='phase';code='CCOD_OK'})|Out-Null
+        Assert-CcodThrows {New-CcodInstallDirectory -Transaction $transaction -Parent $state -Leaf '..\escape' -CreateIfMissing|Out-Null} 'CCOD_INSTALL_LEAF_INVALID'
+        Assert-CcodThrows {Write-CcodInstallRecord -Transaction $transaction -Parent $receipts -Leaf 'nested\record.json' -Record $record|Out-Null} 'CCOD_INSTALL_LEAF_INVALID'
+    } finally {Remove-CcodInstallFileFixture $fixture}
+}
+
 Invoke-CcodTest 'generation and capabilities are unique create-only opaque references' {
     $fixture=New-CcodInstallFileFixture
     try {
@@ -239,7 +258,7 @@ Invoke-CcodTest 'source and destination handles remain private pinned and same-h
         $visibleSha=Get-CcodTestFileSha256 $destination
         if($visibleSha-cne$source.Sha256){
             Write-CcodInstallGenerationManifest -Generation $generation -Manifest (New-CcodGenerationManifest $runtimeId)|Out-Null
-            try{Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -ExpectedPreviousGeneration ([uint64]0) -NewRuntimeId $runtimeId -FileTransaction $generation|Out-Null;throw 'ASSERT_ATTACKED_GENERATION_COMMITTED'}catch{Assert-CcodTrue ($_.FullyQualifiedErrorId-match'^CCOD_INSTALL_(?:PIN_CHANGED|SEAL_MISMATCH|UNKNOWN_LEAF)') 'post-commit same-user mutation cannot become an eligible generation'}
+            try{Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $generation -ExpectedPreviousGeneration ([uint64]0) -FileTransaction $generation|Out-Null;throw 'ASSERT_ATTACKED_GENERATION_COMMITTED'}catch{Assert-CcodTrue ($_.FullyQualifiedErrorId-match'^CCOD_INSTALL_(?:PIN_CHANGED|SEAL_MISMATCH|UNKNOWN_LEAF)') 'post-commit same-user mutation cannot become an eligible generation'}
             return
         }
         Assert-CcodEqual $source.Sha256 $visibleSha 'successful sealed leaf is readable by path before transaction close'
@@ -289,7 +308,7 @@ Invoke-CcodTest 'rejects forged cross-transaction and closed capabilities' {
         $first=Open-CcodFixtureGeneration $firstFixture 'runtime-first';$second=Open-CcodFixtureGeneration $secondFixture 'runtime-second';$forged=New-Object psobject
         Assert-CcodThrows {New-CcodInstallGenerationLeaf -Generation $forged -Leaf 'forged'|Out-Null} 'CCOD_INSTALL_GENERATION_INVALID'
         Write-CcodInstallGenerationManifest -Generation $first -Manifest (New-CcodGenerationManifest 'runtime-first')|Out-Null
-        Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $secondFixture.Install -ExpectedPreviousGeneration ([uint64]0) -NewRuntimeId 'runtime-first' -FileTransaction $first|Out-Null} 'CCOD_INSTALL_TRANSACTION_SCOPE'
+        Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $secondFixture.Install -TargetGeneration $first -ExpectedPreviousGeneration ([uint64]0) -FileTransaction $first|Out-Null} 'CCOD_INSTALL_TRANSACTION_SCOPE'
         Assert-CcodThrows {Retire-CcodInstallGeneration -InstallRoot $firstFixture.Install -RuntimeId 'runtime-first' -FileTransaction $second|Out-Null} 'CCOD_INSTALL_TRANSACTION_SCOPE'
         Close-CcodInstallFileTransaction -Transaction $first -Disposition Failed|Out-Null
         Assert-CcodThrows {New-CcodInstallGenerationLeaf -Generation $first -Leaf 'after-close'|Out-Null} 'CCOD_INSTALL_TRANSACTION_CLOSED'
@@ -331,17 +350,17 @@ Invoke-CcodTest 'pointer generation records are monotonic create-only and collis
     $fixture=New-CcodInstallFileFixture
     try {
         $first=Open-CcodFixtureGeneration $fixture 'runtime-pointer-one';Write-CcodInstallGenerationManifest -Generation $first -Manifest (New-CcodGenerationManifest 'runtime-pointer-one')|Out-Null
-        $committed=Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -ExpectedPreviousGeneration ([uint64]0) -NewRuntimeId 'runtime-pointer-one' -FileTransaction $first
+        $committed=Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $first -ExpectedPreviousGeneration ([uint64]0) -FileTransaction $first
         Assert-CcodEqual ([uint64]1) ([uint64]$committed.Generation) 'first pointer generation is one'
         $records=@(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\active-generation') -File -Filter '*.json');Assert-CcodEqual 1 $records.Count 'one pointer record';$before=Get-CcodTestFileSha256 $records[0].FullName
         $second=Open-CcodFixtureGeneration $fixture 'runtime-pointer-two';Write-CcodInstallGenerationManifest -Generation $second -Manifest (New-CcodGenerationManifest 'runtime-pointer-two')|Out-Null
-        $secondCommit=Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -ExpectedPreviousGeneration ([uint64]1) -NewRuntimeId 'runtime-pointer-two' -FileTransaction $second
+        $secondCommit=Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $second -ExpectedPreviousGeneration ([uint64]1) -FileTransaction $second
         Assert-CcodEqual ([uint64]2) ([uint64]$secondCommit.Generation) 'second pointer generation increments to two'
         $after=@(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\active-generation') -File -Filter '*.json'|Sort-Object Name);Assert-CcodEqual 2 $after.Count 'successful second commit appends one record';Assert-CcodEqual $before (Get-CcodTestFileSha256 $after[0].FullName) 'generation one remains unchanged'
         $third=Open-CcodFixtureGeneration $fixture 'runtime-pointer-three';Write-CcodInstallGenerationManifest -Generation $third -Manifest (New-CcodGenerationManifest 'runtime-pointer-three')|Out-Null
-        Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -ExpectedPreviousGeneration ([uint64]1) -NewRuntimeId 'runtime-pointer-three' -FileTransaction $third|Out-Null} 'CCOD_INSTALL_POINTER_GENERATION_EXISTS'
+        Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $third -ExpectedPreviousGeneration ([uint64]1) -FileTransaction $third|Out-Null} 'CCOD_INSTALL_POINTER_GENERATION_EXISTS'
         Assert-CcodEqual 2 @(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\active-generation') -File -Filter '*.json').Count 'no-replace contender publishes no third record'
-        Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -ExpectedPreviousGeneration ([uint64]::MaxValue) -NewRuntimeId 'runtime-pointer-three' -FileTransaction $third|Out-Null} 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW'
+        Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $third -ExpectedPreviousGeneration ([uint64]::MaxValue) -FileTransaction $third|Out-Null} 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW'
         Assert-CcodEqual 2 @(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\active-generation') -File -Filter '*.json').Count 'overflow publishes no record'
         Assert-CcodOutsideUnchanged $fixture 'pointer monotonicity'
     } finally {Remove-CcodInstallFileFixture $fixture}
@@ -352,7 +371,7 @@ Invoke-CcodTest 'independent transactions race one pointer generation with exact
     $processes=@()
     try {
         $initial=Open-CcodFixtureGeneration $fixture 'runtime-pointer-initial';Write-CcodInstallGenerationManifest -Generation $initial -Manifest (New-CcodGenerationManifest 'runtime-pointer-initial')|Out-Null
-        Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -ExpectedPreviousGeneration ([uint64]0) -NewRuntimeId 'runtime-pointer-initial' -FileTransaction $initial|Out-Null
+        Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $initial -ExpectedPreviousGeneration ([uint64]0) -FileTransaction $initial|Out-Null
         $go=Join-Path $fixture.Base 'go';$escapedModule=$modulePath.Replace("'","''");$escapedRoot=$fixture.Install.Replace("'","''")
         foreach($index in 1..2){
             $runtimeId="runtime-pointer-racer-$index";$scriptPath=Join-Path $fixture.Base "racer-$index.ps1";$ready=Join-Path $fixture.Base "ready-$index";$outcome=Join-Path $fixture.Base "outcome-$index"
@@ -367,7 +386,7 @@ try {
     [IO.File]::WriteAllText('$($ready.Replace("'","''"))','ready')
     `$deadline=[DateTime]::UtcNow.AddSeconds(15)
     while(-not[IO.File]::Exists('$($go.Replace("'","''"))')){if([DateTime]::UtcNow-gt`$deadline){throw 'barrier timeout'};Start-Sleep -Milliseconds 10}
-    try{Commit-CcodInstallActivePointer -InstallRoot '$escapedRoot' -ExpectedPreviousGeneration ([uint64]1) -NewRuntimeId '$runtimeId' -FileTransaction `$tx|Out-Null;[IO.File]::WriteAllText('$($outcome.Replace("'","''"))','success')}
+    try{Commit-CcodInstallActivePointer -InstallRoot '$escapedRoot' -TargetGeneration `$tx -ExpectedPreviousGeneration ([uint64]1) -FileTransaction `$tx|Out-Null;[IO.File]::WriteAllText('$($outcome.Replace("'","''"))','success')}
     catch{[IO.File]::WriteAllText('$($outcome.Replace("'","''"))',[string]`$_.FullyQualifiedErrorId)}
 } finally {if(`$null-ne`$tx){Close-CcodInstallFileTransaction -Transaction `$tx -Disposition Failed|Out-Null}}
 "@
@@ -389,6 +408,59 @@ try {
     }
 }
 
+Invoke-CcodTest 'opens a retained generation read-only and targets it with a generation-three compensation pointer' {
+    $fixture=New-CcodInstallFileFixture
+    $otherFixture=New-CcodInstallFileFixture
+    try {
+        $source=New-CcodSourceFile $fixture 'retained-source.bin' 'retained-runtime-bytes'
+        $old=Open-CcodFixtureGeneration $fixture 'runtime-retained-old';Copy-CcodInstallSealedSource -Generation $old -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null
+        $oldManifest=Write-CcodInstallGenerationManifest -Generation $old -Manifest (New-CcodGenerationManifest 'runtime-retained-old' @([ordered]@{path='payload.bin';length=$source.Length;sha256=$source.Sha256}))
+        Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $old -ExpectedPreviousGeneration ([uint64]0) -FileTransaction $old|Out-Null
+        Close-CcodInstallFileTransaction -Transaction $old -Disposition Ready|Out-Null
+
+        $current=Open-CcodFixtureGeneration $fixture 'runtime-retained-current';Write-CcodInstallGenerationManifest -Generation $current -Manifest (New-CcodGenerationManifest 'runtime-retained-current')|Out-Null
+        Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $current -ExpectedPreviousGeneration ([uint64]1) -FileTransaction $current|Out-Null
+        try{$retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId 'runtime-retained-old' -ExpectedManifestSha256 $oldManifest.Sha256 -FileTransaction $current}catch{$openFailure=$_;try{Close-CcodInstallFileTransaction -Transaction $current -Disposition Failed|Out-Null}catch{};throw $openFailure}
+        Assert-CcodEqual '' (@($retained.PSObject.Properties.Name)-join ',') 'retained generation capability is opaque'
+        Assert-CcodThrows {New-CcodInstallGenerationLeaf -Generation $retained -Leaf 'blocked'|Out-Null} 'CCOD_INSTALL_GENERATION_READ_ONLY'
+        Assert-CcodThrows {Copy-CcodInstallSealedSource -Generation $retained -SourcePath $source.Path -Leaf 'blocked.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null} 'CCOD_INSTALL_GENERATION_READ_ONLY'
+        Assert-CcodThrows {Write-CcodInstallGenerationManifest -Generation $retained -Manifest (New-CcodGenerationManifest 'runtime-retained-old')|Out-Null} 'CCOD_INSTALL_GENERATION_READ_ONLY'
+        Assert-CcodThrows {New-CcodInstallDirectory -Transaction $current -Parent $retained -Leaf 'blocked-dir' -CreateIfMissing|Out-Null} 'CCOD_INSTALL_GENERATION_READ_ONLY'
+        Assert-CcodThrows {Write-CcodInstallRecord -Transaction $current -Parent $retained -Leaf 'blocked.json' -Record ([ordered]@{value='blocked'})|Out-Null} 'CCOD_INSTALL_GENERATION_READ_ONLY'
+        $compensation=Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $retained -ExpectedPreviousGeneration ([uint64]2) -FileTransaction $current
+        Assert-CcodEqual ([uint64]3) ([uint64]$compensation.Generation) 'retained target appends compensation generation three'
+        $pointer=Get-Content -LiteralPath (Join-Path $fixture.Install 'state\active-generation\00000000000000000003.json') -Raw|ConvertFrom-Json
+        Assert-CcodEqual 'runtime-retained-old' $pointer.activeRuntime 'compensation pointer targets retained runtime ID'
+
+        Assert-CcodThrows {Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId 'runtime-missing' -ExpectedManifestSha256 $oldManifest.Sha256 -FileTransaction $current|Out-Null} 'CCOD_INSTALL_RETAINED_GENERATION_INVALID'
+        Assert-CcodThrows {Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId 'runtime-retained-old' -ExpectedManifestSha256 ('0'*64) -FileTransaction $current|Out-Null} 'CCOD_INSTALL_RETAINED_MANIFEST_MISMATCH'
+        $sameRootForeign=Open-CcodFixtureGeneration $fixture 'runtime-same-root-foreign';Write-CcodInstallGenerationManifest -Generation $sameRootForeign -Manifest (New-CcodGenerationManifest 'runtime-same-root-foreign')|Out-Null
+        Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $retained -ExpectedPreviousGeneration ([uint64]3) -FileTransaction $sameRootForeign|Out-Null} 'CCOD_INSTALL_POINTER_TARGET_INVALID'
+        $other=Open-CcodFixtureGeneration $otherFixture 'runtime-other-root';Write-CcodInstallGenerationManifest -Generation $other -Manifest (New-CcodGenerationManifest 'runtime-other-root')|Out-Null
+        Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $otherFixture.Install -TargetGeneration $retained -ExpectedPreviousGeneration ([uint64]0) -FileTransaction $other|Out-Null} 'CCOD_INSTALL_POINTER_TARGET_INVALID'
+    } finally {Remove-CcodInstallFileFixture $fixture;Remove-CcodInstallFileFixture $otherFixture}
+}
+
+Invoke-CcodTest 'rejects structurally invalid or unowned retained generations' {
+    foreach($case in @('reparse','ads','multilink','unowned')){
+        $fixture=New-CcodInstallFileFixture
+        try {
+            $source=New-CcodSourceFile $fixture 'source.bin' 'retained-invalid-source';$runtimeId="runtime-retained-$case";$old=Open-CcodFixtureGeneration $fixture $runtimeId
+            if($case-cne'unowned'){Copy-CcodInstallSealedSource -Generation $old -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null}
+            $manifest=Write-CcodInstallGenerationManifest -Generation $old -Manifest (New-CcodGenerationManifest $runtimeId);Close-CcodInstallFileTransaction -Transaction $old -Disposition Ready|Out-Null
+            $runtimePath=Join-Path $fixture.Install "runtime\$runtimeId"
+            switch($case){
+                'reparse'{New-CcodJunction -Path (Join-Path $runtimePath 'linked') -Target $fixture.Outside;$expected='CCOD_INSTALL_REPARSE_LEAF'}
+                'ads'{[IO.File]::SetAttributes((Join-Path $runtimePath 'payload.bin'),[IO.FileAttributes]::Normal);$previous=$ErrorActionPreference;try{$ErrorActionPreference='Continue';$output=&cmd.exe /d /c "echo attacker>`"$(Join-Path $runtimePath 'payload.bin'):metadata`"" 2>&1;$exitCode=$LASTEXITCODE}finally{$ErrorActionPreference=$previous};if($exitCode-ne0){throw "ADS fixture failed: $($output-join' ')"};$expected='CCOD_INSTALL_ADS_LEAF'}
+                'multilink'{New-CcodHardLink -Path (Join-Path $fixture.Outside 'retained-hardlink.bin') -Existing (Join-Path $runtimePath 'payload.bin');$expected='CCOD_INSTALL_MULTILINK_LEAF'}
+                'unowned'{[IO.Directory]::CreateDirectory((Join-Path $fixture.Install 'runtime\runtime-unowned'))|Out-Null;[IO.File]::Copy((Join-Path $runtimePath 'manifest.json'),(Join-Path $fixture.Install 'runtime\runtime-unowned\manifest.json'));$runtimeId='runtime-unowned';$expected='CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH'}
+            }
+            $transaction=Open-CcodFixtureGeneration $fixture ("runtime-validator-$case");Write-CcodInstallGenerationManifest -Generation $transaction -Manifest (New-CcodGenerationManifest ("runtime-validator-$case"))|Out-Null
+            Assert-CcodThrows {Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $transaction|Out-Null} $expected
+        } finally {Remove-CcodInstallFileFixture $fixture}
+    }
+}
+
 Invoke-CcodTest 'retirement writes one create-only record and keeps the nonempty generation in place' {
     $fixture=New-CcodInstallFileFixture
     try {

From 14178fc834f691489d167a3abb3d34e8af98d055 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sat, 29 Aug 2026 22:19:13 +0800
Subject: [PATCH 078/187] fix: close retained generation capability gaps

---
 .../task-1-report.md                          | 482 ++++++++++++++++++
 .../modules/InstallFileTransaction.psm1       |  45 +-
 .../InstallFileTransaction.SelfTest.ps1       |  74 ++-
 3 files changed, 577 insertions(+), 24 deletions(-)
 create mode 100644 .superpowers/sdd/2026-08-29-v2522-immutable-generation/task-1-report.md

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-1-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-1-report.md
new file mode 100644
index 0000000..3b8176d
--- /dev/null
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-1-report.md
@@ -0,0 +1,482 @@
+# Task 1 report: immutable generation file layer
+
+## Status
+
+Implemented and committed the unprivileged immutable-generation data plane in
+the assigned worktree. No release, push, tag, signing, installer execution,
+product process control, WindowsApps change, DPAPI change, or persistent DACL
+mutation was performed.
+
+## RED evidence
+
+- Command: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Exit code: `1`
+- Expected failure: the old module exported the pinned/DACL transaction API;
+  the required seven immutable-generation operations were absent.
+- Additional retirement immutability RED: the same focused command exited `1`
+  because a retired capability could still create `post-retire.bin`; GREEN now
+  rejects it with `CCOD_INSTALL_GENERATION_RETIRED`.
+
+## GREEN and verification evidence
+
+- Focused command: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Exit code: `0`
+- Result: `10/10` named cases passed, including duplicate generation/leaf and
+  pointer generation collisions, private pinned source/destination handles,
+  flush plus same-handle length/SHA-256, manifest immutability, reparse/ADS/
+  multilink rejection, forged/cross-transaction/closed capabilities, handle
+  release, no-replace monotonic pointer records, and nonempty retirement.
+- Parser command: explicit PowerShell parser pass over the four changed files.
+- Parser exit code: `0` (`Changed PowerShell parser check passed.`)
+- Diff command: `git diff --check`
+- Diff exit code: `0` (only Git LF-to-CRLF checkout warnings).
+
+## Aggregate evidence and known local limitation
+
+- Command: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\PersistenceSelfTest.ps1`
+- Exit code: `1`
+- Exact boundary: `Bootstrap.SelfTest.ps1`, case
+  `selects-previous-runtime-after-active-exits-before-ready-and-swaps-pointer`,
+  error `ASSERT_EXACT`.
+- Command: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\Validate.ps1 -SkipInstalledPackageCheck`
+- Exit code: `1`
+- Exact top-level marker: `CCOD_VALIDATION_FAILURE[0] Persistence self-test
+  failed with exit code 1; CCOD_SELFTEST_FAILED case=selects-previous-runtime-
+  after-active-exits-before-ready-and-swaps-pointer error=ASSERT_EXACT`.
+- Classification: the task brief's known local Bootstrap fallback/mutex
+  aggregate boundary. It is recorded as environmental and is not reported as
+  a pass. The focused file-layer suite and changed-file parser checks pass.
+
+## Windows behavior
+
+- Generation and directory leaves use relative `NtCreateFile` `FILE_CREATE`
+  semantics below validated native parent handles.
+- Sealed sources are opened without write/delete sharing; destinations are
+  created once, flushed, rehashed through the same handle, then handed off to
+  read-only pins without exposing streams or handles.
+- Active pointer records are append-only, zero-padded generation files written
+  to unique temporary leaves and atomically renamed without replacement.
+- Retirement validates the entire owned tree, retains the generation root
+  handle while descendant handles close, then performs one no-replace relative
+  rename into `retired\<runtimeId>.<unique-id>`. Bytes and the original SDDL
+  remain unchanged; a create-only retirement record is retained.
+- The only exported CLR type is the inert `CcodInstallCapabilityMarker`; all
+  path/handle operations remain on an internal type. PowerShell capabilities
+  have no public fields and are bound through module-private weak tables.
+
+## Commit
+
+- `e3ad4f703884ed6893f89565b2bcdc925977a37d` — `fix: use immutable generation file primitives`
+
+## Concerns
+
+- This is deliberately a current-user ordinary-race boundary, not protection
+  against a same-user process with unrestricted DACL/write authority.
+- The append-only pointer reader/consumer migration and complete manifest
+  semantic validation belong to later plan tasks; Task 1 enforces create-only
+  storage, manifest presence, owned runtime identity, and monotonic record
+  collision behavior.
+- Failed no-replace record publication can retain a unique `.ccod.*.tmp` leaf
+  for diagnosis; there is intentionally no install-hot-path recursive cleanup.
+
+## Fix round 1 — review remediation
+
+This section supersedes the original report's description of physical
+generation retirement. Retirement is now record-only; the nonempty generation
+is never renamed or deleted.
+
+### RED evidence
+
+- Command: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Exit code: `1`
+- Exact first failure: case
+  `force-re-import-rebinds-the-current-runtime-ABI-before-real-use`; after two
+  `Import-Module -Force` calls, real `Open-CcodInstallGeneration` failed because
+  `$script:CcodRuntimeType` was unset (`VariableIsUndefined`).
+
+### GREEN evidence
+
+- Command: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Exit code: `0`
+- Result: `13/13` named cases passed. New coverage proves:
+  - ABI v2 rebinding works after two forced imports and a real create;
+  - a 16-worker write/name-exchange attack during handle handoff either leaves
+    a final strict handle revalidated for identity/length/SHA-256 or causes a
+    stable seal failure that cannot commit;
+  - successful sealed leaves remain readable by path before transaction close;
+  - close races a real synchronized CLR relative create and releases source,
+    destination, generation, and retained diagnostic temporary handles;
+  - pointer generation `1 -> 2`, UInt64 overflow rejection, and two independent
+    Windows PowerShell contenders with exactly one no-replace winner;
+  - record-only retirement, collision, record-path I/O failure, post-retirement
+    mutation rejection, and repeated in-transaction idempotence.
+- Reliability rerun: three consecutive expanded focused runs exited `0`.
+- Parser command: explicit parser pass over the four Task 1 PowerShell files.
+- Parser exit code: `0` (`Changed PowerShell parser check passed.`)
+- Diff command: `git diff --check`
+- Diff exit code: `0` (only LF-to-CRLF checkout warnings).
+
+### Aggregate evidence
+
+- `tests\PersistenceSelfTest.ps1`: exit `1` at the unchanged known local case
+  `selects-previous-runtime-after-active-exits-before-ready-and-swaps-pointer`,
+  error `ASSERT_EXACT`.
+- `tests\Validate.ps1 -SkipInstalledPackageCheck`: exit `1` with the same
+  `CCOD_VALIDATION_FAILURE[0]` Bootstrap marker.
+- These aggregate results remain environmental boundaries and are not called a
+  pass. The expanded immutable-generation suite exits zero.
+
+### Windows behavior after remediation
+
+- The current CLR bridge uses `CcodInstallGenerationCapabilityMarkerV2` ABI 2;
+  every module import resolves the marker and rebinds the internal runtime type
+  even when the AppDomain already contains it.
+- Destination handoff opens a temporary read bridge only while the private
+  verified writer still pins the identity. After writer close it opens the
+  strict read handle and immediately rechecks file identity, final path, plain
+  file/stream/link invariants, length, and SHA-256 on that same strict handle.
+- Retirement creates exactly
+  `state\retired-generations\<runtimeId>.json` through the atomic no-replace
+  record path. The original `runtime\<runtimeId>` tree and handles remain in
+  place. State changes to retired only after record publication succeeds.
+- `ExpectedPreviousGeneration = UInt64.MaxValue` fails before addition with
+  `CCOD_INSTALL_POINTER_GENERATION_OVERFLOW`.
+
+### Fix commit
+
+- `90d9d8d6f4aa851073fb8973a47ac0c9c0f18b7d` — `fix: close immutable generation review gaps`
+
+### Remaining concerns
+
+- Retirement idempotence is guaranteed for repeated calls using the same live
+  opaque transaction. Cross-process crash reconciliation and consumption of
+  retired-generation records belong to the later lifecycle/state migration.
+- A failed no-replace collision deliberately retains its unique temporary
+  record for diagnosis; `Close-CcodInstallFileTransaction` releases its handle,
+  and no recursive cleanup is added.
+
+## Fix round 2 — temp-before-validation and commit-final publication
+
+This section supersedes the fix-round-1 handoff description. No final
+generation leaf, manifest, pointer record, or retirement record is created
+before its private temporary object has completed copy/write, durable flush,
+plain-file validation, length verification, and SHA-256 verification.
+
+### RED evidence
+
+- Command: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Exit code: `1`
+- Exact failure: case
+  `requested-final-leaf-is-absent-until-private-temporary-bytes-are-sealed`.
+  A concurrent ordinary path reader observed requested `payload.bin` at length
+  `0` while the expected sealed length was `22020096` bytes.
+
+### GREEN evidence
+
+- Command: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Exit code: `0`
+- Result: `15/15` named cases passed. The two added regressions prove:
+  - the first observable requested final leaf already has the exact sealed
+    length and SHA-256, while no successful `.ccod.*.tmp` name remains; and
+  - a source-hash failure publishes no final leaf, the source stream is owned
+    by the transaction until `Close(Failed)`, and all private temp handles are
+    released deterministically.
+- Reliability evidence: three consecutive expanded focused runs exited `0`;
+  the final post-change focused run also exited `0`.
+- Parser command: explicit parser pass over the four Task 1 PowerShell files.
+- Parser exit code: `0` (`Changed PowerShell parser check passed.`)
+- Diff command: `git diff --check`
+- Diff exit code: `0` (only LF-to-CRLF checkout warnings).
+
+### Aggregate evidence
+
+- `tests\PersistenceSelfTest.ps1`: exit `1` at the unchanged known local case
+  `selects-previous-runtime-after-active-exits-before-ready-and-swaps-pointer`,
+  error `ASSERT_EXACT`.
+- `tests\Validate.ps1 -SkipInstalledPackageCheck`: exit `1` with the same
+  `CCOD_VALIDATION_FAILURE[0]` Bootstrap marker.
+- These aggregates remain environmental boundaries and are not called passes.
+
+### Windows behavior after round 2
+
+- `Copy` opens and transaction-registers its source before length/hash I/O and
+  creates a generated `.ccod.<guid>.tmp` destination registered before copy,
+  flush, or hash can throw.
+- `Write` uses the identical private-temp path for manifest, pointer, and
+  retirement JSON records.
+- `SealAndPublish` closes the private writer under the unguessable temp name,
+  reopens and verifies that temp through a strict read handle, closes it,
+  opens the validated rename handle, applies the read-only file attribute,
+  pre-registers the final dictionary key, and performs one native no-replace
+  relative rename. After rename success it performs no open, flush, hash,
+  stream handoff, or result allocation.
+- Native `Write` returns an existing token rather than allocating an array
+  after publication. PowerShell copy/manifest/pointer/retirement result objects
+  and retirement capability are prepared before the native commit.
+- Before pointer eligibility or retirement, `EnsurePublishedPin` reopens every
+  published generation file by relative handle and revalidates identity, final
+  path, link/stream type, length, and SHA-256; the read handle then becomes
+  transaction-owned.
+- Retirement remains exactly one create-only
+  `state\retired-generations\<runtimeId>.json` record. The in-memory retired
+  transition occurs only after the native record publication returns success.
+
+### Fix commit
+
+- `e74cfdf28fa05c2b0f8c61634b6542f41e734f45` — `fix: seal temporary leaves before publication`
+
+### Remaining concerns
+
+- Between copy publication and later pointer/retirement eligibility checks,
+  an unrestricted same-user writer can clear the read-only attribute or rename
+  the file. That actor is outside the approved unprivileged boundary; the
+  eligibility path nevertheless reopens and rejects any identity/path/hash or
+  unknown-leaf change before writing the control record.
+- Failed no-replace publication retains a read-only diagnostic temp file but
+  no stream handle. It is intentionally not recursively reclaimed in the
+  install hot path.
+
+## Fix round 2 scoped re-review — terminal retirement commit and exception-safe close
+
+### RED evidence
+
+- Command: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Exit code: `1`
+- Exact failing case:
+  `close-retries-a-failing-disposal-and-releases-every-other-registered-resource`.
+  An injected first `FileStream.Dispose` exception stopped cleanup; the
+  generation directory remained locked, and fixture cleanup failed with
+  `The process cannot access the file ... because it is being used by another
+  process.` This also proved a later close was short-circuited by the runtime's
+  already-disposed flag.
+
+### GREEN evidence
+
+- Command: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Exit code: `0`
+- Result: `16/16` named cases passed. The new deterministic disposal regression
+  registers an injected throwing stream plus a real source, destination, and
+  generation tree. It proves:
+  - the first close attempts the throwing stream once and returns the stable,
+    sanitized `CCOD_INSTALL_CLOSE_FAILED`;
+  - the same first close continues to release the source and every generation
+    pin, so both can be moved immediately; and
+  - the second close retries the retained failed resource (attempt count 2)
+    and reports the same bounded cleanup code rather than returning early.
+- Reliability evidence: three consecutive expanded focused runs exited `0`.
+- Parser command: explicit parser pass over the four Task 1 PowerShell files.
+- Parser exit code: `0` (`Changed PowerShell parser check passed.`)
+- Diff command: `git diff --check`
+- Diff exit code: `0` (only LF-to-CRLF checkout warnings).
+
+### Aggregate evidence
+
+- `tests\PersistenceSelfTest.ps1`: exit `1` at the unchanged known local case
+  `selects-previous-runtime-after-active-exits-before-ready-and-swaps-pointer`,
+  error `ASSERT_EXACT`.
+- `tests\Validate.ps1 -SkipInstalledPackageCheck`: exit `1` with the same
+  `CCOD_VALIDATION_FAILURE[0]` Bootstrap marker.
+- These aggregates remain environmental boundaries and are not called passes.
+
+### Implementation behavior
+
+- Native `Retire` now completes all generation/tree validation before calling
+  the shared temp-record publisher. After the no-replace retirement-record
+  rename, it immediately returns the already-existing generation token; the
+  previous post-publication `ValidateCurrent(generation)` call is removed.
+- The PowerShell retirement capability and bounded result are allocated before
+  the native record commit. Only after native success are the prepared result
+  stored and the private `Retired` flag set. Collision/write failure leaves
+  those state fields unchanged.
+- Native `Close` snapshots and attempts every registered external stream and
+  pin independently. Successfully released pins are removed; failures remain
+  registered for retry. The runtime is closed to further operations from the
+  first attempt onward, but subsequent cleanup calls still process retained
+  failures.
+- `Pin.Dispose` marks a pin closed only after its handle/stream disposal
+  succeeds, allowing a genuine failed release to be retried.
+- The exported close wrapper records deterministic closed/cleanup-failed state
+  and always maps internal cleanup exceptions to the fixed
+  `CCOD_INSTALL_CLOSE_FAILED` message.
+
+### Fix commit
+
+- `f86d4397b4a56343db9124f655c923949e6084c0` — `fix: finalize retirement and close cleanup`
+
+### Remaining concerns
+
+- A resource whose `Dispose` permanently fails remains intentionally registered
+  and each later `Close` reports `CCOD_INSTALL_CLOSE_FAILED`; all other
+  resources are nevertheless released. No recursive deletion or DACL fallback
+  is attempted.
+
+## Fix round 3 — retained-generation targets and scoped records
+
+### RED evidence
+
+- Command: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Exit code: `1`
+- Exact first failure: the export-surface case expected
+  `Open-CcodInstallRetainedGeneration`, `New-CcodInstallDirectory`, and
+  `Write-CcodInstallRecord`, but the current module exported none of them and
+  pointer commit still accepted a naked runtime ID.
+
+### GREEN evidence
+
+- Command: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Exit code: `0`
+- Result: `19/19` named cases passed. Added deterministic coverage proves:
+  - install-root `state` and nested `receipts` directories can be opened or
+    created only through opaque same-transaction scopes and single-segment
+    leaves;
+  - JSON/JSONL records use the private-temp publisher, are complete on first
+    visibility, collide without replacement, and reject multi-segment leaves;
+  - an existing generation is recursively opened read-only only when its final
+    path, complete structural tree, manifest hash, and manifest runtime ID
+    match; missing/wrong-hash/reparse/ADS/multilink/unowned fixtures fail with
+    stable codes;
+  - every create/write operation rejects a retained capability;
+  - pointer generations 1 and 2 can be followed by a generation-3 compensation
+    record targeting the retained old runtime;
+  - retained targets from a different transaction on the same root or a
+    different install root are rejected; and
+  - forced module re-import remains active before all new exported operations.
+- Reliability evidence: three consecutive expanded focused runs exited `0`;
+  the final pre-commit focused run also exited `0`.
+- Parser command: explicit parser pass over the four Task 1 PowerShell files.
+- Parser exit code: `0` (`Changed PowerShell parser check passed.`)
+- Diff command: `git diff --check`
+- Diff exit code: `0` (only LF-to-CRLF checkout warnings).
+
+### Aggregate evidence
+
+- `tests\PersistenceSelfTest.ps1`: exit `1` at the unchanged known local case
+  `selects-previous-runtime-after-active-exits-before-ready-and-swaps-pointer`,
+  error `ASSERT_EXACT`.
+- `tests\Validate.ps1 -SkipInstalledPackageCheck`: exit `1` with the same
+  `CCOD_VALIDATION_FAILURE[0]` Bootstrap marker.
+- These aggregates remain environmental boundaries and are not called passes.
+
+### Interface behavior
+
+- `Open-CcodInstallRetainedGeneration` is tied to an existing writable file
+  transaction. Native code opens the existing `runtime\<runtimeId>` root and
+  every descendant through relative read-only handles, rejects reparse/ADS/
+  multilink/final-path changes, hashes each file, verifies the exact manifest
+  hash and uniquely matching manifest runtime ID, and then issues an opaque
+  generation scope marked `ReadOnly`.
+- Retained scopes may be used only as `TargetGeneration`; directory creation,
+  source copy, manifest write, and scoped record write all fail with
+  `CCOD_INSTALL_GENERATION_READ_ONLY`.
+- `Commit-CcodInstallActivePointer` no longer accepts `NewRuntimeId`. It derives
+  the target runtime ID only from a same-transaction opaque generation scope
+  and revalidates either the owned new tree or the retained read-only tree
+  before its monotonic no-replace pointer record.
+- `New-CcodInstallDirectory` treats the opaque transaction itself as the
+  install-root parent and composes native single-leaf open/create for bounded
+  state directories. Returned child capabilities are recursively composable.
+- `Write-CcodInstallRecord` accepts only a same-transaction writable directory,
+  sanitized record object, and single-segment leaf; it shares the existing
+  temp-before-validation/no-replace publisher.
+- Native directory enumeration now removes duplicate names returned across
+  repeated `NtQueryDirectoryFile` buffers before retained-tree pin creation.
+
+### Fix commit
+
+- `c1e3ef08f0c820db79872f8438d66d1ced94eeba` — `feat: add retained generation file capabilities`
+
+### Remaining concerns
+
+- Retained manifest runtime-ID validation is intentionally narrow and is also
+  bound to the caller-supplied exact manifest SHA-256. Full manifest schema,
+  file-list, version, and commit semantics remain the Task 2/RuntimeManifest
+  consumer's responsibility.
+- This round adds only Task 1 file-layer capabilities; no lifecycle module or
+  installer path was migrated.
+
+## Retained-capability extension fix — transitive read-only and ABI V3
+
+### RED evidence
+
+The self-test supports `CCOD_INSTALL_EXTENSION_RED_CASE` only to select one
+deterministic regression while preserving all earlier focused cases. Each
+targeted command used:
+
+```powershell
+$env:CCOD_INSTALL_EXTENSION_RED_CASE='<case>'
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1
+```
+
+All five targeted RED runs exited `1` for their intended production gap:
+
+- `retained-alias`: `ASSERT_THROWS`, expected
+  `CCOD_INSTALL_GENERATION_READ_ONLY`; an alias reopened through
+  transaction-root `runtime\<retained-id>` remained writable.
+- `nested-retained`: `CCOD_INSTALL_RETAINED_GENERATION_INVALID`, message
+  `retained open failed: Access is denied`; nested retained directories lacked
+  directory-listing access.
+- `semantic-runtime-id`: `ASSERT_THROWS`, expected
+  `CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH`; regex matching accepted a nested
+  `metadata.runtimeId` without a matching top-level property.
+- `child-transaction`: `ASSERT_THROWS`, expected
+  `CCOD_INSTALL_TRANSACTION_INVALID`; a child directory capability was
+  accepted as `-FileTransaction`.
+- `v3-reimport`: `TypeNotFound` for
+  `CcodInstallGenerationCapabilityMarkerV3`; re-import still bound ABI V2.
+
+The unfiltered required command also exited `1`; its first new failure was the
+retained-alias `CCOD_INSTALL_GENERATION_READ_ONLY` assertion.
+
+### GREEN evidence
+
+- The same five targeted commands each exited `0`.
+- Full command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Full focused exit code: `0`.
+- Result: `24/24` named cases passed.
+- Parser command: explicit PowerShell parser pass over
+  `InstallFileTransaction.psm1` and
+  `InstallFileTransaction.SelfTest.ps1`.
+- Parser exit code: `0` (`TASK1_PARSER_EXIT=0`).
+- Diff command:
+  `git diff --check -- src/persistence/modules/InstallFileTransaction.psm1 tests/persistence/InstallFileTransaction.SelfTest.ps1`
+- Diff exit code: `0` (only LF-to-CRLF checkout warnings).
+
+### Aggregate evidence
+
+- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\PersistenceSelfTest.ps1`
+  exited `1` at the unchanged known local case
+  `selects-previous-runtime-after-active-exits-before-ready-and-swaps-pointer`,
+  error `ASSERT_EXACT`.
+- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\Validate.ps1 -SkipInstalledPackageCheck`
+  exited `1` with the same `CCOD_VALIDATION_FAILURE[0]` Bootstrap marker.
+- These aggregates remain environmental boundaries and are not called passes.
+
+### Implementation behavior
+
+- The current CLR bridge is
+  `CcodInstallGenerationCapabilityMarkerV3` / internal runtime V3 with ABI 3.
+  Every import resolves and binds V3 even when the AppDomain already contains
+  the old V2 marker.
+- Native `retainedScopes` covers the retained generation and every descendant
+  token. Directory opens propagate read-only state from a retained parent and
+  also recognize a retained root reopened from the transaction-root alias.
+  The PowerShell wrapper asks native `IsRetained` for each returned directory,
+  so all exported create/write routes fail closed with
+  `CCOD_INSTALL_GENERATION_READ_ONLY`.
+- Nested retained child directories are pinned with
+  `LIST_DIRECTORY | READ_ATTRIBUTES | SYNCHRONIZE`, while files remain
+  read-only. Recursive final-path, reparse, ADS, multilink, identity, length,
+  and SHA-256 validation remains intact.
+- Native code returns the exact hash-bound manifest text. The wrapper parses it
+  with `ConvertFrom-Json`, requires a top-level object and exactly one
+  top-level `runtimeId` string equal to the requested ID, and rejects escaped
+  or nested-only occurrences.
+- `Open-CcodInstallRetainedGeneration` requires the supplied
+  `-FileTransaction` object itself to be the transaction-root capability;
+  child directory capabilities fail with `CCOD_INSTALL_TRANSACTION_INVALID`.
+
+### Scope note
+
+- The paused uncommitted Task 2 changes in `InstallLifecycle.psm1` and
+  `InstallLifecycle.SelfTest.ps1` were neither edited nor staged by this fix.
diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index 1be356b..b0ebd33 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -9,7 +9,7 @@ function Throw-CcodInstallFileError {
 }
 
 function Initialize-CcodInstallRuntime {
-    $marker = 'CcodInstallGenerationCapabilityMarkerV2' -as [type]
+    $marker = 'CcodInstallGenerationCapabilityMarkerV3' -as [type]
     if ($null -eq $marker) {
         Add-Type -TypeDefinition @'
 using System;
@@ -20,16 +20,15 @@ using System.Runtime.CompilerServices;
 using System.Runtime.InteropServices;
 using System.Security.Cryptography;
 using System.Text;
-using System.Text.RegularExpressions;
 using Microsoft.Win32.SafeHandles;
 
-public sealed class CcodInstallGenerationCapabilityMarkerV2
+public sealed class CcodInstallGenerationCapabilityMarkerV3
 {
-    private CcodInstallGenerationCapabilityMarkerV2() { }
-    public static int CapabilityAbi { get { return 2; } }
+    private CcodInstallGenerationCapabilityMarkerV3() { }
+    public static int CapabilityAbi { get { return 3; } }
 }
 
-internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
+internal sealed class CcodInstallGenerationRuntimeV3 : IDisposable
 {
     private const uint READ = 0x80000000, WRITE = 0x40000000, DELETE = 0x00010000, SYNC = 0x00100000;
     private const uint READ_ATTRIBUTES = 0x80, WRITE_ATTRIBUTES = 0x100, LIST_DIRECTORY = 0x1, ADD_FILE = 0x2, ADD_SUBDIRECTORY = 0x4;
@@ -80,13 +79,14 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
     private readonly Dictionary<object,Pin> pins = new Dictionary<object,Pin>(ReferenceComparer.Instance);
     private readonly Dictionary<string,Pin> names = new Dictionary<string,Pin>(StringComparer.OrdinalIgnoreCase);
     private readonly HashSet<object> retainedRoots = new HashSet<object>(ReferenceComparer.Instance);
+    private readonly HashSet<object> retainedScopes = new HashSet<object>(ReferenceComparer.Instance);
     private readonly List<FileStream> externalStreams = new List<FileStream>();
     private bool disposed; private string cleanupError;
 
-    private CcodInstallGenerationRuntimeV2(string installRoot,Pin root,Pin runtimeParent)
+    private CcodInstallGenerationRuntimeV3(string installRoot,Pin root,Pin runtimeParent)
     { this.installRoot=installRoot;this.root=root;this.runtimeParent=runtimeParent;AddPin(root);AddPin(runtimeParent); }
 
-    internal static object Open(string path,string runtimeId,out CcodInstallGenerationRuntimeV2 runtime)
+    internal static object Open(string path,string runtimeId,out CcodInstallGenerationRuntimeV3 runtime)
     {
         runtime=null;string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle rootHandle=OpenAbsoluteDirectory(full,true);Pin rootPin=null,runtimePin=null;
         try
@@ -101,7 +101,7 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
             try
             {
                 Pin generation=ValidateDirectoryPin(runtimePin,runtimeId,Path.Combine(runtimePin.Path,runtimeId),true,generationResult.Handle);generationResult.Handle=null;
-                runtime=new CcodInstallGenerationRuntimeV2(full,rootPin,runtimePin);rootPin=null;runtimePin=null;runtime.AddPin(generation);return generation.Token;
+                runtime=new CcodInstallGenerationRuntimeV3(full,rootPin,runtimePin);rootPin=null;runtimePin=null;runtime.AddPin(generation);return generation.Token;
             }
             finally { if(generationResult.Handle!=null)generationResult.Handle.Dispose(); }
         }
@@ -117,23 +117,24 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object OpenDirectory(object parentToken,string leaf,bool createIfMissing)
     {
-        Pin parent=Require(parentToken,true);ValidateCurrent(parent);Pin known;if(names.TryGetValue(Key(parent,leaf),out known)){ValidateCurrent(known);return known.Token;}OpenResult result;
+        Pin parent=Require(parentToken,true);ValidateCurrent(parent);Pin known;if(names.TryGetValue(Key(parent,leaf),out known)){ValidateCurrent(known);if(retainedScopes.Contains(parentToken)||retainedRoots.Contains(known.Token))MarkRetainedTree(known);return known.Token;}OpenResult result;
         if(createIfMissing){try{result=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,CREATE,DIRECTORY|BACKUP_INTENT);}catch(Win32Exception exception){if(exception.NativeErrorCode!=80&&exception.NativeErrorCode!=183)throw;result=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);}}
         else result=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);
-        try{Pin pin=ValidateDirectoryPin(parent,leaf,Path.Combine(parent.Path,leaf),result.Created,result.Handle);result.Handle=null;AddPin(pin);return pin.Token;}finally{if(result.Handle!=null)result.Handle.Dispose();}
+        try{Pin pin=ValidateDirectoryPin(parent,leaf,Path.Combine(parent.Path,leaf),result.Created,result.Handle);result.Handle=null;AddPin(pin);if(retainedScopes.Contains(parentToken))retainedScopes.Add(pin.Token);return pin.Token;}finally{if(result.Handle!=null)result.Handle.Dispose();}
     }
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object GetInstallRoot(){if(disposed)throw new ObjectDisposedException("transaction");ValidateCurrent(root);return root.Token;}
+    [MethodImpl(MethodImplOptions.Synchronized)] internal bool IsRetained(object token){if(disposed)throw new ObjectDisposedException("transaction");return token!=null&&retainedScopes.Contains(token);}
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object OpenRetained(string runtimeId,string expectedManifestSha)
     {
-        if(disposed)throw new ObjectDisposedException("transaction");Pin existing;if(names.TryGetValue(Key(runtimeParent,runtimeId),out existing)){if(!retainedRoots.Contains(existing.Token))throw new InvalidDataException("retained generation already scoped");ValidateRetainedTree(existing);ValidateRetainedManifest(existing,runtimeId,expectedManifestSha);return existing.Token;}OpenResult result=OpenRelative(runtimeParent.Native,runtimeId,LIST_DIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);List<Pin> added=new List<Pin>();
+        if(disposed)throw new ObjectDisposedException("transaction");Pin existing;if(names.TryGetValue(Key(runtimeParent,runtimeId),out existing)){if(!retainedRoots.Contains(existing.Token))throw new InvalidDataException("retained generation already scoped");ValidateRetainedTree(existing);return new object[]{existing.Token,ValidateRetainedManifest(existing,expectedManifestSha)};}OpenResult result=OpenRelative(runtimeParent.Native,runtimeId,LIST_DIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);List<Pin> added=new List<Pin>();
         try
         {
             Pin candidate=ValidateDirectoryPin(runtimeParent,runtimeId,Path.Combine(runtimeParent.Path,runtimeId),false,result.Handle);result.Handle=null;Pin generation;if(names.TryGetValue(Key(runtimeParent,runtimeId),out generation)){candidate.Dispose();}else{generation=candidate;AddPin(generation);added.Add(generation);}OpenRetainedTree(generation,added);
-            ValidateRetainedManifest(generation,runtimeId,expectedManifestSha);ValidateRetainedTree(generation);retainedRoots.Add(generation.Token);return generation.Token;
+            string manifestText=ValidateRetainedManifest(generation,expectedManifestSha);ValidateRetainedTree(generation);retainedRoots.Add(generation.Token);MarkRetainedTree(generation);return new object[]{generation.Token,manifestText};
         }
-        catch(Exception exception){for(int i=added.Count-1;i>=0;i--){Pin pin=added[i];if(pin.Parent!=null)names.Remove(Key(pin.Parent,pin.Leaf));pins.Remove(pin.Token);try{pin.Dispose();}catch{}}throw new InvalidDataException("retained open failed: "+exception.Message,exception);}
+        catch(Exception exception){for(int i=added.Count-1;i>=0;i--){Pin pin=added[i];retainedScopes.Remove(pin.Token);if(pin.Parent!=null)names.Remove(Key(pin.Parent,pin.Leaf));pins.Remove(pin.Token);try{pin.Dispose();}catch{}}throw new InvalidDataException("retained open failed: "+exception.Message,exception);}
         finally{if(result.Handle!=null)result.Handle.Dispose();}
     }
 
@@ -198,10 +199,11 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
     {
         foreach(string leaf in Enumerate(directory.Native))
         {
-            OpenResult probe=OpenRelative(directory.Native,leaf,READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,BACKUP_INTENT);try{FILE_INFO info=Info(probe.Handle);if((info.FileAttributes&ATTR_REPARSE)!=0)throw new InvalidDataException("reparse leaf");string path=Path.Combine(directory.Path,leaf);if(IsDirectory(info)){if(!OnlyDefaultStream(probe.Handle)||!SamePath(FinalPath(probe.Handle),path))throw new InvalidDataException("directory invalid");Pin child=new Pin(directory,leaf,path,true,false,probe.Handle,null,info);probe.Handle=null;AddPin(child);added.Add(child);OpenRetainedTree(child,added);}else{probe.Handle.Dispose();probe.Handle=null;OpenResult file=OpenRelative(directory.Native,leaf,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,OPEN,NON_DIRECTORY);FileStream stream=null;try{stream=new FileStream(file.Handle,FileAccess.Read,65536,false);file.Handle=null;FILE_INFO fileInfo=Info(stream.SafeFileHandle);ValidatePlain(fileInfo,stream.SafeFileHandle);if(!SamePath(FinalPath(stream.SafeFileHandle),path))throw new InvalidDataException("pin changed");Pin child=new Pin(directory,leaf,path,false,false,null,stream,fileInfo);child.SealedLength=stream.Length;child.SealedSha=Sha(stream);child.Sealed=true;child.Published=true;AddPin(child);added.Add(child);stream=null;}finally{if(stream!=null)stream.Dispose();if(file.Handle!=null)file.Handle.Dispose();}}}finally{if(probe.Handle!=null)probe.Handle.Dispose();}}
+            OpenResult probe=OpenRelative(directory.Native,leaf,READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,BACKUP_INTENT);try{FILE_INFO info=Info(probe.Handle);if((info.FileAttributes&ATTR_REPARSE)!=0)throw new InvalidDataException("reparse leaf");string path=Path.Combine(directory.Path,leaf);if(IsDirectory(info)){probe.Handle.Dispose();probe.Handle=null;OpenResult childDirectory=OpenRelative(directory.Native,leaf,LIST_DIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);try{FILE_INFO childInfo=Info(childDirectory.Handle);if(!IsDirectory(childInfo)||(childInfo.FileAttributes&ATTR_REPARSE)!=0||!OnlyDefaultStream(childDirectory.Handle)||!SamePath(FinalPath(childDirectory.Handle),path))throw new InvalidDataException("directory invalid");Pin child=new Pin(directory,leaf,path,true,false,childDirectory.Handle,null,childInfo);childDirectory.Handle=null;AddPin(child);added.Add(child);retainedScopes.Add(child.Token);OpenRetainedTree(child,added);}finally{if(childDirectory.Handle!=null)childDirectory.Handle.Dispose();}}else{probe.Handle.Dispose();probe.Handle=null;OpenResult file=OpenRelative(directory.Native,leaf,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,OPEN,NON_DIRECTORY);FileStream stream=null;try{stream=new FileStream(file.Handle,FileAccess.Read,65536,false);file.Handle=null;FILE_INFO fileInfo=Info(stream.SafeFileHandle);ValidatePlain(fileInfo,stream.SafeFileHandle);if(!SamePath(FinalPath(stream.SafeFileHandle),path))throw new InvalidDataException("pin changed");Pin child=new Pin(directory,leaf,path,false,false,null,stream,fileInfo);child.SealedLength=stream.Length;child.SealedSha=Sha(stream);child.Sealed=true;child.Published=true;AddPin(child);added.Add(child);retainedScopes.Add(child.Token);stream=null;}finally{if(stream!=null)stream.Dispose();if(file.Handle!=null)file.Handle.Dispose();}}}finally{if(probe.Handle!=null)probe.Handle.Dispose();}}
     }
     private void ValidateRetainedTree(Pin directory){ValidateCurrent(directory);foreach(string leaf in Enumerate(directory.Native)){Pin child;if(!names.TryGetValue(Key(directory,leaf),out child))throw new InvalidDataException("unknown retained leaf");if(child.Directory)ValidateRetainedTree(child);else{ValidateCurrent(child);if(child.Stream.Length!=child.SealedLength||Sha(child.Stream)!=child.SealedSha)throw new InvalidDataException("seal mismatch");}}}
-    private void ValidateRetainedManifest(Pin generation,string runtimeId,string expectedManifestSha){Pin manifest;if(!names.TryGetValue(Key(generation,"manifest.json"),out manifest)||manifest.Directory)throw new InvalidDataException("retained manifest missing");if(manifest.SealedSha!=expectedManifestSha)throw new InvalidDataException("retained manifest mismatch");string text=ReadText(manifest.Stream);string propertyPattern="\\\"runtimeId\\\"\\s*:";string valuePattern=propertyPattern+"\\s*\\\""+Regex.Escape(runtimeId)+"\\\"";if(Regex.Matches(text,propertyPattern).Count!=1||Regex.Matches(text,valuePattern).Count!=1)throw new InvalidDataException("retained runtime id mismatch");}
+    private string ValidateRetainedManifest(Pin generation,string expectedManifestSha){Pin manifest;if(!names.TryGetValue(Key(generation,"manifest.json"),out manifest)||manifest.Directory)throw new InvalidDataException("retained manifest missing");if(manifest.SealedSha!=expectedManifestSha)throw new InvalidDataException("retained manifest mismatch");return ReadText(manifest.Stream);}
+    private void MarkRetainedTree(Pin directory){retainedScopes.Add(directory.Token);foreach(Pin pin in pins.Values)if(!pin.Closed&&pin.Path.StartsWith(directory.Path.TrimEnd('\\')+"\\",StringComparison.OrdinalIgnoreCase))retainedScopes.Add(pin.Token);}
     private static string ReadText(FileStream stream){if(stream.Length>4194304)throw new InvalidDataException("retained manifest too large");long position=stream.Position;try{stream.Position=0;byte[] bytes=new byte[stream.Length];int offset=0;while(offset<bytes.Length){int read=stream.Read(bytes,offset,bytes.Length-offset);if(read==0)break;offset+=read;}if(offset!=bytes.Length)throw new EndOfStreamException();return new UTF8Encoding(false,true).GetString(bytes);}finally{stream.Position=position;}}
     private Pin CreateTemporaryFile(Pin parent)
     {
@@ -244,10 +246,10 @@ internal sealed class CcodInstallGenerationRuntimeV2 : IDisposable
     private static int Rename(SafeFileHandle source,SafeFileHandle parent,string destination){byte[] name=Encoding.Unicode.GetBytes(destination);int rootOffset=IntPtr.Size,lengthOffset=rootOffset+IntPtr.Size,nameOffset=lengthOffset+4,size=nameOffset+name.Length+2;IntPtr buffer=Marshal.AllocHGlobal(size);bool parentAdded=false,sourceAdded=false;try{source.DangerousAddRef(ref sourceAdded);parent.DangerousAddRef(ref parentAdded);for(int i=0;i<size;i++)Marshal.WriteByte(buffer,i,0);Marshal.WriteByte(buffer,0,0);Marshal.WriteIntPtr(buffer,rootOffset,parent.DangerousGetHandle());Marshal.WriteInt32(buffer,lengthOffset,name.Length);Marshal.Copy(name,0,IntPtr.Add(buffer,nameOffset),name.Length);IO_STATUS_BLOCK io;int status=NtSetInformationFile(source,out io,buffer,(uint)size,FileRenameInformation);return status>=0?0:(int)RtlNtStatusToDosError(status);}finally{if(parentAdded)parent.DangerousRelease();if(sourceAdded)source.DangerousRelease();Marshal.FreeHGlobal(buffer);}}
 }
 '@
-        $marker = 'CcodInstallGenerationCapabilityMarkerV2' -as [type]
+        $marker = 'CcodInstallGenerationCapabilityMarkerV3' -as [type]
     }
-    if ($null -eq $marker -or [int]$marker.GetProperty('CapabilityAbi').GetValue($null,$null) -ne 2) { Throw-CcodInstallFileError 'CCOD_INSTALL_RUNTIME_ABI_INVALID' 'Install generation runtime ABI is unavailable' $null }
-    $script:CcodRuntimeType = $marker.Assembly.GetType('CcodInstallGenerationRuntimeV2',$true)
+    if ($null -eq $marker -or [int]$marker.GetProperty('CapabilityAbi').GetValue($null,$null) -ne 3) { Throw-CcodInstallFileError 'CCOD_INSTALL_RUNTIME_ABI_INVALID' 'Install generation runtime ABI is unavailable' $null }
+    $script:CcodRuntimeType = $marker.Assembly.GetType('CcodInstallGenerationRuntimeV3',$true)
 }
 
 function Assert-CcodInstallLeaf([string]$Leaf,[string]$ErrorId='CCOD_INSTALL_LEAF_INVALID') {
@@ -286,6 +288,7 @@ function Test-CcodInstallValue($Value,[int]$Depth=0) {
 }
 function ConvertTo-CcodInstallJsonBytes($Value){if(-not(Test-CcodInstallValue $Value)){Throw-CcodInstallFileError 'CCOD_INSTALL_JSON_INVALID' 'Invalid install JSON value' $null};return ,([Text.UTF8Encoding]::new($false).GetBytes(($Value|ConvertTo-Json -Depth 32 -Compress)+"`n"))}
 function Get-CcodInstallBytesSha256([byte[]]$Bytes){$sha=[Security.Cryptography.SHA256]::Create();try{return [BitConverter]::ToString($sha.ComputeHash($Bytes)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()}}
+function Test-CcodRetainedManifestIdentity([string]$Json,[string]$RuntimeId){try{$manifest=$Json|ConvertFrom-Json -ErrorAction Stop}catch{return$false};if($manifest-isnot[pscustomobject]){return$false};$properties=@($manifest.PSObject.Properties|Where-Object Name -CEQ 'runtimeId');return($properties.Count-eq 1-and$properties[0].Value-is[string]-and[string]$properties[0].Value-ceq$RuntimeId)}
 function Assert-CcodInstallRootScope($State,[string]$InstallRoot,[string]$ErrorId){if(-not[IO.Path]::IsPathRooted($InstallRoot)-or-not[String]::Equals([IO.Path]::GetFullPath($InstallRoot).TrimEnd('\'),$State.InstallRoot,[StringComparison]::OrdinalIgnoreCase)){Throw-CcodInstallFileError $ErrorId 'Install root does not match transaction scope' $InstallRoot}}
 
 function Open-CcodInstallGeneration {
@@ -295,8 +298,8 @@ function Open-CcodInstallGeneration {
     try{$token=Invoke-CcodRuntimeStatic Open $arguments}catch [ComponentModel.Win32Exception]{if($_.Exception.NativeErrorCode-in@(32,80,183)){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_EXISTS' 'Install generation already exists' $RuntimeId};throw}
     $runtime=$arguments[2];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$RuntimeId;RootToken=$token;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='Generation';ReadOnly=$false;RuntimeId=$RuntimeId});$transaction
 }
-function Open-CcodInstallRetainedGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)][string]$ExpectedManifestSha256,[Parameter(Mandatory)]$FileTransaction) if(-not[IO.Path]::IsPathRooted($InstallRoot)-or$ExpectedManifestSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_GENERATION_INVALID' 'Invalid retained generation contract' $RuntimeId};Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetained @($RuntimeId,$ExpectedManifestSha256)} 'CCOD_INSTALL_RETAINED_GENERATION_INVALID';Add-CcodInstallScope $scope.Record.Transaction $token Generation $true $RuntimeId }
-function New-CcodInstallDirectory { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$Parent,[Parameter(Mandatory)][string]$Leaf,[switch]$CreateIfMissing) Assert-CcodInstallLeaf $Leaf;$transactionScope=Get-CcodInstallTransaction $Transaction 'CCOD_INSTALL_TRANSACTION_INVALID';if(-not[object]::ReferenceEquals($transactionScope.Record.Transaction,$Transaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Transaction capability must be the transaction root' $null};if([object]::ReferenceEquals($Parent,$Transaction)){$token=Invoke-CcodRuntimeMethod $transactionScope.State.Runtime GetInstallRoot @();$parentScope=[pscustomobject]@{State=$transactionScope.State;Record=[pscustomobject]@{Transaction=$Transaction;Token=$token;Kind='Directory';ReadOnly=$false;RuntimeId=$null}}}else{$parentScope=Get-CcodInstallScopedDirectory $Transaction $Parent};Assert-CcodInstallWritableScope $parentScope;$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $parentScope.State.Runtime OpenDirectory @($parentScope.Record.Token,$Leaf,[bool]$CreateIfMissing)} 'CCOD_INSTALL_DIRECTORY_OPEN_FAILED';Add-CcodInstallScope $Transaction $token Directory $false $null }
+function Open-CcodInstallRetainedGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)][string]$ExpectedManifestSha256,[Parameter(Mandatory)]$FileTransaction) if(-not[IO.Path]::IsPathRooted($InstallRoot)-or$ExpectedManifestSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_GENERATION_INVALID' 'Invalid retained generation contract' $RuntimeId};Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';if(-not[object]::ReferenceEquals($scope.Record.Transaction,$FileTransaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'FileTransaction must be the transaction root capability' $null};Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$nativeResult=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetained @($RuntimeId,$ExpectedManifestSha256)} 'CCOD_INSTALL_RETAINED_GENERATION_INVALID';if(@($nativeResult).Count-ne 2-or-not(Test-CcodRetainedManifestIdentity ([string]$nativeResult[1]) $RuntimeId)){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH' 'Retained manifest must contain exactly one matching top-level runtimeId string' $RuntimeId};Add-CcodInstallScope $scope.Record.Transaction $nativeResult[0] Generation $true $RuntimeId }
+function New-CcodInstallDirectory { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$Parent,[Parameter(Mandatory)][string]$Leaf,[switch]$CreateIfMissing) Assert-CcodInstallLeaf $Leaf;$transactionScope=Get-CcodInstallTransaction $Transaction 'CCOD_INSTALL_TRANSACTION_INVALID';if(-not[object]::ReferenceEquals($transactionScope.Record.Transaction,$Transaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Transaction capability must be the transaction root' $null};if([object]::ReferenceEquals($Parent,$Transaction)){$token=Invoke-CcodRuntimeMethod $transactionScope.State.Runtime GetInstallRoot @();$parentScope=[pscustomobject]@{State=$transactionScope.State;Record=[pscustomobject]@{Transaction=$Transaction;Token=$token;Kind='Directory';ReadOnly=$false;RuntimeId=$null}}}else{$parentScope=Get-CcodInstallScopedDirectory $Transaction $Parent};Assert-CcodInstallWritableScope $parentScope;$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $parentScope.State.Runtime OpenDirectory @($parentScope.Record.Token,$Leaf,[bool]$CreateIfMissing)} 'CCOD_INSTALL_DIRECTORY_OPEN_FAILED';$readOnly=[bool](Invoke-CcodRuntimeMethod $parentScope.State.Runtime IsRetained @($token));Add-CcodInstallScope $Transaction $token Directory $readOnly $(if($readOnly){$parentScope.Record.RuntimeId}else{$null}) }
 function New-CcodInstallGenerationLeaf { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$Leaf) Assert-CcodInstallLeaf $Leaf;$scope=Get-CcodInstallTransaction $Generation;Assert-CcodInstallWritableScope $scope;$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CreateDirectory @($scope.Record.Token,$Leaf)} 'CCOD_INSTALL_LEAF_CREATE_FAILED';Add-CcodInstallScope $scope.Record.Transaction $token Directory $scope.Record.ReadOnly $scope.Record.RuntimeId }
 function Copy-CcodInstallSealedSource { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$SourcePath,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)][int64]$ExpectedLength,[Parameter(Mandatory)][string]$ExpectedSha256) Assert-CcodInstallLeaf $Leaf;if(-not[IO.Path]::IsPathRooted($SourcePath)-or$ExpectedLength-lt 0-or$ExpectedSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Invalid sealed source contract' $SourcePath};$scope=Get-CcodInstallTransaction $Generation;Assert-CcodInstallWritableScope $scope;$result=[pscustomobject]@{Length=$ExpectedLength;Sha256=$ExpectedSha256};Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Copy @($scope.Record.Token,$Leaf,[IO.Path]::GetFullPath($SourcePath),$ExpectedLength,$ExpectedSha256)|Out-Null} 'CCOD_INSTALL_SOURCE_MISMATCH';return $result }
 function Write-CcodInstallGenerationManifest { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)]$Manifest) $scope=Get-CcodInstallTransaction $Generation;Assert-CcodInstallWritableScope $scope;if($scope.Record.Token-ne$scope.State.RootToken){Throw-CcodInstallFileError 'CCOD_INSTALL_MANIFEST_SCOPE' 'Manifest must be written at the generation root' $null};$bytes=ConvertTo-CcodInstallJsonBytes $Manifest;$result=[pscustomobject]@{Length=[int64]$bytes.LongLength;Sha256=(Get-CcodInstallBytesSha256 $bytes)};Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Write @($scope.Record.Token,'manifest.json',$bytes,$true)|Out-Null} 'CCOD_INSTALL_MANIFEST_WRITE_FAILED';return $result }
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index f10889c..a585cef 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -110,6 +110,12 @@ function Assert-CcodOutsideUnchanged {
     Assert-CcodEqual $Fixture.SentinelSha256 (Get-CcodTestFileSha256 $Fixture.Sentinel) "$Message sentinel bytes"
 }
 
+function Invoke-CcodExtensionRedTest {
+    param([Parameter(Mandatory)][string]$Id,[Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][scriptblock]$Action)
+    if (-not [string]::IsNullOrWhiteSpace($env:CCOD_INSTALL_EXTENSION_RED_CASE) -and $env:CCOD_INSTALL_EXTENSION_RED_CASE -cne $Id) { return }
+    Invoke-CcodTest $Name $Action
+}
+
 function Invoke-CcodMoveAttempt {
     param([Parameter(Mandatory)][string]$Path)
     try { [IO.File]::Move($Path,$Path+'.moved'); 'moved' } catch [IO.IOException] { 'blocked' } catch [UnauthorizedAccessException] { 'blocked' }
@@ -132,9 +138,9 @@ function New-CcodHardLink {
 Invoke-CcodTest 'exports only immutable generation operations and an inert CLR marker' {
     $expected=@('Close-CcodInstallFileTransaction','Commit-CcodInstallActivePointer','Copy-CcodInstallSealedSource','New-CcodInstallDirectory','New-CcodInstallGenerationLeaf','Open-CcodInstallGeneration','Open-CcodInstallRetainedGeneration','Retire-CcodInstallGeneration','Write-CcodInstallGenerationManifest','Write-CcodInstallRecord')
     Assert-CcodEqual ($expected -join '|') ((@($module.ExportedCommands.Keys)|Sort-Object)-join '|') 'module export surface is capability-only'
-    Assert-CcodEqual 2 ([CcodInstallGenerationCapabilityMarkerV2]::CapabilityAbi) 'marker exposes the current non-mutating ABI value'
-    Assert-CcodEqual 'CcodInstallGenerationCapabilityMarkerV2' ((@([CcodInstallGenerationCapabilityMarkerV2].Assembly.GetExportedTypes()|ForEach-Object FullName)) -join '|') 'current CLR bridge exports only the inert marker'
-    $dangerous=@([CcodInstallGenerationCapabilityMarkerV2].GetMethods([Reflection.BindingFlags]'Public,Static,DeclaredOnly')|Where-Object{@($_.GetParameters()|Where-Object{$_.ParameterType-in@([string],[IntPtr],[IO.Stream])-or[Microsoft.Win32.SafeHandles.SafeHandle].IsAssignableFrom($_.ParameterType)}).Count-ne 0})
+    Assert-CcodEqual 3 ([CcodInstallGenerationCapabilityMarkerV3]::CapabilityAbi) 'marker exposes the current non-mutating ABI value'
+    Assert-CcodEqual 'CcodInstallGenerationCapabilityMarkerV3' ((@([CcodInstallGenerationCapabilityMarkerV3].Assembly.GetExportedTypes()|ForEach-Object FullName)) -join '|') 'current CLR bridge exports only the inert marker'
+    $dangerous=@([CcodInstallGenerationCapabilityMarkerV3].GetMethods([Reflection.BindingFlags]'Public,Static,DeclaredOnly')|Where-Object{@($_.GetParameters()|Where-Object{$_.ParameterType-in@([string],[IntPtr],[IO.Stream])-or[Microsoft.Win32.SafeHandles.SafeHandle].IsAssignableFrom($_.ParameterType)}).Count-ne 0})
     Assert-CcodEqual 0 $dangerous.Count 'marker accepts no path stream or bare handle'
 }
 
@@ -461,6 +467,68 @@ Invoke-CcodTest 'rejects structurally invalid or unowned retained generations' {
     }
 }
 
+Invoke-CcodExtensionRedTest 'retained-alias' 'retained read-only propagates through transaction-root alias traversal' {
+    $fixture=New-CcodInstallFileFixture
+    try {
+        $runtimeId='runtime-retained-alias';$old=Open-CcodFixtureGeneration $fixture $runtimeId;$manifest=Write-CcodInstallGenerationManifest -Generation $old -Manifest (New-CcodGenerationManifest $runtimeId);Close-CcodInstallFileTransaction -Transaction $old -Disposition Ready|Out-Null
+        $transaction=Open-CcodFixtureGeneration $fixture 'runtime-alias-transaction';Write-CcodInstallGenerationManifest -Generation $transaction -Manifest (New-CcodGenerationManifest 'runtime-alias-transaction')|Out-Null
+        $retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $transaction
+        $runtimeDirectory=New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'runtime'
+        $alias=New-CcodInstallDirectory -Transaction $transaction -Parent $runtimeDirectory -Leaf $runtimeId
+        Assert-CcodThrows {New-CcodInstallDirectory -Transaction $transaction -Parent $alias -Leaf 'blocked-dir' -CreateIfMissing|Out-Null} 'CCOD_INSTALL_GENERATION_READ_ONLY'
+        Assert-CcodThrows {Write-CcodInstallRecord -Transaction $transaction -Parent $alias -Leaf 'blocked.json' -Record ([ordered]@{value='blocked'})|Out-Null} 'CCOD_INSTALL_GENERATION_READ_ONLY'
+        Assert-CcodThrows {New-CcodInstallGenerationLeaf -Generation $alias -Leaf 'blocked-leaf'|Out-Null} 'CCOD_INSTALL_GENERATION_READ_ONLY'
+        Assert-CcodThrows {Write-CcodInstallGenerationManifest -Generation $alias -Manifest (New-CcodGenerationManifest $runtimeId)|Out-Null} 'CCOD_INSTALL_GENERATION_READ_ONLY'
+        Assert-CcodTrue ($null-ne$retained) 'direct retained capability remains available only as a pointer target'
+    } finally {Remove-CcodInstallFileFixture $fixture}
+}
+
+Invoke-CcodExtensionRedTest 'nested-retained' 'opens and recursively validates a nested retained generation read-only' {
+    $fixture=New-CcodInstallFileFixture
+    try {
+        $runtimeId='runtime-retained-nested';$source=New-CcodSourceFile $fixture 'nested-source.bin' 'nested-retained-bytes';$old=Open-CcodFixtureGeneration $fixture $runtimeId;$first=New-CcodInstallGenerationLeaf -Generation $old -Leaf 'first';$second=New-CcodInstallGenerationLeaf -Generation $first -Leaf 'second';Copy-CcodInstallSealedSource -Generation $second -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null
+        $manifest=Write-CcodInstallGenerationManifest -Generation $old -Manifest (New-CcodGenerationManifest $runtimeId @([ordered]@{path='first\second\payload.bin';length=$source.Length;sha256=$source.Sha256}));Close-CcodInstallFileTransaction -Transaction $old -Disposition Ready|Out-Null
+        $transaction=Open-CcodFixtureGeneration $fixture 'runtime-nested-validator';Write-CcodInstallGenerationManifest -Generation $transaction -Manifest (New-CcodGenerationManifest 'runtime-nested-validator')|Out-Null
+        $retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $transaction
+        Assert-CcodEqual '' (@($retained.PSObject.Properties.Name)-join ',') 'nested retained generation opens as an opaque capability'
+        $result=Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $retained -ExpectedPreviousGeneration ([uint64]0) -FileTransaction $transaction
+        Assert-CcodEqual $runtimeId $result.RuntimeId 'nested retained tree remains a valid read-only pointer target'
+    } finally {Remove-CcodInstallFileFixture $fixture}
+}
+
+Invoke-CcodExtensionRedTest 'semantic-runtime-id' 'rejects an escaped or nested runtimeId without one matching top-level property' {
+    $fixture=New-CcodInstallFileFixture
+    try {
+        $runtimeId='runtime-semantic-target';$old=Open-CcodFixtureGeneration $fixture $runtimeId
+        $manifest=Write-CcodInstallGenerationManifest -Generation $old -Manifest ([ordered]@{schemaVersion=1;projectVersion='2.5.22';description='escaped runtimeId marker';metadata=[ordered]@{runtimeId=$runtimeId};commit='0123456789abcdef0123456789abcdef01234567';files=@()});Close-CcodInstallFileTransaction -Transaction $old -Disposition Ready|Out-Null
+        $transaction=Open-CcodFixtureGeneration $fixture 'runtime-semantic-validator';Write-CcodInstallGenerationManifest -Generation $transaction -Manifest (New-CcodGenerationManifest 'runtime-semantic-validator')|Out-Null
+        Assert-CcodThrows {Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $transaction|Out-Null} 'CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH'
+    } finally {Remove-CcodInstallFileFixture $fixture}
+}
+
+Invoke-CcodExtensionRedTest 'child-transaction' 'rejects a child directory capability as retained-open FileTransaction' {
+    $fixture=New-CcodInstallFileFixture
+    try {
+        $runtimeId='runtime-child-transaction-old';$old=Open-CcodFixtureGeneration $fixture $runtimeId;$manifest=Write-CcodInstallGenerationManifest -Generation $old -Manifest (New-CcodGenerationManifest $runtimeId);Close-CcodInstallFileTransaction -Transaction $old -Disposition Ready|Out-Null
+        $transaction=Open-CcodFixtureGeneration $fixture 'runtime-child-transaction-new';Write-CcodInstallGenerationManifest -Generation $transaction -Manifest (New-CcodGenerationManifest 'runtime-child-transaction-new')|Out-Null;$state=New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'state' -CreateIfMissing
+        Assert-CcodThrows {Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $state|Out-Null} 'CCOD_INSTALL_TRANSACTION_INVALID'
+    } finally {Remove-CcodInstallFileFixture $fixture}
+}
+
+Invoke-CcodExtensionRedTest 'v3-reimport' 're-imports ABI V3 and exercises every retained extension export' {
+    $fixture=New-CcodInstallFileFixture
+    try {
+        if($null-eq('CcodInstallGenerationCapabilityMarkerV2'-as[type])){Add-Type -TypeDefinition 'public sealed class CcodInstallGenerationCapabilityMarkerV2 { private CcodInstallGenerationCapabilityMarkerV2() {} public static int CapabilityAbi { get { return 2; } } }'}
+        Assert-CcodEqual 2 ([CcodInstallGenerationCapabilityMarkerV2]::CapabilityAbi) 'old V2 marker is preloaded in the AppDomain'
+        $module=Import-Module $modulePath -Force -PassThru -DisableNameChecking;$module=Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        $old=Open-CcodFixtureGeneration $fixture 'runtime-v3-old';$manifest=Write-CcodInstallGenerationManifest -Generation $old -Manifest (New-CcodGenerationManifest 'runtime-v3-old');Close-CcodInstallFileTransaction -Transaction $old -Disposition Ready|Out-Null
+        $transaction=Open-CcodFixtureGeneration $fixture 'runtime-v3-new';Write-CcodInstallGenerationManifest -Generation $transaction -Manifest (New-CcodGenerationManifest 'runtime-v3-new')|Out-Null
+        $state=New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'state' -CreateIfMissing;$records=New-CcodInstallDirectory -Transaction $transaction -Parent $state -Leaf 'records' -CreateIfMissing;Write-CcodInstallRecord -Transaction $transaction -Parent $records -Leaf 'record.json' -Record ([ordered]@{schemaVersion=1;value='v3'})|Out-Null
+        $retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId 'runtime-v3-old' -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $transaction;Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $retained -ExpectedPreviousGeneration ([uint64]0) -FileTransaction $transaction|Out-Null
+        Assert-CcodEqual 3 ([CcodInstallGenerationCapabilityMarkerV3]::CapabilityAbi) 'module binds the new ABI V3 despite the preloaded V2 marker'
+    } finally {Remove-CcodInstallFileFixture $fixture}
+}
+
 Invoke-CcodTest 'retirement writes one create-only record and keeps the nonempty generation in place' {
     $fixture=New-CcodInstallFileFixture
     try {

From e80b829fc2ec19c2db46bccc5cbbeba8c2e15299 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sat, 29 Aug 2026 22:39:26 +0800
Subject: [PATCH 079/187] fix: reject duplicate retained manifest identities

---
 .../task-1-report.md                          | 55 +++++++++++++++++++
 .../modules/InstallFileTransaction.psm1       |  3 +-
 .../InstallFileTransaction.SelfTest.ps1       | 11 ++++
 3 files changed, 68 insertions(+), 1 deletion(-)

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-1-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-1-report.md
index 3b8176d..b0623ef 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-1-report.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-1-report.md
@@ -480,3 +480,58 @@ retained-alias `CCOD_INSTALL_GENERATION_READ_ONLY` assertion.
 
 - The paused uncommitted Task 2 changes in `InstallLifecycle.psm1` and
   `InstallLifecycle.SelfTest.ps1` were neither edited nor staged by this fix.
+
+## Duplicate retained-manifest identity fix
+
+### RED evidence
+
+- Targeted command:
+  `$env:CCOD_INSTALL_EXTENSION_RED_CASE='duplicate-runtime-id'; powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Targeted exit code: `1`.
+- Exact failure: case
+  `rejects-duplicate-matching-top-level-runtimeId-members-in-a-retained-manifest`
+  reached `ASSERT_THROWS`, expected
+  `CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH`. This proved Windows PowerShell
+  collapsed two equal top-level `runtimeId` members before the old property
+  count check.
+- Unfiltered focused command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Unfiltered RED exit code: `1` with the same exact case and assertion.
+
+### GREEN and verification evidence
+
+- The same targeted duplicate command exited `0`.
+- Full focused command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Full focused exit code: `0`; `25/25` named cases passed, including all
+  earlier retained alias, nested tree, semantic identity, transaction-root,
+  and ABI V3 regressions.
+- Parser command: explicit PowerShell parser pass over
+  `InstallFileTransaction.psm1` and
+  `InstallFileTransaction.SelfTest.ps1`.
+- Parser exit code: `0` (`TASK1_PARSER_EXIT=0`).
+- Diff command:
+  `git diff --check -- src/persistence/modules/InstallFileTransaction.psm1 tests/persistence/InstallFileTransaction.SelfTest.ps1 .superpowers/sdd/2026-08-29-v2522-immutable-generation/task-1-report.md`
+- Diff exit code: `0` (`TASK1_DIFF_CHECK_EXIT=0`; only LF-to-CRLF checkout
+  warnings).
+
+### Implementation behavior
+
+- `ConvertFrom-Json` remains the authoritative complete JSON parser and
+  decoded-value source. The identity check still requires a top-level object
+  whose decoded, case-exact `runtimeId` value is a string equal to the
+  requested runtime ID.
+- A bounded lexical pass now enumerates decoded top-level property names before
+  accepting that parsed value. It preserves duplicate member occurrences,
+  honors JSON string escaping in keys, and ignores nested objects, arrays, and
+  escaped key-like text inside values. Two matching top-level `runtimeId`
+  members are therefore rejected.
+- The regression fixture supplies the exact SHA-256 of the duplicate-key
+  manifest and exercises the real retained-open path. Native SHA-256,
+  full-tree, path, reparse, ADS, multilink, and handle checks are unchanged.
+- The paused Task 2 lifecycle files remained unstaged and were not edited by
+  this fix.
+
+### Commit
+
+- `fix: reject duplicate retained manifest identities`
diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index b0ebd33..c8a349a 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -288,7 +288,8 @@ function Test-CcodInstallValue($Value,[int]$Depth=0) {
 }
 function ConvertTo-CcodInstallJsonBytes($Value){if(-not(Test-CcodInstallValue $Value)){Throw-CcodInstallFileError 'CCOD_INSTALL_JSON_INVALID' 'Invalid install JSON value' $null};return ,([Text.UTF8Encoding]::new($false).GetBytes(($Value|ConvertTo-Json -Depth 32 -Compress)+"`n"))}
 function Get-CcodInstallBytesSha256([byte[]]$Bytes){$sha=[Security.Cryptography.SHA256]::Create();try{return [BitConverter]::ToString($sha.ComputeHash($Bytes)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()}}
-function Test-CcodRetainedManifestIdentity([string]$Json,[string]$RuntimeId){try{$manifest=$Json|ConvertFrom-Json -ErrorAction Stop}catch{return$false};if($manifest-isnot[pscustomobject]){return$false};$properties=@($manifest.PSObject.Properties|Where-Object Name -CEQ 'runtimeId');return($properties.Count-eq 1-and$properties[0].Value-is[string]-and[string]$properties[0].Value-ceq$RuntimeId)}
+function Get-CcodTopLevelJsonPropertyCount([string]$Json,[string]$Name){$count=0;$depth=0;$inString=$false;$escaped=$false;$expectKey=$false;$captureKey=$false;$keyStart=-1;for($index=0;$index-lt$Json.Length;$index++){$character=$Json[$index];if($inString){if($escaped){$escaped=$false;continue};if($character-ceq'\'){$escaped=$true;continue};if($character-ceq'"'){if($captureKey){try{$key=$Json.Substring($keyStart,$index-$keyStart+1)|ConvertFrom-Json -ErrorAction Stop}catch{return -1};if($key-isnot[string]){return -1};if($key-ceq$Name){$count++};$expectKey=$false};$inString=$false;$captureKey=$false};continue};if($character-ceq'"'){$inString=$true;$captureKey=($depth-eq 1-and$expectKey);if($captureKey){$keyStart=$index};continue};if($character-ceq'{'-or$character-ceq'['){$depth++;if($depth-eq 1-and$character-ceq'{'){$expectKey=$true};continue};if($character-ceq'}'-or$character-ceq']'){$depth--;continue};if($character-ceq','-and$depth-eq 1){$expectKey=$true}};if($inString-or$depth-ne 0){return -1};return $count}
+function Test-CcodRetainedManifestIdentity([string]$Json,[string]$RuntimeId){try{$manifest=$Json|ConvertFrom-Json -ErrorAction Stop}catch{return $false};if($manifest-isnot[pscustomobject]-or(Get-CcodTopLevelJsonPropertyCount $Json 'runtimeId')-ne 1){return $false};$properties=@($manifest.PSObject.Properties|Where-Object Name -CEQ 'runtimeId');return ($properties.Count-eq 1-and$properties[0].Value-is[string]-and[string]$properties[0].Value-ceq$RuntimeId)}
 function Assert-CcodInstallRootScope($State,[string]$InstallRoot,[string]$ErrorId){if(-not[IO.Path]::IsPathRooted($InstallRoot)-or-not[String]::Equals([IO.Path]::GetFullPath($InstallRoot).TrimEnd('\'),$State.InstallRoot,[StringComparison]::OrdinalIgnoreCase)){Throw-CcodInstallFileError $ErrorId 'Install root does not match transaction scope' $InstallRoot}}
 
 function Open-CcodInstallGeneration {
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index a585cef..b672990 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -506,6 +506,17 @@ Invoke-CcodExtensionRedTest 'semantic-runtime-id' 'rejects an escaped or nested
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
 
+Invoke-CcodExtensionRedTest 'duplicate-runtime-id' 'rejects duplicate matching top-level runtimeId members in a retained manifest' {
+    $fixture=New-CcodInstallFileFixture
+    try {
+        $runtimeId='runtime-duplicate-semantic-target';$runtimePath=Join-Path $fixture.Install "runtime\$runtimeId";[IO.Directory]::CreateDirectory($runtimePath)|Out-Null
+        $manifestPath=Join-Path $runtimePath 'manifest.json';$manifestText='{"schemaVersion":1,"runtimeId":"'+$runtimeId+'","metadata":{"runtimeId":"nested-only"},"description":"escaped \"runtimeId\" marker","runtimeId":"'+$runtimeId+'","files":[]}'
+        [IO.File]::WriteAllText($manifestPath,$manifestText);$manifestSha=Get-CcodTestFileSha256 $manifestPath
+        $transaction=Open-CcodFixtureGeneration $fixture 'runtime-duplicate-semantic-validator';Write-CcodInstallGenerationManifest -Generation $transaction -Manifest (New-CcodGenerationManifest 'runtime-duplicate-semantic-validator')|Out-Null
+        Assert-CcodThrows {Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifestSha -FileTransaction $transaction|Out-Null} 'CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH'
+    } finally {Remove-CcodInstallFileFixture $fixture}
+}
+
 Invoke-CcodExtensionRedTest 'child-transaction' 'rejects a child directory capability as retained-open FileTransaction' {
     $fixture=New-CcodInstallFileFixture
     try {

From 21014850ed43c04f996fd782a8ae41a771121c8e Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 00:45:50 +0800
Subject: [PATCH 080/187] fix: commit lifecycle through immutable generations

---
 .../task-2-report.md                          | 120 ++++
 Install-CodexControlOtherDevices.ps1          |   4 +-
 ...08-29-v2522-immutable-generation-design.md |  17 +
 src/persistence/modules/InstallLifecycle.psm1 | 410 ++++++++++---
 src/persistence/modules/PersistenceIO.psm1    |  29 +-
 src/persistence/modules/RuntimeManifest.psm1  |  40 +-
 src/persistence/modules/StateStore.psm1       |  32 +-
 src/persistence/modules/UiPreferences.psm1    |  10 +-
 .../persistence/InstallLifecycle.SelfTest.ps1 | 578 ++++++++----------
 tests/persistence/PersistenceIO.SelfTest.ps1  |   6 +
 10 files changed, 835 insertions(+), 411 deletions(-)
 create mode 100644 .superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md
new file mode 100644
index 0000000..22cc90a
--- /dev/null
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md
@@ -0,0 +1,120 @@
+# Task 2 report: immutable lifecycle generations
+
+## Status
+
+Implemented the Task 2 immutable lifecycle migration in the assigned worktree.
+The install path now stages a unique manifest-bound generation, appends the
+transaction and active-generation chains, selects the generation bootstrap for
+the scheduled task, retains legacy root shells and failed/old generations, and
+uses a higher compensating pointer after post-pointer failure.
+
+No release, push, tag, signing, build, installation, real product process
+start/stop, WindowsApps access, DPAPI access, or external write was performed.
+
+## RED evidence
+
+- Recovery baseline command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1`
+  exited `1` at `first-install-stages-verifies-activates-task-and-persists-consent`,
+  old assertion `stable bootstrap copied`. The obsolete root-shell expectation
+  was replaced by the approved generation-specific shell contract.
+- Runtime identity RED exited `1` because `New-CcodUniqueRuntimeId` had no
+  `ContentSha256` parameter. GREEN binds the full SHA-256 of
+  `projectVersion + NUL + sealedPackageSha256` and a per-attempt nonce into a
+  96-character runtime ID.
+- Activation receipt RED exited `1` because `StartingProtection` wrote mutable
+  `state\post-install-activation.json`. GREEN writes phase-specific create-only
+  records below `state\activation-receipts` through the opaque transaction.
+- Operational-state RED reproduced `UnauthorizedAccessException` and
+  `CCOD_ATOMIC_REPLACE_FAILED` after the Task 1 record seal made status and UI
+  files read-only. GREEN separates immutable initialization evidence below
+  `state\install-initializations\<runtimeId>` from writable operational state
+  materialized only when all operational leaves are absent.
+- Real idempotence RED expected `AlreadyInstalled` but received `Upgraded`.
+  GREEN performs no pointer, runtime, task, or process mutation only when the
+  active Ready transaction has the exact explicitly supplied package identity;
+  a different explicit identity returns `CCOD_INSTALL_PACKAGE_CONFLICT`.
+- Bounded reader RED exited `1` because `Read-CcodStrictJson` had no
+  `MaxBytes` parameter. GREEN rejects oversized records before JSON parsing.
+- Transaction-chain identity RED exited `1` because a contiguous snapshot
+  chain could change `oldRuntimeId`. GREEN binds every immutable transaction
+  identity field across all snapshots.
+
+## GREEN and verification evidence
+
+- Lifecycle command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1`
+- Lifecycle exit/result: `0`; `Install lifecycle self-tests passed: 108`.
+- Runtime manifest command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\RuntimeManifest.SelfTest.ps1`
+- Runtime manifest exit/result: `0`; 16 named cases passed.
+- Uninstall bootstrap command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\UninstallBootstrap.SelfTest.ps1`
+- Uninstall bootstrap exit/result: `0`; `Uninstall bootstrap self-tests passed: 12`.
+- Persistence I/O command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\PersistenceIO.SelfTest.ps1`
+- Persistence I/O exit/result: `0`; 24 named cases passed.
+- Aggregate command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\PersistenceSelfTest.ps1`
+- Aggregate exit: `0` (`TASK2_AGGREGATE_EXIT=0`). The prior local
+  Bootstrap/mutex boundary did not reproduce in this fresh run.
+- Parser command: explicit
+  `[Management.Automation.Language.Parser]::ParseFile` pass over all eight
+  changed PowerShell code/test files.
+- Parser exit: `0` (`TASK2_PARSER_EXIT=0`); every file reported `PARSER_OK`.
+- Diff command: `git diff --check`
+- Diff exit: `0` (`TASK2_DIFF_CHECK_EXIT=0`; checkout emitted only LF-to-CRLF
+  warnings).
+
+## Behavior and boundaries
+
+- Runtime IDs are unique per attempt and retain a full deterministic digest of
+  project version plus canonical sealed package identity. Runtime manifest
+  validation still rejects runtime-ID, project-version, file-list, length, and
+  content tampering.
+- `state\active-generation\<20-digit>.json` is the only new active selector.
+  New installs never write `active.json`; legacy `active.json` remains read-only
+  migration input.
+- Transaction snapshots have exact fields and types, strict positive integer
+  generations, bounded safe reads, contiguous phases, immutable identity, and
+  rejection for unknown objects, reparse points, ADS, multilinks, competing
+  nonterminal chains, duplicate/gapped/post-terminal chains, and ambiguous
+  terminal selection.
+- Initial settings, status, verified packages, transition, and UI preference
+  evidence is create-only and generation-bound. The operational state plane is
+  separately created only when entirely absent and remains writable; the tests
+  perform real StateStore and UI write/read round trips without changing file
+  attributes.
+- Pre-pointer failures retain the failed candidate and leave the old pointer
+  and legacy root bootstrap/uninstaller bytes unchanged. Post-pointer failures
+  either append a higher compensation pointer to the retained old runtime and
+  prove it ready, or persist exactly
+  `Failed/CCOD_INSTALL_ROLLBACK_FAILED`. Both generations remain retained.
+- Stable shell candidates remain inside the immutable runtime generation. The
+  scheduled-task adapter is updated only after pointer commit and targets that
+  generation's bootstrap. There is no root shell overwrite or install-hot-path
+  recursive runtime deletion.
+- Idempotence/conflict decisions require an explicit canonical
+  `SealedPackageSha256`. A legacy/direct call that omits it cannot claim package
+  identity and follows the normal unique-generation path; Task 3 Setup must
+  always pass the sealed package hash.
+- Task 1 file-layer modules are imported lazily without `-Force` only when an
+  immutable install operation is actually invoked. This preserves the staged
+  uninstall module import closure and avoids rebinding a live Task 1
+  transaction.
+
+## Concerns
+
+- The current-user ordinary-race boundary remains unchanged: this does not
+  claim protection from an unrestricted same-user writer or in-process module
+  introspection.
+- The pre-Task-3 activation owner still consumes the legacy single receipt in
+  its synthetic compatibility tests. Task 3 owns migration of the sealed Setup
+  bootstrap/validator to the create-only receipt chain and must pass the
+  canonical package identity explicitly.
+- Failed and superseded generations intentionally consume disk until a
+  separately proven maintenance/uninstall reclamation path runs.
+
+## Commit
+
+- `fix: commit lifecycle through immutable generations` (this Task 2 commit)
diff --git a/Install-CodexControlOtherDevices.ps1 b/Install-CodexControlOtherDevices.ps1
index bc8cf47..8d5450d 100644
--- a/Install-CodexControlOtherDevices.ps1
+++ b/Install-CodexControlOtherDevices.ps1
@@ -7,7 +7,8 @@ param(
     [string]$ActivationId,
     [string]$ExpectedVersion,
     [string]$PayloadManifestPath,
-    [string]$ExpectedPayloadManifestSha256
+    [string]$ExpectedPayloadManifestSha256,
+    [string]$SealedPackageSha256
 )
 
 $ErrorActionPreference = 'Stop'
@@ -180,6 +181,7 @@ try {
         $invoke.ExpectedPayloadManifestSha256 = $ExpectedPayloadManifestSha256
         $invoke.PayloadManifestBytesBase64 = [Convert]::ToBase64String([byte[]]$payloadSeal.ManifestBytes)
     }
+    if(-not[string]::IsNullOrWhiteSpace($SealedPackageSha256)){$invoke.SealedPackageSha256=$SealedPackageSha256}
     $receipt = Invoke-CcodInstall @invoke
 } finally {
     if ($null -ne $installerModule) { Remove-Module -Name $installerModule.Name -Force -ErrorAction SilentlyContinue }
diff --git a/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md b/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
index d671916..7b35f8a 100644
--- a/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
+++ b/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
@@ -76,6 +76,23 @@ after the active pointer is committed and the new protection has reached
 verified readiness. An upgrade does not overwrite a stable file while the new
 generation is still incomplete.
 
+### 1a. Immutable initialization evidence and operational state
+
+The install transaction writes create-only, generation-bound initialization
+evidence for settings, status, verified packages, transition state, and UI
+preference below `state\install-initializations\<runtimeId>`. Those records
+prove the exact defaults that were accepted before activation and are never
+rewritten.
+
+The existing `state\*.json` and `state\ui-preferences.json` files are a
+separate operational state plane. They are materialized from the proven
+initialization evidence only when absent, remain subject to the existing
+contained-path/reparse/ADS/single-link checks, and are changed only by the
+running Supervisor after `Ready`. An upgrade never overwrites a partial or
+existing operational state file. This separation is necessary because sealing
+the mutable runtime state files read-only would prevent normal tray settings,
+status, and recovery updates after installation.
+
 ### 2. Small pinned file layer without persistent DACL mutation
 
 `InstallFileTransaction.psm1` keeps only opaque transaction capabilities and
diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index 8385b5c..db01be6 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -14,6 +14,9 @@ $script:CcodLifecycleTaskName = 'Codex Control Other Devices Supervisor'
 $script:CcodLifecycleDefaultInstallRoot = Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)) 'CodexControlOtherDevices'
 $script:CcodActivationReceiptFields = @('schemaVersion','activationId','phase','runtimeId','previousRuntimeId','startedAtUtc','updatedAtUtc','ready','errorCode')
 $script:CcodActivationPhases = @('StoppingPreviousRuntime','InstallingRuntime','ActivatingRuntime','StartingProtection','Ready','Failed')
+$script:CcodInstallTransactionPhases = @('Prepared','PackageVerified','RuntimeStaged','PreviousProtectionStopped','RuntimePromoted','PointerCommitted','StableShellCommitted','ProtectionReady','Ready')
+$script:CcodInstallTransactionFields = @('schemaVersion','transactionId','oldRuntimeId','oldGeneration','newRuntimeId','newGeneration','sealedPackageSha256','ownedObjectNames','phase','errorCode')
+$script:CcodInstallTransactionRoots = [Runtime.CompilerServices.ConditionalWeakTable[object,object]]::new()
 
 function Throw-CcodLifecycleError {
     param(
@@ -90,8 +93,9 @@ function Assert-CcodActivationReceipt {
 }
 
 function Write-CcodActivationReceiptFile {
-    param([Parameter(Mandatory)][string]$InstallRoot, [Parameter(Mandatory)]$Receipt)
+    param([Parameter(Mandatory)][string]$InstallRoot, [Parameter(Mandatory)]$Receipt,$FileTransaction)
     [void](Assert-CcodActivationReceipt $Receipt)
+    if($null-ne$FileTransaction){[void](Assert-CcodInstallTransactionRoot $InstallRoot $FileTransaction);$state=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $FileTransaction -Leaf 'state' -CreateIfMissing;$receipts=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $state -Leaf 'activation-receipts' -CreateIfMissing;$leaf=('{0}.{1}.json'-f$Receipt.activationId,$Receipt.phase);Write-CcodInstallRecord -Transaction $FileTransaction -Parent $receipts -Leaf $leaf -Record $Receipt|Out-Null;return}
     $stateRoot = Join-Path $InstallRoot 'state'
     [IO.Directory]::CreateDirectory($stateRoot) | Out-Null
     Write-CcodAtomicJson -Path (Join-Path $stateRoot 'post-install-activation.json') -Value $Receipt -Compress
@@ -105,7 +109,8 @@ function Write-CcodInstallActivationPhase {
         [AllowNull()]$PreviousRuntimeId,
         [AllowNull()]$ErrorCode,
         [Parameter(Mandatory)][hashtable]$Adapters,
-        [Parameter(Mandatory)][string]$InstallRoot
+        [Parameter(Mandatory)][string]$InstallRoot,
+        $FileTransaction
     )
     $now = & $Adapters.UtcNow
     if ($now -isnot [DateTime]) { Throw-CcodLifecycleError 'CCOD_INSTALL_CLOCK_INVALID' 'Activation clock must return DateTime' $null }
@@ -121,7 +126,7 @@ function Write-CcodInstallActivationPhase {
         errorCode = $ErrorCode
     }
     [void](Assert-CcodActivationReceipt $receipt)
-    try { & $Adapters.WriteActivationReceipt $InstallRoot $receipt }
+    try { & $Adapters.WriteActivationReceipt $InstallRoot $receipt $FileTransaction }
     catch { Throw-CcodLifecycleError 'CCOD_INSTALL_ACTIVATION_RECEIPT_FAILED' 'Activation receipt could not be persisted' $null }
     $Activation.LastPhase = $Phase
     return $receipt
@@ -142,6 +147,220 @@ function Get-CcodLifecycleCanonicalRoot {
     return $root.TrimEnd('\')
 }
 
+function Assert-CcodInstallTransactionRecord {
+    param([Parameter(Mandatory)]$Record)
+
+    $actualFields = if ($Record -is [Collections.IDictionary]) { @($Record.Keys) } else { @($Record.PSObject.Properties.Name) }
+    if (($actualFields -join "`0") -cne ($script:CcodInstallTransactionFields -join "`0") -or
+        $Record.schemaVersion -isnot [int] -or $Record.schemaVersion -ne 1 -or
+        -not (Test-CcodLifecycleCanonicalGuid $Record.transactionId) -or
+        ($null -ne $Record.oldRuntimeId -and ($Record.oldRuntimeId -isnot [string] -or $Record.oldRuntimeId -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$')) -or
+        ($null -ne $Record.newRuntimeId -and ($Record.newRuntimeId -isnot [string] -or $Record.newRuntimeId -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$')) -or
+        $Record.sealedPackageSha256 -isnot [string] -or $Record.sealedPackageSha256 -cnotmatch '^[0-9a-f]{64}$' -or
+        $Record.phase -isnot [string] -or (@($script:CcodInstallTransactionPhases) + 'Failed') -cnotcontains $Record.phase -or
+        (($Record.phase -ceq 'Failed') -and ($Record.errorCode -isnot [string] -or $Record.errorCode -cnotmatch '^CCOD_[A-Z0-9_]{1,96}$')) -or
+        (($Record.phase -cne 'Failed') -and $null -ne $Record.errorCode)) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction record contract is invalid' $null
+    }
+    $integerTypes = @([byte],[uint16],[uint32],[uint64],[int16],[int32],[int64])
+    $newTypeValid = $false
+    foreach ($type in $integerTypes) { if ($Record.newGeneration -is $type) { $newTypeValid = $true; break } }
+    $oldTypeValid = $null -eq $Record.oldGeneration
+    if (-not $oldTypeValid) { foreach ($type in $integerTypes) { if ($Record.oldGeneration -is $type) { $oldTypeValid = $true; break } } }
+    try {
+        if (-not $newTypeValid -or -not $oldTypeValid) { throw 'type' }
+        [uint64]$newGeneration = $Record.newGeneration
+        [uint64]$oldGeneration = if ($null -eq $Record.oldGeneration) { 0 } else { $Record.oldGeneration }
+        if ($newGeneration -eq 0 -or ($null -ne $Record.oldGeneration -and $oldGeneration -eq 0) -or ($null -eq $Record.oldRuntimeId) -ne ($null -eq $Record.oldGeneration)) { throw 'generation' }
+    } catch {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction generations are invalid' $null
+    }
+    $owned = @($Record.ownedObjectNames)
+    if ($owned.Count -gt 64) { Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction owns too many objects' $null }
+    $seen = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    foreach ($name in $owned) {
+        if ($name -isnot [string] -or $name -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$' -or -not $seen.Add($name)) {
+            Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction object names are invalid' $null
+        }
+    }
+    return $true
+}
+
+function Open-CcodLifecycleInstallGeneration {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId)
+    if($null-eq(Get-Command Open-CcodInstallGeneration -ErrorAction SilentlyContinue)){Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop}
+    $canonical = Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
+    $transaction = Open-CcodInstallGeneration -InstallRoot $canonical -RuntimeId $RuntimeId
+    $script:CcodInstallTransactionRoots.Add($transaction,[pscustomobject]@{ InstallRoot=$canonical; RuntimeId=$RuntimeId })
+    return $transaction
+}
+
+function Assert-CcodInstallTransactionRoot {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$FileTransaction)
+    $binding = $null
+    $canonical = Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
+    if (-not $script:CcodInstallTransactionRoots.TryGetValue($FileTransaction,[ref]$binding) -or $binding.InstallRoot -cne $canonical) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_SCOPE' 'Install root does not match the opaque file transaction' $InstallRoot
+    }
+    return $binding
+}
+
+function New-CcodUniqueRuntimeId {
+    param(
+        [Parameter(Mandatory)][string]$ProjectVersion,
+        [Parameter(Mandatory)][string]$ContentSha256,
+        [scriptblock]$NewNonce = { [guid]::NewGuid().ToString('N') }
+    )
+    $nonce = & $NewNonce
+    if ($ProjectVersion -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$' -or
+        $ContentSha256 -cnotmatch '^[0-9a-f]{64}$' -or
+        $nonce -isnot [string] -or $nonce -cnotmatch '^[0-9a-f]{32}$') {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_RUNTIME_ID_INVALID' 'Unique runtime identity input is invalid' $null
+    }
+    $hasher = [Security.Cryptography.SHA256]::Create()
+    try {
+        $identityBytes = [Text.Encoding]::UTF8.GetBytes("$ProjectVersion`0$ContentSha256")
+        $identityDigest = ([BitConverter]::ToString($hasher.ComputeHash($identityBytes))).Replace('-','').ToLowerInvariant()
+    } finally {
+        $hasher.Dispose()
+    }
+    return "$identityDigest-$($nonce.Substring(0,31))"
+}
+
+function New-CcodInstallTransactionRecord {
+    param(
+        [Parameter(Mandatory)][string]$TransactionId,
+        [AllowNull()]$OldRuntimeId,
+        [AllowNull()]$OldGeneration,
+        [AllowNull()]$NewRuntimeId,
+        [Parameter(Mandatory)][uint64]$NewGeneration,
+        [Parameter(Mandatory)][string]$SealedPackageSha256,
+        [string[]]$OwnedObjectNames = @()
+    )
+    $record = [pscustomobject][ordered]@{
+        schemaVersion = 1
+        transactionId = $TransactionId
+        oldRuntimeId = $OldRuntimeId
+        oldGeneration = if ($null -eq $OldGeneration) { $null } else { [uint64]$OldGeneration }
+        newRuntimeId = $NewRuntimeId
+        newGeneration = [uint64]$NewGeneration
+        sealedPackageSha256 = $SealedPackageSha256
+        ownedObjectNames = @($OwnedObjectNames)
+        phase = 'Prepared'
+        errorCode = $null
+    }
+    [void](Assert-CcodInstallTransactionRecord $record)
+    return $record
+}
+
+function Get-CcodInstallTransactionRecordLeaf {
+    param([Parameter(Mandatory)]$Record)
+    $phaseIndex = if ($Record.phase -ceq 'Failed') { 99 } else { [Array]::IndexOf($script:CcodInstallTransactionPhases,[string]$Record.phase) }
+    return ('{0:D20}.{1:D2}.{2}.{3}.json' -f [uint64]$Record.newGeneration,$phaseIndex,[string]$Record.phase,[string]$Record.transactionId)
+}
+
+function Get-CcodInstallTransactionDirectory {
+    param([Parameter(Mandatory)]$FileTransaction)
+    $state = New-CcodInstallDirectory -Transaction $FileTransaction -Parent $FileTransaction -Leaf 'state' -CreateIfMissing
+    return New-CcodInstallDirectory -Transaction $FileTransaction -Parent $state -Leaf 'install-transactions' -CreateIfMissing
+}
+
+function Write-CcodInstallTransactionRecord {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$TransactionRecord,[Parameter(Mandatory)]$FileTransaction)
+    [void](Assert-CcodInstallTransactionRoot -InstallRoot $InstallRoot -FileTransaction $FileTransaction)
+    [void](Assert-CcodInstallTransactionRecord $TransactionRecord)
+    $directory = Get-CcodInstallTransactionDirectory -FileTransaction $FileTransaction
+    Write-CcodInstallRecord -Transaction $FileTransaction -Parent $directory -Leaf (Get-CcodInstallTransactionRecordLeaf $TransactionRecord) -Record $TransactionRecord | Out-Null
+    return $TransactionRecord
+}
+
+function Read-CcodInstallTransactionRecord {
+    param([Parameter(Mandatory)][string]$InstallRoot,[string]$TransactionId)
+    $root = Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
+    $directory = Join-Path (Join-Path $root 'state') 'install-transactions'
+    if (-not [IO.Directory]::Exists($directory)) { return $null }
+    try { [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $directory) }
+    catch { Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction store is unsafe' $directory }
+    $records = [Collections.Generic.List[object]]::new()
+    foreach ($file in @(Get-ChildItem -LiteralPath $directory -Force -ErrorAction Stop)) {
+        if ($file.PSIsContainer -or $file.Name -cnotmatch '^\d{20}\.\d{2}\.[A-Za-z]+\.[0-9a-f-]{36}\.json$') { Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction store contains an unknown object' $file.FullName }
+        try { $record = Read-CcodStrictJson -Path $file.FullName -ExpectedSchema 1 -Kind 'install transaction' }
+        catch { Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction snapshot is malformed' $file.FullName }
+        [void](Assert-CcodInstallTransactionRecord $record)
+        if ((Get-CcodInstallTransactionRecordLeaf $record) -cne $file.Name) { Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction snapshot name is not canonical' $file.FullName }
+        if ([string]::IsNullOrWhiteSpace($TransactionId) -or [string]$record.transactionId -ceq $TransactionId) { $records.Add($record) }
+    }
+    if ($records.Count -eq 0) { return $null }
+    $heads = [Collections.Generic.List[object]]::new()
+    foreach ($group in @($records | Group-Object transactionId)) {
+        $chain = @($group.Group | Sort-Object @{Expression={if ($_.phase -ceq 'Failed') { 99 } else { [Array]::IndexOf($script:CcodInstallTransactionPhases,[string]$_.phase) }}})
+        if ($chain[0].phase -cne 'Prepared') { Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction chain does not begin at Prepared' $group.Name }
+        for ($index=0; $index -lt $chain.Count; $index++) {
+            $current = $chain[$index]
+            $head=$chain[0]
+            $oldGenerationChanged=($null-eq$head.oldGeneration)-ne($null-eq$current.oldGeneration)
+            if(-not$oldGenerationChanged-and$null-ne$head.oldGeneration){$oldGenerationChanged=[uint64]$current.oldGeneration-ne[uint64]$head.oldGeneration}
+            if ([string]$current.transactionId -cne [string]$head.transactionId -or
+                [string]$current.oldRuntimeId -cne [string]$head.oldRuntimeId -or $oldGenerationChanged -or
+                [string]$current.newRuntimeId -cne [string]$head.newRuntimeId -or
+                [uint64]$current.newGeneration -ne [uint64]$head.newGeneration -or
+                [string]$current.sealedPackageSha256 -cne [string]$head.sealedPackageSha256 -or
+                (@($current.ownedObjectNames)-join"`0") -cne (@($head.ownedObjectNames)-join"`0")) {
+                Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction identity changed across snapshots' $group.Name
+            }
+            if ($index -gt 0) {
+                $previous = $chain[$index-1]
+                if ($previous.phase -in @('Ready','Failed') -or ($current.phase -cne 'Failed' -and [Array]::IndexOf($script:CcodInstallTransactionPhases,[string]$current.phase) -ne ([Array]::IndexOf($script:CcodInstallTransactionPhases,[string]$previous.phase)+1))) { Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction chain has a gap, duplicate, or post-terminal snapshot' $group.Name }
+            }
+        }
+        $heads.Add($chain[-1])
+    }
+    if (-not [string]::IsNullOrWhiteSpace($TransactionId)) {
+        $matched=@($heads|Where-Object{$_.transactionId -ceq $TransactionId});if($matched.Count-ne 1){return $null};return $matched[0]
+    }
+    $nonterminal=@($heads|Where-Object{$_.phase -notin @('Ready','Failed')})
+    if($nonterminal.Count-gt 1){Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_AMBIGUOUS' 'More than one nonterminal install transaction exists' $directory}
+    if($nonterminal.Count-eq 1){return $nonterminal[0]}
+    $active=$null;try{$active=Read-CcodActiveRuntime -InstallRoot $root}catch{}
+    if($null-ne$active){$ready=@($heads|Where-Object{$_.phase-ceq'Ready'-and$_.newRuntimeId-ceq$active.activeRuntime-and[uint64]$_.newGeneration-eq[uint64]$active.generation});if($ready.Count-ne 0){if($ready.Count-ne 1){Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_AMBIGUOUS' 'Active generation has multiple Ready records' $directory};return $ready[0]}}
+    $failed=@($heads|Where-Object{$_.phase-ceq'Failed'}|Sort-Object @{Expression={[uint64]$_.newGeneration}})
+    if($failed.Count-eq 0){return $null};$max=[uint64]$failed[-1].newGeneration;$same=@($failed|Where-Object{[uint64]$_.newGeneration-eq$max});if($same.Count-ne 1){Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_AMBIGUOUS' 'Latest failed generation is ambiguous' $directory};return $same[0]
+}
+
+function Set-CcodInstallTransactionPhase {
+    param(
+        [Parameter(Mandatory)][string]$InstallRoot,
+        [Parameter(Mandatory)][string]$TransactionId,
+        [Parameter(Mandatory)][string]$ExpectedPhase,
+        [Parameter(Mandatory)][string]$NewPhase,
+        [string]$ErrorCode,
+        [Parameter(Mandatory)]$FileTransaction
+    )
+    [void](Assert-CcodInstallTransactionRoot -InstallRoot $InstallRoot -FileTransaction $FileTransaction)
+    $record = Read-CcodInstallTransactionRecord -InstallRoot $InstallRoot -TransactionId $TransactionId
+    if ($null -eq $record -or [string]$record.phase -cne $ExpectedPhase -or $ExpectedPhase -in @('Ready','Failed')) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_PHASE_INVALID' 'Install transaction phase precondition is stale' $TransactionId
+    }
+    $index = [Array]::IndexOf($script:CcodInstallTransactionPhases,$ExpectedPhase)
+    $expectedNext = if ($index -ge 0 -and $index + 1 -lt $script:CcodInstallTransactionPhases.Count) { $script:CcodInstallTransactionPhases[$index + 1] } else { $null }
+    if ($NewPhase -cne 'Failed' -and $NewPhase -cne $expectedNext) { Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_PHASE_INVALID' 'Install transaction phase transition is invalid' $NewPhase }
+    if ($NewPhase -ceq 'Failed' -and $ErrorCode -cnotmatch '^CCOD_[A-Z0-9_]{1,96}$') { Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_PHASE_INVALID' 'Failed install transaction requires a canonical error code' $ErrorCode }
+    $next = [pscustomobject][ordered]@{}
+    foreach ($field in $script:CcodInstallTransactionFields) { $next | Add-Member -NotePropertyName $field -NotePropertyValue $record.$field }
+    $next.phase = $NewPhase
+    $next.errorCode = if ($NewPhase -ceq 'Failed') { $ErrorCode } else { $null }
+    return Write-CcodInstallTransactionRecord -InstallRoot $InstallRoot -TransactionRecord $next -FileTransaction $FileTransaction
+}
+
+function Test-CcodInstallPackageIdentity {
+    param($TransactionRecord,[Parameter(Mandatory)][string]$ProjectVersion,[Parameter(Mandatory)][string]$ActiveProjectVersion,[Parameter(Mandatory)][string]$SealedPackageSha256,[string]$ActiveRuntimeId,[uint64]$ActiveGeneration)
+    if ($SealedPackageSha256 -cnotmatch '^[0-9a-f]{64}$') { Throw-CcodLifecycleError 'CCOD_INSTALL_PACKAGE_IDENTITY_INVALID' 'Sealed package SHA-256 is invalid' $null }
+    if ($ProjectVersion -cne $ActiveProjectVersion -or $null -eq $TransactionRecord) { return $false }
+    [void](Assert-CcodInstallTransactionRecord $TransactionRecord)
+    if ([string]$TransactionRecord.sealedPackageSha256 -cne $SealedPackageSha256) { Throw-CcodLifecycleError 'CCOD_INSTALL_PACKAGE_CONFLICT' 'The installed version is bound to different sealed package bytes' $null }
+    return ([string]$TransactionRecord.phase -ceq 'Ready' -and [string]$TransactionRecord.newRuntimeId -ceq $ActiveRuntimeId -and [uint64]$TransactionRecord.newGeneration -eq $ActiveGeneration)
+}
+
 function Assert-CcodLifecycleInstallPathSafe {
     param(
         [Parameter(Mandatory)][string]$InstallRoot,
@@ -747,6 +966,27 @@ function Copy-CcodLifecycleStaging {
     }
 }
 
+function New-CcodLifecycleImmutableGeneration {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)][string]$ProjectVersion,[Parameter(Mandatory)][object[]]$Files)
+    $transaction=Open-CcodLifecycleInstallGeneration -InstallRoot $InstallRoot -RuntimeId $RuntimeId
+    try {
+        $directories=@{' '=$transaction}
+        $records=[Collections.Generic.List[object]]::new()
+        foreach($file in $Files){
+            $relative=([string]$file.Relative).Replace('\','/');$segments=$relative.Split('/');$parent=$transaction;$key=''
+            for($i=0;$i-lt$segments.Count-1;$i++){$key=if($key){$key+'/'+$segments[$i]}else{$segments[$i]};if(-not$directories.ContainsKey($key)){$directories[$key]=New-CcodInstallGenerationLeaf -Generation $parent -Leaf $segments[$i]};$parent=$directories[$key]}
+            $length=if($null-ne$file.PSObject.Properties['ExpectedLength']){[int64]$file.ExpectedLength}else{[int64](Get-Item -LiteralPath $file.Source -Force -ErrorAction Stop).Length};$sha=if($null-ne$file.PSObject.Properties['ExpectedSha256']){[string]$file.ExpectedSha256}else{Get-CcodLifecycleFileSha256 $file.Source}
+            Copy-CcodInstallSealedSource -Generation $parent -SourcePath $file.Source -Leaf $segments[-1] -ExpectedLength $length -ExpectedSha256 $sha|Out-Null
+            $records.Add([pscustomobject][ordered]@{path=$relative;length=$length;sha256=$sha})
+        }
+        $runtimeRoot=Join-Path (Join-Path $InstallRoot 'runtime') $RuntimeId;$manifest=New-CcodRuntimeManifest -RuntimeDirectory $runtimeRoot -ProjectVersion $ProjectVersion -RuntimeId $RuntimeId
+        $manifestSeal=Write-CcodInstallGenerationManifest -Generation $transaction -Manifest $manifest
+        $validation=Test-CcodRuntimeManifest -RuntimeDirectory $runtimeRoot -ExpectedRuntimeId $RuntimeId
+        if(-not$validation.Valid){Throw-CcodLifecycleError 'CCOD_INSTALL_MANIFEST_INVALID' ('Immutable runtime manifest validation failed: '+$validation.Code) $runtimeRoot}
+        return [pscustomobject]@{FileTransaction=$transaction;Generation=$transaction;RuntimeRoot=$runtimeRoot;Manifest=$manifest;ManifestSha256=$manifestSeal.Sha256}
+    } catch {try{Close-CcodInstallFileTransaction -Transaction $transaction -Disposition Failed}catch{};throw}
+}
+
 function Get-CcodLifecycleProjectVersion {
     param([Parameter(Mandatory)][string]$SourceRoot)
 
@@ -786,7 +1026,8 @@ function Write-CcodLifecycleLog {
         [Parameter(Mandatory)][string]$Stage,
         [Parameter(Mandatory)][string]$Code,
         [Parameter(Mandatory)][string]$Outcome,
-        [switch]$ThrowOnFailure
+        [switch]$ThrowOnFailure,
+        $FileTransaction
     )
 
     try {
@@ -799,7 +1040,7 @@ function Write-CcodLifecycleLog {
             code = $Code
             outcome = $Outcome
         }
-        & $Adapters.WriteLog $InstallRoot $record
+        & $Adapters.WriteLog $InstallRoot $record $FileTransaction
     } catch {
         if ($ThrowOnFailure) { throw }
     }
@@ -1420,8 +1661,8 @@ function Get-CcodLifecycleAdapters {
         UtcNow = { [DateTime]::UtcNow }
         NewActivationId = { [guid]::NewGuid().ToString('D') }
         WriteActivationReceipt = {
-            param($InstallRoot, $Receipt)
-            Write-CcodActivationReceiptFile -InstallRoot $InstallRoot -Receipt $Receipt
+            param($InstallRoot, $Receipt,$FileTransaction)
+            Write-CcodActivationReceiptFile -InstallRoot $InstallRoot -Receipt $Receipt -FileTransaction $FileTransaction
         }
         ReadActiveLifecycleRequest = {
             param($StateRoot)
@@ -1432,8 +1673,9 @@ function Get-CcodLifecycleAdapters {
             Wait-CcodLifecycleNewRuntimeReady -InstallRoot $InstallRoot -RuntimeId $RuntimeId -RuntimeGeneration $RuntimeGeneration -Identity $Identity -TaskStartedAtUtc $TaskStartedAtUtc -TimeoutMilliseconds $TimeoutMilliseconds
         }
         InstallSupervisorTask = {
-            param($InstallRoot, $UserSid)
+            param($InstallRoot, $UserSid,$RuntimeId)
             $spec = Get-CcodSupervisorTaskSpec -InstallRoot $InstallRoot -UserSid $UserSid
+            if(-not[string]::IsNullOrWhiteSpace($RuntimeId)){$bootstrap=[IO.Path]::GetFullPath((Join-Path (Join-Path (Join-Path $InstallRoot 'runtime') $RuntimeId) 'src\persistence\bootstrap.ps1'));$spec.Argument='-NoProfile -ExecutionPolicy Bypass -STA -WindowStyle Hidden -File "'+$bootstrap+'" -InstallRoot "'+([IO.Path]::GetFullPath($InstallRoot))+'" -EntryMode Task'}
             $definition = New-CcodSupervisorTaskDefinition -Spec $spec
             Install-CcodSupervisorTask -Definition $definition -TaskName $spec.TaskName
         }
@@ -1531,8 +1773,8 @@ function Get-CcodLifecycleAdapters {
             Enter-CcodLifecycleOwnership -InstallRoot $InstallRoot -RuntimeId $RuntimeId -RuntimeGeneration $RuntimeGeneration -OwnerIdentity $OwnerIdentity -UserSid $UserSid -SessionId $SessionId
         }
         SetActiveRuntime = {
-            param($InstallRoot, $RuntimeId, $Ownership)
-            Set-CcodActiveRuntime -InstallRoot $InstallRoot -NewRuntimeId $RuntimeId -Ownership $Ownership
+            param($InstallRoot, $RuntimeId, $Ownership,$TargetGeneration,$FileTransaction)
+            Set-CcodActiveRuntime -InstallRoot $InstallRoot -TargetGeneration $TargetGeneration -FileTransaction $FileTransaction -Ownership $Ownership
         }
         ExitLifecycleOwnership = {
             param($Ownership)
@@ -1582,7 +1824,8 @@ function Get-CcodLifecycleAdapters {
             New-CcodRuntimeManifest -RuntimeDirectory $RuntimeDirectory -ProjectVersion $ProjectVersion
         }
         WriteLog = {
-            param($InstallRoot, $Record)
+            param($InstallRoot, $Record,$FileTransaction)
+            if($null-ne$FileTransaction){$state=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $FileTransaction -Leaf 'state' -CreateIfMissing;$logs=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $state -Leaf 'install-logs' -CreateIfMissing;$leaf=('{0}.{1}.{2}.json'-f([DateTime]::Parse($Record.timestampUtc).Ticks),$Record.stage,[guid]::NewGuid().ToString('N'));Write-CcodInstallRecord -Transaction $FileTransaction -Parent $logs -Leaf $leaf -Record $Record|Out-Null;return}
             $logDirectory = Join-Path $InstallRoot 'logs'
             [IO.Directory]::CreateDirectory($logDirectory) | Out-Null
             Write-CcodRotatingLog -Path (Join-Path $logDirectory 'install.log') -Message ($Record | ConvertTo-Json -Depth 6 -Compress)
@@ -1607,10 +1850,11 @@ function Install-CcodLifecycleTask {
     param(
         [Parameter(Mandatory)][string]$InstallRoot,
         [Parameter(Mandatory)][hashtable]$Adapters,
-        $Identity
+        $Identity,
+        [string]$RuntimeId
     )
 
-    & $Adapters.InstallSupervisorTask $InstallRoot $Identity.UserSid
+    & $Adapters.InstallSupervisorTask $InstallRoot $Identity.UserSid $RuntimeId
 }
 
 function Start-CcodLifecycleTask {
@@ -1864,6 +2108,31 @@ function Invoke-CcodRepairState {
     }
 }
 
+function Invoke-CcodInstallCompensation {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$TransactionRecord,[Parameter(Mandatory)]$FileTransaction,[Parameter(Mandatory)][hashtable]$Adapters,$Ownership,$Identity)
+    [void](Assert-CcodInstallTransactionRoot $InstallRoot $FileTransaction);[void](Assert-CcodInstallTransactionRecord $TransactionRecord)
+    if($null-eq$TransactionRecord.oldRuntimeId-or$null-eq$TransactionRecord.oldGeneration){Throw-CcodLifecycleError 'CCOD_INSTALL_ROLLBACK_FAILED' 'No retained generation exists for compensation' $null}
+    $manifestPath=Join-Path (Join-Path (Join-Path $InstallRoot 'runtime') $TransactionRecord.oldRuntimeId) 'manifest.json';if(-not[IO.File]::Exists($manifestPath)){Throw-CcodLifecycleError 'CCOD_INSTALL_ROLLBACK_FAILED' 'Retained generation manifest is missing' $null}
+    $retained=Open-CcodInstallRetainedGeneration -InstallRoot $InstallRoot -RuntimeId $TransactionRecord.oldRuntimeId -ExpectedManifestSha256 (Get-CcodLifecycleFileSha256 $manifestPath) -FileTransaction $FileTransaction
+    $compensationOwnership=$Ownership
+    if($null-eq$compensationOwnership-or$compensationOwnership.released){
+        $active=Read-CcodActiveRuntime -InstallRoot $InstallRoot
+        $process=[Diagnostics.Process]::GetCurrentProcess()
+        try{$ownerIdentity=[pscustomobject][ordered]@{pid=[int]$process.Id;creationTimeUtc=$process.StartTime.ToUniversalTime().ToString('o')}}finally{$process.Dispose()}
+        try{$compensationOwnership=&$Adapters.EnterLifecycleOwnership $InstallRoot ([string]$active.activeRuntime) ([uint64]$active.generation) $ownerIdentity $Identity.UserSid $Identity.SessionId}catch{Throw-CcodLifecycleError 'CCOD_INSTALL_ROLLBACK_FAILED' 'Compensation ownership could not be acquired' $null}
+    }
+    try{$pointer=&$Adapters.SetActiveRuntime $InstallRoot $TransactionRecord.oldRuntimeId $compensationOwnership $retained $FileTransaction}catch{Throw-CcodLifecycleError 'CCOD_INSTALL_ROLLBACK_FAILED' 'Compensating pointer commit failed' $null}
+    Install-CcodLifecycleTask -InstallRoot $InstallRoot -Adapters $Adapters -Identity $Identity -RuntimeId $TransactionRecord.oldRuntimeId
+    if(-not$compensationOwnership.released){
+        try{$released=&$Adapters.ExitLifecycleOwnership $compensationOwnership}catch{Throw-CcodLifecycleError 'CCOD_INSTALL_ROLLBACK_FAILED' 'Compensation ownership could not be released' $null}
+        if($released-isnot[bool]-or-not$released-or-not$compensationOwnership.released){Throw-CcodLifecycleError 'CCOD_INSTALL_ROLLBACK_FAILED' 'Compensation ownership release was not proven' $null}
+    }
+    $started=&$Adapters.UtcNow;try{&$Adapters.StartSupervisorTask}catch{Throw-CcodLifecycleError 'CCOD_INSTALL_ROLLBACK_FAILED' 'Retained generation restart failed' $null}
+    $proof=&$Adapters.WaitNewRuntimeReady $InstallRoot $TransactionRecord.oldRuntimeId ([uint64]$pointer.generation) $Identity $started 15000
+    if($null-eq$proof-or-not$proof.SupervisorReady-or-not$proof.TrayReady){Throw-CcodLifecycleError 'CCOD_INSTALL_ROLLBACK_FAILED' 'Retained generation readiness was not proven' $null}
+    return $pointer
+}
+
 function Invoke-CcodInstall {
     [CmdletBinding(SupportsShouldProcess = $true)]
     param(
@@ -1877,6 +2146,7 @@ function Invoke-CcodInstall {
         [string]$PayloadManifestPath,
         [string]$ExpectedPayloadManifestSha256,
         [string]$PayloadManifestBytesBase64,
+        [string]$SealedPackageSha256,
         [hashtable]$Adapters
     )
 
@@ -1898,6 +2168,7 @@ function Invoke-CcodInstall {
             RepairCompleted = $false
         }
     }
+    if(-not[IO.Directory]::Exists($root)){[IO.Directory]::CreateDirectory($root)|Out-Null}
 
     if (-not [IO.Directory]::Exists($sourceRoot)) {
         Throw-CcodLifecycleError 'CCOD_INSTALL_SOURCE_MISSING' 'Source checkout does not exist' $sourceRoot
@@ -1923,6 +2194,9 @@ function Invoke-CcodInstall {
         Throw-CcodLifecycleError 'CCOD_INSTALL_IDENTITY_INVALID' 'Current user identity is unavailable' $null
     }
     $projectVersion = & $adapters.GetProjectVersion $sourceRoot
+    $sealedPackageIdentitySupplied = -not [string]::IsNullOrWhiteSpace($SealedPackageSha256)
+    if([string]::IsNullOrWhiteSpace($SealedPackageSha256)){$SealedPackageSha256=if($payloadBound){$ExpectedPayloadManifestSha256}else{Get-CcodLifecycleFileSha256 (Join-Path $sourceRoot 'package.json')}}
+    if($SealedPackageSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodLifecycleError 'CCOD_INSTALL_PACKAGE_IDENTITY_INVALID' 'Sealed package SHA-256 is required' $null}
     if ($payloadBound -and [string]$projectVersion -cne $ExpectedVersion) {
         Throw-CcodLifecycleError 'CCOD_INSTALL_PAYLOAD_VERSION_MISMATCH' 'Source package version does not match the expected setup version' $sourceRoot
     }
@@ -1931,8 +2205,17 @@ function Invoke-CcodInstall {
 
     $existingPointer = $null
     $activePath = Join-Path $root 'active.json'
-    if ([IO.File]::Exists($activePath)) {
-        $existingPointer = Read-CcodActiveRuntime -InstallRoot $root
+    try{$existingPointer=Read-CcodActiveRuntime -InstallRoot $root}catch{if([IO.File]::Exists($activePath)-or[IO.Directory]::Exists((Join-Path $root 'state\active-generation'))){throw}}
+    if($null-ne$existingPointer-and$sealedPackageIdentitySupplied){
+        $activeRuntimeRoot=[IO.Path]::GetFullPath((Join-Path (Join-Path $root 'runtime') ([string]$existingPointer.activeRuntime)))
+        $activeValidation=Test-CcodRuntimeManifest -RuntimeDirectory $activeRuntimeRoot -ExpectedRuntimeId ([string]$existingPointer.activeRuntime)
+        if($activeValidation.Valid){
+            $activeTransaction=Read-CcodInstallTransactionRecord -InstallRoot $root
+            $sameIdentity=Test-CcodInstallPackageIdentity -TransactionRecord $activeTransaction -ProjectVersion ([string]$projectVersion) -ActiveProjectVersion ([string]$activeValidation.Manifest.projectVersion) -SealedPackageSha256 $SealedPackageSha256 -ActiveRuntimeId ([string]$existingPointer.activeRuntime) -ActiveGeneration ([uint64]$existingPointer.generation)
+            if($sameIdentity){
+                return [pscustomobject][ordered]@{Outcome='AlreadyInstalled';Installed=$true;RuntimeId=[string]$existingPointer.activeRuntime;PreviousRuntimeId=$existingPointer.previousRuntime;RepairCompleted=$false}
+            }
+        }
     }
 
     if ([string]::IsNullOrWhiteSpace($ActivationId)) { $ActivationId = & $adapters.NewActivationId }
@@ -1957,13 +2240,18 @@ function Invoke-CcodInstall {
     $shutdownGate = $null
     $lifecycleOwnership = $null
     $previousProtectionStopped = $false
+    $fileTransaction=$null;$generationCapability=$null;$installRecord=$null
     try {
+        $runtimeId=New-CcodUniqueRuntimeId -ProjectVersion $projectVersion -ContentSha256 $SealedPackageSha256;$generation=New-CcodLifecycleImmutableGeneration -InstallRoot $root -RuntimeId $runtimeId -ProjectVersion $projectVersion -Files $files;$fileTransaction=$generation.FileTransaction;$generationCapability=$generation.Generation;$runtimeRoot=$generation.RuntimeRoot;$runtimeCreated=$true
+        $newGeneration=if($null-eq$existingPointer){[uint64]1}else{[uint64]$existingPointer.generation+1};$installRecord=New-CcodInstallTransactionRecord -TransactionId ([guid]::NewGuid().ToString('D')) -OldRuntimeId $(if($upgrade){$existingPointer.activeRuntime}else{$null}) -OldGeneration $(if($upgrade){$existingPointer.generation}else{$null}) -NewRuntimeId $runtimeId -NewGeneration $newGeneration -SealedPackageSha256 $SealedPackageSha256 -OwnedObjectNames @($runtimeId)
+        Write-CcodInstallTransactionRecord -InstallRoot $root -TransactionRecord $installRecord -FileTransaction $fileTransaction|Out-Null
+        foreach($phase in @('PackageVerified','RuntimeStaged')){$installRecord=Set-CcodInstallTransactionPhase -InstallRoot $root -TransactionId $installRecord.transactionId -ExpectedPhase $installRecord.phase -NewPhase $phase -FileTransaction $fileTransaction}
         if ($upgrade) {
             $pending = & $adapters.ReadActiveLifecycleRequest (Join-Path $root 'state')
             if ($null -ne $pending) {
                 Throw-CcodLifecycleError 'CCOD_INSTALL_LIFECYCLE_BUSY' 'A nonterminal lifecycle transaction must complete before upgrade' $null
             }
-            Write-CcodInstallActivationPhase -Activation $activation -Phase 'StoppingPreviousRuntime' -RuntimeId $null -PreviousRuntimeId ([string]$existingPointer.activeRuntime) -ErrorCode $null -Adapters $adapters -InstallRoot $root | Out-Null
+            Write-CcodInstallActivationPhase -Activation $activation -Phase 'StoppingPreviousRuntime' -RuntimeId $null -PreviousRuntimeId ([string]$existingPointer.activeRuntime) -ErrorCode $null -Adapters $adapters -InstallRoot $root -FileTransaction $fileTransaction | Out-Null
             $shutdownGate = & $adapters.CreateSupervisorShutdownGate $identity.UserSid $identity.SessionId
             if ($null -eq $shutdownGate) {
                 Throw-CcodLifecycleError 'CCOD_INSTALL_SHUTDOWN_GATE_FAILED' 'The upgrade shutdown gate could not be created' $root
@@ -1973,6 +2261,7 @@ function Invoke-CcodInstall {
                 Throw-CcodLifecycleError 'CCOD_INSTALL_PREVIOUS_RUNTIME_BUSY' 'The verified previous Supervisor did not exit exactly' $null
             }
             $previousProtectionStopped = $true
+            $installRecord=Set-CcodInstallTransactionPhase -InstallRoot $root -TransactionId $installRecord.transactionId -ExpectedPhase 'RuntimeStaged' -NewPhase 'PreviousProtectionStopped' -FileTransaction $fileTransaction
             [void](Assert-CcodLifecycleTaskIdle -Adapters $adapters)
             $installLease = & $adapters.EnterInstallLease $identity.UserSid
             if ($null -eq $installLease -or $installLease.Outcome -isnot [string] -or @('Acquired', 'TimedOut') -cnotcontains $installLease.Outcome) {
@@ -1986,69 +2275,37 @@ function Invoke-CcodInstall {
                 Throw-CcodLifecycleError 'CCOD_INSTALL_LIFECYCLE_BUSY' 'A nonterminal lifecycle transaction appeared during upgrade shutdown' $null
             }
         }
+        if(-not$upgrade){$installRecord=Set-CcodInstallTransactionPhase -InstallRoot $root -TransactionId $installRecord.transactionId -ExpectedPhase 'RuntimeStaged' -NewPhase 'PreviousProtectionStopped' -FileTransaction $fileTransaction}
 
-        Write-CcodInstallActivationPhase -Activation $activation -Phase 'InstallingRuntime' -RuntimeId $null -PreviousRuntimeId $(if ($upgrade) { [string]$existingPointer.activeRuntime } else { $null }) -ErrorCode $null -Adapters $adapters -InstallRoot $root | Out-Null
-        $stagingDirectory = Copy-CcodLifecycleStaging -SourceRoot $sourceRoot -InstallRoot $root -Adapters $adapters -Files $files
-        $manifest = & $adapters.NewRuntimeManifest $stagingDirectory $projectVersion
-        $stagingManifestPath = Join-Path $stagingDirectory 'manifest.json'
-        [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $root -Path $stagingManifestPath -AllowMissing)
-        [IO.File]::WriteAllText(
-            $stagingManifestPath,
-            ($manifest | ConvertTo-Json -Depth 16),
-            [Text.UTF8Encoding]::new($false)
-        )
-        [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $root -Path $stagingManifestPath)
-        $runtimeId = [string]$manifest.runtimeId
-        $validation = Test-CcodRuntimeManifest -RuntimeDirectory $stagingDirectory -ExpectedRuntimeId $runtimeId
-        if (-not $validation.Valid) {
-            Throw-CcodLifecycleError 'CCOD_INSTALL_MANIFEST_INVALID' ("Staged runtime failed manifest validation: {0}" -f $validation.Code) $stagingDirectory
-        }
-        $runtimeContainer = [IO.Path]::GetFullPath((Join-Path $root 'runtime'))
-        [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $runtimeContainer)
-        $runtimeRoot = [IO.Path]::GetFullPath((Join-Path $runtimeContainer $runtimeId))
-        [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $runtimeRoot)
-        if ([IO.Directory]::Exists($runtimeRoot)) {
-            $existingValidation = Test-CcodRuntimeManifest -RuntimeDirectory $runtimeRoot -ExpectedRuntimeId $runtimeId
-            if (-not $existingValidation.Valid) {
-                Throw-CcodLifecycleError 'CCOD_INSTALL_RUNTIME_CONFLICT' 'An invalid runtime already occupies the target runtime id' $runtimeRoot
-            }
-            if ([IO.Directory]::Exists($stagingDirectory)) {
-                try { [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $stagingDirectory); Remove-Item -LiteralPath $stagingDirectory -Recurse -Force -ErrorAction Stop } catch { }
-            }
-        } else {
-            [IO.Directory]::CreateDirectory($runtimeContainer) | Out-Null
-            [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $runtimeContainer)
-            [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $stagingDirectory)
-            [IO.Directory]::Move($stagingDirectory, $runtimeRoot)
-            [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $root -Path $runtimeRoot)
-            $runtimeCreated = $true
-        }
-        $stagingDirectory = $null
+        Write-CcodInstallActivationPhase -Activation $activation -Phase 'InstallingRuntime' -RuntimeId $runtimeId -PreviousRuntimeId $(if ($upgrade) { [string]$existingPointer.activeRuntime } else { $null }) -ErrorCode $null -Adapters $adapters -InstallRoot $root -FileTransaction $fileTransaction | Out-Null
+        $installRecord=Set-CcodInstallTransactionPhase -InstallRoot $root -TransactionId $installRecord.transactionId -ExpectedPhase 'PreviousProtectionStopped' -NewPhase 'RuntimePromoted' -FileTransaction $fileTransaction
         if (-not $upgrade) {
             $stateRoot = Join-Path $root 'state'
-            Initialize-CcodState -StateRoot $stateRoot -NodeCandidates $nodeCandidates -CandidateCompatibleOptIn ([bool]$EnableCandidateCompatibleUpdates)
-            Initialize-CcodUiPreference -StateRoot $stateRoot | Out-Null
+            Initialize-CcodState -StateRoot $stateRoot -NodeCandidates $nodeCandidates -CandidateCompatibleOptIn ([bool]$EnableCandidateCompatibleUpdates) -FileTransaction $fileTransaction -InitializationId $runtimeId
+            Initialize-CcodUiPreference -StateRoot $stateRoot -FileTransaction $fileTransaction -InitializationId $runtimeId | Out-Null
         }
-        Write-CcodInstallActivationPhase -Activation $activation -Phase 'ActivatingRuntime' -RuntimeId $runtimeId -PreviousRuntimeId $(if ($upgrade) { [string]$existingPointer.activeRuntime } else { $null }) -ErrorCode $null -Adapters $adapters -InstallRoot $root | Out-Null
+        Write-CcodInstallActivationPhase -Activation $activation -Phase 'ActivatingRuntime' -RuntimeId $runtimeId -PreviousRuntimeId $(if ($upgrade) { [string]$existingPointer.activeRuntime } else { $null }) -ErrorCode $null -Adapters $adapters -InstallRoot $root -FileTransaction $fileTransaction | Out-Null
         $process = [Diagnostics.Process]::GetCurrentProcess()
         try {
             $ownerIdentity = [pscustomobject][ordered]@{ pid=[int]$process.Id; creationTimeUtc=$process.StartTime.ToUniversalTime().ToString('o') }
             $ownershipRuntimeId = if ($null -ne $existingPointer) { [string]$existingPointer.activeRuntime } else { $runtimeId }
             [UInt64]$ownershipGeneration = if ($null -ne $existingPointer) { [UInt64]$existingPointer.generation } else { 1 }
             $lifecycleOwnership = & $adapters.EnterLifecycleOwnership $root $ownershipRuntimeId $ownershipGeneration $ownerIdentity $identity.UserSid $identity.SessionId
-            $pointer = & $adapters.SetActiveRuntime $root $runtimeId $lifecycleOwnership
+            $pointer = & $adapters.SetActiveRuntime $root $runtimeId $lifecycleOwnership $generationCapability $fileTransaction
         } finally { $process.Dispose() }
         [UInt64]$expectedGeneration = if ($null -ne $existingPointer) { [UInt64]$existingPointer.generation + 1 } else { 1 }
         if ($null -eq $pointer -or $pointer.activeRuntime -cne $runtimeId -or [UInt64]$pointer.generation -ne $expectedGeneration) {
             Throw-CcodLifecycleError 'CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN' 'The active runtime generation commit could not be proven' $null
         }
         $pointerCommitted = $true
+        $installRecord=Set-CcodInstallTransactionPhase -InstallRoot $root -TransactionId $installRecord.transactionId -ExpectedPhase 'RuntimePromoted' -NewPhase 'PointerCommitted' -FileTransaction $fileTransaction
         if ($null -ne $shutdownGate) {
             & $adapters.CloseSupervisorShutdownGate $shutdownGate
             $shutdownGate = $null
         }
-        Write-CcodInstallActivationPhase -Activation $activation -Phase 'StartingProtection' -RuntimeId $runtimeId -PreviousRuntimeId $pointer.previousRuntime -ErrorCode $null -Adapters $adapters -InstallRoot $root | Out-Null
-        Install-CcodLifecycleTask -InstallRoot $root -Adapters $adapters -Identity $identity
+        Write-CcodInstallActivationPhase -Activation $activation -Phase 'StartingProtection' -RuntimeId $runtimeId -PreviousRuntimeId $pointer.previousRuntime -ErrorCode $null -Adapters $adapters -InstallRoot $root -FileTransaction $fileTransaction | Out-Null
+        Install-CcodLifecycleTask -InstallRoot $root -Adapters $adapters -Identity $identity -RuntimeId $runtimeId
+        $installRecord=Set-CcodInstallTransactionPhase -InstallRoot $root -TransactionId $installRecord.transactionId -ExpectedPhase 'PointerCommitted' -NewPhase 'StableShellCommitted' -FileTransaction $fileTransaction
         if ($DoNotStart) {
             Throw-CcodLifecycleError 'CCOD_INSTALL_NEW_RUNTIME_NOT_READY' 'Activation cannot succeed without starting and proving the new runtime' $null
         }
@@ -2071,6 +2328,7 @@ function Invoke-CcodInstall {
             -not $readyProof.SupervisorReady -or -not $readyProof.TrayReady) {
             Throw-CcodLifecycleError 'CCOD_INSTALL_NEW_RUNTIME_NOT_READY' 'The new Supervisor and authenticated TrayHost readiness were not proven' $null
         }
+        $installRecord=Set-CcodInstallTransactionPhase -InstallRoot $root -TransactionId $installRecord.transactionId -ExpectedPhase 'StableShellCommitted' -NewPhase 'ProtectionReady' -FileTransaction $fileTransaction
         $finalPointer = Read-CcodActiveRuntime -InstallRoot $root
         $finalValidation = Test-CcodRuntimeManifest -RuntimeDirectory $runtimeRoot -ExpectedRuntimeId $runtimeId
         $finalExpectedVersion = if ($payloadBound) { $ExpectedVersion } else { [string]$projectVersion }
@@ -2078,17 +2336,12 @@ function Invoke-CcodInstall {
             -not $finalValidation.Valid -or [string]$finalValidation.Manifest.projectVersion -cne $finalExpectedVersion) {
             Throw-CcodLifecycleError 'CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN' 'The final active pointer and runtime version could not be revalidated' $runtimeRoot
         }
-        Write-CcodInstallActivationPhase -Activation $activation -Phase 'Ready' -RuntimeId $runtimeId -PreviousRuntimeId $pointer.previousRuntime -ErrorCode $null -Adapters $adapters -InstallRoot $root | Out-Null
-        if ($upgrade) {
-            try { Remove-CcodLifecycleOldRuntimes -InstallRoot $root -ActiveRuntimeId $runtimeId -PreviousRuntimeId $pointer.previousRuntime }
-            catch {
-                try { Write-CcodLifecycleLog -InstallRoot $root -Adapters $adapters -Stage 'OldRuntimeCleanup' -Code 'CCOD_INSTALL_OLD_RUNTIME_CLEANUP_FAILED' -Outcome 'Retained' } catch { }
-            }
-        }
+        Write-CcodInstallActivationPhase -Activation $activation -Phase 'Ready' -RuntimeId $runtimeId -PreviousRuntimeId $pointer.previousRuntime -ErrorCode $null -Adapters $adapters -InstallRoot $root -FileTransaction $fileTransaction | Out-Null
+        $installRecord=Set-CcodInstallTransactionPhase -InstallRoot $root -TransactionId $installRecord.transactionId -ExpectedPhase 'ProtectionReady' -NewPhase 'Ready' -FileTransaction $fileTransaction
         try {
-            Write-CcodLifecycleLog -InstallRoot $root -Adapters $adapters -Stage $(if ($upgrade) { 'Upgrade' } else { 'Install' }) -Code 'CCOD_INSTALL_COMPLETED' -Outcome $(if ($upgrade) { 'Upgraded' } else { 'Installed' }) -ThrowOnFailure
+            Write-CcodLifecycleLog -InstallRoot $root -Adapters $adapters -Stage $(if ($upgrade) { 'Upgrade' } else { 'Install' }) -Code 'CCOD_INSTALL_COMPLETED' -Outcome $(if ($upgrade) { 'Upgraded' } else { 'Installed' }) -ThrowOnFailure -FileTransaction $fileTransaction
         } catch {
-            try { Write-CcodLifecycleLog -InstallRoot $root -Adapters $adapters -Stage 'PostReady' -Code 'CCOD_INSTALL_POST_READY_LOG_FAILED' -Outcome 'ReadyRetained' } catch { }
+            try { Write-CcodLifecycleLog -InstallRoot $root -Adapters $adapters -Stage 'PostReady' -Code 'CCOD_INSTALL_POST_READY_LOG_FAILED' -Outcome 'ReadyRetained' -FileTransaction $fileTransaction } catch { }
         }
     } catch {
         $caught = $_
@@ -2102,7 +2355,7 @@ function Invoke-CcodInstall {
                 default { 'CCOD_INSTALL_FAILED' }
             }
         }
-        if (-not $pointerCommitted -and $null -ne $runtimeId -and [IO.File]::Exists($activePath)) {
+        if (-not $pointerCommitted -and $null -ne $runtimeId) {
             try {
                 $observedPointer = Read-CcodActiveRuntime -InstallRoot $root
                 if ($observedPointer.activeRuntime -ceq $runtimeId -and ($null -eq $existingPointer -or [UInt64]$observedPointer.generation -gt [UInt64]$existingPointer.generation)) {
@@ -2110,6 +2363,7 @@ function Invoke-CcodInstall {
                 }
             } catch { }
         }
+        if($pointerCommitted-and$upgrade-and$null-ne$fileTransaction-and$null-ne$installRecord){try{$pointer=Invoke-CcodInstallCompensation -InstallRoot $root -TransactionRecord $installRecord -FileTransaction $fileTransaction -Adapters $adapters -Ownership $lifecycleOwnership -Identity $identity}catch{$errorCode='CCOD_INSTALL_ROLLBACK_FAILED'}}
         if (-not $pointerCommitted -and $upgrade -and $previousProtectionStopped) {
             $rollbackFailure = $null
             try {
@@ -2138,21 +2392,19 @@ function Invoke-CcodInstall {
                     -not $rollbackProof.SupervisorReady -or -not $rollbackProof.TrayReady) {
                     throw 'Previous runtime readiness was not proven'
                 }
-                try { Write-CcodLifecycleLog -InstallRoot $root -Adapters $adapters -Stage 'UpgradeRollback' -Code 'CCOD_INSTALL_PREVIOUS_RUNTIME_RESTORED' -Outcome 'Restored' } catch { }
+                try { Write-CcodLifecycleLog -InstallRoot $root -Adapters $adapters -Stage 'UpgradeRollback' -Code 'CCOD_INSTALL_PREVIOUS_RUNTIME_RESTORED' -Outcome 'Restored' -FileTransaction $fileTransaction } catch { }
             } catch {
                 $rollbackFailure = $_
             }
             if ($null -ne $rollbackFailure) {
                 $errorCode = 'CCOD_INSTALL_ROLLBACK_FAILED'
-                try { Write-CcodLifecycleLog -InstallRoot $root -Adapters $adapters -Stage 'UpgradeRollback' -Code $errorCode -Outcome 'Failed' } catch { }
+                try { Write-CcodLifecycleLog -InstallRoot $root -Adapters $adapters -Stage 'UpgradeRollback' -Code $errorCode -Outcome 'Failed' -FileTransaction $fileTransaction } catch { }
             }
         }
-        if (-not $pointerCommitted -and $runtimeCreated -and $null -ne $runtimeRoot -and [IO.Directory]::Exists($runtimeRoot)) {
-            try { [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $runtimeRoot); Remove-Item -LiteralPath $runtimeRoot -Recurse -Force -ErrorAction Stop } catch { }
-        }
+        if($null-ne$installRecord-and$null-ne$fileTransaction-and$installRecord.phase-notin@('Ready','Failed')){try{$installRecord=Set-CcodInstallTransactionPhase -InstallRoot $root -TransactionId $installRecord.transactionId -ExpectedPhase $installRecord.phase -NewPhase Failed -ErrorCode $errorCode -FileTransaction $fileTransaction}catch{}}
         if ($errorCode -cne 'CCOD_INSTALL_ACTIVATION_RECEIPT_FAILED') {
             try {
-                Write-CcodInstallActivationPhase -Activation $activation -Phase 'Failed' -RuntimeId $runtimeId -PreviousRuntimeId $(if ($null -ne $existingPointer) { [string]$existingPointer.activeRuntime } else { $null }) -ErrorCode $errorCode -Adapters $adapters -InstallRoot $root | Out-Null
+                Write-CcodInstallActivationPhase -Activation $activation -Phase 'Failed' -RuntimeId $runtimeId -PreviousRuntimeId $(if ($null -ne $existingPointer) { [string]$existingPointer.activeRuntime } else { $null }) -ErrorCode $errorCode -Adapters $adapters -InstallRoot $root -FileTransaction $fileTransaction | Out-Null
             } catch { }
         }
         if ((Get-CcodLifecycleErrorId $caught) -ceq $errorCode) { throw $caught }
@@ -2167,13 +2419,7 @@ function Invoke-CcodInstall {
         if ($null -ne $lifecycleOwnership -and -not $lifecycleOwnership.released) {
             try { & $adapters.ExitLifecycleOwnership $lifecycleOwnership | Out-Null } catch { }
         }
-        if ($null -ne $stagingDirectory -and [IO.Directory]::Exists($stagingDirectory)) {
-            try { [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $stagingDirectory); Remove-Item -LiteralPath $stagingDirectory -Recurse -Force -ErrorAction Stop } catch { }
-        }
-        $stagingRoot = [IO.Path]::GetFullPath((Join-Path $root '.staging'))
-        if ([IO.Directory]::Exists($stagingRoot) -and -not (Test-CcodLifecycleReparse -Path $stagingRoot)) {
-            try { [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $stagingRoot); Remove-Item -LiteralPath $stagingRoot -Recurse -Force -ErrorAction Stop } catch { }
-        }
+        if($null-ne$fileTransaction){try{Close-CcodInstallFileTransaction -Transaction $fileTransaction -Disposition $(if($null-ne$installRecord-and$installRecord.phase-ceq'Ready'){'Ready'}else{'Failed'})}catch{}}
     }
 
     return [pscustomobject][ordered]@{
diff --git a/src/persistence/modules/PersistenceIO.psm1 b/src/persistence/modules/PersistenceIO.psm1
index a69517b..41f4b8b 100644
--- a/src/persistence/modules/PersistenceIO.psm1
+++ b/src/persistence/modules/PersistenceIO.psm1
@@ -546,7 +546,8 @@ function Read-CcodStrictJson {
     param(
         [Parameter(Mandatory)][string]$Path,
         [Parameter(Mandatory)]$ExpectedSchema,
-        [Parameter(Mandatory)][string]$Kind
+        [Parameter(Mandatory)][string]$Kind,
+        [ValidateRange(1,10485760)][int64]$MaxBytes = 1048576
     )
 
     if (-not [IO.File]::Exists($Path)) {
@@ -554,7 +555,31 @@ function Read-CcodStrictJson {
     }
 
     try {
-        $json = [IO.File]::ReadAllText($Path, [Text.UTF8Encoding]::new($false))
+        $item = Get-Item -LiteralPath $Path -Force -ErrorAction Stop
+        if ($item.PSIsContainer -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) {
+            Throw-CcodError 'CCOD_STATE_UNSAFE' "$Kind state is not a plain file" $Path
+        }
+        if ([int64]$item.Length -gt $MaxBytes) {
+            Throw-CcodError 'CCOD_STATE_TOO_LARGE' "$Kind state exceeds the bounded record size" $Path
+        }
+        $stream = [IO.File]::Open($Path,[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read)
+        try {
+            if ($stream.Length -gt $MaxBytes -or $stream.Length -gt [int]::MaxValue) {
+                Throw-CcodError 'CCOD_STATE_TOO_LARGE' "$Kind state exceeds the bounded record size" $Path
+            }
+            $bytes = [byte[]]::new([int]$stream.Length)
+            $offset = 0
+            while ($offset -lt $bytes.Length) {
+                $read = $stream.Read($bytes,$offset,$bytes.Length-$offset)
+                if ($read -le 0) { Throw-CcodError 'CCOD_STATE_MALFORMED' "$Kind state could not be read completely" $Path }
+                $offset += $read
+            }
+            if ($stream.ReadByte() -ne -1) { Throw-CcodError 'CCOD_STATE_TOO_LARGE' "$Kind state changed beyond the bounded record size" $Path }
+        } finally { $stream.Dispose() }
+        $json = [Text.UTF8Encoding]::new($false,$true).GetString($bytes)
+    } catch [Management.Automation.RuntimeException] {
+        if (([string]$_.FullyQualifiedErrorId -split ',')[0] -clike 'CCOD_*') { throw }
+        Throw-CcodError 'CCOD_STATE_MALFORMED' "$Kind state is not valid JSON" $Path
     } catch {
         Throw-CcodError 'CCOD_STATE_MALFORMED' "$Kind state is not valid JSON" $Path
     }
diff --git a/src/persistence/modules/RuntimeManifest.psm1 b/src/persistence/modules/RuntimeManifest.psm1
index 54e0d31..a422aa9 100644
--- a/src/persistence/modules/RuntimeManifest.psm1
+++ b/src/persistence/modules/RuntimeManifest.psm1
@@ -196,14 +196,15 @@ function New-CcodRuntimeManifest {
     [CmdletBinding()]
     param(
         [Parameter(Mandatory)][string]$RuntimeDirectory,
-        [Parameter(Mandatory)][string]$ProjectVersion
+        [Parameter(Mandatory)][string]$ProjectVersion,
+        [string]$RuntimeId
     )
 
     $files = @(Get-CcodRuntimeFileRecords -RuntimeDirectory $RuntimeDirectory)
     return [pscustomobject][ordered]@{
         schemaVersion = 1
         projectVersion = $ProjectVersion
-        runtimeId = Get-CcodRuntimeId -ProjectVersion $ProjectVersion -Files $files
+        runtimeId = if ([string]::IsNullOrWhiteSpace($RuntimeId)) { Get-CcodRuntimeId -ProjectVersion $ProjectVersion -Files $files } else { Assert-CcodRuntimeId $RuntimeId }
         files = $files
     }
 }
@@ -309,10 +310,6 @@ function Test-CcodRuntimeManifest {
         }
     }
 
-    $computedRuntimeId = Get-CcodRuntimeId -ProjectVersion ([string]$projectVersionProperty.Value) -Files $actualFiles
-    if ($computedRuntimeId -cne $manifestRuntimeId) {
-        return New-CcodRuntimeValidationResult -Valid $false -Code 'CCOD_RUNTIME_ID_MISMATCH' -RuntimeId $manifestRuntimeId -Manifest $manifest
-    }
     return New-CcodRuntimeValidationResult -Valid $true -Code 'CCOD_RUNTIME_VALID' -RuntimeId $manifestRuntimeId -Manifest $manifest
 }
 
@@ -330,6 +327,24 @@ function Read-CcodActiveRuntime {
     [CmdletBinding()]
     param([Parameter(Mandatory)][string]$InstallRoot)
 
+    $pointerRoot = Resolve-CcodContainedPath -Root $InstallRoot -RelativePath 'state\active-generation' -AllowMissingLeaf
+    if ([IO.Directory]::Exists($pointerRoot)) {
+        $entries=@(Get-ChildItem -LiteralPath $pointerRoot -Force -ErrorAction Stop)
+        if($entries.Count-eq 0){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation store is empty' $pointerRoot}
+        $records=[Collections.Generic.List[object]]::new()
+        foreach($entry in $entries){
+            if($entry.PSIsContainer-or($entry.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0-or$entry.Name-cnotmatch'^\d{20}\.json$'){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation store contains an unknown object' $entry.FullName}
+            $record=Read-CcodStrictJson -Path $entry.FullName -ExpectedSchema 1 -Kind 'active generation'
+            $names=@($record.PSObject.Properties.Name);if(($names-join',')-cne'schemaVersion,generation,activeRuntime,previousGeneration'-or$record.activeRuntime-isnot[string]){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation record fields are invalid' $entry.FullName}
+            $generation=ConvertTo-CcodRuntimeGeneration $record.generation $entry.FullName
+            $integerTypes=@([byte],[uint16],[uint32],[uint64],[int16],[int32],[int64]);$typed=$false;foreach($t in $integerTypes){if($record.previousGeneration-is$t){$typed=$true;break}};if(-not$typed){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Previous generation is not an integer' $entry.FullName}
+            [uint64]$previous=$record.previousGeneration;if($generation-ne($previous+1)-or$entry.Name-cne('{0:D20}.json'-f$generation)){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation record is not canonical' $entry.FullName}
+            Assert-CcodRuntimeId $record.activeRuntime|Out-Null;$records.Add([pscustomobject]@{generation=$generation;previousGeneration=$previous;activeRuntime=[string]$record.activeRuntime})
+        }
+        $ordered=@($records|Sort-Object generation);for($i=0;$i-lt$ordered.Count;$i++){if([uint64]$ordered[$i].generation-ne[uint64]($i+1)-or[uint64]$ordered[$i].previousGeneration-ne[uint64]$i){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation chain has a gap' $pointerRoot}}
+        $latest=$ordered[-1];$previousRuntime=if($latest.previousGeneration-gt0){[string]$ordered[[int]$latest.previousGeneration-1].activeRuntime}else{$null}
+        return [pscustomobject][ordered]@{schemaVersion=2;activeRuntime=$latest.activeRuntime;previousRuntime=$previousRuntime;generation=[uint64]$latest.generation;updatedAtUtc=(Get-Item $pointerRoot).LastWriteTimeUtc.ToString('o')}
+    }
     $path = Resolve-CcodContainedPath -Root $InstallRoot -RelativePath 'active.json' -AllowMissingLeaf
     $active = $null
     $legacy = $false
@@ -404,7 +419,9 @@ function Set-CcodActiveRuntime {
     [CmdletBinding()]
     param(
         [Parameter(Mandatory)][string]$InstallRoot,
-        [Parameter(Mandatory)][string]$NewRuntimeId,
+        [string]$NewRuntimeId,
+        $TargetGeneration,
+        $FileTransaction,
         $Ownership,
         [hashtable]$Adapters
     )
@@ -413,6 +430,15 @@ function Set-CcodActiveRuntime {
     if ($null -eq $Ownership) {
         Throw-CcodRuntimeError 'CCOD_RUNTIME_FENCE_REQUIRED' 'Active runtime mutation requires proven lifecycle ownership' $InstallRoot
     }
+    if($null-ne$FileTransaction-or$null-ne$TargetGeneration){
+        if($null-eq(Get-Command Commit-CcodInstallActivePointer -ErrorAction SilentlyContinue)){Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop}
+        if($null-eq$FileTransaction-or$null-eq$TargetGeneration){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Pointer commit requires target and transaction' $InstallRoot}
+        $current=$null;try{$current=Read-CcodActiveRuntime $InstallRoot}catch{if((Get-CcodErrorId $_)-notin@('CCOD_STATE_MISSING','CCOD_PATH_MISSING')){throw}}
+        [uint64]$previous=if($null-eq$current){0}else{$current.generation}
+        try{[void](& $Adapters.AssertLifecycleFence $InstallRoot $Ownership ($null-ne$current) $(if($null-ne$current){$current.activeRuntime}else{$null}))}catch{Throw-CcodRuntimeError 'CCOD_RUNTIME_FENCE_STALE' 'Active runtime mutation lifecycle fence is stale' $InstallRoot}
+        $committed=Commit-CcodInstallActivePointer -InstallRoot $InstallRoot -TargetGeneration $TargetGeneration -ExpectedPreviousGeneration $previous -FileTransaction $FileTransaction
+        return Read-CcodActiveRuntime -InstallRoot $InstallRoot
+    }
     Assert-CcodRuntimeId -RuntimeId $NewRuntimeId | Out-Null
     $runtimeDirectory = Get-CcodRuntimeDirectoryForId -InstallRoot $InstallRoot -RuntimeId $NewRuntimeId
     $validation = Test-CcodRuntimeManifest -RuntimeDirectory $runtimeDirectory -ExpectedRuntimeId $NewRuntimeId
diff --git a/src/persistence/modules/StateStore.psm1 b/src/persistence/modules/StateStore.psm1
index a24a49a..74aeb58 100644
--- a/src/persistence/modules/StateStore.psm1
+++ b/src/persistence/modules/StateStore.psm1
@@ -382,14 +382,15 @@ function Write-CcodTypedState {
         [Parameter(Mandatory)][string]$Leaf,
         [Parameter(Mandatory)]$Value,
         [Parameter(Mandatory)][scriptblock]$Validator,
-        [hashtable]$Adapters
+        [hashtable]$Adapters,
+        $FileTransaction
     )
 
     if (-not (Test-CcodSchemaVersionOne -Value $Value)) {
         Throw-CcodStateError 'CCOD_SCHEMA_UNSUPPORTED' 'State writes require schema version 1' $Value
     }
     & $Validator $Value $Adapters
-    Write-CcodAtomicJson -Path (Get-CcodStatePath -StateRoot $StateRoot -Leaf $Leaf) -Value $Value
+    if($null-ne$FileTransaction){$state=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $FileTransaction -Leaf 'state' -CreateIfMissing;Write-CcodInstallRecord -Transaction $FileTransaction -Parent $state -Leaf $Leaf -Record $Value|Out-Null}else{Write-CcodAtomicJson -Path (Get-CcodStatePath -StateRoot $StateRoot -Leaf $Leaf) -Value $Value}
 }
 
 function Initialize-CcodState {
@@ -398,7 +399,9 @@ function Initialize-CcodState {
         [Parameter(Mandatory)][string]$StateRoot,
         [string[]]$NodeCandidates = @(),
         [bool]$CandidateCompatibleOptIn = $false,
-        [hashtable]$Adapters
+        [hashtable]$Adapters,
+        $FileTransaction,
+        [string]$InitializationId
     )
 
     $adapters = Get-CcodStateAdapters -Adapters $Adapters
@@ -418,10 +421,25 @@ function Initialize-CcodState {
         Throw-CcodStateError 'CCOD_STATE_ALREADY_INITIALIZED' 'State initialization refuses to overwrite existing evidence; use explicit repair' $StateRoot
     }
 
-    Write-CcodSettings -StateRoot $StateRoot -Settings (New-CcodSettings -NodeCandidates $NodeCandidates -CandidateCompatibleOptIn $CandidateCompatibleOptIn -AutomationEnabled $true -UpdatedAtUtc (Get-CcodStateTimestamp -Adapters $adapters)) -Adapters $adapters
-    Write-CcodTypedState -StateRoot $StateRoot -Leaf 'status.json' -Value (New-CcodStatusStore) -Validator ${function:Assert-CcodStatusShape} -Adapters $adapters
-    Write-CcodVerifiedPackages -StateRoot $StateRoot -VerifiedPackages (New-CcodVerifiedPackagesStore) -Adapters $adapters
-    Write-CcodTypedState -StateRoot $StateRoot -Leaf 'transition.json' -Value (New-CcodTransitionStore) -Validator ${function:Assert-CcodTransitionShape} -Adapters $adapters
+    $settings = New-CcodSettings -NodeCandidates $NodeCandidates -CandidateCompatibleOptIn $CandidateCompatibleOptIn -AutomationEnabled $true -UpdatedAtUtc (Get-CcodStateTimestamp -Adapters $adapters)
+    $status = New-CcodStatusStore
+    $verifiedPackages = New-CcodVerifiedPackagesStore
+    $transition = New-CcodTransitionStore
+    if($null-ne$FileTransaction){
+      if($null-eq(Get-Command New-CcodInstallDirectory -ErrorAction SilentlyContinue)){Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop}
+      if($InitializationId-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$'){Throw-CcodStateError 'CCOD_STATE_INITIALIZATION_INVALID' 'Immutable initialization identity is invalid' $InitializationId}
+      $state=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $FileTransaction -Leaf 'state' -CreateIfMissing
+      $initializations=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $state -Leaf 'install-initializations' -CreateIfMissing
+      $baseline=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $initializations -Leaf $InitializationId -CreateIfMissing
+      Write-CcodInstallRecord -Transaction $FileTransaction -Parent $baseline -Leaf 'settings.json' -Record $settings|Out-Null
+      Write-CcodInstallRecord -Transaction $FileTransaction -Parent $baseline -Leaf 'status.json' -Record $status|Out-Null
+      Write-CcodInstallRecord -Transaction $FileTransaction -Parent $baseline -Leaf 'verified-packages.json' -Record $verifiedPackages|Out-Null
+      Write-CcodInstallRecord -Transaction $FileTransaction -Parent $baseline -Leaf 'transition.json' -Record $transition|Out-Null
+    }
+    Write-CcodSettings -StateRoot $StateRoot -Settings $settings -Adapters $adapters
+    Write-CcodTypedState -StateRoot $StateRoot -Leaf 'status.json' -Value $status -Validator ${function:Assert-CcodStatusShape} -Adapters $adapters
+    Write-CcodVerifiedPackages -StateRoot $StateRoot -VerifiedPackages $verifiedPackages -Adapters $adapters
+    Write-CcodTypedState -StateRoot $StateRoot -Leaf 'transition.json' -Value $transition -Validator ${function:Assert-CcodTransitionShape} -Adapters $adapters
 }
 
 function Read-CcodSettings {
diff --git a/src/persistence/modules/UiPreferences.psm1 b/src/persistence/modules/UiPreferences.psm1
index dac297b..76e2a10 100644
--- a/src/persistence/modules/UiPreferences.psm1
+++ b/src/persistence/modules/UiPreferences.psm1
@@ -100,11 +100,19 @@ function Get-CcodUiPreferenceTimestamp {
 
 function Initialize-CcodUiPreference {
     [CmdletBinding()]
-    param([Parameter(Mandatory)][string]$StateRoot)
+    param([Parameter(Mandatory)][string]$StateRoot,$FileTransaction,[string]$InitializationId)
 
     $path = Resolve-CcodContainedPath -Root $StateRoot -RelativePath 'ui-preferences.json' -AllowMissingLeaf
     $store = New-CcodUiPreferenceStore -LanguageMode 'System' -UpdatedAtUtc (Get-CcodUiPreferenceTimestamp -Adapters (Get-CcodUiPreferenceAdapters))
     Assert-CcodUiPreferenceStore -Store $store
+    if($null-ne$FileTransaction){
+        if($null-eq(Get-Command New-CcodInstallDirectory -ErrorAction SilentlyContinue)){Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop}
+        if($InitializationId-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$'){Throw-CcodUiPreferenceError 'CCOD_UI_PREFERENCES_INVALID' 'Immutable initialization identity is invalid.' $InitializationId}
+        $state=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $FileTransaction -Leaf 'state' -CreateIfMissing
+        $initializations=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $state -Leaf 'install-initializations' -CreateIfMissing
+        $baseline=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $initializations -Leaf $InitializationId -CreateIfMissing
+        try{Write-CcodInstallRecord -Transaction $FileTransaction -Parent $baseline -Leaf 'ui-preferences.json' -Record $store|Out-Null}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_RECORD_EXISTS*'){Throw-CcodUiPreferenceError 'CCOD_UI_PREFERENCES_EXISTS' 'UI preference baseline already exists.' $path};throw}
+    }
     try {
         Write-CcodAtomicJsonIfAbsent -Path $path -Value $store
     } catch {
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index 8672679..6dbbb54 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -184,6 +184,7 @@ function New-CcodLifecycleFake {
         LogRecords = [Collections.Generic.List[object]]::new()
         FailLogCode = $null
         CopyOverride = $null
+        TaskRuntimeIds = [Collections.Generic.List[string]]::new()
     }
     $adapters = @{}
     $adapters.ValidateSource = { param($SourceRoot) $world.Calls.Add("Validate:$([IO.Path]::GetFileName($SourceRoot))"); [bool]$world.ValidateSource }.GetNewClosure()
@@ -192,20 +193,25 @@ function New-CcodLifecycleFake {
     $adapters.ValidateNodeCandidate = { param($Path) $world.Calls.Add("ValidateNode:$([IO.Path]::GetFileName($Path))"); $Path -ceq $world.NodePath }.GetNewClosure()
     $adapters.GetCurrentIdentity = { $world.Calls.Add('Identity'); $world.Identity }.GetNewClosure()
     $adapters.UtcNow = { $world.Calls.Add('Now'); $world.NowUtc }.GetNewClosure()
-    $adapters.NewActivationId = { 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee' }.GetNewClosure()
+    $adapters.NewActivationId = { [guid]::NewGuid().ToString('D') }.GetNewClosure()
     $adapters.WriteActivationReceipt = {
-        param($InstallRoot, $Receipt)
+        param($InstallRoot, $Receipt, $FileTransaction)
         $world.Phases.Add([string]$Receipt.phase)
-        $stateRoot = Join-Path $InstallRoot 'state'
-        [IO.Directory]::CreateDirectory($stateRoot) | Out-Null
-        [IO.File]::WriteAllText((Join-Path $stateRoot 'post-install-activation.json'), ($Receipt | ConvertTo-Json -Depth 8), [Text.UTF8Encoding]::new($false))
+        if ($null -ne $FileTransaction) {
+            $module = Get-Module -Name InstallLifecycle -ErrorAction Stop
+            & $module { param($Root,$Value,$Transaction) Write-CcodActivationReceiptFile -InstallRoot $Root -Receipt $Value -FileTransaction $Transaction } $InstallRoot $Receipt $FileTransaction
+        } else {
+            $stateRoot = Join-Path $InstallRoot 'state'
+            [IO.Directory]::CreateDirectory($stateRoot) | Out-Null
+            [IO.File]::WriteAllText((Join-Path $stateRoot 'post-install-activation.json'), ($Receipt | ConvertTo-Json -Depth 8), [Text.UTF8Encoding]::new($false))
+        }
     }.GetNewClosure()
     $adapters.ReadActiveLifecycleRequest = { param($StateRoot) $world.Calls.Add('ReadActiveLifecycleRequest');$world.ActiveLifecycleRequest }.GetNewClosure()
     $adapters.WaitNewRuntimeReady = {
         param($InstallRoot, $RuntimeId, $RuntimeGeneration, $Identity, $TaskStartedAtUtc, $TimeoutMilliseconds)
         [pscustomobject][ordered]@{ SupervisorReady = [bool]$world.NewSupervisorReady; TrayReady = [bool]$world.NewTrayReady }
     }.GetNewClosure()
-    $adapters.InstallSupervisorTask = { param($InstallRoot, $UserSid) $world.Calls.Add("InstallTask:$([IO.Path]::GetFileName($InstallRoot)):$UserSid"); $world.TaskInstalled++ }.GetNewClosure()
+    $adapters.InstallSupervisorTask = { param($InstallRoot, $UserSid, $RuntimeId) $world.Calls.Add("InstallTask:$([IO.Path]::GetFileName($InstallRoot)):${UserSid}:$RuntimeId"); $world.TaskRuntimeIds.Add([string]$RuntimeId); $world.TaskInstalled++ }.GetNewClosure()
     $adapters.RemoveSupervisorTask = { $world.Calls.Add('RemoveTask'); $world.TaskRemoved++ }.GetNewClosure()
     $adapters.TestSupervisorTaskAbsent = { $world.Calls.Add('TaskAbsent'); [bool]$world.TaskAbsent }.GetNewClosure()
     $adapters.StartSupervisorTask = { $world.Calls.Add('StartTask');if($world.StartTaskFailure){throw 'PRIVATE_TASK_START_SECRET'};$world.TaskStarted++ }.GetNewClosure()
@@ -252,10 +258,10 @@ function New-CcodLifecycleFake {
         }
     }.GetNewClosure()
     $adapters.SetActiveRuntime = {
-        param($InstallRoot, $RuntimeId, $Ownership)
-        if ($null -ne $world.SetActiveFailure) { & $world.SetActiveFailure $InstallRoot $RuntimeId $Ownership }
+        param($InstallRoot, $RuntimeId, $Ownership, $TargetGeneration, $FileTransaction)
+        if ($null -ne $world.SetActiveFailure) { & $world.SetActiveFailure $InstallRoot $RuntimeId $Ownership $TargetGeneration $FileTransaction }
         $assertFence = { param($Root, $Receipt, $ExpectActivePointer) if ($Receipt.released) { throw 'released lifecycle owner' }; $true }
-        Set-CcodActiveRuntime -InstallRoot $InstallRoot -NewRuntimeId $RuntimeId -Ownership $Ownership -Adapters @{ AssertLifecycleFence=$assertFence }
+        Set-CcodActiveRuntime -InstallRoot $InstallRoot -TargetGeneration $TargetGeneration -FileTransaction $FileTransaction -Ownership $Ownership -Adapters @{ AssertLifecycleFence=$assertFence }
     }.GetNewClosure()
     $adapters.ExitLifecycleOwnership = {
         param($Ownership)
@@ -305,7 +311,7 @@ function New-CcodLifecycleFake {
 
 function Read-CcodLifecycleActivePointer {
     param([Parameter(Mandatory)][string]$Root)
-    return (Get-Content -LiteralPath (Join-Path $Root 'active.json') -Raw | ConvertFrom-Json)
+    return Read-CcodActiveRuntime -InstallRoot $Root
 }
 
 function Set-CcodLifecycleTestStatus {
@@ -393,6 +399,163 @@ function Invoke-CcodLifecycleUninstallCleanupTest {
 
 $results = @()
 
+$results += Invoke-CcodTest 'immutable install records advance only through canonical create-only phase snapshots' {
+    $install = New-CcodLifecycleTempRoot
+    [IO.Directory]::CreateDirectory($install) | Out-Null
+    $transactionId = '11111111-2222-3333-4444-555555555555'
+    $packageSha256 = ('a' * 64)
+    $module = Get-Module -Name InstallLifecycle -ErrorAction Stop
+    $fileTransaction = & $module { param($Root) Open-CcodLifecycleInstallGeneration -InstallRoot $Root -RuntimeId 'runtime-new' } $install
+    try {
+        $record = & $module {
+            param($Id,$PackageHash)
+            New-CcodInstallTransactionRecord -TransactionId $Id -OldRuntimeId 'runtime-old' -OldGeneration ([uint64]7) -NewRuntimeId 'runtime-new' -NewGeneration ([uint64]8) -SealedPackageSha256 $PackageHash -OwnedObjectNames @('runtime-new','bootstrap.ps1','Uninstall-CodexControlOtherDevices.ps1')
+        } $transactionId $packageSha256
+        Assert-CcodEqual 'Prepared' $record.phase 'new immutable transaction begins Prepared'
+        Assert-CcodEqual $null $record.errorCode 'nonterminal immutable transaction has no error code'
+        & $module { param($Root,$Value,$Tx) Write-CcodInstallTransactionRecord -InstallRoot $Root -TransactionRecord $Value -FileTransaction $Tx } $install $record $fileTransaction
+        foreach ($phase in @('PackageVerified','RuntimeStaged','PreviousProtectionStopped','RuntimePromoted','PointerCommitted','StableShellCommitted','ProtectionReady','Ready')) {
+            $previous = [string]$record.phase
+            $record = & $module { param($Root,$Id,$Expected,$Next,$Tx) Set-CcodInstallTransactionPhase -InstallRoot $Root -TransactionId $Id -ExpectedPhase $Expected -NewPhase $Next -FileTransaction $Tx } $install $transactionId $previous $phase $fileTransaction
+            Assert-CcodEqual $phase $record.phase "immutable transaction advances to $phase"
+        }
+        $read = & $module { param($Root,$Id) Read-CcodInstallTransactionRecord -InstallRoot $Root -TransactionId $Id } $install $transactionId
+        Assert-CcodEqual 'Ready' $read.phase 'reader selects the terminal canonical snapshot'
+        Assert-CcodEqual $packageSha256 $read.sealedPackageSha256 'phase snapshots retain the sealed package identity'
+        Assert-CcodThrows { & $module { param($Root,$Id,$Tx) Set-CcodInstallTransactionPhase -InstallRoot $Root -TransactionId $Id -ExpectedPhase 'RuntimeStaged' -NewPhase 'Ready' -FileTransaction $Tx } $install $transactionId $fileTransaction } 'CCOD_INSTALL_TRANSACTION_PHASE_INVALID'
+    } finally {
+        & $module { param($Tx) Close-CcodInstallFileTransaction -Transaction $Tx -Disposition Failed } $fileTransaction
+        if (Test-Path -LiteralPath $install) { Remove-Item -LiteralPath $install -Recurse -Force }
+    }
+}
+
+$results += Invoke-CcodTest 'same-version immutable install identity is idempotent only for the same sealed package hash' {
+    $module = Get-Module -Name InstallLifecycle -ErrorAction Stop
+    $existing = [pscustomobject][ordered]@{
+        schemaVersion=1;transactionId='11111111-2222-3333-4444-555555555555';oldRuntimeId='runtime-old';oldGeneration=[uint64]7
+        newRuntimeId='runtime-new';newGeneration=[uint64]8;sealedPackageSha256=('b'*64);ownedObjectNames=@('runtime-new');phase='Ready';errorCode=$null
+    }
+    $same = & $module { param($Record,$Hash) Test-CcodInstallPackageIdentity -TransactionRecord $Record -ProjectVersion '2.5.22' -ActiveProjectVersion '2.5.22' -SealedPackageSha256 $Hash -ActiveRuntimeId 'runtime-new' -ActiveGeneration 8 } $existing ('b'*64)
+    Assert-CcodEqual $true $same 'same version and same package hash is idempotent'
+    Assert-CcodThrows { & $module { param($Record,$Hash) Test-CcodInstallPackageIdentity -TransactionRecord $Record -ProjectVersion '2.5.22' -ActiveProjectVersion '2.5.22' -SealedPackageSha256 $Hash -ActiveRuntimeId 'runtime-new' -ActiveGeneration 8 } $existing ('c'*64) } 'CCOD_INSTALL_PACKAGE_CONFLICT'
+    $drift = & $module { param($Record) Test-CcodInstallPackageIdentity -TransactionRecord $Record -ProjectVersion '2.5.22' -ActiveProjectVersion '2.5.22' -SealedPackageSha256 ('b'*64) -ActiveRuntimeId 'runtime-other' -ActiveGeneration 9 } $existing
+    Assert-CcodEqual $false $drift 'idempotence is bound to the active runtime and pointer generation'
+    $legacy = & $module { Test-CcodInstallPackageIdentity -TransactionRecord $null -ProjectVersion '2.5.22' -ActiveProjectVersion '2.5.21' -SealedPackageSha256 ('d'*64) -ActiveRuntimeId 'legacy' -ActiveGeneration 1 }
+    Assert-CcodEqual $false $legacy 'legacy install without transaction record is treated as non-idempotent Idle'
+}
+
+$results += Invoke-CcodTest 'Invoke-CcodInstall is idempotent only for the active Ready runtime and exact sealed package identity' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    try{
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22-idempotent'|Out-Null
+        $nodePath=New-CcodLifecycleFakeNode -Root $nodeRoot
+        $firstFake=New-CcodLifecycleFake -NodePath $nodePath
+        $first=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('a'*64) -Adapters $firstFake.Adapters
+        $firstPointer=Read-CcodActiveRuntime -InstallRoot $install
+        $sameFake=New-CcodLifecycleFake -NodePath $nodePath
+        $same=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('a'*64) -Adapters $sameFake.Adapters
+        $samePointer=Read-CcodActiveRuntime -InstallRoot $install
+        Assert-CcodEqual 'AlreadyInstalled' $same.Outcome 'same version and package identity returns an idempotent outcome'
+        Assert-CcodEqual $first.RuntimeId $same.RuntimeId 'idempotence remains bound to the active runtime'
+        Assert-CcodEqual $firstPointer.generation $samePointer.generation 'idempotence does not append a pointer generation'
+        Assert-CcodEqual 1 @(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory).Count 'idempotence creates no generation'
+        Assert-CcodEqual 0 $sameFake.World.TaskInstalled 'idempotence performs no task mutation'
+        Assert-CcodEqual 0 $sameFake.World.TaskStarted 'idempotence starts no process'
+        $conflictFake=New-CcodLifecycleFake -NodePath $nodePath
+        Assert-CcodThrows {Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('b'*64) -Adapters $conflictFake.Adapters|Out-Null} 'CCOD_INSTALL_PACKAGE_CONFLICT'
+        $conflictPointer=Read-CcodActiveRuntime -InstallRoot $install
+        Assert-CcodEqual $firstPointer.generation $conflictPointer.generation 'package conflict leaves the active pointer unchanged'
+        Assert-CcodEqual $first.RuntimeId $conflictPointer.activeRuntime 'package conflict remains bound to the old active runtime'
+        Assert-CcodEqual 1 @(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory).Count 'package conflict creates no generation'
+        Assert-CcodEqual 0 $conflictFake.World.TaskInstalled 'package conflict performs no task mutation'
+    }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}}
+}
+
+$results += Invoke-CcodTest 'missing sealed package identity never enables idempotence or package-conflict decisions' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    try{
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22-no-identity'|Out-Null;$nodePath=New-CcodLifecycleFakeNode -Root $nodeRoot
+        $first=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('a'*64) -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
+        $second=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
+        Assert-CcodEqual 'Upgraded' $second.Outcome 'legacy direct call without canonical package identity is not treated as idempotent'
+        Assert-CcodTrue ($second.RuntimeId-cne$first.RuntimeId) 'missing package identity creates a fresh unique generation'
+        Assert-CcodEqual 2 (Read-CcodActiveRuntime -InstallRoot $install).generation 'missing package identity follows the normal monotonic upgrade path'
+    }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}}
+}
+
+$results += Invoke-CcodTest 'unique immutable runtime ids bind project and sealed content identity while preserving per-attempt uniqueness' {
+    $module=Get-Module InstallLifecycle -ErrorAction Stop
+    $first=&$module { New-CcodUniqueRuntimeId -ProjectVersion '2.5.22' -ContentSha256 ('a'*64) -NewNonce { '1'*32 } }
+    $second=&$module { New-CcodUniqueRuntimeId -ProjectVersion '2.5.22' -ContentSha256 ('a'*64) -NewNonce { '2'*32 } }
+    $differentContent=&$module { New-CcodUniqueRuntimeId -ProjectVersion '2.5.22' -ContentSha256 ('b'*64) -NewNonce { '1'*32 } }
+    $differentVersion=&$module { New-CcodUniqueRuntimeId -ProjectVersion '2.5.23' -ContentSha256 ('a'*64) -NewNonce { '1'*32 } }
+    Assert-CcodEqual 'af45134e2aa385355392e1e45369c3ae41520cc99278076626aeeca7bfde0356-1111111111111111111111111111111' $first 'runtime id contains the full deterministic project/package digest and a canonical attempt nonce'
+    Assert-CcodEqual 96 $first.Length 'runtime id remains within the manifest identity bound'
+    Assert-CcodTrue ($first-cne$second) 'identical package content receives a unique generation id per attempt'
+    Assert-CcodTrue ($first-cne$differentContent) 'sealed package content changes the deterministic runtime identity'
+    Assert-CcodTrue ($first-cne$differentVersion) 'project version changes the deterministic runtime identity'
+    Assert-CcodThrows { &$module { New-CcodUniqueRuntimeId -ProjectVersion '2.5.22' -ContentSha256 ('a'*64) -NewNonce { 'not-a-guid' } } } 'CCOD_INSTALL_RUNTIME_ID_INVALID'
+    Assert-CcodThrows { &$module { New-CcodUniqueRuntimeId -ProjectVersion '2.5.22' -ContentSha256 ('A'*64) -NewNonce { '1'*32 } } } 'CCOD_INSTALL_RUNTIME_ID_INVALID'
+}
+
+$results += Invoke-CcodTest 'immutable record helpers reject a cross-root transaction before creating state' {
+    $a=New-CcodLifecycleTempRoot;$b=New-CcodLifecycleTempRoot;[IO.Directory]::CreateDirectory($a)|Out-Null;[IO.Directory]::CreateDirectory($b)|Out-Null
+    $module=Get-Module InstallLifecycle -ErrorAction Stop;$tx=&$module {param($Root)Open-CcodLifecycleInstallGeneration -InstallRoot $Root -RuntimeId 'scope-runtime'} $a
+    try {
+        $record=&$module {New-CcodInstallTransactionRecord -TransactionId '22222222-3333-4444-5555-666666666666' -OldRuntimeId $null -OldGeneration $null -NewRuntimeId 'scope-runtime' -NewGeneration 1 -SealedPackageSha256 ('e'*64) -OwnedObjectNames @('scope-runtime')}
+        Assert-CcodThrows { &$module {param($Root,$Record,$Tx)Write-CcodInstallTransactionRecord -InstallRoot $Root -TransactionRecord $Record -FileTransaction $Tx} $b $record $tx } 'CCOD_INSTALL_TRANSACTION_SCOPE'
+        Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $b 'state')) 'cross-root call creates no state'
+    } finally { &$module {param($Tx)Close-CcodInstallFileTransaction -Transaction $Tx -Disposition Failed} $tx;if(Test-Path $a){Remove-Item $a -Recurse -Force};if(Test-Path $b){Remove-Item $b -Recurse -Force} }
+}
+
+$results += Invoke-CcodTest 'transaction reader rejects immutable identity drift across a contiguous snapshot chain' {
+    $install=New-CcodLifecycleTempRoot;$transactionId='33333333-4444-5555-6666-777777777777'
+    try{
+        $store=Join-Path $install 'state\install-transactions';[IO.Directory]::CreateDirectory($store)|Out-Null
+        $prepared=[pscustomobject][ordered]@{schemaVersion=1;transactionId=$transactionId;oldRuntimeId='runtime-old-a';oldGeneration=1;newRuntimeId='runtime-new';newGeneration=2;sealedPackageSha256=('f'*64);ownedObjectNames=@('runtime-new');phase='Prepared';errorCode=$null}
+        $verified=[pscustomobject][ordered]@{schemaVersion=1;transactionId=$transactionId;oldRuntimeId='runtime-old-b';oldGeneration=1;newRuntimeId='runtime-new';newGeneration=2;sealedPackageSha256=('f'*64);ownedObjectNames=@('runtime-new');phase='PackageVerified';errorCode=$null}
+        [IO.File]::WriteAllText((Join-Path $store "00000000000000000002.00.Prepared.$transactionId.json"),($prepared|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText((Join-Path $store "00000000000000000002.01.PackageVerified.$transactionId.json"),($verified|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
+        $module=Get-Module InstallLifecycle -ErrorAction Stop
+        Assert-CcodThrows {&$module {param($Root,$Id)Read-CcodInstallTransactionRecord -InstallRoot $Root -TransactionId $Id|Out-Null} $install $transactionId} 'CCOD_INSTALL_TRANSACTION_INVALID'
+    }finally{if(Test-Path -LiteralPath $install){Remove-Item -LiteralPath $install -Recurse -Force}}
+}
+
+$results += Invoke-CcodTest 'transaction store rejects unknown reparse ADS multilink and ambiguous chains' {
+    $module=Get-Module InstallLifecycle -ErrorAction Stop
+    $newRecord={param($Id,[uint64]$Generation)[pscustomobject][ordered]@{schemaVersion=1;transactionId=$Id;oldRuntimeId='runtime-old';oldGeneration=[uint64]1;newRuntimeId=("runtime-new-$Generation");newGeneration=$Generation;sealedPackageSha256=('a'*64);ownedObjectNames=@("runtime-new-$Generation");phase='Prepared';errorCode=$null}}
+    foreach($kind in @('unknown','reparse','ads','multilink','ambiguous')){
+        $install=New-CcodLifecycleTempRoot;$outside=New-CcodLifecycleTempRoot
+        try{
+            $store=Join-Path $install 'state\install-transactions';[IO.Directory]::CreateDirectory($store)|Out-Null;[IO.Directory]::CreateDirectory($outside)|Out-Null
+            if($kind-ceq'unknown'){[IO.File]::WriteAllText((Join-Path $store 'unknown.bin'),'x',[Text.UTF8Encoding]::new($false))}
+            elseif($kind-ceq'reparse'){New-Item -ItemType Junction -Path (Join-Path $store '00000000000000000002.00.Prepared.44444444-5555-6666-7777-888888888888.json') -Target $outside|Out-Null}
+            elseif($kind-ceq'ads'){$id='44444444-5555-6666-7777-888888888888';$path=Join-Path $store "00000000000000000002.00.Prepared.$id.json";[IO.File]::WriteAllText($path,((&$newRecord $id 2)|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false));Set-Content -LiteralPath $path -Stream 'evidence' -Value 'x' -NoNewline}
+            elseif($kind-ceq'multilink'){$id='44444444-5555-6666-7777-888888888888';$outsideFile=Join-Path $outside 'record.json';[IO.File]::WriteAllText($outsideFile,((&$newRecord $id 2)|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false));New-Item -ItemType HardLink -Path (Join-Path $store "00000000000000000002.00.Prepared.$id.json") -Target $outsideFile|Out-Null}
+            else{foreach($pair in @(@('44444444-5555-6666-7777-888888888888',[uint64]2),@('55555555-6666-7777-8888-999999999999',[uint64]3))){$id=[string]$pair[0];$generation=[uint64]$pair[1];[IO.File]::WriteAllText((Join-Path $store ('{0:D20}.00.Prepared.{1}.json'-f$generation,$id)),((&$newRecord $id $generation)|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))}}
+            $expected=if($kind-ceq'ambiguous'){'CCOD_INSTALL_TRANSACTION_AMBIGUOUS'}else{'CCOD_INSTALL_TRANSACTION_INVALID'}
+            Assert-CcodThrows {&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root|Out-Null} $install} $expected
+        }finally{if(Test-Path -LiteralPath $install){Remove-Item -LiteralPath $install -Recurse -Force -ErrorAction SilentlyContinue};if(Test-Path -LiteralPath $outside){Remove-Item -LiteralPath $outside -Recurse -Force -ErrorAction SilentlyContinue}}
+    }
+}
+
+$results += Invoke-CcodTest 'transaction reader rejects ambiguous Ready and latest Failed terminal heads' {
+    $module=Get-Module InstallLifecycle -ErrorAction Stop
+    foreach($terminalKind in @('Ready','Failed')){
+        $install=New-CcodLifecycleTempRoot
+        try{
+            $store=Join-Path $install 'state\install-transactions';[IO.Directory]::CreateDirectory($store)|Out-Null
+            $runtimeId='runtime-terminal';$generation=if($terminalKind-ceq'Ready'){[uint64]1}else{[uint64]2}
+            foreach($id in @('66666666-7777-8888-9999-aaaaaaaaaaaa','77777777-8888-9999-aaaa-bbbbbbbbbbbb')){
+                $phases=if($terminalKind-ceq'Ready'){@('Prepared','PackageVerified','RuntimeStaged','PreviousProtectionStopped','RuntimePromoted','PointerCommitted','StableShellCommitted','ProtectionReady','Ready')}else{@('Prepared','Failed')}
+                foreach($phase in $phases){$index=if($phase-ceq'Failed'){99}else{[Array]::IndexOf(@('Prepared','PackageVerified','RuntimeStaged','PreviousProtectionStopped','RuntimePromoted','PointerCommitted','StableShellCommitted','ProtectionReady','Ready'),$phase)};$record=[pscustomobject][ordered]@{schemaVersion=1;transactionId=$id;oldRuntimeId=$null;oldGeneration=$null;newRuntimeId=$runtimeId;newGeneration=$generation;sealedPackageSha256=('b'*64);ownedObjectNames=@($runtimeId);phase=$phase;errorCode=if($phase-ceq'Failed'){'CCOD_INSTALL_FAILED'}else{$null}};[IO.File]::WriteAllText((Join-Path $store ('{0:D20}.{1:D2}.{2}.{3}.json'-f$generation,$index,$phase,$id)),($record|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))}
+            }
+            if($terminalKind-ceq'Ready'){$pointerRoot=Join-Path $install 'state\active-generation';[IO.Directory]::CreateDirectory($pointerRoot)|Out-Null;[IO.File]::WriteAllText((Join-Path $pointerRoot '00000000000000000001.json'),('{"schemaVersion":1,"generation":1,"activeRuntime":"'+$runtimeId+'","previousGeneration":0}'),[Text.UTF8Encoding]::new($false))}
+            Assert-CcodThrows {&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root|Out-Null} $install} 'CCOD_INSTALL_TRANSACTION_AMBIGUOUS'
+        }finally{if(Test-Path -LiteralPath $install){Remove-Item -LiteralPath $install -Recurse -Force}}
+    }
+}
+
 $results += Invoke-CcodTest 'waits for the previous IgnoreNew task instance before starting the new supervisor' {
     $module = Get-Module -Name InstallLifecycle -ErrorAction Stop
     $calls = [Collections.Generic.List[string]]::new()
@@ -651,10 +814,15 @@ $results += Invoke-CcodTest 'first install stages verifies activates task and pe
         $receipt = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -EnableCandidateCompatibleUpdates -Adapters $fake.Adapters
         Assert-CcodEqual 'Installed' $receipt.Outcome 'first install outcome'
         Assert-CcodEqual $true $receipt.Installed 'first install flag'
-        Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $install 'bootstrap.ps1') -PathType Leaf) 'stable bootstrap copied'
-        Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $install 'active.json') -PathType Leaf) 'active pointer written'
-        Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $install "runtime\$($receipt.RuntimeId)") -PathType Container) 'runtime staged'
+        $runtimeRoot = Join-Path $install "runtime\$($receipt.RuntimeId)"
+        Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $runtimeRoot 'src\persistence\bootstrap.ps1') -PathType Leaf) 'generation-specific bootstrap is sealed with the runtime'
+        Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $install 'bootstrap.ps1')) 'first install does not create a mutable root bootstrap'
+        Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $install 'active.json')) 'new install never writes the legacy active pointer'
+        Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $install 'state\post-install-activation.json')) 'new install never writes the mutable legacy activation receipt'
+        Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $install 'state\active-generation\00000000000000000001.json') -PathType Leaf) 'append-only active generation pointer written'
+        Assert-CcodTrue (Test-Path -LiteralPath $runtimeRoot -PathType Container) 'runtime staged'
         Assert-CcodEqual 1 $fake.World.TaskInstalled 'task installed'
+        Assert-CcodEqual $receipt.RuntimeId $fake.World.TaskRuntimeIds[0] 'scheduled task selects the committed generation bootstrap'
         Assert-CcodEqual 1 $fake.World.TaskStarted 'task started'
         Assert-CcodEqual $null $receipt.PreviousRuntimeId 'first install has no previous runtime'
         $state = Read-CcodState -StateRoot (Join-Path $install 'state')
@@ -665,7 +833,19 @@ $results += Invoke-CcodTest 'first install stages verifies activates task and pe
         $preference = Read-CcodUiPreference -StateRoot $stateRoot
         Assert-CcodEqual 'System' $preference.LanguageMode 'first install follows Windows'
         Assert-CcodEqual $false $preference.FallbackUsed 'first install persisted preference'
-        $runtimeRoot = Join-Path $install "runtime\$($receipt.RuntimeId)"
+        $baselineRoot = Join-Path $stateRoot "install-initializations\$($receipt.RuntimeId)"
+        foreach ($leaf in @('settings.json','status.json','verified-packages.json','transition.json','ui-preferences.json')) {
+            $baselinePath = Join-Path $baselineRoot $leaf
+            Assert-CcodTrue (Test-Path -LiteralPath $baselinePath -PathType Leaf) "immutable initialization baseline contains $leaf"
+            Assert-CcodTrue (((Get-Item -LiteralPath $baselinePath -Force).Attributes -band [IO.FileAttributes]::ReadOnly) -ne 0) "immutable initialization baseline seals $leaf"
+        }
+        foreach ($leaf in @('settings.json','status.json','verified-packages.json','transition.json','ui-preferences.json')) {
+            Assert-CcodEqual 0 ((Get-Item -LiteralPath (Join-Path $stateRoot $leaf) -Force).Attributes -band [IO.FileAttributes]::ReadOnly) "operational $leaf remains writable"
+        }
+        Set-CcodAutomationEnabled -StateRoot $stateRoot -Enabled $false
+        Assert-CcodEqual $false (Read-CcodSettings -StateRoot $stateRoot).automationEnabled 'StateStore can update and read operational state after immutable initialization'
+        Set-CcodUiLanguageMode -StateRoot $stateRoot -LanguageMode 'zh-CN' | Out-Null
+        Assert-CcodEqual 'zh-CN' (Read-CcodUiPreference -StateRoot $stateRoot).LanguageMode 'UI preferences can update and read operational state after immutable initialization'
         Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $runtimeRoot 'src\persistence\resources\ui.en-US.json') -PathType Leaf) 'English catalog staged'
         Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $runtimeRoot 'src\persistence\resources\ui.zh-CN.json') -PathType Leaf) 'Chinese catalog staged'
         $manifest = Test-CcodRuntimeManifest -RuntimeDirectory $runtimeRoot -ExpectedRuntimeId $receipt.RuntimeId
@@ -741,15 +921,20 @@ $results += Invoke-CcodTest 'payload-bound install rereads the active pointer af
     $install = New-CcodLifecycleTempRoot
     $nodeRoot = New-CcodLifecycleTempRoot
     try {
-        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22' | Out-Null
-        $manifestPath = New-CcodLifecyclePayloadManifest -Root $source -Version '2.5.22'
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.21' | Out-Null
         $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
-        $first = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
+        $first = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('a'*64) -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
         $oldPointer = Read-CcodActiveRuntime -InstallRoot $install
+        [IO.File]::WriteAllText((Join-Path $source 'package.json'),(@{name='codexremote-fix';version='2.5.22';private=$true}|ConvertTo-Json -Depth 4),[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText((Join-Path $source 'src\runtime\main-payload.js'),"module.exports = 'fixture-2.5.22';`n",[Text.UTF8Encoding]::new($false))
+        $manifestPath = New-CcodLifecyclePayloadManifest -Root $source -Version '2.5.22'
         $fake = New-CcodLifecycleFake -NodePath $nodePath
+        $fake.Adapters.NewActivationId = { 'bbbbbbbb-cccc-dddd-eeee-ffffffffffff' }
         $fake.Adapters.WaitNewRuntimeReady = {
             param($InstallRoot,$RuntimeId,$RuntimeGeneration,$Identity,$TaskStartedAtUtc,$TimeoutMilliseconds)
-            [IO.File]::WriteAllText((Join-Path $InstallRoot 'active.json'),($oldPointer | ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+            $pointerRoot = Join-Path $InstallRoot 'state\active-generation'
+            $drift = [pscustomobject][ordered]@{ schemaVersion=1; generation=[uint64]3; activeRuntime=[string]$oldPointer.activeRuntime; previousGeneration=[uint64]2 }
+            [IO.File]::WriteAllText((Join-Path $pointerRoot '00000000000000000003.json'),($drift | ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
             [pscustomobject][ordered]@{ SupervisorReady = $true; TrayReady = $true }
         }.GetNewClosure()
 
@@ -772,27 +957,25 @@ $results += Invoke-CcodTest 'stable bootstrap and uninstaller come from manifest
         New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22' | Out-Null
         $uninstallerSource = Join-Path $source 'Uninstall-CodexControlOtherDevices.ps1'
         [IO.File]::WriteAllText($uninstallerSource,"# verified uninstaller`r`n",[Text.UTF8Encoding]::new($false))
+        [IO.Directory]::CreateDirectory($install) | Out-Null
+        $legacyBootstrap = Join-Path $install 'bootstrap.ps1'
+        $legacyUninstaller = Join-Path $install 'Uninstall-CodexControlOtherDevices.ps1'
+        [IO.File]::WriteAllText($legacyBootstrap,"# legacy bootstrap sentinel`r`n",[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($legacyUninstaller,"# legacy uninstaller sentinel`r`n",[Text.UTF8Encoding]::new($false))
+        $legacyBootstrapHash = Get-CcodTestFileSha256 -Path $legacyBootstrap
+        $legacyUninstallerHash = Get-CcodTestFileSha256 -Path $legacyUninstaller
         $manifestPath = New-CcodLifecyclePayloadManifest -Root $source -Version '2.5.22'
         $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
         $fake = New-CcodLifecycleFake -NodePath $nodePath
-        $fake.World.CopyOverride = [pscustomobject]@{
-            Match = '*Uninstall-CodexControlOtherDevices.ps1'
-            Action = {
-                param($SourcePath,$DestinationPath)
-                [IO.Directory]::CreateDirectory((Split-Path $DestinationPath -Parent)) | Out-Null
-                [IO.File]::Copy($SourcePath,$DestinationPath,$true)
-                if ([IO.Path]::GetFullPath($SourcePath).Equals([IO.Path]::GetFullPath($uninstallerSource),[StringComparison]::OrdinalIgnoreCase)) {
-                    [IO.File]::WriteAllText($SourcePath,"# mutated after staging`r`n",[Text.UTF8Encoding]::new($false))
-                }
-            }.GetNewClosure()
-        }
 
         $payloadBinding = Get-CcodLifecyclePayloadBinding -ManifestPath $manifestPath -ExpectedVersion '2.5.22'
         $receipt = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install @payloadBinding -Adapters $fake.Adapters
 
         $runtimeRoot = Join-Path $install "runtime\$($receipt.RuntimeId)"
-        Assert-CcodEqual (Get-CcodTestFileSha256 -Path (Join-Path $runtimeRoot 'src\persistence\bootstrap.ps1')) (Get-CcodTestFileSha256 -Path (Join-Path $install 'bootstrap.ps1')) 'stable bootstrap equals its verified runtime byte copy'
-        Assert-CcodEqual (Get-CcodTestFileSha256 -Path (Join-Path $runtimeRoot 'Uninstall-CodexControlOtherDevices.ps1')) (Get-CcodTestFileSha256 -Path (Join-Path $install 'Uninstall-CodexControlOtherDevices.ps1')) 'stable uninstaller ignores post-staging source mutation'
+        Assert-CcodEqual (Get-CcodTestFileSha256 -Path (Join-Path $source 'src\persistence\bootstrap.ps1')) (Get-CcodTestFileSha256 -Path (Join-Path $runtimeRoot 'src\persistence\bootstrap.ps1')) 'generation bootstrap equals the manifest-verified sealed source bytes'
+        Assert-CcodEqual (Get-CcodTestFileSha256 -Path $uninstallerSource) (Get-CcodTestFileSha256 -Path (Join-Path $runtimeRoot 'Uninstall-CodexControlOtherDevices.ps1')) 'generation uninstaller equals the manifest-verified sealed source bytes'
+        Assert-CcodEqual $legacyBootstrapHash (Get-CcodTestFileSha256 -Path $legacyBootstrap) 'legacy root bootstrap bytes remain unchanged'
+        Assert-CcodEqual $legacyUninstallerHash (Get-CcodTestFileSha256 -Path $legacyUninstaller) 'legacy root uninstaller bytes remain unchanged'
     } finally {
         foreach ($path in @($source,$install,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
     }
@@ -817,26 +1000,6 @@ $results += Invoke-CcodTest 'install root junction is rejected before staging wr
     }
 }
 
-$results += Invoke-CcodTest 'staging junction is rejected before payload writes' {
-    $source = New-CcodLifecycleTempRoot
-    $install = New-CcodLifecycleTempRoot
-    $target = New-CcodLifecycleTempRoot
-    $nodeRoot = New-CcodLifecycleTempRoot
-    try {
-        New-CcodLifecycleSourceFixture -Root $source | Out-Null
-        [IO.Directory]::CreateDirectory($install) | Out-Null
-        [IO.Directory]::CreateDirectory($target) | Out-Null
-        New-Item -ItemType Junction -Path (Join-Path $install '.staging') -Target $target | Out-Null
-        $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
-        Assert-CcodThrows { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters | Out-Null } 'CCOD_INSTALL_REPARSE_PATH'
-        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath $target -Force).Count 'staging junction target remains empty'
-    } finally {
-        $junction = Join-Path $install '.staging'
-        if (Test-Path -LiteralPath $junction) { [IO.Directory]::Delete($junction) }
-        foreach ($path in @($source,$install,$target,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
-    }
-}
-
 $results += Invoke-CcodTest 'runtime junction is rejected before staging promotion' {
     $source = New-CcodLifecycleTempRoot
     $install = New-CcodLifecycleTempRoot
@@ -848,7 +1011,7 @@ $results += Invoke-CcodTest 'runtime junction is rejected before staging promoti
         [IO.Directory]::CreateDirectory($target) | Out-Null
         New-Item -ItemType Junction -Path (Join-Path $install 'runtime') -Target $target | Out-Null
         $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
-        Assert-CcodThrows { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters | Out-Null } 'CCOD_INSTALL_REPARSE_PATH'
+        Assert-CcodThrows { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters | Out-Null } 'CCOD_INSTALL_FAILED'
         Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath $target -Force).Count 'runtime junction target receives no promoted runtime'
         Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $install 'active.json'))) 'runtime junction cannot reach active pointer mutation'
     } finally {
@@ -858,61 +1021,6 @@ $results += Invoke-CcodTest 'runtime junction is rejected before staging promoti
     }
 }
 
-$results += Invoke-CcodTest 'stable bootstrap leaf junction is rejected before copy' {
-    $source = New-CcodLifecycleTempRoot
-    $install = New-CcodLifecycleTempRoot
-    $target = New-CcodLifecycleTempRoot
-    $nodeRoot = New-CcodLifecycleTempRoot
-    try {
-        New-CcodLifecycleSourceFixture -Root $source | Out-Null
-        [IO.Directory]::CreateDirectory($install) | Out-Null
-        [IO.Directory]::CreateDirectory($target) | Out-Null
-        $bootstrapLink = Join-Path $install 'bootstrap.ps1'
-        New-Item -ItemType Junction -Path $bootstrapLink -Target $target | Out-Null
-        $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
-        Assert-CcodThrows { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters | Out-Null } 'CCOD_INSTALL_REPARSE_PATH'
-        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath $target -Force).Count 'stable bootstrap junction target receives no bytes'
-    } finally {
-        $bootstrapLink = Join-Path $install 'bootstrap.ps1'
-        if (Test-Path -LiteralPath $bootstrapLink) { [IO.Directory]::Delete($bootstrapLink) }
-        foreach ($path in @($source,$install,$target,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
-    }
-}
-
-# Production mutation caught: treating a non-reparse hard link as a safe overwrite target and changing bytes outside the install root.
-$results += Invoke-CcodTest 'stable bootstrap and public uninstaller reject hard-linked target leaves before outside bytes change' {
-    foreach ($case in @(
-        [pscustomobject]@{Name='bootstrap';Leaf='bootstrap.ps1';AddUninstaller=$false},
-        [pscustomobject]@{Name='uninstaller';Leaf='Uninstall-CodexControlOtherDevices.ps1';AddUninstaller=$true}
-    )) {
-        $source = New-CcodLifecycleTempRoot
-        $install = New-CcodLifecycleTempRoot
-        $outside = New-CcodLifecycleTempRoot
-        $nodeRoot = New-CcodLifecycleTempRoot
-        try {
-            New-CcodLifecycleSourceFixture -Root $source | Out-Null
-            if ($case.AddUninstaller) {
-                [IO.File]::WriteAllText((Join-Path $source 'Uninstall-CodexControlOtherDevices.ps1'),'# verified uninstaller',[Text.UTF8Encoding]::new($false))
-            }
-            [IO.Directory]::CreateDirectory($install) | Out-Null
-            [IO.Directory]::CreateDirectory($outside) | Out-Null
-            $sentinel = Join-Path $outside ($case.Name + '-sentinel.txt')
-            [IO.File]::WriteAllText($sentinel,'outside-original',[Text.UTF8Encoding]::new($false))
-            $targetLeaf = Join-Path $install $case.Leaf
-            New-Item -ItemType HardLink -Path $targetLeaf -Target $sentinel | Out-Null
-            $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
-
-            Assert-CcodThrows {
-                Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters | Out-Null
-            } 'CCOD_INSTALL_UNSAFE_LEAF'
-            Assert-CcodEqual 'outside-original' ([IO.File]::ReadAllText($sentinel,[Text.UTF8Encoding]::new($false))) "$($case.Name) hard-link sentinel remains unchanged"
-            Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $install 'active.json'))) "$($case.Name) hard-link rejection cannot commit an active pointer"
-        } finally {
-            foreach ($path in @($source,$install,$outside,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force -ErrorAction SilentlyContinue } }
-        }
-    }
-}
-
 # Production mutation caught: recursive whole-install deletion bypassing the strict per-leaf hard-link contract.
 $results += Invoke-CcodTest 'whole-install deletion rejects a nested hard-link before removing any in-tree leaf' {
     $install = New-CcodLifecycleTempRoot
@@ -943,67 +1051,6 @@ $results += Invoke-CcodTest 'whole-install deletion rejects a nested hard-link b
     }
 }
 
-$results += Invoke-CcodTest 'runtime manifest leaf junction is rejected before write' {
-    $source = New-CcodLifecycleTempRoot
-    $install = New-CcodLifecycleTempRoot
-    $target = New-CcodLifecycleTempRoot
-    $nodeRoot = New-CcodLifecycleTempRoot
-    try {
-        New-CcodLifecycleSourceFixture -Root $source | Out-Null
-        [IO.Directory]::CreateDirectory($target) | Out-Null
-        $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
-        $fake = New-CcodLifecycleFake -NodePath $nodePath
-        $fake.Adapters.NewRuntimeManifest = {
-            param($RuntimeDirectory,$ProjectVersion)
-            $manifest = New-CcodRuntimeManifest -RuntimeDirectory $RuntimeDirectory -ProjectVersion $ProjectVersion
-            New-Item -ItemType Junction -Path (Join-Path $RuntimeDirectory 'manifest.json') -Target $target | Out-Null
-            return $manifest
-        }.GetNewClosure()
-        Assert-CcodThrows { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters | Out-Null } 'CCOD_INSTALL_REPARSE_PATH'
-        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath $target -Force).Count 'runtime manifest junction target receives no bytes'
-    } finally {
-        foreach ($staging in @(Get-ChildItem -LiteralPath (Join-Path $install '.staging') -Directory -ErrorAction SilentlyContinue)) {
-            $link = Join-Path $staging.FullName 'manifest.json'
-            if (Test-Path -LiteralPath $link) { [IO.Directory]::Delete($link) }
-        }
-        foreach ($path in @($source,$install,$target,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
-    }
-}
-
-$results += Invoke-CcodTest 'staging cleanup refuses a nested junction after copy failure' {
-    $source = New-CcodLifecycleTempRoot
-    $install = New-CcodLifecycleTempRoot
-    $target = New-CcodLifecycleTempRoot
-    $nodeRoot = New-CcodLifecycleTempRoot
-    try {
-        New-CcodLifecycleSourceFixture -Root $source | Out-Null
-        [IO.Directory]::CreateDirectory($target) | Out-Null
-        [IO.File]::WriteAllText((Join-Path $target 'sentinel.txt'),'keep',[Text.UTF8Encoding]::new($false))
-        $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
-        $fake = New-CcodLifecycleFake -NodePath $nodePath
-        $fake.World.CopyOverride = [pscustomobject]@{
-            Match = '*Supervisor.ps1'
-            Action = {
-                param($SourcePath,$DestinationPath)
-                $stagingDirectory = Split-Path (Split-Path (Split-Path $DestinationPath -Parent) -Parent) -Parent
-                [IO.Directory]::CreateDirectory($stagingDirectory) | Out-Null
-                New-Item -ItemType Junction -Path (Join-Path $stagingDirectory 'cleanup-escape') -Target $target | Out-Null
-                throw 'PRIVATE_COPY_FAILURE_AFTER_JUNCTION'
-            }.GetNewClosure()
-        }
-        Assert-CcodThrows { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters | Out-Null } 'CCOD_INSTALL_STAGING_FAILED'
-        $retained = @(Get-ChildItem -LiteralPath (Join-Path $install '.staging') -Directory -ErrorAction SilentlyContinue | Where-Object { Test-Path -LiteralPath (Join-Path $_.FullName 'cleanup-escape') })
-        Assert-CcodEqual 1 $retained.Count 'unsafe staging tree is retained instead of recursively deleted'
-        Assert-CcodEqual 'keep' ([IO.File]::ReadAllText((Join-Path $target 'sentinel.txt'))) 'cleanup never deletes through the nested junction'
-    } finally {
-        foreach ($staging in @(Get-ChildItem -LiteralPath (Join-Path $install '.staging') -Directory -ErrorAction SilentlyContinue)) {
-            $link = Join-Path $staging.FullName 'cleanup-escape'
-            if (Test-Path -LiteralPath $link) { [IO.Directory]::Delete($link) }
-        }
-        foreach ($path in @($source,$install,$target,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
-    }
-}
-
 $results += Invoke-CcodTest 'payload manifest ancestry treats Windows root equality case-insensitively' {
     $source = New-CcodLifecycleTempRoot
     $install = New-CcodLifecycleTempRoot
@@ -1040,7 +1087,7 @@ $results += Invoke-CcodTest 'payload-bound install rejects a changed runtime man
         $payloadBinding = Get-CcodLifecyclePayloadBinding -ManifestPath $manifestPath -ExpectedVersion '2.5.22'
         Assert-CcodThrows {
             Invoke-CcodInstall -SourceRoot $source -InstallRoot $install @payloadBinding -Adapters $fake.Adapters | Out-Null
-        } 'CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN'
+        } 'CCOD_INSTALL_NEW_RUNTIME_NOT_READY'
         Assert-CcodTrue ($fake.World.Phases -notcontains 'Ready') 'changed selected runtime manifest cannot produce Ready'
     } finally {
         foreach ($path in @($source,$install,$nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
@@ -1089,7 +1136,7 @@ $results += Invoke-CcodTest 'hidden persistence module is staged and manifest-ha
         $receipt = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
         $runtimeRoot = Join-Path $install "runtime\$($receipt.RuntimeId)"
         $stagedModule = Join-Path $runtimeRoot 'src\persistence\modules\HiddenRuntime.psm1'
-        Assert-CcodTrue (Test-Path -LiteralPath $stagedModule -PathType Leaf) 'hidden module is staged'
+        Assert-CcodTrue (Test-Path -LiteralPath $stagedModule -PathType Leaf) 'hidden module is staged into the sealed generation'
         $manifest = Test-CcodRuntimeManifest -RuntimeDirectory $runtimeRoot -ExpectedRuntimeId $receipt.RuntimeId
         Assert-CcodEqual $true $manifest.Valid 'hidden module runtime manifest validates'
         $record = @($manifest.Manifest.files | Where-Object { $_.path -ceq 'src/persistence/modules/HiddenRuntime.psm1' })
@@ -1166,9 +1213,15 @@ $results += Invoke-CcodTest 'upgrade emits a strict ordered Ready receipt only a
         Assert-CcodTrue ($fake.World.NewSupervisorReady -and $fake.World.NewTrayReady) 'new Supervisor signal proves the authenticated TrayHost handshake completed'
         Assert-CcodEqual $expectedKeyHash (Get-FileHash -LiteralPath $deviceKey -Algorithm SHA256).Hash 'upgrade preserves device-key bytes'
 
-        $activationPath = Join-Path $install 'state\post-install-activation.json'
-        Assert-CcodTrue (Test-Path -LiteralPath $activationPath -PathType Leaf) 'activation receipt is durable'
-        $activation = Get-Content -LiteralPath $activationPath -Raw -Encoding UTF8 | ConvertFrom-Json
+        $activationRoot = Join-Path $install 'state\activation-receipts'
+        $matching = @(Get-ChildItem -LiteralPath $activationRoot -Filter '*.Ready.json' -File | ForEach-Object {
+            $value = Get-Content -LiteralPath $_.FullName -Raw -Encoding UTF8 | ConvertFrom-Json
+            if ([string]$value.runtimeId -ceq [string]$receipt.RuntimeId) { [pscustomobject]@{ Path=$_.FullName; Value=$value } }
+        })
+        Assert-CcodEqual 1 $matching.Count 'exactly one create-only Ready activation receipt binds the upgraded runtime'
+        $activationPath = $matching[0].Path
+        $activation = $matching[0].Value
+        Assert-CcodTrue ([IO.Path]::GetFileName($activationPath) -ceq ("$($activation.activationId).Ready.json")) 'activation receipt filename binds its canonical activation id and phase'
         Assert-CcodEqual 'schemaVersion,activationId,phase,runtimeId,previousRuntimeId,startedAtUtc,updatedAtUtc,ready,errorCode' (($activation.PSObject.Properties.Name) -join ',') 'activation receipt has exact properties'
         Assert-CcodEqual 'Ready' $activation.phase 'terminal activation phase is Ready'
         Assert-CcodEqual $true $activation.ready 'Ready receipt is the only successful terminal state'
@@ -1359,10 +1412,11 @@ $results += Invoke-CcodTest 'upgrade boundaries fail closed with phase receipts
         [pscustomobject]@{ Name='old task still running';Code='CCOD_INSTALL_SUPERVISOR_TASK_BUSY';Committed=$false;Configure={param($Fake)$Fake.World.TaskIdle=$false} },
         [pscustomobject]@{ Name='stale lifecycle generation';Code='CCOD_LIFECYCLE_FENCE_STALE';Committed=$false;Configure={param($Fake)$Fake.World.SetActiveFailure={throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new('stale'), 'CCOD_LIFECYCLE_FENCE_STALE', [Management.Automation.ErrorCategory]::InvalidData, $null)}} },
         [pscustomobject]@{ Name='active pointer write failure';Code='CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN';Committed=$false;Configure={param($Fake)$Fake.World.SetActiveFailure={throw 'PRIVATE_POINTER_SECRET'}} },
-        [pscustomobject]@{ Name='crash after generation commit';Code='CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN';Committed=$true;Configure={param($Fake)$Fake.World.SetActiveFailure={param($Root,$RuntimeId,$Ownership)$fence={param($InstallRoot,$Receipt,$ExpectActivePointer)$true};Set-CcodActiveRuntime -InstallRoot $Root -NewRuntimeId $RuntimeId -Ownership $Ownership -Adapters @{AssertLifecycleFence=$fence}|Out-Null;throw 'PRIVATE_AFTER_COMMIT_SECRET'}} },
-        [pscustomobject]@{ Name='new task start failure';Code='CCOD_INSTALL_SUPERVISOR_START_FAILED';Committed=$true;Configure={param($Fake)$Fake.World.StartTaskFailure=$true} },
-        [pscustomobject]@{ Name='Supervisor ready timeout';Code='CCOD_INSTALL_NEW_RUNTIME_NOT_READY';Committed=$true;Configure={param($Fake)$Fake.World.NewSupervisorReady=$false} },
-        [pscustomobject]@{ Name='TrayHost ready timeout';Code='CCOD_INSTALL_NEW_RUNTIME_NOT_READY';Committed=$true;Configure={param($Fake)$Fake.World.NewTrayReady=$false} }
+        [pscustomobject]@{ Name='crash after generation commit';Code='CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN';Committed=$true;Configure={param($Fake,$OldRuntime)$gate=[pscustomobject]@{Remaining=1};$Fake.World.SetActiveFailure={param($Root,$RuntimeId,$Ownership,$TargetGeneration,$FileTransaction)if($gate.Remaining-gt0){$gate.Remaining--;$fence={param($InstallRoot,$Receipt,$ExpectActivePointer)$true};Set-CcodActiveRuntime -InstallRoot $Root -TargetGeneration $TargetGeneration -FileTransaction $FileTransaction -Ownership $Ownership -Adapters @{AssertLifecycleFence=$fence}|Out-Null;throw 'PRIVATE_AFTER_COMMIT_SECRET'}}.GetNewClosure()} },
+        [pscustomobject]@{ Name='new task start failure';Code='CCOD_INSTALL_SUPERVISOR_START_FAILED';Committed=$true;Configure={param($Fake,$OldRuntime)$gate=[pscustomobject]@{Remaining=1};$Fake.Adapters.StartSupervisorTask={if($gate.Remaining-gt0){$gate.Remaining--;throw 'PRIVATE_TASK_START_SECRET'};$Fake.World.TaskStarted++}.GetNewClosure()} },
+        [pscustomobject]@{ Name='Supervisor ready timeout';Code='CCOD_INSTALL_NEW_RUNTIME_NOT_READY';Committed=$true;Configure={param($Fake,$OldRuntime)$Fake.Adapters.WaitNewRuntimeReady={param($Root,$RuntimeId,$Generation,$Identity,$Started,$Timeout)[pscustomobject]@{SupervisorReady=([string]$RuntimeId-ceq[string]$OldRuntime);TrayReady=$true}}.GetNewClosure()} },
+        [pscustomobject]@{ Name='TrayHost ready timeout';Code='CCOD_INSTALL_NEW_RUNTIME_NOT_READY';Committed=$true;Configure={param($Fake,$OldRuntime)$Fake.Adapters.WaitNewRuntimeReady={param($Root,$RuntimeId,$Generation,$Identity,$Started,$Timeout)[pscustomobject]@{SupervisorReady=$true;TrayReady=([string]$RuntimeId-ceq[string]$OldRuntime)}}.GetNewClosure()} },
+        [pscustomobject]@{ Name='rollback readiness failure';Code='CCOD_INSTALL_ROLLBACK_FAILED';Committed=$true;Configure={param($Fake,$OldRuntime)$Fake.World.NewSupervisorReady=$false} }
     )
     foreach ($case in $cases) {
         $source = New-CcodLifecycleTempRoot
@@ -1375,27 +1429,31 @@ $results += Invoke-CcodTest 'upgrade boundaries fail closed with phase receipts
             Set-CcodLifecycleTestStatus -InstallRoot $install -RuntimeId $first.RuntimeId
             [IO.File]::WriteAllText((Join-Path $source 'src\runtime\main-payload.js'), "module.exports = 'boundary-$($case.Name)';`n", [Text.UTF8Encoding]::new($false))
             $fake = New-CcodLifecycleFake -NodePath $nodePath
-            & $case.Configure $fake
+            & $case.Configure $fake $first.RuntimeId
 
             $failure = $null
             try { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters | Out-Null } catch { $failure = $_ }
             Assert-CcodTrue ($null -ne $failure) "$($case.Name) fails closed"
-            Assert-CcodTrue ($failure.FullyQualifiedErrorId -like "$($case.Code)*") "$($case.Name) returns its stable support code"
-            $activation = Get-Content -LiteralPath (Join-Path $install 'state\post-install-activation.json') -Raw -Encoding UTF8 | ConvertFrom-Json
+            Assert-CcodTrue ($failure.FullyQualifiedErrorId -like "$($case.Code)*") "$($case.Name) returns its stable support code (actual=$($failure.FullyQualifiedErrorId); calls=$($fake.World.Calls -join ','))"
+            $failedReceipts = @(Get-ChildItem -LiteralPath (Join-Path $install 'state\activation-receipts') -Filter '*.Failed.json' -File | ForEach-Object { Get-Content -LiteralPath $_.FullName -Raw -Encoding UTF8 | ConvertFrom-Json })
+            Assert-CcodEqual 1 $failedReceipts.Count "$($case.Name) writes one create-only Failed receipt"
+            $activation = $failedReceipts[0]
             Assert-CcodEqual 'Failed' $activation.phase "$($case.Name) writes Failed"
             Assert-CcodEqual $false $activation.ready "$($case.Name) never writes Ready"
             Assert-CcodEqual $case.Code $activation.errorCode "$($case.Name) persists the stable code"
+            $failedTransactions = @(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Failed.*.json' -File | ForEach-Object { Get-Content -LiteralPath $_.FullName -Raw -Encoding UTF8 | ConvertFrom-Json } | Where-Object { [string]$_.newRuntimeId -cne [string]$first.RuntimeId })
+            Assert-CcodEqual 1 $failedTransactions.Count "$($case.Name) writes one terminal transaction snapshot"
+            Assert-CcodEqual $case.Code $failedTransactions[0].errorCode "$($case.Name) binds the transaction head to the stable code"
 
             $pointer = Read-CcodLifecycleActivePointer -Root $install
             $runtimeIds = @(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory | ForEach-Object Name)
+            Assert-CcodEqual 2 $runtimeIds.Count "$($case.Name) retains old and failed generations"
             if ($case.Committed) {
-                Assert-CcodTrue ($pointer.activeRuntime -cne $first.RuntimeId) "$($case.Name) keeps the committed new generation instead of regressing the pointer"
-                Assert-CcodEqual $first.RuntimeId $pointer.previousRuntime "$($case.Name) preserves the previous runtime for recovery"
-                Assert-CcodEqual 2 $runtimeIds.Count "$($case.Name) preserves both committed generations"
+                Assert-CcodEqual $first.RuntimeId $pointer.activeRuntime "$($case.Name) appends a compensating pointer to the retained old runtime"
+                Assert-CcodTrue ([uint64]$pointer.generation -ge 3) "$($case.Name) compensation advances rather than regresses the generation"
             } else {
                 Assert-CcodEqual $first.RuntimeId $pointer.activeRuntime "$($case.Name) leaves the old pointer active before mutation"
-                Assert-CcodEqual 1 $runtimeIds.Count "$($case.Name) removes any uncommitted staged runtime"
-                Assert-CcodEqual $first.RuntimeId $runtimeIds[0] "$($case.Name) retains only the previous runtime"
+                Assert-CcodEqual 1 ([uint64]$pointer.generation) "$($case.Name) does not append a pre-pointer compensation"
             }
         } finally {
             foreach ($path in @($source, $install, $nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
@@ -1403,33 +1461,6 @@ $results += Invoke-CcodTest 'upgrade boundaries fail closed with phase receipts
     }
 }
 
-# Production mutation caught: reporting a pre-generation upgrade failure after stopping the old runtime without first restarting and proving the still-active generation.
-$results += Invoke-CcodTest 'pre-generation upgrade failure restores and proves previous runtime protection before Failed' {
-    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
-    try {
-        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.0-rollback-a'|Out-Null
-        $nodePath=New-CcodLifecycleFakeNode -Root $nodeRoot
-        $first=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
-        Set-CcodLifecycleTestStatus -InstallRoot $install -RuntimeId $first.RuntimeId
-        [IO.File]::WriteAllText((Join-Path $source 'src\runtime\main-payload.js'),"module.exports='rollback-b';`n",[Text.UTF8Encoding]::new($false))
-        $fake=New-CcodLifecycleFake -NodePath $nodePath
-        $fake.World.CopyOverride=[pscustomobject]@{Match='*Supervisor.ps1';Action={param($SourcePath,$DestinationPath)throw 'PRIVATE_PREGENERATION_COPY_FAILURE'}}
-        $originalWriter=$fake.Adapters.WriteActivationReceipt
-        $fake.Adapters.WriteActivationReceipt={param($Root,$Receipt)$fake.World.Calls.Add("Receipt:$($Receipt.phase)");&$originalWriter $Root $Receipt}.GetNewClosure()
-        $fake.Adapters.WaitNewRuntimeReady={param($Root,$Runtime,$Generation,$Identity,$Started,$Timeout)$fake.World.Calls.Add("WaitRollbackReady:${Runtime}:${Generation}:${Timeout}");[pscustomobject][ordered]@{SupervisorReady=$true;TrayReady=$true}}.GetNewClosure()
-
-        Assert-CcodThrows {Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters|Out-Null} 'CCOD_INSTALL_STAGING_FAILED'
-        [string[]]$calls=@($fake.World.Calls)
-        $close=[Array]::IndexOf($calls,'CloseShutdownGate');$lease=[Array]::IndexOf($calls,'ExitInstallLease');$start=[Array]::IndexOf($calls,'StartTask')
-        $wait=@($calls|Where-Object{$_-like"WaitRollbackReady:$($first.RuntimeId):1:*"})[0];$waitIndex=[Array]::IndexOf($calls,$wait);$failed=[Array]::IndexOf($calls,'Receipt:Failed')
-        Assert-CcodTrue ($close-ge0-and$lease-gt$close-and$start-gt$lease-and$waitIndex-gt$start-and$failed-gt$waitIndex) 'shutdown gate and install ownership release before old task restart, readiness proof, and Failed receipt'
-        Assert-CcodEqual 1 $fake.World.TaskStarted 'previous protection is restarted exactly once'
-        $pointer=Read-CcodLifecycleActivePointer -Root $install
-        Assert-CcodEqual $first.RuntimeId $pointer.activeRuntime 'rollback proof remains bound to the previous active runtime'
-        Assert-CcodEqual 1 ([UInt64]$pointer.generation) 'rollback proof remains bound to the previous active generation'
-    } finally {foreach($path in @($source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}}
-}
-
 # Production mutation caught: setting previousProtectionStopped only after task-idle proof, which skips rollback when exact Supervisor exit succeeds but IgnoreNew remains busy.
 $results += Invoke-CcodTest 'task-idle failure restarts and proves the old active generation before Failed' {
     $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
@@ -1441,7 +1472,7 @@ $results += Invoke-CcodTest 'task-idle failure restarts and proves the old activ
         [IO.File]::WriteAllText((Join-Path $source 'src\runtime\main-payload.js'),"module.exports='task-idle-rollback-b';`n",[Text.UTF8Encoding]::new($false))
         $fake=New-CcodLifecycleFake -NodePath $nodePath;$fake.World.TaskIdle=$false
         $originalWriter=$fake.Adapters.WriteActivationReceipt
-        $fake.Adapters.WriteActivationReceipt={param($Root,$Receipt)$fake.World.Calls.Add("Receipt:$($Receipt.phase)");&$originalWriter $Root $Receipt}.GetNewClosure()
+        $fake.Adapters.WriteActivationReceipt={param($Root,$Receipt,$FileTransaction)$fake.World.Calls.Add("Receipt:$($Receipt.phase)");&$originalWriter $Root $Receipt $FileTransaction}.GetNewClosure()
         $fake.Adapters.WaitNewRuntimeReady={param($Root,$Runtime,$Generation,$Identity,$Started,$Timeout)$fake.World.Calls.Add("WaitRollbackReady:${Runtime}:${Generation}:${Timeout}");[pscustomobject][ordered]@{SupervisorReady=$true;TrayReady=$true}}.GetNewClosure()
 
         Assert-CcodThrows {Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters|Out-Null} 'CCOD_INSTALL_SUPERVISOR_TASK_BUSY'
@@ -1456,28 +1487,8 @@ $results += Invoke-CcodTest 'task-idle failure restarts and proves the old activ
     } finally {foreach($path in @($source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}}
 }
 
-$results += Invoke-CcodTest 'pre-generation rollback proof failure reports a bounded rollback code and preserves the old generation' {
-    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
-    try{
-        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.0-rollback-proof-a'|Out-Null;$nodePath=New-CcodLifecycleFakeNode -Root $nodeRoot
-        $first=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
-        Set-CcodLifecycleTestStatus -InstallRoot $install -RuntimeId $first.RuntimeId
-        [IO.File]::WriteAllText((Join-Path $source 'src\runtime\main-payload.js'),"module.exports='rollback-proof-b';`n",[Text.UTF8Encoding]::new($false))
-        $fake=New-CcodLifecycleFake -NodePath $nodePath;$fake.World.StartTaskFailure=$true
-        $fake.World.CopyOverride=[pscustomobject]@{Match='*Supervisor.ps1';Action={param($SourcePath,$DestinationPath)throw 'PRIVATE_PREGENERATION_COPY_FAILURE'}}
-
-        Assert-CcodThrows {Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters|Out-Null} 'CCOD_INSTALL_ROLLBACK_FAILED'
-        $activation=Get-Content -LiteralPath (Join-Path $install 'state\post-install-activation.json') -Raw -Encoding UTF8|ConvertFrom-Json
-        Assert-CcodEqual 'Failed' $activation.phase 'unproven rollback remains terminally Failed'
-        Assert-CcodEqual 'CCOD_INSTALL_ROLLBACK_FAILED' $activation.errorCode 'unproven rollback exposes only the bounded support code'
-        $pointer=Read-CcodLifecycleActivePointer -Root $install
-        Assert-CcodEqual $first.RuntimeId $pointer.activeRuntime 'unproven rollback never mutates the previous active pointer'
-        Assert-CcodEqual 1 ([UInt64]$pointer.generation) 'unproven rollback never regresses or advances generation'
-    }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}}
-}
-
-# Production mutation caught: removing superseded runtime directories before readiness or retaining them after a verified Ready transition.
-$results += Invoke-CcodTest 'old runtime cleanup occurs only after combined readiness succeeds' {
+# Production mutation caught: physically deleting retained generations after readiness.
+$results += Invoke-CcodTest 'old and unknown runtime generations remain retained after Ready and failure' {
     $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
     try{
         New-CcodLifecycleSourceFixture -Root $source -Version '2.5.0-cleanup-a'|Out-Null;$nodePath=New-CcodLifecycleFakeNode -Root $nodeRoot
@@ -1489,42 +1500,18 @@ $results += Invoke-CcodTest 'old runtime cleanup occurs only after combined read
         $readyFake.Adapters.WaitNewRuntimeReady={param($Root,$Runtime,$Generation,$Identity,$Started,$Timeout)$cleanupWorld.ObservedBeforeReady=Test-Path -LiteralPath $orphan -PathType Container;[pscustomobject][ordered]@{SupervisorReady=$true;TrayReady=$true}}.GetNewClosure()
         $second=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $readyFake.Adapters
         Assert-CcodTrue $cleanupWorld.ObservedBeforeReady 'superseded runtime still exists while readiness is being proven'
-        Assert-CcodTrue (-not(Test-Path -LiteralPath $orphan)) 'superseded runtime is cleaned only after Ready'
+        Assert-CcodTrue (Test-Path -LiteralPath $orphan -PathType Container) 'Ready retains unknown runtime directories for separate maintenance'
 
         Set-CcodLifecycleTestStatus -InstallRoot $install -RuntimeId $second.RuntimeId
         $orphanAfterFailure=Join-Path $install 'runtime\superseded-after-failure';[IO.Directory]::CreateDirectory($orphanAfterFailure)|Out-Null
         [IO.File]::WriteAllText((Join-Path $source 'src\runtime\main-payload.js'),"module.exports='cleanup-timeout';`n",[Text.UTF8Encoding]::new($false))
         $blocked=New-CcodLifecycleFake -NodePath $nodePath;$blocked.World.NewTrayReady=$false
-        Assert-CcodThrows {Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $blocked.Adapters|Out-Null} 'CCOD_INSTALL_NEW_RUNTIME_NOT_READY'
+        Assert-CcodThrows {Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $blocked.Adapters|Out-Null} 'CCOD_INSTALL_ROLLBACK_FAILED'
         Assert-CcodTrue (Test-Path -LiteralPath $orphanAfterFailure -PathType Container) 'readiness failure never performs old-runtime cleanup'
     }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}}
 }
 
 # Production mutation caught: allowing a best-effort post-Ready cleanup exception to enter activation failure handling and overwrite the terminal Ready receipt.
-$results += Invoke-CcodTest 'post-Ready cleanup failure retains Ready and the undeleted old runtime' {
-    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot;$lock=$null
-    try{
-        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.0-cleanup-failure-a'|Out-Null;$nodePath=New-CcodLifecycleFakeNode -Root $nodeRoot
-        $first=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
-        Set-CcodLifecycleTestStatus -InstallRoot $install -RuntimeId $first.RuntimeId
-        $orphan=Join-Path $install 'runtime\superseded-locked';[IO.Directory]::CreateDirectory($orphan)|Out-Null
-        $lockedPath=Join-Path $orphan 'locked.bin';$lock=[IO.File]::Open($lockedPath,[IO.FileMode]::CreateNew,[IO.FileAccess]::ReadWrite,[IO.FileShare]::None)
-        [IO.File]::WriteAllText((Join-Path $source 'src\runtime\main-payload.js'),"module.exports='cleanup-failure-b';`n",[Text.UTF8Encoding]::new($false))
-        $fake=New-CcodLifecycleFake -NodePath $nodePath
-
-        $second=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters
-        Assert-CcodEqual 'Upgraded' $second.Outcome 'cleanup failure does not invalidate the verified upgrade'
-        $activation=Get-Content -LiteralPath (Join-Path $install 'state\post-install-activation.json') -Raw -Encoding UTF8|ConvertFrom-Json
-        Assert-CcodEqual 'Ready' $activation.phase 'cleanup failure cannot overwrite Ready with Failed'
-        Assert-CcodEqual $true $activation.ready 'terminal readiness remains successful'
-        Assert-CcodTrue (Test-Path -LiteralPath $orphan -PathType Container) 'cleanup failure retains the undeleted old runtime'
-        Assert-CcodEqual 1 @($fake.World.LogRecords|Where-Object{$_.code-ceq'CCOD_INSTALL_OLD_RUNTIME_CLEANUP_FAILED'}).Count 'cleanup failure leaves one safe diagnostic record'
-    }finally{
-        if($null-ne$lock){$lock.Dispose()}
-        foreach($path in @($source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}
-    }
-}
-
 # Production mutation caught: silently losing a completion-log failure or allowing any post-Ready diagnostic path to overwrite Ready.
 $results += Invoke-CcodTest 'post-Ready completion-log failure stays Ready retains previous runtime and emits a bounded diagnostic' {
     $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
@@ -1537,7 +1524,7 @@ $results += Invoke-CcodTest 'post-Ready completion-log failure stays Ready retai
 
         $second=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters
         Assert-CcodEqual 'Upgraded' $second.Outcome 'post-Ready log failure does not invalidate the verified upgrade'
-        $activation=Get-Content -LiteralPath (Join-Path $install 'state\post-install-activation.json') -Raw -Encoding UTF8|ConvertFrom-Json
+        $activation=@(Get-ChildItem -LiteralPath (Join-Path $install 'state\activation-receipts') -Filter '*.Ready.json' -File|ForEach-Object{Get-Content -LiteralPath $_.FullName -Raw -Encoding UTF8|ConvertFrom-Json}|Where-Object{$_.runtimeId-ceq$second.RuntimeId})[0]
         Assert-CcodEqual 'Ready' $activation.phase 'post-Ready log failure cannot overwrite Ready'
         Assert-CcodEqual $true $activation.ready 'post-Ready log failure preserves successful readiness'
         Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $install "runtime\$($first.RuntimeId)") -PathType Container) 'post-Ready log failure retains the previous runtime'
@@ -1579,61 +1566,30 @@ $results += Invoke-CcodTest 'upgrade stops the old owner and task before acquiri
     }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}}
 }
 
-$results += Invoke-CcodTest 'staging copy failure fails closed before activation' {
-    $source = New-CcodLifecycleTempRoot
-    $install = New-CcodLifecycleTempRoot
-    $nodeRoot = New-CcodLifecycleTempRoot
-    try {
-        New-CcodLifecycleSourceFixture -Root $source | Out-Null
-        $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
-        $fake = New-CcodLifecycleFake -NodePath $nodePath
-        $fake.World.CopyOverride = [pscustomobject]@{ Match = '*Supervisor.ps1'; Action = { param($Source, $Destination) throw 'PRIVATE_COPY_SECRET' } }
-        Assert-CcodThrows { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters } 'CCOD_INSTALL_STAGING_FAILED'
-        Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $install 'active.json'))) 'staging failure never writes active pointer'
-        Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $install 'bootstrap.ps1'))) 'staging failure never writes bootstrap'
-        Assert-CcodEqual 0 (Get-ChildItem -LiteralPath $install -Directory -ErrorAction SilentlyContinue | Where-Object { $_.Name -eq '.staging' }).Count 'staging directory cleaned'
-    } finally {
-        foreach ($path in @($source, $install, $nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
-    }
-}
-
-$results += Invoke-CcodTest 'manifest hash mismatch fails closed and cleans staging' {
-    $source = New-CcodLifecycleTempRoot
-    $install = New-CcodLifecycleTempRoot
-    $nodeRoot = New-CcodLifecycleTempRoot
-    try {
-        New-CcodLifecycleSourceFixture -Root $source | Out-Null
-        $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
-        $fake = New-CcodLifecycleFake -NodePath $nodePath
-        $fake.World.CopyOverride = [pscustomobject]@{ Match = '*SessionController.ps1'; Action = { param($Source, $Destination) [IO.Directory]::CreateDirectory((Split-Path $Destination -Parent)) | Out-Null; [IO.File]::WriteAllText($Destination, 'tampered', [Text.UTF8Encoding]::new($false)) } }
-        Assert-CcodThrows { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters } 'CCOD_INSTALL_FILE_HASH_MISMATCH'
-        Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $install 'active.json'))) 'hash mismatch never activates'
-        Assert-CcodEqual 0 (Get-ChildItem -LiteralPath $install -Directory -ErrorAction SilentlyContinue | Where-Object { $_.Name -eq '.staging' }).Count 'hash mismatch cleans staging'
-    } finally {
-        foreach ($path in @($source, $install, $nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
-    }
-}
-
-$results += Invoke-CcodTest 'selected UI catalog mutation after inventory fails hash verification before activation' {
+$results += Invoke-CcodTest 'sealed-source copy failure retains the candidate and leaves pointer and legacy shells unchanged' {
     $source = New-CcodLifecycleTempRoot
     $install = New-CcodLifecycleTempRoot
     $nodeRoot = New-CcodLifecycleTempRoot
+    $sourceLock = $null
     try {
         New-CcodLifecycleSourceFixture -Root $source | Out-Null
+        [IO.Directory]::CreateDirectory($install) | Out-Null
+        $legacyBootstrap=Join-Path $install 'bootstrap.ps1';$legacyUninstaller=Join-Path $install 'Uninstall-CodexControlOtherDevices.ps1'
+        [IO.File]::WriteAllText($legacyBootstrap,'legacy-bootstrap',[Text.UTF8Encoding]::new($false));[IO.File]::WriteAllText($legacyUninstaller,'legacy-uninstaller',[Text.UTF8Encoding]::new($false))
+        $bootstrapHash=Get-CcodTestFileSha256 $legacyBootstrap;$uninstallerHash=Get-CcodTestFileSha256 $legacyUninstaller
         $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
         $fake = New-CcodLifecycleFake -NodePath $nodePath
-        $fake.World.CopyOverride = [pscustomobject]@{
-            Match = '*ui.en-US.json'
-            Action = {
-                param($Source, $Destination)
-                [IO.Directory]::CreateDirectory((Split-Path $Destination -Parent)) | Out-Null
-                [IO.File]::Copy($Source, $Destination, $true)
-                [IO.File]::WriteAllText($Source, '{"schemaVersion":1,"language":"tampered-after-inventory"}', [Text.UTF8Encoding]::new($false))
-            }
-        }
-        Assert-CcodThrows { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters } 'CCOD_INSTALL_FILE_HASH_MISMATCH'
-        Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $install 'active.json'))) 'post-inventory catalog mutation never activates'
-    } finally {
+        $sourceLock=[IO.File]::Open((Join-Path $source 'src\persistence\Supervisor.ps1'),[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::None)
+        $failure=$null;try{Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters|Out-Null}catch{$failure=$_}
+        Assert-CcodTrue ($null-ne$failure) 'sealed source lock fails the immutable copy'
+        Assert-CcodTrue ($failure.FullyQualifiedErrorId-like'CCOD_INSTALL_*') 'sealed source copy failure is bounded'
+        Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $install 'active.json')) 'sealed source failure never writes legacy active pointer'
+        Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $install 'state\active-generation')) 'sealed source failure occurs before append-only pointer commit'
+        Assert-CcodEqual $bootstrapHash (Get-CcodTestFileSha256 $legacyBootstrap) 'sealed source failure leaves legacy bootstrap bytes unchanged'
+        Assert-CcodEqual $uninstallerHash (Get-CcodTestFileSha256 $legacyUninstaller) 'sealed source failure leaves legacy uninstaller bytes unchanged'
+        Assert-CcodEqual 1 @(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory -ErrorAction SilentlyContinue).Count 'failed immutable candidate is retained for diagnosis'
+    } finally {
+        if($null-ne$sourceLock){$sourceLock.Dispose()}
         foreach ($path in @($source, $install, $nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
     }
 }
@@ -1824,7 +1780,7 @@ $results += Invoke-CcodTest 'invalid active pointer fails closed before upgrade'
         $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
         $fake = New-CcodLifecycleFake -NodePath $nodePath
         Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters | Out-Null
-        [IO.File]::WriteAllText((Join-Path $install 'active.json'), '{"schemaVersion":9,"activeRuntime":"x","previousRuntime":null,"updatedAtUtc":"2030-02-03T03:04:05.0000000Z"}', [Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText((Join-Path $install 'state\active-generation\00000000000000000002.json'), '{"schemaVersion":9,"generation":2,"activeRuntime":"x","previousGeneration":1}', [Text.UTF8Encoding]::new($false))
         [IO.File]::WriteAllText((Join-Path $source 'src\runtime\main-payload.js'), "module.exports = 'fixture-v2';`n", [Text.UTF8Encoding]::new($false))
         Assert-CcodThrows { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters } 'CCOD_SCHEMA_UNSUPPORTED'
     } finally {
diff --git a/tests/persistence/PersistenceIO.SelfTest.ps1 b/tests/persistence/PersistenceIO.SelfTest.ps1
index bd585eb..528add4 100644
--- a/tests/persistence/PersistenceIO.SelfTest.ps1
+++ b/tests/persistence/PersistenceIO.SelfTest.ps1
@@ -49,6 +49,12 @@ try {
         Assert-CcodEqual 1 (Read-CcodStrictJson -Path $path -ExpectedSchema 1 -Kind 'settings').schemaVersion 'schema round-trip'
     }
 
+    Invoke-CcodTest 'bounded strict JSON reader rejects oversized complete records before parsing' {
+        $path = Join-Path $root 'state\oversized-record.json'
+        [IO.File]::WriteAllText($path,('{"schemaVersion":1,"padding":"'+('x'*4096)+'"}'),[Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows { Read-CcodStrictJson -Path $path -ExpectedSchema 1 -Kind 'bounded record' -MaxBytes 1024 | Out-Null } 'CCOD_STATE_TOO_LARGE'
+    }
+
     Invoke-CcodTest 'preserves ISO timestamp fields as JSON strings under Windows PowerShell' {
         $path = Join-Path $root 'state\timestamp-string.json'
         $timestamp = '2030-02-03T04:05:06.0000000Z'

From bd5b690ec825673794cf2d9fdb7e1a628613ad44 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 03:15:35 +0800
Subject: [PATCH 081/187] fix: complete generation bootstrap lifecycle

---
 .../task-2-report.md                          |  86 +++++++++++++
 ...08-29-v2522-immutable-generation-design.md |  31 ++++-
 src/persistence/StaticProbeWorker.ps1         |  19 +--
 src/persistence/UninstallBootstrap.ps1        |  24 ++--
 src/persistence/bootstrap.ps1                 |  64 ++++++++--
 src/persistence/modules/InstallLifecycle.psm1 | 108 ++++++++++------
 src/persistence/modules/RuntimeManifest.psm1  |  41 ++++++-
 src/persistence/modules/StateStore.psm1       |  18 +--
 src/persistence/modules/UiPreferences.psm1    |  16 ++-
 tests/persistence/Bootstrap.SelfTest.ps1      |  34 +++++-
 .../persistence/InstallLifecycle.SelfTest.ps1 | 115 +++++++++++++-----
 .../persistence/RuntimeManifest.SelfTest.ps1  |  34 +++++-
 .../StaticProbeWorker.SelfTest.ps1            |  15 ++-
 .../UninstallBootstrap.SelfTest.ps1           |  10 +-
 14 files changed, 477 insertions(+), 138 deletions(-)

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md
index 22cc90a..10cb813 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md
@@ -118,3 +118,89 @@ start/stop, WindowsApps access, DPAPI access, or external write was performed.
 ## Commit
 
 - `fix: commit lifecycle through immutable generations` (this Task 2 commit)
+
+## Fix round 1 — complete the real generation-bootstrap lifecycle
+
+### Review status and RED evidence
+
+The scoped review of `e80b829..2101485` failed with one Critical and six
+Important findings. This round keeps `2101485` and remediates all seven.
+
+- Bootstrap command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\Bootstrap.SelfTest.ps1`
+  exited `1`; the new real generation-bootstrap case expected exit `0` but
+  received `1` because production still required root `active.json`.
+- RuntimeManifest command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\RuntimeManifest.SelfTest.ps1`
+  exited `1` at the canonical identity assertion because production still
+  emitted `projectVersion-digest16` without a nonce.
+- The lifecycle review regressions then exposed: transaction-root callbacks
+  executing in the wrong module session, a sealed-source fixture failing
+  before generation creation, missing upgrade baselines, cross-root state/UI
+  writes, global nonterminal state accepted at the real entry, freshly read old
+  manifest hashes used for compensation, and contradictory Failed evidence
+  after a visible Ready receipt.
+- The first aggregate attempt exited `1` at
+  `StaticProbeWorker.SelfTest.ps1` with `CCOD_STATIC_RUNTIME_UNAUTHORIZED`;
+  that independent runtime authorizer still used the old ID and legacy-only
+  selector. The second aggregate attempt exited `1` at
+  `UiPreferences.SelfTest.ps1` because the upgrade baseline path had
+  accidentally changed the public duplicate-initialize contract.
+
+### GREEN and verification evidence
+
+- Bootstrap: `24/24`, exit `0`. Coverage includes a copied generation
+  bootstrap actually launching its selected Supervisor with no `active.json`,
+  append-only selector unknown/reparse/ADS/multilink rejection, and legacy
+  fallback only when the chain is absent.
+- InstallLifecycle: `114/114`, exit `0`. Coverage includes same-generation
+  bootstrap parent readiness, legacy-root parent rejection under append-only
+  selection, global pointer-less/ambiguous transaction exclusion, fresh and
+  upgrade baselines, cross-root rejection, partial operational state,
+  recorded-old-manifest compensation, and the Ready final-snapshot gap.
+- RuntimeManifest: 18 named cases, exit `0`, including canonical
+  `projectVersion-fileDigest16-nonce32`, copied/renamed identity with recorded
+  manifest hash, wrong nonce/content, and selector ADS/multilink checks.
+- UninstallBootstrap: `13/13`, exit `0`, including canonical-ID and
+  append-only generation-7 authorization without legacy `active.json`.
+- PersistenceIO: 24 named cases, exit `0`.
+- StaticProbeWorker: 37 named cases, exit `0`, including append-only runtime
+  authorization without legacy `active.json`.
+- UiPreferences focused suite: 9 cases, exit `0`; the default duplicate
+  initialize behavior remains `CCOD_UI_PREFERENCES_EXISTS`, while only the
+  root-bound lifecycle path opts into reading an existing upgrade baseline.
+- Parser: explicit `ParseFile` checks passed for all 12 changed PowerShell
+  code/test files.
+- Diff: `git diff --check` exited `0`; only LF-to-CRLF checkout warnings were
+  emitted.
+- Aggregate:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\PersistenceSelfTest.ps1`
+  exited `0` (`FIX1_AGGREGATE_FINAL_EXIT=0`).
+
+### Remediated behavior
+
+- The generation bootstrap and every audited runtime authorizer read a strict,
+  contiguous append-only active-generation chain first and use legacy
+  `active.json` only when that chain is absent.
+- Runtime identity is exactly
+  `projectVersion-fileDigest16-nonce32`; RuntimeManifest, bootstrap,
+  StaticProbeWorker, and UninstallBootstrap independently recompute it from
+  sorted file records.
+- The install entry rejects any global nonterminal or ambiguous transaction
+  before creating a generation, independent of pointer/package identity.
+- Every fresh or upgrade generation records all five immutable initialization
+  baselines. Complete operational state is snapshotted but not overwritten;
+  partial/malformed operational state fails closed.
+- StateStore and UiPreferences no longer accept file-transaction capabilities.
+  InstallLifecycle first validates the opaque transaction root, then writes
+  baselines itself, so root A cannot be combined with StateRoot B.
+- Active pointer readers reject unknown objects, reparse points, ADS, and
+  multi-linked leaves. Transaction records bind both old and new manifest
+  SHA-256 values; compensation uses only the recorded old hash.
+- A final transaction-snapshot failure after a visible Ready activation receipt
+  returns `CCOD_INSTALL_READY_FINALIZATION_PENDING`, leaves the transaction at
+  `ProtectionReady`, and writes no contradictory Failed receipt or snapshot.
+
+### Fix commit
+
+- `fix: complete generation bootstrap lifecycle` (this fix-round commit)
diff --git a/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md b/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
index 7b35f8a..99269f6 100644
--- a/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
+++ b/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
@@ -71,10 +71,21 @@ manifest is written as the final generation file, then validated through the
 same create-only path. Existing generations are never used as a source root.
 
 Stable `bootstrap.ps1` and `Uninstall-CodexControlOtherDevices.ps1` are
-generated as new candidates inside the generation. They are made visible only
-after the active pointer is committed and the new protection has reached
-verified readiness. An upgrade does not overwrite a stable file while the new
-generation is still incomplete.
+generated as new candidates inside the generation. After pointer commit, the
+scheduled task may select that sealed generation bootstrap solely to prove
+protection readiness; user-visible registration and shortcuts are updated only
+after `Ready`. An upgrade never overwrites a root stable file while the new
+generation is incomplete.
+
+Every new runtime ID is the canonical `projectVersion-fileDigest16-nonce32`
+form: `fileDigest16` is derived from the sorted manifest file records, and the
+lowercase 32-hex nonce makes otherwise identical attempts unique. The runtime
+manifest and bootstrap independently recompute and require that form. The
+stable generation bootstrap reads the append-only active-generation chain
+before it launches Supervisor; it may read legacy `active.json` only when the
+new chain is absent. Lifecycle readiness likewise accepts the exact
+generation bootstrap selected by the scheduled task, with the fixed root
+bootstrap retained only for a proven legacy task.
 
 ### 1a. Immutable initialization evidence and operational state
 
@@ -145,6 +156,18 @@ existing pointer/runtime identity checks. Same-version repair is idempotent
 only when the package hash matches; a different hash returns a conflict before
 pointer mutation.
 
+The transaction records both the old and new manifest SHA-256 values before
+pointer mutation. Compensation opens the old generation only against its
+recorded old-manifest hash; it never treats a freshly read old manifest hash as
+proof. The install entrypoint first rejects any global nonterminal or
+ambiguous transaction chain, whether or not a legacy pointer is present.
+
+`Ready` terminalization never appends a `Failed` record after a visible Ready
+activation receipt. If the final transaction snapshot cannot be persisted, the
+transaction remains recoverable/nonterminal and a later recovery may finish
+the missing Ready snapshot; callers do not claim readiness until both matching
+terminal records exist.
+
 ### 4. Setup and product registration
 
 The Inno shell uses `CreateAppDir=no` and `Uninstallable=no` and has no
diff --git a/src/persistence/StaticProbeWorker.ps1 b/src/persistence/StaticProbeWorker.ps1
index 47b29ca..4e63d37 100644
--- a/src/persistence/StaticProbeWorker.ps1
+++ b/src/persistence/StaticProbeWorker.ps1
@@ -421,12 +421,13 @@ function Test-CcodStaticManifestPath {
 }
 
 function Get-CcodStaticRuntimeIdFromRecords {
-    param([string]$ProjectVersion,[object[]]$Files)
+    param([string]$ProjectVersion,[object[]]$Files,[string]$ExpectedRuntimeId)
     $lines=[Collections.Generic.List[string]]::new()
     foreach($file in $Files){$lines.Add(('{0}`t{1}`t{2}' -f [string]$file.path,[int64]$file.length,[string]$file.sha256))}
     $canonical=$lines -join "`n";$sha=[Security.Cryptography.SHA256]::Create()
     try{$digest=[BitConverter]::ToString($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes($canonical))).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()}
-    $runtimeId='{0}-{1}' -f $ProjectVersion,$digest.Substring(0,16)
+    $match=[regex]::Match($ExpectedRuntimeId,'^(?<version>[A-Za-z0-9][A-Za-z0-9._-]{0,45})-(?<digest>[0-9a-f]{16})-(?<nonce>[0-9a-f]{32})$');if(-not$match.Success-or$match.Groups['version'].Value-cne$ProjectVersion){Throw-CcodStaticProbeError 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Runtime identity format is invalid' $ExpectedRuntimeId}
+    $runtimeId='{0}-{1}-{2}' -f $ProjectVersion,$digest.Substring(0,16),$match.Groups['nonce'].Value
     if(-not (Test-CcodStaticRuntimeId $runtimeId)){Throw-CcodStaticProbeError 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Computed runtime ID is invalid' $null}
     return $runtimeId
 }
@@ -452,11 +453,13 @@ function Get-CcodStaticProbeRuntimeAuthorization {
         if((Split-Path $persistenceRoot -Leaf) -cne 'persistence' -or (Split-Path $srcRoot -Leaf) -cne 'src' -or (Split-Path $runtimeContainer -Leaf) -cne 'runtime' -or -not (Test-CcodStaticRuntimeId $runtimeId)){throw 'layout'}
         $installRoot=[IO.Path]::GetFullPath($installRoot);$runtimeRoot=[IO.Path]::GetFullPath($runtimeRoot)
         Assert-CcodStaticProbeNoReparse -Root $installRoot -Path $ScriptPath -Adapters $Adapters
-        $activePath=[IO.Path]::GetFullPath((Join-Path $installRoot 'active.json'));Assert-CcodStaticProbeNoReparse $installRoot $activePath -Adapters $Adapters
-        $active=Read-CcodStaticProbeLocalJson $activePath;Assert-CcodStaticExactObject $active @('schemaVersion','activeRuntime','previousRuntime','updatedAtUtc') 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Active pointer'|Out-Null
-        if($active.schemaVersion -isnot [int] -or $active.schemaVersion -ne 1 -or -not(Test-CcodStaticRuntimeId $active.activeRuntime) -or
-            ($null -ne $active.previousRuntime -and (-not(Test-CcodStaticRuntimeId $active.previousRuntime) -or $active.previousRuntime -ceq $active.activeRuntime)) -or
-            -not(Test-CcodStaticCanonicalUtc $active.updatedAtUtc) -or $active.activeRuntime -cne $runtimeId){throw 'active pointer'}
+        $pointerRoot=[IO.Path]::GetFullPath((Join-Path $installRoot 'state\active-generation'))
+        if([IO.Directory]::Exists($pointerRoot)){
+            Assert-CcodStaticProbeNoReparse $installRoot $pointerRoot -Adapters $Adapters;$entries=@(Get-ChildItem -LiteralPath $pointerRoot -Force -ErrorAction Stop);if($entries.Count-eq0){throw 'empty active chain'};$records=[Collections.Generic.List[object]]::new()
+            foreach($entry in $entries){if($entry.PSIsContainer-or$entry.Name-cnotmatch'^\d{20}\.json$'){throw 'active entry'};Assert-CcodStaticProbeNoReparse $installRoot $entry.FullName -Adapters $Adapters;$record=Read-CcodStaticProbeLocalJson $entry.FullName;Assert-CcodStaticExactObject $record @('schemaVersion','generation','activeRuntime','previousGeneration') 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Active generation'|Out-Null;if($record.schemaVersion-isnot[int]-or$record.generation-isnot[long]-and$record.generation-isnot[int]-or$record.previousGeneration-isnot[long]-and$record.previousGeneration-isnot[int]-or-not(Test-CcodStaticRuntimeId $record.activeRuntime)){throw 'active generation'};[uint64]$generation=$record.generation;[uint64]$previousGeneration=$record.previousGeneration;if($generation-ne($previousGeneration+1)-or$entry.Name-cne('{0:D20}.json'-f$generation)){throw 'active generation canonical'};$records.Add([pscustomobject]@{generation=$generation;previousGeneration=$previousGeneration;activeRuntime=[string]$record.activeRuntime;path=$entry.FullName})}
+            $ordered=@($records|Sort-Object generation);for($i=0;$i-lt$ordered.Count;$i++){if([uint64]$ordered[$i].generation-ne[uint64]($i+1)-or[uint64]$ordered[$i].previousGeneration-ne[uint64]$i){throw 'active chain'}};$latest=$ordered[-1];$active=[pscustomobject]@{activeRuntime=$latest.activeRuntime};$activePath=$latest.path
+        }else{$activePath=[IO.Path]::GetFullPath((Join-Path $installRoot 'active.json'));Assert-CcodStaticProbeNoReparse $installRoot $activePath -Adapters $Adapters;$active=Read-CcodStaticProbeLocalJson $activePath;Assert-CcodStaticExactObject $active @('schemaVersion','activeRuntime','previousRuntime','updatedAtUtc') 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Active pointer'|Out-Null;if($active.schemaVersion -isnot [int] -or $active.schemaVersion -ne 1 -or -not(Test-CcodStaticRuntimeId $active.activeRuntime) -or($null -ne $active.previousRuntime -and (-not(Test-CcodStaticRuntimeId $active.previousRuntime) -or $active.previousRuntime -ceq $active.activeRuntime)) -or-not(Test-CcodStaticCanonicalUtc $active.updatedAtUtc)){throw 'active pointer'}}
+        if($active.activeRuntime-cne$runtimeId){throw 'active runtime'}
         $expectedRuntime=[IO.Path]::GetFullPath((Join-Path (Join-Path $installRoot 'runtime') $active.activeRuntime))
         $expectedWorker=[IO.Path]::GetFullPath((Join-Path $expectedRuntime 'src\persistence\StaticProbeWorker.ps1'))
         if($expectedRuntime -cne $runtimeRoot -or $expectedWorker -cne $ScriptPath){throw 'self binding'}
@@ -472,7 +475,7 @@ function Get-CcodStaticProbeRuntimeAuthorization {
             $previous=$file.path;$records.Add([pscustomobject][ordered]@{path=$file.path;length=[int64]$file.length;sha256=$file.sha256})
         }
         foreach($required in $script:CcodStaticProbeRequiredFiles){if(@($records|Where-Object{$_.path -ceq $required}).Count -ne 1){throw 'required file'}}
-        $computed=Get-CcodStaticRuntimeIdFromRecords $manifest.projectVersion $records.ToArray()
+        $computed=Get-CcodStaticRuntimeIdFromRecords $manifest.projectVersion $records.ToArray() $manifest.runtimeId
         if($computed -cne $manifest.runtimeId -or $computed -cne $active.activeRuntime -or $computed -cne $runtimeId){throw 'runtime id'}
         foreach($required in $script:CcodStaticProbeRequiredFiles){
             $record=@($records|Where-Object{$_.path -ceq $required})[0];$path=[IO.Path]::GetFullPath((Join-Path $runtimeRoot ($required.Replace('/','\'))))
diff --git a/src/persistence/UninstallBootstrap.ps1 b/src/persistence/UninstallBootstrap.ps1
index 779d04e..6f2c008 100644
--- a/src/persistence/UninstallBootstrap.ps1
+++ b/src/persistence/UninstallBootstrap.ps1
@@ -257,7 +257,7 @@ function Get-CcodUninstallBootstrapRuntimeRecords {
 }
 
 function Get-CcodUninstallBootstrapRuntimeId {
-    param([Parameter(Mandatory)][string]$ProjectVersion,[Parameter(Mandatory)][object[]]$Records)
+    param([Parameter(Mandatory)][string]$ProjectVersion,[Parameter(Mandatory)][object[]]$Records,[Parameter(Mandatory)][string]$Nonce)
     if ($ProjectVersion -isnot [string] -or $ProjectVersion -notmatch '^\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?$') {
         Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The runtime manifest version is invalid' $ProjectVersion
     }
@@ -266,7 +266,8 @@ function Get-CcodUninstallBootstrapRuntimeId {
     $sha = [Security.Cryptography.SHA256]::Create()
     try {
         $digest = [BitConverter]::ToString($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes(($lines -join "`n")))).Replace('-','').ToLowerInvariant()
-        return '{0}-{1}' -f $ProjectVersion,$digest.Substring(0,16)
+        if($Nonce-cnotmatch'^[0-9a-f]{32}$'){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The runtime nonce is invalid' $Nonce}
+        return '{0}-{1}-{2}' -f $ProjectVersion,$digest.Substring(0,16),$Nonce
     } finally { $sha.Dispose() }
 }
 
@@ -362,16 +363,12 @@ function Get-CcodUninstallBootstrapVerifiedRuntimeContext {
         if ([string]::IsNullOrWhiteSpace($PSCommandPath) -or (Get-CcodUninstallBootstrapFullPath -Path $PSCommandPath -Kind 'Bootstrap script') -cne $expectedScript) {
             Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'The uninstall bootstrap was not launched from the installed application root' $PSCommandPath
         }
-        $activePath = Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath 'active.json' -RequireLeafFile
-        $active = Read-CcodUninstallBootstrapJson -Path $activePath -Kind 'Active runtime pointer'
-        if (-not (Test-CcodUninstallBootstrapExactProperties $active @('schemaVersion','activeRuntime','previousRuntime','generation','updatedAtUtc')) -or
-            $active.schemaVersion -isnot [int] -or $active.schemaVersion -ne 2 -or
-            $active.activeRuntime -isnot [string] -or $active.activeRuntime -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$' -or
-            ($null -ne $active.previousRuntime -and ($active.previousRuntime -isnot [string] -or $active.previousRuntime -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$')) -or
-            -not (Test-CcodUninstallBootstrapCanonicalUtc $active.updatedAtUtc)) {
-            Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active runtime pointer is invalid' $activePath
-        }
-        $generation = ConvertTo-CcodUninstallBootstrapUInt64 $active.generation 'active runtime generation'
+        $pointerRoot=Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath 'state\active-generation' -AllowMissingLeaf
+        if([IO.Directory]::Exists($pointerRoot)){
+            $entries=@(Get-ChildItem -LiteralPath $pointerRoot -Force -ErrorAction Stop);if($entries.Count-eq0){throw 'empty selector'};$records=[Collections.Generic.List[object]]::new()
+            foreach($entry in $entries){if($entry.PSIsContainer-or$entry.Name-cnotmatch'^\d{20}\.json$'){throw 'selector entry'};$path=Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath ('state\active-generation\'+$entry.Name) -RequireLeafFile;$record=Read-CcodUninstallBootstrapJson -Path $path -Kind 'Active generation';if(-not(Test-CcodUninstallBootstrapExactProperties $record @('schemaVersion','generation','activeRuntime','previousGeneration'))-or$record.schemaVersion-isnot[int]-or$record.schemaVersion-ne1-or$record.activeRuntime-isnot[string]-or$record.activeRuntime-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$'){throw 'selector record'};[uint64]$g=ConvertTo-CcodUninstallBootstrapUInt64 $record.generation 'active generation';[uint64]$p=[uint64]$record.previousGeneration;if($g-ne($p+1)-or$entry.Name-cne('{0:D20}.json'-f$g)){throw 'selector canonical'};$records.Add([pscustomobject]@{generation=$g;previousGeneration=$p;activeRuntime=[string]$record.activeRuntime})}
+            $ordered=@($records|Sort-Object generation);for($i=0;$i-lt$ordered.Count;$i++){if([uint64]$ordered[$i].generation-ne[uint64]($i+1)-or[uint64]$ordered[$i].previousGeneration-ne[uint64]$i){throw 'selector chain'}};$latest=$ordered[-1];$active=[pscustomobject]@{activeRuntime=$latest.activeRuntime};$generation=[uint64]$latest.generation
+        }else{$activePath = Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath 'active.json' -RequireLeafFile;$active = Read-CcodUninstallBootstrapJson -Path $activePath -Kind 'Active runtime pointer';if (-not (Test-CcodUninstallBootstrapExactProperties $active @('schemaVersion','activeRuntime','previousRuntime','generation','updatedAtUtc')) -or$active.schemaVersion -isnot [int] -or $active.schemaVersion -ne 2 -or$active.activeRuntime -isnot [string] -or $active.activeRuntime -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$' -or($null -ne $active.previousRuntime -and ($active.previousRuntime -isnot [string] -or $active.previousRuntime -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$')) -or-not (Test-CcodUninstallBootstrapCanonicalUtc $active.updatedAtUtc)){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active runtime pointer is invalid' $activePath};$generation = ConvertTo-CcodUninstallBootstrapUInt64 $active.generation 'active runtime generation'}
         $runtimeRoot = Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath ('runtime\' + $active.activeRuntime)
         $runtimeItem = Get-Item -LiteralPath $runtimeRoot -Force -ErrorAction Stop
         if (-not $runtimeItem.PSIsContainer) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active runtime directory is invalid' $runtimeRoot }
@@ -401,7 +398,8 @@ function Get-CcodUninstallBootstrapVerifiedRuntimeContext {
             }
             $recordMap[$expected.path] = $expected
         }
-        if ((Get-CcodUninstallBootstrapRuntimeId -ProjectVersion $manifest.projectVersion -Records $actualRecords) -cne $active.activeRuntime) {
+        $identityMatch=[regex]::Match([string]$active.activeRuntime,'^(?<version>[A-Za-z0-9][A-Za-z0-9._-]{0,45})-(?<digest>[0-9a-f]{16})-(?<nonce>[0-9a-f]{32})$')
+        if(-not$identityMatch.Success-or$identityMatch.Groups['version'].Value-cne[string]$manifest.projectVersion-or(Get-CcodUninstallBootstrapRuntimeId -ProjectVersion $manifest.projectVersion -Records $actualRecords -Nonce $identityMatch.Groups['nonce'].Value) -cne $active.activeRuntime) {
             Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active runtime ID does not match its verified manifest' $runtimeRoot
         }
         foreach ($entry in $script:CcodUninstallPayloadEntries) {
diff --git a/src/persistence/bootstrap.ps1 b/src/persistence/bootstrap.ps1
index 24a1c49..39ef577 100644
--- a/src/persistence/bootstrap.ps1
+++ b/src/persistence/bootstrap.ps1
@@ -124,9 +124,55 @@ function Assert-CcodBootstrapRuntimeId {
     return $RuntimeId
 }
 
+function Get-CcodBootstrapFileLinkCount {
+    param([Parameter(Mandatory)][string]$Path)
+    if($null-eq('CcodBootstrapFileIdentity' -as[type])){Add-Type -TypeDefinition @'
+using System; using System.ComponentModel; using System.IO; using System.Runtime.InteropServices; using Microsoft.Win32.SafeHandles;
+public static class CcodBootstrapFileIdentity {
+ [StructLayout(LayoutKind.Sequential)] struct Info { public uint Attr; public System.Runtime.InteropServices.ComTypes.FILETIME C,A,W; public uint Vol,High,Low,Links,Hi,Lo; }
+ [DllImport("kernel32.dll",SetLastError=true)] static extern bool GetFileInformationByHandle(SafeFileHandle h,out Info i);
+ public static uint Links(string p){using(FileStream s=new FileStream(p,FileMode.Open,FileAccess.Read,FileShare.Read)){Info i;if(!GetFileInformationByHandle(s.SafeFileHandle,out i))throw new Win32Exception(Marshal.GetLastWin32Error());return i.Links;}}
+}
+'@}
+    return [CcodBootstrapFileIdentity]::Links($Path)
+}
+
+function Assert-CcodBootstrapPlainSelectorFile {
+    param([Parameter(Mandatory)][string]$Path)
+    $item=Get-Item -LiteralPath $Path -Force -ErrorAction Stop
+    if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0-or(Get-CcodBootstrapFileLinkCount $Path)-ne1){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector is not a plain single-link file' $Path}
+    $streams=@(Get-Item -LiteralPath $Path -Stream * -ErrorAction Stop)
+    if($streams.Count-ne1-or[string]$streams[0].Stream-cne':$DATA'){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector has alternate data streams' $Path}
+}
+
 function Read-CcodBootstrapActivePointer {
     param([Parameter(Mandatory)][string]$InstallRoot)
 
+    $pointerRoot=Assert-CcodBootstrapContained -Root $InstallRoot -Path (Join-Path $InstallRoot 'state\active-generation') -AllowMissingLeaf
+    if([IO.Directory]::Exists($pointerRoot)){
+        if(Test-CcodBootstrapReparse $pointerRoot){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector root is a reparse point' $pointerRoot}
+        $entries=@(Get-ChildItem -LiteralPath $pointerRoot -Force -ErrorAction Stop)
+        if($entries.Count-eq0){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector is empty' $pointerRoot}
+        $records=[Collections.Generic.List[object]]::new()
+        foreach($entry in $entries){
+            if($entry.PSIsContainer-or$entry.Name-cnotmatch'^\d{20}\.json$'){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector contains an unknown entry' $entry.FullName}
+            Assert-CcodBootstrapPlainSelectorFile $entry.FullName
+            $record=Read-CcodBootstrapJson -Path $entry.FullName -Kind 'active generation selector'
+            $names=@($record.PSObject.Properties.Name)
+            if(($names-join',')-cne'schemaVersion,generation,activeRuntime,previousGeneration'-or$record.schemaVersion-isnot[int]-or$record.schemaVersion-ne1-or$record.activeRuntime-isnot[string]){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector fields are invalid' $entry.FullName}
+            $integerTypes=@([byte],[uint16],[uint32],[uint64],[int16],[int32],[int64]);$gOk=$false;$pOk=$false;foreach($t in $integerTypes){if($record.generation-is$t){$gOk=$true};if($record.previousGeneration-is$t){$pOk=$true}}
+            if(-not$gOk-or-not$pOk){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector generations are not integers' $entry.FullName}
+            try{[uint64]$g=$record.generation;[uint64]$p=$record.previousGeneration}catch{Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector generations are invalid' $entry.FullName}
+            if($g-eq0-or$p-eq[uint64]::MaxValue-or$g-ne($p+1)-or$entry.Name-cne('{0:D20}.json'-f$g)){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector record is not canonical' $entry.FullName}
+            Assert-CcodBootstrapRuntimeId $record.activeRuntime|Out-Null
+            $records.Add([pscustomobject]@{Generation=$g;PreviousGeneration=$p;ActiveRuntime=[string]$record.activeRuntime})
+        }
+        $ordered=@($records|Sort-Object Generation)
+        for($i=0;$i-lt$ordered.Count;$i++){if([uint64]$ordered[$i].Generation-ne[uint64]($i+1)-or[uint64]$ordered[$i].PreviousGeneration-ne[uint64]$i){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector chain has a gap or duplicate' $pointerRoot}}
+        $latest=$ordered[-1];$previous=if($latest.PreviousGeneration-gt0){[string]$ordered[[int]$latest.PreviousGeneration-1].ActiveRuntime}else{$null}
+        return [pscustomobject]@{ActiveRuntime=$latest.ActiveRuntime;PreviousRuntime=$previous;SchemaVersion=3;Generation=[uint64]$latest.Generation;Selector='AppendOnly'}
+    }
+
     $path = Assert-CcodBootstrapContained -Root $InstallRoot -Path (Join-Path $InstallRoot 'active.json') -AllowMissingLeaf
     $value = Read-CcodBootstrapJson -Path $path -Kind 'active.json'
     if ($null -eq $value.PSObject.Properties['schemaVersion'] -or $value.schemaVersion -isnot [int] -or $value.schemaVersion -notin @(1,2) -or
@@ -157,6 +203,7 @@ function Read-CcodBootstrapActivePointer {
         PreviousRuntime = if ($null -eq $value.previousRuntime -or [string]::IsNullOrWhiteSpace($value.previousRuntime)) { $null } else { [string]$value.previousRuntime }
         SchemaVersion = [int]$value.schemaVersion
         Generation = $generation
+        Selector = 'Legacy'
     }
 }
 
@@ -220,8 +267,10 @@ function Get-CcodBootstrapFileRecords {
 function Get-CcodBootstrapRuntimeId {
     param(
         [Parameter(Mandatory)][string]$ProjectVersion,
-        [Parameter(Mandatory)][object[]]$Files
+        [Parameter(Mandatory)][object[]]$Files,
+        [Parameter(Mandatory)][string]$Nonce
     )
+    if($ProjectVersion-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,45}$'-or$Nonce-cnotmatch'^[0-9a-f]{32}$'){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_RUNTIME_ID_INVALID' 'Runtime identity components are invalid' $ProjectVersion}
 
     $lines = [Collections.Generic.List[string]]::new()
     foreach ($file in $Files) {
@@ -234,7 +283,7 @@ function Get-CcodBootstrapRuntimeId {
     } finally {
         $sha256.Dispose()
     }
-    return ('{0}-{1}' -f $ProjectVersion, ([BitConverter]::ToString($digest).Replace('-', '')).ToLowerInvariant().Substring(0, 16))
+    return ('{0}-{1}-{2}' -f $ProjectVersion, ([BitConverter]::ToString($digest).Replace('-', '')).ToLowerInvariant().Substring(0, 16),$Nonce)
 }
 
 function New-CcodBootstrapRuntimeValidation {
@@ -278,7 +327,7 @@ function Test-CcodBootstrapRuntime {
             return New-CcodBootstrapRuntimeValidation -Valid $false -Code 'CCOD_BOOTSTRAP_MANIFEST_INVALID' -RuntimeDirectory $runtimeDirectory -SupervisorPath $null
         }
         $manifestRuntimeId = [string]$manifest.runtimeId
-        if ($manifestRuntimeId -cnotmatch '^[A-Za-z0-9._-]{1,96}$' -or $manifestRuntimeId -cne $RuntimeId) {
+        if ($manifestRuntimeId -cnotmatch'^(?<version>[A-Za-z0-9][A-Za-z0-9._-]{0,45})-(?<digest>[0-9a-f]{16})-(?<nonce>[0-9a-f]{32})$'-or$Matches.version-cne[string]$manifest.projectVersion-or $manifestRuntimeId -cne $RuntimeId) {
             return New-CcodBootstrapRuntimeValidation -Valid $false -Code 'CCOD_BOOTSTRAP_RUNTIME_ID_MISMATCH' -RuntimeDirectory $runtimeDirectory -SupervisorPath $null
         }
 
@@ -323,7 +372,8 @@ function Test-CcodBootstrapRuntime {
                 return New-CcodBootstrapRuntimeValidation -Valid $false -Code 'CCOD_BOOTSTRAP_FILE_HASH_MISMATCH' -RuntimeDirectory $runtimeDirectory -SupervisorPath $null
             }
         }
-        $computedRuntimeId = Get-CcodBootstrapRuntimeId -ProjectVersion ([string]$manifest.projectVersion) -Files $actualFiles
+        $identityMatch=[regex]::Match($manifestRuntimeId,'^(?<version>[A-Za-z0-9][A-Za-z0-9._-]{0,45})-(?<digest>[0-9a-f]{16})-(?<nonce>[0-9a-f]{32})$')
+        $computedRuntimeId = Get-CcodBootstrapRuntimeId -ProjectVersion ([string]$manifest.projectVersion) -Files $actualFiles -Nonce $identityMatch.Groups['nonce'].Value
         $requiredRuntimeFiles = @('src/persistence/Supervisor.ps1')
         if ($computedRuntimeId -cne $manifestRuntimeId -or @($requiredRuntimeFiles | Where-Object { -not $manifestPaths.Contains($_) }).Count -ne 0) {
             return New-CcodBootstrapRuntimeValidation -Valid $false -Code 'CCOD_BOOTSTRAP_RUNTIME_ID_MISMATCH' -RuntimeDirectory $runtimeDirectory -SupervisorPath $null
@@ -345,7 +395,7 @@ function Import-CcodBootstrapKernelObjects {
     )
 
     $candidates = @([string]$Pointer.ActiveRuntime)
-    if ($null -ne $Pointer.PreviousRuntime -and $Pointer.PreviousRuntime -cne $Pointer.ActiveRuntime) {
+    if ($Pointer.Selector -ceq 'Legacy' -and $null -ne $Pointer.PreviousRuntime -and $Pointer.PreviousRuntime -cne $Pointer.ActiveRuntime) {
         $candidates += [string]$Pointer.PreviousRuntime
     }
 
@@ -842,7 +892,7 @@ try {
 
     $pointer = Read-CcodBootstrapActivePointer -InstallRoot $root
     $candidates = @($pointer.ActiveRuntime)
-    if ($null -ne $pointer.PreviousRuntime -and $pointer.PreviousRuntime -cne $pointer.ActiveRuntime) {
+    if ($pointer.Selector -ceq 'Legacy' -and $null -ne $pointer.PreviousRuntime -and $pointer.PreviousRuntime -cne $pointer.ActiveRuntime) {
         $candidates += $pointer.PreviousRuntime
     }
 
@@ -868,7 +918,7 @@ try {
         $launchLease = $null
         $outcome = Wait-CcodBootstrapReady -Event $readyEvent -Process $child -TimeoutSeconds $ReadyTimeoutSeconds
         if ($outcome -ceq 'Ready') {
-            if ($runtimeId -cne $pointer.ActiveRuntime) {
+            if ($pointer.Selector -ceq 'Legacy' -and $runtimeId -cne $pointer.ActiveRuntime) {
                 $updated = Invoke-CcodBootstrapFencedPointerPromotion -InstallRoot $root -Pointer $pointer -Validation $validation -NewRuntimeId $runtimeId -UserSid $userSid -SessionId $sessionId
                 Write-CcodBootstrapLog -InstallRoot $root -Message ("Runtime {0} signaled ready; active pointer switched from {1}" -f $runtimeId, $pointer.ActiveRuntime)
             }
diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index db01be6..fe0aabf 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -15,7 +15,7 @@ $script:CcodLifecycleDefaultInstallRoot = Join-Path ([Environment]::GetFolderPat
 $script:CcodActivationReceiptFields = @('schemaVersion','activationId','phase','runtimeId','previousRuntimeId','startedAtUtc','updatedAtUtc','ready','errorCode')
 $script:CcodActivationPhases = @('StoppingPreviousRuntime','InstallingRuntime','ActivatingRuntime','StartingProtection','Ready','Failed')
 $script:CcodInstallTransactionPhases = @('Prepared','PackageVerified','RuntimeStaged','PreviousProtectionStopped','RuntimePromoted','PointerCommitted','StableShellCommitted','ProtectionReady','Ready')
-$script:CcodInstallTransactionFields = @('schemaVersion','transactionId','oldRuntimeId','oldGeneration','newRuntimeId','newGeneration','sealedPackageSha256','ownedObjectNames','phase','errorCode')
+$script:CcodInstallTransactionFields = @('schemaVersion','transactionId','oldRuntimeId','oldGeneration','oldManifestSha256','newRuntimeId','newGeneration','newManifestSha256','sealedPackageSha256','ownedObjectNames','phase','errorCode')
 $script:CcodInstallTransactionRoots = [Runtime.CompilerServices.ConditionalWeakTable[object,object]]::new()
 
 function Throw-CcodLifecycleError {
@@ -156,6 +156,8 @@ function Assert-CcodInstallTransactionRecord {
         -not (Test-CcodLifecycleCanonicalGuid $Record.transactionId) -or
         ($null -ne $Record.oldRuntimeId -and ($Record.oldRuntimeId -isnot [string] -or $Record.oldRuntimeId -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$')) -or
         ($null -ne $Record.newRuntimeId -and ($Record.newRuntimeId -isnot [string] -or $Record.newRuntimeId -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$')) -or
+        ($null-ne$Record.oldManifestSha256-and($Record.oldManifestSha256-isnot[string]-or$Record.oldManifestSha256-cnotmatch'^[0-9a-f]{64}$')) -or
+        $Record.newManifestSha256-isnot[string]-or$Record.newManifestSha256-cnotmatch'^[0-9a-f]{64}$' -or
         $Record.sealedPackageSha256 -isnot [string] -or $Record.sealedPackageSha256 -cnotmatch '^[0-9a-f]{64}$' -or
         $Record.phase -isnot [string] -or (@($script:CcodInstallTransactionPhases) + 'Failed') -cnotcontains $Record.phase -or
         (($Record.phase -ceq 'Failed') -and ($Record.errorCode -isnot [string] -or $Record.errorCode -cnotmatch '^CCOD_[A-Z0-9_]{1,96}$')) -or
@@ -171,7 +173,7 @@ function Assert-CcodInstallTransactionRecord {
         if (-not $newTypeValid -or -not $oldTypeValid) { throw 'type' }
         [uint64]$newGeneration = $Record.newGeneration
         [uint64]$oldGeneration = if ($null -eq $Record.oldGeneration) { 0 } else { $Record.oldGeneration }
-        if ($newGeneration -eq 0 -or ($null -ne $Record.oldGeneration -and $oldGeneration -eq 0) -or ($null -eq $Record.oldRuntimeId) -ne ($null -eq $Record.oldGeneration)) { throw 'generation' }
+        if ($newGeneration -eq 0 -or ($null -ne $Record.oldGeneration -and $oldGeneration -eq 0) -or ($null -eq $Record.oldRuntimeId) -ne ($null -eq $Record.oldGeneration) -or ($null-eq$Record.oldRuntimeId)-ne($null-eq$Record.oldManifestSha256)) { throw 'generation' }
     } catch {
         Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction generations are invalid' $null
     }
@@ -208,23 +210,23 @@ function Assert-CcodInstallTransactionRoot {
 function New-CcodUniqueRuntimeId {
     param(
         [Parameter(Mandatory)][string]$ProjectVersion,
-        [Parameter(Mandatory)][string]$ContentSha256,
+        [Parameter(Mandatory)][object[]]$Files,
         [scriptblock]$NewNonce = { [guid]::NewGuid().ToString('N') }
     )
     $nonce = & $NewNonce
-    if ($ProjectVersion -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$' -or
-        $ContentSha256 -cnotmatch '^[0-9a-f]{64}$' -or
+    if ($ProjectVersion -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,45}$' -or
         $nonce -isnot [string] -or $nonce -cnotmatch '^[0-9a-f]{32}$') {
         Throw-CcodLifecycleError 'CCOD_INSTALL_RUNTIME_ID_INVALID' 'Unique runtime identity input is invalid' $null
     }
-    $hasher = [Security.Cryptography.SHA256]::Create()
-    try {
-        $identityBytes = [Text.Encoding]::UTF8.GetBytes("$ProjectVersion`0$ContentSha256")
-        $identityDigest = ([BitConverter]::ToString($hasher.ComputeHash($identityBytes))).Replace('-','').ToLowerInvariant()
-    } finally {
-        $hasher.Dispose()
+    $records=[Collections.Generic.List[object]]::new()
+    foreach($file in $Files){
+        $relative=([string]$file.Relative).Replace('\','/')
+        $length=if($null-ne$file.PSObject.Properties['ExpectedLength']){[int64]$file.ExpectedLength}else{[int64](Get-Item -LiteralPath $file.Source -Force -ErrorAction Stop).Length}
+        $sha=if($null-ne$file.PSObject.Properties['ExpectedSha256']){[string]$file.ExpectedSha256}else{Get-CcodLifecycleFileSha256 -Path $file.Source}
+        $records.Add([pscustomobject]@{path=$relative;length=$length;sha256=$sha})
     }
-    return "$identityDigest-$($nonce.Substring(0,31))"
+    $comparison=[Comparison[object]]{param($left,$right)[StringComparer]::Ordinal.Compare([string]$left.path,[string]$right.path)};$records.Sort($comparison)
+    try{return Get-CcodRuntimeId -ProjectVersion $ProjectVersion -Files $records.ToArray() -Nonce $nonce}catch{Throw-CcodLifecycleError 'CCOD_INSTALL_RUNTIME_ID_INVALID' 'Unique runtime identity input is invalid' $null}
 }
 
 function New-CcodInstallTransactionRecord {
@@ -232,8 +234,10 @@ function New-CcodInstallTransactionRecord {
         [Parameter(Mandatory)][string]$TransactionId,
         [AllowNull()]$OldRuntimeId,
         [AllowNull()]$OldGeneration,
+        [AllowNull()]$OldManifestSha256,
         [AllowNull()]$NewRuntimeId,
         [Parameter(Mandatory)][uint64]$NewGeneration,
+        [Parameter(Mandatory)][string]$NewManifestSha256,
         [Parameter(Mandatory)][string]$SealedPackageSha256,
         [string[]]$OwnedObjectNames = @()
     )
@@ -242,8 +246,10 @@ function New-CcodInstallTransactionRecord {
         transactionId = $TransactionId
         oldRuntimeId = $OldRuntimeId
         oldGeneration = if ($null -eq $OldGeneration) { $null } else { [uint64]$OldGeneration }
+        oldManifestSha256 = $OldManifestSha256
         newRuntimeId = $NewRuntimeId
         newGeneration = [uint64]$NewGeneration
+        newManifestSha256 = $NewManifestSha256
         sealedPackageSha256 = $SealedPackageSha256
         ownedObjectNames = @($OwnedObjectNames)
         phase = 'Prepared'
@@ -265,6 +271,23 @@ function Get-CcodInstallTransactionDirectory {
     return New-CcodInstallDirectory -Transaction $FileTransaction -Parent $state -Leaf 'install-transactions' -CreateIfMissing
 }
 
+function Initialize-CcodInstallStatePlanes {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)]$FileTransaction,[string[]]$NodeCandidates,[bool]$CandidateCompatibleOptIn)
+    [void](Assert-CcodInstallTransactionRoot -InstallRoot $InstallRoot -FileTransaction $FileTransaction)
+    if($RuntimeId-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$'){Throw-CcodLifecycleError 'CCOD_INSTALL_RUNTIME_ID_INVALID' 'Initialization runtime identity is invalid' $RuntimeId}
+    $state=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $FileTransaction -Leaf 'state' -CreateIfMissing
+    $initializations=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $state -Leaf 'install-initializations' -CreateIfMissing
+    $baseline=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $initializations -Leaf $RuntimeId -CreateIfMissing
+    $stateRoot=Join-Path $InstallRoot 'state'
+    $values=Initialize-CcodState -StateRoot $stateRoot -NodeCandidates $NodeCandidates -CandidateCompatibleOptIn $CandidateCompatibleOptIn
+    Write-CcodInstallRecord -Transaction $FileTransaction -Parent $baseline -Leaf 'settings.json' -Record $values.settings|Out-Null
+    Write-CcodInstallRecord -Transaction $FileTransaction -Parent $baseline -Leaf 'status.json' -Record $values.status|Out-Null
+    Write-CcodInstallRecord -Transaction $FileTransaction -Parent $baseline -Leaf 'verified-packages.json' -Record $values.verifiedPackages|Out-Null
+    Write-CcodInstallRecord -Transaction $FileTransaction -Parent $baseline -Leaf 'transition.json' -Record $values.transition|Out-Null
+    $ui=Initialize-CcodUiPreference -StateRoot $stateRoot -AllowExisting
+    Write-CcodInstallRecord -Transaction $FileTransaction -Parent $baseline -Leaf 'ui-preferences.json' -Record $ui|Out-Null
+}
+
 function Write-CcodInstallTransactionRecord {
     param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$TransactionRecord,[Parameter(Mandatory)]$FileTransaction)
     [void](Assert-CcodInstallTransactionRoot -InstallRoot $InstallRoot -FileTransaction $FileTransaction)
@@ -302,8 +325,10 @@ function Read-CcodInstallTransactionRecord {
             if(-not$oldGenerationChanged-and$null-ne$head.oldGeneration){$oldGenerationChanged=[uint64]$current.oldGeneration-ne[uint64]$head.oldGeneration}
             if ([string]$current.transactionId -cne [string]$head.transactionId -or
                 [string]$current.oldRuntimeId -cne [string]$head.oldRuntimeId -or $oldGenerationChanged -or
+                [string]$current.oldManifestSha256-cne[string]$head.oldManifestSha256 -or
                 [string]$current.newRuntimeId -cne [string]$head.newRuntimeId -or
                 [uint64]$current.newGeneration -ne [uint64]$head.newGeneration -or
+                [string]$current.newManifestSha256-cne[string]$head.newManifestSha256 -or
                 [string]$current.sealedPackageSha256 -cne [string]$head.sealedPackageSha256 -or
                 (@($current.ownedObjectNames)-join"`0") -cne (@($head.ownedObjectNames)-join"`0")) {
                 Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction identity changed across snapshots' $group.Name
@@ -1119,11 +1144,12 @@ function Get-CcodLifecycleVerifiedSupervisorFallback {
         if ($null -eq $Identity -or $Identity.UserSid -isnot [string] -or [string]::IsNullOrWhiteSpace($Identity.UserSid)) { return $null }
         $expectedSessionId = [int]$Identity.SessionId
         $root = Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
-        $bootstrapPath = [IO.Path]::GetFullPath((Join-Path $root 'bootstrap.ps1'))
-        if (-not [IO.File]::Exists($bootstrapPath) -or (Test-CcodLifecycleReparse -Path $bootstrapPath)) { return $null }
         $runtimeRoot = Get-CcodLifecycleCanonicalRoot -Path (Join-Path $root 'runtime') -Kind 'Runtime root'
         $runtimePrefix = $runtimeRoot.TrimEnd([char[]]@([char]92,[char]47)) + [IO.Path]::DirectorySeparatorChar
-        $bootstrapFilePattern = '(?i)(?:^|\s)-File\s+"' + [regex]::Escape($bootstrapPath) + '"(?=\s|$)'
+        $appendOnlySelector=[IO.Directory]::Exists((Join-Path $root 'state\active-generation'))
+        $legacyBootstrapPath=[IO.Path]::GetFullPath((Join-Path $root 'bootstrap.ps1'))
+        if(-not$appendOnlySelector-and(-not[IO.File]::Exists($legacyBootstrapPath)-or(Test-CcodLifecycleReparse $legacyBootstrapPath))){return $null}
+        $bootstrapFilePattern = '(?i)(?:^|\s)-File\s+"(?<path>[^"]+)"(?=\s|$)'
         $bootstrapRootPattern = '(?i)(?:^|\s)-InstallRoot\s+"' + [regex]::Escape($root) + '"(?=\s|$)'
         $supervisorFilePattern = '(?i)(?:^|\s)-File\s+"(?<path>' + [regex]::Escape($runtimePrefix) + '[^\\/\s"]+' + [regex]::Escape('\src\persistence\Supervisor.ps1') + ')"(?=\s|$)'
         $tokenPattern = '(?i)(?:^|\s)-ReadyToken\s+[0-9a-f]{64}(?=\s|$)'
@@ -1147,9 +1173,13 @@ function Get-CcodLifecycleVerifiedSupervisorFallback {
             $parentPid = [int]$process.ParentProcessId
             if ($parentPid -lt 1 -or -not $byPid.ContainsKey($parentPid)) { continue }
             $parent = $byPid[$parentPid]
-            if ([int]$parent.SessionId -ne $expectedSessionId -or [string]::IsNullOrWhiteSpace([string]$parent.CommandLine) -or
-                -not [regex]::IsMatch([string]$parent.CommandLine, $bootstrapFilePattern) -or
-                -not [regex]::IsMatch([string]$parent.CommandLine, $bootstrapRootPattern)) { continue }
+            if ([int]$parent.SessionId -ne $expectedSessionId -or [string]::IsNullOrWhiteSpace([string]$parent.CommandLine) -or -not [regex]::IsMatch([string]$parent.CommandLine, $bootstrapRootPattern)) { continue }
+            $parentBootstrapMatch=[regex]::Match([string]$parent.CommandLine,$bootstrapFilePattern)
+            if(-not$parentBootstrapMatch.Success){continue}
+            $runtimeId=($supervisorPath.Substring($runtimePrefix.Length)-split'[\\/]')[0]
+            $expectedBootstrap=if($appendOnlySelector){[IO.Path]::GetFullPath((Join-Path (Join-Path $runtimeRoot $runtimeId) 'src\persistence\bootstrap.ps1'))}else{$legacyBootstrapPath}
+            try{$parentBootstrap=[IO.Path]::GetFullPath($parentBootstrapMatch.Groups['path'].Value)}catch{continue}
+            if($parentBootstrap-cne$expectedBootstrap-or-not[IO.File]::Exists($expectedBootstrap)-or(Test-CcodLifecycleReparse $expectedBootstrap)){continue}
             $supervisorOwner = & $OwnerSidResolver $process
             $parentOwner = & $OwnerSidResolver $parent
             if ($null -eq $supervisorOwner -or $null -eq $parentOwner -or
@@ -1819,6 +1849,10 @@ function Get-CcodLifecycleAdapters {
             param($Source, $Destination)
             Copy-CcodLifecycleFileAtomically -Source $Source -Destination $Destination
         }
+        CommitReadyTransaction = {
+            param($InstallRoot,$TransactionId,$FileTransaction)
+            Set-CcodInstallTransactionPhase -InstallRoot $InstallRoot -TransactionId $TransactionId -ExpectedPhase 'ProtectionReady' -NewPhase 'Ready' -FileTransaction $FileTransaction
+        }
         NewRuntimeManifest = {
             param($RuntimeDirectory, $ProjectVersion)
             New-CcodRuntimeManifest -RuntimeDirectory $RuntimeDirectory -ProjectVersion $ProjectVersion
@@ -1943,7 +1977,7 @@ function Wait-CcodLifecycleNewRuntimeReady {
         if (-not $validation.Valid) { return New-CcodLifecycleNotReadyProof }
         if ($null -eq $Identity -or $Identity.UserSid -isnot [string] -or $Identity.SessionId -isnot [int]) { return New-CcodLifecycleNotReadyProof }
         $supervisorPath = [IO.Path]::GetFullPath((Join-Path $runtimeRoot 'src\persistence\Supervisor.ps1'))
-        $bootstrapPath = [IO.Path]::GetFullPath((Join-Path $root 'bootstrap.ps1'))
+        $bootstrapPath = if([IO.Directory]::Exists((Join-Path $root 'state\active-generation'))){[IO.Path]::GetFullPath((Join-Path $runtimeRoot 'src\persistence\bootstrap.ps1'))}else{[IO.Path]::GetFullPath((Join-Path $root 'bootstrap.ps1'))}
         $hostPrefix = '^\s*(?:"[^"]*powershell\.exe"|[^\s"]*powershell\.exe)'
         $supervisorPattern = $hostPrefix + '\s+-NoProfile\s+-ExecutionPolicy\s+Bypass\s+-STA\s+-File\s+(?:\"(?<path>[^\"]+)\"|(?<path>[^\s]+))\s+-ReadyToken\s+(?<token>[0-9a-f]{64})\s*$'
         $bootstrapPattern = $hostPrefix + '\s+-NoProfile\s+-ExecutionPolicy\s+Bypass\s+-STA\s+-WindowStyle\s+Hidden\s+-File\s+"(?<path>[^"]+)"\s+-InstallRoot\s+"(?<root>[^"]+)"\s+-EntryMode\s+Task\s*$'
@@ -2113,7 +2147,7 @@ function Invoke-CcodInstallCompensation {
     [void](Assert-CcodInstallTransactionRoot $InstallRoot $FileTransaction);[void](Assert-CcodInstallTransactionRecord $TransactionRecord)
     if($null-eq$TransactionRecord.oldRuntimeId-or$null-eq$TransactionRecord.oldGeneration){Throw-CcodLifecycleError 'CCOD_INSTALL_ROLLBACK_FAILED' 'No retained generation exists for compensation' $null}
     $manifestPath=Join-Path (Join-Path (Join-Path $InstallRoot 'runtime') $TransactionRecord.oldRuntimeId) 'manifest.json';if(-not[IO.File]::Exists($manifestPath)){Throw-CcodLifecycleError 'CCOD_INSTALL_ROLLBACK_FAILED' 'Retained generation manifest is missing' $null}
-    $retained=Open-CcodInstallRetainedGeneration -InstallRoot $InstallRoot -RuntimeId $TransactionRecord.oldRuntimeId -ExpectedManifestSha256 (Get-CcodLifecycleFileSha256 $manifestPath) -FileTransaction $FileTransaction
+    $retained=Open-CcodInstallRetainedGeneration -InstallRoot $InstallRoot -RuntimeId $TransactionRecord.oldRuntimeId -ExpectedManifestSha256 $TransactionRecord.oldManifestSha256 -FileTransaction $FileTransaction
     $compensationOwnership=$Ownership
     if($null-eq$compensationOwnership-or$compensationOwnership.released){
         $active=Read-CcodActiveRuntime -InstallRoot $InstallRoot
@@ -2206,12 +2240,20 @@ function Invoke-CcodInstall {
     $existingPointer = $null
     $activePath = Join-Path $root 'active.json'
     try{$existingPointer=Read-CcodActiveRuntime -InstallRoot $root}catch{if([IO.File]::Exists($activePath)-or[IO.Directory]::Exists((Join-Path $root 'state\active-generation'))){throw}}
-    if($null-ne$existingPointer-and$sealedPackageIdentitySupplied){
+    $globalTransaction=Read-CcodInstallTransactionRecord -InstallRoot $root
+    if($null-ne$globalTransaction-and$globalTransaction.phase-notin@('Ready','Failed')){Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_BUSY' 'A nonterminal install transaction must be recovered before a new attempt' $globalTransaction.transactionId}
+    $oldManifestSha256=$null;$activeValidation=$null
+    if($null-ne$existingPointer){
         $activeRuntimeRoot=[IO.Path]::GetFullPath((Join-Path (Join-Path $root 'runtime') ([string]$existingPointer.activeRuntime)))
-        $activeValidation=Test-CcodRuntimeManifest -RuntimeDirectory $activeRuntimeRoot -ExpectedRuntimeId ([string]$existingPointer.activeRuntime)
+        $activeManifestPath=Join-Path $activeRuntimeRoot 'manifest.json'
+        if(-not[IO.File]::Exists($activeManifestPath)){Throw-CcodLifecycleError 'CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN' 'The active runtime manifest is missing before upgrade' $activeManifestPath}
+        $oldManifestSha256=Get-CcodLifecycleFileSha256 -Path $activeManifestPath
+        $activeValidation=Test-CcodRuntimeManifest -RuntimeDirectory $activeRuntimeRoot -ExpectedRuntimeId ([string]$existingPointer.activeRuntime) -ExpectedManifestSha256 $oldManifestSha256
+        if(-not$activeValidation.Valid){Throw-CcodLifecycleError 'CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN' 'The active runtime manifest is invalid before upgrade' $activeRuntimeRoot}
+    }
+    if($null-ne$existingPointer-and$sealedPackageIdentitySupplied){
         if($activeValidation.Valid){
-            $activeTransaction=Read-CcodInstallTransactionRecord -InstallRoot $root
-            $sameIdentity=Test-CcodInstallPackageIdentity -TransactionRecord $activeTransaction -ProjectVersion ([string]$projectVersion) -ActiveProjectVersion ([string]$activeValidation.Manifest.projectVersion) -SealedPackageSha256 $SealedPackageSha256 -ActiveRuntimeId ([string]$existingPointer.activeRuntime) -ActiveGeneration ([uint64]$existingPointer.generation)
+            $sameIdentity=Test-CcodInstallPackageIdentity -TransactionRecord $globalTransaction -ProjectVersion ([string]$projectVersion) -ActiveProjectVersion ([string]$activeValidation.Manifest.projectVersion) -SealedPackageSha256 $SealedPackageSha256 -ActiveRuntimeId ([string]$existingPointer.activeRuntime) -ActiveGeneration ([uint64]$existingPointer.generation)
             if($sameIdentity){
                 return [pscustomobject][ordered]@{Outcome='AlreadyInstalled';Installed=$true;RuntimeId=[string]$existingPointer.activeRuntime;PreviousRuntimeId=$existingPointer.previousRuntime;RepairCompleted=$false}
             }
@@ -2240,10 +2282,10 @@ function Invoke-CcodInstall {
     $shutdownGate = $null
     $lifecycleOwnership = $null
     $previousProtectionStopped = $false
-    $fileTransaction=$null;$generationCapability=$null;$installRecord=$null
+    $fileTransaction=$null;$generationCapability=$null;$installRecord=$null;$readyReceiptCommitted=$false
     try {
-        $runtimeId=New-CcodUniqueRuntimeId -ProjectVersion $projectVersion -ContentSha256 $SealedPackageSha256;$generation=New-CcodLifecycleImmutableGeneration -InstallRoot $root -RuntimeId $runtimeId -ProjectVersion $projectVersion -Files $files;$fileTransaction=$generation.FileTransaction;$generationCapability=$generation.Generation;$runtimeRoot=$generation.RuntimeRoot;$runtimeCreated=$true
-        $newGeneration=if($null-eq$existingPointer){[uint64]1}else{[uint64]$existingPointer.generation+1};$installRecord=New-CcodInstallTransactionRecord -TransactionId ([guid]::NewGuid().ToString('D')) -OldRuntimeId $(if($upgrade){$existingPointer.activeRuntime}else{$null}) -OldGeneration $(if($upgrade){$existingPointer.generation}else{$null}) -NewRuntimeId $runtimeId -NewGeneration $newGeneration -SealedPackageSha256 $SealedPackageSha256 -OwnedObjectNames @($runtimeId)
+        $runtimeId=New-CcodUniqueRuntimeId -ProjectVersion $projectVersion -Files $files;$generation=New-CcodLifecycleImmutableGeneration -InstallRoot $root -RuntimeId $runtimeId -ProjectVersion $projectVersion -Files $files;$fileTransaction=$generation.FileTransaction;$generationCapability=$generation.Generation;$runtimeRoot=$generation.RuntimeRoot;$runtimeCreated=$true
+        $newGeneration=if($null-eq$existingPointer){[uint64]1}else{[uint64]$existingPointer.generation+1};$installRecord=New-CcodInstallTransactionRecord -TransactionId ([guid]::NewGuid().ToString('D')) -OldRuntimeId $(if($upgrade){$existingPointer.activeRuntime}else{$null}) -OldGeneration $(if($upgrade){$existingPointer.generation}else{$null}) -OldManifestSha256 $oldManifestSha256 -NewRuntimeId $runtimeId -NewGeneration $newGeneration -NewManifestSha256 $generation.ManifestSha256 -SealedPackageSha256 $SealedPackageSha256 -OwnedObjectNames @($runtimeId)
         Write-CcodInstallTransactionRecord -InstallRoot $root -TransactionRecord $installRecord -FileTransaction $fileTransaction|Out-Null
         foreach($phase in @('PackageVerified','RuntimeStaged')){$installRecord=Set-CcodInstallTransactionPhase -InstallRoot $root -TransactionId $installRecord.transactionId -ExpectedPhase $installRecord.phase -NewPhase $phase -FileTransaction $fileTransaction}
         if ($upgrade) {
@@ -2279,11 +2321,7 @@ function Invoke-CcodInstall {
 
         Write-CcodInstallActivationPhase -Activation $activation -Phase 'InstallingRuntime' -RuntimeId $runtimeId -PreviousRuntimeId $(if ($upgrade) { [string]$existingPointer.activeRuntime } else { $null }) -ErrorCode $null -Adapters $adapters -InstallRoot $root -FileTransaction $fileTransaction | Out-Null
         $installRecord=Set-CcodInstallTransactionPhase -InstallRoot $root -TransactionId $installRecord.transactionId -ExpectedPhase 'PreviousProtectionStopped' -NewPhase 'RuntimePromoted' -FileTransaction $fileTransaction
-        if (-not $upgrade) {
-            $stateRoot = Join-Path $root 'state'
-            Initialize-CcodState -StateRoot $stateRoot -NodeCandidates $nodeCandidates -CandidateCompatibleOptIn ([bool]$EnableCandidateCompatibleUpdates) -FileTransaction $fileTransaction -InitializationId $runtimeId
-            Initialize-CcodUiPreference -StateRoot $stateRoot -FileTransaction $fileTransaction -InitializationId $runtimeId | Out-Null
-        }
+        Initialize-CcodInstallStatePlanes -InstallRoot $root -RuntimeId $runtimeId -FileTransaction $fileTransaction -NodeCandidates $nodeCandidates -CandidateCompatibleOptIn ([bool]$EnableCandidateCompatibleUpdates)
         Write-CcodInstallActivationPhase -Activation $activation -Phase 'ActivatingRuntime' -RuntimeId $runtimeId -PreviousRuntimeId $(if ($upgrade) { [string]$existingPointer.activeRuntime } else { $null }) -ErrorCode $null -Adapters $adapters -InstallRoot $root -FileTransaction $fileTransaction | Out-Null
         $process = [Diagnostics.Process]::GetCurrentProcess()
         try {
@@ -2330,14 +2368,15 @@ function Invoke-CcodInstall {
         }
         $installRecord=Set-CcodInstallTransactionPhase -InstallRoot $root -TransactionId $installRecord.transactionId -ExpectedPhase 'StableShellCommitted' -NewPhase 'ProtectionReady' -FileTransaction $fileTransaction
         $finalPointer = Read-CcodActiveRuntime -InstallRoot $root
-        $finalValidation = Test-CcodRuntimeManifest -RuntimeDirectory $runtimeRoot -ExpectedRuntimeId $runtimeId
+        $finalValidation = Test-CcodRuntimeManifest -RuntimeDirectory $runtimeRoot -ExpectedRuntimeId $runtimeId -ExpectedManifestSha256 $installRecord.newManifestSha256
         $finalExpectedVersion = if ($payloadBound) { $ExpectedVersion } else { [string]$projectVersion }
         if ($finalPointer.activeRuntime -cne $runtimeId -or [UInt64]$finalPointer.generation -ne [UInt64]$pointer.generation -or
             -not $finalValidation.Valid -or [string]$finalValidation.Manifest.projectVersion -cne $finalExpectedVersion) {
             Throw-CcodLifecycleError 'CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN' 'The final active pointer and runtime version could not be revalidated' $runtimeRoot
         }
         Write-CcodInstallActivationPhase -Activation $activation -Phase 'Ready' -RuntimeId $runtimeId -PreviousRuntimeId $pointer.previousRuntime -ErrorCode $null -Adapters $adapters -InstallRoot $root -FileTransaction $fileTransaction | Out-Null
-        $installRecord=Set-CcodInstallTransactionPhase -InstallRoot $root -TransactionId $installRecord.transactionId -ExpectedPhase 'ProtectionReady' -NewPhase 'Ready' -FileTransaction $fileTransaction
+        $readyReceiptCommitted=$true
+        $installRecord=&$adapters.CommitReadyTransaction $root $installRecord.transactionId $fileTransaction
         try {
             Write-CcodLifecycleLog -InstallRoot $root -Adapters $adapters -Stage $(if ($upgrade) { 'Upgrade' } else { 'Install' }) -Code 'CCOD_INSTALL_COMPLETED' -Outcome $(if ($upgrade) { 'Upgraded' } else { 'Installed' }) -ThrowOnFailure -FileTransaction $fileTransaction
         } catch {
@@ -2346,6 +2385,7 @@ function Invoke-CcodInstall {
     } catch {
         $caught = $_
         $errorCode = Get-CcodLifecycleErrorId $caught
+        if($readyReceiptCommitted){Throw-CcodLifecycleError 'CCOD_INSTALL_READY_FINALIZATION_PENDING' 'Ready activation is visible but the final transaction snapshot requires recovery' $installRecord.transactionId}
         if ($errorCode -notmatch '^CCOD_[A-Z0-9_]+$') {
             $errorCode = switch ([string]$activation.LastPhase) {
                 'StoppingPreviousRuntime' { 'CCOD_INSTALL_PREVIOUS_RUNTIME_BUSY' }
diff --git a/src/persistence/modules/RuntimeManifest.psm1 b/src/persistence/modules/RuntimeManifest.psm1
index a422aa9..947a665 100644
--- a/src/persistence/modules/RuntimeManifest.psm1
+++ b/src/persistence/modules/RuntimeManifest.psm1
@@ -175,9 +175,14 @@ function Get-CcodRuntimeId {
     [CmdletBinding()]
     param(
         [Parameter(Mandatory)][string]$ProjectVersion,
-        [Parameter(Mandatory)][object[]]$Files
+        [Parameter(Mandatory)][object[]]$Files,
+        [string]$Nonce = ([guid]::NewGuid().ToString('N'))
     )
 
+    if($ProjectVersion-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,45}$'-or$Nonce-cnotmatch'^[0-9a-f]{32}$'){
+        Throw-CcodRuntimeError 'CCOD_RUNTIME_ID_INVALID' 'Runtime identity components are invalid' $ProjectVersion
+    }
+
     $lines = [System.Collections.Generic.List[string]]::new()
     foreach ($file in $Files) {
         $lines.Add(('{0}`t{1}`t{2}' -f [string]$file.path, [int64]$file.length, [string]$file.sha256))
@@ -189,7 +194,13 @@ function Get-CcodRuntimeId {
     } finally {
         $sha256.Dispose()
     }
-    return Assert-CcodRuntimeId -RuntimeId ('{0}-{1}' -f $ProjectVersion, $digest.Substring(0, 16))
+    return Assert-CcodRuntimeId -RuntimeId ('{0}-{1}-{2}' -f $ProjectVersion, $digest.Substring(0, 16), $Nonce)
+}
+
+function Test-CcodRuntimeIdBinding {
+    param([Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)][string]$ProjectVersion,[Parameter(Mandatory)][object[]]$Files)
+    if($RuntimeId-cnotmatch'^(?<version>[A-Za-z0-9][A-Za-z0-9._-]{0,45})-(?<digest>[0-9a-f]{16})-(?<nonce>[0-9a-f]{32})$'-or$Matches.version-cne$ProjectVersion){return $false}
+    return (Get-CcodRuntimeId -ProjectVersion $ProjectVersion -Files $Files -Nonce $Matches.nonce)-ceq$RuntimeId
 }
 
 function New-CcodRuntimeManifest {
@@ -204,7 +215,7 @@ function New-CcodRuntimeManifest {
     return [pscustomobject][ordered]@{
         schemaVersion = 1
         projectVersion = $ProjectVersion
-        runtimeId = if ([string]::IsNullOrWhiteSpace($RuntimeId)) { Get-CcodRuntimeId -ProjectVersion $ProjectVersion -Files $files } else { Assert-CcodRuntimeId $RuntimeId }
+        runtimeId = if ([string]::IsNullOrWhiteSpace($RuntimeId)) { Get-CcodRuntimeId -ProjectVersion $ProjectVersion -Files $files } elseif(Test-CcodRuntimeIdBinding -RuntimeId (Assert-CcodRuntimeId $RuntimeId) -ProjectVersion $ProjectVersion -Files $files){$RuntimeId}else{Throw-CcodRuntimeError 'CCOD_RUNTIME_ID_MISMATCH' 'Runtime ID is not bound to the manifest file set and project version' $RuntimeId}
         files = $files
     }
 }
@@ -229,7 +240,8 @@ function Test-CcodRuntimeManifest {
     [CmdletBinding()]
     param(
         [Parameter(Mandatory)][string]$RuntimeDirectory,
-        [Parameter(Mandatory)][string]$ExpectedRuntimeId
+        [Parameter(Mandatory)][string]$ExpectedRuntimeId,
+        [string]$ExpectedManifestSha256
     )
 
     Assert-CcodRuntimeId -RuntimeId $ExpectedRuntimeId | Out-Null
@@ -242,6 +254,9 @@ function Test-CcodRuntimeManifest {
     if (-not [IO.File]::Exists($manifestPath)) {
         return New-CcodRuntimeValidationResult -Valid $false -Code 'CCOD_RUNTIME_MANIFEST_MISSING' -RuntimeId $ExpectedRuntimeId -Manifest $null
     }
+    if(-not[string]::IsNullOrWhiteSpace($ExpectedManifestSha256)){
+        if($ExpectedManifestSha256-cnotmatch'^[0-9a-f]{64}$'-or(Get-CcodRuntimeFileSha256 -Path $manifestPath)-cne$ExpectedManifestSha256){return New-CcodRuntimeValidationResult -Valid $false -Code 'CCOD_RUNTIME_MANIFEST_HASH_MISMATCH' -RuntimeId $ExpectedRuntimeId -Manifest $null}
+    }
 
     try {
         $manifest = Read-CcodStrictJson -Path $manifestPath -ExpectedSchema 1 -Kind 'runtime manifest'
@@ -310,6 +325,9 @@ function Test-CcodRuntimeManifest {
         }
     }
 
+    if(-not(Test-CcodRuntimeIdBinding -RuntimeId $manifestRuntimeId -ProjectVersion ([string]$projectVersionProperty.Value) -Files $actualFiles)){
+        return New-CcodRuntimeValidationResult -Valid $false -Code 'CCOD_RUNTIME_ID_MISMATCH' -RuntimeId $manifestRuntimeId -Manifest $manifest
+    }
     return New-CcodRuntimeValidationResult -Valid $true -Code 'CCOD_RUNTIME_VALID' -RuntimeId $manifestRuntimeId -Manifest $manifest
 }
 
@@ -323,6 +341,20 @@ function Get-CcodRuntimeDirectoryForId {
     return Resolve-CcodContainedPath -Root $InstallRoot -RelativePath (Join-Path 'runtime' $RuntimeId) -AllowMissingLeaf
 }
 
+function Assert-CcodRuntimePointerFile {
+    param([Parameter(Mandatory)][string]$Path)
+    try{
+        $item=Get-Item -LiteralPath $Path -Force -ErrorAction Stop
+        if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){throw 'not plain'}
+        $streams=@(Get-Item -LiteralPath $Path -Stream * -ErrorAction Stop);if($streams.Count-ne1-or[string]$streams[0].Stream-cne':$DATA'){throw 'stream'}
+        if($null-eq('CcodRuntimePointerIdentity' -as[type])){Add-Type -TypeDefinition @'
+using System; using System.ComponentModel; using System.IO; using System.Runtime.InteropServices; using Microsoft.Win32.SafeHandles;
+public static class CcodRuntimePointerIdentity { [StructLayout(LayoutKind.Sequential)] struct Info { public uint A; public System.Runtime.InteropServices.ComTypes.FILETIME C,X,W; public uint V,H,L,N,Ih,Il; } [DllImport("kernel32.dll",SetLastError=true)] static extern bool GetFileInformationByHandle(SafeFileHandle h,out Info i); public static uint Links(string p){using(FileStream s=new FileStream(p,FileMode.Open,FileAccess.Read,FileShare.Read)){Info i;if(!GetFileInformationByHandle(s.SafeFileHandle,out i))throw new Win32Exception(Marshal.GetLastWin32Error());return i.N;}} }
+'@}
+        if([CcodRuntimePointerIdentity]::Links($Path)-ne1){throw 'links'}
+    }catch{Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation selector is not a plain single-link file' $Path}
+}
+
 function Read-CcodActiveRuntime {
     [CmdletBinding()]
     param([Parameter(Mandatory)][string]$InstallRoot)
@@ -334,6 +366,7 @@ function Read-CcodActiveRuntime {
         $records=[Collections.Generic.List[object]]::new()
         foreach($entry in $entries){
             if($entry.PSIsContainer-or($entry.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0-or$entry.Name-cnotmatch'^\d{20}\.json$'){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation store contains an unknown object' $entry.FullName}
+            Assert-CcodRuntimePointerFile -Path $entry.FullName
             $record=Read-CcodStrictJson -Path $entry.FullName -ExpectedSchema 1 -Kind 'active generation'
             $names=@($record.PSObject.Properties.Name);if(($names-join',')-cne'schemaVersion,generation,activeRuntime,previousGeneration'-or$record.activeRuntime-isnot[string]){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation record fields are invalid' $entry.FullName}
             $generation=ConvertTo-CcodRuntimeGeneration $record.generation $entry.FullName
diff --git a/src/persistence/modules/StateStore.psm1 b/src/persistence/modules/StateStore.psm1
index 74aeb58..aed4eb4 100644
--- a/src/persistence/modules/StateStore.psm1
+++ b/src/persistence/modules/StateStore.psm1
@@ -399,9 +399,7 @@ function Initialize-CcodState {
         [Parameter(Mandatory)][string]$StateRoot,
         [string[]]$NodeCandidates = @(),
         [bool]$CandidateCompatibleOptIn = $false,
-        [hashtable]$Adapters,
-        $FileTransaction,
-        [string]$InitializationId
+        [hashtable]$Adapters
     )
 
     $adapters = Get-CcodStateAdapters -Adapters $Adapters
@@ -415,7 +413,7 @@ function Initialize-CcodState {
     if (-not (& $adapters.DirectoryExists $receiptRoot)) { & $adapters.CreateDirectory $receiptRoot }
     Read-CcodLifecycleRequest -StateRoot $StateRoot | Out-Null
     if ($existing.Count -eq $paths.Count) {
-        return
+        return [pscustomobject][ordered]@{settings=(Read-CcodSettings -StateRoot $StateRoot -Adapters $adapters);status=(Read-CcodStatus -StateRoot $StateRoot -Adapters $adapters);verifiedPackages=(Read-CcodVerifiedPackages -StateRoot $StateRoot -Adapters $adapters);transition=(Read-CcodTypedState -StateRoot $StateRoot -Leaf 'transition.json' -Kind 'transition' -Validator ${function:Assert-CcodTransitionShape} -Adapters $adapters)}
     }
     if ($existing.Count -ne 0) {
         Throw-CcodStateError 'CCOD_STATE_ALREADY_INITIALIZED' 'State initialization refuses to overwrite existing evidence; use explicit repair' $StateRoot
@@ -425,21 +423,11 @@ function Initialize-CcodState {
     $status = New-CcodStatusStore
     $verifiedPackages = New-CcodVerifiedPackagesStore
     $transition = New-CcodTransitionStore
-    if($null-ne$FileTransaction){
-      if($null-eq(Get-Command New-CcodInstallDirectory -ErrorAction SilentlyContinue)){Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop}
-      if($InitializationId-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$'){Throw-CcodStateError 'CCOD_STATE_INITIALIZATION_INVALID' 'Immutable initialization identity is invalid' $InitializationId}
-      $state=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $FileTransaction -Leaf 'state' -CreateIfMissing
-      $initializations=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $state -Leaf 'install-initializations' -CreateIfMissing
-      $baseline=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $initializations -Leaf $InitializationId -CreateIfMissing
-      Write-CcodInstallRecord -Transaction $FileTransaction -Parent $baseline -Leaf 'settings.json' -Record $settings|Out-Null
-      Write-CcodInstallRecord -Transaction $FileTransaction -Parent $baseline -Leaf 'status.json' -Record $status|Out-Null
-      Write-CcodInstallRecord -Transaction $FileTransaction -Parent $baseline -Leaf 'verified-packages.json' -Record $verifiedPackages|Out-Null
-      Write-CcodInstallRecord -Transaction $FileTransaction -Parent $baseline -Leaf 'transition.json' -Record $transition|Out-Null
-    }
     Write-CcodSettings -StateRoot $StateRoot -Settings $settings -Adapters $adapters
     Write-CcodTypedState -StateRoot $StateRoot -Leaf 'status.json' -Value $status -Validator ${function:Assert-CcodStatusShape} -Adapters $adapters
     Write-CcodVerifiedPackages -StateRoot $StateRoot -VerifiedPackages $verifiedPackages -Adapters $adapters
     Write-CcodTypedState -StateRoot $StateRoot -Leaf 'transition.json' -Value $transition -Validator ${function:Assert-CcodTransitionShape} -Adapters $adapters
+    return [pscustomobject][ordered]@{settings=$settings;status=$status;verifiedPackages=$verifiedPackages;transition=$transition}
 }
 
 function Read-CcodSettings {
diff --git a/src/persistence/modules/UiPreferences.psm1 b/src/persistence/modules/UiPreferences.psm1
index 76e2a10..ef50231 100644
--- a/src/persistence/modules/UiPreferences.psm1
+++ b/src/persistence/modules/UiPreferences.psm1
@@ -100,19 +100,16 @@ function Get-CcodUiPreferenceTimestamp {
 
 function Initialize-CcodUiPreference {
     [CmdletBinding()]
-    param([Parameter(Mandatory)][string]$StateRoot,$FileTransaction,[string]$InitializationId)
+    param([Parameter(Mandatory)][string]$StateRoot,[switch]$AllowExisting)
 
     $path = Resolve-CcodContainedPath -Root $StateRoot -RelativePath 'ui-preferences.json' -AllowMissingLeaf
+    if([IO.File]::Exists($path)){
+        if(-not$AllowExisting){Throw-CcodUiPreferenceError 'CCOD_UI_PREFERENCES_EXISTS' 'UI preferences already exist.' $path}
+        $existing=Read-CcodStrictJson -Path $path -ExpectedSchema 1 -Kind 'UI preferences';Assert-CcodUiPreferenceStore -Store $existing
+        return $existing
+    }
     $store = New-CcodUiPreferenceStore -LanguageMode 'System' -UpdatedAtUtc (Get-CcodUiPreferenceTimestamp -Adapters (Get-CcodUiPreferenceAdapters))
     Assert-CcodUiPreferenceStore -Store $store
-    if($null-ne$FileTransaction){
-        if($null-eq(Get-Command New-CcodInstallDirectory -ErrorAction SilentlyContinue)){Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop}
-        if($InitializationId-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$'){Throw-CcodUiPreferenceError 'CCOD_UI_PREFERENCES_INVALID' 'Immutable initialization identity is invalid.' $InitializationId}
-        $state=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $FileTransaction -Leaf 'state' -CreateIfMissing
-        $initializations=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $state -Leaf 'install-initializations' -CreateIfMissing
-        $baseline=New-CcodInstallDirectory -Transaction $FileTransaction -Parent $initializations -Leaf $InitializationId -CreateIfMissing
-        try{Write-CcodInstallRecord -Transaction $FileTransaction -Parent $baseline -Leaf 'ui-preferences.json' -Record $store|Out-Null}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_RECORD_EXISTS*'){Throw-CcodUiPreferenceError 'CCOD_UI_PREFERENCES_EXISTS' 'UI preference baseline already exists.' $path};throw}
-    }
     try {
         Write-CcodAtomicJsonIfAbsent -Path $path -Value $store
     } catch {
@@ -121,6 +118,7 @@ function Initialize-CcodUiPreference {
         }
         throw
     }
+    return $store
 }
 
 function Read-CcodUiPreference {
diff --git a/tests/persistence/Bootstrap.SelfTest.ps1 b/tests/persistence/Bootstrap.SelfTest.ps1
index d8473b4..463dc13 100644
--- a/tests/persistence/Bootstrap.SelfTest.ps1
+++ b/tests/persistence/Bootstrap.SelfTest.ps1
@@ -114,7 +114,8 @@ function Add-CcodTestRuntime {
         [Parameter(Mandatory)][string]$SupervisorScript,
         [AllowNull()][string]$RuntimeId,
         [bool]$IncludeFenceModules = $true,
-        [bool]$FailLifecycleRelease = $false
+        [bool]$FailLifecycleRelease = $false,
+        [bool]$IncludeGenerationBootstrap = $false
     )
 
     if ([string]::IsNullOrWhiteSpace($RuntimeId)) {
@@ -131,6 +132,7 @@ function Add-CcodTestRuntime {
     New-Item -ItemType Directory -Path $kernelDirectory -Force | Out-Null
     $kernelPath = Join-Path $kernelDirectory 'KernelObjects.psm1'
     [IO.File]::Copy($kernelObjectsModule, $kernelPath, $true)
+    if($IncludeGenerationBootstrap){[IO.File]::Copy($bootstrapScript,(Join-Path $supervisorDirectory 'bootstrap.ps1'),$true)}
     if ($IncludeFenceModules) {
         foreach ($moduleName in @('PersistenceIO.psm1','LifecycleEpoch.psm1','LifecycleTransaction.psm1','RuntimeManifest.psm1','TrustedLogonIdentity.psm1')) {
             [IO.File]::Copy((Join-Path $repositoryRoot ('src\persistence\modules\' + $moduleName)), (Join-Path $kernelDirectory $moduleName), $true)
@@ -200,15 +202,23 @@ function Read-CcodTestActivePointer {
     return (Get-Content -LiteralPath (Join-Path $Root 'active.json') -Raw | ConvertFrom-Json)
 }
 
+function Set-CcodTestActiveGenerationPointer {
+    param([Parameter(Mandatory)][string]$Root,[Parameter(Mandatory)][string]$ActiveRuntime,[UInt64]$Generation=1)
+    $pointerRoot=Join-Path $Root 'state\active-generation';[IO.Directory]::CreateDirectory($pointerRoot)|Out-Null
+    $record=[pscustomobject][ordered]@{schemaVersion=1;generation=$Generation;activeRuntime=$ActiveRuntime;previousGeneration=($Generation-1)}
+    [IO.File]::WriteAllText((Join-Path $pointerRoot ('{0:D20}.json'-f$Generation)),($record|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
+}
+
 function Invoke-CcodBootstrapUnderTest {
     param(
         [Parameter(Mandatory)][string]$Root,
         [Parameter(Mandatory)][string]$ReadyToken,
         [int]$ReadyTimeoutSeconds = 3,
-        [ValidateSet('Task','Explicit')][string]$EntryMode = 'Explicit'
+        [ValidateSet('Task','Explicit')][string]$EntryMode = 'Explicit',
+        [string]$BootstrapPath = $bootstrapScript
     )
 
-    $output = & $powershellExecutable -NoProfile -ExecutionPolicy Bypass -File $bootstrapScript `
+    $output = & $powershellExecutable -NoProfile -ExecutionPolicy Bypass -File $BootstrapPath `
         -InstallRoot $Root -ReadyToken $ReadyToken -ReadyTimeoutSeconds $ReadyTimeoutSeconds -EntryMode $EntryMode 2>&1
     $exitCode = [int]$LASTEXITCODE
     return $exitCode
@@ -328,6 +338,24 @@ $results += Invoke-CcodTest 'production suppression caller fails closed for unsa
 }
 
 
+$results += Invoke-CcodTest 'bootstrap append-only selector rejects unknown reparse ADS and multi-linked leaves' {
+    foreach($kind in @('unknown','reparse','ads','multilink')){$root=Join-Path ([IO.Path]::GetTempPath()) ("ccod-bootstrap-pointer-$kind-"+[guid]::NewGuid().ToString('N'));$outside=Join-Path ([IO.Path]::GetTempPath()) ("ccod-bootstrap-pointer-outside-$kind-"+[guid]::NewGuid().ToString('N'));try{New-CcodBootstrapFixture -Root $root|Out-Null;[IO.Directory]::CreateDirectory($outside)|Out-Null;$pointerRoot=Join-Path $root 'state\active-generation';[IO.Directory]::CreateDirectory($pointerRoot)|Out-Null;$path=Join-Path $pointerRoot '00000000000000000001.json';$id='2.5.22-1111111111111111-22222222222222222222222222222222';$json='{"schemaVersion":1,"generation":1,"activeRuntime":"'+$id+'","previousGeneration":0}';if($kind-ceq'unknown'){[IO.File]::WriteAllText((Join-Path $pointerRoot 'unknown.bin'),'x',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'reparse'){New-Item -ItemType Junction -Path $path -Target $outside|Out-Null}elseif($kind-ceq'ads'){[IO.File]::WriteAllText($path,$json,[Text.UTF8Encoding]::new($false));Set-Content -LiteralPath $path -Stream evidence -Value x -NoNewline}else{$outsideFile=Join-Path $outside 'pointer.json';[IO.File]::WriteAllText($outsideFile,$json,[Text.UTF8Encoding]::new($false));New-Item -ItemType HardLink -Path $path -Target $outsideFile|Out-Null};Assert-CcodThrows {Read-CcodBootstrapActivePointer -InstallRoot $root|Out-Null} 'CCOD_BOOTSTRAP_POINTER_INVALID'}finally{if(Test-Path $root){Remove-Item $root -Recurse -Force};if(Test-Path $outside){Remove-Item $outside -Recurse -Force}}}
+}
+
+$results += Invoke-CcodTest 'generation bootstrap launches the append-only selected runtime without root active json' {
+    $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-bootstrap-generation-'+[guid]::NewGuid().ToString('N'))
+    try{
+        New-CcodBootstrapFixture -Root $root|Out-Null
+        $marker=Join-Path $root 'generation.started'
+        $runtimeId=Add-CcodTestRuntime -Root $root -SupervisorScript (New-CcodTestSupervisorScript -Kind 'Ready' -MarkerPath $marker) -IncludeGenerationBootstrap $true
+        Set-CcodTestActiveGenerationPointer -Root $root -ActiveRuntime $runtimeId
+        $generationBootstrap=Join-Path $root "runtime\$runtimeId\src\persistence\bootstrap.ps1"
+        Assert-CcodExactEqual $false (Test-Path -LiteralPath (Join-Path $root 'active.json')) 'fresh append-only fixture has no root active json'
+        Assert-CcodExactEqual 0 (Invoke-CcodBootstrapUnderTest -Root $root -ReadyToken (New-CcodBootstrapToken) -EntryMode Task -BootstrapPath $generationBootstrap) 'generation bootstrap launches selected Supervisor'
+        Assert-CcodTrue (Test-Path -LiteralPath $marker) 'selected generation Supervisor actually starts and signals ready'
+    }finally{if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force}}
+}
+
 $results += Invoke-CcodTest 'selects previous runtime after active exits before ready and swaps pointer' {
     $root = Join-Path ([IO.Path]::GetTempPath()) ("ccod-bootstrap-" + [guid]::NewGuid().ToString('N'))
     try {
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index 6dbbb54..d261bcb 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -409,7 +409,7 @@ $results += Invoke-CcodTest 'immutable install records advance only through cano
     try {
         $record = & $module {
             param($Id,$PackageHash)
-            New-CcodInstallTransactionRecord -TransactionId $Id -OldRuntimeId 'runtime-old' -OldGeneration ([uint64]7) -NewRuntimeId 'runtime-new' -NewGeneration ([uint64]8) -SealedPackageSha256 $PackageHash -OwnedObjectNames @('runtime-new','bootstrap.ps1','Uninstall-CodexControlOtherDevices.ps1')
+            New-CcodInstallTransactionRecord -TransactionId $Id -OldRuntimeId 'runtime-old' -OldGeneration ([uint64]7) -OldManifestSha256 ('1'*64) -NewRuntimeId 'runtime-new' -NewGeneration ([uint64]8) -NewManifestSha256 ('2'*64) -SealedPackageSha256 $PackageHash -OwnedObjectNames @('runtime-new','bootstrap.ps1','Uninstall-CodexControlOtherDevices.ps1')
         } $transactionId $packageSha256
         Assert-CcodEqual 'Prepared' $record.phase 'new immutable transaction begins Prepared'
         Assert-CcodEqual $null $record.errorCode 'nonterminal immutable transaction has no error code'
@@ -433,7 +433,7 @@ $results += Invoke-CcodTest 'same-version immutable install identity is idempote
     $module = Get-Module -Name InstallLifecycle -ErrorAction Stop
     $existing = [pscustomobject][ordered]@{
         schemaVersion=1;transactionId='11111111-2222-3333-4444-555555555555';oldRuntimeId='runtime-old';oldGeneration=[uint64]7
-        newRuntimeId='runtime-new';newGeneration=[uint64]8;sealedPackageSha256=('b'*64);ownedObjectNames=@('runtime-new');phase='Ready';errorCode=$null
+        oldManifestSha256=('1'*64);newRuntimeId='runtime-new';newGeneration=[uint64]8;newManifestSha256=('2'*64);sealedPackageSha256=('b'*64);ownedObjectNames=@('runtime-new');phase='Ready';errorCode=$null
     }
     $same = & $module { param($Record,$Hash) Test-CcodInstallPackageIdentity -TransactionRecord $Record -ProjectVersion '2.5.22' -ActiveProjectVersion '2.5.22' -SealedPackageSha256 $Hash -ActiveRuntimeId 'runtime-new' -ActiveGeneration 8 } $existing ('b'*64)
     Assert-CcodEqual $true $same 'same version and same package hash is idempotent'
@@ -483,37 +483,54 @@ $results += Invoke-CcodTest 'missing sealed package identity never enables idemp
     }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}}
 }
 
-$results += Invoke-CcodTest 'unique immutable runtime ids bind project and sealed content identity while preserving per-attempt uniqueness' {
+$results += Invoke-CcodTest 'unique immutable runtime ids bind project and manifest file identity while preserving per-attempt uniqueness' {
     $module=Get-Module InstallLifecycle -ErrorAction Stop
-    $first=&$module { New-CcodUniqueRuntimeId -ProjectVersion '2.5.22' -ContentSha256 ('a'*64) -NewNonce { '1'*32 } }
-    $second=&$module { New-CcodUniqueRuntimeId -ProjectVersion '2.5.22' -ContentSha256 ('a'*64) -NewNonce { '2'*32 } }
-    $differentContent=&$module { New-CcodUniqueRuntimeId -ProjectVersion '2.5.22' -ContentSha256 ('b'*64) -NewNonce { '1'*32 } }
-    $differentVersion=&$module { New-CcodUniqueRuntimeId -ProjectVersion '2.5.23' -ContentSha256 ('a'*64) -NewNonce { '1'*32 } }
-    Assert-CcodEqual 'af45134e2aa385355392e1e45369c3ae41520cc99278076626aeeca7bfde0356-1111111111111111111111111111111' $first 'runtime id contains the full deterministic project/package digest and a canonical attempt nonce'
-    Assert-CcodEqual 96 $first.Length 'runtime id remains within the manifest identity bound'
+    $filesA=@([pscustomobject]@{Relative='a.txt';ExpectedLength=[int64]1;ExpectedSha256=('a'*64);Source='unused'})
+    $filesB=@([pscustomobject]@{Relative='a.txt';ExpectedLength=[int64]1;ExpectedSha256=('b'*64);Source='unused'})
+    $first=&$module {param($Files)New-CcodUniqueRuntimeId -ProjectVersion '2.5.22' -Files $Files -NewNonce { '1'*32 }} $filesA
+    $second=&$module {param($Files)New-CcodUniqueRuntimeId -ProjectVersion '2.5.22' -Files $Files -NewNonce { '2'*32 }} $filesA
+    $differentContent=&$module {param($Files)New-CcodUniqueRuntimeId -ProjectVersion '2.5.22' -Files $Files -NewNonce { '1'*32 }} $filesB
+    $differentVersion=&$module {param($Files)New-CcodUniqueRuntimeId -ProjectVersion '2.5.23' -Files $Files -NewNonce { '1'*32 }} $filesA
+    Assert-CcodEqual '2.5.22-a1c6387570c23404-11111111111111111111111111111111' $first 'runtime id contains project version, manifest file digest, and canonical nonce'
+    Assert-CcodTrue ($first.Length-le96) 'runtime id remains within the manifest identity bound'
     Assert-CcodTrue ($first-cne$second) 'identical package content receives a unique generation id per attempt'
-    Assert-CcodTrue ($first-cne$differentContent) 'sealed package content changes the deterministic runtime identity'
+    Assert-CcodTrue ($first-cne$differentContent) 'manifest file content changes the deterministic runtime identity'
     Assert-CcodTrue ($first-cne$differentVersion) 'project version changes the deterministic runtime identity'
-    Assert-CcodThrows { &$module { New-CcodUniqueRuntimeId -ProjectVersion '2.5.22' -ContentSha256 ('a'*64) -NewNonce { 'not-a-guid' } } } 'CCOD_INSTALL_RUNTIME_ID_INVALID'
-    Assert-CcodThrows { &$module { New-CcodUniqueRuntimeId -ProjectVersion '2.5.22' -ContentSha256 ('A'*64) -NewNonce { '1'*32 } } } 'CCOD_INSTALL_RUNTIME_ID_INVALID'
+    Assert-CcodThrows { &$module {param($Files)New-CcodUniqueRuntimeId -ProjectVersion '2.5.22' -Files $Files -NewNonce { 'not-a-guid' }} $filesA } 'CCOD_INSTALL_RUNTIME_ID_INVALID'
 }
 
 $results += Invoke-CcodTest 'immutable record helpers reject a cross-root transaction before creating state' {
     $a=New-CcodLifecycleTempRoot;$b=New-CcodLifecycleTempRoot;[IO.Directory]::CreateDirectory($a)|Out-Null;[IO.Directory]::CreateDirectory($b)|Out-Null
     $module=Get-Module InstallLifecycle -ErrorAction Stop;$tx=&$module {param($Root)Open-CcodLifecycleInstallGeneration -InstallRoot $Root -RuntimeId 'scope-runtime'} $a
     try {
-        $record=&$module {New-CcodInstallTransactionRecord -TransactionId '22222222-3333-4444-5555-666666666666' -OldRuntimeId $null -OldGeneration $null -NewRuntimeId 'scope-runtime' -NewGeneration 1 -SealedPackageSha256 ('e'*64) -OwnedObjectNames @('scope-runtime')}
+        $record=&$module {New-CcodInstallTransactionRecord -TransactionId '22222222-3333-4444-5555-666666666666' -OldRuntimeId $null -OldGeneration $null -OldManifestSha256 $null -NewRuntimeId 'scope-runtime' -NewGeneration 1 -NewManifestSha256 ('2'*64) -SealedPackageSha256 ('e'*64) -OwnedObjectNames @('scope-runtime')}
         Assert-CcodThrows { &$module {param($Root,$Record,$Tx)Write-CcodInstallTransactionRecord -InstallRoot $Root -TransactionRecord $Record -FileTransaction $Tx} $b $record $tx } 'CCOD_INSTALL_TRANSACTION_SCOPE'
         Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $b 'state')) 'cross-root call creates no state'
     } finally { &$module {param($Tx)Close-CcodInstallFileTransaction -Transaction $Tx -Disposition Failed} $tx;if(Test-Path $a){Remove-Item $a -Recurse -Force};if(Test-Path $b){Remove-Item $b -Recurse -Force} }
 }
 
+$results += Invoke-CcodTest 'state and UI initialization reject a cross-root transaction before either state plane is written' {
+    $a=New-CcodLifecycleTempRoot;$b=New-CcodLifecycleTempRoot;[IO.Directory]::CreateDirectory($a)|Out-Null;[IO.Directory]::CreateDirectory($b)|Out-Null
+    $module=Get-Module InstallLifecycle -ErrorAction Stop;$runtimeId='2.5.22-1111111111111111-22222222222222222222222222222222';$tx=&$module {param($Root,$Id)Open-CcodLifecycleInstallGeneration -InstallRoot $Root -RuntimeId $Id} $a $runtimeId
+    try{Assert-CcodThrows {&$module {param($Root,$Id,$Transaction)Initialize-CcodInstallStatePlanes -InstallRoot $Root -RuntimeId $Id -FileTransaction $Transaction -NodeCandidates @() -CandidateCompatibleOptIn $false} $b $runtimeId $tx} 'CCOD_INSTALL_TRANSACTION_SCOPE';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $a 'state')) 'root A receives no baseline on cross-root rejection';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $b 'state')) 'root B receives no operational or UI state on cross-root rejection'}finally{&$module {param($Transaction)Close-CcodInstallFileTransaction -Transaction $Transaction -Disposition Failed} $tx;if(Test-Path $a){Remove-Item $a -Recurse -Force};if(Test-Path $b){Remove-Item $b -Recurse -Force}}
+}
+
+$results += Invoke-CcodTest 'partial operational state fails closed without overwrite or activation' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    try{
+        New-CcodLifecycleSourceFixture -Root $source|Out-Null;$stateRoot=Join-Path $install 'state';[IO.Directory]::CreateDirectory($stateRoot)|Out-Null
+        $settingsPath=Join-Path $stateRoot 'settings.json';[IO.File]::WriteAllText($settingsPath,'{"schemaVersion":1,"sentinel":"partial"}',[Text.UTF8Encoding]::new($false));$before=Get-CcodTestFileSha256 $settingsPath
+        $node=New-CcodLifecycleFakeNode -Root $nodeRoot;Assert-CcodThrows {Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $node).Adapters|Out-Null} 'CCOD_STATE_ALREADY_INITIALIZED'
+        Assert-CcodEqual $before (Get-CcodTestFileSha256 $settingsPath) 'partial operational state is not overwritten';Assert-CcodEqual 1 @(Get-ChildItem -LiteralPath $stateRoot -File).Count 'no other operational state leaf is materialized';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $stateRoot 'active-generation')) 'partial state cannot activate a generation'
+    }finally{foreach($p in @($source,$install,$nodeRoot)){if(Test-Path $p){Remove-Item $p -Recurse -Force}}}
+}
+
 $results += Invoke-CcodTest 'transaction reader rejects immutable identity drift across a contiguous snapshot chain' {
     $install=New-CcodLifecycleTempRoot;$transactionId='33333333-4444-5555-6666-777777777777'
     try{
         $store=Join-Path $install 'state\install-transactions';[IO.Directory]::CreateDirectory($store)|Out-Null
-        $prepared=[pscustomobject][ordered]@{schemaVersion=1;transactionId=$transactionId;oldRuntimeId='runtime-old-a';oldGeneration=1;newRuntimeId='runtime-new';newGeneration=2;sealedPackageSha256=('f'*64);ownedObjectNames=@('runtime-new');phase='Prepared';errorCode=$null}
-        $verified=[pscustomobject][ordered]@{schemaVersion=1;transactionId=$transactionId;oldRuntimeId='runtime-old-b';oldGeneration=1;newRuntimeId='runtime-new';newGeneration=2;sealedPackageSha256=('f'*64);ownedObjectNames=@('runtime-new');phase='PackageVerified';errorCode=$null}
+        $prepared=[pscustomobject][ordered]@{schemaVersion=1;transactionId=$transactionId;oldRuntimeId='runtime-old-a';oldGeneration=1;oldManifestSha256=('1'*64);newRuntimeId='runtime-new';newGeneration=2;newManifestSha256=('2'*64);sealedPackageSha256=('f'*64);ownedObjectNames=@('runtime-new');phase='Prepared';errorCode=$null}
+        $verified=[pscustomobject][ordered]@{schemaVersion=1;transactionId=$transactionId;oldRuntimeId='runtime-old-b';oldGeneration=1;oldManifestSha256=('1'*64);newRuntimeId='runtime-new';newGeneration=2;newManifestSha256=('2'*64);sealedPackageSha256=('f'*64);ownedObjectNames=@('runtime-new');phase='PackageVerified';errorCode=$null}
         [IO.File]::WriteAllText((Join-Path $store "00000000000000000002.00.Prepared.$transactionId.json"),($prepared|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
         [IO.File]::WriteAllText((Join-Path $store "00000000000000000002.01.PackageVerified.$transactionId.json"),($verified|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
         $module=Get-Module InstallLifecycle -ErrorAction Stop
@@ -523,7 +540,7 @@ $results += Invoke-CcodTest 'transaction reader rejects immutable identity drift
 
 $results += Invoke-CcodTest 'transaction store rejects unknown reparse ADS multilink and ambiguous chains' {
     $module=Get-Module InstallLifecycle -ErrorAction Stop
-    $newRecord={param($Id,[uint64]$Generation)[pscustomobject][ordered]@{schemaVersion=1;transactionId=$Id;oldRuntimeId='runtime-old';oldGeneration=[uint64]1;newRuntimeId=("runtime-new-$Generation");newGeneration=$Generation;sealedPackageSha256=('a'*64);ownedObjectNames=@("runtime-new-$Generation");phase='Prepared';errorCode=$null}}
+    $newRecord={param($Id,[uint64]$Generation)[pscustomobject][ordered]@{schemaVersion=1;transactionId=$Id;oldRuntimeId='runtime-old';oldGeneration=[uint64]1;oldManifestSha256=('1'*64);newRuntimeId=("runtime-new-$Generation");newGeneration=$Generation;newManifestSha256=('2'*64);sealedPackageSha256=('a'*64);ownedObjectNames=@("runtime-new-$Generation");phase='Prepared';errorCode=$null}}
     foreach($kind in @('unknown','reparse','ads','multilink','ambiguous')){
         $install=New-CcodLifecycleTempRoot;$outside=New-CcodLifecycleTempRoot
         try{
@@ -548,7 +565,7 @@ $results += Invoke-CcodTest 'transaction reader rejects ambiguous Ready and late
             $runtimeId='runtime-terminal';$generation=if($terminalKind-ceq'Ready'){[uint64]1}else{[uint64]2}
             foreach($id in @('66666666-7777-8888-9999-aaaaaaaaaaaa','77777777-8888-9999-aaaa-bbbbbbbbbbbb')){
                 $phases=if($terminalKind-ceq'Ready'){@('Prepared','PackageVerified','RuntimeStaged','PreviousProtectionStopped','RuntimePromoted','PointerCommitted','StableShellCommitted','ProtectionReady','Ready')}else{@('Prepared','Failed')}
-                foreach($phase in $phases){$index=if($phase-ceq'Failed'){99}else{[Array]::IndexOf(@('Prepared','PackageVerified','RuntimeStaged','PreviousProtectionStopped','RuntimePromoted','PointerCommitted','StableShellCommitted','ProtectionReady','Ready'),$phase)};$record=[pscustomobject][ordered]@{schemaVersion=1;transactionId=$id;oldRuntimeId=$null;oldGeneration=$null;newRuntimeId=$runtimeId;newGeneration=$generation;sealedPackageSha256=('b'*64);ownedObjectNames=@($runtimeId);phase=$phase;errorCode=if($phase-ceq'Failed'){'CCOD_INSTALL_FAILED'}else{$null}};[IO.File]::WriteAllText((Join-Path $store ('{0:D20}.{1:D2}.{2}.{3}.json'-f$generation,$index,$phase,$id)),($record|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))}
+                foreach($phase in $phases){$index=if($phase-ceq'Failed'){99}else{[Array]::IndexOf(@('Prepared','PackageVerified','RuntimeStaged','PreviousProtectionStopped','RuntimePromoted','PointerCommitted','StableShellCommitted','ProtectionReady','Ready'),$phase)};$record=[pscustomobject][ordered]@{schemaVersion=1;transactionId=$id;oldRuntimeId=$null;oldGeneration=$null;oldManifestSha256=$null;newRuntimeId=$runtimeId;newGeneration=$generation;newManifestSha256=('2'*64);sealedPackageSha256=('b'*64);ownedObjectNames=@($runtimeId);phase=$phase;errorCode=if($phase-ceq'Failed'){'CCOD_INSTALL_FAILED'}else{$null}};[IO.File]::WriteAllText((Join-Path $store ('{0:D20}.{1:D2}.{2}.{3}.json'-f$generation,$index,$phase,$id)),($record|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))}
             }
             if($terminalKind-ceq'Ready'){$pointerRoot=Join-Path $install 'state\active-generation';[IO.Directory]::CreateDirectory($pointerRoot)|Out-Null;[IO.File]::WriteAllText((Join-Path $pointerRoot '00000000000000000001.json'),('{"schemaVersion":1,"generation":1,"activeRuntime":"'+$runtimeId+'","previousGeneration":0}'),[Text.UTF8Encoding]::new($false))}
             Assert-CcodThrows {&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root|Out-Null} $install} 'CCOD_INSTALL_TRANSACTION_AMBIGUOUS'
@@ -556,6 +573,19 @@ $results += Invoke-CcodTest 'transaction reader rejects ambiguous Ready and late
     }
 }
 
+$results += Invoke-CcodTest 'real install entry rejects pointerless and ambiguous nonterminal transaction state before generation creation' {
+    foreach($count in @(1,2)){
+        $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+        try{
+            New-CcodLifecycleSourceFixture -Root $source|Out-Null;$store=Join-Path $install 'state\install-transactions';[IO.Directory]::CreateDirectory($store)|Out-Null
+            for($i=1;$i-le$count;$i++){$id=if($i-eq1){'88888888-9999-aaaa-bbbb-cccccccccccc'}else{'99999999-aaaa-bbbb-cccc-dddddddddddd'};$runtime="pending-$i";$record=[pscustomobject][ordered]@{schemaVersion=1;transactionId=$id;oldRuntimeId=$null;oldGeneration=$null;oldManifestSha256=$null;newRuntimeId=$runtime;newGeneration=[uint64]$i;newManifestSha256=('2'*64);sealedPackageSha256=('3'*64);ownedObjectNames=@($runtime);phase='Prepared';errorCode=$null};[IO.File]::WriteAllText((Join-Path $store ('{0:D20}.00.Prepared.{1}.json'-f$i,$id)),($record|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))}
+            $node=New-CcodLifecycleFakeNode -Root $nodeRoot;$expected=if($count-eq1){'CCOD_INSTALL_TRANSACTION_BUSY'}else{'CCOD_INSTALL_TRANSACTION_AMBIGUOUS'}
+            Assert-CcodThrows {Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $node).Adapters|Out-Null} $expected
+            Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $install 'runtime')) "global transaction gate creates no generation for $count head(s)"
+        }finally{foreach($p in @($source,$install,$nodeRoot)){if(Test-Path $p){Remove-Item $p -Recurse -Force}}}
+    }
+}
+
 $results += Invoke-CcodTest 'waits for the previous IgnoreNew task instance before starting the new supervisor' {
     $module = Get-Module -Name InstallLifecycle -ErrorAction Stop
     $calls = [Collections.Generic.List[string]]::new()
@@ -1161,6 +1191,7 @@ $results += Invoke-CcodTest 'upgrade retains one previous runtime and starts the
         Set-CcodUiLanguageMode -StateRoot $stateRoot -LanguageMode 'en-US' -Adapters @{ UtcNow = { [DateTimeOffset]::Parse('2030-02-03T03:04:06.0000000Z') } } | Out-Null
         $preferencePath = Join-Path $stateRoot 'ui-preferences.json'
         $preferenceBytes = [IO.File]::ReadAllBytes($preferencePath)
+        $operationalHashes=@{};foreach($leaf in @('settings.json','status.json','verified-packages.json','transition.json','ui-preferences.json')){$operationalHashes[$leaf]=Get-CcodTestFileSha256 -Path (Join-Path $stateRoot $leaf)}
         [IO.File]::WriteAllText((Join-Path $source 'src\runtime\main-payload.js'), "module.exports = 'fixture-v2';`n", [Text.UTF8Encoding]::new($false))
         $fake2 = New-CcodLifecycleFake -NodePath $nodePath
         $second = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake2.Adapters
@@ -1180,6 +1211,8 @@ $results += Invoke-CcodTest 'upgrade retains one previous runtime and starts the
         Assert-CcodEqual $first.RuntimeId $pointer.previousRuntime 'previous points at old runtime'
         Assert-CcodEqual (($preferenceBytes | ForEach-Object { $_.ToString('x2') }) -join '') (([IO.File]::ReadAllBytes($preferencePath) | ForEach-Object { $_.ToString('x2') }) -join '') 'upgrade preserves valid UI preference bytes'
         Assert-CcodEqual 'en-US' (Read-CcodUiPreference -StateRoot $stateRoot).LanguageMode 'upgrade retains selected UI language'
+        $upgradeBaseline=Join-Path $stateRoot "install-initializations\$($second.RuntimeId)"
+        foreach($leaf in @('settings.json','status.json','verified-packages.json','transition.json','ui-preferences.json')){Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $upgradeBaseline $leaf) -PathType Leaf) "upgrade baseline contains $leaf";Assert-CcodEqual $operationalHashes[$leaf] (Get-CcodTestFileSha256 -Path (Join-Path $stateRoot $leaf)) "upgrade does not overwrite operational $leaf"}
         $runtimeRoot = Join-Path $install 'runtime'
         $ids = @(Get-ChildItem -LiteralPath $runtimeRoot -Directory | ForEach-Object { $_.Name } | Sort-Object)
         Assert-CcodEqual (($ids -join '|')) ((@($first.RuntimeId, $second.RuntimeId) | Sort-Object) -join '|') 'only active and previous runtime remain'
@@ -1244,7 +1277,7 @@ $results += Invoke-CcodTest 'new-runtime readiness accepts only the exact post-t
         $installed = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
         $identity = New-CcodLifecycleIdentity
         $taskStartedAt = [DateTime]::Parse('2030-02-03T03:04:05Z').ToUniversalTime()
-        $bootstrapPath = [IO.Path]::GetFullPath((Join-Path $install 'bootstrap.ps1'))
+        $bootstrapPath = [IO.Path]::GetFullPath((Join-Path $install "runtime\$($installed.RuntimeId)\src\persistence\bootstrap.ps1"))
         $supervisorPath = [IO.Path]::GetFullPath((Join-Path $install "runtime\$($installed.RuntimeId)\src\persistence\Supervisor.ps1"))
         $token = 'a' * 64
         $snapshots = @(
@@ -1290,7 +1323,7 @@ $results += Invoke-CcodTest 'new-runtime readiness retries a temporary Ready eve
         $installed = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
         $identity = New-CcodLifecycleIdentity
         $started = [DateTime]::Parse('2030-02-03T03:04:05Z').ToUniversalTime()
-        $bootstrap = [IO.Path]::GetFullPath((Join-Path $install 'bootstrap.ps1'))
+        $bootstrap = [IO.Path]::GetFullPath((Join-Path $install "runtime\$($installed.RuntimeId)\src\persistence\bootstrap.ps1"))
         $supervisor = [IO.Path]::GetFullPath((Join-Path $install "runtime\$($installed.RuntimeId)\src\persistence\Supervisor.ps1"))
         $token = 'e' * 64
         $items = @(
@@ -1347,7 +1380,7 @@ $results += Invoke-CcodTest 'new-runtime readiness rejects every mismatched or a
         $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
         $installed = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
         $identity = New-CcodLifecycleIdentity;$started=[DateTime]::Parse('2030-02-03T03:04:05Z').ToUniversalTime()
-        $bootstrap=[IO.Path]::GetFullPath((Join-Path $install 'bootstrap.ps1'));$supervisor=[IO.Path]::GetFullPath((Join-Path $install "runtime\$($installed.RuntimeId)\src\persistence\Supervisor.ps1"));$token='b'*64
+        $bootstrap=[IO.Path]::GetFullPath((Join-Path $install "runtime\$($installed.RuntimeId)\src\persistence\bootstrap.ps1"));$supervisor=[IO.Path]::GetFullPath((Join-Path $install "runtime\$($installed.RuntimeId)\src\persistence\Supervisor.ps1"));$token='b'*64
         $newSnapshots = {
             $parent=[pscustomobject][ordered]@{ProcessId=600;ParentProcessId=1;SessionId=$identity.SessionId;CreationDate=[DateTime]::Parse('2030-02-03T03:04:05.1000000Z').ToUniversalTime();Name='powershell.exe';CommandLine="powershell.exe -NoProfile -ExecutionPolicy Bypass -STA -WindowStyle Hidden -File `"$bootstrap`" -InstallRoot `"$install`" -EntryMode Task"}
             $child=[pscustomobject][ordered]@{ProcessId=601;ParentProcessId=600;SessionId=$identity.SessionId;CreationDate=[DateTime]::Parse('2030-02-03T03:04:06.0000000Z').ToUniversalTime();Name='powershell.exe';CommandLine="powershell.exe -NoProfile -ExecutionPolicy Bypass -STA -File `"$supervisor`" -ReadyToken $token"}
@@ -1387,7 +1420,7 @@ $results += Invoke-CcodTest 'new-runtime readiness requires a live exact process
     try{
         New-CcodLifecycleSourceFixture -Root $source -Version '2.5.0-ready-event'|Out-Null;$nodePath=New-CcodLifecycleFakeNode -Root $nodeRoot
         $installed=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
-        $identity=New-CcodLifecycleIdentity;$started=[DateTime]::Parse('2030-02-03T03:04:05Z').ToUniversalTime();$bootstrap=[IO.Path]::GetFullPath((Join-Path $install 'bootstrap.ps1'));$supervisor=[IO.Path]::GetFullPath((Join-Path $install "runtime\$($installed.RuntimeId)\src\persistence\Supervisor.ps1"));$token='d'*64
+        $identity=New-CcodLifecycleIdentity;$started=[DateTime]::Parse('2030-02-03T03:04:05Z').ToUniversalTime();$bootstrap=[IO.Path]::GetFullPath((Join-Path $install "runtime\$($installed.RuntimeId)\src\persistence\bootstrap.ps1"));$supervisor=[IO.Path]::GetFullPath((Join-Path $install "runtime\$($installed.RuntimeId)\src\persistence\Supervisor.ps1"));$token='d'*64
         $items=@([pscustomobject]@{ProcessId=700;ParentProcessId=1;SessionId=1;CreationDate=[DateTime]::Parse('2030-02-03T03:04:05.1Z').ToUniversalTime();Name='powershell.exe';CommandLine="powershell.exe -NoProfile -ExecutionPolicy Bypass -STA -WindowStyle Hidden -File `"$bootstrap`" -InstallRoot `"$install`" -EntryMode Task"},[pscustomobject]@{ProcessId=701;ParentProcessId=700;SessionId=1;CreationDate=[DateTime]::Parse('2030-02-03T03:04:06Z').ToUniversalTime();Name='powershell.exe';CommandLine="powershell.exe -NoProfile -ExecutionPolicy Bypass -STA -File `"$supervisor`" -ReadyToken $token"})
         $cases=@(
             [pscustomobject]@{Name='TrayHost handshake remains unsignaled';OpenThrows=$false;AliveChecks=99;Signal=$false},
@@ -1461,6 +1494,11 @@ $results += Invoke-CcodTest 'upgrade boundaries fail closed with phase receipts
     }
 }
 
+$results += Invoke-CcodTest 'compensation refuses a replaced old manifest using the transaction-recorded hash' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    try{New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22-old-manifest'|Out-Null;$node=New-CcodLifecycleFakeNode -Root $nodeRoot;$first=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $node).Adapters;Set-CcodLifecycleTestStatus -InstallRoot $install -RuntimeId $first.RuntimeId;[IO.File]::WriteAllText((Join-Path $source 'src\runtime\main-payload.js'),"module.exports='upgrade';`n",[Text.UTF8Encoding]::new($false));$oldManifest=Join-Path $install "runtime\$($first.RuntimeId)\manifest.json";$fake=New-CcodLifecycleFake -NodePath $node;$changed=[pscustomobject]@{Done=$false};$fake.Adapters.WaitNewRuntimeReady={param($Root,$Runtime,$Generation,$Identity,$Started,$Timeout)if(-not$changed.Done){$changed.Done=$true;[IO.File]::SetAttributes($oldManifest,[IO.FileAttributes]::Normal);[IO.File]::AppendAllText($oldManifest,' ',[Text.UTF8Encoding]::new($false))};[pscustomobject]@{SupervisorReady=$false;TrayReady=$false}}.GetNewClosure();Assert-CcodThrows {Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters|Out-Null} 'CCOD_INSTALL_ROLLBACK_FAILED';$pointer=Read-CcodActiveRuntime -InstallRoot $install;Assert-CcodTrue ($pointer.activeRuntime-cne$first.RuntimeId) 'replaced old manifest cannot receive a compensating pointer';Assert-CcodEqual 2 $pointer.generation 'failed old-manifest proof leaves the committed new pointer generation';Assert-CcodEqual 2 @(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory).Count 'both generations remain retained'}finally{foreach($p in @($source,$install,$nodeRoot)){if(Test-Path $p){Remove-Item $p -Recurse -Force}}}
+}
+
 # Production mutation caught: setting previousProtectionStopped only after task-idle proof, which skips rollback when exact Supervisor exit succeeds but IgnoreNew remains busy.
 $results += Invoke-CcodTest 'task-idle failure restarts and proves the old active generation before Failed' {
     $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
@@ -1570,17 +1608,18 @@ $results += Invoke-CcodTest 'sealed-source copy failure retains the candidate an
     $source = New-CcodLifecycleTempRoot
     $install = New-CcodLifecycleTempRoot
     $nodeRoot = New-CcodLifecycleTempRoot
-    $sourceLock = $null
+    $lockHolder = [pscustomobject]@{Stream=$null}
     try {
-        New-CcodLifecycleSourceFixture -Root $source | Out-Null
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22' | Out-Null
+        $manifestPath=New-CcodLifecyclePayloadManifest -Root $source -Version '2.5.22';$payloadBinding=Get-CcodLifecyclePayloadBinding -ManifestPath $manifestPath -ExpectedVersion '2.5.22'
         [IO.Directory]::CreateDirectory($install) | Out-Null
         $legacyBootstrap=Join-Path $install 'bootstrap.ps1';$legacyUninstaller=Join-Path $install 'Uninstall-CodexControlOtherDevices.ps1'
         [IO.File]::WriteAllText($legacyBootstrap,'legacy-bootstrap',[Text.UTF8Encoding]::new($false));[IO.File]::WriteAllText($legacyUninstaller,'legacy-uninstaller',[Text.UTF8Encoding]::new($false))
         $bootstrapHash=Get-CcodTestFileSha256 $legacyBootstrap;$uninstallerHash=Get-CcodTestFileSha256 $legacyUninstaller
         $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
         $fake = New-CcodLifecycleFake -NodePath $nodePath
-        $sourceLock=[IO.File]::Open((Join-Path $source 'src\persistence\Supervisor.ps1'),[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::None)
-        $failure=$null;try{Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters|Out-Null}catch{$failure=$_}
+        $fake.Adapters.ValidateSource={param($Root)$lockHolder.Stream=[IO.File]::Open((Join-Path $Root 'src\persistence\Supervisor.ps1'),[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::None);$true}.GetNewClosure()
+        $failure=$null;try{Invoke-CcodInstall -SourceRoot $source -InstallRoot $install @payloadBinding -Adapters $fake.Adapters|Out-Null}catch{$failure=$_}
         Assert-CcodTrue ($null-ne$failure) 'sealed source lock fails the immutable copy'
         Assert-CcodTrue ($failure.FullyQualifiedErrorId-like'CCOD_INSTALL_*') 'sealed source copy failure is bounded'
         Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $install 'active.json')) 'sealed source failure never writes legacy active pointer'
@@ -1589,11 +1628,16 @@ $results += Invoke-CcodTest 'sealed-source copy failure retains the candidate an
         Assert-CcodEqual $uninstallerHash (Get-CcodTestFileSha256 $legacyUninstaller) 'sealed source failure leaves legacy uninstaller bytes unchanged'
         Assert-CcodEqual 1 @(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory -ErrorAction SilentlyContinue).Count 'failed immutable candidate is retained for diagnosis'
     } finally {
-        if($null-ne$sourceLock){$sourceLock.Dispose()}
+        if($null-ne$lockHolder.Stream){$lockHolder.Stream.Dispose()}
         foreach ($path in @($source, $install, $nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
     }
 }
 
+$results += Invoke-CcodTest 'final transaction snapshot failure leaves Ready receipt and recoverable nonterminal without Failed ambiguity' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    try{New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22-final-gap'|Out-Null;$node=New-CcodLifecycleFakeNode -Root $nodeRoot;$fake=New-CcodLifecycleFake -NodePath $node;$fake.Adapters.CommitReadyTransaction={throw 'PRIVATE_FINAL_SNAPSHOT_FAILURE'};$failure=$null;try{Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters|Out-Null}catch{$failure=$_};Assert-CcodTrue ($failure.FullyQualifiedErrorId-like'CCOD_INSTALL_READY_FINALIZATION_PENDING*') 'final snapshot failure reports recoverable pending status';$ready=@(Get-ChildItem -LiteralPath (Join-Path $install 'state\activation-receipts') -Filter '*.Ready.json' -File);$failed=@(Get-ChildItem -LiteralPath (Join-Path $install 'state\activation-receipts') -Filter '*.Failed.json' -File);Assert-CcodEqual 1 $ready.Count 'Ready activation receipt remains visible exactly once';Assert-CcodEqual 0 $failed.Count 'no contradictory Failed activation receipt is appended';$transactionFailed=@(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Failed.*.json' -File);$transactionReady=@(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Ready.*.json' -File);Assert-CcodEqual 0 $transactionFailed.Count 'no Failed transaction snapshot follows Ready receipt';Assert-CcodEqual 0 $transactionReady.Count 'missing final transaction snapshot remains absent for recovery';$module=Get-Module InstallLifecycle;$head=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install;Assert-CcodEqual 'ProtectionReady' $head.phase 'transaction remains recoverable at ProtectionReady'}finally{foreach($p in @($source,$install,$nodeRoot)){if(Test-Path $p){Remove-Item $p -Recurse -Force}}}
+}
+
 $results += Invoke-CcodTest 'source reparse point fails closed before staging' {
     $source = New-CcodLifecycleTempRoot
     $install = New-CcodLifecycleTempRoot
@@ -1837,7 +1881,7 @@ $results += Invoke-CcodTest 'repair state quarantines damage and resets consent
     }
 }
 
-$results += Invoke-CcodTest 'upgrade and repair preserve malformed UI preference without safety damage' {
+$results += Invoke-CcodTest 'upgrade fails closed on malformed UI baseline while repair preserves its bytes' {
     $source = New-CcodLifecycleTempRoot
     $install = New-CcodLifecycleTempRoot
     $nodeRoot = New-CcodLifecycleTempRoot
@@ -1852,9 +1896,9 @@ $results += Invoke-CcodTest 'upgrade and repair preserve malformed UI preference
         [byte[]]$malformed = 0x00,0x7b,0xff,0x13,0x0a
         [IO.File]::WriteAllBytes($preferencePath, $malformed)
         [IO.File]::WriteAllText((Join-Path $source 'src\runtime\main-payload.js'), "module.exports = 'fixture-ui-malformed-v2';`n", [Text.UTF8Encoding]::new($false))
-        $upgrade = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
-        Assert-CcodEqual 'Upgraded' $upgrade.Outcome 'malformed preference does not block ordinary upgrade'
-        Assert-CcodEqual '007bff130a' (([IO.File]::ReadAllBytes($preferencePath) | ForEach-Object { $_.ToString('x2') }) -join '') 'ordinary upgrade preserves malformed UI preference bytes'
+        Assert-CcodThrows {Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters|Out-Null} 'CCOD_STATE_MALFORMED'
+        Assert-CcodEqual $first.RuntimeId (Read-CcodActiveRuntime -InstallRoot $install).activeRuntime 'malformed UI baseline cannot advance the active pointer'
+        Assert-CcodEqual '007bff130a' (([IO.File]::ReadAllBytes($preferencePath) | ForEach-Object { $_.ToString('x2') }) -join '') 'failed upgrade preserves malformed UI preference bytes'
         $repairFake = New-CcodLifecycleFake -NodePath $nodePath
         $repair = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -RepairState -Adapters $repairFake.Adapters
         Assert-CcodEqual 'Repaired' $repair.Outcome 'malformed preference does not block repair'
@@ -1869,7 +1913,7 @@ $results += Invoke-CcodTest 'upgrade and repair preserve malformed UI preference
     }
 }
 
-$results += Invoke-CcodTest 'legacy missing UI preference remains absent across upgrade and follows Windows' {
+$results += Invoke-CcodTest 'legacy missing UI preference is safely materialized during upgrade' {
     $source = New-CcodLifecycleTempRoot
     $install = New-CcodLifecycleTempRoot
     $nodeRoot = New-CcodLifecycleTempRoot
@@ -1885,10 +1929,10 @@ $results += Invoke-CcodTest 'legacy missing UI preference remains absent across
         [IO.File]::WriteAllText((Join-Path $source 'src\runtime\main-payload.js'), "module.exports = 'fixture-ui-legacy-v2';`n", [Text.UTF8Encoding]::new($false))
         $upgrade = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
         Assert-CcodEqual 'Upgraded' $upgrade.Outcome 'legacy preference absence does not block upgrade'
-        Assert-CcodTrue (-not (Test-Path -LiteralPath $preferencePath)) 'legacy missing preference remains absent after upgrade'
+        Assert-CcodTrue (Test-Path -LiteralPath $preferencePath -PathType Leaf) 'legacy missing preference is materialized from the upgrade baseline'
         $preference = Read-CcodUiPreference -StateRoot $stateRoot
         Assert-CcodEqual 'System' $preference.LanguageMode 'legacy missing preference follows Windows'
-        Assert-CcodEqual $true $preference.FallbackUsed 'legacy missing preference uses safe fallback'
+        Assert-CcodEqual $false $preference.FallbackUsed 'materialized preference no longer requires fallback'
     } finally {
         foreach ($path in @($source, $install, $nodeRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
     }
@@ -2486,6 +2530,11 @@ $results += Invoke-CcodTest 'upgrade stops a verified fallback supervisor when s
     }
 }
 
+$results += Invoke-CcodTest 'fallback accepts generation parent and rejects root parent when append-only selector exists' {
+    $install=New-CcodLifecycleTempRoot
+    try{$identity=New-CcodLifecycleIdentity;[IO.Directory]::CreateDirectory($install)|Out-Null;$runtimeId='2.5.22-1111111111111111-22222222222222222222222222222222';$runtimeRoot=Join-Path $install "runtime\$runtimeId";$supervisor=Join-Path $runtimeRoot 'src\persistence\Supervisor.ps1';$generationBootstrap=Join-Path $runtimeRoot 'src\persistence\bootstrap.ps1';[IO.Directory]::CreateDirectory((Split-Path $supervisor -Parent))|Out-Null;[IO.File]::WriteAllText($generationBootstrap,'# generation',[Text.UTF8Encoding]::new($false));$pointerRoot=Join-Path $install 'state\active-generation';[IO.Directory]::CreateDirectory($pointerRoot)|Out-Null;[IO.File]::WriteAllText((Join-Path $pointerRoot '00000000000000000001.json'),('{"schemaVersion":1,"generation":1,"activeRuntime":"'+$runtimeId+'","previousGeneration":0}'),[Text.UTF8Encoding]::new($false));$parent=[pscustomobject]@{ProcessId=96;ParentProcessId=1;SessionId=$identity.SessionId;CreationDate=[DateTime]::Parse('2030-02-03T02:59:59Z').ToUniversalTime();CommandLine="powershell.exe -File `"$generationBootstrap`" -InstallRoot `"$install`""};$child=[pscustomobject]@{ProcessId=97;ParentProcessId=96;SessionId=$identity.SessionId;CreationDate=[DateTime]::Parse('2030-02-03T03:00:00Z').ToUniversalTime();CommandLine="powershell.exe -File `"$supervisor`" -ReadyToken $('a'*64)"};$module=Get-Module InstallLifecycle;$accepted=&$module {param($Root,$Current,$Items)Get-CcodLifecycleVerifiedSupervisorFallback -InstallRoot $Root -Identity $Current -ProcessEnumerator {param($Ignored)$Items} -OwnerSidResolver {param($P)[pscustomobject]@{ReturnValue=0;Sid=$Current.UserSid}}} $install $identity @($parent,$child);Assert-CcodEqual 97 $accepted.Pid 'append-only task accepts exact same-generation bootstrap parent';$rootBootstrap=Join-Path $install 'bootstrap.ps1';[IO.File]::WriteAllText($rootBootstrap,'# legacy',[Text.UTF8Encoding]::new($false));$parent.CommandLine="powershell.exe -File `"$rootBootstrap`" -InstallRoot `"$install`"";$rejected=&$module {param($Root,$Current,$Items)Get-CcodLifecycleVerifiedSupervisorFallback -InstallRoot $Root -Identity $Current -ProcessEnumerator {param($Ignored)$Items} -OwnerSidResolver {param($P)[pscustomobject]@{ReturnValue=0;Sid=$Current.UserSid}}} $install $identity @($parent,$child);Assert-CcodTrue ($null-eq$rejected) 'append-only selector rejects legacy root bootstrap parent'}finally{if(Test-Path $install){Remove-Item $install -Recurse -Force}}
+}
+
 $results += Invoke-CcodTest 'fallback accepts a deleted legacy runtime only through the exact stable bootstrap parent' {
     $install = New-CcodLifecycleTempRoot
     try {
diff --git a/tests/persistence/RuntimeManifest.SelfTest.ps1 b/tests/persistence/RuntimeManifest.SelfTest.ps1
index 1b9cc1c..e0db57e 100644
--- a/tests/persistence/RuntimeManifest.SelfTest.ps1
+++ b/tests/persistence/RuntimeManifest.SelfTest.ps1
@@ -69,8 +69,9 @@ try {
         Write-CcodAtomicJson -Path (Join-Path $runtime 'manifest.json') -Value $first
         $second = New-CcodRuntimeManifest -RuntimeDirectory $runtime -ProjectVersion '2.0.0'
 
-        Assert-CcodTrue ($first.runtimeId -match '^[A-Za-z0-9._-]{1,96}$') 'runtime ID must be a safe name'
-        Assert-CcodEqual $first.runtimeId $second.runtimeId 'the same runtime bytes must produce the same runtime ID'
+        Assert-CcodTrue ($first.runtimeId -cmatch '^2\.0\.0-[0-9a-f]{16}-[0-9a-f]{32}$') 'runtime ID binds project version, file digest, and nonce'
+        Assert-CcodTrue ($first.runtimeId -cne $second.runtimeId) 'the same runtime bytes receive unique per-attempt nonces'
+        Assert-CcodEqual (($first.runtimeId -split '-')[-2]) (($second.runtimeId -split '-')[-2]) 'identical sorted file records retain the same deterministic digest'
         Assert-CcodEqual 'a.txt' $first.files[0].path 'files must sort ordinally'
         Assert-CcodEqual 'b.txt' $first.files[1].path 'files must sort ordinally'
         Assert-CcodEqual 2 $first.files.Count 'manifest must exclude manifest.json itself'
@@ -91,6 +92,21 @@ try {
         Assert-CcodEqual $false $result.Valid 'tampered bytes must be rejected'
     }
 
+    Invoke-CcodTest 'rejects copied renamed and nonce-tampered generation identity' {
+        $runtime=Join-Path $root 'identity-original';New-Item -ItemType Directory -Path $runtime|Out-Null
+        [IO.File]::WriteAllText((Join-Path $runtime 'a.txt'),'alpha',[Text.UTF8Encoding]::new($false))
+        $manifest=New-CcodRuntimeManifest -RuntimeDirectory $runtime -ProjectVersion '2.5.22'
+        Write-CcodAtomicJson -Path (Join-Path $runtime 'manifest.json') -Value $manifest
+        $originalManifestSha=Get-CcodTestFileSha256 -Path (Join-Path $runtime 'manifest.json')
+        $parts=$manifest.runtimeId -split '-';$renamedId=($parts[0..($parts.Count-2)] -join '-')+'-'+('f'*32)
+        $renamed=Join-Path $root $renamedId;Copy-Item -LiteralPath $runtime -Destination $renamed -Recurse
+        $altered=Get-Content -LiteralPath (Join-Path $renamed 'manifest.json') -Raw|ConvertFrom-Json;$altered.runtimeId=$renamedId
+        Write-CcodAtomicJson -Path (Join-Path $renamed 'manifest.json') -Value $altered
+        Assert-CcodEqual $false (Test-CcodRuntimeManifest -RuntimeDirectory $renamed -ExpectedRuntimeId $renamedId -ExpectedManifestSha256 $originalManifestSha).Valid 'copied generation cannot authorize a renamed nonce by rewriting its manifest identity'
+        $altered.runtimeId=$manifest.runtimeId.Substring(0,$manifest.runtimeId.Length-1)+'A';Write-CcodAtomicJson -Path (Join-Path $renamed 'manifest.json') -Value $altered
+        Assert-CcodEqual $false (Test-CcodRuntimeManifest -RuntimeDirectory $renamed -ExpectedRuntimeId $altered.runtimeId).Valid 'wrong non-lowercase nonce is rejected'
+    }
+
     Invoke-CcodTest 'rejects an unsafe manifest path instead of reading outside its runtime' {
         $runtime = Join-Path $root 'unsafe-manifest'
         New-Item -ItemType Directory -Path $runtime | Out-Null
@@ -160,6 +176,20 @@ try {
         Assert-CcodThrows { Read-CcodActiveRuntime -InstallRoot $installRoot } 'CCOD_RUNTIME_ID_INVALID'
     }
 
+    Invoke-CcodTest 'append-only active selector rejects unknown reparse ADS and multi-linked leaves' {
+        foreach($kind in @('unknown','reparse','ads','multilink')){
+            $installRoot=Join-Path $root ("pointer-$kind");$pointerRoot=Join-Path $installRoot 'state\active-generation';$target=Join-Path $outside ("pointer-$kind")
+            [IO.Directory]::CreateDirectory($pointerRoot)|Out-Null;[IO.Directory]::CreateDirectory($target)|Out-Null
+            $runtimeId='2.5.22-1111111111111111-22222222222222222222222222222222';$path=Join-Path $pointerRoot '00000000000000000001.json';$json='{"schemaVersion":1,"generation":1,"activeRuntime":"'+$runtimeId+'","previousGeneration":0}'
+            if($kind-ceq'unknown'){[IO.File]::WriteAllText((Join-Path $pointerRoot 'unknown.bin'),'x',[Text.UTF8Encoding]::new($false))}
+            elseif($kind-ceq'reparse'){New-Item -ItemType Junction -Path $path -Target $target|Out-Null}
+            elseif($kind-ceq'ads'){[IO.File]::WriteAllText($path,$json,[Text.UTF8Encoding]::new($false));Set-Content -LiteralPath $path -Stream 'evidence' -Value 'x' -NoNewline}
+            else{$outsideFile=Join-Path $target 'pointer.json';[IO.File]::WriteAllText($outsideFile,$json,[Text.UTF8Encoding]::new($false));New-Item -ItemType HardLink -Path $path -Target $outsideFile|Out-Null}
+            Assert-CcodThrows {Read-CcodActiveRuntime -InstallRoot $installRoot|Out-Null} 'CCOD_RUNTIME_POINTER_INVALID'
+            if(Test-Path $installRoot){Remove-Item $installRoot -Recurse -Force};if(Test-Path $target){Remove-Item $target -Recurse -Force}
+        }
+    }
+
     Invoke-CcodTest 'includes the lifecycle worker and coordinator in the staged runtime closure' {
         $sourceFiles=@(& $installLifecycleModule {param($sourceRoot)Get-CcodLifecycleSourceFiles -SourceRoot $sourceRoot} $repositoryRoot)
         foreach($relative in @('src\persistence\LifecycleWorker.ps1','src\persistence\SessionController.ps1','src\persistence\modules\LifecycleCoordinator.psm1','src\persistence\modules\LifecycleEpoch.psm1','src\persistence\modules\ProcessControl.psm1','src\persistence\modules\SessionEngine.psm1','src\persistence\modules\WorkerRuntime.psm1')){
diff --git a/tests/persistence/StaticProbeWorker.SelfTest.ps1 b/tests/persistence/StaticProbeWorker.SelfTest.ps1
index efc4691..0344546 100644
--- a/tests/persistence/StaticProbeWorker.SelfTest.ps1
+++ b/tests/persistence/StaticProbeWorker.SelfTest.ps1
@@ -185,7 +185,7 @@ function Get-CcodTestRuntimeId {
     $sha = [Security.Cryptography.SHA256]::Create()
     try { $digest = [BitConverter]::ToString($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes($canonical))).Replace('-','').ToLowerInvariant() }
     finally { $sha.Dispose() }
-    return '{0}-{1}' -f $ProjectVersion,$digest.Substring(0,16)
+    return '{0}-{1}-{2}' -f $ProjectVersion,$digest.Substring(0,16),('c'*32)
 }
 
 function Get-CcodTestRuntimeRecords {
@@ -203,7 +203,7 @@ function Get-CcodTestRuntimeRecords {
 }
 
 function New-CcodAuthorizedRuntimeFixture {
-    param([string]$Root,[string]$ReadStrictJsonMarker)
+    param([string]$Root,[string]$ReadStrictJsonMarker,[switch]$AppendOnly)
     $install = Join-Path $Root 'install'
     $staging = Join-Path $install 'staging'
     foreach ($relative in @(
@@ -235,8 +235,8 @@ function New-CcodAuthorizedRuntimeFixture {
     [IO.Directory]::Move($staging,$runtime)
     $manifest = [pscustomobject][ordered]@{schemaVersion=1;projectVersion='2.0.0';runtimeId=$runtimeId;files=$records}
     [IO.File]::WriteAllText((Join-Path $runtime 'manifest.json'),($manifest|ConvertTo-Json -Depth 12),[Text.UTF8Encoding]::new($false))
-    $active = [pscustomobject][ordered]@{schemaVersion=1;activeRuntime=$runtimeId;previousRuntime=$null;updatedAtUtc='2030-02-03T04:05:06.0000000Z'}
-    [IO.File]::WriteAllText((Join-Path $install 'active.json'),($active|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+    if($AppendOnly){$pointerRoot=Join-Path $install 'state\active-generation';[IO.Directory]::CreateDirectory($pointerRoot)|Out-Null;$active=[pscustomobject][ordered]@{schemaVersion=1;generation=[uint64]1;activeRuntime=$runtimeId;previousGeneration=[uint64]0};[IO.File]::WriteAllText((Join-Path $pointerRoot '00000000000000000001.json'),($active|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))}
+    else{$active = [pscustomobject][ordered]@{schemaVersion=1;activeRuntime=$runtimeId;previousRuntime=$null;updatedAtUtc='2030-02-03T04:05:06.0000000Z'};[IO.File]::WriteAllText((Join-Path $install 'active.json'),($active|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))}
     $workers = Join-Path $install 'state\workers'
     [IO.Directory]::CreateDirectory($workers)|Out-Null
     return [pscustomobject][ordered]@{
@@ -504,6 +504,13 @@ try {
         Assert-CcodEqual 0 $requestHarness.ProbeCalls.Count 'duplicate request never probes'
     }
 
+    Invoke-CcodTest 'authorizes append-only active generation without legacy active json' {
+        $fixture=New-CcodAuthorizedRuntimeFixture -Root (Join-Path $root 'append-only-runtime') -AppendOnly
+        Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $fixture.InstallRoot 'active.json')) 'append-only fixture has no legacy selector'
+        $context=Get-CcodStaticProbeRuntimeAuthorization -ScriptPath $fixture.WorkerPath
+        Assert-CcodEqual $fixture.RuntimeId $context.RuntimeId 'static worker binds the append-only selected runtime'
+    }
+
     Invoke-CcodTest 'imports only exact private bound runtime APIs and unloads every module command surface' {
         $fixture=New-CcodAuthorizedRuntimeFixture -Root (Join-Path $root 'private-runtime-api')
         $context=Get-CcodStaticProbeRuntimeAuthorization -ScriptPath $fixture.WorkerPath
diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index 3b7fc8c..acbdc2c 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -156,7 +156,7 @@ function Set-CcodUninstallBootstrapFixtureDirectoryOwner {
 }
 
 function New-CcodVerifiedUninstallRuntimeFixture {
-    param([Parameter(Mandatory)][string]$InstallRoot)
+    param([Parameter(Mandatory)][string]$InstallRoot,[switch]$AppendOnly)
     $runtimeRoot = Join-Path $InstallRoot 'runtime\pending'
     foreach ($entry in @(
         'src/persistence/UninstallBootstrap.ps1',
@@ -186,7 +186,8 @@ function New-CcodVerifiedUninstallRuntimeFixture {
     [IO.Directory]::CreateDirectory((Join-Path $InstallRoot 'state')) | Out-Null
     Set-CcodUninstallBootstrapFixtureDirectoryOwner -Path $InstallRoot
     $timestamp = '2030-02-03T03:04:05.0000000Z'
-    [IO.File]::WriteAllText((Join-Path $InstallRoot 'active.json'),([ordered]@{schemaVersion=2;activeRuntime=$manifest.runtimeId;previousRuntime=$null;generation=[uint64]7;updatedAtUtc=$timestamp}|ConvertTo-Json),[Text.UTF8Encoding]::new($false))
+    if($AppendOnly){$pointerRoot=Join-Path $InstallRoot 'state\active-generation';[IO.Directory]::CreateDirectory($pointerRoot)|Out-Null;for($generation=1;$generation-le7;$generation++){[IO.File]::WriteAllText((Join-Path $pointerRoot ('{0:D20}.json'-f$generation)),([ordered]@{schemaVersion=1;generation=[uint64]$generation;activeRuntime=$manifest.runtimeId;previousGeneration=[uint64]($generation-1)}|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))}}
+    else{[IO.File]::WriteAllText((Join-Path $InstallRoot 'active.json'),([ordered]@{schemaVersion=2;activeRuntime=$manifest.runtimeId;previousRuntime=$null;generation=[uint64]7;updatedAtUtc=$timestamp}|ConvertTo-Json),[Text.UTF8Encoding]::new($false))}
     [IO.File]::WriteAllText((Join-Path $InstallRoot 'state\lifecycle-epoch.json'),([ordered]@{schemaVersion=1;epoch=[uint64]11}|ConvertTo-Json),[Text.UTF8Encoding]::new($false))
     return [pscustomobject][ordered]@{RuntimeRoot=$finalRuntime;RuntimeId=$manifest.runtimeId}
 }
@@ -232,6 +233,11 @@ $results += Invoke-CcodTest 'production runtime verification binds the installed
     }
 }
 
+$results += Invoke-CcodTest 'production uninstall authorization consumes append-only selector before legacy active json' {
+    $localAppData=Join-Path ([IO.Path]::GetTempPath()) ('ccod-uninstall-append-'+[guid]::NewGuid().ToString('N'));$installRoot=Join-Path $localAppData 'CodexControlOtherDevices';$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
+    try{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$localAppData,'Process');$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $installRoot -AppendOnly;$context=Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $installRoot;Assert-CcodEqual $fixture.RuntimeId $context.runtimeId 'uninstall context binds append-only active runtime';Assert-CcodEqual 7 ([uint64]$context.runtimeGeneration) 'uninstall context binds latest append-only generation';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $installRoot 'active.json')) 'append-only uninstall authorization needs no legacy pointer'}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $localAppData){Remove-Item $localAppData -Recurse -Force}}
+}
+
 $results += Invoke-CcodTest 'external staging refuses a cleanup source changed after runtime verification' {
     $localAppData = Join-Path ([IO.Path]::GetTempPath()) ('ccod-uninstall-race-' + [guid]::NewGuid().ToString('N'))
     $installRoot = Join-Path $localAppData 'CodexControlOtherDevices'

From f10f7255ea8047de63c0c6e084f5f25c8f44c2d4 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 10:28:48 +0800
Subject: [PATCH 082/187] fix: recover append-only lifecycle finalization

---
 .../task-2-report.md                          |  85 +++++++++++++++
 ...08-29-v2522-immutable-generation-design.md |   9 ++
 src/persistence/StaticProbeWorker.ps1         |  15 ++-
 src/persistence/UninstallBootstrap.ps1        |  13 ++-
 src/persistence/bootstrap.ps1                 |  29 ++++-
 .../modules/InstallFileTransaction.psm1       |  58 ++++++----
 src/persistence/modules/InstallLifecycle.psm1 | 100 ++++++++++++++++--
 src/persistence/modules/RuntimeManifest.psm1  |   9 +-
 tests/persistence/Bootstrap.SelfTest.ps1      |   4 +-
 .../InstallFileTransaction.SelfTest.ps1       |  30 ++++--
 .../persistence/InstallLifecycle.SelfTest.ps1 |  91 +++++++++++++++-
 .../persistence/RuntimeManifest.SelfTest.ps1  |  18 ++++
 .../StaticProbeWorker.SelfTest.ps1            |  15 +++
 .../UninstallBootstrap.SelfTest.ps1           |   5 +
 14 files changed, 427 insertions(+), 54 deletions(-)

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md
index 10cb813..1ca25ce 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md
@@ -204,3 +204,88 @@ Important findings. This round keeps `2101485` and remediates all seven.
 ### Fix commit
 
 - `fix: complete generation bootstrap lifecycle` (this fix-round commit)
+
+## Fix round 2 — recover append-only lifecycle finalization
+
+### RED and root-cause evidence
+
+- The pre-recovery lifecycle baseline command
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1`
+  exited `0` with `Install lifecycle self-tests passed: 114`; this proved the
+  existing suite covered only creation of the `ProtectionReady` gap, not a
+  later invocation that completes it.
+- After adding the second-invocation recovery regression, the same command
+  exited `1` with
+  `CCOD_SELFTEST_FAILED case=a-later-invocation-recovers-one-missing-Ready-transaction-snapshot-without-another-install-mutation error=CCOD_INSTALL_SOURCE_MISSING`.
+  The real entry touched the vanished source checkout before attempting any
+  state-only recovery.
+- The first implementation run exited `1` with
+  `CCOD_INSTALL_READY_RECOVERY_INVALID`; temporary bounded diagnostics traced
+  that failure to calling the private, non-exported
+  `Get-CcodRuntimeDirectoryForId`. The final implementation derives the
+  already validated runtime path locally and applies the existing contained
+  install-path proof; the temporary diagnostic text was removed.
+
+### GREEN and final verification evidence
+
+- InstallFileTransaction command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+  exited `0`; all 26 named cases passed. Coverage includes V4 state-only
+  create-only records, duplicate-record rejection, generation/payload/
+  manifest/retained/pointer/retirement exclusion, and a forced re-import with
+  the V3 marker already present.
+- InstallLifecycle command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1`
+  exited `0` with `Install lifecycle self-tests passed: 116`. A later
+  invocation with the source checkout removed appends exactly one matching
+  Ready transaction snapshot and creates no runtime, pointer, task start, or
+  Failed record. Malformed Ready receipt, mismatched append-only pointer, and
+  changed manifest bytes each remain `ProtectionReady` and write nothing.
+- Bootstrap exited `0` with `Bootstrap self-test passed: 24`.
+- RuntimeManifest exited `0`; all 19 named cases reported `True`, including
+  real default-adapter fresh and append-only upgrade pointer commits.
+- StaticProbeWorker exited `0`; all 38 named cases reported `True`, including
+  unsafe selector root/leaf/JSON/generation rejection.
+- UninstallBootstrap exited `0` with
+  `Uninstall bootstrap self-tests passed: 14`.
+- PersistenceIO exited `0`; all 24 named cases reported `True`.
+- UiPreferences exited `0`; all 9 named cases reported `PASS`.
+- Explicit PowerShell parser checks passed for all 12 changed `.ps1`/`.psm1`
+  files (`PARSER_COUNT=12`).
+- `git diff --check` exited `0`; it emitted only checkout LF-to-CRLF warnings.
+- Aggregate command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\PersistenceSelfTest.ps1`
+  exited `0`; after expanding the forced-V3-reimport denial matrix, the final
+  aggregate rerun also exited `0`. Both aggregate runs emitted no stdout/stderr
+  result text.
+
+### Recovered behavior and boundaries
+
+- `Open-CcodInstallStateTransaction` is ABI V4 and can traverse only
+  root-to-`state` directories and publish create-only state records. It cannot
+  create/open/mutate a generation, copy payload bytes, write a generation
+  manifest, select a retained generation, commit an active pointer, or retire
+  a generation.
+- `Invoke-CcodInstall` distinguishes only the exact recoverable
+  `ProtectionReady` head from other nonterminal transactions. It revalidates
+  immutable transaction identity, the exact append-only active runtime and
+  generation, the recorded new-manifest SHA-256, the current runtime manifest,
+  and exactly one matching Ready activation receipt before and after opening
+  the state-only capability.
+- Recovery occurs before source validation and performs no install, task,
+  process, pointer, log, activation-receipt, or Failed write. A proof mismatch
+  returns `CCOD_INSTALL_READY_RECOVERY_INVALID`; a state-only append failure
+  remains retryable as `CCOD_INSTALL_READY_FINALIZATION_PENDING`.
+- Selector readers in Bootstrap, StaticProbeWorker, and UninstallBootstrap
+  reject a non-directory selector root and unsafe, malformed, duplicate,
+  non-integral, or noncanonical leaves. Legacy `active.json` fallback remains
+  available only when the append-only root is absent.
+- No push, tag, release, build, installation, product-process action,
+  WindowsApps access, DPAPI access, or external write was performed.
+
+### Remaining concerns
+
+- The documented current-user ordinary-race boundary is unchanged; this is not
+  a sandbox against unrestricted same-user or in-process code.
+- Failed and superseded immutable generations remain retained until the
+  separately proven reclamation path runs.
diff --git a/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md b/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
index 99269f6..b59c532 100644
--- a/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
+++ b/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
@@ -114,6 +114,7 @@ Required operations are create-only:
 
 ```powershell
 Open-CcodInstallGeneration -InstallRoot <absolute-root> -RuntimeId <unique-id>
+Open-CcodInstallStateTransaction -InstallRoot <absolute-root>
 Open-CcodInstallRetainedGeneration -InstallRoot <absolute-root> -RuntimeId <existing-id> -ExpectedManifestSha256 <hex>
 New-CcodInstallDirectory -Transaction <opaque-context> -Parent <opaque-directory> -Leaf <single-segment> [-CreateIfMissing]
 New-CcodInstallGenerationLeaf -Generation <opaque-generation> -Leaf <single-segment>
@@ -125,6 +126,14 @@ Retire-CcodInstallGeneration -InstallRoot <absolute-root> -RuntimeId <owned-id>
 Close-CcodInstallFileTransaction -Transaction <opaque-context> -Disposition Ready|Failed
 ```
 
+`Open-CcodInstallStateTransaction` is an opaque state-only capability for a
+bounded recovery record after an interrupted terminalization. It can compose
+only the install-root `state` directories and create-only records; it cannot
+create a runtime generation, copy a payload, write a manifest, open a retained
+generation, or commit a pointer. A recovery uses it only after revalidating the
+already committed pointer, generation manifest, Ready receipt, and transaction
+identity.
+
 `Retire-CcodInstallGeneration` removes a generation from the active selection by
 one create-only retired-generation record; it does not rename or recursively
 delete the nonempty directory. Physical reclamation is a later operation that
diff --git a/src/persistence/StaticProbeWorker.ps1 b/src/persistence/StaticProbeWorker.ps1
index 4e63d37..fd25ee5 100644
--- a/src/persistence/StaticProbeWorker.ps1
+++ b/src/persistence/StaticProbeWorker.ps1
@@ -443,6 +443,15 @@ function Get-CcodStaticFileSha256 {
     }finally{$sha.Dispose()}
 }
 
+function Assert-CcodStaticSelectorFile {
+    param([string]$InstallRoot,[string]$Path,[hashtable]$Adapters)
+    Assert-CcodStaticProbeNoReparse $InstallRoot $Path -Adapters $Adapters
+    try{$item=Get-Item -LiteralPath $Path -Force -ErrorAction Stop;if($item.PSIsContainer-or$item-isnot[IO.FileInfo]){throw'not file'};$streams=@(Get-Item -LiteralPath $Path -Stream * -ErrorAction Stop);if($streams.Count-ne1-or[string]$streams[0].Stream-cne':$DATA'){throw'stream'};if($null-eq('CcodStaticSelectorIdentity' -as[type])){Add-Type -TypeDefinition @'
+using System; using System.ComponentModel; using System.IO; using System.Runtime.InteropServices; using Microsoft.Win32.SafeHandles;
+public static class CcodStaticSelectorIdentity { [StructLayout(LayoutKind.Sequential)] struct I { public uint A; public System.Runtime.InteropServices.ComTypes.FILETIME C,X,W; public uint V,H,L,N,Ih,Il; } [DllImport("kernel32.dll",SetLastError=true)] static extern bool GetFileInformationByHandle(SafeFileHandle h,out I i); public static uint Links(string p){using(FileStream s=new FileStream(p,FileMode.Open,FileAccess.Read,FileShare.Read)){I i;if(!GetFileInformationByHandle(s.SafeFileHandle,out i))throw new Win32Exception(Marshal.GetLastWin32Error());return i.N;}} }
+'@};if([CcodStaticSelectorIdentity]::Links($Path)-ne1){throw'links'}}catch{Throw-CcodStaticProbeError 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Active selector leaf is unsafe' $Path}
+}
+
 function Get-CcodStaticProbeRuntimeAuthorization {
     [CmdletBinding()]
     param([Parameter(Mandatory)][string]$ScriptPath,[hashtable]$Adapters)
@@ -454,9 +463,11 @@ function Get-CcodStaticProbeRuntimeAuthorization {
         $installRoot=[IO.Path]::GetFullPath($installRoot);$runtimeRoot=[IO.Path]::GetFullPath($runtimeRoot)
         Assert-CcodStaticProbeNoReparse -Root $installRoot -Path $ScriptPath -Adapters $Adapters
         $pointerRoot=[IO.Path]::GetFullPath((Join-Path $installRoot 'state\active-generation'))
-        if([IO.Directory]::Exists($pointerRoot)){
+        $pointerRootItem=$null;try{$pointerRootItem=Get-Item -LiteralPath $pointerRoot -Force -ErrorAction Stop}catch{}
+        if($null-ne$pointerRootItem-and-not$pointerRootItem.PSIsContainer){throw 'selector root type'}
+        if($null-ne$pointerRootItem){
             Assert-CcodStaticProbeNoReparse $installRoot $pointerRoot -Adapters $Adapters;$entries=@(Get-ChildItem -LiteralPath $pointerRoot -Force -ErrorAction Stop);if($entries.Count-eq0){throw 'empty active chain'};$records=[Collections.Generic.List[object]]::new()
-            foreach($entry in $entries){if($entry.PSIsContainer-or$entry.Name-cnotmatch'^\d{20}\.json$'){throw 'active entry'};Assert-CcodStaticProbeNoReparse $installRoot $entry.FullName -Adapters $Adapters;$record=Read-CcodStaticProbeLocalJson $entry.FullName;Assert-CcodStaticExactObject $record @('schemaVersion','generation','activeRuntime','previousGeneration') 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Active generation'|Out-Null;if($record.schemaVersion-isnot[int]-or$record.generation-isnot[long]-and$record.generation-isnot[int]-or$record.previousGeneration-isnot[long]-and$record.previousGeneration-isnot[int]-or-not(Test-CcodStaticRuntimeId $record.activeRuntime)){throw 'active generation'};[uint64]$generation=$record.generation;[uint64]$previousGeneration=$record.previousGeneration;if($generation-ne($previousGeneration+1)-or$entry.Name-cne('{0:D20}.json'-f$generation)){throw 'active generation canonical'};$records.Add([pscustomobject]@{generation=$generation;previousGeneration=$previousGeneration;activeRuntime=[string]$record.activeRuntime;path=$entry.FullName})}
+            foreach($entry in $entries){if($entry.PSIsContainer-or$entry.Name-cnotmatch'^\d{20}\.json$'){throw 'active entry'};Assert-CcodStaticSelectorFile $installRoot $entry.FullName $Adapters;$record=Read-CcodStaticProbeLocalJson $entry.FullName;Assert-CcodStaticExactObject $record @('schemaVersion','generation','activeRuntime','previousGeneration') 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Active generation'|Out-Null;if($record.schemaVersion-isnot[int]-or$record.generation-isnot[long]-and$record.generation-isnot[int]-or$record.previousGeneration-isnot[long]-and$record.previousGeneration-isnot[int]-or-not(Test-CcodStaticRuntimeId $record.activeRuntime)){throw 'active generation'};try{[uint64]$generation=$record.generation;[uint64]$previousGeneration=$record.previousGeneration}catch{throw 'active generation range'};if($generation-eq0-or$previousGeneration-eq[uint64]::MaxValue-or$generation-ne($previousGeneration+1)-or$entry.Name-cne('{0:D20}.json'-f$generation)){throw 'active generation canonical'};$records.Add([pscustomobject]@{generation=$generation;previousGeneration=$previousGeneration;activeRuntime=[string]$record.activeRuntime;path=$entry.FullName})}
             $ordered=@($records|Sort-Object generation);for($i=0;$i-lt$ordered.Count;$i++){if([uint64]$ordered[$i].generation-ne[uint64]($i+1)-or[uint64]$ordered[$i].previousGeneration-ne[uint64]$i){throw 'active chain'}};$latest=$ordered[-1];$active=[pscustomobject]@{activeRuntime=$latest.activeRuntime};$activePath=$latest.path
         }else{$activePath=[IO.Path]::GetFullPath((Join-Path $installRoot 'active.json'));Assert-CcodStaticProbeNoReparse $installRoot $activePath -Adapters $Adapters;$active=Read-CcodStaticProbeLocalJson $activePath;Assert-CcodStaticExactObject $active @('schemaVersion','activeRuntime','previousRuntime','updatedAtUtc') 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Active pointer'|Out-Null;if($active.schemaVersion -isnot [int] -or $active.schemaVersion -ne 1 -or -not(Test-CcodStaticRuntimeId $active.activeRuntime) -or($null -ne $active.previousRuntime -and (-not(Test-CcodStaticRuntimeId $active.previousRuntime) -or $active.previousRuntime -ceq $active.activeRuntime)) -or-not(Test-CcodStaticCanonicalUtc $active.updatedAtUtc)){throw 'active pointer'}}
         if($active.activeRuntime-cne$runtimeId){throw 'active runtime'}
diff --git a/src/persistence/UninstallBootstrap.ps1 b/src/persistence/UninstallBootstrap.ps1
index 6f2c008..ea70a76 100644
--- a/src/persistence/UninstallBootstrap.ps1
+++ b/src/persistence/UninstallBootstrap.ps1
@@ -199,6 +199,11 @@ function Read-CcodUninstallBootstrapJson {
     try {
         $item = Get-Item -LiteralPath $Path -Force -ErrorAction Stop
         if ($item.PSIsContainer -or $item -isnot [IO.FileInfo] -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0 -or $item.Length -lt 1 -or $item.Length -gt $MaximumBytes) { throw 'invalid file' }
+        $streams=@(Get-Item -LiteralPath $Path -Stream * -ErrorAction Stop);if($streams.Count-ne1-or[string]$streams[0].Stream-cne':$DATA'){throw 'alternate stream'}
+        if($null-eq('CcodUninstallSelectorIdentity' -as[type])){Add-Type -TypeDefinition @'
+using System; using System.ComponentModel; using System.IO; using System.Runtime.InteropServices; using Microsoft.Win32.SafeHandles;
+public static class CcodUninstallSelectorIdentity { [StructLayout(LayoutKind.Sequential)] struct I { public uint A; public System.Runtime.InteropServices.ComTypes.FILETIME C,X,W; public uint V,H,L,N,Ih,Il; } [DllImport("kernel32.dll",SetLastError=true)] static extern bool GetFileInformationByHandle(SafeFileHandle h,out I i); public static uint Links(string p){using(FileStream s=new FileStream(p,FileMode.Open,FileAccess.Read,FileShare.Read)){I i;if(!GetFileInformationByHandle(s.SafeFileHandle,out i))throw new Win32Exception(Marshal.GetLastWin32Error());return i.N;}} }
+'@};if([CcodUninstallSelectorIdentity]::Links($Path)-ne1){throw 'multi-link'}
         $json = [IO.File]::ReadAllText($Path,[Text.UTF8Encoding]::new($false,$true))
         if (-not (Test-CcodUninstallBootstrapJsonHasNoDuplicateProperties $json)) { throw 'duplicate JSON properties' }
         $value = $json | ConvertFrom-Json -ErrorAction Stop
@@ -363,10 +368,12 @@ function Get-CcodUninstallBootstrapVerifiedRuntimeContext {
         if ([string]::IsNullOrWhiteSpace($PSCommandPath) -or (Get-CcodUninstallBootstrapFullPath -Path $PSCommandPath -Kind 'Bootstrap script') -cne $expectedScript) {
             Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'The uninstall bootstrap was not launched from the installed application root' $PSCommandPath
         }
-        $pointerRoot=Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath 'state\active-generation' -AllowMissingLeaf
-        if([IO.Directory]::Exists($pointerRoot)){
+        try{$pointerRoot=Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath 'state\active-generation' -AllowMissingLeaf}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active generation selector root is unsafe' $install}
+        $pointerRootItem=$null;try{$pointerRootItem=Get-Item -LiteralPath $pointerRoot -Force -ErrorAction Stop}catch{}
+        if($null-ne$pointerRootItem-and-not$pointerRootItem.PSIsContainer){throw 'selector root type'}
+        if($null-ne$pointerRootItem){
             $entries=@(Get-ChildItem -LiteralPath $pointerRoot -Force -ErrorAction Stop);if($entries.Count-eq0){throw 'empty selector'};$records=[Collections.Generic.List[object]]::new()
-            foreach($entry in $entries){if($entry.PSIsContainer-or$entry.Name-cnotmatch'^\d{20}\.json$'){throw 'selector entry'};$path=Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath ('state\active-generation\'+$entry.Name) -RequireLeafFile;$record=Read-CcodUninstallBootstrapJson -Path $path -Kind 'Active generation';if(-not(Test-CcodUninstallBootstrapExactProperties $record @('schemaVersion','generation','activeRuntime','previousGeneration'))-or$record.schemaVersion-isnot[int]-or$record.schemaVersion-ne1-or$record.activeRuntime-isnot[string]-or$record.activeRuntime-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$'){throw 'selector record'};[uint64]$g=ConvertTo-CcodUninstallBootstrapUInt64 $record.generation 'active generation';[uint64]$p=[uint64]$record.previousGeneration;if($g-ne($p+1)-or$entry.Name-cne('{0:D20}.json'-f$g)){throw 'selector canonical'};$records.Add([pscustomobject]@{generation=$g;previousGeneration=$p;activeRuntime=[string]$record.activeRuntime})}
+            foreach($entry in $entries){if($entry.PSIsContainer-or$entry.Name-cnotmatch'^\d{20}\.json$'){throw 'selector entry'};try{$path=Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath ('state\active-generation\'+$entry.Name) -RequireLeafFile;$record=Read-CcodUninstallBootstrapJson -Path $path -Kind 'Active generation'}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active generation selector leaf is unsafe' $entry.FullName};$integerTypes=@([byte],[uint16],[uint32],[uint64],[int16],[int32],[int64]);$gType=$false;$pType=$false;foreach($t in $integerTypes){if($record.generation-is$t){$gType=$true};if($record.previousGeneration-is$t){$pType=$true}};if(-not(Test-CcodUninstallBootstrapExactProperties $record @('schemaVersion','generation','activeRuntime','previousGeneration'))-or$record.schemaVersion-isnot[int]-or$record.schemaVersion-ne1-or-not$gType-or-not$pType-or$record.activeRuntime-isnot[string]-or$record.activeRuntime-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$'){throw 'selector record'};[uint64]$g=ConvertTo-CcodUninstallBootstrapUInt64 $record.generation 'active generation';[uint64]$p=[uint64]$record.previousGeneration;if($p-eq[uint64]::MaxValue-or$g-ne($p+1)-or$entry.Name-cne('{0:D20}.json'-f$g)){throw 'selector canonical'};$records.Add([pscustomobject]@{generation=$g;previousGeneration=$p;activeRuntime=[string]$record.activeRuntime})}
             $ordered=@($records|Sort-Object generation);for($i=0;$i-lt$ordered.Count;$i++){if([uint64]$ordered[$i].generation-ne[uint64]($i+1)-or[uint64]$ordered[$i].previousGeneration-ne[uint64]$i){throw 'selector chain'}};$latest=$ordered[-1];$active=[pscustomobject]@{activeRuntime=$latest.activeRuntime};$generation=[uint64]$latest.generation
         }else{$activePath = Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath 'active.json' -RequireLeafFile;$active = Read-CcodUninstallBootstrapJson -Path $activePath -Kind 'Active runtime pointer';if (-not (Test-CcodUninstallBootstrapExactProperties $active @('schemaVersion','activeRuntime','previousRuntime','generation','updatedAtUtc')) -or$active.schemaVersion -isnot [int] -or $active.schemaVersion -ne 2 -or$active.activeRuntime -isnot [string] -or $active.activeRuntime -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$' -or($null -ne $active.previousRuntime -and ($active.previousRuntime -isnot [string] -or $active.previousRuntime -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$')) -or-not (Test-CcodUninstallBootstrapCanonicalUtc $active.updatedAtUtc)){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active runtime pointer is invalid' $activePath};$generation = ConvertTo-CcodUninstallBootstrapUInt64 $active.generation 'active runtime generation'}
         $runtimeRoot = Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath ('runtime\' + $active.activeRuntime)
diff --git a/src/persistence/bootstrap.ps1 b/src/persistence/bootstrap.ps1
index 39ef577..4893b28 100644
--- a/src/persistence/bootstrap.ps1
+++ b/src/persistence/bootstrap.ps1
@@ -94,6 +94,23 @@ function Get-CcodBootstrapCanonicalRoot {
     return $root
 }
 
+function Skip-CcodBootstrapJsonWhitespace {param([string]$Text,[ref]$Index)while($Index.Value-lt$Text.Length-and($Text[$Index.Value]-eq' '-or$Text[$Index.Value]-eq"`t"-or$Text[$Index.Value]-eq"`r"-or$Text[$Index.Value]-eq"`n")){$Index.Value++}}
+function Read-CcodBootstrapJsonStringToken {param([string]$Text,[ref]$Index)if($Index.Value-ge$Text.Length-or$Text[$Index.Value]-ne'"'){throw'json string'};$start=$Index.Value;$Index.Value++;while($Index.Value-lt$Text.Length){$c=$Text[$Index.Value];if($c-eq'"'){$Index.Value++;return $Text.Substring($start,$Index.Value-$start)};if([int][char]$c-lt0x20){throw'json control'};if($c-eq'\'){$Index.Value++;if($Index.Value-ge$Text.Length){throw'json escape'};$escape=$Text[$Index.Value];if($escape-eq'u'){if($Index.Value+4-ge$Text.Length-or$Text.Substring($Index.Value+1,4)-cnotmatch'^[0-9A-Fa-f]{4}$'){throw'json unicode'};$Index.Value+=5;continue};if('"\/bfnrt'.IndexOf($escape)-lt0){throw'json escape'}};$Index.Value++};throw'json string end'}
+function Read-CcodBootstrapJsonValue {
+    param([string]$Text,[ref]$Index)
+    Skip-CcodBootstrapJsonWhitespace $Text $Index
+    if($Index.Value-ge$Text.Length){throw'json value'}
+    if($Text[$Index.Value]-eq'{'){
+        $Index.Value++;Skip-CcodBootstrapJsonWhitespace $Text $Index;$keys=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+        if($Index.Value-lt$Text.Length-and$Text[$Index.Value]-eq'}'){$Index.Value++;return}
+        while($true){$encoded=Read-CcodBootstrapJsonStringToken $Text $Index;$key=$encoded|ConvertFrom-Json -ErrorAction Stop;if($key-isnot[string]-or-not$keys.Add($key)){throw'json duplicate'};Skip-CcodBootstrapJsonWhitespace $Text $Index;if($Index.Value-ge$Text.Length-or$Text[$Index.Value]-ne':'){throw'json separator'};$Index.Value++;Read-CcodBootstrapJsonValue $Text $Index;Skip-CcodBootstrapJsonWhitespace $Text $Index;if($Index.Value-ge$Text.Length){throw'json end'};if($Text[$Index.Value]-eq'}'){$Index.Value++;return};if($Text[$Index.Value]-ne','){throw'json delimiter'};$Index.Value++;Skip-CcodBootstrapJsonWhitespace $Text $Index}
+    }
+    if($Text[$Index.Value]-eq'['){$Index.Value++;Skip-CcodBootstrapJsonWhitespace $Text $Index;if($Index.Value-lt$Text.Length-and$Text[$Index.Value]-eq']'){$Index.Value++;return};while($true){Read-CcodBootstrapJsonValue $Text $Index;Skip-CcodBootstrapJsonWhitespace $Text $Index;if($Index.Value-ge$Text.Length){throw'json array end'};if($Text[$Index.Value]-eq']'){$Index.Value++;return};if($Text[$Index.Value]-ne','){throw'json array delimiter'};$Index.Value++}}
+    if($Text[$Index.Value]-eq'"'){[void](Read-CcodBootstrapJsonStringToken $Text $Index);return}
+    $start=$Index.Value;$delimiters=",]} `t`r`n";while($Index.Value-lt$Text.Length-and$delimiters.IndexOf([string]$Text[$Index.Value])-lt0){$Index.Value++};if($Index.Value-eq$start){throw'json scalar'}
+}
+function Assert-CcodBootstrapJsonNoDuplicateKeys {param([string]$Text)$index=0;Read-CcodBootstrapJsonValue $Text ([ref]$index);Skip-CcodBootstrapJsonWhitespace $Text ([ref]$index);if($index-ne$Text.Length){throw'json trailing'}}
+
 function Read-CcodBootstrapJson {
     param(
         [Parameter(Mandatory)][string]$Path,
@@ -105,7 +122,9 @@ function Read-CcodBootstrapJson {
     }
     $value = $null
     try {
-        $value = ([IO.File]::ReadAllText($Path) | ConvertFrom-Json)
+        $item=Get-Item -LiteralPath $Path -Force -ErrorAction Stop;if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0-or$item.Length-lt1-or$item.Length-gt1048576){throw'invalid file'}
+        $text=[Text.UTF8Encoding]::new($false,$true).GetString([IO.File]::ReadAllBytes($Path));Assert-CcodBootstrapJsonNoDuplicateKeys $text
+        $value = ($text | ConvertFrom-Json -ErrorAction Stop)
     } catch {
         Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_STATE_MALFORMED' "$Kind is malformed" $Path
     }
@@ -148,8 +167,10 @@ function Assert-CcodBootstrapPlainSelectorFile {
 function Read-CcodBootstrapActivePointer {
     param([Parameter(Mandatory)][string]$InstallRoot)
 
-    $pointerRoot=Assert-CcodBootstrapContained -Root $InstallRoot -Path (Join-Path $InstallRoot 'state\active-generation') -AllowMissingLeaf
-    if([IO.Directory]::Exists($pointerRoot)){
+    try{$pointerRoot=Assert-CcodBootstrapContained -Root $InstallRoot -Path (Join-Path $InstallRoot 'state\active-generation') -AllowMissingLeaf}catch{Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector root is unsafe' (Join-Path $InstallRoot 'state\active-generation')}
+    $pointerRootItem=$null;try{$pointerRootItem=Get-Item -LiteralPath $pointerRoot -Force -ErrorAction Stop}catch{}
+    if($null-ne$pointerRootItem-and-not$pointerRootItem.PSIsContainer){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector root is not a directory' $pointerRoot}
+    if($null-ne$pointerRootItem){
         if(Test-CcodBootstrapReparse $pointerRoot){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector root is a reparse point' $pointerRoot}
         $entries=@(Get-ChildItem -LiteralPath $pointerRoot -Force -ErrorAction Stop)
         if($entries.Count-eq0){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector is empty' $pointerRoot}
@@ -157,7 +178,7 @@ function Read-CcodBootstrapActivePointer {
         foreach($entry in $entries){
             if($entry.PSIsContainer-or$entry.Name-cnotmatch'^\d{20}\.json$'){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector contains an unknown entry' $entry.FullName}
             Assert-CcodBootstrapPlainSelectorFile $entry.FullName
-            $record=Read-CcodBootstrapJson -Path $entry.FullName -Kind 'active generation selector'
+            try{$record=Read-CcodBootstrapJson -Path $entry.FullName -Kind 'active generation selector'}catch{Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector JSON is invalid' $entry.FullName}
             $names=@($record.PSObject.Properties.Name)
             if(($names-join',')-cne'schemaVersion,generation,activeRuntime,previousGeneration'-or$record.schemaVersion-isnot[int]-or$record.schemaVersion-ne1-or$record.activeRuntime-isnot[string]){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector fields are invalid' $entry.FullName}
             $integerTypes=@([byte],[uint16],[uint32],[uint64],[int16],[int32],[int64]);$gOk=$false;$pOk=$false;foreach($t in $integerTypes){if($record.generation-is$t){$gOk=$true};if($record.previousGeneration-is$t){$pOk=$true}}
diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index c8a349a..194e887 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -9,7 +9,7 @@ function Throw-CcodInstallFileError {
 }
 
 function Initialize-CcodInstallRuntime {
-    $marker = 'CcodInstallGenerationCapabilityMarkerV3' -as [type]
+    $marker = 'CcodInstallGenerationCapabilityMarkerV4' -as [type]
     if ($null -eq $marker) {
         Add-Type -TypeDefinition @'
 using System;
@@ -22,13 +22,13 @@ using System.Security.Cryptography;
 using System.Text;
 using Microsoft.Win32.SafeHandles;
 
-public sealed class CcodInstallGenerationCapabilityMarkerV3
+public sealed class CcodInstallGenerationCapabilityMarkerV4
 {
-    private CcodInstallGenerationCapabilityMarkerV3() { }
-    public static int CapabilityAbi { get { return 3; } }
+    private CcodInstallGenerationCapabilityMarkerV4() { }
+    public static int CapabilityAbi { get { return 4; } }
 }
 
-internal sealed class CcodInstallGenerationRuntimeV3 : IDisposable
+internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
 {
     private const uint READ = 0x80000000, WRITE = 0x40000000, DELETE = 0x00010000, SYNC = 0x00100000;
     private const uint READ_ATTRIBUTES = 0x80, WRITE_ATTRIBUTES = 0x100, LIST_DIRECTORY = 0x1, ADD_FILE = 0x2, ADD_SUBDIRECTORY = 0x4;
@@ -83,10 +83,11 @@ internal sealed class CcodInstallGenerationRuntimeV3 : IDisposable
     private readonly List<FileStream> externalStreams = new List<FileStream>();
     private bool disposed; private string cleanupError;
 
-    private CcodInstallGenerationRuntimeV3(string installRoot,Pin root,Pin runtimeParent)
-    { this.installRoot=installRoot;this.root=root;this.runtimeParent=runtimeParent;AddPin(root);AddPin(runtimeParent); }
+    private readonly bool stateOnly;
+    private CcodInstallGenerationRuntimeV4(string installRoot,Pin root,Pin runtimeParent,bool stateOnly)
+    { this.installRoot=installRoot;this.root=root;this.runtimeParent=runtimeParent;this.stateOnly=stateOnly;AddPin(root);if(runtimeParent!=null)AddPin(runtimeParent); }
 
-    internal static object Open(string path,string runtimeId,out CcodInstallGenerationRuntimeV3 runtime)
+    internal static object Open(string path,string runtimeId,out CcodInstallGenerationRuntimeV4 runtime)
     {
         runtime=null;string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle rootHandle=OpenAbsoluteDirectory(full,true);Pin rootPin=null,runtimePin=null;
         try
@@ -101,23 +102,33 @@ internal sealed class CcodInstallGenerationRuntimeV3 : IDisposable
             try
             {
                 Pin generation=ValidateDirectoryPin(runtimePin,runtimeId,Path.Combine(runtimePin.Path,runtimeId),true,generationResult.Handle);generationResult.Handle=null;
-                runtime=new CcodInstallGenerationRuntimeV3(full,rootPin,runtimePin);rootPin=null;runtimePin=null;runtime.AddPin(generation);return generation.Token;
+                runtime=new CcodInstallGenerationRuntimeV4(full,rootPin,runtimePin,false);rootPin=null;runtimePin=null;runtime.AddPin(generation);return generation.Token;
             }
             finally { if(generationResult.Handle!=null)generationResult.Handle.Dispose(); }
         }
         catch { if(runtimePin!=null)runtimePin.Dispose();if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw; }
     }
 
+    internal static object OpenState(string path,out CcodInstallGenerationRuntimeV4 runtime)
+    {
+        runtime=null;string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle rootHandle=OpenAbsoluteDirectory(full,true);Pin rootPin=null;
+        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;runtime=new CcodInstallGenerationRuntimeV4(full,rootPin,null,true);rootPin=null;return runtime.root.Token;}
+        catch{if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw;}
+    }
+
+    private bool IsStateScope(Pin pin){for(Pin cursor=pin;cursor!=null;cursor=cursor.Parent)if(Object.ReferenceEquals(cursor.Parent,root)&&String.Equals(cursor.Leaf,"state",StringComparison.Ordinal))return true;return false;}
+    private void RequireStateDirectory(Pin parent,string leaf){if(!stateOnly)return;if(Object.ReferenceEquals(parent,root)){if(!String.Equals(leaf,"state",StringComparison.Ordinal))throw new InvalidOperationException("state-only scope");return;}if(!IsStateScope(parent))throw new InvalidOperationException("state-only scope");}
+
     [MethodImpl(MethodImplOptions.Synchronized)] internal object CreateDirectory(object parentToken,string leaf)
     {
-        Pin parent=Require(parentToken,true);ValidateCurrent(parent);OpenResult result=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ|SHARE_WRITE,CREATE,DIRECTORY|BACKUP_INTENT);
+        Pin parent=Require(parentToken,true);ValidateCurrent(parent);RequireStateDirectory(parent,leaf);OpenResult result=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|DELETE|SYNC,SHARE_READ|SHARE_WRITE,CREATE,DIRECTORY|BACKUP_INTENT);
         try { Pin pin=ValidateDirectoryPin(parent,leaf,Path.Combine(parent.Path,leaf),true,result.Handle);result.Handle=null;AddPin(pin);return pin.Token; }
         finally { if(result.Handle!=null)result.Handle.Dispose(); }
     }
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object OpenDirectory(object parentToken,string leaf,bool createIfMissing)
     {
-        Pin parent=Require(parentToken,true);ValidateCurrent(parent);Pin known;if(names.TryGetValue(Key(parent,leaf),out known)){ValidateCurrent(known);if(retainedScopes.Contains(parentToken)||retainedRoots.Contains(known.Token))MarkRetainedTree(known);return known.Token;}OpenResult result;
+        Pin parent=Require(parentToken,true);ValidateCurrent(parent);RequireStateDirectory(parent,leaf);Pin known;if(names.TryGetValue(Key(parent,leaf),out known)){ValidateCurrent(known);if(retainedScopes.Contains(parentToken)||retainedRoots.Contains(known.Token))MarkRetainedTree(known);return known.Token;}OpenResult result;
         if(createIfMissing){try{result=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,CREATE,DIRECTORY|BACKUP_INTENT);}catch(Win32Exception exception){if(exception.NativeErrorCode!=80&&exception.NativeErrorCode!=183)throw;result=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);}}
         else result=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);
         try{Pin pin=ValidateDirectoryPin(parent,leaf,Path.Combine(parent.Path,leaf),result.Created,result.Handle);result.Handle=null;AddPin(pin);if(retainedScopes.Contains(parentToken))retainedScopes.Add(pin.Token);return pin.Token;}finally{if(result.Handle!=null)result.Handle.Dispose();}
@@ -128,7 +139,7 @@ internal sealed class CcodInstallGenerationRuntimeV3 : IDisposable
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object OpenRetained(string runtimeId,string expectedManifestSha)
     {
-        if(disposed)throw new ObjectDisposedException("transaction");Pin existing;if(names.TryGetValue(Key(runtimeParent,runtimeId),out existing)){if(!retainedRoots.Contains(existing.Token))throw new InvalidDataException("retained generation already scoped");ValidateRetainedTree(existing);return new object[]{existing.Token,ValidateRetainedManifest(existing,expectedManifestSha)};}OpenResult result=OpenRelative(runtimeParent.Native,runtimeId,LIST_DIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);List<Pin> added=new List<Pin>();
+        if(stateOnly)throw new InvalidOperationException("state-only scope");if(disposed)throw new ObjectDisposedException("transaction");Pin existing;if(names.TryGetValue(Key(runtimeParent,runtimeId),out existing)){if(!retainedRoots.Contains(existing.Token))throw new InvalidDataException("retained generation already scoped");ValidateRetainedTree(existing);return new object[]{existing.Token,ValidateRetainedManifest(existing,expectedManifestSha)};}OpenResult result=OpenRelative(runtimeParent.Native,runtimeId,LIST_DIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);List<Pin> added=new List<Pin>();
         try
         {
             Pin candidate=ValidateDirectoryPin(runtimeParent,runtimeId,Path.Combine(runtimeParent.Path,runtimeId),false,result.Handle);result.Handle=null;Pin generation;if(names.TryGetValue(Key(runtimeParent,runtimeId),out generation)){candidate.Dispose();}else{generation=candidate;AddPin(generation);added.Add(generation);}OpenRetainedTree(generation,added);
@@ -140,7 +151,7 @@ internal sealed class CcodInstallGenerationRuntimeV3 : IDisposable
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object Copy(object parentToken,string leaf,string source,long expectedLength,string expectedSha)
     {
-        Pin parent=Require(parentToken,true);ValidateCurrent(parent);string full=Path.GetFullPath(source);
+        if(stateOnly)throw new InvalidOperationException("state-only scope");Pin parent=Require(parentToken,true);ValidateCurrent(parent);string full=Path.GetFullPath(source);
         SafeFileHandle sourceHandle=CreateFileW(full,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,IntPtr.Zero,OPEN_EXISTING,FLAG_REPARSE,IntPtr.Zero);
         if(sourceHandle.IsInvalid)throw new Win32Exception(Marshal.GetLastWin32Error());FileStream sourceStream=null;
         try
@@ -157,19 +168,19 @@ internal sealed class CcodInstallGenerationRuntimeV3 : IDisposable
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object Write(object parentToken,string leaf,byte[] bytes,bool manifest)
     {
-        Pin parent=Require(parentToken,true);ValidateCurrent(parent);Pin pin=CreateTemporaryFile(parent);pin.Stream.Write(bytes,0,bytes.Length);pin.Stream.Flush(true);string sha=Sha(pin.Stream);if(pin.Stream.Length!=bytes.LongLength)throw new InvalidDataException("destination mismatch");SealAndPublish(pin,leaf,bytes.LongLength,sha,manifest);return pin.Token;
+        Pin parent=Require(parentToken,true);ValidateCurrent(parent);if(stateOnly&&(manifest||!IsStateScope(parent)))throw new InvalidOperationException("state-only scope");Pin pin=CreateTemporaryFile(parent);pin.Stream.Write(bytes,0,bytes.Length);pin.Stream.Flush(true);string sha=Sha(pin.Stream);if(pin.Stream.Length!=bytes.LongLength)throw new InvalidDataException("destination mismatch");SealAndPublish(pin,leaf,bytes.LongLength,sha,manifest);return pin.Token;
     }
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object CommitPointer(object generationToken,ulong previousGeneration,string runtimeId,byte[] bytes)
     {
-        Pin generation=Require(generationToken,true);ValidateCurrent(generation);if(!Object.ReferenceEquals(generation.Parent,runtimeParent)||!String.Equals(generation.Leaf,runtimeId,StringComparison.Ordinal))throw new InvalidDataException("transaction scope");
+        if(stateOnly)throw new InvalidOperationException("state-only scope");Pin generation=Require(generationToken,true);ValidateCurrent(generation);if(!Object.ReferenceEquals(generation.Parent,runtimeParent)||!String.Equals(generation.Leaf,runtimeId,StringComparison.Ordinal))throw new InvalidDataException("transaction scope");
         if(retainedRoots.Contains(generationToken))ValidateRetainedTree(generation);else{Pin manifest=null;if(!names.TryGetValue(Key(generation,"manifest.json"),out manifest)||!manifest.Manifest||!manifest.Sealed)throw new InvalidDataException("manifest missing");EnsurePublishedPin(manifest);ValidateOwnedTree(generation);}
         if(previousGeneration==UInt64.MaxValue)throw new OverflowException("pointer generation overflow");Pin state=OpenOrCreateDirectory(root,"state"),pointer=OpenOrCreateDirectory(state,"active-generation");if(CurrentPointerGeneration(pointer)!=previousGeneration)throw new InvalidOperationException("pointer generation exists");string leaf=(previousGeneration+1).ToString("D20")+".json";return Write(pointer.Token,leaf,bytes,false);
     }
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object Retire(object generationToken,string runtimeId,string recordLeaf,byte[] record)
     {
-        Pin generation=Require(generationToken,true);ValidateCurrent(generation);if(!Object.ReferenceEquals(generation.Parent,runtimeParent)||!String.Equals(generation.Leaf,runtimeId,StringComparison.Ordinal)||!generation.Owned)throw new InvalidDataException("generation not owned");
+        if(stateOnly)throw new InvalidOperationException("state-only scope");Pin generation=Require(generationToken,true);ValidateCurrent(generation);if(!Object.ReferenceEquals(generation.Parent,runtimeParent)||!String.Equals(generation.Leaf,runtimeId,StringComparison.Ordinal)||!generation.Owned)throw new InvalidDataException("generation not owned");
         ValidateOwnedTree(generation);Pin state=OpenOrCreateDirectory(root,"state"),retirements=OpenOrCreateDirectory(state,"retired-generations");Write(retirements.Token,recordLeaf,record,false);return generation.Token;
     }
 
@@ -246,10 +257,10 @@ internal sealed class CcodInstallGenerationRuntimeV3 : IDisposable
     private static int Rename(SafeFileHandle source,SafeFileHandle parent,string destination){byte[] name=Encoding.Unicode.GetBytes(destination);int rootOffset=IntPtr.Size,lengthOffset=rootOffset+IntPtr.Size,nameOffset=lengthOffset+4,size=nameOffset+name.Length+2;IntPtr buffer=Marshal.AllocHGlobal(size);bool parentAdded=false,sourceAdded=false;try{source.DangerousAddRef(ref sourceAdded);parent.DangerousAddRef(ref parentAdded);for(int i=0;i<size;i++)Marshal.WriteByte(buffer,i,0);Marshal.WriteByte(buffer,0,0);Marshal.WriteIntPtr(buffer,rootOffset,parent.DangerousGetHandle());Marshal.WriteInt32(buffer,lengthOffset,name.Length);Marshal.Copy(name,0,IntPtr.Add(buffer,nameOffset),name.Length);IO_STATUS_BLOCK io;int status=NtSetInformationFile(source,out io,buffer,(uint)size,FileRenameInformation);return status>=0?0:(int)RtlNtStatusToDosError(status);}finally{if(parentAdded)parent.DangerousRelease();if(sourceAdded)source.DangerousRelease();Marshal.FreeHGlobal(buffer);}}
 }
 '@
-        $marker = 'CcodInstallGenerationCapabilityMarkerV3' -as [type]
+        $marker = 'CcodInstallGenerationCapabilityMarkerV4' -as [type]
     }
-    if ($null -eq $marker -or [int]$marker.GetProperty('CapabilityAbi').GetValue($null,$null) -ne 3) { Throw-CcodInstallFileError 'CCOD_INSTALL_RUNTIME_ABI_INVALID' 'Install generation runtime ABI is unavailable' $null }
-    $script:CcodRuntimeType = $marker.Assembly.GetType('CcodInstallGenerationRuntimeV3',$true)
+    if ($null -eq $marker -or [int]$marker.GetProperty('CapabilityAbi').GetValue($null,$null) -ne 4) { Throw-CcodInstallFileError 'CCOD_INSTALL_RUNTIME_ABI_INVALID' 'Install generation runtime ABI is unavailable' $null }
+    $script:CcodRuntimeType = $marker.Assembly.GetType('CcodInstallGenerationRuntimeV4',$true)
 }
 
 function Assert-CcodInstallLeaf([string]$Leaf,[string]$ErrorId='CCOD_INSTALL_LEAF_INVALID') {
@@ -262,7 +273,7 @@ function Get-CcodInstallTransaction($Capability,[string]$InvalidId='CCOD_INSTALL
 function Add-CcodInstallScope($Transaction,$Token,[string]$Kind='Directory',[bool]$ReadOnly=$false,[AllowNull()][string]$RuntimeId=$null){$capability=New-CcodInstallCapability;$script:CcodScopes.Add($capability,[pscustomobject]@{Transaction=$Transaction;Token=$Token;Kind=$Kind;ReadOnly=$ReadOnly;RuntimeId=$RuntimeId});$capability}
 function Get-CcodInstallScopedDirectory($Transaction,$Parent){$parentScope=Get-CcodInstallTransaction $Parent 'CCOD_INSTALL_DIRECTORY_INVALID';if(-not[object]::ReferenceEquals($parentScope.Record.Transaction,$Transaction)-or$parentScope.Record.Kind-cnotin@('Directory','Generation')){Throw-CcodInstallFileError 'CCOD_INSTALL_DIRECTORY_INVALID' 'Directory capability is outside the transaction scope' $null};return $parentScope}
 function Assert-CcodInstallWritableScope($Scope){if($Scope.Record.ReadOnly){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_READ_ONLY' 'Retained generation capability is read-only' $null}}
-function Convert-CcodInstallRuntimeError($Action,[string]$DefaultId){try{return&$Action}catch{$exception=$_.Exception;while($null-ne$exception.InnerException-and$exception-is[Management.Automation.RuntimeException]){$exception=$exception.InnerException};$message=[string]$exception.Message;if($exception-is[ObjectDisposedException]){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' $message $null};if($exception-is[ComponentModel.Win32Exception]-and$exception.NativeErrorCode-in@(80,183)){Throw-CcodInstallFileError 'CCOD_INSTALL_LEAF_EXISTS' 'Install object already exists' $null};if($message-match'pointer generation exists'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' $message $null};if($message-match'pointer generation overflow'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW' $message $null};if($message-match'retained manifest mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_MANIFEST_MISMATCH' $message $null};if($message-match'retained runtime id mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH' $message $null};if($message-match'seal mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_SEAL_MISMATCH' $message $null};if($message-match'alternate stream'){Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' $message $null};if($message-match'multi-link'){Throw-CcodInstallFileError 'CCOD_INSTALL_MULTILINK_LEAF' $message $null};if($message-match'reparse'){Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' $message $null};if($message-match'transaction scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_SCOPE' $message $null};if($message-match'generation not owned'){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' $message $null};if($message-match'unknown|unsealed'){Throw-CcodInstallFileError 'CCOD_INSTALL_UNKNOWN_LEAF' $message $null};if($message-match'pin changed|path changed'){Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' $message $null};Throw-CcodInstallFileError $DefaultId $message $null}}
+function Convert-CcodInstallRuntimeError($Action,[string]$DefaultId){try{return&$Action}catch{$exception=$_.Exception;while($null-ne$exception.InnerException-and$exception-is[Management.Automation.RuntimeException]){$exception=$exception.InnerException};$message=[string]$exception.Message;if($exception-is[ObjectDisposedException]){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' $message $null};if($message-match'state-only scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_STATE_SCOPE' $message $null};if($exception-is[ComponentModel.Win32Exception]-and$exception.NativeErrorCode-in@(80,183)){Throw-CcodInstallFileError 'CCOD_INSTALL_LEAF_EXISTS' 'Install object already exists' $null};if($message-match'pointer generation exists'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' $message $null};if($message-match'pointer generation overflow'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW' $message $null};if($message-match'retained manifest mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_MANIFEST_MISMATCH' $message $null};if($message-match'retained runtime id mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH' $message $null};if($message-match'seal mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_SEAL_MISMATCH' $message $null};if($message-match'alternate stream'){Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' $message $null};if($message-match'multi-link'){Throw-CcodInstallFileError 'CCOD_INSTALL_MULTILINK_LEAF' $message $null};if($message-match'reparse'){Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' $message $null};if($message-match'transaction scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_SCOPE' $message $null};if($message-match'generation not owned'){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' $message $null};if($message-match'unknown|unsealed'){Throw-CcodInstallFileError 'CCOD_INSTALL_UNKNOWN_LEAF' $message $null};if($message-match'pin changed|path changed'){Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' $message $null};Throw-CcodInstallFileError $DefaultId $message $null}}
 function Test-CcodInstallValue($Value,[int]$Depth=0) {
     if ($Depth -gt 12) { return $false }
     if ($null -eq $Value) { return $true }
@@ -297,11 +308,12 @@ function Open-CcodInstallGeneration {
     Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID'
     $arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$RuntimeId,$null)
     try{$token=Invoke-CcodRuntimeStatic Open $arguments}catch [ComponentModel.Win32Exception]{if($_.Exception.NativeErrorCode-in@(32,80,183)){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_EXISTS' 'Install generation already exists' $RuntimeId};throw}
-    $runtime=$arguments[2];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$RuntimeId;RootToken=$token;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='Generation';ReadOnly=$false;RuntimeId=$RuntimeId});$transaction
+    $runtime=$arguments[2];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$RuntimeId;RootToken=$token;StateOnly=$false;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='Generation';ReadOnly=$false;RuntimeId=$RuntimeId});$transaction
 }
+function Open-CcodInstallStateTransaction { param([Parameter(Mandatory)][string]$InstallRoot) Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenState $arguments} 'CCOD_INSTALL_STATE_TRANSACTION_INVALID';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$null;RootToken=$token;StateOnly=$true;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='StateTransaction';ReadOnly=$false;RuntimeId=$null});$transaction }
 function Open-CcodInstallRetainedGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)][string]$ExpectedManifestSha256,[Parameter(Mandatory)]$FileTransaction) if(-not[IO.Path]::IsPathRooted($InstallRoot)-or$ExpectedManifestSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_GENERATION_INVALID' 'Invalid retained generation contract' $RuntimeId};Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';if(-not[object]::ReferenceEquals($scope.Record.Transaction,$FileTransaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'FileTransaction must be the transaction root capability' $null};Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$nativeResult=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetained @($RuntimeId,$ExpectedManifestSha256)} 'CCOD_INSTALL_RETAINED_GENERATION_INVALID';if(@($nativeResult).Count-ne 2-or-not(Test-CcodRetainedManifestIdentity ([string]$nativeResult[1]) $RuntimeId)){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH' 'Retained manifest must contain exactly one matching top-level runtimeId string' $RuntimeId};Add-CcodInstallScope $scope.Record.Transaction $nativeResult[0] Generation $true $RuntimeId }
 function New-CcodInstallDirectory { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$Parent,[Parameter(Mandatory)][string]$Leaf,[switch]$CreateIfMissing) Assert-CcodInstallLeaf $Leaf;$transactionScope=Get-CcodInstallTransaction $Transaction 'CCOD_INSTALL_TRANSACTION_INVALID';if(-not[object]::ReferenceEquals($transactionScope.Record.Transaction,$Transaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Transaction capability must be the transaction root' $null};if([object]::ReferenceEquals($Parent,$Transaction)){$token=Invoke-CcodRuntimeMethod $transactionScope.State.Runtime GetInstallRoot @();$parentScope=[pscustomobject]@{State=$transactionScope.State;Record=[pscustomobject]@{Transaction=$Transaction;Token=$token;Kind='Directory';ReadOnly=$false;RuntimeId=$null}}}else{$parentScope=Get-CcodInstallScopedDirectory $Transaction $Parent};Assert-CcodInstallWritableScope $parentScope;$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $parentScope.State.Runtime OpenDirectory @($parentScope.Record.Token,$Leaf,[bool]$CreateIfMissing)} 'CCOD_INSTALL_DIRECTORY_OPEN_FAILED';$readOnly=[bool](Invoke-CcodRuntimeMethod $parentScope.State.Runtime IsRetained @($token));Add-CcodInstallScope $Transaction $token Directory $readOnly $(if($readOnly){$parentScope.Record.RuntimeId}else{$null}) }
-function New-CcodInstallGenerationLeaf { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$Leaf) Assert-CcodInstallLeaf $Leaf;$scope=Get-CcodInstallTransaction $Generation;Assert-CcodInstallWritableScope $scope;$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CreateDirectory @($scope.Record.Token,$Leaf)} 'CCOD_INSTALL_LEAF_CREATE_FAILED';Add-CcodInstallScope $scope.Record.Transaction $token Directory $scope.Record.ReadOnly $scope.Record.RuntimeId }
+function New-CcodInstallGenerationLeaf { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$Leaf) Assert-CcodInstallLeaf $Leaf;$scope=Get-CcodInstallTransaction $Generation;Assert-CcodInstallWritableScope $scope;if($scope.State.StateOnly){Throw-CcodInstallFileError 'CCOD_INSTALL_STATE_SCOPE' 'State-only transaction cannot create a generation leaf' $Leaf};$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CreateDirectory @($scope.Record.Token,$Leaf)} 'CCOD_INSTALL_LEAF_CREATE_FAILED';Add-CcodInstallScope $scope.Record.Transaction $token Directory $scope.Record.ReadOnly $scope.Record.RuntimeId }
 function Copy-CcodInstallSealedSource { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$SourcePath,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)][int64]$ExpectedLength,[Parameter(Mandatory)][string]$ExpectedSha256) Assert-CcodInstallLeaf $Leaf;if(-not[IO.Path]::IsPathRooted($SourcePath)-or$ExpectedLength-lt 0-or$ExpectedSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Invalid sealed source contract' $SourcePath};$scope=Get-CcodInstallTransaction $Generation;Assert-CcodInstallWritableScope $scope;$result=[pscustomobject]@{Length=$ExpectedLength;Sha256=$ExpectedSha256};Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Copy @($scope.Record.Token,$Leaf,[IO.Path]::GetFullPath($SourcePath),$ExpectedLength,$ExpectedSha256)|Out-Null} 'CCOD_INSTALL_SOURCE_MISMATCH';return $result }
 function Write-CcodInstallGenerationManifest { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)]$Manifest) $scope=Get-CcodInstallTransaction $Generation;Assert-CcodInstallWritableScope $scope;if($scope.Record.Token-ne$scope.State.RootToken){Throw-CcodInstallFileError 'CCOD_INSTALL_MANIFEST_SCOPE' 'Manifest must be written at the generation root' $null};$bytes=ConvertTo-CcodInstallJsonBytes $Manifest;$result=[pscustomobject]@{Length=[int64]$bytes.LongLength;Sha256=(Get-CcodInstallBytesSha256 $bytes)};Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Write @($scope.Record.Token,'manifest.json',$bytes,$true)|Out-Null} 'CCOD_INSTALL_MANIFEST_WRITE_FAILED';return $result }
 function Write-CcodInstallRecord { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$Parent,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)]$Record) Assert-CcodInstallLeaf $Leaf;$scope=Get-CcodInstallScopedDirectory $Transaction $Parent;Assert-CcodInstallWritableScope $scope;$bytes=ConvertTo-CcodInstallJsonBytes $Record;$result=[pscustomobject]@{Length=[int64]$bytes.LongLength;Sha256=(Get-CcodInstallBytesSha256 $bytes)};try{Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Write @($scope.Record.Token,$Leaf,$bytes,$false)|Out-Null} 'CCOD_INSTALL_RECORD_WRITE_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_RECORD_EXISTS' 'Install record already exists' $Leaf};throw};return $result }
@@ -310,4 +322,4 @@ function Retire-CcodInstallGeneration { param([Parameter(Mandatory)][string]$Ins
 function Close-CcodInstallFileTransaction { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][ValidateSet('Ready','Failed')][string]$Disposition) $state=$null;if($null-eq$Transaction-or-not$script:CcodTransactions.TryGetValue($Transaction,[ref]$state)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Invalid install file transaction capability' $null};if($state.Closed-and-not$state.CleanupFailed){return};try{Invoke-CcodRuntimeMethod $state.Runtime Close @()|Out-Null;$state.CleanupFailed=$false}catch{$state.CleanupFailed=$true;$state.Closed=$true;$state.Disposition=$Disposition;Throw-CcodInstallFileError 'CCOD_INSTALL_CLOSE_FAILED' 'Install file transaction cleanup failed; registered failures are retained for retry' $null};$state.Closed=$true;$state.Disposition=$Disposition }
 
 Initialize-CcodInstallRuntime
-Export-ModuleMember -Function Open-CcodInstallGeneration,Open-CcodInstallRetainedGeneration,New-CcodInstallDirectory,New-CcodInstallGenerationLeaf,Copy-CcodInstallSealedSource,Write-CcodInstallGenerationManifest,Write-CcodInstallRecord,Commit-CcodInstallActivePointer,Retire-CcodInstallGeneration,Close-CcodInstallFileTransaction
+Export-ModuleMember -Function Open-CcodInstallGeneration,Open-CcodInstallStateTransaction,Open-CcodInstallRetainedGeneration,New-CcodInstallDirectory,New-CcodInstallGenerationLeaf,Copy-CcodInstallSealedSource,Write-CcodInstallGenerationManifest,Write-CcodInstallRecord,Commit-CcodInstallActivePointer,Retire-CcodInstallGeneration,Close-CcodInstallFileTransaction
diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index fe0aabf..8e809e2 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -197,6 +197,15 @@ function Open-CcodLifecycleInstallGeneration {
     return $transaction
 }
 
+function Open-CcodLifecycleInstallStateTransaction {
+    param([Parameter(Mandatory)][string]$InstallRoot)
+    if($null-eq(Get-Command Open-CcodInstallStateTransaction -ErrorAction SilentlyContinue)){Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop}
+    $canonical = Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
+    $transaction = Open-CcodInstallStateTransaction -InstallRoot $canonical
+    $script:CcodInstallTransactionRoots.Add($transaction,[pscustomobject]@{ InstallRoot=$canonical; RuntimeId=$null })
+    return $transaction
+}
+
 function Assert-CcodInstallTransactionRoot {
     param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$FileTransaction)
     $binding = $null
@@ -377,6 +386,80 @@ function Set-CcodInstallTransactionPhase {
     return Write-CcodInstallTransactionRecord -InstallRoot $InstallRoot -TransactionRecord $next -FileTransaction $FileTransaction
 }
 
+function Read-CcodReadyActivationReceiptForRecovery {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$TransactionRecord)
+    $root=Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
+    $directory=Join-Path (Join-Path $root 'state') 'activation-receipts'
+    if(-not[IO.Directory]::Exists($directory)){Throw-CcodLifecycleError 'CCOD_INSTALL_READY_RECOVERY_INVALID' 'Ready activation receipt store is missing' $directory}
+    try{[void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $directory)}catch{Throw-CcodLifecycleError 'CCOD_INSTALL_READY_RECOVERY_INVALID' 'Ready activation receipt store is unsafe' $directory}
+    $matching=[Collections.Generic.List[object]]::new()
+    try{
+        foreach($file in @(Get-ChildItem -LiteralPath $directory -Force -ErrorAction Stop)){
+            if($file.PSIsContainer-or$file.Name-cnotmatch'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.[A-Za-z]+\.json$'){throw 'unknown receipt object'}
+            $receipt=Read-CcodStrictJson -Path $file.FullName -ExpectedSchema 1 -Kind 'activation receipt'
+            [void](Assert-CcodActivationReceipt $receipt)
+            if($file.Name-cne('{0}.{1}.json'-f$receipt.activationId,$receipt.phase)){throw 'noncanonical receipt name'}
+            if($receipt.phase-ceq'Ready'-and$receipt.runtimeId-ceq$TransactionRecord.newRuntimeId-and[string]$receipt.previousRuntimeId-ceq[string]$TransactionRecord.oldRuntimeId){$matching.Add($receipt)}
+        }
+    }catch{Throw-CcodLifecycleError 'CCOD_INSTALL_READY_RECOVERY_INVALID' 'Ready activation receipt store is invalid' $directory}
+    if($matching.Count-ne1){Throw-CcodLifecycleError 'CCOD_INSTALL_READY_RECOVERY_INVALID' 'Exactly one matching Ready activation receipt is required' $TransactionRecord.transactionId}
+    return $matching[0]
+}
+
+function Assert-CcodReadyFinalizationRecoveryProof {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$TransactionRecord)
+    try{
+        [void](Assert-CcodInstallTransactionRecord $TransactionRecord)
+        if($TransactionRecord.phase-cne'ProtectionReady'-or[string]::IsNullOrWhiteSpace([string]$TransactionRecord.newRuntimeId)){throw 'transaction phase'}
+        [uint64]$expectedGeneration=if($null-eq$TransactionRecord.oldGeneration){1}else{[uint64]$TransactionRecord.oldGeneration+1}
+        if([uint64]$TransactionRecord.newGeneration-ne$expectedGeneration){throw 'transaction generation'}
+        $pointerRoot=Join-Path $InstallRoot 'state\active-generation'
+        if(-not[IO.Directory]::Exists($pointerRoot)){throw 'append-only pointer missing'}
+        $pointerItem=Get-Item -LiteralPath $pointerRoot -Force -ErrorAction Stop
+        if(-not$pointerItem.PSIsContainer-or($pointerItem.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){throw 'append-only pointer root'}
+        [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $InstallRoot -Path $pointerRoot)
+        $pointer=Read-CcodActiveRuntime -InstallRoot $InstallRoot
+        if($pointer.activeRuntime-cne$TransactionRecord.newRuntimeId-or[uint64]$pointer.generation-ne[uint64]$TransactionRecord.newGeneration-or[string]$pointer.previousRuntime-cne[string]$TransactionRecord.oldRuntimeId){throw 'active pointer mismatch'}
+        $runtimeRoot=[IO.Path]::GetFullPath((Join-Path (Join-Path $InstallRoot 'runtime') $TransactionRecord.newRuntimeId))
+        [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $runtimeRoot)
+        $validation=Test-CcodRuntimeManifest -RuntimeDirectory $runtimeRoot -ExpectedRuntimeId $TransactionRecord.newRuntimeId -ExpectedManifestSha256 $TransactionRecord.newManifestSha256
+        if($null-eq$validation-or-not$validation.Valid){throw 'runtime manifest mismatch'}
+        $receipt=Read-CcodReadyActivationReceiptForRecovery -InstallRoot $InstallRoot -TransactionRecord $TransactionRecord
+        return [pscustomobject]@{Pointer=$pointer;RuntimeRoot=$runtimeRoot;Validation=$validation;Receipt=$receipt}
+    }catch{
+        if((Get-CcodLifecycleErrorId $_)-ceq'CCOD_INSTALL_READY_RECOVERY_INVALID'){throw}
+        Throw-CcodLifecycleError 'CCOD_INSTALL_READY_RECOVERY_INVALID' 'Ready finalization recovery proof is invalid' $TransactionRecord.transactionId
+    }
+}
+
+function Complete-CcodReadyFinalizationRecovery {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$TransactionRecord)
+    [void](Assert-CcodReadyFinalizationRecoveryProof -InstallRoot $InstallRoot -TransactionRecord $TransactionRecord)
+    $fileTransaction=$null
+    $observed=$null
+    try{
+        $fileTransaction=Open-CcodLifecycleInstallStateTransaction -InstallRoot $InstallRoot
+        [void](Assert-CcodReadyFinalizationRecoveryProof -InstallRoot $InstallRoot -TransactionRecord $TransactionRecord)
+        try{[void](Set-CcodInstallTransactionPhase -InstallRoot $InstallRoot -TransactionId $TransactionRecord.transactionId -ExpectedPhase 'ProtectionReady' -NewPhase 'Ready' -FileTransaction $fileTransaction)}catch{
+            $observed=Read-CcodInstallTransactionRecord -InstallRoot $InstallRoot -TransactionId $TransactionRecord.transactionId
+            if($null-eq$observed-or$observed.phase-cne'Ready'){Throw-CcodLifecycleError 'CCOD_INSTALL_READY_FINALIZATION_PENDING' 'Ready finalization snapshot could not be appended' $TransactionRecord.transactionId}
+        }
+        $observed=Read-CcodInstallTransactionRecord -InstallRoot $InstallRoot -TransactionId $TransactionRecord.transactionId
+        if($null-eq$observed-or$observed.phase-cne'Ready'){Throw-CcodLifecycleError 'CCOD_INSTALL_READY_FINALIZATION_PENDING' 'Ready finalization snapshot is not visible' $TransactionRecord.transactionId}
+    }catch{
+        try{$observed=Read-CcodInstallTransactionRecord -InstallRoot $InstallRoot -TransactionId $TransactionRecord.transactionId}catch{}
+        if($null-eq$observed-or$observed.phase-cne'Ready'){
+            if((Get-CcodLifecycleErrorId $_)-in@('CCOD_INSTALL_READY_RECOVERY_INVALID','CCOD_INSTALL_READY_FINALIZATION_PENDING')){throw}
+            Throw-CcodLifecycleError 'CCOD_INSTALL_READY_FINALIZATION_PENDING' 'Ready finalization snapshot requires another bounded recovery attempt' $TransactionRecord.transactionId
+        }
+    }finally{
+        if($null-ne$fileTransaction){try{Close-CcodInstallFileTransaction -Transaction $fileTransaction -Disposition $(if($null-ne$observed-and$observed.phase-ceq'Ready'){'Ready'}else{'Failed'})}catch{}}
+    }
+    $ready=Read-CcodInstallTransactionRecord -InstallRoot $InstallRoot -TransactionId $TransactionRecord.transactionId
+    if($null-eq$ready-or$ready.phase-cne'Ready'){Throw-CcodLifecycleError 'CCOD_INSTALL_READY_FINALIZATION_PENDING' 'Ready finalization snapshot is not durable' $TransactionRecord.transactionId}
+    return [pscustomobject][ordered]@{Outcome='Recovered';Installed=$true;RuntimeId=[string]$ready.newRuntimeId;PreviousRuntimeId=$ready.oldRuntimeId;RepairCompleted=$false}
+}
+
 function Test-CcodInstallPackageIdentity {
     param($TransactionRecord,[Parameter(Mandatory)][string]$ProjectVersion,[Parameter(Mandatory)][string]$ActiveProjectVersion,[Parameter(Mandatory)][string]$SealedPackageSha256,[string]$ActiveRuntimeId,[uint64]$ActiveGeneration)
     if ($SealedPackageSha256 -cnotmatch '^[0-9a-f]{64}$') { Throw-CcodLifecycleError 'CCOD_INSTALL_PACKAGE_IDENTITY_INVALID' 'Sealed package SHA-256 is invalid' $null }
@@ -1804,7 +1887,7 @@ function Get-CcodLifecycleAdapters {
         }
         SetActiveRuntime = {
             param($InstallRoot, $RuntimeId, $Ownership,$TargetGeneration,$FileTransaction)
-            Set-CcodActiveRuntime -InstallRoot $InstallRoot -TargetGeneration $TargetGeneration -FileTransaction $FileTransaction -Ownership $Ownership
+            Set-CcodActiveRuntime -InstallRoot $InstallRoot -NewRuntimeId $RuntimeId -TargetGeneration $TargetGeneration -FileTransaction $FileTransaction -Ownership $Ownership
         }
         ExitLifecycleOwnership = {
             param($Ownership)
@@ -2204,6 +2287,16 @@ function Invoke-CcodInstall {
     }
     if(-not[IO.Directory]::Exists($root)){[IO.Directory]::CreateDirectory($root)|Out-Null}
 
+    $globalTransaction=Read-CcodInstallTransactionRecord -InstallRoot $root
+    if($null-ne$globalTransaction-and$globalTransaction.phase-notin@('Ready','Failed')){
+        if($globalTransaction.phase-ceq'ProtectionReady'){return Complete-CcodReadyFinalizationRecovery -InstallRoot $root -TransactionRecord $globalTransaction}
+        Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_BUSY' 'A nonterminal install transaction must be recovered before a new attempt' $globalTransaction.transactionId
+    }
+
+    $existingPointer = $null
+    $activePath = Join-Path $root 'active.json'
+    try{$existingPointer=Read-CcodActiveRuntime -InstallRoot $root}catch{if([IO.File]::Exists($activePath)-or[IO.Directory]::Exists((Join-Path $root 'state\active-generation'))){throw}}
+
     if (-not [IO.Directory]::Exists($sourceRoot)) {
         Throw-CcodLifecycleError 'CCOD_INSTALL_SOURCE_MISSING' 'Source checkout does not exist' $sourceRoot
     }
@@ -2237,11 +2330,6 @@ function Invoke-CcodInstall {
     $nodeCandidates = @(Get-CcodLifecycleNodeCandidates -Adapters $adapters)
     if (-not $payloadBound) { $files = @(Get-CcodLifecycleSourceFiles -SourceRoot $sourceRoot -RequireTrayHost) }
 
-    $existingPointer = $null
-    $activePath = Join-Path $root 'active.json'
-    try{$existingPointer=Read-CcodActiveRuntime -InstallRoot $root}catch{if([IO.File]::Exists($activePath)-or[IO.Directory]::Exists((Join-Path $root 'state\active-generation'))){throw}}
-    $globalTransaction=Read-CcodInstallTransactionRecord -InstallRoot $root
-    if($null-ne$globalTransaction-and$globalTransaction.phase-notin@('Ready','Failed')){Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_BUSY' 'A nonterminal install transaction must be recovered before a new attempt' $globalTransaction.transactionId}
     $oldManifestSha256=$null;$activeValidation=$null
     if($null-ne$existingPointer){
         $activeRuntimeRoot=[IO.Path]::GetFullPath((Join-Path (Join-Path $root 'runtime') ([string]$existingPointer.activeRuntime)))
diff --git a/src/persistence/modules/RuntimeManifest.psm1 b/src/persistence/modules/RuntimeManifest.psm1
index 947a665..05fa9e7 100644
--- a/src/persistence/modules/RuntimeManifest.psm1
+++ b/src/persistence/modules/RuntimeManifest.psm1
@@ -40,12 +40,13 @@ function Get-CcodRuntimeAdapters {
         UtcNow = { [DateTime]::UtcNow }
         AssertLifecycleFence = {
             param($InstallRoot, $Ownership, $ExpectActivePointer, $NewRuntimeId)
-            $path = Resolve-CcodContainedPath -Root $InstallRoot -RelativePath 'active.json' -AllowMissingLeaf
             if ([bool]$ExpectActivePointer) {
-                if (-not [IO.File]::Exists($path)) { Throw-CcodRuntimeError 'CCOD_RUNTIME_FENCE_STALE' 'Expected active pointer disappeared during lifecycle mutation' $path }
+                $selected=$null;try{$selected=Read-CcodActiveRuntime -InstallRoot $InstallRoot}catch{Throw-CcodRuntimeError 'CCOD_RUNTIME_FENCE_STALE' 'Expected active selector disappeared during lifecycle mutation' $InstallRoot}
+                if($null-eq$selected-or$selected.activeRuntime-cne$Ownership.runtimeId-or[uint64]$selected.generation-ne[uint64]$Ownership.runtimeGeneration){Throw-CcodRuntimeError 'CCOD_RUNTIME_FENCE_STALE' 'Append-only selected runtime does not match lifecycle ownership' $Ownership}
                 return Assert-CcodLifecycleFence -InstallRoot $InstallRoot -Ownership $Ownership
             }
-            if ([IO.File]::Exists($path)) { Throw-CcodRuntimeError 'CCOD_RUNTIME_FENCE_STALE' 'Unexpected active pointer appeared during lifecycle initialization' $path }
+            try{$unexpected=Read-CcodActiveRuntime -InstallRoot $InstallRoot}catch{$unexpected=$null}
+            if ($null-ne$unexpected-or[IO.Directory]::Exists((Join-Path $InstallRoot 'state\active-generation'))-or[IO.File]::Exists((Join-Path $InstallRoot 'active.json'))) { Throw-CcodRuntimeError 'CCOD_RUNTIME_FENCE_STALE' 'Unexpected active selector appeared during lifecycle initialization' $InstallRoot }
             if ([UInt64]$Ownership.runtimeGeneration -ne 1 -or [string]$Ownership.runtimeId -cne [string]$NewRuntimeId) {
                 Throw-CcodRuntimeError 'CCOD_RUNTIME_FENCE_STALE' 'Initial active pointer requires generation-one ownership of the new runtime' $Ownership
             }
@@ -468,7 +469,7 @@ function Set-CcodActiveRuntime {
         if($null-eq$FileTransaction-or$null-eq$TargetGeneration){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Pointer commit requires target and transaction' $InstallRoot}
         $current=$null;try{$current=Read-CcodActiveRuntime $InstallRoot}catch{if((Get-CcodErrorId $_)-notin@('CCOD_STATE_MISSING','CCOD_PATH_MISSING')){throw}}
         [uint64]$previous=if($null-eq$current){0}else{$current.generation}
-        try{[void](& $Adapters.AssertLifecycleFence $InstallRoot $Ownership ($null-ne$current) $(if($null-ne$current){$current.activeRuntime}else{$null}))}catch{Throw-CcodRuntimeError 'CCOD_RUNTIME_FENCE_STALE' 'Active runtime mutation lifecycle fence is stale' $InstallRoot}
+        try{[void](& $Adapters.AssertLifecycleFence $InstallRoot $Ownership ($null-ne$current) $NewRuntimeId)}catch{Throw-CcodRuntimeError 'CCOD_RUNTIME_FENCE_STALE' 'Active runtime mutation lifecycle fence is stale' $InstallRoot}
         $committed=Commit-CcodInstallActivePointer -InstallRoot $InstallRoot -TargetGeneration $TargetGeneration -ExpectedPreviousGeneration $previous -FileTransaction $FileTransaction
         return Read-CcodActiveRuntime -InstallRoot $InstallRoot
     }
diff --git a/tests/persistence/Bootstrap.SelfTest.ps1 b/tests/persistence/Bootstrap.SelfTest.ps1
index 463dc13..e4ccbe4 100644
--- a/tests/persistence/Bootstrap.SelfTest.ps1
+++ b/tests/persistence/Bootstrap.SelfTest.ps1
@@ -338,8 +338,8 @@ $results += Invoke-CcodTest 'production suppression caller fails closed for unsa
 }
 
 
-$results += Invoke-CcodTest 'bootstrap append-only selector rejects unknown reparse ADS and multi-linked leaves' {
-    foreach($kind in @('unknown','reparse','ads','multilink')){$root=Join-Path ([IO.Path]::GetTempPath()) ("ccod-bootstrap-pointer-$kind-"+[guid]::NewGuid().ToString('N'));$outside=Join-Path ([IO.Path]::GetTempPath()) ("ccod-bootstrap-pointer-outside-$kind-"+[guid]::NewGuid().ToString('N'));try{New-CcodBootstrapFixture -Root $root|Out-Null;[IO.Directory]::CreateDirectory($outside)|Out-Null;$pointerRoot=Join-Path $root 'state\active-generation';[IO.Directory]::CreateDirectory($pointerRoot)|Out-Null;$path=Join-Path $pointerRoot '00000000000000000001.json';$id='2.5.22-1111111111111111-22222222222222222222222222222222';$json='{"schemaVersion":1,"generation":1,"activeRuntime":"'+$id+'","previousGeneration":0}';if($kind-ceq'unknown'){[IO.File]::WriteAllText((Join-Path $pointerRoot 'unknown.bin'),'x',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'reparse'){New-Item -ItemType Junction -Path $path -Target $outside|Out-Null}elseif($kind-ceq'ads'){[IO.File]::WriteAllText($path,$json,[Text.UTF8Encoding]::new($false));Set-Content -LiteralPath $path -Stream evidence -Value x -NoNewline}else{$outsideFile=Join-Path $outside 'pointer.json';[IO.File]::WriteAllText($outsideFile,$json,[Text.UTF8Encoding]::new($false));New-Item -ItemType HardLink -Path $path -Target $outsideFile|Out-Null};Assert-CcodThrows {Read-CcodBootstrapActivePointer -InstallRoot $root|Out-Null} 'CCOD_BOOTSTRAP_POINTER_INVALID'}finally{if(Test-Path $root){Remove-Item $root -Recurse -Force};if(Test-Path $outside){Remove-Item $outside -Recurse -Force}}}
+$results += Invoke-CcodTest 'bootstrap append-only selector rejects unsafe roots leaves JSON and generations' {
+    foreach($kind in @('unknown','root-file','root-reparse','leaf-reparse','ads','multilink','duplicate','fractional','noncanonical')){$root=Join-Path ([IO.Path]::GetTempPath()) ("ccod-bootstrap-pointer-$kind-"+[guid]::NewGuid().ToString('N'));$outside=Join-Path ([IO.Path]::GetTempPath()) ("ccod-bootstrap-pointer-outside-$kind-"+[guid]::NewGuid().ToString('N'));try{New-CcodBootstrapFixture -Root $root|Out-Null;[IO.Directory]::CreateDirectory($outside)|Out-Null;$pointerRoot=Join-Path $root 'state\active-generation';[IO.Directory]::CreateDirectory($pointerRoot)|Out-Null;$path=Join-Path $pointerRoot '00000000000000000001.json';$id='2.5.22-1111111111111111-22222222222222222222222222222222';$json='{"schemaVersion":1,"generation":1,"activeRuntime":"'+$id+'","previousGeneration":0}';if($kind-ceq'unknown'){[IO.File]::WriteAllText((Join-Path $pointerRoot 'unknown.bin'),'x',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'root-file'){Remove-Item $pointerRoot -Recurse -Force;[IO.File]::WriteAllText($pointerRoot,'x',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'root-reparse'){Remove-Item $pointerRoot -Recurse -Force;New-Item -ItemType Junction -Path $pointerRoot -Target $outside|Out-Null}elseif($kind-ceq'leaf-reparse'){New-Item -ItemType Junction -Path $path -Target $outside|Out-Null}elseif($kind-ceq'ads'){[IO.File]::WriteAllText($path,$json,[Text.UTF8Encoding]::new($false));Set-Content -LiteralPath $path -Stream evidence -Value x -NoNewline}elseif($kind-ceq'multilink'){$outsideFile=Join-Path $outside 'pointer.json';[IO.File]::WriteAllText($outsideFile,$json,[Text.UTF8Encoding]::new($false));New-Item -ItemType HardLink -Path $path -Target $outsideFile|Out-Null}elseif($kind-ceq'duplicate'){[IO.File]::WriteAllText($path,('{"schemaVersion":1,"schemaVersion":1,"generation":1,"activeRuntime":"'+$id+'","previousGeneration":0}'),[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'fractional'){[IO.File]::WriteAllText($path,('{"schemaVersion":1,"generation":1.5,"activeRuntime":"'+$id+'","previousGeneration":0}'),[Text.UTF8Encoding]::new($false))}else{[IO.File]::WriteAllText((Join-Path $pointerRoot '00000000000000000002.json'),$json,[Text.UTF8Encoding]::new($false))};Assert-CcodThrows {Read-CcodBootstrapActivePointer -InstallRoot $root|Out-Null} 'CCOD_BOOTSTRAP_POINTER_INVALID'}finally{if(Test-Path $root){Remove-Item $root -Recurse -Force};if(Test-Path $outside){Remove-Item $outside -Recurse -Force}}}
 }
 
 $results += Invoke-CcodTest 'generation bootstrap launches the append-only selected runtime without root active json' {
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index b672990..b560dc0 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -136,14 +136,19 @@ function New-CcodHardLink {
 }
 
 Invoke-CcodTest 'exports only immutable generation operations and an inert CLR marker' {
-    $expected=@('Close-CcodInstallFileTransaction','Commit-CcodInstallActivePointer','Copy-CcodInstallSealedSource','New-CcodInstallDirectory','New-CcodInstallGenerationLeaf','Open-CcodInstallGeneration','Open-CcodInstallRetainedGeneration','Retire-CcodInstallGeneration','Write-CcodInstallGenerationManifest','Write-CcodInstallRecord')
+    $expected=@('Close-CcodInstallFileTransaction','Commit-CcodInstallActivePointer','Copy-CcodInstallSealedSource','New-CcodInstallDirectory','New-CcodInstallGenerationLeaf','Open-CcodInstallGeneration','Open-CcodInstallRetainedGeneration','Open-CcodInstallStateTransaction','Retire-CcodInstallGeneration','Write-CcodInstallGenerationManifest','Write-CcodInstallRecord')
     Assert-CcodEqual ($expected -join '|') ((@($module.ExportedCommands.Keys)|Sort-Object)-join '|') 'module export surface is capability-only'
-    Assert-CcodEqual 3 ([CcodInstallGenerationCapabilityMarkerV3]::CapabilityAbi) 'marker exposes the current non-mutating ABI value'
-    Assert-CcodEqual 'CcodInstallGenerationCapabilityMarkerV3' ((@([CcodInstallGenerationCapabilityMarkerV3].Assembly.GetExportedTypes()|ForEach-Object FullName)) -join '|') 'current CLR bridge exports only the inert marker'
-    $dangerous=@([CcodInstallGenerationCapabilityMarkerV3].GetMethods([Reflection.BindingFlags]'Public,Static,DeclaredOnly')|Where-Object{@($_.GetParameters()|Where-Object{$_.ParameterType-in@([string],[IntPtr],[IO.Stream])-or[Microsoft.Win32.SafeHandles.SafeHandle].IsAssignableFrom($_.ParameterType)}).Count-ne 0})
+    Assert-CcodEqual 4 ([CcodInstallGenerationCapabilityMarkerV4]::CapabilityAbi) 'marker exposes the current non-mutating ABI value'
+    Assert-CcodEqual 'CcodInstallGenerationCapabilityMarkerV4' ((@([CcodInstallGenerationCapabilityMarkerV4].Assembly.GetExportedTypes()|ForEach-Object FullName)) -join '|') 'current CLR bridge exports only the inert marker'
+    $dangerous=@([CcodInstallGenerationCapabilityMarkerV4].GetMethods([Reflection.BindingFlags]'Public,Static,DeclaredOnly')|Where-Object{@($_.GetParameters()|Where-Object{$_.ParameterType-in@([string],[IntPtr],[IO.Stream])-or[Microsoft.Win32.SafeHandles.SafeHandle].IsAssignableFrom($_.ParameterType)}).Count-ne 0})
     Assert-CcodEqual 0 $dangerous.Count 'marker accepts no path stream or bare handle'
 }
 
+Invoke-CcodTest 'V4 state-only transaction writes records but cannot reach generation or pointer operations' {
+    $fixture=New-CcodInstallFileFixture;$transaction=$null
+    try{$transaction=Open-CcodInstallStateTransaction -InstallRoot $fixture.Install;$fixture.Transactions.Add($transaction);$state=New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'state' -CreateIfMissing;$records=New-CcodInstallDirectory -Transaction $transaction -Parent $state -Leaf 'install-transactions' -CreateIfMissing;Write-CcodInstallRecord -Transaction $transaction -Parent $records -Leaf 'ready.json' -Record ([ordered]@{schemaVersion=1;phase='Ready'})|Out-Null;Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $fixture.Install 'state\install-transactions\ready.json')) 'state-only transaction writes a create-only state record';Assert-CcodThrows {Write-CcodInstallRecord -Transaction $transaction -Parent $records -Leaf 'ready.json' -Record ([ordered]@{schemaVersion=1;phase='Ready'})|Out-Null} 'CCOD_INSTALL_RECORD_EXISTS';Assert-CcodThrows {New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'runtime' -CreateIfMissing|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {New-CcodInstallGenerationLeaf -Generation $transaction -Leaf 'payload'|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';$source=New-CcodSourceFile $fixture 'state-source.txt' 'x';Assert-CcodThrows {Copy-CcodInstallSealedSource -Generation $transaction -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {Write-CcodInstallGenerationManifest -Generation $transaction -Manifest (New-CcodGenerationManifest 'state-runtime')|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId 'state-runtime' -ExpectedManifestSha256 ('0'*64) -FileTransaction $transaction|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $transaction -ExpectedPreviousGeneration 0 -FileTransaction $transaction|Out-Null} 'CCOD_INSTALL_POINTER_TARGET_INVALID';Assert-CcodThrows {Retire-CcodInstallGeneration -InstallRoot $fixture.Install -RuntimeId 'state-runtime' -FileTransaction $transaction|Out-Null} 'CCOD_INSTALL_GENERATION_NOT_OWNED';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $fixture.Install 'runtime')) 'state-only transaction creates no runtime tree';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $fixture.Install 'state\active-generation')) 'state-only transaction creates no active pointer';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $fixture.Install 'state\retired-generations')) 'state-only transaction creates no retirement record'}finally{Remove-CcodInstallFileFixture $fixture}
+}
+
 Invoke-CcodTest 'force re-import rebinds the current runtime ABI before real use' {
     $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
     $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
@@ -526,17 +531,26 @@ Invoke-CcodExtensionRedTest 'child-transaction' 'rejects a child directory capab
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
 
-Invoke-CcodExtensionRedTest 'v3-reimport' 're-imports ABI V3 and exercises every retained extension export' {
+Invoke-CcodExtensionRedTest 'v3-reimport' 're-imports ABI V4 and exercises every retained extension export' {
     $fixture=New-CcodInstallFileFixture
     try {
-        if($null-eq('CcodInstallGenerationCapabilityMarkerV2'-as[type])){Add-Type -TypeDefinition 'public sealed class CcodInstallGenerationCapabilityMarkerV2 { private CcodInstallGenerationCapabilityMarkerV2() {} public static int CapabilityAbi { get { return 2; } } }'}
-        Assert-CcodEqual 2 ([CcodInstallGenerationCapabilityMarkerV2]::CapabilityAbi) 'old V2 marker is preloaded in the AppDomain'
+        if($null-eq('CcodInstallGenerationCapabilityMarkerV3'-as[type])){Add-Type -TypeDefinition 'public sealed class CcodInstallGenerationCapabilityMarkerV3 { private CcodInstallGenerationCapabilityMarkerV3() {} public static int CapabilityAbi { get { return 3; } } }'}
+        Assert-CcodEqual 3 ([CcodInstallGenerationCapabilityMarkerV3]::CapabilityAbi) 'old V3 marker is preloaded in the AppDomain'
         $module=Import-Module $modulePath -Force -PassThru -DisableNameChecking;$module=Import-Module $modulePath -Force -PassThru -DisableNameChecking
         $old=Open-CcodFixtureGeneration $fixture 'runtime-v3-old';$manifest=Write-CcodInstallGenerationManifest -Generation $old -Manifest (New-CcodGenerationManifest 'runtime-v3-old');Close-CcodInstallFileTransaction -Transaction $old -Disposition Ready|Out-Null
         $transaction=Open-CcodFixtureGeneration $fixture 'runtime-v3-new';Write-CcodInstallGenerationManifest -Generation $transaction -Manifest (New-CcodGenerationManifest 'runtime-v3-new')|Out-Null
         $state=New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'state' -CreateIfMissing;$records=New-CcodInstallDirectory -Transaction $transaction -Parent $state -Leaf 'records' -CreateIfMissing;Write-CcodInstallRecord -Transaction $transaction -Parent $records -Leaf 'record.json' -Record ([ordered]@{schemaVersion=1;value='v3'})|Out-Null
         $retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId 'runtime-v3-old' -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $transaction;Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $retained -ExpectedPreviousGeneration ([uint64]0) -FileTransaction $transaction|Out-Null
-        Assert-CcodEqual 3 ([CcodInstallGenerationCapabilityMarkerV3]::CapabilityAbi) 'module binds the new ABI V3 despite the preloaded V2 marker'
+        $stateOnly=Open-CcodInstallStateTransaction -InstallRoot $fixture.Install;$fixture.Transactions.Add($stateOnly);$stateOnlyRoot=New-CcodInstallDirectory -Transaction $stateOnly -Parent $stateOnly -Leaf 'state' -CreateIfMissing;$recovery=New-CcodInstallDirectory -Transaction $stateOnly -Parent $stateOnlyRoot -Leaf 'recovery' -CreateIfMissing;Write-CcodInstallRecord -Transaction $stateOnly -Parent $recovery -Leaf 'ready.json' -Record ([ordered]@{schemaVersion=1;phase='Ready'})|Out-Null
+        $source=New-CcodSourceFile $fixture 'v4-state-source.txt' 'state-only-after-v3'
+        Assert-CcodThrows {New-CcodInstallDirectory -Transaction $stateOnly -Parent $stateOnly -Leaf 'runtime' -CreateIfMissing|Out-Null} 'CCOD_INSTALL_STATE_SCOPE'
+        Assert-CcodThrows {New-CcodInstallGenerationLeaf -Generation $stateOnly -Leaf 'payload'|Out-Null} 'CCOD_INSTALL_STATE_SCOPE'
+        Assert-CcodThrows {Copy-CcodInstallSealedSource -Generation $stateOnly -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null} 'CCOD_INSTALL_STATE_SCOPE'
+        Assert-CcodThrows {Write-CcodInstallGenerationManifest -Generation $stateOnly -Manifest (New-CcodGenerationManifest 'state-after-v3')|Out-Null} 'CCOD_INSTALL_STATE_SCOPE'
+        Assert-CcodThrows {Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId 'runtime-v3-old' -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $stateOnly|Out-Null} 'CCOD_INSTALL_STATE_SCOPE'
+        Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $stateOnly -ExpectedPreviousGeneration ([uint64]1) -FileTransaction $stateOnly|Out-Null} 'CCOD_INSTALL_POINTER_TARGET_INVALID'
+        Assert-CcodThrows {Retire-CcodInstallGeneration -InstallRoot $fixture.Install -RuntimeId 'runtime-v3-old' -FileTransaction $stateOnly|Out-Null} 'CCOD_INSTALL_GENERATION_NOT_OWNED'
+        Assert-CcodEqual 4 ([CcodInstallGenerationCapabilityMarkerV4]::CapabilityAbi) 'module binds the new ABI V4 despite the preloaded V3 marker'
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
 
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index d261bcb..1fa38ac 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -260,8 +260,8 @@ function New-CcodLifecycleFake {
     $adapters.SetActiveRuntime = {
         param($InstallRoot, $RuntimeId, $Ownership, $TargetGeneration, $FileTransaction)
         if ($null -ne $world.SetActiveFailure) { & $world.SetActiveFailure $InstallRoot $RuntimeId $Ownership $TargetGeneration $FileTransaction }
-        $assertFence = { param($Root, $Receipt, $ExpectActivePointer) if ($Receipt.released) { throw 'released lifecycle owner' }; $true }
-        Set-CcodActiveRuntime -InstallRoot $InstallRoot -TargetGeneration $TargetGeneration -FileTransaction $FileTransaction -Ownership $Ownership -Adapters @{ AssertLifecycleFence=$assertFence }
+        $assertFence = { param($Root, $Receipt, $ExpectActivePointer,$TargetRuntimeId) if ($Receipt.released) { throw 'released lifecycle owner' }; $true }
+        Set-CcodActiveRuntime -InstallRoot $InstallRoot -NewRuntimeId $RuntimeId -TargetGeneration $TargetGeneration -FileTransaction $FileTransaction -Ownership $Ownership -Adapters @{ AssertLifecycleFence=$assertFence }
     }.GetNewClosure()
     $adapters.ExitLifecycleOwnership = {
         param($Ownership)
@@ -309,6 +309,33 @@ function New-CcodLifecycleFake {
     [pscustomobject]@{ World = $world; Adapters = $adapters }
 }
 
+function New-CcodReadyFinalizationGapFixture {
+    $source=New-CcodLifecycleTempRoot
+    $install=New-CcodLifecycleTempRoot
+    $nodeRoot=New-CcodLifecycleTempRoot
+    try {
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22-finalization-recovery' | Out-Null
+        $node=New-CcodLifecycleFakeNode -Root $nodeRoot
+        $fake=New-CcodLifecycleFake -NodePath $node
+        $fake.Adapters.CommitReadyTransaction={throw 'PRIVATE_FINAL_SNAPSHOT_FAILURE'}
+        $failure=$null
+        try { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters | Out-Null } catch { $failure=$_ }
+        Assert-CcodTrue ($null-ne$failure-and$failure.FullyQualifiedErrorId-like'CCOD_INSTALL_READY_FINALIZATION_PENDING*') 'fixture reaches the exact Ready-finalization gap'
+        $module=Get-Module InstallLifecycle -ErrorAction Stop
+        $head=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install
+        Assert-CcodEqual 'ProtectionReady' $head.phase 'fixture transaction is recoverable at ProtectionReady'
+        return [pscustomobject]@{Source=$source;Install=$install;NodeRoot=$nodeRoot;Node=$node;Transaction=$head}
+    } catch {
+        foreach($path in @($source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}
+        throw
+    }
+}
+
+function Remove-CcodReadyFinalizationGapFixture {
+    param([Parameter(Mandatory)]$Fixture)
+    foreach($path in @($Fixture.Source,$Fixture.Install,$Fixture.NodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}
+}
+
 function Read-CcodLifecycleActivePointer {
     param([Parameter(Mandatory)][string]$Root)
     return Read-CcodActiveRuntime -InstallRoot $Root
@@ -1638,6 +1665,66 @@ $results += Invoke-CcodTest 'final transaction snapshot failure leaves Ready rec
     try{New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22-final-gap'|Out-Null;$node=New-CcodLifecycleFakeNode -Root $nodeRoot;$fake=New-CcodLifecycleFake -NodePath $node;$fake.Adapters.CommitReadyTransaction={throw 'PRIVATE_FINAL_SNAPSHOT_FAILURE'};$failure=$null;try{Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters|Out-Null}catch{$failure=$_};Assert-CcodTrue ($failure.FullyQualifiedErrorId-like'CCOD_INSTALL_READY_FINALIZATION_PENDING*') 'final snapshot failure reports recoverable pending status';$ready=@(Get-ChildItem -LiteralPath (Join-Path $install 'state\activation-receipts') -Filter '*.Ready.json' -File);$failed=@(Get-ChildItem -LiteralPath (Join-Path $install 'state\activation-receipts') -Filter '*.Failed.json' -File);Assert-CcodEqual 1 $ready.Count 'Ready activation receipt remains visible exactly once';Assert-CcodEqual 0 $failed.Count 'no contradictory Failed activation receipt is appended';$transactionFailed=@(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Failed.*.json' -File);$transactionReady=@(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Ready.*.json' -File);Assert-CcodEqual 0 $transactionFailed.Count 'no Failed transaction snapshot follows Ready receipt';Assert-CcodEqual 0 $transactionReady.Count 'missing final transaction snapshot remains absent for recovery';$module=Get-Module InstallLifecycle;$head=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install;Assert-CcodEqual 'ProtectionReady' $head.phase 'transaction remains recoverable at ProtectionReady'}finally{foreach($p in @($source,$install,$nodeRoot)){if(Test-Path $p){Remove-Item $p -Recurse -Force}}}
 }
 
+# Production mutation caught: treating every nonterminal transaction as permanently busy instead of finalizing an already-proven Ready activation.
+$results += Invoke-CcodTest 'a later invocation recovers one missing Ready transaction snapshot without another install mutation' {
+    $fixture=New-CcodReadyFinalizationGapFixture
+    try {
+        $runtimeCount=@(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'runtime') -Directory -Force).Count
+        $pointerCount=@(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\active-generation') -File -Force).Count
+        Remove-Item -LiteralPath $fixture.Source -Recurse -Force
+        $recoveryFake=New-CcodLifecycleFake -NodePath $fixture.Node
+        $result=Invoke-CcodInstall -SourceRoot $fixture.Source -InstallRoot $fixture.Install -Adapters $recoveryFake.Adapters
+        Assert-CcodEqual 'Recovered' $result.Outcome 'finalization recovery reports a bounded recovered outcome'
+        Assert-CcodEqual $fixture.Transaction.newRuntimeId $result.RuntimeId 'recovery result binds the pending transaction runtime'
+        Assert-CcodEqual $runtimeCount @(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'runtime') -Directory -Force).Count 'recovery creates no runtime generation'
+        Assert-CcodEqual $pointerCount @(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\active-generation') -File -Force).Count 'recovery appends no active pointer'
+        Assert-CcodEqual 1 @(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\install-transactions') -Filter '*.Ready.*.json' -File -Force).Count 'recovery appends exactly one Ready transaction snapshot'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\install-transactions') -Filter '*.Failed.*.json' -File -Force).Count 'recovery appends no Failed transaction snapshot'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\activation-receipts') -Filter '*.Failed.json' -File -Force).Count 'recovery appends no Failed activation receipt'
+        $module=Get-Module InstallLifecycle -ErrorAction Stop
+        $head=&$module {param($Root,$Id)Read-CcodInstallTransactionRecord -InstallRoot $Root -TransactionId $Id} $fixture.Install $fixture.Transaction.transactionId
+        Assert-CcodEqual 'Ready' $head.phase 'the original transaction alone becomes terminal Ready'
+        Assert-CcodEqual 0 $recoveryFake.World.TaskInstalled 'recovery does not reinstall the scheduled task'
+        Assert-CcodEqual 0 $recoveryFake.World.TaskStarted 'recovery does not restart the product'
+        Assert-CcodEqual 0 @($recoveryFake.World.Calls|Where-Object{$_-like'Validate:*'}).Count 'state-only recovery does not depend on the vanished source checkout'
+    } finally { Remove-CcodReadyFinalizationGapFixture $fixture }
+}
+
+# Production mutation caught: finalizing ProtectionReady when any receipt, selected pointer, or recorded manifest proof no longer matches.
+$results += Invoke-CcodTest 'invalid Ready receipt pointer or manifest leaves ProtectionReady without runtime pointer or Failed writes' {
+    $fixture=New-CcodReadyFinalizationGapFixture
+    $caseRoots=[Collections.Generic.List[string]]::new()
+    try {
+        Remove-Item -LiteralPath $fixture.Source -Recurse -Force
+        foreach($case in @(
+            @{Name='receipt';Mutate={param($Root,$Transaction)$path=@(Get-ChildItem -LiteralPath (Join-Path $Root 'state\activation-receipts') -Filter '*.Ready.json' -File)[0].FullName;[IO.File]::SetAttributes($path,[IO.FileAttributes]::Normal);[IO.File]::WriteAllText($path,'{',[Text.UTF8Encoding]::new($false))}},
+            @{Name='pointer';Mutate={param($Root,$Transaction)$path=@(Get-ChildItem -LiteralPath (Join-Path $Root 'state\active-generation') -Filter '*.json' -File|Sort-Object Name)[-1].FullName;$record=Get-Content -LiteralPath $path -Raw|ConvertFrom-Json;$replacement=if($record.activeRuntime.EndsWith('0')){'1'}else{'0'};$record.activeRuntime=$record.activeRuntime.Substring(0,$record.activeRuntime.Length-1)+$replacement;[IO.File]::SetAttributes($path,[IO.FileAttributes]::Normal);[IO.File]::WriteAllText($path,($record|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))}},
+            @{Name='manifest';Mutate={param($Root,$Transaction)$path=Join-Path $Root "runtime\$($Transaction.newRuntimeId)\manifest.json";[IO.File]::SetAttributes($path,[IO.FileAttributes]::Normal);[IO.File]::AppendAllText($path,"`n",[Text.UTF8Encoding]::new($false))}}
+        )) {
+            $caseRoot=New-CcodLifecycleTempRoot
+            $caseRoots.Add($caseRoot)
+            Copy-Item -LiteralPath $fixture.Install -Destination $caseRoot -Recurse -Force
+            $runtimeCount=@(Get-ChildItem -LiteralPath (Join-Path $caseRoot 'runtime') -Directory -Force).Count
+            $pointerCount=@(Get-ChildItem -LiteralPath (Join-Path $caseRoot 'state\active-generation') -File -Force).Count
+            & $case.Mutate $caseRoot $fixture.Transaction
+            $failure=$null
+            try { Invoke-CcodInstall -SourceRoot $fixture.Source -InstallRoot $caseRoot -Adapters (New-CcodLifecycleFake -NodePath $fixture.Node).Adapters | Out-Null } catch { $failure=$_ }
+            Assert-CcodTrue ($null-ne$failure-and$failure.FullyQualifiedErrorId-like'CCOD_INSTALL_READY_RECOVERY_INVALID*') "$($case.Name) mismatch fails the bounded recovery contract"
+            Assert-CcodEqual $runtimeCount @(Get-ChildItem -LiteralPath (Join-Path $caseRoot 'runtime') -Directory -Force).Count "$($case.Name) mismatch creates no runtime generation"
+            Assert-CcodEqual $pointerCount @(Get-ChildItem -LiteralPath (Join-Path $caseRoot 'state\active-generation') -File -Force).Count "$($case.Name) mismatch appends no active pointer"
+            Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $caseRoot 'state\install-transactions') -Filter '*.Ready.*.json' -File -Force).Count "$($case.Name) mismatch appends no Ready transaction snapshot"
+            Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $caseRoot 'state\install-transactions') -Filter '*.Failed.*.json' -File -Force).Count "$($case.Name) mismatch appends no Failed transaction snapshot"
+            Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $caseRoot 'state\activation-receipts') -Filter '*.Failed.json' -File -Force).Count "$($case.Name) mismatch appends no Failed activation receipt"
+            $module=Get-Module InstallLifecycle -ErrorAction Stop
+            $head=&$module {param($Root,$Id)Read-CcodInstallTransactionRecord -InstallRoot $Root -TransactionId $Id} $caseRoot $fixture.Transaction.transactionId
+            Assert-CcodEqual 'ProtectionReady' $head.phase "$($case.Name) mismatch remains recoverable and nonterminal"
+        }
+    } finally {
+        foreach($caseRoot in $caseRoots){if(Test-Path -LiteralPath $caseRoot){Remove-Item -LiteralPath $caseRoot -Recurse -Force}}
+        Remove-CcodReadyFinalizationGapFixture $fixture
+    }
+}
+
 $results += Invoke-CcodTest 'source reparse point fails closed before staging' {
     $source = New-CcodLifecycleTempRoot
     $install = New-CcodLifecycleTempRoot
diff --git a/tests/persistence/RuntimeManifest.SelfTest.ps1 b/tests/persistence/RuntimeManifest.SelfTest.ps1
index e0db57e..2a324b5 100644
--- a/tests/persistence/RuntimeManifest.SelfTest.ps1
+++ b/tests/persistence/RuntimeManifest.SelfTest.ps1
@@ -7,6 +7,7 @@ $installLifecycleModule = Import-Module (Join-Path $repositoryRoot 'src\persiste
 Import-Module (Join-Path $repositoryRoot 'src\persistence\modules\PersistenceIO.psm1') -Force
 Import-Module (Join-Path $repositoryRoot 'src\persistence\modules\RuntimeManifest.psm1') -Force
 Import-Module (Join-Path $repositoryRoot 'src\persistence\modules\LifecycleEpoch.psm1') -Force
+Import-Module (Join-Path $repositoryRoot 'src\persistence\modules\InstallFileTransaction.psm1')
 Import-Module (Join-Path $repositoryRoot 'src\persistence\modules\PersistenceIO.psm1') -Force
 
 $root = Join-Path ([IO.Path]::GetTempPath()) ("ccod-runtime-manifest-" + [guid]::NewGuid().ToString('N'))
@@ -176,6 +177,23 @@ try {
         Assert-CcodThrows { Read-CcodActiveRuntime -InstallRoot $installRoot } 'CCOD_RUNTIME_ID_INVALID'
     }
 
+    Invoke-CcodTest 'default immutable pointer fence commits fresh and append-only upgrade with real ownership' {
+        $installRoot=Join-Path $root 'default-immutable-fence';[IO.Directory]::CreateDirectory($installRoot)|Out-Null;$identity=[Security.Principal.WindowsIdentity]::GetCurrent();$process=[Diagnostics.Process]::GetCurrentProcess();$firstTx=$null;$secondTx=$null;$ownership=$null
+        $makeGeneration={param($Root,$Content,$Nonce)$source=Join-Path $Root ("source-$Nonce.txt");[IO.File]::WriteAllText($source,$Content,[Text.UTF8Encoding]::new($false));$sha=(Get-FileHash -LiteralPath $source -Algorithm SHA256).Hash.ToLowerInvariant();$records=@([pscustomobject]@{path='payload.txt';length=[int64](Get-Item $source).Length;sha256=$sha});$id=Get-CcodRuntimeId -ProjectVersion '2.5.22' -Files $records -Nonce $Nonce;$tx=Open-CcodInstallGeneration -InstallRoot $Root -RuntimeId $id;Copy-CcodInstallSealedSource -Generation $tx -SourcePath $source -Leaf 'payload.txt' -ExpectedLength $records[0].length -ExpectedSha256 $sha|Out-Null;$runtime=Join-Path $Root "runtime\$id";$manifest=New-CcodRuntimeManifest -RuntimeDirectory $runtime -ProjectVersion '2.5.22' -RuntimeId $id;Write-CcodInstallGenerationManifest -Generation $tx -Manifest $manifest|Out-Null;[pscustomobject]@{Id=$id;Transaction=$tx;Generation=$tx}}
+        try{
+            $first=&$makeGeneration $installRoot 'first' ('1'*32);$firstTx=$first.Transaction
+            $owner=[pscustomobject][ordered]@{pid=[int]$process.Id;creationTimeUtc=$process.StartTime.ToUniversalTime().ToString('o')}
+            $ownership=Enter-CcodLifecycleOwnership -InstallRoot $installRoot -RuntimeId $first.Id -RuntimeGeneration 1 -OwnerIdentity $owner -UserSid $identity.User.Value -SessionId ([int]$process.SessionId)
+            $fresh=Set-CcodActiveRuntime -InstallRoot $installRoot -NewRuntimeId $first.Id -TargetGeneration $first.Generation -FileTransaction $first.Transaction -Ownership $ownership
+            Assert-CcodEqual 1 $fresh.generation 'default fresh fence commits generation one'
+            Exit-CcodLifecycleOwnership $ownership|Out-Null;$ownership=$null;Close-CcodInstallFileTransaction $firstTx Ready;$firstTx=$null
+            $second=&$makeGeneration $installRoot 'second' ('2'*32);$secondTx=$second.Transaction
+            $ownership=Enter-CcodLifecycleOwnership -InstallRoot $installRoot -RuntimeId $fresh.activeRuntime -RuntimeGeneration $fresh.generation -OwnerIdentity $owner -UserSid $identity.User.Value -SessionId ([int]$process.SessionId)
+            $upgraded=Set-CcodActiveRuntime -InstallRoot $installRoot -NewRuntimeId $second.Id -TargetGeneration $second.Generation -FileTransaction $second.Transaction -Ownership $ownership
+            Assert-CcodEqual 2 $upgraded.generation 'default upgrade fence advances append-only generation';Assert-CcodEqual $second.Id $upgraded.activeRuntime 'default upgrade fence selects the new target'
+        }finally{if($null-ne$ownership-and-not$ownership.released){Exit-CcodLifecycleOwnership $ownership|Out-Null};if($null-ne$firstTx){Close-CcodInstallFileTransaction $firstTx Failed};if($null-ne$secondTx){Close-CcodInstallFileTransaction $secondTx Failed};$process.Dispose();$identity.Dispose()}
+    }
+
     Invoke-CcodTest 'append-only active selector rejects unknown reparse ADS and multi-linked leaves' {
         foreach($kind in @('unknown','reparse','ads','multilink')){
             $installRoot=Join-Path $root ("pointer-$kind");$pointerRoot=Join-Path $installRoot 'state\active-generation';$target=Join-Path $outside ("pointer-$kind")
diff --git a/tests/persistence/StaticProbeWorker.SelfTest.ps1 b/tests/persistence/StaticProbeWorker.SelfTest.ps1
index 0344546..48943c7 100644
--- a/tests/persistence/StaticProbeWorker.SelfTest.ps1
+++ b/tests/persistence/StaticProbeWorker.SelfTest.ps1
@@ -511,6 +511,21 @@ try {
         Assert-CcodEqual $fixture.RuntimeId $context.RuntimeId 'static worker binds the append-only selected runtime'
     }
 
+    Invoke-CcodTest 'append-only authorization rejects unsafe roots leaves JSON and generations' {
+        foreach($kind in @('root-file','root-reparse','leaf-reparse','ads','multilink','duplicate','fractional','noncanonical')){
+            $fixture=New-CcodAuthorizedRuntimeFixture -Root (Join-Path $root ("append-hostile-$kind")) -AppendOnly;$pointerRoot=Join-Path $fixture.InstallRoot 'state\active-generation';$leaf=Join-Path $pointerRoot '00000000000000000001.json';$target=Join-Path $fixture.InstallRoot ("target-$kind")
+            if($kind-ceq'root-file'){Remove-Item $pointerRoot -Recurse -Force;[IO.File]::WriteAllText($pointerRoot,'x',[Text.UTF8Encoding]::new($false))}
+            elseif($kind-ceq'root-reparse'){Remove-Item $pointerRoot -Recurse -Force;[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $pointerRoot -Target $target|Out-Null}
+            elseif($kind-ceq'leaf-reparse'){[IO.File]::Delete($leaf);[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $leaf -Target $target|Out-Null}
+            elseif($kind-ceq'ads'){Set-Content -LiteralPath $leaf -Stream evidence -Value x -NoNewline}
+            elseif($kind-ceq'multilink'){$text=[IO.File]::ReadAllText($leaf);[IO.File]::Delete($leaf);$outside=Join-Path $fixture.InstallRoot 'outside-pointer.json';[IO.File]::WriteAllText($outside,$text,[Text.UTF8Encoding]::new($false));New-Item -ItemType HardLink -Path $leaf -Target $outside|Out-Null}
+            elseif($kind-ceq'duplicate'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"schemaVersion":1,"generation":1,"activeRuntime":"'+$id+'","previousGeneration":0}'),[Text.UTF8Encoding]::new($false))}
+            elseif($kind-ceq'fractional'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"generation":1.5,"activeRuntime":"'+$id+'","previousGeneration":0}'),[Text.UTF8Encoding]::new($false))}
+            else{Move-Item -LiteralPath $leaf -Destination (Join-Path $pointerRoot '00000000000000000002.json')}
+            Assert-CcodThrows {Get-CcodStaticProbeRuntimeAuthorization -ScriptPath $fixture.WorkerPath|Out-Null} 'CCOD_STATIC_RUNTIME_UNAUTHORIZED'
+        }
+    }
+
     Invoke-CcodTest 'imports only exact private bound runtime APIs and unloads every module command surface' {
         $fixture=New-CcodAuthorizedRuntimeFixture -Root (Join-Path $root 'private-runtime-api')
         $context=Get-CcodStaticProbeRuntimeAuthorization -ScriptPath $fixture.WorkerPath
diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index acbdc2c..c9de83a 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -238,6 +238,11 @@ $results += Invoke-CcodTest 'production uninstall authorization consumes append-
     try{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$localAppData,'Process');$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $installRoot -AppendOnly;$context=Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $installRoot;Assert-CcodEqual $fixture.RuntimeId $context.runtimeId 'uninstall context binds append-only active runtime';Assert-CcodEqual 7 ([uint64]$context.runtimeGeneration) 'uninstall context binds latest append-only generation';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $installRoot 'active.json')) 'append-only uninstall authorization needs no legacy pointer'}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $localAppData){Remove-Item $localAppData -Recurse -Force}}
 }
 
+$results += Invoke-CcodTest 'uninstall append-only authorization rejects unsafe roots leaves JSON and generations' {
+    $previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
+    try{foreach($kind in @('root-file','root-reparse','leaf-reparse','ads','multilink','duplicate','fractional','noncanonical')){$local=Join-Path ([IO.Path]::GetTempPath()) ("ccod-uninstall-hostile-$kind-"+[guid]::NewGuid().ToString('N'));$install=Join-Path $local 'CodexControlOtherDevices';[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$pointerRoot=Join-Path $install 'state\active-generation';$leaf=Join-Path $pointerRoot '00000000000000000007.json';$target=Join-Path $install ("target-$kind");if($kind-ceq'root-file'){Remove-Item $pointerRoot -Recurse -Force;[IO.File]::WriteAllText($pointerRoot,'x',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'root-reparse'){Remove-Item $pointerRoot -Recurse -Force;[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $pointerRoot -Target $target|Out-Null}elseif($kind-ceq'leaf-reparse'){[IO.File]::Delete($leaf);[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $leaf -Target $target|Out-Null}elseif($kind-ceq'ads'){Set-Content -LiteralPath $leaf -Stream evidence -Value x -NoNewline}elseif($kind-ceq'multilink'){$text=[IO.File]::ReadAllText($leaf);[IO.File]::Delete($leaf);$outside=Join-Path $install 'outside-pointer.json';[IO.File]::WriteAllText($outside,$text,[Text.UTF8Encoding]::new($false));New-Item -ItemType HardLink -Path $leaf -Target $outside|Out-Null}elseif($kind-ceq'duplicate'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"schemaVersion":1,"generation":7,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'fractional'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"generation":7.5,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}else{Move-Item $leaf (Join-Path $pointerRoot '00000000000000000008.json')};Assert-CcodThrows {Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $install|Out-Null} 'CCOD_UNINSTALL_RUNTIME_INVALID';if(Test-Path $local){Remove-Item $local -Recurse -Force}}}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process')}
+}
+
 $results += Invoke-CcodTest 'external staging refuses a cleanup source changed after runtime verification' {
     $localAppData = Join-Path ([IO.Path]::GetTempPath()) ('ccod-uninstall-race-' + [guid]::NewGuid().ToString('N'))
     $installRoot = Join-Path $localAppData 'CodexControlOtherDevices'

From 8eb69208b186a4e5b147dda8b51c48299a222872 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 11:23:07 +0800
Subject: [PATCH 083/187] fix: fail closed selector fallback

---
 .../task-2-report.md                          | 77 +++++++++++++++++++
 ...08-29-v2522-immutable-generation-design.md |  8 +-
 src/persistence/StaticProbeWorker.ps1         |  5 +-
 src/persistence/UninstallBootstrap.ps1        |  9 ++-
 src/persistence/bootstrap.ps1                 |  9 ++-
 src/persistence/modules/RuntimeManifest.psm1  | 14 ++--
 tests/persistence/Bootstrap.SelfTest.ps1      |  7 +-
 .../InstallFileTransaction.SelfTest.ps1       | 46 +++++++----
 .../persistence/RuntimeManifest.SelfTest.ps1  | 14 ++++
 .../StaticProbeWorker.SelfTest.ps1            | 15 +++-
 .../UninstallBootstrap.SelfTest.ps1           |  7 +-
 11 files changed, 174 insertions(+), 37 deletions(-)

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md
index 1ca25ce..10adf5e 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md
@@ -289,3 +289,80 @@ Important findings. This round keeps `2101485` and remediates all seven.
   a sandbox against unrestricted same-user or in-process code.
 - Failed and superseded immutable generations remain retained until the
   separately proven reclamation path runs.
+
+## Fix round 3 — fail closed selector fallback
+
+### RED and root-cause evidence
+
+- RuntimeManifest command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\RuntimeManifest.SelfTest.ps1`
+  exited `1` at
+  `default-immutable-fence-rejects-selector-root-files-and-non-not-found-lookup-failures-before-pointer-commit`
+  with `CCOD_INSTALL_POINTER_COMMIT_FAILED` and `The directory name is
+  invalid`. A selector-root file passed the authorization read and failed only
+  later inside pointer commit.
+- Bootstrap command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\Bootstrap.SelfTest.ps1`
+  exited `1` at
+  `bootstrap-selector-fallback-requires-proven-ItemNotFound-instead-of-a-lookup-error`;
+  the wished-for selector lookup seam did not yet exist
+  (`NamedParameterNotFound,Read-CcodBootstrapActivePointer`).
+- StaticProbeWorker command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\StaticProbeWorker.SelfTest.ps1`
+  exited `1` in the hostile selector matrix with
+  `ASSERT_THROWS: expected CCOD_STATIC_RUNTIME_UNAUTHORIZED`. The exact
+  identified case was `schema`: selector `schemaVersion:2` was authorized.
+- UninstallBootstrap command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\UninstallBootstrap.SelfTest.ps1`
+  exited `1` at
+  `uninstall-selector-fallback-requires-proven-ItemNotFound-instead-of-a-lookup-error`;
+  the wished-for selector lookup seam did not yet exist
+  (`NamedParameterNotFound,Get-CcodUninstallBootstrapVerifiedRuntimeContext`).
+
+### GREEN and final verification evidence
+
+- InstallFileTransaction exited `0`; all 26 named cases passed. The V3/V4
+  evidence now uses a fresh child `powershell.exe`: V3 is defined first, V4 is
+  proven absent before import, the current module then exposes ABI V4, one
+  state record is appended, and generation leaf, copy, manifest, retained,
+  pointer, and retirement operations are rejected through exports only.
+- Bootstrap exited `0` with `Bootstrap self-test passed: 25`.
+- RuntimeManifest exited `0`; all 20 named cases reported `True`.
+- StaticProbeWorker exited `0`; all 39 named cases reported `True`.
+- UninstallBootstrap exited `0` with
+  `Uninstall bootstrap self-tests passed: 15`.
+- InstallLifecycle exited `0` with
+  `Install lifecycle self-tests passed: 116`.
+- PersistenceIO exited `0`; all 24 named cases reported `True`.
+- UiPreferences exited `0`; all 9 named cases reported `PASS`.
+- Explicit parser checks passed all 9 changed `.ps1`/`.psm1` files
+  (`PARSER_COUNT=9`).
+- `git diff --check` exited `0`; it emitted only checkout LF-to-CRLF warnings.
+- Aggregate command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\PersistenceSelfTest.ps1`
+  exited `0` and emitted no stdout/stderr result text.
+
+### Behavior and boundaries
+
+- RuntimeManifest/default fence, Bootstrap, StaticProbeWorker, and
+  UninstallBootstrap permit legacy `active.json` fallback only after a proven
+  ItemNotFound result for `state\active-generation`. Root files, reparse
+  points, access/I/O lookup errors, null/non-proof adapter returns, malformed
+  stores, and unsupported records fail with the component's bounded pointer or
+  runtime authorization error.
+- StaticProbeWorker now requires append-only selector `schemaVersion` to be
+  exactly integer `1`. Static and Uninstall matrices cover malformed JSON,
+  unsupported schema, duplicate key, ADS, multi-link, root/leaf reparse,
+  fractional generation, and noncanonical names before runtime authorization.
+  Bootstrap retains equivalent hostile-selector coverage.
+- Every fix2 invariant remains covered, including the real default pointer
+  fence, state-only Ready finalization, recorded-manifest compensation, and no
+  root-shell overwrite.
+- No push, tag, release, build, installation, product-process action,
+  WindowsApps access, DPAPI access, or external write was performed.
+
+### Remaining concerns
+
+- The documented current-user ordinary-race boundary remains unchanged.
+- Failed and superseded immutable generations remain retained until the
+  separately proven reclamation path runs.
diff --git a/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md b/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
index b59c532..57f4cb6 100644
--- a/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
+++ b/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
@@ -87,6 +87,11 @@ new chain is absent. Lifecycle readiness likewise accepts the exact
 generation bootstrap selected by the scheduled task, with the fixed root
 bootstrap retained only for a proven legacy task.
 
+Absence of the append-only selector is a positive lookup result: only an exact
+ItemNotFound outcome permits legacy fallback. A selector-root file, reparse
+point, access or I/O failure, malformed store, or unsupported record fails the
+component's bounded authorization contract instead of consulting `active.json`.
+
 ### 1a. Immutable initialization evidence and operational state
 
 The install transaction writes create-only, generation-bound initialization
@@ -132,7 +137,8 @@ only the install-root `state` directories and create-only records; it cannot
 create a runtime generation, copy a payload, write a manifest, open a retained
 generation, or commit a pointer. A recovery uses it only after revalidating the
 already committed pointer, generation manifest, Ready receipt, and transaction
-identity.
+identity. Its V4 ABI compatibility proof runs in a fresh child process that
+loads the V3 marker first and exercises only the exported capability surface.
 
 `Retire-CcodInstallGeneration` removes a generation from the active selection by
 one create-only retired-generation record; it does not rename or recursively
diff --git a/src/persistence/StaticProbeWorker.ps1 b/src/persistence/StaticProbeWorker.ps1
index fd25ee5..3c40e2d 100644
--- a/src/persistence/StaticProbeWorker.ps1
+++ b/src/persistence/StaticProbeWorker.ps1
@@ -463,11 +463,12 @@ function Get-CcodStaticProbeRuntimeAuthorization {
         $installRoot=[IO.Path]::GetFullPath($installRoot);$runtimeRoot=[IO.Path]::GetFullPath($runtimeRoot)
         Assert-CcodStaticProbeNoReparse -Root $installRoot -Path $ScriptPath -Adapters $Adapters
         $pointerRoot=[IO.Path]::GetFullPath((Join-Path $installRoot 'state\active-generation'))
-        $pointerRootItem=$null;try{$pointerRootItem=Get-Item -LiteralPath $pointerRoot -Force -ErrorAction Stop}catch{}
+        $pathAdapters=Get-CcodStaticProbePathAdapters $Adapters
+        $pointerRootItem=Invoke-CcodStaticAdapter $pathAdapters.GetItem @($pointerRoot,$true) OptionalSingle 'CCOD_STATIC_RUNTIME_UNAUTHORIZED'
         if($null-ne$pointerRootItem-and-not$pointerRootItem.PSIsContainer){throw 'selector root type'}
         if($null-ne$pointerRootItem){
             Assert-CcodStaticProbeNoReparse $installRoot $pointerRoot -Adapters $Adapters;$entries=@(Get-ChildItem -LiteralPath $pointerRoot -Force -ErrorAction Stop);if($entries.Count-eq0){throw 'empty active chain'};$records=[Collections.Generic.List[object]]::new()
-            foreach($entry in $entries){if($entry.PSIsContainer-or$entry.Name-cnotmatch'^\d{20}\.json$'){throw 'active entry'};Assert-CcodStaticSelectorFile $installRoot $entry.FullName $Adapters;$record=Read-CcodStaticProbeLocalJson $entry.FullName;Assert-CcodStaticExactObject $record @('schemaVersion','generation','activeRuntime','previousGeneration') 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Active generation'|Out-Null;if($record.schemaVersion-isnot[int]-or$record.generation-isnot[long]-and$record.generation-isnot[int]-or$record.previousGeneration-isnot[long]-and$record.previousGeneration-isnot[int]-or-not(Test-CcodStaticRuntimeId $record.activeRuntime)){throw 'active generation'};try{[uint64]$generation=$record.generation;[uint64]$previousGeneration=$record.previousGeneration}catch{throw 'active generation range'};if($generation-eq0-or$previousGeneration-eq[uint64]::MaxValue-or$generation-ne($previousGeneration+1)-or$entry.Name-cne('{0:D20}.json'-f$generation)){throw 'active generation canonical'};$records.Add([pscustomobject]@{generation=$generation;previousGeneration=$previousGeneration;activeRuntime=[string]$record.activeRuntime;path=$entry.FullName})}
+            foreach($entry in $entries){if($entry.PSIsContainer-or$entry.Name-cnotmatch'^\d{20}\.json$'){throw 'active entry'};Assert-CcodStaticSelectorFile $installRoot $entry.FullName $Adapters;$record=Read-CcodStaticProbeLocalJson $entry.FullName;Assert-CcodStaticExactObject $record @('schemaVersion','generation','activeRuntime','previousGeneration') 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Active generation'|Out-Null;if($record.schemaVersion -isnot [int] -or $record.schemaVersion -ne 1){throw 'active generation schema'};if($record.generation-isnot[long]-and$record.generation-isnot[int]-or$record.previousGeneration-isnot[long]-and$record.previousGeneration-isnot[int]-or-not(Test-CcodStaticRuntimeId $record.activeRuntime)){throw 'active generation'};try{[uint64]$generation=$record.generation;[uint64]$previousGeneration=$record.previousGeneration}catch{throw 'active generation range'};if($generation-eq0-or$previousGeneration-eq[uint64]::MaxValue-or$generation-ne($previousGeneration+1)-or$entry.Name-cne('{0:D20}.json'-f$generation)){throw 'active generation canonical'};$records.Add([pscustomobject]@{generation=$generation;previousGeneration=$previousGeneration;activeRuntime=[string]$record.activeRuntime;path=$entry.FullName})}
             $ordered=@($records|Sort-Object generation);for($i=0;$i-lt$ordered.Count;$i++){if([uint64]$ordered[$i].generation-ne[uint64]($i+1)-or[uint64]$ordered[$i].previousGeneration-ne[uint64]$i){throw 'active chain'}};$latest=$ordered[-1];$active=[pscustomobject]@{activeRuntime=$latest.activeRuntime};$activePath=$latest.path
         }else{$activePath=[IO.Path]::GetFullPath((Join-Path $installRoot 'active.json'));Assert-CcodStaticProbeNoReparse $installRoot $activePath -Adapters $Adapters;$active=Read-CcodStaticProbeLocalJson $activePath;Assert-CcodStaticExactObject $active @('schemaVersion','activeRuntime','previousRuntime','updatedAtUtc') 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Active pointer'|Out-Null;if($active.schemaVersion -isnot [int] -or $active.schemaVersion -ne 1 -or -not(Test-CcodStaticRuntimeId $active.activeRuntime) -or($null -ne $active.previousRuntime -and (-not(Test-CcodStaticRuntimeId $active.previousRuntime) -or $active.previousRuntime -ceq $active.activeRuntime)) -or-not(Test-CcodStaticCanonicalUtc $active.updatedAtUtc)){throw 'active pointer'}}
         if($active.activeRuntime-cne$runtimeId){throw 'active runtime'}
diff --git a/src/persistence/UninstallBootstrap.ps1 b/src/persistence/UninstallBootstrap.ps1
index ea70a76..85a839e 100644
--- a/src/persistence/UninstallBootstrap.ps1
+++ b/src/persistence/UninstallBootstrap.ps1
@@ -353,7 +353,7 @@ function New-CcodUninstallBootstrapResumeContext {
 }
 
 function Get-CcodUninstallBootstrapVerifiedRuntimeContext {
-    param([Parameter(Mandatory)][string]$InstallerRoot,[Parameter(Mandatory)][string]$InstallRoot)
+    param([Parameter(Mandatory)][string]$InstallerRoot,[Parameter(Mandatory)][string]$InstallRoot,[hashtable]$SelectorAdapters)
     try {
         $installer = Get-CcodUninstallBootstrapComparablePath -Path $InstallerRoot -Kind 'Installer root'
         $install = Get-CcodUninstallBootstrapComparablePath -Path $InstallRoot -Kind 'Install root'
@@ -369,9 +369,10 @@ function Get-CcodUninstallBootstrapVerifiedRuntimeContext {
             Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'The uninstall bootstrap was not launched from the installed application root' $PSCommandPath
         }
         try{$pointerRoot=Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath 'state\active-generation' -AllowMissingLeaf}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active generation selector root is unsafe' $install}
-        $pointerRootItem=$null;try{$pointerRootItem=Get-Item -LiteralPath $pointerRoot -Force -ErrorAction Stop}catch{}
-        if($null-ne$pointerRootItem-and-not$pointerRootItem.PSIsContainer){throw 'selector root type'}
-        if($null-ne$pointerRootItem){
+        $pointerRootItem=$null;$pointerRootAbsent=$false;$getSelectorRootItem=if($null-ne$SelectorAdapters-and$SelectorAdapters.ContainsKey('GetSelectorRootItem')){$SelectorAdapters.GetSelectorRootItem}else{{param($Path)Get-Item -LiteralPath $Path -Force -ErrorAction Stop}}
+        try{$pointerRootItem=&$getSelectorRootItem $pointerRoot;if($null-eq$pointerRootItem){throw [IO.InvalidDataException]::new('selector lookup returned no proof')}}catch [Management.Automation.ItemNotFoundException]{$pointerRootAbsent=$true}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active generation selector root lookup failed' $pointerRoot}
+        if(-not$pointerRootAbsent-and-not$pointerRootItem.PSIsContainer){throw 'selector root type'}
+        if(-not$pointerRootAbsent){
             $entries=@(Get-ChildItem -LiteralPath $pointerRoot -Force -ErrorAction Stop);if($entries.Count-eq0){throw 'empty selector'};$records=[Collections.Generic.List[object]]::new()
             foreach($entry in $entries){if($entry.PSIsContainer-or$entry.Name-cnotmatch'^\d{20}\.json$'){throw 'selector entry'};try{$path=Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath ('state\active-generation\'+$entry.Name) -RequireLeafFile;$record=Read-CcodUninstallBootstrapJson -Path $path -Kind 'Active generation'}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active generation selector leaf is unsafe' $entry.FullName};$integerTypes=@([byte],[uint16],[uint32],[uint64],[int16],[int32],[int64]);$gType=$false;$pType=$false;foreach($t in $integerTypes){if($record.generation-is$t){$gType=$true};if($record.previousGeneration-is$t){$pType=$true}};if(-not(Test-CcodUninstallBootstrapExactProperties $record @('schemaVersion','generation','activeRuntime','previousGeneration'))-or$record.schemaVersion-isnot[int]-or$record.schemaVersion-ne1-or-not$gType-or-not$pType-or$record.activeRuntime-isnot[string]-or$record.activeRuntime-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$'){throw 'selector record'};[uint64]$g=ConvertTo-CcodUninstallBootstrapUInt64 $record.generation 'active generation';[uint64]$p=[uint64]$record.previousGeneration;if($p-eq[uint64]::MaxValue-or$g-ne($p+1)-or$entry.Name-cne('{0:D20}.json'-f$g)){throw 'selector canonical'};$records.Add([pscustomobject]@{generation=$g;previousGeneration=$p;activeRuntime=[string]$record.activeRuntime})}
             $ordered=@($records|Sort-Object generation);for($i=0;$i-lt$ordered.Count;$i++){if([uint64]$ordered[$i].generation-ne[uint64]($i+1)-or[uint64]$ordered[$i].previousGeneration-ne[uint64]$i){throw 'selector chain'}};$latest=$ordered[-1];$active=[pscustomobject]@{activeRuntime=$latest.activeRuntime};$generation=[uint64]$latest.generation
diff --git a/src/persistence/bootstrap.ps1 b/src/persistence/bootstrap.ps1
index 4893b28..d092d5d 100644
--- a/src/persistence/bootstrap.ps1
+++ b/src/persistence/bootstrap.ps1
@@ -165,12 +165,13 @@ function Assert-CcodBootstrapPlainSelectorFile {
 }
 
 function Read-CcodBootstrapActivePointer {
-    param([Parameter(Mandatory)][string]$InstallRoot)
+    param([Parameter(Mandatory)][string]$InstallRoot,[hashtable]$SelectorAdapters)
 
     try{$pointerRoot=Assert-CcodBootstrapContained -Root $InstallRoot -Path (Join-Path $InstallRoot 'state\active-generation') -AllowMissingLeaf}catch{Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector root is unsafe' (Join-Path $InstallRoot 'state\active-generation')}
-    $pointerRootItem=$null;try{$pointerRootItem=Get-Item -LiteralPath $pointerRoot -Force -ErrorAction Stop}catch{}
-    if($null-ne$pointerRootItem-and-not$pointerRootItem.PSIsContainer){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector root is not a directory' $pointerRoot}
-    if($null-ne$pointerRootItem){
+    $pointerRootItem=$null;$pointerRootAbsent=$false;$getSelectorRootItem=if($null-ne$SelectorAdapters-and$SelectorAdapters.ContainsKey('GetSelectorRootItem')){$SelectorAdapters.GetSelectorRootItem}else{{param($Path)Get-Item -LiteralPath $Path -Force -ErrorAction Stop}}
+    try{$pointerRootItem=&$getSelectorRootItem $pointerRoot;if($null-eq$pointerRootItem){throw [IO.InvalidDataException]::new('selector lookup returned no proof')}}catch [Management.Automation.ItemNotFoundException]{$pointerRootAbsent=$true}catch{Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector root lookup failed' $pointerRoot}
+    if(-not$pointerRootAbsent-and-not$pointerRootItem.PSIsContainer){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector root is not a directory' $pointerRoot}
+    if(-not$pointerRootAbsent){
         if(Test-CcodBootstrapReparse $pointerRoot){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector root is a reparse point' $pointerRoot}
         $entries=@(Get-ChildItem -LiteralPath $pointerRoot -Force -ErrorAction Stop)
         if($entries.Count-eq0){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector is empty' $pointerRoot}
diff --git a/src/persistence/modules/RuntimeManifest.psm1 b/src/persistence/modules/RuntimeManifest.psm1
index 05fa9e7..6c57e0d 100644
--- a/src/persistence/modules/RuntimeManifest.psm1
+++ b/src/persistence/modules/RuntimeManifest.psm1
@@ -38,6 +38,7 @@ function Get-CcodRuntimeAdapters {
 
     $resolved = @{
         UtcNow = { [DateTime]::UtcNow }
+        GetSelectorRootItem = { param($Path) Get-Item -LiteralPath $Path -Force -ErrorAction Stop }
         AssertLifecycleFence = {
             param($InstallRoot, $Ownership, $ExpectActivePointer, $NewRuntimeId)
             if ([bool]$ExpectActivePointer) {
@@ -45,7 +46,7 @@ function Get-CcodRuntimeAdapters {
                 if($null-eq$selected-or$selected.activeRuntime-cne$Ownership.runtimeId-or[uint64]$selected.generation-ne[uint64]$Ownership.runtimeGeneration){Throw-CcodRuntimeError 'CCOD_RUNTIME_FENCE_STALE' 'Append-only selected runtime does not match lifecycle ownership' $Ownership}
                 return Assert-CcodLifecycleFence -InstallRoot $InstallRoot -Ownership $Ownership
             }
-            try{$unexpected=Read-CcodActiveRuntime -InstallRoot $InstallRoot}catch{$unexpected=$null}
+            try{$unexpected=Read-CcodActiveRuntime -InstallRoot $InstallRoot}catch{if((Get-CcodErrorId $_)-notin@('CCOD_STATE_MISSING','CCOD_PATH_MISSING')){throw};$unexpected=$null}
             if ($null-ne$unexpected-or[IO.Directory]::Exists((Join-Path $InstallRoot 'state\active-generation'))-or[IO.File]::Exists((Join-Path $InstallRoot 'active.json'))) { Throw-CcodRuntimeError 'CCOD_RUNTIME_FENCE_STALE' 'Unexpected active selector appeared during lifecycle initialization' $InstallRoot }
             if ([UInt64]$Ownership.runtimeGeneration -ne 1 -or [string]$Ownership.runtimeId -cne [string]$NewRuntimeId) {
                 Throw-CcodRuntimeError 'CCOD_RUNTIME_FENCE_STALE' 'Initial active pointer requires generation-one ownership of the new runtime' $Ownership
@@ -358,10 +359,13 @@ public static class CcodRuntimePointerIdentity { [StructLayout(LayoutKind.Sequen
 
 function Read-CcodActiveRuntime {
     [CmdletBinding()]
-    param([Parameter(Mandatory)][string]$InstallRoot)
+    param([Parameter(Mandatory)][string]$InstallRoot,[hashtable]$Adapters)
 
     $pointerRoot = Resolve-CcodContainedPath -Root $InstallRoot -RelativePath 'state\active-generation' -AllowMissingLeaf
-    if ([IO.Directory]::Exists($pointerRoot)) {
+    $selectorRootItem=$null;$selectorRootAbsent=$false;$selectorRootReader=if($null-ne$Adapters-and$Adapters.ContainsKey('GetSelectorRootItem')){$Adapters.GetSelectorRootItem}else{{param($Path)Get-Item -LiteralPath $Path -Force -ErrorAction Stop}}
+    try{$selectorRootItem=&$selectorRootReader $pointerRoot;if($null-eq$selectorRootItem){throw [IO.InvalidDataException]::new('selector lookup returned no proof')}}catch [Management.Automation.ItemNotFoundException]{$selectorRootAbsent=$true}catch{Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation selector root lookup failed' $pointerRoot}
+    if (-not$selectorRootAbsent) {
+        if(-not$selectorRootItem.PSIsContainer-or($selectorRootItem.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation selector root is not a plain directory' $pointerRoot}
         $entries=@(Get-ChildItem -LiteralPath $pointerRoot -Force -ErrorAction Stop)
         if($entries.Count-eq 0){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation store is empty' $pointerRoot}
         $records=[Collections.Generic.List[object]]::new()
@@ -377,7 +381,7 @@ function Read-CcodActiveRuntime {
         }
         $ordered=@($records|Sort-Object generation);for($i=0;$i-lt$ordered.Count;$i++){if([uint64]$ordered[$i].generation-ne[uint64]($i+1)-or[uint64]$ordered[$i].previousGeneration-ne[uint64]$i){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation chain has a gap' $pointerRoot}}
         $latest=$ordered[-1];$previousRuntime=if($latest.previousGeneration-gt0){[string]$ordered[[int]$latest.previousGeneration-1].activeRuntime}else{$null}
-        return [pscustomobject][ordered]@{schemaVersion=2;activeRuntime=$latest.activeRuntime;previousRuntime=$previousRuntime;generation=[uint64]$latest.generation;updatedAtUtc=(Get-Item $pointerRoot).LastWriteTimeUtc.ToString('o')}
+        return [pscustomobject][ordered]@{schemaVersion=2;activeRuntime=$latest.activeRuntime;previousRuntime=$previousRuntime;generation=[uint64]$latest.generation;updatedAtUtc=$selectorRootItem.LastWriteTimeUtc.ToString('o')}
     }
     $path = Resolve-CcodContainedPath -Root $InstallRoot -RelativePath 'active.json' -AllowMissingLeaf
     $active = $null
@@ -467,7 +471,7 @@ function Set-CcodActiveRuntime {
     if($null-ne$FileTransaction-or$null-ne$TargetGeneration){
         if($null-eq(Get-Command Commit-CcodInstallActivePointer -ErrorAction SilentlyContinue)){Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop}
         if($null-eq$FileTransaction-or$null-eq$TargetGeneration){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Pointer commit requires target and transaction' $InstallRoot}
-        $current=$null;try{$current=Read-CcodActiveRuntime $InstallRoot}catch{if((Get-CcodErrorId $_)-notin@('CCOD_STATE_MISSING','CCOD_PATH_MISSING')){throw}}
+        $current=$null;try{$current=Read-CcodActiveRuntime -InstallRoot $InstallRoot -Adapters @{GetSelectorRootItem=$Adapters.GetSelectorRootItem}}catch{if((Get-CcodErrorId $_)-notin@('CCOD_STATE_MISSING','CCOD_PATH_MISSING')){throw}}
         [uint64]$previous=if($null-eq$current){0}else{$current.generation}
         try{[void](& $Adapters.AssertLifecycleFence $InstallRoot $Ownership ($null-ne$current) $NewRuntimeId)}catch{Throw-CcodRuntimeError 'CCOD_RUNTIME_FENCE_STALE' 'Active runtime mutation lifecycle fence is stale' $InstallRoot}
         $committed=Commit-CcodInstallActivePointer -InstallRoot $InstallRoot -TargetGeneration $TargetGeneration -ExpectedPreviousGeneration $previous -FileTransaction $FileTransaction
diff --git a/tests/persistence/Bootstrap.SelfTest.ps1 b/tests/persistence/Bootstrap.SelfTest.ps1
index e4ccbe4..d3d5020 100644
--- a/tests/persistence/Bootstrap.SelfTest.ps1
+++ b/tests/persistence/Bootstrap.SelfTest.ps1
@@ -339,7 +339,12 @@ $results += Invoke-CcodTest 'production suppression caller fails closed for unsa
 
 
 $results += Invoke-CcodTest 'bootstrap append-only selector rejects unsafe roots leaves JSON and generations' {
-    foreach($kind in @('unknown','root-file','root-reparse','leaf-reparse','ads','multilink','duplicate','fractional','noncanonical')){$root=Join-Path ([IO.Path]::GetTempPath()) ("ccod-bootstrap-pointer-$kind-"+[guid]::NewGuid().ToString('N'));$outside=Join-Path ([IO.Path]::GetTempPath()) ("ccod-bootstrap-pointer-outside-$kind-"+[guid]::NewGuid().ToString('N'));try{New-CcodBootstrapFixture -Root $root|Out-Null;[IO.Directory]::CreateDirectory($outside)|Out-Null;$pointerRoot=Join-Path $root 'state\active-generation';[IO.Directory]::CreateDirectory($pointerRoot)|Out-Null;$path=Join-Path $pointerRoot '00000000000000000001.json';$id='2.5.22-1111111111111111-22222222222222222222222222222222';$json='{"schemaVersion":1,"generation":1,"activeRuntime":"'+$id+'","previousGeneration":0}';if($kind-ceq'unknown'){[IO.File]::WriteAllText((Join-Path $pointerRoot 'unknown.bin'),'x',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'root-file'){Remove-Item $pointerRoot -Recurse -Force;[IO.File]::WriteAllText($pointerRoot,'x',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'root-reparse'){Remove-Item $pointerRoot -Recurse -Force;New-Item -ItemType Junction -Path $pointerRoot -Target $outside|Out-Null}elseif($kind-ceq'leaf-reparse'){New-Item -ItemType Junction -Path $path -Target $outside|Out-Null}elseif($kind-ceq'ads'){[IO.File]::WriteAllText($path,$json,[Text.UTF8Encoding]::new($false));Set-Content -LiteralPath $path -Stream evidence -Value x -NoNewline}elseif($kind-ceq'multilink'){$outsideFile=Join-Path $outside 'pointer.json';[IO.File]::WriteAllText($outsideFile,$json,[Text.UTF8Encoding]::new($false));New-Item -ItemType HardLink -Path $path -Target $outsideFile|Out-Null}elseif($kind-ceq'duplicate'){[IO.File]::WriteAllText($path,('{"schemaVersion":1,"schemaVersion":1,"generation":1,"activeRuntime":"'+$id+'","previousGeneration":0}'),[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'fractional'){[IO.File]::WriteAllText($path,('{"schemaVersion":1,"generation":1.5,"activeRuntime":"'+$id+'","previousGeneration":0}'),[Text.UTF8Encoding]::new($false))}else{[IO.File]::WriteAllText((Join-Path $pointerRoot '00000000000000000002.json'),$json,[Text.UTF8Encoding]::new($false))};Assert-CcodThrows {Read-CcodBootstrapActivePointer -InstallRoot $root|Out-Null} 'CCOD_BOOTSTRAP_POINTER_INVALID'}finally{if(Test-Path $root){Remove-Item $root -Recurse -Force};if(Test-Path $outside){Remove-Item $outside -Recurse -Force}}}
+    foreach($kind in @('unknown','root-file','root-reparse','leaf-reparse','ads','multilink','malformed','schema','duplicate','fractional','noncanonical')){$root=Join-Path ([IO.Path]::GetTempPath()) ("ccod-bootstrap-pointer-$kind-"+[guid]::NewGuid().ToString('N'));$outside=Join-Path ([IO.Path]::GetTempPath()) ("ccod-bootstrap-pointer-outside-$kind-"+[guid]::NewGuid().ToString('N'));try{New-CcodBootstrapFixture -Root $root|Out-Null;[IO.Directory]::CreateDirectory($outside)|Out-Null;$pointerRoot=Join-Path $root 'state\active-generation';[IO.Directory]::CreateDirectory($pointerRoot)|Out-Null;$path=Join-Path $pointerRoot '00000000000000000001.json';$id='2.5.22-1111111111111111-22222222222222222222222222222222';$json='{"schemaVersion":1,"generation":1,"activeRuntime":"'+$id+'","previousGeneration":0}';if($kind-ceq'unknown'){[IO.File]::WriteAllText((Join-Path $pointerRoot 'unknown.bin'),'x',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'root-file'){Remove-Item $pointerRoot -Recurse -Force;[IO.File]::WriteAllText($pointerRoot,'x',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'root-reparse'){Remove-Item $pointerRoot -Recurse -Force;New-Item -ItemType Junction -Path $pointerRoot -Target $outside|Out-Null}elseif($kind-ceq'leaf-reparse'){New-Item -ItemType Junction -Path $path -Target $outside|Out-Null}elseif($kind-ceq'ads'){[IO.File]::WriteAllText($path,$json,[Text.UTF8Encoding]::new($false));Set-Content -LiteralPath $path -Stream evidence -Value x -NoNewline}elseif($kind-ceq'multilink'){$outsideFile=Join-Path $outside 'pointer.json';[IO.File]::WriteAllText($outsideFile,$json,[Text.UTF8Encoding]::new($false));New-Item -ItemType HardLink -Path $path -Target $outsideFile|Out-Null}elseif($kind-ceq'malformed'){[IO.File]::WriteAllText($path,'{',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'schema'){[IO.File]::WriteAllText($path,$json.Replace('"schemaVersion":1','"schemaVersion":2'),[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'duplicate'){[IO.File]::WriteAllText($path,('{"schemaVersion":1,"schemaVersion":1,"generation":1,"activeRuntime":"'+$id+'","previousGeneration":0}'),[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'fractional'){[IO.File]::WriteAllText($path,('{"schemaVersion":1,"generation":1.5,"activeRuntime":"'+$id+'","previousGeneration":0}'),[Text.UTF8Encoding]::new($false))}else{[IO.File]::WriteAllText((Join-Path $pointerRoot '00000000000000000002.json'),$json,[Text.UTF8Encoding]::new($false))};Assert-CcodThrows {Read-CcodBootstrapActivePointer -InstallRoot $root|Out-Null} 'CCOD_BOOTSTRAP_POINTER_INVALID'}finally{if(Test-Path $root){Remove-Item $root -Recurse -Force};if(Test-Path $outside){Remove-Item $outside -Recurse -Force}}}
+}
+
+$results += Invoke-CcodTest 'bootstrap selector fallback requires proven ItemNotFound instead of a lookup error' {
+    $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-bootstrap-pointer-lookup-'+[guid]::NewGuid().ToString('N'))
+    try{New-CcodBootstrapFixture -Root $root|Out-Null;Assert-CcodThrows {Read-CcodBootstrapActivePointer -InstallRoot $root -SelectorAdapters @{GetSelectorRootItem={param($Path)throw [UnauthorizedAccessException]::new('selector lookup denied')}}|Out-Null} 'CCOD_BOOTSTRAP_POINTER_INVALID'}finally{if(Test-Path $root){Remove-Item $root -Recurse -Force}}
 }
 
 $results += Invoke-CcodTest 'generation bootstrap launches the append-only selected runtime without root active json' {
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index b560dc0..31a4cfc 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -531,26 +531,38 @@ Invoke-CcodExtensionRedTest 'child-transaction' 'rejects a child directory capab
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
 
-Invoke-CcodExtensionRedTest 'v3-reimport' 're-imports ABI V4 and exercises every retained extension export' {
+Invoke-CcodExtensionRedTest 'v3-reimport' 'a child process loads V3 first then proves the V4 state-only export boundary' {
     $fixture=New-CcodInstallFileFixture
     try {
-        if($null-eq('CcodInstallGenerationCapabilityMarkerV3'-as[type])){Add-Type -TypeDefinition 'public sealed class CcodInstallGenerationCapabilityMarkerV3 { private CcodInstallGenerationCapabilityMarkerV3() {} public static int CapabilityAbi { get { return 3; } } }'}
-        Assert-CcodEqual 3 ([CcodInstallGenerationCapabilityMarkerV3]::CapabilityAbi) 'old V3 marker is preloaded in the AppDomain'
-        $module=Import-Module $modulePath -Force -PassThru -DisableNameChecking;$module=Import-Module $modulePath -Force -PassThru -DisableNameChecking
-        $old=Open-CcodFixtureGeneration $fixture 'runtime-v3-old';$manifest=Write-CcodInstallGenerationManifest -Generation $old -Manifest (New-CcodGenerationManifest 'runtime-v3-old');Close-CcodInstallFileTransaction -Transaction $old -Disposition Ready|Out-Null
-        $transaction=Open-CcodFixtureGeneration $fixture 'runtime-v3-new';Write-CcodInstallGenerationManifest -Generation $transaction -Manifest (New-CcodGenerationManifest 'runtime-v3-new')|Out-Null
-        $state=New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'state' -CreateIfMissing;$records=New-CcodInstallDirectory -Transaction $transaction -Parent $state -Leaf 'records' -CreateIfMissing;Write-CcodInstallRecord -Transaction $transaction -Parent $records -Leaf 'record.json' -Record ([ordered]@{schemaVersion=1;value='v3'})|Out-Null
-        $retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId 'runtime-v3-old' -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $transaction;Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $retained -ExpectedPreviousGeneration ([uint64]0) -FileTransaction $transaction|Out-Null
-        $stateOnly=Open-CcodInstallStateTransaction -InstallRoot $fixture.Install;$fixture.Transactions.Add($stateOnly);$stateOnlyRoot=New-CcodInstallDirectory -Transaction $stateOnly -Parent $stateOnly -Leaf 'state' -CreateIfMissing;$recovery=New-CcodInstallDirectory -Transaction $stateOnly -Parent $stateOnlyRoot -Leaf 'recovery' -CreateIfMissing;Write-CcodInstallRecord -Transaction $stateOnly -Parent $recovery -Leaf 'ready.json' -Record ([ordered]@{schemaVersion=1;phase='Ready'})|Out-Null
         $source=New-CcodSourceFile $fixture 'v4-state-source.txt' 'state-only-after-v3'
-        Assert-CcodThrows {New-CcodInstallDirectory -Transaction $stateOnly -Parent $stateOnly -Leaf 'runtime' -CreateIfMissing|Out-Null} 'CCOD_INSTALL_STATE_SCOPE'
-        Assert-CcodThrows {New-CcodInstallGenerationLeaf -Generation $stateOnly -Leaf 'payload'|Out-Null} 'CCOD_INSTALL_STATE_SCOPE'
-        Assert-CcodThrows {Copy-CcodInstallSealedSource -Generation $stateOnly -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null} 'CCOD_INSTALL_STATE_SCOPE'
-        Assert-CcodThrows {Write-CcodInstallGenerationManifest -Generation $stateOnly -Manifest (New-CcodGenerationManifest 'state-after-v3')|Out-Null} 'CCOD_INSTALL_STATE_SCOPE'
-        Assert-CcodThrows {Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId 'runtime-v3-old' -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $stateOnly|Out-Null} 'CCOD_INSTALL_STATE_SCOPE'
-        Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $stateOnly -ExpectedPreviousGeneration ([uint64]1) -FileTransaction $stateOnly|Out-Null} 'CCOD_INSTALL_POINTER_TARGET_INVALID'
-        Assert-CcodThrows {Retire-CcodInstallGeneration -InstallRoot $fixture.Install -RuntimeId 'runtime-v3-old' -FileTransaction $stateOnly|Out-Null} 'CCOD_INSTALL_GENERATION_NOT_OWNED'
-        Assert-CcodEqual 4 ([CcodInstallGenerationCapabilityMarkerV4]::CapabilityAbi) 'module binds the new ABI V4 despite the preloaded V3 marker'
+        $escapedModule=$modulePath.Replace("'","''");$escapedInstall=$fixture.Install.Replace("'","''");$escapedSource=$source.Path.Replace("'","''")
+        $child=@"
+`$ErrorActionPreference='Stop';`$ProgressPreference='SilentlyContinue'
+Add-Type -TypeDefinition 'public sealed class CcodInstallGenerationCapabilityMarkerV3 { private CcodInstallGenerationCapabilityMarkerV3() {} public static int CapabilityAbi { get { return 3; } } }'
+if([CcodInstallGenerationCapabilityMarkerV3]::CapabilityAbi-ne3-or`$null-ne('CcodInstallGenerationCapabilityMarkerV4'-as[type])){throw 'V3 was not loaded first'}
+Import-Module '$escapedModule' -Force -DisableNameChecking -ErrorAction Stop
+if([CcodInstallGenerationCapabilityMarkerV4]::CapabilityAbi-ne4){throw 'V4 ABI missing'}
+function Assert-ChildThrows([scriptblock]`$Action,[string]`$ErrorId){try{&`$Action;throw "EXPECTED_`$ErrorId"}catch{if(`$_.FullyQualifiedErrorId-notlike"`$ErrorId*"){throw}}}
+`$transaction=Open-CcodInstallStateTransaction -InstallRoot '$escapedInstall'
+try{
+  `$state=New-CcodInstallDirectory -Transaction `$transaction -Parent `$transaction -Leaf 'state' -CreateIfMissing
+  `$records=New-CcodInstallDirectory -Transaction `$transaction -Parent `$state -Leaf 'v3-first-recovery' -CreateIfMissing
+  Write-CcodInstallRecord -Transaction `$transaction -Parent `$records -Leaf 'ready.json' -Record ([ordered]@{schemaVersion=1;phase='Ready'})|Out-Null
+  if(-not[IO.File]::Exists((Join-Path '$escapedInstall' 'state\v3-first-recovery\ready.json'))){throw 'state record missing'}
+  Assert-ChildThrows {New-CcodInstallDirectory -Transaction `$transaction -Parent `$transaction -Leaf 'runtime' -CreateIfMissing|Out-Null} 'CCOD_INSTALL_STATE_SCOPE'
+  Assert-ChildThrows {New-CcodInstallGenerationLeaf -Generation `$transaction -Leaf 'payload'|Out-Null} 'CCOD_INSTALL_STATE_SCOPE'
+  Assert-ChildThrows {Copy-CcodInstallSealedSource -Generation `$transaction -SourcePath '$escapedSource' -Leaf 'payload.bin' -ExpectedLength $($source.Length) -ExpectedSha256 '$($source.Sha256)'|Out-Null} 'CCOD_INSTALL_STATE_SCOPE'
+  Assert-ChildThrows {Write-CcodInstallGenerationManifest -Generation `$transaction -Manifest ([ordered]@{schemaVersion=1})|Out-Null} 'CCOD_INSTALL_STATE_SCOPE'
+  Assert-ChildThrows {Open-CcodInstallRetainedGeneration -InstallRoot '$escapedInstall' -RuntimeId 'runtime-v3-old' -ExpectedManifestSha256 ('0'*64) -FileTransaction `$transaction|Out-Null} 'CCOD_INSTALL_STATE_SCOPE'
+  Assert-ChildThrows {Commit-CcodInstallActivePointer -InstallRoot '$escapedInstall' -TargetGeneration `$transaction -ExpectedPreviousGeneration 0 -FileTransaction `$transaction|Out-Null} 'CCOD_INSTALL_POINTER_TARGET_INVALID'
+  Assert-ChildThrows {Retire-CcodInstallGeneration -InstallRoot '$escapedInstall' -RuntimeId 'runtime-v3-old' -FileTransaction `$transaction|Out-Null} 'CCOD_INSTALL_GENERATION_NOT_OWNED'
+  if([IO.Directory]::Exists((Join-Path '$escapedInstall' 'runtime'))-or[IO.Directory]::Exists((Join-Path '$escapedInstall' 'state\active-generation'))-or[IO.Directory]::Exists((Join-Path '$escapedInstall' 'state\retired-generations'))){throw 'state-only escape observed'}
+}finally{Close-CcodInstallFileTransaction -Transaction `$transaction -Disposition Ready}
+[Console]::Out.WriteLine('V3_FIRST_V4_STATE_ONLY_OK')
+"@
+        $encoded=[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($child));$output=@(& powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand $encoded 2>&1);$exitCode=$LASTEXITCODE
+        Assert-CcodEqual 0 $exitCode 'fresh child process accepts V4 after loading only V3 first'
+        Assert-CcodEqual 'V3_FIRST_V4_STATE_ONLY_OK' ($output -join '') 'child proves only the exported V4 state-only boundary'
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
 
diff --git a/tests/persistence/RuntimeManifest.SelfTest.ps1 b/tests/persistence/RuntimeManifest.SelfTest.ps1
index 2a324b5..8d014eb 100644
--- a/tests/persistence/RuntimeManifest.SelfTest.ps1
+++ b/tests/persistence/RuntimeManifest.SelfTest.ps1
@@ -208,6 +208,20 @@ try {
         }
     }
 
+    Invoke-CcodTest 'default immutable fence rejects selector root files and non-not-found lookup failures before pointer commit' {
+        foreach($kind in @('root-file','lookup-error')){
+            $installRoot=Join-Path $root ("pointer-root-$kind");[IO.Directory]::CreateDirectory($installRoot)|Out-Null;$identity=[Security.Principal.WindowsIdentity]::GetCurrent();$process=[Diagnostics.Process]::GetCurrentProcess();$transaction=$null;$ownership=$null
+            try{
+                $source=Join-Path $installRoot 'source.txt';[IO.File]::WriteAllText($source,'selector-root-proof',[Text.UTF8Encoding]::new($false));$sha=(Get-FileHash -LiteralPath $source -Algorithm SHA256).Hash.ToLowerInvariant();$records=@([pscustomobject]@{path='payload.txt';length=[int64](Get-Item $source).Length;sha256=$sha});$runtimeId=Get-CcodRuntimeId -ProjectVersion '2.5.22' -Files $records -Nonce ('3'*32);$transaction=Open-CcodInstallGeneration -InstallRoot $installRoot -RuntimeId $runtimeId;Copy-CcodInstallSealedSource -Generation $transaction -SourcePath $source -Leaf 'payload.txt' -ExpectedLength $records[0].length -ExpectedSha256 $sha|Out-Null;$runtime=Join-Path $installRoot "runtime\$runtimeId";$manifest=New-CcodRuntimeManifest -RuntimeDirectory $runtime -ProjectVersion '2.5.22' -RuntimeId $runtimeId;Write-CcodInstallGenerationManifest -Generation $transaction -Manifest $manifest|Out-Null
+                $pointerRoot=Join-Path $installRoot 'state\active-generation';if($kind-ceq'root-file'){[IO.Directory]::CreateDirectory((Split-Path $pointerRoot -Parent))|Out-Null;[IO.File]::WriteAllText($pointerRoot,'not-a-directory',[Text.UTF8Encoding]::new($false))}
+                $owner=[pscustomobject][ordered]@{pid=[int]$process.Id;creationTimeUtc=$process.StartTime.ToUniversalTime().ToString('o')};$ownership=Enter-CcodLifecycleOwnership -InstallRoot $installRoot -RuntimeId $runtimeId -RuntimeGeneration 1 -OwnerIdentity $owner -UserSid $identity.User.Value -SessionId ([int]$process.SessionId)
+                $adapters=if($kind-ceq'lookup-error'){@{GetSelectorRootItem={param($Path)throw [UnauthorizedAccessException]::new('selector lookup denied')}}}else{$null}
+                Assert-CcodThrows {Set-CcodActiveRuntime -InstallRoot $installRoot -NewRuntimeId $runtimeId -TargetGeneration $transaction -FileTransaction $transaction -Ownership $ownership -Adapters $adapters|Out-Null} 'CCOD_RUNTIME_POINTER_INVALID'
+                Assert-CcodEqual $false ([IO.File]::Exists((Join-Path $pointerRoot '00000000000000000001.json'))) "$kind failure publishes no active generation"
+            }finally{if($null-ne$ownership-and-not$ownership.released){Exit-CcodLifecycleOwnership $ownership|Out-Null};if($null-ne$transaction){Close-CcodInstallFileTransaction $transaction Failed};$process.Dispose();$identity.Dispose()}
+        }
+    }
+
     Invoke-CcodTest 'includes the lifecycle worker and coordinator in the staged runtime closure' {
         $sourceFiles=@(& $installLifecycleModule {param($sourceRoot)Get-CcodLifecycleSourceFiles -SourceRoot $sourceRoot} $repositoryRoot)
         foreach($relative in @('src\persistence\LifecycleWorker.ps1','src\persistence\SessionController.ps1','src\persistence\modules\LifecycleCoordinator.psm1','src\persistence\modules\LifecycleEpoch.psm1','src\persistence\modules\ProcessControl.psm1','src\persistence\modules\SessionEngine.psm1','src\persistence\modules\WorkerRuntime.psm1')){
diff --git a/tests/persistence/StaticProbeWorker.SelfTest.ps1 b/tests/persistence/StaticProbeWorker.SelfTest.ps1
index 48943c7..ce319b7 100644
--- a/tests/persistence/StaticProbeWorker.SelfTest.ps1
+++ b/tests/persistence/StaticProbeWorker.SelfTest.ps1
@@ -512,20 +512,31 @@ try {
     }
 
     Invoke-CcodTest 'append-only authorization rejects unsafe roots leaves JSON and generations' {
-        foreach($kind in @('root-file','root-reparse','leaf-reparse','ads','multilink','duplicate','fractional','noncanonical')){
+        foreach($kind in @('root-file','root-reparse','leaf-reparse','ads','multilink','malformed','schema','duplicate','fractional','noncanonical')){
             $fixture=New-CcodAuthorizedRuntimeFixture -Root (Join-Path $root ("append-hostile-$kind")) -AppendOnly;$pointerRoot=Join-Path $fixture.InstallRoot 'state\active-generation';$leaf=Join-Path $pointerRoot '00000000000000000001.json';$target=Join-Path $fixture.InstallRoot ("target-$kind")
             if($kind-ceq'root-file'){Remove-Item $pointerRoot -Recurse -Force;[IO.File]::WriteAllText($pointerRoot,'x',[Text.UTF8Encoding]::new($false))}
             elseif($kind-ceq'root-reparse'){Remove-Item $pointerRoot -Recurse -Force;[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $pointerRoot -Target $target|Out-Null}
             elseif($kind-ceq'leaf-reparse'){[IO.File]::Delete($leaf);[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $leaf -Target $target|Out-Null}
             elseif($kind-ceq'ads'){Set-Content -LiteralPath $leaf -Stream evidence -Value x -NoNewline}
             elseif($kind-ceq'multilink'){$text=[IO.File]::ReadAllText($leaf);[IO.File]::Delete($leaf);$outside=Join-Path $fixture.InstallRoot 'outside-pointer.json';[IO.File]::WriteAllText($outside,$text,[Text.UTF8Encoding]::new($false));New-Item -ItemType HardLink -Path $leaf -Target $outside|Out-Null}
+            elseif($kind-ceq'malformed'){[IO.File]::WriteAllText($leaf,'{',[Text.UTF8Encoding]::new($false))}
+            elseif($kind-ceq'schema'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":2,"generation":1,"activeRuntime":"'+$id+'","previousGeneration":0}'),[Text.UTF8Encoding]::new($false))}
             elseif($kind-ceq'duplicate'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"schemaVersion":1,"generation":1,"activeRuntime":"'+$id+'","previousGeneration":0}'),[Text.UTF8Encoding]::new($false))}
             elseif($kind-ceq'fractional'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"generation":1.5,"activeRuntime":"'+$id+'","previousGeneration":0}'),[Text.UTF8Encoding]::new($false))}
             else{Move-Item -LiteralPath $leaf -Destination (Join-Path $pointerRoot '00000000000000000002.json')}
-            Assert-CcodThrows {Get-CcodStaticProbeRuntimeAuthorization -ScriptPath $fixture.WorkerPath|Out-Null} 'CCOD_STATIC_RUNTIME_UNAUTHORIZED'
+            $failure=$null;try{Get-CcodStaticProbeRuntimeAuthorization -ScriptPath $fixture.WorkerPath|Out-Null}catch{$failure=$_}
+            $actualId=if($null-eq$failure){'<none>'}else{[string]$failure.FullyQualifiedErrorId}
+            Assert-CcodTrue ($null-ne$failure-and$actualId-like'CCOD_STATIC_RUNTIME_UNAUTHORIZED*') "$kind selector mutation is rejected before runtime authorization (actual=$actualId)"
         }
     }
 
+    Invoke-CcodTest 'append-only selector lookup errors cannot fall back to a valid legacy pointer' {
+        $fixture=New-CcodAuthorizedRuntimeFixture -Root (Join-Path $root 'append-lookup-error')
+        $pointerRoot=Join-Path $fixture.InstallRoot 'state\active-generation'
+        $getItem={param($Path,$AllowMissing)if([IO.Path]::GetFullPath($Path)-ceq[IO.Path]::GetFullPath($pointerRoot)){throw [UnauthorizedAccessException]::new('selector lookup denied')};try{return Get-Item -LiteralPath $Path -Force -ErrorAction Stop}catch [Management.Automation.ItemNotFoundException]{if($AllowMissing){return $null};throw}}.GetNewClosure()
+        Assert-CcodThrows {Get-CcodStaticProbeRuntimeAuthorization -ScriptPath $fixture.WorkerPath -Adapters @{GetItem=$getItem}|Out-Null} 'CCOD_STATIC_RUNTIME_UNAUTHORIZED'
+    }
+
     Invoke-CcodTest 'imports only exact private bound runtime APIs and unloads every module command surface' {
         $fixture=New-CcodAuthorizedRuntimeFixture -Root (Join-Path $root 'private-runtime-api')
         $context=Get-CcodStaticProbeRuntimeAuthorization -ScriptPath $fixture.WorkerPath
diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index c9de83a..aa3bc40 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -240,7 +240,12 @@ $results += Invoke-CcodTest 'production uninstall authorization consumes append-
 
 $results += Invoke-CcodTest 'uninstall append-only authorization rejects unsafe roots leaves JSON and generations' {
     $previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
-    try{foreach($kind in @('root-file','root-reparse','leaf-reparse','ads','multilink','duplicate','fractional','noncanonical')){$local=Join-Path ([IO.Path]::GetTempPath()) ("ccod-uninstall-hostile-$kind-"+[guid]::NewGuid().ToString('N'));$install=Join-Path $local 'CodexControlOtherDevices';[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$pointerRoot=Join-Path $install 'state\active-generation';$leaf=Join-Path $pointerRoot '00000000000000000007.json';$target=Join-Path $install ("target-$kind");if($kind-ceq'root-file'){Remove-Item $pointerRoot -Recurse -Force;[IO.File]::WriteAllText($pointerRoot,'x',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'root-reparse'){Remove-Item $pointerRoot -Recurse -Force;[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $pointerRoot -Target $target|Out-Null}elseif($kind-ceq'leaf-reparse'){[IO.File]::Delete($leaf);[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $leaf -Target $target|Out-Null}elseif($kind-ceq'ads'){Set-Content -LiteralPath $leaf -Stream evidence -Value x -NoNewline}elseif($kind-ceq'multilink'){$text=[IO.File]::ReadAllText($leaf);[IO.File]::Delete($leaf);$outside=Join-Path $install 'outside-pointer.json';[IO.File]::WriteAllText($outside,$text,[Text.UTF8Encoding]::new($false));New-Item -ItemType HardLink -Path $leaf -Target $outside|Out-Null}elseif($kind-ceq'duplicate'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"schemaVersion":1,"generation":7,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'fractional'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"generation":7.5,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}else{Move-Item $leaf (Join-Path $pointerRoot '00000000000000000008.json')};Assert-CcodThrows {Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $install|Out-Null} 'CCOD_UNINSTALL_RUNTIME_INVALID';if(Test-Path $local){Remove-Item $local -Recurse -Force}}}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process')}
+    try{foreach($kind in @('root-file','root-reparse','leaf-reparse','ads','multilink','malformed','schema','duplicate','fractional','noncanonical')){$local=Join-Path ([IO.Path]::GetTempPath()) ("ccod-uninstall-hostile-$kind-"+[guid]::NewGuid().ToString('N'));$install=Join-Path $local 'CodexControlOtherDevices';[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$pointerRoot=Join-Path $install 'state\active-generation';$leaf=Join-Path $pointerRoot '00000000000000000007.json';$target=Join-Path $install ("target-$kind");if($kind-ceq'root-file'){Remove-Item $pointerRoot -Recurse -Force;[IO.File]::WriteAllText($pointerRoot,'x',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'root-reparse'){Remove-Item $pointerRoot -Recurse -Force;[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $pointerRoot -Target $target|Out-Null}elseif($kind-ceq'leaf-reparse'){[IO.File]::Delete($leaf);[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $leaf -Target $target|Out-Null}elseif($kind-ceq'ads'){Set-Content -LiteralPath $leaf -Stream evidence -Value x -NoNewline}elseif($kind-ceq'multilink'){$text=[IO.File]::ReadAllText($leaf);[IO.File]::Delete($leaf);$outside=Join-Path $install 'outside-pointer.json';[IO.File]::WriteAllText($outside,$text,[Text.UTF8Encoding]::new($false));New-Item -ItemType HardLink -Path $leaf -Target $outside|Out-Null}elseif($kind-ceq'malformed'){[IO.File]::WriteAllText($leaf,'{',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'schema'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":2,"generation":7,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'duplicate'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"schemaVersion":1,"generation":7,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'fractional'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"generation":7.5,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}else{Move-Item $leaf (Join-Path $pointerRoot '00000000000000000008.json')};Assert-CcodThrows {Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $install|Out-Null} 'CCOD_UNINSTALL_RUNTIME_INVALID';if(Test-Path $local){Remove-Item $local -Recurse -Force}}}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process')}
+}
+
+$results += Invoke-CcodTest 'uninstall selector fallback requires proven ItemNotFound instead of a lookup error' {
+    $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-uninstall-lookup-'+[guid]::NewGuid().ToString('N'));$install=Join-Path $local 'CodexControlOtherDevices';$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
+    try{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install|Out-Null;Assert-CcodThrows {Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $install -SelectorAdapters @{GetSelectorRootItem={param($Path)throw [UnauthorizedAccessException]::new('selector lookup denied')}}|Out-Null} 'CCOD_UNINSTALL_RUNTIME_INVALID'}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $local){Remove-Item $local -Recurse -Force}}
 }
 
 $results += Invoke-CcodTest 'external staging refuses a cleanup source changed after runtime verification' {

From d3ec629e4e161cc10337501fbe51a98970398f1e Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 12:11:59 +0800
Subject: [PATCH 084/187] fix: prove selector absence safely

---
 .../task-2-report.md                          | 72 +++++++++++++++++++
 ...08-29-v2522-immutable-generation-design.md | 13 ++--
 src/persistence/StaticProbeWorker.ps1         | 24 ++++++-
 src/persistence/UninstallBootstrap.ps1        |  7 +-
 src/persistence/bootstrap.ps1                 |  7 +-
 src/persistence/modules/RuntimeManifest.psm1  |  7 +-
 tests/persistence/Bootstrap.SelfTest.ps1      | 11 +++
 .../persistence/RuntimeManifest.SelfTest.ps1  |  9 +++
 .../StaticProbeWorker.SelfTest.ps1            | 23 ++++++
 .../UninstallBootstrap.SelfTest.ps1           | 11 +++
 10 files changed, 173 insertions(+), 11 deletions(-)

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md
index 10adf5e..426b253 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md
@@ -366,3 +366,75 @@ Important findings. This round keeps `2101485` and remediates all seven.
 - The documented current-user ordinary-race boundary remains unchanged.
 - Failed and superseded immutable generations remain retained until the
   separately proven reclamation path runs.
+
+## Fix round 4 — prove selector absence safely
+
+### RED and root-cause evidence
+
+- RuntimeManifest exited `1` at
+  `legacy-fallback-rejects-a-state-ancestor-file-before-active-runtime-authorization`
+  with `ASSERT_THROWS: expected CCOD_RUNTIME_POINTER_INVALID`. A valid legacy
+  pointer was accepted when the intermediate `state` object was a regular file.
+- Bootstrap exited `1` at
+  `bootstrap-legacy-fallback-rejects-a-state-ancestor-file` with
+  `ASSERT_THROWS: expected CCOD_BOOTSTRAP_POINTER_INVALID`; the child lookup's
+  ItemNotFound result hid the invalid parent object.
+- StaticProbeWorker exited `1` at
+  `selector-lookup-requires-an-explicit-discriminated-absence-proof` with
+  `CCOD_STATIC_RUNTIME_UNAUTHORIZED`: an actual ItemNotFound adapter result was
+  collapsed into generic adapter failure. After the discriminated lookup was
+  added, the next RED run reached
+  `legacy-authorization-rejects-a-state-ancestor-file` and exited `1` with
+  `ASSERT_THROWS`, proving that the parent check remained independently absent.
+- UninstallBootstrap exited `1` at
+  `uninstall-legacy-fallback-rejects-a-state-ancestor-file-at-the-selector-boundary`
+  with `ASSERT_TRUE`; it did not reject the malformed parent at the bounded
+  selector authorization boundary.
+
+### GREEN and final verification evidence
+
+- InstallFileTransaction exited `0`; all 26 named cases passed, including the
+  V4 state-only no-escape and V3-first re-import evidence.
+- Bootstrap exited `0` with `Bootstrap self-test passed: 26`.
+- RuntimeManifest exited `0`; all 21 named cases reported `True`.
+- StaticProbeWorker exited `0`; all 41 named cases reported `True`, including
+  actual ItemNotFound fallback, null/empty/malformed/unknown result rejection,
+  and the `state`-file boundary.
+- UninstallBootstrap exited `0` with
+  `Uninstall bootstrap self-tests passed: 16`.
+- InstallLifecycle exited `0` with
+  `Install lifecycle self-tests passed: 116`.
+- PersistenceIO exited `0`; all 24 named cases reported `True`.
+- UiPreferences exited `0`; all 9 named cases reported `PASS`.
+- Explicit PowerShell parser checks passed all 8 changed `.ps1`/`.psm1` files
+  (`PARSER_COUNT=8`).
+- `git diff --check` exited `0`; it emitted only checkout LF-to-CRLF warnings.
+- Aggregate command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\PersistenceSelfTest.ps1`
+  exited `0` and emitted no suite failure text.
+
+### Behavior and boundaries
+
+- RuntimeManifest/default fence, Bootstrap, StaticProbeWorker, and
+  UninstallBootstrap now consult legacy `active.json` only when `state` itself
+  has an exact ItemNotFound outcome, or when `state` is a proven plain
+  nonreparse directory and `state\active-generation` has an exact ItemNotFound
+  outcome. A parent file, reparse point, inaccessible object, lookup failure,
+  or other non-directory fails the component's bounded authorization contract.
+- StaticProbe selector lookup now returns one exact discriminated
+  `{ Status, Item }` object. Only `Status='Missing'` with a null item, produced
+  from an exact ItemNotFound exception, represents absence; `Found` requires a
+  nonnull item, and null, empty, malformed, unknown, diagnostic, or exceptional
+  adapter results fail before runtime import.
+- Every earlier Task 2 invariant remains covered, including V4 state-only
+  recovery containment, append-only Ready finalization, canonical runtime
+  identity, the real default pointer fence, recorded-manifest compensation,
+  strict selector leaf validation, and no root-shell overwrite.
+- No push, tag, release, build, installation, product-process action,
+  WindowsApps access, DPAPI access, or external write was performed.
+
+### Remaining concerns
+
+- The documented current-user ordinary-race boundary remains unchanged.
+- Failed and superseded immutable generations remain retained until the
+  separately proven reclamation path runs.
diff --git a/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md b/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
index 57f4cb6..484a791 100644
--- a/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
+++ b/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
@@ -87,10 +87,15 @@ new chain is absent. Lifecycle readiness likewise accepts the exact
 generation bootstrap selected by the scheduled task, with the fixed root
 bootstrap retained only for a proven legacy task.
 
-Absence of the append-only selector is a positive lookup result: only an exact
-ItemNotFound outcome permits legacy fallback. A selector-root file, reparse
-point, access or I/O failure, malformed store, or unsupported record fails the
-component's bounded authorization contract instead of consulting `active.json`.
+Absence of the append-only selector is a positive lookup result. Legacy
+fallback is permitted only when `state` itself has an exact ItemNotFound
+outcome, or when `state` is a proven plain nonreparse directory and its
+`active-generation` child has an exact ItemNotFound outcome. A file, reparse
+point, access or I/O failure, malformed store, or unsupported record at either
+boundary fails the component's bounded authorization contract instead of
+consulting `active.json`. StaticProbe carries the lookup through an exact
+discriminated `Found`/`Missing` result; null, empty, malformed, or exceptional
+adapter output cannot represent absence.
 
 ### 1a. Immutable initialization evidence and operational state
 
diff --git a/src/persistence/StaticProbeWorker.ps1 b/src/persistence/StaticProbeWorker.ps1
index 3c40e2d..a976c32 100644
--- a/src/persistence/StaticProbeWorker.ps1
+++ b/src/persistence/StaticProbeWorker.ps1
@@ -248,6 +248,15 @@ function Get-CcodStaticProbePathAdapters {
         DirectoryExists={param($Path)[IO.Directory]::Exists($Path)}
     }
     if($null -ne $Adapters){foreach($key in @('GetItem','FileExists','DirectoryExists')){if($Adapters.ContainsKey($key)){$resolved[$key]=$Adapters[$key]}}}
+    if($null-ne$Adapters-and$Adapters.ContainsKey('GetSelectorRootResult')){$resolved.GetSelectorRootResult=$Adapters.GetSelectorRootResult}
+    else{
+        $getItem=$resolved.GetItem
+        $resolved.GetSelectorRootResult={
+            param($Path)
+            try{$item=&$getItem $Path $false}catch [Management.Automation.ItemNotFoundException]{return [pscustomobject][ordered]@{Status='Missing';Item=$null}}
+            return [pscustomobject][ordered]@{Status='Found';Item=$item}
+        }.GetNewClosure()
+    }
     return $resolved
 }
 
@@ -462,9 +471,22 @@ function Get-CcodStaticProbeRuntimeAuthorization {
         if((Split-Path $persistenceRoot -Leaf) -cne 'persistence' -or (Split-Path $srcRoot -Leaf) -cne 'src' -or (Split-Path $runtimeContainer -Leaf) -cne 'runtime' -or -not (Test-CcodStaticRuntimeId $runtimeId)){throw 'layout'}
         $installRoot=[IO.Path]::GetFullPath($installRoot);$runtimeRoot=[IO.Path]::GetFullPath($runtimeRoot)
         Assert-CcodStaticProbeNoReparse -Root $installRoot -Path $ScriptPath -Adapters $Adapters
+        $stateRoot=[IO.Path]::GetFullPath((Join-Path $installRoot 'state'))
         $pointerRoot=[IO.Path]::GetFullPath((Join-Path $installRoot 'state\active-generation'))
         $pathAdapters=Get-CcodStaticProbePathAdapters $Adapters
-        $pointerRootItem=Invoke-CcodStaticAdapter $pathAdapters.GetItem @($pointerRoot,$true) OptionalSingle 'CCOD_STATIC_RUNTIME_UNAUTHORIZED'
+        $stateResult=Invoke-CcodStaticAdapter $pathAdapters.GetSelectorRootResult @($stateRoot) Single 'CCOD_STATIC_RUNTIME_UNAUTHORIZED'
+        Assert-CcodStaticExactObject $stateResult @('Status','Item') 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Active selector state lookup'|Out-Null
+        if($stateResult.Status -isnot [string]){throw 'state lookup status'}
+        if($stateResult.Status-ceq'Missing'){if($null-ne$stateResult.Item){throw 'state missing item'};$pointerRootItem=$null}
+        elseif($stateResult.Status-ceq'Found'){
+            if($null-eq$stateResult.Item-or-not$stateResult.Item.PSIsContainer-or($stateResult.Item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){throw 'state root type'}
+            $selectorResult=Invoke-CcodStaticAdapter $pathAdapters.GetSelectorRootResult @($pointerRoot) Single 'CCOD_STATIC_RUNTIME_UNAUTHORIZED'
+            Assert-CcodStaticExactObject $selectorResult @('Status','Item') 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Active selector lookup'|Out-Null
+            if($selectorResult.Status -isnot [string]){throw 'selector lookup status'}
+            if($selectorResult.Status-ceq'Missing'){if($null-ne$selectorResult.Item){throw 'selector missing item'};$pointerRootItem=$null}
+            elseif($selectorResult.Status-ceq'Found'){if($null-eq$selectorResult.Item){throw 'selector found item'};$pointerRootItem=$selectorResult.Item}
+            else{throw 'selector lookup status'}
+        }else{throw 'state lookup status'}
         if($null-ne$pointerRootItem-and-not$pointerRootItem.PSIsContainer){throw 'selector root type'}
         if($null-ne$pointerRootItem){
             Assert-CcodStaticProbeNoReparse $installRoot $pointerRoot -Adapters $Adapters;$entries=@(Get-ChildItem -LiteralPath $pointerRoot -Force -ErrorAction Stop);if($entries.Count-eq0){throw 'empty active chain'};$records=[Collections.Generic.List[object]]::new()
diff --git a/src/persistence/UninstallBootstrap.ps1 b/src/persistence/UninstallBootstrap.ps1
index 85a839e..3248e44 100644
--- a/src/persistence/UninstallBootstrap.ps1
+++ b/src/persistence/UninstallBootstrap.ps1
@@ -368,9 +368,12 @@ function Get-CcodUninstallBootstrapVerifiedRuntimeContext {
         if ([string]::IsNullOrWhiteSpace($PSCommandPath) -or (Get-CcodUninstallBootstrapFullPath -Path $PSCommandPath -Kind 'Bootstrap script') -cne $expectedScript) {
             Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'The uninstall bootstrap was not launched from the installed application root' $PSCommandPath
         }
-        try{$pointerRoot=Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath 'state\active-generation' -AllowMissingLeaf}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active generation selector root is unsafe' $install}
+        try{$stateRoot=Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath 'state' -AllowMissingLeaf;$pointerRoot=Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath 'state\active-generation' -AllowMissingLeaf}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active generation selector path is unsafe' $install}
         $pointerRootItem=$null;$pointerRootAbsent=$false;$getSelectorRootItem=if($null-ne$SelectorAdapters-and$SelectorAdapters.ContainsKey('GetSelectorRootItem')){$SelectorAdapters.GetSelectorRootItem}else{{param($Path)Get-Item -LiteralPath $Path -Force -ErrorAction Stop}}
-        try{$pointerRootItem=&$getSelectorRootItem $pointerRoot;if($null-eq$pointerRootItem){throw [IO.InvalidDataException]::new('selector lookup returned no proof')}}catch [Management.Automation.ItemNotFoundException]{$pointerRootAbsent=$true}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active generation selector root lookup failed' $pointerRoot}
+        $stateRootItem=$null;$stateRootAbsent=$false
+        try{$stateRootItem=&$getSelectorRootItem $stateRoot;if($null-eq$stateRootItem){throw [IO.InvalidDataException]::new('state lookup returned no proof')}}catch [Management.Automation.ItemNotFoundException]{$stateRootAbsent=$true}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active generation state ancestor lookup failed' $stateRoot}
+        if(-not$stateRootAbsent-and(-not$stateRootItem.PSIsContainer-or($stateRootItem.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0)){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active generation selector state ancestor is not a plain directory' $stateRoot}
+        if($stateRootAbsent){$pointerRootAbsent=$true}else{try{$pointerRootItem=&$getSelectorRootItem $pointerRoot;if($null-eq$pointerRootItem){throw [IO.InvalidDataException]::new('selector lookup returned no proof')}}catch [Management.Automation.ItemNotFoundException]{$pointerRootAbsent=$true}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active generation selector root lookup failed' $pointerRoot}}
         if(-not$pointerRootAbsent-and-not$pointerRootItem.PSIsContainer){throw 'selector root type'}
         if(-not$pointerRootAbsent){
             $entries=@(Get-ChildItem -LiteralPath $pointerRoot -Force -ErrorAction Stop);if($entries.Count-eq0){throw 'empty selector'};$records=[Collections.Generic.List[object]]::new()
diff --git a/src/persistence/bootstrap.ps1 b/src/persistence/bootstrap.ps1
index d092d5d..83eef5e 100644
--- a/src/persistence/bootstrap.ps1
+++ b/src/persistence/bootstrap.ps1
@@ -167,9 +167,12 @@ function Assert-CcodBootstrapPlainSelectorFile {
 function Read-CcodBootstrapActivePointer {
     param([Parameter(Mandatory)][string]$InstallRoot,[hashtable]$SelectorAdapters)
 
-    try{$pointerRoot=Assert-CcodBootstrapContained -Root $InstallRoot -Path (Join-Path $InstallRoot 'state\active-generation') -AllowMissingLeaf}catch{Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector root is unsafe' (Join-Path $InstallRoot 'state\active-generation')}
+    try{$stateRoot=Assert-CcodBootstrapContained -Root $InstallRoot -Path (Join-Path $InstallRoot 'state') -AllowMissingLeaf;$pointerRoot=Assert-CcodBootstrapContained -Root $InstallRoot -Path (Join-Path $InstallRoot 'state\active-generation') -AllowMissingLeaf}catch{Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector path is unsafe' (Join-Path $InstallRoot 'state\active-generation')}
     $pointerRootItem=$null;$pointerRootAbsent=$false;$getSelectorRootItem=if($null-ne$SelectorAdapters-and$SelectorAdapters.ContainsKey('GetSelectorRootItem')){$SelectorAdapters.GetSelectorRootItem}else{{param($Path)Get-Item -LiteralPath $Path -Force -ErrorAction Stop}}
-    try{$pointerRootItem=&$getSelectorRootItem $pointerRoot;if($null-eq$pointerRootItem){throw [IO.InvalidDataException]::new('selector lookup returned no proof')}}catch [Management.Automation.ItemNotFoundException]{$pointerRootAbsent=$true}catch{Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector root lookup failed' $pointerRoot}
+    $stateRootItem=$null;$stateRootAbsent=$false
+    try{$stateRootItem=&$getSelectorRootItem $stateRoot;if($null-eq$stateRootItem){throw [IO.InvalidDataException]::new('state lookup returned no proof')}}catch [Management.Automation.ItemNotFoundException]{$stateRootAbsent=$true}catch{Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation state ancestor lookup failed' $stateRoot}
+    if(-not$stateRootAbsent-and(-not$stateRootItem.PSIsContainer-or(Test-CcodBootstrapReparse $stateRoot))){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation state ancestor is not a plain directory' $stateRoot}
+    if($stateRootAbsent){$pointerRootAbsent=$true}else{try{$pointerRootItem=&$getSelectorRootItem $pointerRoot;if($null-eq$pointerRootItem){throw [IO.InvalidDataException]::new('selector lookup returned no proof')}}catch [Management.Automation.ItemNotFoundException]{$pointerRootAbsent=$true}catch{Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector root lookup failed' $pointerRoot}}
     if(-not$pointerRootAbsent-and-not$pointerRootItem.PSIsContainer){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector root is not a directory' $pointerRoot}
     if(-not$pointerRootAbsent){
         if(Test-CcodBootstrapReparse $pointerRoot){Throw-CcodBootstrapError 'CCOD_BOOTSTRAP_POINTER_INVALID' 'Active generation selector root is a reparse point' $pointerRoot}
diff --git a/src/persistence/modules/RuntimeManifest.psm1 b/src/persistence/modules/RuntimeManifest.psm1
index 6c57e0d..974eee0 100644
--- a/src/persistence/modules/RuntimeManifest.psm1
+++ b/src/persistence/modules/RuntimeManifest.psm1
@@ -361,9 +361,12 @@ function Read-CcodActiveRuntime {
     [CmdletBinding()]
     param([Parameter(Mandatory)][string]$InstallRoot,[hashtable]$Adapters)
 
-    $pointerRoot = Resolve-CcodContainedPath -Root $InstallRoot -RelativePath 'state\active-generation' -AllowMissingLeaf
+    try{$stateRoot=Resolve-CcodContainedPath -Root $InstallRoot -RelativePath 'state' -AllowMissingLeaf;$pointerRoot=Resolve-CcodContainedPath -Root $InstallRoot -RelativePath 'state\active-generation' -AllowMissingLeaf}catch{Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation selector path is unsafe' $InstallRoot}
     $selectorRootItem=$null;$selectorRootAbsent=$false;$selectorRootReader=if($null-ne$Adapters-and$Adapters.ContainsKey('GetSelectorRootItem')){$Adapters.GetSelectorRootItem}else{{param($Path)Get-Item -LiteralPath $Path -Force -ErrorAction Stop}}
-    try{$selectorRootItem=&$selectorRootReader $pointerRoot;if($null-eq$selectorRootItem){throw [IO.InvalidDataException]::new('selector lookup returned no proof')}}catch [Management.Automation.ItemNotFoundException]{$selectorRootAbsent=$true}catch{Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation selector root lookup failed' $pointerRoot}
+    $stateRootItem=$null;$stateRootAbsent=$false
+    try{$stateRootItem=&$selectorRootReader $stateRoot;if($null-eq$stateRootItem){throw [IO.InvalidDataException]::new('state lookup returned no proof')}}catch [Management.Automation.ItemNotFoundException]{$stateRootAbsent=$true}catch{Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation state ancestor lookup failed' $stateRoot}
+    if(-not$stateRootAbsent){if(-not$stateRootItem.PSIsContainer-or($stateRootItem.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation state ancestor is not a plain directory' $stateRoot}}
+    if($stateRootAbsent){$selectorRootAbsent=$true}else{try{$selectorRootItem=&$selectorRootReader $pointerRoot;if($null-eq$selectorRootItem){throw [IO.InvalidDataException]::new('selector lookup returned no proof')}}catch [Management.Automation.ItemNotFoundException]{$selectorRootAbsent=$true}catch{Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation selector root lookup failed' $pointerRoot}}
     if (-not$selectorRootAbsent) {
         if(-not$selectorRootItem.PSIsContainer-or($selectorRootItem.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation selector root is not a plain directory' $pointerRoot}
         $entries=@(Get-ChildItem -LiteralPath $pointerRoot -Force -ErrorAction Stop)
diff --git a/tests/persistence/Bootstrap.SelfTest.ps1 b/tests/persistence/Bootstrap.SelfTest.ps1
index d3d5020..7564f00 100644
--- a/tests/persistence/Bootstrap.SelfTest.ps1
+++ b/tests/persistence/Bootstrap.SelfTest.ps1
@@ -347,6 +347,17 @@ $results += Invoke-CcodTest 'bootstrap selector fallback requires proven ItemNot
     try{New-CcodBootstrapFixture -Root $root|Out-Null;Assert-CcodThrows {Read-CcodBootstrapActivePointer -InstallRoot $root -SelectorAdapters @{GetSelectorRootItem={param($Path)throw [UnauthorizedAccessException]::new('selector lookup denied')}}|Out-Null} 'CCOD_BOOTSTRAP_POINTER_INVALID'}finally{if(Test-Path $root){Remove-Item $root -Recurse -Force}}
 }
 
+$results += Invoke-CcodTest 'bootstrap legacy fallback rejects a state ancestor file' {
+    $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-bootstrap-pointer-state-file-'+[guid]::NewGuid().ToString('N'))
+    try{
+        [IO.Directory]::CreateDirectory($root)|Out-Null
+        $runtimeId='2.5.22-1111111111111111-22222222222222222222222222222222'
+        Set-CcodTestActivePointer -Root $root -ActiveRuntime $runtimeId
+        [IO.File]::WriteAllText((Join-Path $root 'state'),'not-a-directory',[Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows {Read-CcodBootstrapActivePointer -InstallRoot $root|Out-Null} 'CCOD_BOOTSTRAP_POINTER_INVALID'
+    }finally{if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+}
+
 $results += Invoke-CcodTest 'generation bootstrap launches the append-only selected runtime without root active json' {
     $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-bootstrap-generation-'+[guid]::NewGuid().ToString('N'))
     try{
diff --git a/tests/persistence/RuntimeManifest.SelfTest.ps1 b/tests/persistence/RuntimeManifest.SelfTest.ps1
index 8d014eb..0b4269d 100644
--- a/tests/persistence/RuntimeManifest.SelfTest.ps1
+++ b/tests/persistence/RuntimeManifest.SelfTest.ps1
@@ -222,6 +222,15 @@ try {
         }
     }
 
+    Invoke-CcodTest 'legacy fallback rejects a state ancestor file before active runtime authorization' {
+        $installRoot=Join-Path $root 'pointer-state-file';[IO.Directory]::CreateDirectory($installRoot)|Out-Null
+        $runtimeId='2.5.22-1111111111111111-22222222222222222222222222222222'
+        $active=[ordered]@{schemaVersion=2;activeRuntime=$runtimeId;previousRuntime=$null;generation=[uint64]1;updatedAtUtc='2030-02-03T04:05:06.0000000Z'}
+        [IO.File]::WriteAllText((Join-Path $installRoot 'active.json'),($active|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText((Join-Path $installRoot 'state'),'not-a-directory',[Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows {Read-CcodActiveRuntime -InstallRoot $installRoot|Out-Null} 'CCOD_RUNTIME_POINTER_INVALID'
+    }
+
     Invoke-CcodTest 'includes the lifecycle worker and coordinator in the staged runtime closure' {
         $sourceFiles=@(& $installLifecycleModule {param($sourceRoot)Get-CcodLifecycleSourceFiles -SourceRoot $sourceRoot} $repositoryRoot)
         foreach($relative in @('src\persistence\LifecycleWorker.ps1','src\persistence\SessionController.ps1','src\persistence\modules\LifecycleCoordinator.psm1','src\persistence\modules\LifecycleEpoch.psm1','src\persistence\modules\ProcessControl.psm1','src\persistence\modules\SessionEngine.psm1','src\persistence\modules\WorkerRuntime.psm1')){
diff --git a/tests/persistence/StaticProbeWorker.SelfTest.ps1 b/tests/persistence/StaticProbeWorker.SelfTest.ps1
index ce319b7..8eb04a2 100644
--- a/tests/persistence/StaticProbeWorker.SelfTest.ps1
+++ b/tests/persistence/StaticProbeWorker.SelfTest.ps1
@@ -537,6 +537,29 @@ try {
         Assert-CcodThrows {Get-CcodStaticProbeRuntimeAuthorization -ScriptPath $fixture.WorkerPath -Adapters @{GetItem=$getItem}|Out-Null} 'CCOD_STATIC_RUNTIME_UNAUTHORIZED'
     }
 
+    Invoke-CcodTest 'selector lookup requires an explicit discriminated absence proof' {
+        $fixture=New-CcodAuthorizedRuntimeFixture -Root (Join-Path $root 'append-explicit-absence')
+        $pointerRoot=Join-Path $fixture.InstallRoot 'state\active-generation'
+        $getItem={param($Path,$AllowMissing)if([IO.Path]::GetFullPath($Path)-ceq[IO.Path]::GetFullPath($pointerRoot)){throw [Management.Automation.ItemNotFoundException]::new('selector is absent')};Get-Item -LiteralPath $Path -Force -ErrorAction Stop}.GetNewClosure()
+        $context=Get-CcodStaticProbeRuntimeAuthorization -ScriptPath $fixture.WorkerPath -Adapters @{GetItem=$getItem}
+        Assert-CcodEqual $fixture.RuntimeId $context.RuntimeId 'an exact ItemNotFound result permits legacy fallback'
+        foreach($case in @(
+            @{Name='null';Callback={return $null}},
+            @{Name='empty';Callback={}},
+            @{Name='malformed';Callback={[pscustomobject]@{Status='Missing'}}},
+            @{Name='unknown';Callback={[pscustomobject][ordered]@{Status='Unknown';Item=$null}}}
+        )){
+            Assert-CcodThrows {Get-CcodStaticProbeRuntimeAuthorization -ScriptPath $fixture.WorkerPath -Adapters @{GetSelectorRootResult=$case.Callback}|Out-Null} 'CCOD_STATIC_RUNTIME_UNAUTHORIZED'
+        }
+    }
+
+    Invoke-CcodTest 'legacy authorization rejects a state ancestor file' {
+        $fixture=New-CcodAuthorizedRuntimeFixture -Root (Join-Path $root 'legacy-state-file')
+        $state=Join-Path $fixture.InstallRoot 'state';Remove-Item -LiteralPath $state -Recurse -Force
+        [IO.File]::WriteAllText($state,'not-a-directory',[Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows {Get-CcodStaticProbeRuntimeAuthorization -ScriptPath $fixture.WorkerPath|Out-Null} 'CCOD_STATIC_RUNTIME_UNAUTHORIZED'
+    }
+
     Invoke-CcodTest 'imports only exact private bound runtime APIs and unloads every module command surface' {
         $fixture=New-CcodAuthorizedRuntimeFixture -Root (Join-Path $root 'private-runtime-api')
         $context=Get-CcodStaticProbeRuntimeAuthorization -ScriptPath $fixture.WorkerPath
diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index aa3bc40..80cdd25 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -248,6 +248,17 @@ $results += Invoke-CcodTest 'uninstall selector fallback requires proven ItemNot
     try{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install|Out-Null;Assert-CcodThrows {Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $install -SelectorAdapters @{GetSelectorRootItem={param($Path)throw [UnauthorizedAccessException]::new('selector lookup denied')}}|Out-Null} 'CCOD_UNINSTALL_RUNTIME_INVALID'}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $local){Remove-Item $local -Recurse -Force}}
 }
 
+$results += Invoke-CcodTest 'uninstall legacy fallback rejects a state ancestor file at the selector boundary' {
+    $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-uninstall-state-file-'+[guid]::NewGuid().ToString('N'));$install=Join-Path $local 'CodexControlOtherDevices';$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
+    try{
+        [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install|Out-Null
+        $state=Join-Path $install 'state';Remove-Item -LiteralPath $state -Recurse -Force;[IO.File]::WriteAllText($state,'not-a-directory',[Text.UTF8Encoding]::new($false))
+        $failure=$null;try{Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $install|Out-Null}catch{$failure=$_}
+        Assert-CcodTrue ($null-ne$failure-and$failure.FullyQualifiedErrorId-like'CCOD_UNINSTALL_RUNTIME_INVALID*') 'state ancestor file fails uninstall authorization'
+        Assert-CcodTrue ($failure.Exception.Message-like'*selector*') 'state ancestor file is rejected at the selector boundary'
+    }finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $local){Remove-Item $local -Recurse -Force}}
+}
+
 $results += Invoke-CcodTest 'external staging refuses a cleanup source changed after runtime verification' {
     $localAppData = Join-Path ([IO.Path]::GetTempPath()) ('ccod-uninstall-race-' + [guid]::NewGuid().ToString('N'))
     $installRoot = Join-Path $localAppData 'CodexControlOtherDevices'

From 46692e77df56c4185db46869c2d3fc697970d8c5 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 13:05:56 +0800
Subject: [PATCH 085/187] fix: permit proven legacy selector fallback

---
 .../task-2-report.md                          | 73 +++++++++++++++++++
 ...08-29-v2522-immutable-generation-design.md |  6 ++
 src/persistence/UninstallBootstrap.ps1        |  4 +-
 tests/persistence/Bootstrap.SelfTest.ps1      | 41 +++++++++--
 .../UninstallBootstrap.SelfTest.ps1           | 19 +++++
 5 files changed, 134 insertions(+), 9 deletions(-)

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md
index 426b253..7f35626 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-2-report.md
@@ -438,3 +438,76 @@ Important findings. This round keeps `2101485` and remediates all seven.
 - The documented current-user ordinary-race boundary remains unchanged.
 - Failed and superseded immutable generations remain retained until the
   separately proven reclamation path runs.
+
+## Fix round 5 — permit proven legacy selector fallback
+
+### RED and root-cause evidence
+
+- UninstallBootstrap exited `1` at
+  `uninstall-legacy-fallback-accepts-a-valid-pointer-when-the-entire-state-plane-is-absent`.
+  The regression expected a valid legacy pointer to reach the later missing
+  lifecycle-epoch boundary, but production rejected the selector path first.
+  `UninstallBootstrap` resolved `state\active-generation` before it performed
+  the separate ItemNotFound lookup for `state`, so a genuinely absent selector
+  plane could never take the permitted compatibility path.
+- The first focused matrix also reproduced the independent Bootstrap harness
+  failure at
+  `fails-promptly-when-fallback-lifecycle-ownership-cannot-be-released`:
+  `ASSERT_EXACT` reported `TimedOut` expected `False`, actual `True`. The old
+  test timed the whole cold launch with a 4-second watchdog even though the
+  injected release attempt occurred at about 3.1 seconds, fallback promotion
+  at about 5.0 seconds, the stable failure log at about 5.03 seconds, and
+  process exit at about 5.08 seconds. The harness killed the bootstrap before
+  its `finally`; this was not a production bootstrap deadlock.
+
+### GREEN and final verification evidence
+
+- Uninstall now resolves and probes `state` first. Exact ItemNotFound selects
+  legacy fallback without resolving its child; only a proven plain nonreparse
+  state directory permits resolving and probing `state\active-generation`.
+  The no-state regression first proves that an invalid legacy pointer is still
+  rejected, then restores the valid pointer and proves authorization reaches
+  the later missing lifecycle-epoch boundary rather than skipping validation.
+- The Bootstrap release-failure test is deterministic and test-only. Its
+  injected release function writes a marker immediately before throwing, the
+  whole-process watchdog is 15 seconds, and the assertion requires exit `1`
+  within 2 seconds after the marker. It retains the stable failure-log,
+  fallback-child-exited, and AccountTransition-mutex-reacquired proofs. No
+  production bootstrap control flow or timeout changed.
+- InstallFileTransaction exited `0`; all 26 named cases passed.
+- Bootstrap exited `0` with `Bootstrap self-test passed: 26`.
+- RuntimeManifest exited `0`; all 21 named cases reported `True`.
+- StaticProbeWorker exited `0`; all 41 named cases reported `True`.
+- UninstallBootstrap exited `0` with
+  `Uninstall bootstrap self-tests passed: 17`.
+- InstallLifecycle exited `0` with
+  `Install lifecycle self-tests passed: 116`.
+- PersistenceIO exited `0`; all 24 named cases reported `True`.
+- UiPreferences exited `0`; all 9 named cases reported `PASS`.
+- Explicit PowerShell parser checks passed all 3 changed `.ps1` files
+  (`TASK2_FIX5_PARSER_COUNT=3`).
+- `git diff --check` exited `0` (`TASK2_FIX5_DIFF_CHECK_EXIT=0`); it emitted
+  only checkout LF-to-CRLF warnings.
+- Aggregate command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\PersistenceSelfTest.ps1`
+  exited `0` (`TASK2_FIX5_AGGREGATE_EXIT=0`) with no suite failure output.
+
+### Behavior and boundaries
+
+- A wholly absent `state` plane is now the exact permitted Uninstall legacy
+  compatibility case. Existing state files, reparse points, inaccessible
+  objects, null or malformed lookup results, and non-ItemNotFound failures
+  still return `CCOD_UNINSTALL_RUNTIME_INVALID` at the selector boundary.
+- When `state` is valid, child absence alone permits legacy fallback; every
+  hostile selector-root/leaf, JSON, schema, generation, ADS, and multilink
+  negative case remains covered and green.
+- Legacy selection does not bypass runtime-manifest, cleanup-payload, bootstrap
+  fingerprint, or lifecycle-epoch validation. No production Bootstrap change,
+  release, install, product-process action, WindowsApps access, DPAPI access,
+  push, tag, signing, or external write was performed.
+
+### Remaining concerns
+
+- The documented current-user ordinary-race boundary remains unchanged.
+- Failed and superseded immutable generations remain retained until the
+  separately proven reclamation path runs.
diff --git a/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md b/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
index 484a791..913db52 100644
--- a/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
+++ b/docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md
@@ -97,6 +97,12 @@ consulting `active.json`. StaticProbe carries the lookup through an exact
 discriminated `Found`/`Missing` result; null, empty, malformed, or exceptional
 adapter output cannot represent absence.
 
+`UninstallBootstrap` resolves and proves the `state` ancestor before it ever
+resolves `state\active-generation`. Exact absence of `state` permits the legacy
+pointer lookup, while a proven plain `state` directory is required before the
+child lookup; this compatibility fallback does not suppress the later
+lifecycle-epoch and cleanup validation boundaries.
+
 ### 1a. Immutable initialization evidence and operational state
 
 The install transaction writes create-only, generation-bound initialization
diff --git a/src/persistence/UninstallBootstrap.ps1 b/src/persistence/UninstallBootstrap.ps1
index 3248e44..a368c66 100644
--- a/src/persistence/UninstallBootstrap.ps1
+++ b/src/persistence/UninstallBootstrap.ps1
@@ -368,12 +368,12 @@ function Get-CcodUninstallBootstrapVerifiedRuntimeContext {
         if ([string]::IsNullOrWhiteSpace($PSCommandPath) -or (Get-CcodUninstallBootstrapFullPath -Path $PSCommandPath -Kind 'Bootstrap script') -cne $expectedScript) {
             Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'The uninstall bootstrap was not launched from the installed application root' $PSCommandPath
         }
-        try{$stateRoot=Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath 'state' -AllowMissingLeaf;$pointerRoot=Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath 'state\active-generation' -AllowMissingLeaf}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active generation selector path is unsafe' $install}
+        try{$stateRoot=Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath 'state' -AllowMissingLeaf}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active generation selector path is unsafe' $install}
         $pointerRootItem=$null;$pointerRootAbsent=$false;$getSelectorRootItem=if($null-ne$SelectorAdapters-and$SelectorAdapters.ContainsKey('GetSelectorRootItem')){$SelectorAdapters.GetSelectorRootItem}else{{param($Path)Get-Item -LiteralPath $Path -Force -ErrorAction Stop}}
         $stateRootItem=$null;$stateRootAbsent=$false
         try{$stateRootItem=&$getSelectorRootItem $stateRoot;if($null-eq$stateRootItem){throw [IO.InvalidDataException]::new('state lookup returned no proof')}}catch [Management.Automation.ItemNotFoundException]{$stateRootAbsent=$true}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active generation state ancestor lookup failed' $stateRoot}
         if(-not$stateRootAbsent-and(-not$stateRootItem.PSIsContainer-or($stateRootItem.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0)){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active generation selector state ancestor is not a plain directory' $stateRoot}
-        if($stateRootAbsent){$pointerRootAbsent=$true}else{try{$pointerRootItem=&$getSelectorRootItem $pointerRoot;if($null-eq$pointerRootItem){throw [IO.InvalidDataException]::new('selector lookup returned no proof')}}catch [Management.Automation.ItemNotFoundException]{$pointerRootAbsent=$true}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active generation selector root lookup failed' $pointerRoot}}
+        if($stateRootAbsent){$pointerRootAbsent=$true}else{try{$pointerRoot=Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath 'state\active-generation' -AllowMissingLeaf}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active generation selector path is unsafe' $install};try{$pointerRootItem=&$getSelectorRootItem $pointerRoot;if($null-eq$pointerRootItem){throw [IO.InvalidDataException]::new('selector lookup returned no proof')}}catch [Management.Automation.ItemNotFoundException]{$pointerRootAbsent=$true}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active generation selector root lookup failed' $pointerRoot}}
         if(-not$pointerRootAbsent-and-not$pointerRootItem.PSIsContainer){throw 'selector root type'}
         if(-not$pointerRootAbsent){
             $entries=@(Get-ChildItem -LiteralPath $pointerRoot -Force -ErrorAction Stop);if($entries.Count-eq0){throw 'empty selector'};$records=[Collections.Generic.List[object]]::new()
diff --git a/tests/persistence/Bootstrap.SelfTest.ps1 b/tests/persistence/Bootstrap.SelfTest.ps1
index 7564f00..045e3eb 100644
--- a/tests/persistence/Bootstrap.SelfTest.ps1
+++ b/tests/persistence/Bootstrap.SelfTest.ps1
@@ -115,6 +115,7 @@ function Add-CcodTestRuntime {
         [AllowNull()][string]$RuntimeId,
         [bool]$IncludeFenceModules = $true,
         [bool]$FailLifecycleRelease = $false,
+        [AllowNull()][string]$LifecycleReleaseMarkerPath,
         [bool]$IncludeGenerationBootstrap = $false
     )
 
@@ -138,18 +139,22 @@ function Add-CcodTestRuntime {
             [IO.File]::Copy((Join-Path $repositoryRoot ('src\persistence\modules\' + $moduleName)), (Join-Path $kernelDirectory $moduleName), $true)
         }
         if ($FailLifecycleRelease) {
-            [IO.File]::AppendAllText((Join-Path $kernelDirectory 'LifecycleEpoch.psm1'), @'
+            if ([string]::IsNullOrWhiteSpace($LifecycleReleaseMarkerPath)) { throw 'A lifecycle release failure marker path is required' }
+            $releaseMarkerBase64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes([IO.Path]::GetFullPath($LifecycleReleaseMarkerPath)))
+            $releaseFailureInjection = @'
 
 function Exit-CcodLifecycleOwnership {
     [CmdletBinding()]
     param([Parameter(Mandatory)]$Ownership, [hashtable]$Adapters)
+    [IO.File]::WriteAllText([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('__CCOD_RELEASE_MARKER_BASE64__')),'release-attempted',[Text.UTF8Encoding]::new($false))
     throw [Management.Automation.ErrorRecord]::new(
         [InvalidOperationException]::new('injected lifecycle release failure'),
         'CCOD_LIFECYCLE_RELEASE_FAILED',
         [Management.Automation.ErrorCategory]::CloseError,
         $Ownership)
 }
-'@, [Text.UTF8Encoding]::new($false))
+'@
+            [IO.File]::AppendAllText((Join-Path $kernelDirectory 'LifecycleEpoch.psm1'), $releaseFailureInjection.Replace('__CCOD_RELEASE_MARKER_BASE64__',$releaseMarkerBase64), [Text.UTF8Encoding]::new($false))
         }
     }
     $manifest = New-CcodRuntimeManifest -RuntimeDirectory $runtimeDirectory -ProjectVersion '0.0.0-bootstrap-test'
@@ -228,7 +233,8 @@ function Invoke-CcodBootstrapTimed {
     param(
         [Parameter(Mandatory)][string]$Root,
         [Parameter(Mandatory)][string]$ReadyToken,
-        [int]$TimeoutMilliseconds = 4000
+        [int]$TimeoutMilliseconds = 15000,
+        [AllowNull()][string]$ReleaseAttemptMarkerPath
     )
 
     $startInfo = [Diagnostics.ProcessStartInfo]::new()
@@ -241,7 +247,21 @@ function Invoke-CcodBootstrapTimed {
     $stopwatch = [Diagnostics.Stopwatch]::StartNew()
     try {
         [void]$process.Start()
-        $exited = $process.WaitForExit($TimeoutMilliseconds)
+        $markerObserved = $false
+        $markerAtMilliseconds = $null
+        if (-not [string]::IsNullOrWhiteSpace($ReleaseAttemptMarkerPath)) {
+            while ($stopwatch.ElapsedMilliseconds -lt $TimeoutMilliseconds) {
+                if ([IO.File]::Exists($ReleaseAttemptMarkerPath)) {
+                    $markerObserved = $true
+                    $markerAtMilliseconds = [long]$stopwatch.ElapsedMilliseconds
+                    break
+                }
+                if ($process.HasExited) { break }
+                Start-Sleep -Milliseconds 10
+            }
+        }
+        $remainingMilliseconds = [Math]::Max(0,$TimeoutMilliseconds - [int]$stopwatch.ElapsedMilliseconds)
+        $exited = if ($process.HasExited) { $true } else { $process.WaitForExit($remainingMilliseconds) }
         if (-not $exited) {
             $process.Kill()
             $process.WaitForExit()
@@ -250,6 +270,8 @@ function Invoke-CcodBootstrapTimed {
             TimedOut = -not $exited
             ExitCode = if ($exited) { [int]$process.ExitCode } else { $null }
             ElapsedMilliseconds = [long]$stopwatch.ElapsedMilliseconds
+            ReleaseAttemptObserved = $markerObserved
+            ElapsedAfterReleaseAttemptMilliseconds = if ($markerObserved) { [long]($stopwatch.ElapsedMilliseconds - $markerAtMilliseconds) } else { $null }
         }
     } finally {
         $stopwatch.Stop()
@@ -484,17 +506,22 @@ $results += Invoke-CcodTest 'fails promptly when fallback lifecycle ownership ca
         New-CcodBootstrapFixture -Root $root | Out-Null
         $activeId = Add-CcodTestRuntime -Root $root -SupervisorScript (New-CcodTestSupervisorScript -Kind 'ExitEarly' -MarkerPath (Join-Path $root 'release-active.started'))
         $pidPath = Join-Path $root 'release-previous.pid'
-        $previousId = Add-CcodTestRuntime -Root $root -SupervisorScript (New-CcodTestSupervisorScript -Kind 'ReadyLongLived' -MarkerPath $pidPath) -FailLifecycleRelease $true
+        $releaseAttemptPath = Join-Path $root 'release-attempted'
+        $previousId = Add-CcodTestRuntime -Root $root -SupervisorScript (New-CcodTestSupervisorScript -Kind 'ReadyLongLived' -MarkerPath $pidPath) -FailLifecycleRelease $true -LifecycleReleaseMarkerPath $releaseAttemptPath
         Set-CcodTestActivePointer -Root $root -ActiveRuntime $activeId -PreviousRuntime $previousId -SchemaVersion 2 -Generation 9
 
-        $run = Invoke-CcodBootstrapTimed -Root $root -ReadyToken (New-CcodBootstrapToken)
+        $run = Invoke-CcodBootstrapTimed -Root $root -ReadyToken (New-CcodBootstrapToken) -ReleaseAttemptMarkerPath $releaseAttemptPath
         if ([IO.File]::Exists($pidPath)) { $supervisorPid = [int][IO.File]::ReadAllText($pidPath) }
+        Assert-CcodExactEqual $true $run.ReleaseAttemptObserved 'release failure timing starts only after the injected release attempt'
         Assert-CcodExactEqual $false $run.TimedOut 'release failure exits instead of waiting for the ready long-lived Supervisor'
         Assert-CcodExactEqual 1 $run.ExitCode 'release failure is a stable nonzero bootstrap outcome'
-        Assert-CcodTrue ($run.ElapsedMilliseconds -lt 4000) 'release failure returns within the bounded prompt-exit window'
+        Assert-CcodTrue ($run.ElapsedAfterReleaseAttemptMilliseconds -le 2000) 'release failure exits within two seconds of the injected release attempt'
         $log = [IO.File]::ReadAllText((Join-Path $root 'logs\bootstrap.log'))
         Assert-CcodTrue ($log.Contains('CCOD_BOOTSTRAP_FENCE_RELEASE_FAILED')) 'release failure is normalized to the stable bootstrap code'
         Assert-CcodTrue (-not $log.Contains('signaled ready; active pointer switched')) 'release failure never logs successful fallback readiness'
+        Assert-CcodTrue ($null-ne$supervisorPid) 'fallback Supervisor published its process identity before release failed'
+        $fallbackProcess = Get-Process -Id $supervisorPid -ErrorAction SilentlyContinue
+        try { Assert-CcodExactEqual $null $fallbackProcess 'bootstrap failure exits the fallback Supervisor before returning' } finally { if ($null-ne$fallbackProcess) { $fallbackProcess.Dispose() } }
 
         $sid = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value
         $lease = Enter-CcodMutex -Kind AccountTransition -UserSid $sid -TimeoutMilliseconds 1000
diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index 80cdd25..622e3cb 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -238,6 +238,25 @@ $results += Invoke-CcodTest 'production uninstall authorization consumes append-
     try{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$localAppData,'Process');$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $installRoot -AppendOnly;$context=Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $installRoot;Assert-CcodEqual $fixture.RuntimeId $context.runtimeId 'uninstall context binds append-only active runtime';Assert-CcodEqual 7 ([uint64]$context.runtimeGeneration) 'uninstall context binds latest append-only generation';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $installRoot 'active.json')) 'append-only uninstall authorization needs no legacy pointer'}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $localAppData){Remove-Item $localAppData -Recurse -Force}}
 }
 
+$results += Invoke-CcodTest 'uninstall legacy fallback accepts a valid pointer when the entire state plane is absent' {
+    $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-uninstall-no-state-'+[guid]::NewGuid().ToString('N'));$install=Join-Path $local 'CodexControlOtherDevices';$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
+    try{
+        [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install|Out-Null
+        $state=Join-Path $install 'state';Remove-Item -LiteralPath $state -Recurse -Force
+        $activePath=Join-Path $install 'active.json';$validActive=[IO.File]::ReadAllText($activePath)
+        Assert-CcodEqual $true (Test-Path -LiteralPath $activePath -PathType Leaf) 'legacy active pointer remains present'
+        Assert-CcodEqual $false (Test-Path -LiteralPath $state) 'new selector state plane is entirely absent'
+        [IO.File]::WriteAllText($activePath,'{"schemaVersion":3,"activeRuntime":"invalid","previousRuntime":null,"generation":7,"updatedAtUtc":"2030-01-02T03:04:05.0000000Z"}',[Text.UTF8Encoding]::new($false))
+        $invalidFailure=$null;try{Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $install|Out-Null}catch{$invalidFailure=$_}
+        Assert-CcodTrue ($null-ne$invalidFailure-and$invalidFailure.FullyQualifiedErrorId-like'CCOD_UNINSTALL_RUNTIME_INVALID*') 'an invalid legacy pointer is not skipped when the selector plane is absent'
+        Assert-CcodEqual ([IO.Path]::GetFullPath($activePath)) ([string]$invalidFailure.TargetObject) 'legacy fallback still authorizes through the active pointer'
+        [IO.File]::WriteAllText($activePath,$validActive,[Text.UTF8Encoding]::new($false))
+        $failure=$null;try{Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $install|Out-Null}catch{$failure=$_}
+        Assert-CcodTrue ($null-ne$failure-and$failure.FullyQualifiedErrorId-like'CCOD_UNINSTALL_REPARSE_OR_PATH_INVALID*') 'missing lifecycle epoch still fails closed after legacy authorization'
+        Assert-CcodEqual ([IO.Path]::GetFullPath($state)) ([string]$failure.TargetObject) 'valid legacy selector fallback reaches the later lifecycle epoch validation'
+    }finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $local){Remove-Item $local -Recurse -Force}}
+}
+
 $results += Invoke-CcodTest 'uninstall append-only authorization rejects unsafe roots leaves JSON and generations' {
     $previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
     try{foreach($kind in @('root-file','root-reparse','leaf-reparse','ads','multilink','malformed','schema','duplicate','fractional','noncanonical')){$local=Join-Path ([IO.Path]::GetTempPath()) ("ccod-uninstall-hostile-$kind-"+[guid]::NewGuid().ToString('N'));$install=Join-Path $local 'CodexControlOtherDevices';[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$pointerRoot=Join-Path $install 'state\active-generation';$leaf=Join-Path $pointerRoot '00000000000000000007.json';$target=Join-Path $install ("target-$kind");if($kind-ceq'root-file'){Remove-Item $pointerRoot -Recurse -Force;[IO.File]::WriteAllText($pointerRoot,'x',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'root-reparse'){Remove-Item $pointerRoot -Recurse -Force;[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $pointerRoot -Target $target|Out-Null}elseif($kind-ceq'leaf-reparse'){[IO.File]::Delete($leaf);[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $leaf -Target $target|Out-Null}elseif($kind-ceq'ads'){Set-Content -LiteralPath $leaf -Stream evidence -Value x -NoNewline}elseif($kind-ceq'multilink'){$text=[IO.File]::ReadAllText($leaf);[IO.File]::Delete($leaf);$outside=Join-Path $install 'outside-pointer.json';[IO.File]::WriteAllText($outside,$text,[Text.UTF8Encoding]::new($false));New-Item -ItemType HardLink -Path $leaf -Target $outside|Out-Null}elseif($kind-ceq'malformed'){[IO.File]::WriteAllText($leaf,'{',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'schema'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":2,"generation":7,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'duplicate'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"schemaVersion":1,"generation":7,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'fractional'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"generation":7.5,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}else{Move-Item $leaf (Join-Path $pointerRoot '00000000000000000008.json')};Assert-CcodThrows {Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $install|Out-Null} 'CCOD_UNINSTALL_RUNTIME_INVALID';if(Test-Path $local){Remove-Item $local -Recurse -Force}}}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process')}

From 9e1c41c72d296c2d0c014a45561a855699ebd39b Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 15:00:33 +0800
Subject: [PATCH 086/187] fix: bootstrap sealed installer package

---
 .../task-3-report.md                          |  98 ++
 Activate-CcodRemoteFix.ps1                    | 121 ++-
 Install-CodexControlOtherDevices.ps1          |   4 +-
 build/CodexControlOtherDevices.iss            | 834 +++---------------
 build/InstallerPackage.psm1                   | 236 +++++
 build/SetupArtifact.psm1                      |  80 +-
 build/build.ps1                               |  53 +-
 .../persistence/InstallLifecycle.SelfTest.ps1 | 149 ++--
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 192 +++-
 tools/New-InstallerDestinationInventory.ps1   |  32 +-
 10 files changed, 947 insertions(+), 852 deletions(-)
 create mode 100644 .superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md
 create mode 100644 build/InstallerPackage.psm1

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md
new file mode 100644
index 0000000..b2e43c6
--- /dev/null
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md
@@ -0,0 +1,98 @@
+# Task 3 report: sealed Setup package and temporary bootstrap
+
+## Status
+
+Implemented the Task 3 sealed installer package and no-`{app}` Setup bootstrap.
+Setup now embeds exactly four `dontcopy` inputs, retains package/manifest/
+bootstrap locks across activation and validation, and accepts success only from
+the same temporary bootstrap's strict append-only `Ready` validation.
+
+No release build, installation, product process control, external service,
+WindowsApps access, DPAPI access, signing, push, tag, or publication occurred.
+
+## RED evidence
+
+The following REDs were observed in order. Obsolete-test REDs are identified
+separately from production defects so they are not mistaken for regressions.
+
+- `ReleaseWorkflow.SelfTest.ps1` exited `1` because
+  `build\InstallerPackage.psm1` did not exist.
+- After the package matrix went GREEN, ReleaseWorkflow exited `1` because the
+  production ISS lacked `CreateAppDir=no` and still exposed the old `{app}`
+  product-copy contract.
+- Expected obsolete-contract REDs then identified old destination-inventory,
+  `{app}\payload`, direct portable-launcher, recursive/reparse-gate, shortcut,
+  icon, uninstall, installed-validation, and legacy receipt assertions. They
+  were replaced with Task 3 no-product-write and append-only assertions; no
+  production compatibility fallback was added.
+- The first real sealed-package ISCC compile exited `2` with
+  `Unknown identifier 'CreateGuid'`; the compiled path now uses the proven
+  `CoCreateGuid` / `StringFromGUID2` contract.
+- PE validation REDs exposed Inno version-string field truncation for full
+  64-character manifest/bootstrap hashes. The final PE contract binds each as
+  exact 32+32 fields and independently recomposes both hashes.
+- The first real package-to-bootstrap execution returned
+  `CCOD_INSTALLER_PACKAGE_INVALID`. The cause was compact PowerShell text such
+  as `return[pscustomobject]` and `throw'CODE'` being parsed as command names.
+  The syntax was corrected and the same real test then passed.
+- The Setup provenance RED failed because the old schema bound only the payload
+  manifest. Schema 2 now records and revalidates package, package-manifest, and
+  bootstrap hashes plus canonical build inputs and the PE split contract.
+- `InstallLifecycle.SelfTest.ps1` REDs identified the pre-Task-3 mutable
+  `state\post-install-activation.json` fixtures. Ready, Failed, and progress
+  fixtures now use separate append-only leaves. A correlated nonterminal leaf
+  returns `CCOD_ACTIVATION_RECEIPT_NOT_READY`; no receipt returns
+  `CCOD_ACTIVATION_RECEIPT_MISSING`; conflicting terminal leaves fail closed.
+
+## Implemented behavior
+
+- `New-CcodInstallerPackage` creates one ZIP containing exactly the
+  manifest-listed payload plus `installer-payload.manifest.json` and emits a
+  canonical package manifest bound to version and 40-hex commit.
+- `Test-CcodInstallerPackage` rejects missing, extra, duplicate,
+  case-colliding, unsafe, length-changed, content-changed, version-changed,
+  commit-changed, package-hash-changed, and manifest-hash-changed inputs.
+- `build.ps1` creates and immediately revalidates the sealed package, binds the
+  package, manifest, and bootstrap hashes into generated ISCC input, and uses
+  schema-2 sealed Setup provenance.
+- The ISS has `CreateAppDir=no`, `Uninstallable=no`, no product `[Files]`
+  destination, and no `[Icons]`, `[Registry]`, `[UninstallRun]`, recursive
+  extraction, legacy shortcut deletion, or `{app}` bootstrap execution.
+- Inno extracts four named temporary inputs, hashes/locks/rehashes package,
+  manifest, and bootstrap, executes that exact bootstrap path, then invokes it
+  again with `-ValidateReceiptOnly` while the locks remain held.
+- The bootstrap validates and extracts only the ZIP manifest entry set into a
+  fresh private root, passes the exact package SHA-256 as
+  `-SealedPackageSha256`, and validates only append-only activation receipts.
+- A real disposable test proves package -> temporary bootstrap -> child hash
+  propagation and append-only Ready. A separate replacement barrier proves
+  locked original bootstrap bytes, not replacement bytes, are executed.
+
+## GREEN and verification evidence
+
+- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ReleaseWorkflow.SelfTest.ps1`
+  exited `0`; final output: `Release workflow self-tests passed.` The suite
+  includes a real Inno Setup 6.7.3 production-script compile.
+- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1`
+  exited `0`; final output: `Install lifecycle self-tests passed: 113`.
+- Explicit PowerShell parser validation passed all eight changed `.ps1`/
+  `.psm1` files (`PARSER_COUNT=8`).
+- `git diff --check` exited `0`; only checkout LF-to-CRLF warnings were emitted.
+- Static boundary audit reported `BOUNDARY_VIOLATIONS=0` for pre-Ready `{app}`
+  writes, product sections, recursive extraction, old app bootstrap execution,
+  Setup mode, and mutable receipt-reader authority.
+- The full aggregate was not requested by the Task 3 brief and was not run; no
+  aggregate-pass claim is made.
+
+## Boundaries and remaining work
+
+- Task 4 still owns post-Ready uninstall registration, shortcuts, icons, and
+  exact legacy registration/shortcut migration.
+- Task 5 still owns Defender scanning and the final exact public asset contract.
+- The current-user ordinary-writer boundary and retained-generation disk-use
+  boundary from Tasks 1-2 are unchanged.
+
+## Commit
+
+- `fix: bootstrap sealed installer package` (the Task 3 commit containing this
+  report; resolve the exact object as this worktree's Task 3 HEAD).
diff --git a/Activate-CcodRemoteFix.ps1 b/Activate-CcodRemoteFix.ps1
index d479e7b..87e12f2 100644
--- a/Activate-CcodRemoteFix.ps1
+++ b/Activate-CcodRemoteFix.ps1
@@ -1,8 +1,13 @@
 [CmdletBinding()]
 param(
-    [Parameter(Mandatory)][string]$AppRoot,
+    [string]$AppRoot,
     [Parameter(Mandatory)][string]$InstallRoot,
     [string]$PayloadRoot,
+    [string]$PackagePath,
+    [string]$PackageManifestPath,
+    [string]$ExpectedPackageSha256,
+    [string]$ExpectedPackageManifestSha256,
+    [string]$ExpectedGitCommit,
     [string]$ExpectedVersion,
     [string]$ExpectedPayloadManifestSha256,
     [string]$ActivationId,
@@ -54,6 +59,48 @@ function Write-CcodActivationRecord {
     } catch { }
 }
 
+function Get-CcodActivationFileSha256 {
+    param([Parameter(Mandatory)][string]$Path)
+    $stream=$null;$sha=[Security.Cryptography.SHA256]::Create()
+    try{$stream=[IO.File]::Open([IO.Path]::GetFullPath($Path),[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read);return [BitConverter]::ToString($sha.ComputeHash($stream)).Replace('-','').ToLowerInvariant()}
+    finally{if($null-ne$stream){$stream.Dispose()};$sha.Dispose()}
+}
+
+function Test-CcodActivationPackageRelativePath {
+    param($Path)
+    return $Path-is[string]-and$Path-cmatch'^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$'-and-not$Path.Contains('//')-and-not$Path.Contains('..')-and-not$Path.Contains(':')-and-not$Path.Contains('\')-and-not$Path.EndsWith('/')
+}
+
+function Open-CcodInstallerPackageSeal {
+    param([Parameter(Mandatory)][string]$PackagePath,[Parameter(Mandatory)][string]$PackageManifestPath,[Parameter(Mandatory)][string]$ExpectedPackageSha256,[Parameter(Mandatory)][string]$ExpectedPackageManifestSha256,[Parameter(Mandatory)][string]$ExpectedVersion,[Parameter(Mandatory)][string]$ExpectedGitCommit)
+    if($ExpectedPackageSha256-cnotmatch'^[0-9a-f]{64}$'-or$ExpectedPackageManifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$ExpectedVersion-cnotmatch'^\d+\.\d+\.\d+$'-or$ExpectedGitCommit-cnotmatch'^[0-9a-f]{40}$'){throw 'CCOD_INSTALLER_PACKAGE_INVALID'}
+    Add-Type -AssemblyName System.IO.Compression -ErrorAction Stop
+    $package=[IO.Path]::GetFullPath($PackagePath);$manifestPath=[IO.Path]::GetFullPath($PackageManifestPath);$packageStream=$null;$manifestStream=$null;$archive=$null
+    try{
+        foreach($path in @($package,$manifestPath)){$item=Get-Item -LiteralPath $path -Force -ErrorAction Stop;if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne 0-or$item.Length-le 0-or$item.Length-gt 536870912){throw 'CCOD_INSTALLER_PACKAGE_INVALID'}}
+        $packageStream=[IO.File]::Open($package,[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read);$sha=[Security.Cryptography.SHA256]::Create();try{$actualPackage=[BitConverter]::ToString($sha.ComputeHash($packageStream)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()};$packageStream.Position=0;if($actualPackage-cne$ExpectedPackageSha256){throw 'CCOD_INSTALLER_PACKAGE_HASH_MISMATCH'}
+        $manifestStream=[IO.File]::Open($manifestPath,[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read);$sha=[Security.Cryptography.SHA256]::Create();try{$actualManifest=[BitConverter]::ToString($sha.ComputeHash($manifestStream)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()};$manifestStream.Position=0;if($actualManifest-cne$ExpectedPackageManifestSha256){throw 'CCOD_INSTALLER_PACKAGE_MANIFEST_HASH_MISMATCH'}
+        $reader=[IO.StreamReader]::new($manifestStream,[Text.UTF8Encoding]::new($false,$true),$true,4096,$true);try{$text=$reader.ReadToEnd()}finally{$reader.Dispose()};$manifestStream.Position=0;try{$manifest=$text|ConvertFrom-Json -ErrorAction Stop}catch{throw 'CCOD_INSTALLER_PACKAGE_INVALID'}
+        if($manifest-isnot[pscustomobject]-or(@($manifest.PSObject.Properties.Name)-join',')-cne'schemaVersion,product,version,gitCommit,payloadManifest,files'-or$manifest.schemaVersion-isnot[int]-or$manifest.schemaVersion-ne 1-or$manifest.product-cne'CodexRemote-fix'-or$manifest.version-cne$ExpectedVersion-or$manifest.gitCommit-cne$ExpectedGitCommit-or$manifest.payloadManifest.name-cne'installer-payload.manifest.json'-or$manifest.payloadManifest.sha256-cnotmatch'^[0-9a-f]{64}$'){throw 'CCOD_INSTALLER_PACKAGE_INVALID'}
+        $records=@($manifest.files);if($records.Count-eq 0){throw 'CCOD_INSTALLER_PACKAGE_INVALID'};$expected=[Collections.Generic.Dictionary[string,object]]::new([StringComparer]::OrdinalIgnoreCase);$previous=$null
+        foreach($record in $records){if($record-isnot[pscustomobject]-or(@($record.PSObject.Properties.Name)-join',')-cne'path,length,sha256'-or-not(Test-CcodActivationPackageRelativePath $record.path)-or$record.length-isnot[ValueType]-or[decimal]$record.length-ne[decimal][int64]$record.length-or[int64]$record.length-lt 0-or$record.sha256-cnotmatch'^[0-9a-f]{64}$'-or($null-ne$previous-and[StringComparer]::Ordinal.Compare($previous,[string]$record.path)-ge 0)-or$expected.ContainsKey([string]$record.path)){throw 'CCOD_INSTALLER_PACKAGE_INVALID'};$expected.Add([string]$record.path,$record);$previous=[string]$record.path}
+        $archive=[IO.Compression.ZipArchive]::new($packageStream,[IO.Compression.ZipArchiveMode]::Read,$true);$entries=[Collections.Generic.Dictionary[string,object]]::new([StringComparer]::OrdinalIgnoreCase)
+        foreach($entry in @($archive.Entries)){if(-not(Test-CcodActivationPackageRelativePath $entry.FullName)-or$entries.ContainsKey($entry.FullName)-or$entry.Name.Length-eq 0){throw 'CCOD_INSTALLER_PACKAGE_INVALID'};$entries.Add($entry.FullName,$entry)}
+        if($entries.Count-ne$expected.Count+1-or-not$entries.ContainsKey('installer-payload.manifest.json')){throw 'CCOD_INSTALLER_PACKAGE_INVALID'}
+        foreach($pair in $expected.GetEnumerator()){$entry=$entries[$pair.Key];$record=$pair.Value;if([int64]$entry.Length-ne[int64]$record.length){throw 'CCOD_INSTALLER_PACKAGE_INVALID'};$stream=$entry.Open();$sha=[Security.Cryptography.SHA256]::Create();try{$hash=[BitConverter]::ToString($sha.ComputeHash($stream)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose();$stream.Dispose()};if($hash-cne[string]$record.sha256){throw 'CCOD_INSTALLER_PACKAGE_INVALID'}}
+        $payloadEntry=$entries['installer-payload.manifest.json'];$stream=$payloadEntry.Open();$sha=[Security.Cryptography.SHA256]::Create();try{$payloadHash=[BitConverter]::ToString($sha.ComputeHash($stream)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose();$stream.Dispose()};if([int64]$payloadEntry.Length-ne[int64]$manifest.payloadManifest.length-or$payloadHash-cne[string]$manifest.payloadManifest.sha256){throw 'CCOD_INSTALLER_PACKAGE_INVALID'}
+        return [pscustomobject]@{PackageStream=$packageStream;ManifestStream=$manifestStream;Archive=$archive;Manifest=$manifest;Entries=$entries;PayloadManifestSha256=$payloadHash}
+    }catch{if($null-ne$archive){$archive.Dispose()};if($null-ne$manifestStream){$manifestStream.Dispose()};if($null-ne$packageStream){$packageStream.Dispose()};throw}
+}
+
+function Expand-CcodInstallerPackageSeal {
+    param([Parameter(Mandatory)]$Seal,[Parameter(Mandatory)][string]$DestinationRoot)
+    $root=[IO.Path]::GetFullPath($DestinationRoot);if([IO.File]::Exists($root)-or[IO.Directory]::Exists($root)){throw 'CCOD_INSTALLER_PACKAGE_INVALID'};[IO.Directory]::CreateDirectory($root)|Out-Null
+    try{foreach($entry in @($Seal.Archive.Entries)){$target=[IO.Path]::GetFullPath((Join-Path $root $entry.FullName.Replace('/','\')));if(-not$target.StartsWith($root.TrimEnd('\')+'\',[StringComparison]::OrdinalIgnoreCase)){throw 'CCOD_INSTALLER_PACKAGE_INVALID'};$parent=Split-Path $target -Parent;if(-not[IO.Directory]::Exists($parent)){[IO.Directory]::CreateDirectory($parent)|Out-Null};$source=$entry.Open();$destination=[IO.File]::Open($target,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::None);try{$source.CopyTo($destination);$destination.Flush($true)}finally{$destination.Dispose();$source.Dispose()}};return $root}catch{if([IO.Directory]::Exists($root)){Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue};throw}
+}
+
+function Close-CcodInstallerPackageSeal { param($Seal) if($null-eq$Seal){return};foreach($name in @('Archive','ManifestStream','PackageStream')){try{if($null-ne$Seal.$name){$Seal.$name.Dispose()}}catch{}} }
+
 function Get-CcodActivationBytesSha256 {
     param([Parameter(Mandatory)][byte[]]$Bytes)
     $sha = [Security.Cryptography.SHA256]::Create()
@@ -557,8 +604,21 @@ function Assert-CcodActivationReceiptPathSafe {
 
 function Read-CcodTerminalActivationReceipt {
     param([Parameter(Mandatory)][string]$Root,[Parameter(Mandatory)][string]$ExpectedActivationId)
-    $path = Join-Path $Root 'state\post-install-activation.json'
-    if (-not [IO.File]::Exists($path)) { throw 'CCOD_ACTIVATION_RECEIPT_MISSING' }
+    $directory = Join-Path $Root 'state\activation-receipts'
+    if (-not [IO.Directory]::Exists($directory)) { throw 'CCOD_ACTIVATION_RECEIPT_MISSING' }
+    try { Assert-CcodActivationReceiptPathSafe -Root $Root -Path $directory } catch { throw 'CCOD_ACTIVATION_RECEIPT_INVALID' }
+    $terminal = @(
+        foreach ($phase in @('Ready','Failed')) {
+            $candidate = Join-Path $directory ("$ExpectedActivationId.$phase.json")
+            if ([IO.File]::Exists($candidate)) { $candidate }
+        }
+    )
+    if ($terminal.Count -eq 0) {
+        if (Test-CcodActivationReceiptObserved -Root $Root -ExpectedActivationId $ExpectedActivationId) { throw 'CCOD_ACTIVATION_RECEIPT_NOT_READY' }
+        throw 'CCOD_ACTIVATION_RECEIPT_MISSING'
+    }
+    if ($terminal.Count -ne 1) { throw 'CCOD_ACTIVATION_RECEIPT_INVALID' }
+    $path = $terminal[0]
     try {
         Assert-CcodActivationReceiptPathSafe -Root $Root -Path $path
         $item = Get-Item -LiteralPath $path -Force -ErrorAction Stop
@@ -590,6 +650,7 @@ function Read-CcodTerminalActivationReceipt {
         ($receipt.phase -cnotin @('Ready','Failed') -and ($receipt.ready -or $null -ne $receipt.errorCode))) {
         throw 'CCOD_ACTIVATION_RECEIPT_INVALID'
     }
+    if ([IO.Path]::GetFileName($path) -cne ("$ExpectedActivationId.$($receipt.phase).json")) { throw 'CCOD_ACTIVATION_RECEIPT_INVALID' }
     return $receipt
 }
 
@@ -641,6 +702,7 @@ function Invoke-CcodOwnedInstallWorker {
         [Parameter(Mandatory)][string]$InstallScript,
         [Parameter(Mandatory)][string]$VerifiedPayloadRoot,
         [Parameter(Mandatory)][string]$StateRoot,
+        [string]$SealedPackageSha256,
         [Parameter(Mandatory)][int]$FirstReceiptTimeout,
         [Parameter(Mandatory)][int]$ActivationTimeout
     )
@@ -668,6 +730,9 @@ function Invoke-CcodOwnedInstallWorker {
                 '-ExpectedPayloadManifestSha256',$ExpectedPayloadManifestSha256
             )
         }
+        if (-not [string]::IsNullOrWhiteSpace($SealedPackageSha256)) {
+            $arguments += @('-SealedPackageSha256',$SealedPackageSha256)
+        }
         $startInfo = [Diagnostics.ProcessStartInfo]::new()
         $startInfo.FileName = $PowerShellPath
         $startInfo.Arguments = (($arguments | ForEach-Object { ConvertTo-CcodNativeProcessArgument ([string]$_) }) -join ' ')
@@ -680,8 +745,7 @@ function Invoke-CcodOwnedInstallWorker {
         while (-not $process.HasExited) {
             if (-not $firstReceiptObserved) {
                 try {
-                    $null = Read-CcodTerminalActivationReceipt -Root $StateRoot -ExpectedActivationId $ActivationId
-                    $firstReceiptObserved = $true
+                    $firstReceiptObserved = Test-CcodActivationReceiptObserved -Root $StateRoot -ExpectedActivationId $ActivationId
                 } catch { }
             }
             if (-not $firstReceiptObserved -and $clock.ElapsedMilliseconds -ge $FirstReceiptTimeout) {
@@ -778,10 +842,49 @@ function Show-CcodActivationFailure {
 }
 
 if ($ValidateReceiptOnly -and $ValidateReceiptWithTimeout) { Write-Error 'CCOD_ACTIVATION_VALIDATOR_MODE_INVALID' -ErrorAction Continue; exit 3 }
-if ([string]::IsNullOrWhiteSpace($PayloadRoot)) { $PayloadRoot = $AppRoot }
-$PayloadRoot = [IO.Path]::GetFullPath($PayloadRoot)
+$packageBound = -not [string]::IsNullOrWhiteSpace($PackagePath) -or -not [string]::IsNullOrWhiteSpace($PackageManifestPath) -or -not [string]::IsNullOrWhiteSpace($ExpectedPackageSha256) -or -not [string]::IsNullOrWhiteSpace($ExpectedPackageManifestSha256) -or -not [string]::IsNullOrWhiteSpace($ExpectedGitCommit)
+$packageSeal = $null
+$packageAppRoot = $null
 $payloadSeal = $null
 try {
+if ($packageBound) {
+    if ([string]::IsNullOrWhiteSpace($PackagePath) -or [string]::IsNullOrWhiteSpace($PackageManifestPath) -or [string]::IsNullOrWhiteSpace($ExpectedPackageSha256) -or [string]::IsNullOrWhiteSpace($ExpectedPackageManifestSha256) -or [string]::IsNullOrWhiteSpace($ExpectedVersion) -or [string]::IsNullOrWhiteSpace($ExpectedGitCommit)) { throw 'CCOD_INSTALLER_PACKAGE_INVALID' }
+    try {
+        $packageSeal = Open-CcodInstallerPackageSeal -PackagePath $PackagePath -PackageManifestPath $PackageManifestPath -ExpectedPackageSha256 $ExpectedPackageSha256 -ExpectedPackageManifestSha256 $ExpectedPackageManifestSha256 -ExpectedVersion $ExpectedVersion -ExpectedGitCommit $ExpectedGitCommit
+        $packageAppRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-activation-package-' + [guid]::NewGuid().ToString('N'))
+        [IO.Directory]::CreateDirectory((Join-Path $packageAppRoot 'payload')) | Out-Null
+        $PayloadRoot = Join-Path (Join-Path $packageAppRoot 'payload') $ExpectedVersion
+        [void](Expand-CcodInstallerPackageSeal -Seal $packageSeal -DestinationRoot $PayloadRoot)
+        $AppRoot = $packageAppRoot
+        $ExpectedPayloadManifestSha256 = [string]$packageSeal.PayloadManifestSha256
+    } catch {
+        $candidate = ([string]$_.FullyQualifiedErrorId -split ',')[0]
+        $code = if ($candidate -cmatch '^CCOD_[A-Z0-9_]{1,96}$') { $candidate } elseif ($_.Exception.Message -cmatch '^CCOD_[A-Z0-9_]{1,96}$') { $Matches[0] } else { 'CCOD_INSTALLER_PACKAGE_INVALID' }
+        Write-Error $code -ErrorAction Continue
+        exit 3
+    }
+} else {
+    if ([string]::IsNullOrWhiteSpace($AppRoot)) { Write-Error 'CCOD_INSTALL_INPUT_INVALID' -ErrorAction Continue; exit 3 }
+    if ([string]::IsNullOrWhiteSpace($PayloadRoot)) { $PayloadRoot = $AppRoot }
+}
+
+function Test-CcodActivationReceiptObserved {
+    param([Parameter(Mandatory)][string]$Root,[Parameter(Mandatory)][string]$ExpectedActivationId)
+    $directory = Join-Path $Root 'state\activation-receipts'
+    if (-not [IO.Directory]::Exists($directory)) { return $false }
+    try {
+        Assert-CcodActivationReceiptPathSafe -Root $Root -Path $directory
+        foreach ($phase in $script:CcodActivationReceiptPhases) {
+            $path = Join-Path $directory ("$ExpectedActivationId.$phase.json")
+            if ([IO.File]::Exists($path)) {
+                Assert-CcodActivationReceiptPathSafe -Root $Root -Path $path
+                return $true
+            }
+        }
+    } catch { return $false }
+    return $false
+}
+$PayloadRoot = [IO.Path]::GetFullPath($PayloadRoot)
 if (-not [string]::IsNullOrWhiteSpace($ExpectedVersion)) {
     try { $payloadSeal = New-CcodActivationPayloadSeal -AppRoot $AppRoot -Root $PayloadRoot -Version $ExpectedVersion -ExpectedManifestSha256 $ExpectedPayloadManifestSha256 }
     catch {
@@ -828,7 +931,7 @@ try {
     if (-not [IO.File]::Exists($installScript)) { throw 'CCOD_ACTIVATION_INSTALL_SCRIPT_MISSING' }
     $powershell = (Get-Command powershell.exe -ErrorAction Stop).Source
     Write-CcodActivationRecord -Code 'STARTED' -DurationMilliseconds $clock.ElapsedMilliseconds
-    $installExitCode = Invoke-CcodOwnedInstallWorker -PowerShellPath $powershell -InstallScript $installScript -VerifiedPayloadRoot $executionPayloadRoot -StateRoot $stateRoot -FirstReceiptTimeout $FirstReceiptTimeoutMilliseconds -ActivationTimeout $ActivationTimeoutMilliseconds
+    $installExitCode = Invoke-CcodOwnedInstallWorker -PowerShellPath $powershell -InstallScript $installScript -VerifiedPayloadRoot $executionPayloadRoot -StateRoot $stateRoot -SealedPackageSha256 $(if($packageBound){$ExpectedPackageSha256}else{$null}) -FirstReceiptTimeout $FirstReceiptTimeoutMilliseconds -ActivationTimeout $ActivationTimeoutMilliseconds
     if ($installExitCode -ne 0) {
         $reportedErrorCode = $null
         try {
@@ -873,4 +976,6 @@ Write-CcodActivationRecord -Code 'COMPLETED' -DurationMilliseconds $clock.Elapse
 exit 0
 } finally {
     Close-CcodActivationPayloadSeal -Seal $payloadSeal
+    Close-CcodInstallerPackageSeal -Seal $packageSeal
+    if ($null -ne $packageAppRoot -and [IO.Directory]::Exists($packageAppRoot)) { Remove-Item -LiteralPath $packageAppRoot -Recurse -Force -ErrorAction SilentlyContinue }
 }
diff --git a/Install-CodexControlOtherDevices.ps1 b/Install-CodexControlOtherDevices.ps1
index 8d5450d..718e4a7 100644
--- a/Install-CodexControlOtherDevices.ps1
+++ b/Install-CodexControlOtherDevices.ps1
@@ -181,7 +181,9 @@ try {
         $invoke.ExpectedPayloadManifestSha256 = $ExpectedPayloadManifestSha256
         $invoke.PayloadManifestBytesBase64 = [Convert]::ToBase64String([byte[]]$payloadSeal.ManifestBytes)
     }
-    if(-not[string]::IsNullOrWhiteSpace($SealedPackageSha256)){$invoke.SealedPackageSha256=$SealedPackageSha256}
+    if (-not [string]::IsNullOrWhiteSpace($SealedPackageSha256)) {
+        $invoke.SealedPackageSha256 = $SealedPackageSha256
+    }
     $receipt = Invoke-CcodInstall @invoke
 } finally {
     if ($null -ne $installerModule) { Remove-Module -Name $installerModule.Name -Force -ErrorAction SilentlyContinue }
diff --git a/build/CodexControlOtherDevices.iss b/build/CodexControlOtherDevices.iss
index e5c5a8c..b1bd096 100644
--- a/build/CodexControlOtherDevices.iss
+++ b/build/CodexControlOtherDevices.iss
@@ -1,16 +1,29 @@
 [Setup]
-#ifndef TrayHostArtifactDirectory
-#define TrayHostArtifactDirectory SourcePath + "\generated\trayhost"
+#ifndef ProjectVersion
+#error ProjectVersion must be supplied by the release builder
 #endif
-#ifndef PortableArtifactDirectory
-#define PortableArtifactDirectory SourcePath + "\generated\portable"
+#ifndef InstallerPackagePath
+#error InstallerPackagePath must be supplied by the release builder
 #endif
-#ifndef InstallerPayloadDirectory
-#error InstallerPayloadDirectory must be supplied by the release builder
+#ifndef InstallerPackageManifestPath
+#error InstallerPackageManifestPath must be supplied by the release builder
 #endif
-#ifndef InstallerPayloadManifestSha256
-#error InstallerPayloadManifestSha256 must be supplied by the release builder
+#ifndef InstallerPackageSha256
+#error InstallerPackageSha256 must be supplied by the release builder
 #endif
+#ifndef InstallerPackageManifestSha256
+#error InstallerPackageManifestSha256 must be supplied by the release builder
+#endif
+#define InstallerPackageManifestSha256First Copy(InstallerPackageManifestSha256, 1, 32)
+#define InstallerPackageManifestSha256Last Copy(InstallerPackageManifestSha256, 33, 32)
+#ifndef ActivationBootstrapPath
+#error ActivationBootstrapPath must be supplied by the release builder
+#endif
+#ifndef ActivationBootstrapSha256
+#error ActivationBootstrapSha256 must be supplied by the release builder
+#endif
+#define ActivationBootstrapSha256First Copy(ActivationBootstrapSha256, 1, 32)
+#define ActivationBootstrapSha256Last Copy(ActivationBootstrapSha256, 33, 32)
 #ifndef SetupGitCommit
 #error SetupGitCommit must be supplied by the release builder
 #endif
@@ -27,20 +40,20 @@ AppSupportURL=https://github.com/naipi11/CodexRemote-fix/issues
 AppUpdatesURL=https://github.com/naipi11/CodexRemote-fix/releases
 VersionInfoVersion={#ProjectVersion}.0
 VersionInfoTextVersion={#ProjectVersion}.0
-VersionInfoProductName=CodexRemote-fix
-VersionInfoProductTextVersion={#ProjectVersion}.0
-VersionInfoDescription=CCODSETUP {#ProjectVersion}
+VersionInfoProductName={#ActivationBootstrapSha256Last}
+VersionInfoProductTextVersion={#InstallerPackageManifestSha256First}
+VersionInfoDescription={#InstallerPackageManifestSha256Last}
 VersionInfoCompany={#SetupGitCommit}
-VersionInfoCopyright={#InstallerPayloadManifestSha256}
-DefaultDirName={localappdata}\CodexControlOtherDevices-installer
-DefaultGroupName=CodexRemote-fix
-UsePreviousGroup=no
+VersionInfoCopyright={#InstallerPackageSha256}
+VersionInfoOriginalFileName={#ActivationBootstrapSha256First}
+DefaultDirName={localappdata}\CodexControlOtherDevices
+CreateAppDir=no
+Uninstallable=no
 DisableProgramGroupPage=yes
 PrivilegesRequired=lowest
 OutputDir=dist
 OutputBaseFilename=CodexRemote-fix-{#ProjectVersion}-setup
 SetupIconFile=..\assets\codexremote-fix\codexremote-fix.ico
-UninstallDisplayIcon={app}\assets\CodexRemote-fix.ico
 Compression=lzma2
 SolidCompression=yes
 WizardStyle=modern
@@ -55,762 +68,139 @@ MinVersion=10.0.17763
 Name: "english"; MessagesFile: "compiler:Default.isl"
 
 [Files]
-Source: "{#SetupProvenancePath}"; DestDir: "{app}"; DestName: "setup-provenance.json"; Flags: dontcopy
-Source: "{#InstallerPayloadDirectory}\installer-payload.manifest.json"; DestDir: "{app}"; DestName: "setup-input-payload-manifest.json"; Flags: dontcopy
-Source: "..\README.md"; DestDir: "{app}"; Flags: ignoreversion
-Source: "..\README.zh-CN.md"; DestDir: "{app}"; Flags: ignoreversion
-Source: "..\LICENSE"; DestDir: "{app}"; Flags: ignoreversion
-Source: "..\NOTICE.md"; DestDir: "{app}"; Flags: ignoreversion
-Source: "..\SECURITY.md"; DestDir: "{app}"; Flags: ignoreversion
-Source: "..\package.json"; DestDir: "{app}"; Flags: ignoreversion
-Source: "..\build\CodexControlOtherDevices.iss"; DestDir: "{app}\build"; Flags: ignoreversion
-Source: "..\build\build.ps1"; DestDir: "{app}\build"; Flags: ignoreversion
-Source: "..\build\SetupArtifact.psm1"; DestDir: "{app}\build"; Flags: ignoreversion
-Source: "..\build\build-trayhost.ps1"; DestDir: "{app}\build"; Flags: ignoreversion
-Source: "..\build\TrayHostBuild.psm1"; DestDir: "{app}\build"; Flags: ignoreversion
-Source: "..\build\TrayHostReferencePack.psm1"; DestDir: "{app}\build"; Flags: ignoreversion
-Source: "..\build\trayhost-packages.lock.json"; DestDir: "{app}\build"; Flags: ignoreversion
-Source: "{#TrayHostArtifactDirectory}\CodexRemote.TrayHost.exe"; DestDir: "{app}\bin"; Flags: ignoreversion
-Source: "{#TrayHostArtifactDirectory}\CodexRemote.TrayHost.exe.config"; DestDir: "{app}\bin"; Flags: ignoreversion
-Source: "{#TrayHostArtifactDirectory}\trayhost-build-provenance.json"; DestDir: "{app}\bin"; Flags: ignoreversion
-Source: "{#PortableArtifactDirectory}\CodexRemote.Portable.exe"; DestDir: "{app}\bin"; Flags: ignoreversion
-Source: "{#PortableArtifactDirectory}\CodexRemote.Portable.exe.config"; DestDir: "{app}\bin"; Flags: ignoreversion
-Source: "{#PortableArtifactDirectory}\portable-launcher-provenance.json"; DestDir: "{app}\bin"; Flags: ignoreversion
-Source: "..\.github\workflows\release.yml"; DestDir: "{app}\.github\workflows"; Flags: ignoreversion
-Source: "..\assets\codexremote-fix\codexremote-fix.ico"; DestDir: "{app}\assets"; DestName: "CodexRemote-fix.ico"; Flags: ignoreversion
-Source: "..\assets\codexremote-fix\codexremote-fix.ico"; DestDir: "{app}\assets\codexremote-fix"; Flags: ignoreversion
-Source: "..\docs\*"; DestDir: "{app}\docs"; Flags: ignoreversion recursesubdirs createallsubdirs
-Source: "..\src\*"; DestDir: "{app}\src"; Flags: ignoreversion recursesubdirs createallsubdirs
-Source: "..\tests\*"; DestDir: "{app}\tests"; Flags: ignoreversion recursesubdirs createallsubdirs
-Source: "..\Install-CodexControlOtherDevices.ps1"; DestDir: "{app}"; Flags: ignoreversion
-Source: "..\Uninstall-CodexControlOtherDevices.ps1"; DestDir: "{app}"; Flags: ignoreversion
-Source: "..\Start-CodexControlOtherDevices.ps1"; DestDir: "{app}"; Flags: ignoreversion
-Source: "..\Reset-CodexControlOtherDevices.ps1"; DestDir: "{app}"; Flags: ignoreversion
-Source: "..\Test-CodexControlOtherDevices.ps1"; DestDir: "{app}"; Flags: ignoreversion
-Source: "..\Activate-CcodRemoteFix.ps1"; DestDir: "{app}"; Flags: ignoreversion
-Source: "..\Prompt-CcodRestart.ps1"; DestDir: "{app}"; Flags: ignoreversion
-Source: "..\tools\New-InstallerPayloadManifest.ps1"; DestDir: "{app}\tools"; Flags: ignoreversion
-Source: "..\tools\New-InstallerDestinationInventory.ps1"; DestDir: "{app}\tools"; Flags: ignoreversion
-Source: "{#InstallerPayloadDirectory}\*"; DestDir: "{app}\payload\{#ProjectVersion}"; Flags: ignoreversion recursesubdirs createallsubdirs
-
-[InstallDelete]
-Type: files; Name: "{userprograms}\Codex Control other devices\Codex Control other devices for Windows.lnk"
-Type: files; Name: "{userprograms}\Codex Control other devices\Open the tray supervisor.lnk"
-Type: files; Name: "{userprograms}\Codex Control other devices\Compatibility check.lnk"
-Type: files; Name: "{userprograms}\Codex Control other devices\Uninstall Codex Control other devices.lnk"
-Type: files; Name: "{userprograms}\Codex Control other devices\CodexRemote-fix.lnk"
-Type: files; Name: "{userprograms}\Codex Control other devices\CodexRemote-fix compatibility check.lnk"
-Type: files; Name: "{userprograms}\Codex Control other devices\Uninstall CodexRemote-fix.lnk"
-Type: dirifempty; Name: "{userprograms}\Codex Control other devices"
-Type: files; Name: "{userdesktop}\Codex 设备连接 (Device Connection).lnk"
-
-[Icons]
-Name: "{group}\CodexRemote-fix"; Filename: "{sys}\WindowsPowerShell\v1.0\powershell.exe"; Parameters: "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File ""{localappdata}\CodexControlOtherDevices\bootstrap.ps1"" -InstallRoot ""{localappdata}\CodexControlOtherDevices"" -EntryMode Explicit"; WorkingDir: "{localappdata}\CodexControlOtherDevices"; IconFilename: "{app}\assets\CodexRemote-fix.ico"
-Name: "{group}\CodexRemote-fix compatibility check"; Filename: "{sys}\WindowsPowerShell\v1.0\powershell.exe"; Parameters: "-NoProfile -ExecutionPolicy Bypass -File ""{app}\Test-CodexControlOtherDevices.ps1"""; WorkingDir: "{app}"; IconFilename: "{app}\assets\CodexRemote-fix.ico"
-Name: "{group}\Uninstall CodexRemote-fix"; Filename: "{app}\unins000.exe"; IconFilename: "{app}\assets\CodexRemote-fix.ico"
-Name: "{userdesktop}\CodexRemote-fix"; Filename: "{sys}\WindowsPowerShell\v1.0\powershell.exe"; Parameters: "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File ""{localappdata}\CodexControlOtherDevices\bootstrap.ps1"" -InstallRoot ""{localappdata}\CodexControlOtherDevices"" -EntryMode Explicit"; WorkingDir: "{localappdata}\CodexControlOtherDevices"; IconFilename: "{app}\assets\CodexRemote-fix.ico"
+Source: "{#InstallerPackagePath}"; DestName: "ccod-installer-package.zip"; Flags: dontcopy
+Source: "{#InstallerPackageManifestPath}"; DestName: "ccod-installer-package.manifest.json"; Flags: dontcopy
+Source: "{#ActivationBootstrapPath}"; DestName: "ccod-activation-bootstrap.ps1"; Flags: dontcopy
+Source: "{#SetupProvenancePath}"; DestName: "ccod-setup-provenance.json"; Flags: dontcopy
 
 [Code]
 // CCOD_INSTALLER_DESTINATION_INVENTORY
 const
-  ACTIVATION_TIMEOUT_MILLISECONDS = 300000;
-  FIRST_ACTIVATION_RECEIPT_TIMEOUT_MILLISECONDS = 90000;
-  ACTIVATION_POLL_MILLISECONDS = 50;
-  VALIDATION_RETRY_MILLISECONDS = 500;
-  VALIDATION_TIMEOUT_MILLISECONDS = 2000;
-  VALIDATION_LAUNCH_BUDGET_MILLISECONDS = 5000;
-  CCOD_FILE_ATTRIBUTE_DIRECTORY = $00000010;
-  CCOD_FILE_ATTRIBUTE_REPARSE_POINT = $00000400;
-  CCOD_FILE_READ_ATTRIBUTES = $00000080;
-  CCOD_DELETE_ACCESS = $00010000;
+  CCOD_GENERIC_READ = $80000000;
   CCOD_FILE_SHARE_READ = $00000001;
-  CCOD_FILE_SHARE_WRITE = $00000002;
-  CCOD_FILE_SHARE_DELETE = $00000004;
   CCOD_OPEN_EXISTING = 3;
-  CCOD_FILE_FLAG_OPEN_REPARSE_POINT = $00200000;
-  CCOD_FILE_FLAG_BACKUP_SEMANTICS = $02000000;
-  CCOD_INVALID_FILE_ATTRIBUTES = $FFFFFFFF;
+  CCOD_FILE_ATTRIBUTE_NORMAL = $00000080;
   CCOD_INVALID_HANDLE_VALUE = -1;
-  CCOD_ERROR_HANDLE_EOF = 38;
+  CCOD_EXPECTED_PACKAGE_SHA256 = '{#InstallerPackageSha256}';
+  CCOD_EXPECTED_PACKAGE_MANIFEST_SHA256 = '{#InstallerPackageManifestSha256}';
+  CCOD_EXPECTED_BOOTSTRAP_SHA256 = '{#ActivationBootstrapSha256}';
 
-type
-  TActivationPhase = (apNone, apStoppingPreviousRuntime, apInstallingRuntime,
-    apActivatingRuntime, apStartingProtection, apReady, apFailed);
-  TCcodFileTime = record
-    LowDateTime: Cardinal;
-    HighDateTime: Cardinal;
-  end;
-  TCcodByHandleFileInformation = record
-    FileAttributes: Cardinal;
-    CreationTime: TCcodFileTime;
-    LastAccessTime: TCcodFileTime;
-    LastWriteTime: TCcodFileTime;
-    VolumeSerialNumber: Cardinal;
-    FileSizeHigh: Cardinal;
-    FileSizeLow: Cardinal;
-    NumberOfLinks: Cardinal;
-    FileIndexHigh: Cardinal;
-    FileIndexLow: Cardinal;
-  end;
-  TCcodFindStreamData = record
-    StreamSize: Int64;
-    StreamNameBuffer: array[0..591] of Byte;
-  end;
+var
+  CcodInputHandles: array of Integer;
+  CcodPackagePath: String;
+  CcodPackageManifestPath: String;
+  CcodBootstrapPath: String;
 
-function GetTickCount64(): Int64;
-  external 'GetTickCount64@kernel32.dll stdcall';
-function CoCreateGuid(var Guid: TGUID): HResult;
-  external 'CoCreateGuid@ole32.dll stdcall';
-function StringFromGUID2(var Guid: TGUID; GuidString: String; MaxCharacters: Integer): Integer;
-  external 'StringFromGUID2@ole32.dll stdcall';
-function GetFileAttributesW(const FileName: String): Cardinal;
-  external 'GetFileAttributesW@kernel32.dll stdcall';
 function CreateFileW(const FileName: String; DesiredAccess, ShareMode,
   SecurityAttributes, CreationDisposition, FlagsAndAttributes,
   TemplateFile: Cardinal): Integer;
   external 'CreateFileW@kernel32.dll stdcall';
-function GetFileInformationByHandle(FileHandle: Integer;
-  var Information: TCcodByHandleFileInformation): Boolean;
-  external 'GetFileInformationByHandle@kernel32.dll stdcall';
 function CloseHandle(Handle: Integer): Boolean;
   external 'CloseHandle@kernel32.dll stdcall';
-function FindFirstStreamW(const FileName: String; InfoLevel: Integer;
-  var StreamData: TCcodFindStreamData; Flags: Cardinal): Integer;
-  external 'FindFirstStreamW@kernel32.dll stdcall';
-function FindNextStreamW(FindHandle: Integer;
-  var StreamData: TCcodFindStreamData): Boolean;
-  external 'FindNextStreamW@kernel32.dll stdcall';
-function CcodFindClose(FindHandle: Integer): Boolean;
-  external 'FindClose@kernel32.dll stdcall';
-function GetLastError(): Cardinal;
-  external 'GetLastError@kernel32.dll stdcall';
-
-function IsSafeExistingPayloadDirectory(const DirectoryName: String): Boolean;
-var
-  Attributes: Cardinal;
-begin
-  Attributes := GetFileAttributesW(DirectoryName);
-  Result := (Attributes = CCOD_INVALID_FILE_ATTRIBUTES) or
-    (((Attributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) <> 0) and
-     ((Attributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) = 0));
-end;
-
-function HasOnlyDefaultDataStream(const FileName: String): Boolean;
-var
-  FindHandle: Integer;
-  StreamData: TCcodFindStreamData;
-  ErrorCode: Cardinal;
-begin
-  Result := False;
-  FindHandle := FindFirstStreamW(FileName, 0, StreamData, 0);
-  if FindHandle = CCOD_INVALID_HANDLE_VALUE then Exit;
-  try
-    if FindNextStreamW(FindHandle, StreamData) then Exit;
-    ErrorCode := GetLastError();
-    Result := ErrorCode = CCOD_ERROR_HANDLE_EOF;
-  finally
-    CcodFindClose(FindHandle);
-  end;
-end;
-
-function IsSafeExistingSetupLeaf(const FileName: String): Boolean;
-var
-  Attributes: Cardinal;
-  FileHandle: Integer;
-  Information: TCcodByHandleFileInformation;
-begin
-  Result := False;
-  Attributes := GetFileAttributesW(FileName);
-  if (Attributes = CCOD_INVALID_FILE_ATTRIBUTES) or
-     ((Attributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) <> 0) or
-     ((Attributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) <> 0) then Exit;
-  FileHandle := CreateFileW(FileName, CCOD_FILE_READ_ATTRIBUTES,
-    CCOD_FILE_SHARE_READ or CCOD_FILE_SHARE_WRITE or CCOD_FILE_SHARE_DELETE,
-    0, CCOD_OPEN_EXISTING, CCOD_FILE_FLAG_OPEN_REPARSE_POINT, 0);
-  if FileHandle = CCOD_INVALID_HANDLE_VALUE then Exit;
-  try
-    if not GetFileInformationByHandle(FileHandle, Information) then Exit;
-    Result := (Information.NumberOfLinks = 1) and
-      ((Information.FileAttributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) = 0) and
-      ((Information.FileAttributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) = 0) and
-      HasOnlyDefaultDataStream(FileName);
-  finally
-    CloseHandle(FileHandle);
-  end;
-end;
-
-function IsSafeExistingSetupTree(const DirectoryName: String): Boolean;
-var
-  Attributes: Cardinal;
-  FindRec: TFindRec;
-  ChildPath: String;
-begin
-  Result := IsSafeExistingPayloadDirectory(DirectoryName);
-  if not Result then Exit;
-  Attributes := GetFileAttributesW(DirectoryName);
-  if Attributes = CCOD_INVALID_FILE_ATTRIBUTES then Exit;
-  if FindFirst(AddBackslash(DirectoryName) + '*', FindRec) then
-  begin
-    try
-      repeat
-        if (FindRec.Name <> '.') and (FindRec.Name <> '..') then
-        begin
-          ChildPath := AddBackslash(DirectoryName) + FindRec.Name;
-          if (FindRec.Attributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) <> 0 then
-          begin
-            Result := False;
-            Exit;
-          end;
-          if ((FindRec.Attributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) <> 0) and
-             (not IsSafeExistingSetupTree(ChildPath)) then
-          begin
-            Result := False;
-            Exit;
-          end;
-          if ((FindRec.Attributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) = 0) and
-             (not IsSafeExistingSetupLeaf(ChildPath)) then
-          begin
-            Result := False;
-            Exit;
-          end;
-        end;
-      until not FindNext(FindRec);
-    finally
-      FindClose(FindRec);
-    end;
-  end;
-end;
-
-// CCOD_SETUP_PIN_BEGIN
-var
-  CcodSetupPinHandles: array of Integer;
-
-procedure AddCcodSetupPin(Handle: Integer);
-var
-  Count: Integer;
-begin
-  Count := GetArrayLength(CcodSetupPinHandles);
-  SetArrayLength(CcodSetupPinHandles, Count + 1);
-  CcodSetupPinHandles[Count] := Handle;
-end;
+function CoCreateGuid(var Guid: TGUID): HResult;
+  external 'CoCreateGuid@ole32.dll stdcall';
+function StringFromGUID2(var Guid: TGUID; GuidString: String;
+  MaxCharacters: Integer): Integer;
+  external 'StringFromGUID2@ole32.dll stdcall';
 
-procedure CloseCcodSetupPins();
+procedure CloseCcodInputHandles();
 var
   Index: Integer;
 begin
-  for Index := GetArrayLength(CcodSetupPinHandles) - 1 downto 0 do
-    if CcodSetupPinHandles[Index] <> CCOD_INVALID_HANDLE_VALUE then
-      CloseHandle(CcodSetupPinHandles[Index]);
-  SetArrayLength(CcodSetupPinHandles, 0);
+  for Index := GetArrayLength(CcodInputHandles) - 1 downto 0 do
+    if CcodInputHandles[Index] <> CCOD_INVALID_HANDLE_VALUE then
+      CloseHandle(CcodInputHandles[Index]);
+  SetArrayLength(CcodInputHandles, 0);
 end;
 
-function PinCcodExistingSetupDirectory(const DirectoryName: String): Boolean;
+function LockCcodInput(const Path, ExpectedSha256: String): Boolean;
 var
-  Attributes: Cardinal;
-  DirectoryHandle: Integer;
-  Information: TCcodByHandleFileInformation;
+  Handle: Integer;
+  Count: Integer;
 begin
   Result := False;
-  Attributes := GetFileAttributesW(DirectoryName);
-  if Attributes = CCOD_INVALID_FILE_ATTRIBUTES then
-  begin
-    Result := True;
-    Exit;
-  end;
-  if ((Attributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) = 0) or
-     ((Attributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) <> 0) then Exit;
-  DirectoryHandle := CreateFileW(DirectoryName, CCOD_FILE_READ_ATTRIBUTES or CCOD_DELETE_ACCESS,
-    CCOD_FILE_SHARE_READ or CCOD_FILE_SHARE_WRITE, 0, CCOD_OPEN_EXISTING,
-    CCOD_FILE_FLAG_BACKUP_SEMANTICS or CCOD_FILE_FLAG_OPEN_REPARSE_POINT, 0);
-  if DirectoryHandle = CCOD_INVALID_HANDLE_VALUE then Exit;
-  if (not GetFileInformationByHandle(DirectoryHandle, Information)) or
-     ((Information.FileAttributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) = 0) or
-     ((Information.FileAttributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) <> 0) then
+  if Lowercase(GetSHA256OfFile(Path)) <> ExpectedSha256 then Exit;
+  Handle := CreateFileW(Path, CCOD_GENERIC_READ, CCOD_FILE_SHARE_READ, 0,
+    CCOD_OPEN_EXISTING, CCOD_FILE_ATTRIBUTE_NORMAL, 0);
+  if Handle = CCOD_INVALID_HANDLE_VALUE then Exit;
+  if Lowercase(GetSHA256OfFile(Path)) <> ExpectedSha256 then
   begin
-    CloseHandle(DirectoryHandle);
+    CloseHandle(Handle);
     Exit;
   end;
-  Attributes := GetFileAttributesW(DirectoryName);
-  if (Attributes = CCOD_INVALID_FILE_ATTRIBUTES) or
-     ((Attributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) = 0) or
-     ((Attributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) <> 0) then
-  begin
-    CloseHandle(DirectoryHandle);
-    Exit;
-  end;
-  AddCcodSetupPin(DirectoryHandle);
+  Count := GetArrayLength(CcodInputHandles);
+  SetArrayLength(CcodInputHandles, Count + 1);
+  CcodInputHandles[Count] := Handle;
   Result := True;
 end;
 
-function PinCcodExistingSetupLeaf(const FileName: String): Boolean;
-var
-  Attributes: Cardinal;
-  FileHandle: Integer;
-  Information: TCcodByHandleFileInformation;
+function ExtractAndLockCcodInputs(): Boolean;
 begin
   Result := False;
-  if not IsSafeExistingSetupLeaf(FileName) then Exit;
-  FileHandle := CreateFileW(FileName, CCOD_FILE_READ_ATTRIBUTES,
-    CCOD_FILE_SHARE_READ or CCOD_FILE_SHARE_WRITE, 0, CCOD_OPEN_EXISTING,
-    CCOD_FILE_FLAG_OPEN_REPARSE_POINT, 0);
-  if FileHandle = CCOD_INVALID_HANDLE_VALUE then Exit;
-  if (not GetFileInformationByHandle(FileHandle, Information)) or
-     (Information.NumberOfLinks <> 1) or
-     ((Information.FileAttributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) <> 0) or
-     ((Information.FileAttributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) <> 0) or
-     (not HasOnlyDefaultDataStream(FileName)) then
-  begin
-    CloseHandle(FileHandle);
-    Exit;
-  end;
-  Attributes := GetFileAttributesW(FileName);
-  if (Attributes = CCOD_INVALID_FILE_ATTRIBUTES) or
-     ((Attributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) <> 0) or
-     ((Attributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) <> 0) then
-  begin
-    CloseHandle(FileHandle);
-    Exit;
-  end;
-  AddCcodSetupPin(FileHandle);
+  ExtractTemporaryFile('ccod-installer-package.zip');
+  ExtractTemporaryFile('ccod-installer-package.manifest.json');
+  ExtractTemporaryFile('ccod-activation-bootstrap.ps1');
+  ExtractTemporaryFile('ccod-setup-provenance.json');
+  CcodPackagePath := ExpandConstant('{tmp}\ccod-installer-package.zip');
+  CcodPackageManifestPath := ExpandConstant('{tmp}\ccod-installer-package.manifest.json');
+  CcodBootstrapPath := ExpandConstant('{tmp}\ccod-activation-bootstrap.ps1');
+  if not LockCcodInput(CcodPackagePath, CCOD_EXPECTED_PACKAGE_SHA256) then Exit;
+  if not LockCcodInput(CcodPackageManifestPath, CCOD_EXPECTED_PACKAGE_MANIFEST_SHA256) then Exit;
+  if not LockCcodInput(CcodBootstrapPath, CCOD_EXPECTED_BOOTSTRAP_SHA256) then Exit;
   Result := True;
 end;
 
-function PinCcodExistingSetupTree(const DirectoryName: String): Boolean;
-var
-  Attributes: Cardinal;
-  FindRec: TFindRec;
-  ChildPath: String;
-begin
-  Result := PinCcodExistingSetupDirectory(DirectoryName);
-  if not Result then Exit;
-  Attributes := GetFileAttributesW(DirectoryName);
-  if Attributes = CCOD_INVALID_FILE_ATTRIBUTES then Exit;
-  if FindFirst(AddBackslash(DirectoryName) + '*', FindRec) then
-  begin
-    try
-      repeat
-        if (FindRec.Name <> '.') and (FindRec.Name <> '..') then
-        begin
-          ChildPath := AddBackslash(DirectoryName) + FindRec.Name;
-          if ((FindRec.Attributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) <> 0) then
-          begin
-            if not PinCcodExistingSetupTree(ChildPath) then
-            begin
-              Result := False;
-              Exit;
-            end;
-          end
-          else if not PinCcodExistingSetupLeaf(ChildPath) then
-          begin
-            Result := False;
-            Exit;
-          end;
-        end;
-      until not FindNext(FindRec);
-    finally
-      FindClose(FindRec);
-    end;
-  end;
-end;
-
-function PinCcodExpectedSetupDirectories(const AppDirectory: String): Boolean;
-var
-  Directories: TStringList;
-  Index: Integer;
-  Candidate: String;
-begin
-  Result := False;
-  Directories := TStringList.Create;
-  try
-    AddCcodExpectedSetupDirectories(Directories);
-    if Directories.Count = 0 then Exit;
-    for Index := 0 to Directories.Count - 1 do
-    begin
-      Candidate := AddBackslash(AppDirectory) + Directories[Index];
-      if not PinCcodExistingSetupDirectory(Candidate) then Exit;
-    end;
-    Result := True;
-  finally
-    Directories.Free;
-  end;
-end;
-// CCOD_SETUP_PIN_END
-
-function AreCcodExpectedSetupDirectoriesSafe(const AppDirectory: String): Boolean;
-var
-  Directories: TStringList;
-  Index: Integer;
-  Candidate: String;
-begin
-  Result := False;
-  Directories := TStringList.Create;
-  try
-    AddCcodExpectedSetupDirectories(Directories);
-    if Directories.Count = 0 then Exit;
-    for Index := 0 to Directories.Count - 1 do
-    begin
-      Candidate := AddBackslash(AppDirectory) + Directories[Index];
-      if not IsSafeExistingPayloadDirectory(Candidate) then Exit;
-    end;
-    Result := True;
-  finally
-    Directories.Free;
-  end;
-end;
-
-function PrepareToInstall(var NeedsRestart: Boolean): String;
-var
-  AppDirectory: String;
-begin
-  Result := '';
-  CloseCcodSetupPins();
-  AppDirectory := ExpandConstant('{app}');
-  if not IsSafeExistingSetupTree(AppDirectory) or
-     not AreCcodExpectedSetupDirectoriesSafe(AppDirectory) then
-    Result := 'CodexRemote-fix refused an unsafe existing payload directory.'
-  else if not PinCcodExistingSetupTree(AppDirectory) or
-          not PinCcodExpectedSetupDirectories(AppDirectory) then
-    Result := 'CodexRemote-fix could not retain the safe Setup write boundary.';
-  if Result <> '' then CloseCcodSetupPins();
-end;
-
 function NewActivationId(): String;
 var
   Guid: TGUID;
-  GuidString: String;
-  GuidLength: Integer;
-begin
-  if CoCreateGuid(Guid) <> 0 then
-    RaiseException('CodexRemote-fix activation correlation could not be created.');
-  SetLength(GuidString, 39);
-  GuidLength := StringFromGUID2(Guid, GuidString, 39);
-  if GuidLength <> 39 then
-    RaiseException('CodexRemote-fix activation correlation could not be formatted.');
-  SetLength(GuidString, 38);
-  Result := LowerCase(Copy(GuidString, 2, 36));
-  if Length(Result) <> 36 then
-    RaiseException('CodexRemote-fix activation correlation is invalid.');
-end;
-
-function IsSafeActivationFile(const FileName: String): Boolean;
-var
-  Attributes, DirectoryAttributes, RootAttributes: Cardinal;
-  DirectoryName, RootName: String;
+  Value: String;
+  Length: Integer;
 begin
-  Attributes := GetFileAttributesW(FileName);
-  if (Attributes = CCOD_INVALID_FILE_ATTRIBUTES) or
-    ((Attributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) <> 0) or
-    ((Attributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) <> 0) then Exit;
-  DirectoryName := ExtractFileDir(FileName);
-  RootName := ExtractFileDir(DirectoryName);
-  DirectoryAttributes := GetFileAttributesW(DirectoryName);
-  RootAttributes := GetFileAttributesW(RootName);
-  Result := (DirectoryAttributes <> CCOD_INVALID_FILE_ATTRIBUTES) and
-    (RootAttributes <> CCOD_INVALID_FILE_ATTRIBUTES) and
-    ((DirectoryAttributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) <> 0) and
-    ((RootAttributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) <> 0) and
-    ((DirectoryAttributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) = 0) and
-    ((RootAttributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) = 0) and
-    ((Attributes and CCOD_FILE_ATTRIBUTE_DIRECTORY) = 0) and
-    ((Attributes and CCOD_FILE_ATTRIBUTE_REPARSE_POINT) = 0);
+  if CoCreateGuid(Guid) <> 0 then RaiseException('CCOD_SETUP_ACTIVATION_ID_FAILED');
+  SetLength(Value, 39);
+  Length := StringFromGUID2(Guid, Value, 39);
+  if Length <> 39 then RaiseException('CCOD_SETUP_ACTIVATION_ID_FAILED');
+  SetLength(Value, 38);
+  Result := Lowercase(Copy(Value, 2, 36));
 end;
 
-procedure RefuseStaleActivationReceipt(const ReceiptPath: String);
-var
-  Attributes: Cardinal;
-begin
-  Attributes := GetFileAttributesW(ReceiptPath);
-  if Attributes <> CCOD_INVALID_FILE_ATTRIBUTES then
-  begin
-    if not IsSafeActivationFile(ReceiptPath) then
-      RaiseException('CodexRemote-fix refused an unsafe stale activation receipt.');
-    if not DeleteFile(ReceiptPath) then
-      RaiseException('CodexRemote-fix could not remove a stale activation receipt.');
-  end;
-  if GetFileAttributesW(ReceiptPath) <> CCOD_INVALID_FILE_ATTRIBUTES then
-    RaiseException('CodexRemote-fix refused a stale activation receipt.');
-end;
-
-function LoadBoundedActivationReceipt(const ReceiptPath: String; var Content: AnsiString): Boolean;
-var
-  ReceiptSize: Int64;
-begin
-  Result := False;
-  if not FileSize64(ReceiptPath, ReceiptSize) then Exit;
-  if (ReceiptSize <= 0) or (ReceiptSize > 16384) then Exit;
-  Result := LoadStringFromFile(ReceiptPath, Content);
-end;
-
-function IsJsonWhitespace(const Character: Char): Boolean;
+function GetCcodBootstrapParameters(const ActivationId: String;
+  ValidateOnly: Boolean): String;
 begin
-  Result := (Character = ' ') or (Character = #9) or
-    (Character = #10) or (Character = #13);
-end;
-
-function HasJsonStringValue(const Content, FieldName, FieldValue: String): Boolean;
-var
-  FieldIndex, RelativeIndex, SearchOffset, ValueIndex: Integer;
-  FieldToken, ValueToken: String;
-begin
-  Result := False;
-  FieldToken := '"' + FieldName + '"';
-  ValueToken := '"' + FieldValue + '"';
-  SearchOffset := 1;
-  while SearchOffset <= Length(Content) do
-  begin
-    RelativeIndex := Pos(FieldToken, Copy(Content, SearchOffset,
-      Length(Content) - SearchOffset + 1));
-    if RelativeIndex = 0 then Exit;
-    FieldIndex := SearchOffset + RelativeIndex - 1;
-    ValueIndex := FieldIndex + Length(FieldToken);
-    while ValueIndex <= Length(Content) do
-    begin
-      if not IsJsonWhitespace(Content[ValueIndex]) then Break;
-      ValueIndex := ValueIndex + 1;
-    end;
-    if (ValueIndex <= Length(Content)) and (Content[ValueIndex] = ':') then
-    begin
-      ValueIndex := ValueIndex + 1;
-      while ValueIndex <= Length(Content) do
-      begin
-        if not IsJsonWhitespace(Content[ValueIndex]) then Break;
-        ValueIndex := ValueIndex + 1;
-      end;
-      if Copy(Content, ValueIndex, Length(ValueToken)) = ValueToken then
-      begin
-        Result := True;
-        Exit;
-      end;
-    end;
-    SearchOffset := FieldIndex + Length(FieldToken);
-  end;
-end;
-
-function DetectActivationPhase(const Content: String): TActivationPhase;
-begin
-  Result := apNone;
-  if HasJsonStringValue(Content, 'phase', 'StoppingPreviousRuntime') then
-    Result := apStoppingPreviousRuntime
-  else if HasJsonStringValue(Content, 'phase', 'InstallingRuntime') then
-    Result := apInstallingRuntime
-  else if HasJsonStringValue(Content, 'phase', 'ActivatingRuntime') then
-    Result := apActivatingRuntime
-  else if HasJsonStringValue(Content, 'phase', 'StartingProtection') then
-    Result := apStartingProtection
-  else if HasJsonStringValue(Content, 'phase', 'Ready') then
-    Result := apReady
-  else if HasJsonStringValue(Content, 'phase', 'Failed') then
-    Result := apFailed;
-end;
-
-procedure UpdateActivationStartingPresentation();
-begin
-  WizardForm.StatusLabel.Caption := 'Starting CodexRemote-fix activation...';
-  WizardForm.ProgressGauge.Position := 70;
-  WizardForm.Update;
-end;
-
-procedure UpdateActivationPresentation(const Phase: TActivationPhase);
-begin
-  case Phase of
-    apStoppingPreviousRuntime:
-      begin WizardForm.StatusLabel.Caption := 'Stopping the previous protected runtime...'; WizardForm.ProgressGauge.Position := 20; end;
-    apInstallingRuntime:
-      begin WizardForm.StatusLabel.Caption := 'Installing the verified runtime...'; WizardForm.ProgressGauge.Position := 40; end;
-    apActivatingRuntime:
-      begin WizardForm.StatusLabel.Caption := 'Committing the runtime generation...'; WizardForm.ProgressGauge.Position := 60; end;
-    apStartingProtection:
-      begin WizardForm.StatusLabel.Caption := 'Starting Supervisor and TrayHost protection...'; WizardForm.ProgressGauge.Position := 80; end;
-    apReady:
-      begin WizardForm.StatusLabel.Caption := 'Verifying activation completion...'; WizardForm.ProgressGauge.Position := 95; end;
-    apFailed:
-      begin WizardForm.StatusLabel.Caption := 'Activation failed safely.'; WizardForm.ProgressGauge.Position := 95; end;
-  end;
-end;
-
-function ReadActivationProgressPhase(const ReceiptPath, ExpectedActivationId: String): TActivationPhase;
-var
-  Content: AnsiString;
-  Text: String;
-begin
-  Result := apNone;
-  if not FileExists(ReceiptPath) then Exit;
-  if not IsSafeActivationFile(ReceiptPath) then Exit;
-  if not LoadBoundedActivationReceipt(ReceiptPath, Content) then Exit;
-  Text := String(Content);
-  if HasJsonStringValue(Text, 'activationId', ExpectedActivationId) then
-    Result := DetectActivationPhase(Text);
+  Result := '-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File "' +
+    CcodBootstrapPath + '" -PackagePath "' + CcodPackagePath +
+    '" -PackageManifestPath "' + CcodPackageManifestPath +
+    '" -ExpectedPackageSha256 "{#InstallerPackageSha256}' +
+    '" -ExpectedPackageManifestSha256 "{#InstallerPackageManifestSha256}' +
+    '" -ExpectedVersion "{#ProjectVersion}' +
+    '" -ExpectedGitCommit "{#SetupGitCommit}' +
+    '" -InstallRoot "' + ExpandConstant('{localappdata}\CodexControlOtherDevices') +
+    '" -ActivationId "' + ActivationId + '"';
+  if ValidateOnly then Result := Result + ' -ValidateReceiptOnly';
 end;
 
 procedure CurStepChanged(CurStep: TSetupStep);
 var
-  ActivationResultCode: Integer;
-  ValidationResultCode: Integer;
-  PromptResultCode: Integer;
-  Parameters, ReceiptPath, ActivationId: String;
+  ActivationId, Parameters: String;
+  ActivationResultCode, ValidationResultCode: Integer;
 begin
-  if CurStep <> ssPostInstall then
-    Exit;
-  CloseCcodSetupPins();
+  if CurStep <> ssPostInstall then Exit;
+  CloseCcodInputHandles();
+  if not ExtractAndLockCcodInputs() then RaiseException('CCOD_SETUP_INPUT_BINDING_INVALID');
   ActivationId := NewActivationId();
-  ReceiptPath := ExpandConstant('{localappdata}\CodexControlOtherDevices\state\post-install-activation.json');
-  RefuseStaleActivationReceipt(ReceiptPath);
-  UpdateActivationStartingPresentation();
-  Parameters := '-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File "' +
-    ExpandConstant('{app}\Activate-CcodRemoteFix.ps1') + '" -AppRoot "' + ExpandConstant('{app}') +
-    '" -PayloadRoot "' + ExpandConstant('{app}\payload\{#ProjectVersion}') +
-    '" -ExpectedVersion "{#ProjectVersion}' +
-    '" -ExpectedPayloadManifestSha256 "{#InstallerPayloadManifestSha256}' +
-    '" -InstallRoot "' + ExpandConstant('{localappdata}\CodexControlOtherDevices') +
-    '" -ActivationId "' + ActivationId + '" -FirstReceiptTimeoutMilliseconds ' +
-    IntToStr(FIRST_ACTIVATION_RECEIPT_TIMEOUT_MILLISECONDS) + ' -ActivationTimeoutMilliseconds ' +
-    IntToStr(ACTIVATION_TIMEOUT_MILLISECONDS);
-  if not Exec(ExpandConstant('{sys}\WindowsPowerShell\v1.0\powershell.exe'), Parameters, '', SW_HIDE,
-      ewWaitUntilTerminated, ActivationResultCode) then
-  begin
-    Log('CodexRemote-fix activation owner could not be started: ' + SysErrorMessage(ActivationResultCode));
-    RaiseException('CodexRemote-fix activation process could not be started.');
-  end;
-  if ActivationResultCode <> 0 then
-  begin
-    Log('CodexRemote-fix activation owner exited unsuccessfully, result code ' + IntToStr(ActivationResultCode) + '.');
-    SuppressibleMsgBox('CodexRemote-fix activation failed safely. Use the support code in post-install-activation.log.', mbError, MB_OK, IDOK);
-    RaiseException('CodexRemote-fix activation failed.');
-  end;
-  Parameters := '-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File "' +
-    ExpandConstant('{app}\Activate-CcodRemoteFix.ps1') + '" -AppRoot "' + ExpandConstant('{app}') +
-    '" -PayloadRoot "' + ExpandConstant('{app}\payload\{#ProjectVersion}') +
-    '" -ExpectedVersion "{#ProjectVersion}' +
-    '" -ExpectedPayloadManifestSha256 "{#InstallerPayloadManifestSha256}' +
-    '" -InstallRoot "' + ExpandConstant('{localappdata}\CodexControlOtherDevices') +
-    '" -ValidateReceiptWithTimeout -ValidationTimeoutMilliseconds ' + IntToStr(VALIDATION_TIMEOUT_MILLISECONDS) +
-    ' -ActivationId "' + ActivationId + '"';
-  if not Exec(ExpandConstant('{sys}\WindowsPowerShell\v1.0\powershell.exe'), Parameters, '', SW_HIDE,
-      ewWaitUntilTerminated, ValidationResultCode) then
-  begin
-    Log('CodexRemote-fix activation validator could not be started: ' + SysErrorMessage(ValidationResultCode));
-    RaiseException('CodexRemote-fix activation validator could not be started.');
-  end;
-  if ValidationResultCode <> 0 then
-  begin
-    Log('CodexRemote-fix activation validator rejected the terminal receipt, result code ' + IntToStr(ValidationResultCode) + '.');
-    SuppressibleMsgBox('CodexRemote-fix activation failed safe validation. Use the support code in post-install-activation.log.', mbError, MB_OK, IDOK);
-    RaiseException('CodexRemote-fix activation receipt validation failed.');
-  end;
-  if ValidationResultCode = 0 then
-  begin
-    WizardForm.StatusLabel.Caption := 'CodexRemote-fix activation is ready.';
-    WizardForm.ProgressGauge.Position := 100;
-    WizardForm.Update;
-    if not WizardSilent then
-    begin
-      Parameters := '-NoProfile -ExecutionPolicy Bypass -File "' + ExpandConstant('{app}\Prompt-CcodRestart.ps1') + '" -AppRoot "' + ExpandConstant('{app}') + '" -InstallRoot "' + ExpandConstant('{localappdata}\CodexControlOtherDevices') + '" -ActivationId "' + ActivationId + '"';
-      if (not Exec(ExpandConstant('{sys}\WindowsPowerShell\v1.0\powershell.exe'), Parameters, '', SW_HIDE, ewWaitUntilTerminated, PromptResultCode)) or (PromptResultCode <> 0) then
-        SuppressibleMsgBox('Codex restart was not submitted. Restart Codex manually when convenient.', mbInformation, MB_OK, IDOK);
-    end;
-  end;
+  Parameters := GetCcodBootstrapParameters(ActivationId, False);
+  if (not Exec(ExpandConstant('{sys}\WindowsPowerShell\v1.0\powershell.exe'), Parameters,
+      '', SW_HIDE, ewWaitUntilTerminated, ActivationResultCode)) or
+      (ActivationResultCode <> 0) then RaiseException('CCOD_SETUP_ACTIVATION_FAILED');
+  Parameters := GetCcodBootstrapParameters(ActivationId, True);
+  if (not Exec(ExpandConstant('{sys}\WindowsPowerShell\v1.0\powershell.exe'), Parameters,
+      '', SW_HIDE, ewWaitUntilTerminated, ValidationResultCode)) or
+      (ValidationResultCode <> 0) then RaiseException('CCOD_SETUP_READY_VALIDATION_FAILED');
+  WizardForm.StatusLabel.Caption := 'CodexRemote-fix activation is ready.';
+  WizardForm.ProgressGauge.Position := 100;
 end;
 
 procedure DeinitializeSetup();
 begin
-  CloseCcodSetupPins();
-end;
-
-function IsCanonicalUninstallTransactionId(const Value: String): Boolean;
-var
-  Index: Integer;
-  Character: Char;
-begin
-  Result := Length(Value) = 36;
-  if not Result then Exit;
-  for Index := 1 to Length(Value) do
-  begin
-    Character := Value[Index];
-    if (Index = 9) or (Index = 14) or (Index = 19) or (Index = 24) then
-    begin
-      if Character <> '-' then begin Result := False; Exit; end;
-    end
-    else if not (((Character >= '0') and (Character <= '9')) or ((Character >= 'a') and (Character <= 'f'))) then
-    begin
-      Result := False;
-      Exit;
-    end;
-  end;
-end;
-
-function TryReadUninstallTransactionId(var TransactionId: String): Boolean;
-var
-  CurrentPath, Text, Marker: String;
-  Content: AnsiString;
-  Position: Integer;
-begin
-  Result := False;
-  TransactionId := '';
-  CurrentPath := ExpandConstant('{localappdata}\CodexRemote-fix-uninstall\current.json');
-  if not IsSafeActivationFile(CurrentPath) then Exit;
-  if not LoadBoundedActivationReceipt(CurrentPath, Content) then Exit;
-  Text := String(Content);
-  Marker := '"transactionId":"';
-  Position := Pos(Marker, Text);
-  if Position = 0 then Exit;
-  Position := Position + Length(Marker);
-  if Position + 36 > Length(Text) + 1 then Exit;
-  TransactionId := Copy(Text, Position, 36);
-  if (Position + 36 > Length(Text)) or (Text[Position + 36] <> '"') or not IsCanonicalUninstallTransactionId(TransactionId) then
-  begin
-    TransactionId := '';
-    Exit;
-  end;
-  Result := True;
-end;
-
-function GetExternalUninstallBootstrapPath: String;
-var
-  TransactionId: String;
-begin
-  Result := '';
-  if not TryReadUninstallTransactionId(TransactionId) then Exit;
-  Result := ExpandConstant('{localappdata}\CodexRemote-fix-uninstall\') + TransactionId + '\payload\src\persistence\UninstallBootstrap.ps1';
-  if not FileExists(Result) then Result := '';
-end;
-
-function InitializeUninstall(): Boolean;
-var
-  ResultCode: Integer;
-  Parameters: String;
-begin
-  Parameters := '-NoProfile -ExecutionPolicy Bypass -File "' +
-    ExpandConstant('{app}\src\persistence\UninstallBootstrap.ps1') + '" -InstallerRoot "' +
-    ExpandConstant('{app}') + '" -InstallRoot "' +
-    ExpandConstant('{localappdata}\CodexControlOtherDevices') + '" -Mode Prepare';
-  Result := Exec(ExpandConstant('{sys}\WindowsPowerShell\v1.0\powershell.exe'), Parameters,
-    '', SW_HIDE, ewWaitUntilTerminated, ResultCode) and (ResultCode = 0);
-  if not Result then
-  begin
-    Log('CodexRemote-fix uninstall bootstrap refused pre-deletion cleanup, result code ' + IntToStr(ResultCode) + '.');
-    SuppressibleMsgBox('CodexRemote-fix could not verify safe cleanup. No installer files were removed; retry uninstall after resolving the reported support code.', mbError, MB_OK, IDOK);
-  end;
-end;
-
-procedure CurUninstallStepChanged(CurUninstallStep: TUninstallStep);
-var
-  ResultCode: Integer;
-  Parameters, BootstrapPath: String;
-begin
-  if CurUninstallStep <> usPostUninstall then Exit;
-  BootstrapPath := GetExternalUninstallBootstrapPath;
-  if BootstrapPath = '' then
-  begin
-    Log('CodexRemote-fix uninstall completion receipt could not locate the staged bootstrap.');
-    RaiseException('CCOD_UNINSTALL_FINALIZATION_MISSING');
-  end;
-  Parameters := '-NoProfile -NonInteractive -ExecutionPolicy Bypass -File "' + BootstrapPath +
-    '" -InstallerRoot "' + ExpandConstant('{app}') + '" -InstallRoot "' +
-    ExpandConstant('{localappdata}\CodexControlOtherDevices') + '" -Mode FinalizeReceipt';
-  if (not Exec(ExpandConstant('{sys}\WindowsPowerShell\v1.0\powershell.exe'), Parameters,
-      '', SW_HIDE, ewWaitUntilTerminated, ResultCode)) or (ResultCode <> 0) then
-  begin
-    Log('CodexRemote-fix uninstall completion receipt was not finalized, result code ' + IntToStr(ResultCode) + '.');
-    RaiseException('CCOD_UNINSTALL_FINALIZATION_FAILED');
-  end;
+  CloseCcodInputHandles();
 end;
diff --git a/build/InstallerPackage.psm1 b/build/InstallerPackage.psm1
new file mode 100644
index 0000000..55fd5ae
--- /dev/null
+++ b/build/InstallerPackage.psm1
@@ -0,0 +1,236 @@
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+$script:CcodInstallerPackageMaximumBytes = 536870912
+$script:CcodInstallerPackageManifestMaximumBytes = 4194304
+$script:CcodInstallerPackageEntryMaximumBytes = 268435456
+
+function Throw-CcodInstallerPackageError {
+    param([Parameter(Mandatory)][string]$Id,[Parameter(Mandatory)][string]$Message,$Target)
+    throw [Management.Automation.ErrorRecord]::new(
+        [IO.InvalidDataException]::new($Message),
+        $Id,
+        [Management.Automation.ErrorCategory]::InvalidData,
+        $Target
+    )
+}
+
+function Get-CcodInstallerPackageSha256 {
+    param([Parameter(Mandatory)][string]$Path)
+    $stream = $null
+    $sha = [Security.Cryptography.SHA256]::Create()
+    try {
+        $stream = [IO.File]::Open([IO.Path]::GetFullPath($Path),[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read)
+        return [BitConverter]::ToString($sha.ComputeHash($stream)).Replace('-','').ToLowerInvariant()
+    } finally {
+        if ($null -ne $stream) { $stream.Dispose() }
+        $sha.Dispose()
+    }
+}
+
+function Get-CcodInstallerPackageStreamSha256 {
+    param([Parameter(Mandatory)][IO.Stream]$Stream)
+    $sha = [Security.Cryptography.SHA256]::Create()
+    try {
+        $Stream.Position = 0
+        $value = [BitConverter]::ToString($sha.ComputeHash($Stream)).Replace('-','').ToLowerInvariant()
+        $Stream.Position = 0
+        return $value
+    } finally { $sha.Dispose() }
+}
+
+function Test-CcodInstallerPackageRelativePath {
+    param([AllowNull()][string]$Path)
+    return $Path -is [string] -and $Path -cmatch '^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$' -and
+        -not $Path.Contains('//') -and -not $Path.Contains('..') -and -not $Path.Contains(':') -and
+        -not $Path.Contains('\') -and -not $Path.EndsWith('/')
+}
+
+function Get-CcodInstallerPackageTopLevelJsonPropertyCount {
+    param([Parameter(Mandatory)][string]$Json,[Parameter(Mandatory)][string]$Name)
+    $count=0;$depth=0;$inString=$false;$escaped=$false;$expectKey=$false;$captureKey=$false;$keyStart=-1
+    for($index=0;$index-lt$Json.Length;$index++){
+        $character=$Json[$index]
+        if($inString){
+            if($escaped){$escaped=$false;continue}
+            if($character-ceq'\'){$escaped=$true;continue}
+            if($character-ceq'"'){
+                if($captureKey){
+                    try{$key=$Json.Substring($keyStart,$index-$keyStart+1)|ConvertFrom-Json -ErrorAction Stop}catch{return -1}
+                    if($key-isnot[string]){return -1};if($key-ceq$Name){$count++};$expectKey=$false
+                }
+                $inString=$false;$captureKey=$false
+            }
+            continue
+        }
+        if($character-ceq'"'){$inString=$true;$captureKey=($depth-eq 1-and$expectKey);if($captureKey){$keyStart=$index};continue}
+        if($character-ceq'{'-or$character-ceq'['){$depth++;if($depth-eq 1-and$character-ceq'{'){$expectKey=$true};continue}
+        if($character-ceq'}'-or$character-ceq']'){$depth--;if($depth-lt 0){return -1};continue}
+        if($character-ceq','-and$depth-eq 1){$expectKey=$true}
+    }
+    if($inString-or$depth-ne 0){return -1};return $count
+}
+
+function Assert-CcodInstallerPackageRegularFile {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$Kind,[int64]$MaximumBytes = 536870912)
+    $full = [IO.Path]::GetFullPath($Path)
+    if (-not [IO.File]::Exists($full)) { Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' "$Kind is missing" $full }
+    $item = Get-Item -LiteralPath $full -Force -ErrorAction Stop
+    if ($item.PSIsContainer -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0 -or $item.Length -le 0 -or $item.Length -gt $MaximumBytes) {
+        Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' "$Kind is not a bounded regular file" $full
+    }
+    return $full
+}
+
+function Read-CcodInstallerPayloadManifest {
+    param([Parameter(Mandatory)][byte[]]$Bytes,[Parameter(Mandatory)][string]$ExpectedVersion)
+    try { $text=[Text.UTF8Encoding]::new($false,$true).GetString($Bytes);$manifest=$text|ConvertFrom-Json -ErrorAction Stop }
+    catch { Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Payload manifest JSON is invalid' $null }
+    foreach($name in @('schemaVersion','projectVersion','files')){if((Get-CcodInstallerPackageTopLevelJsonPropertyCount $text $name)-ne 1){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Payload manifest contains duplicate or missing fields' $name}}
+    if($manifest-isnot[pscustomobject]-or(@($manifest.PSObject.Properties.Name)-join',')-cne'schemaVersion,projectVersion,files'-or
+       $manifest.schemaVersion-isnot[int]-or$manifest.schemaVersion-ne 1-or$manifest.projectVersion-isnot[string]-or$manifest.projectVersion-cne$ExpectedVersion){
+        Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Payload manifest metadata is invalid' $null
+    }
+    $records=@($manifest.files);if($records.Count-eq 0){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Payload manifest is empty' $null}
+    $seen=[Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase);$previous=$null
+    foreach($record in $records){
+        if($record-isnot[pscustomobject]-or(@($record.PSObject.Properties.Name)-join',')-cne'path,length,sha256'-or
+           -not(Test-CcodInstallerPackageRelativePath ([string]$record.path))-or
+           $record.length-isnot[ValueType]-or[decimal]$record.length-ne[decimal][int64]$record.length-or[int64]$record.length-lt 0-or[int64]$record.length-gt$script:CcodInstallerPackageEntryMaximumBytes-or
+           $record.sha256-isnot[string]-or$record.sha256-cnotmatch'^[0-9a-f]{64}$'-or
+           ($null-ne$previous-and[StringComparer]::Ordinal.Compare($previous,[string]$record.path)-ge 0)-or-not$seen.Add([string]$record.path)){
+            Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Payload manifest file record is invalid' $record
+        }
+        $previous=[string]$record.path
+    }
+    return [pscustomobject]@{Text=$text;Manifest=$manifest;Records=$records}
+}
+
+function Read-CcodInstallerPackageManifest {
+    param([Parameter(Mandatory)][byte[]]$Bytes,[Parameter(Mandatory)][string]$ExpectedVersion,[Parameter(Mandatory)][string]$ExpectedGitCommit)
+    try{$text=[Text.UTF8Encoding]::new($false,$true).GetString($Bytes);$manifest=$text|ConvertFrom-Json -ErrorAction Stop}catch{Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Installer package manifest JSON is invalid' $null}
+    foreach($name in @('schemaVersion','product','version','gitCommit','payloadManifest','files')){if((Get-CcodInstallerPackageTopLevelJsonPropertyCount $text $name)-ne 1){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Installer package manifest contains duplicate or missing fields' $name}}
+    if($manifest-isnot[pscustomobject]-or(@($manifest.PSObject.Properties.Name)-join',')-cne'schemaVersion,product,version,gitCommit,payloadManifest,files'-or
+       $manifest.schemaVersion-isnot[int]-or$manifest.schemaVersion-ne 1-or$manifest.product-isnot[string]-or$manifest.product-cne'CodexRemote-fix'-or
+       $manifest.version-isnot[string]-or$manifest.version-cne$ExpectedVersion-or$manifest.gitCommit-isnot[string]-or$manifest.gitCommit-cne$ExpectedGitCommit-or
+       $manifest.payloadManifest-isnot[pscustomobject]-or(@($manifest.payloadManifest.PSObject.Properties.Name)-join',')-cne'name,length,sha256'-or
+       $manifest.payloadManifest.name-isnot[string]-or$manifest.payloadManifest.name-cne'installer-payload.manifest.json'-or
+       $manifest.payloadManifest.length-isnot[ValueType]-or[decimal]$manifest.payloadManifest.length-ne[decimal][int64]$manifest.payloadManifest.length-or[int64]$manifest.payloadManifest.length-le 0-or[int64]$manifest.payloadManifest.length-gt$script:CcodInstallerPackageManifestMaximumBytes-or
+       $manifest.payloadManifest.sha256-isnot[string]-or$manifest.payloadManifest.sha256-cnotmatch'^[0-9a-f]{64}$'){
+        Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Installer package manifest metadata is invalid' $null
+    }
+    return [pscustomobject]@{Text=$text;Manifest=$manifest;Records=@($manifest.files)}
+}
+
+function Assert-CcodInstallerPackageFileRecords {
+    param([Parameter(Mandatory)]$Records)
+    $seen=[Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase);$previous=$null
+    foreach($record in @($Records)){
+        if($record-isnot[pscustomobject]-or(@($record.PSObject.Properties.Name)-join',')-cne'path,length,sha256'-or-not(Test-CcodInstallerPackageRelativePath ([string]$record.path))-or
+           $record.length-isnot[ValueType]-or[decimal]$record.length-ne[decimal][int64]$record.length-or[int64]$record.length-lt 0-or[int64]$record.length-gt$script:CcodInstallerPackageEntryMaximumBytes-or
+           $record.sha256-isnot[string]-or$record.sha256-cnotmatch'^[0-9a-f]{64}$'-or($null-ne$previous-and[StringComparer]::Ordinal.Compare($previous,[string]$record.path)-ge 0)-or-not$seen.Add([string]$record.path)){
+            Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Installer package file record is invalid' $record
+        };$previous=[string]$record.path
+    }
+    if($seen.Count-eq 0){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Installer package file list is empty' $null}
+    return [pscustomobject]@{Set=$seen;Count=$seen.Count}
+}
+
+function Open-CcodInstallerPackageSeal {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string]$PackagePath,[Parameter(Mandatory)][string]$ManifestPath,
+        [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedPackageSha256,
+        [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedManifestSha256,
+        [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion,
+        [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit
+    )
+    Add-Type -AssemblyName System.IO.Compression -ErrorAction Stop
+    $package=Assert-CcodInstallerPackageRegularFile $PackagePath 'Installer package' $script:CcodInstallerPackageMaximumBytes
+    $manifestPathFull=Assert-CcodInstallerPackageRegularFile $ManifestPath 'Installer package manifest' $script:CcodInstallerPackageManifestMaximumBytes
+    $packageStream=$null;$manifestStream=$null;$archive=$null
+    try{
+        $packageStream=[IO.File]::Open($package,[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read)
+        if((Get-CcodInstallerPackageStreamSha256 $packageStream)-cne$ExpectedPackageSha256){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_HASH_MISMATCH' 'Installer package hash mismatch' $package}
+        $manifestStream=[IO.File]::Open($manifestPathFull,[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read)
+        if((Get-CcodInstallerPackageStreamSha256 $manifestStream)-cne$ExpectedManifestSha256){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_MANIFEST_HASH_MISMATCH' 'Installer package manifest hash mismatch' $manifestPathFull}
+        $manifestBytes=New-Object byte[] ([int]$manifestStream.Length);$manifestStream.Position=0;$read=$manifestStream.Read($manifestBytes,0,$manifestBytes.Length);if($read-ne$manifestBytes.Length){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Installer package manifest read was incomplete' $manifestPathFull}
+        $manifestResult=Read-CcodInstallerPackageManifest -Bytes $manifestBytes -ExpectedVersion $ExpectedVersion -ExpectedGitCommit $ExpectedGitCommit
+        $expectedResult=Assert-CcodInstallerPackageFileRecords -Records $manifestResult.Records
+        $expected=$expectedResult.Set
+        $archive=[IO.Compression.ZipArchive]::new($packageStream,[IO.Compression.ZipArchiveMode]::Read,$true)
+        $entries=[Collections.Generic.Dictionary[string,object]]::new([StringComparer]::OrdinalIgnoreCase)
+        foreach($entry in @($archive.Entries)){
+            $name=[string]$entry.FullName
+            if(-not(Test-CcodInstallerPackageRelativePath $name)-or$entries.ContainsKey($name)-or$entry.Name.Length-eq 0-or$entry.Length-lt 0-or$entry.Length-gt$script:CcodInstallerPackageEntryMaximumBytes){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Installer package entry set is unsafe or duplicate' $name}
+            $entries.Add($name,$entry)
+        }
+        if($entries.Count-ne($expected.Count+1)-or-not$entries.ContainsKey('installer-payload.manifest.json')){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Installer package entry set differs from its manifest' $package}
+        foreach($path in $expected){if(-not$entries.ContainsKey($path)){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Installer package entry is missing' $path}}
+        $payloadEntry=$entries['installer-payload.manifest.json'];$payloadBytes=New-Object byte[] ([int]$payloadEntry.Length);$entryStream=$payloadEntry.Open();try{$offset=0;while($offset-lt$payloadBytes.Length){$count=$entryStream.Read($payloadBytes,$offset,$payloadBytes.Length-$offset);if($count-le 0){break};$offset+=$count};if($offset-ne$payloadBytes.Length){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Payload manifest entry read was incomplete' $null}}finally{$entryStream.Dispose()}
+        $payloadSha=[Security.Cryptography.SHA256]::Create();try{$payloadHash=[BitConverter]::ToString($payloadSha.ComputeHash($payloadBytes)).Replace('-','').ToLowerInvariant()}finally{$payloadSha.Dispose()}
+        if([int64]$payloadBytes.Length-ne[int64]$manifestResult.Manifest.payloadManifest.length-or$payloadHash-cne[string]$manifestResult.Manifest.payloadManifest.sha256){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Embedded payload manifest binding is invalid' $null}
+        $payloadResult=Read-CcodInstallerPayloadManifest -Bytes $payloadBytes -ExpectedVersion $ExpectedVersion
+        if(@($payloadResult.Records).Count-ne@($manifestResult.Records).Count){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Payload and package manifests differ' $null}
+        for($i=0;$i-lt@($payloadResult.Records).Count;$i++){if(($payloadResult.Records[$i]|ConvertTo-Json -Compress)-cne($manifestResult.Records[$i]|ConvertTo-Json -Compress)){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Payload and package file records differ' $null}}
+        foreach($record in @($manifestResult.Records)){$entry=$entries[[string]$record.path];if([int64]$entry.Length-ne[int64]$record.length){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Installer package entry length mismatch' $record.path};$s=$entry.Open();$sha=[Security.Cryptography.SHA256]::Create();try{$hash=[BitConverter]::ToString($sha.ComputeHash($s)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose();$s.Dispose()};if($hash-cne[string]$record.sha256){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Installer package entry hash mismatch' $record.path}}
+        return [pscustomobject]@{Valid=$true;PackagePath=$package;ManifestPath=$manifestPathFull;PackageSha256=$ExpectedPackageSha256;ManifestSha256=$ExpectedManifestSha256;PayloadManifestSha256=$payloadHash;Manifest=$manifestResult.Manifest;PayloadManifestBytes=$payloadBytes;PackageStream=$packageStream;ManifestStream=$manifestStream;Archive=$archive;Entries=$entries}
+    }catch{if($null-ne$archive){$archive.Dispose()};if($null-ne$manifestStream){$manifestStream.Dispose()};if($null-ne$packageStream){$packageStream.Dispose()};throw}
+}
+
+function Close-CcodInstallerPackageSeal { param($Seal) if($null-eq$Seal){return};foreach($name in @('Archive','ManifestStream','PackageStream')){try{$value=$Seal.$name;if($null-ne$value){$value.Dispose()}}catch{}} }
+
+function Expand-CcodInstallerPackageSeal {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)]$Seal,[Parameter(Mandatory)][string]$DestinationRoot)
+    if($null-eq$Seal-or-not[bool]$Seal.Valid){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Installer package seal is invalid' $null}
+    $destination=[IO.Path]::GetFullPath($DestinationRoot)
+    if([IO.File]::Exists($destination)-or[IO.Directory]::Exists($destination)){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Package extraction destination already exists' $destination}
+    [IO.Directory]::CreateDirectory($destination)|Out-Null
+    try{
+        $records=@($Seal.Manifest.files)+@([pscustomobject][ordered]@{path='installer-payload.manifest.json';length=[int64]$Seal.PayloadManifestBytes.Length;sha256=[string]$Seal.PayloadManifestSha256})
+        foreach($record in $records){
+            $relative=[string]$record.path;$target=[IO.Path]::GetFullPath((Join-Path $destination $relative.Replace('/','\')));$prefix=$destination.TrimEnd('\')+'\'
+            if(-not$target.StartsWith($prefix,[StringComparison]::OrdinalIgnoreCase)){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Package extraction path escaped its destination' $relative}
+            $parent=Split-Path $target -Parent;if(-not[IO.Directory]::Exists($parent)){[IO.Directory]::CreateDirectory($parent)|Out-Null}
+            $entry=$Seal.Entries[$relative];$source=$entry.Open();$output=[IO.File]::Open($target,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::None)
+            try{$source.CopyTo($output);$output.Flush($true)}finally{$output.Dispose();$source.Dispose()}
+            if([int64](Get-Item -LiteralPath $target -Force).Length-ne[int64]$record.length-or(Get-CcodInstallerPackageSha256 $target)-cne[string]$record.sha256){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Extracted package entry failed verification' $relative}
+        }
+        return $destination
+    }catch{if([IO.Directory]::Exists($destination)){Remove-Item -LiteralPath $destination -Recurse -Force -ErrorAction SilentlyContinue};throw}
+}
+
+function Test-CcodInstallerPackage {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][string]$PackagePath,[Parameter(Mandatory)][string]$ManifestPath,[Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedPackageSha256,[Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedManifestSha256,[Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion,[Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit)
+    $seal=$null;try{$seal=Open-CcodInstallerPackageSeal @PSBoundParameters;return [pscustomobject]@{Valid=$true;PackageSha256=$seal.PackageSha256;ManifestSha256=$seal.ManifestSha256;PayloadManifestSha256=$seal.PayloadManifestSha256;FileCount=@($seal.Manifest.files).Count}}finally{Close-CcodInstallerPackageSeal $seal}
+}
+
+function New-CcodInstallerPackage {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][string]$PayloadRoot,[Parameter(Mandatory)][string]$PayloadManifestPath,[Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$Version,[Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$GitCommit,[Parameter(Mandatory)][string]$OutputPath,[Parameter(Mandatory)][string]$ManifestOutputPath)
+    Add-Type -AssemblyName System.IO.Compression -ErrorAction Stop
+    Add-Type -AssemblyName System.IO.Compression.FileSystem -ErrorAction Stop
+    $root=[IO.Path]::GetFullPath($PayloadRoot).TrimEnd('\');if(-not[IO.Directory]::Exists($root)){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Payload root is missing' $root};$rootItem=Get-Item -LiteralPath $root -Force;if(($rootItem.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne 0){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Payload root is a reparse point' $root}
+    $payloadManifest=Assert-CcodInstallerPackageRegularFile $PayloadManifestPath 'Payload manifest' $script:CcodInstallerPackageManifestMaximumBytes;$payloadBytes=[IO.File]::ReadAllBytes($payloadManifest);$payloadResult=Read-CcodInstallerPayloadManifest -Bytes $payloadBytes -ExpectedVersion $Version
+    $records=@($payloadResult.Records);$actual=[Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+    foreach($item in @(Get-ChildItem -LiteralPath $root -Force -Recurse)) { if(($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne 0){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Payload contains a reparse point' $item.FullName};if($item.PSIsContainer-or$item.FullName.Equals($payloadManifest,[StringComparison]::OrdinalIgnoreCase)){continue};$relative=$item.FullName.Substring($root.Length+1).Replace('\','/');[void]$actual.Add($relative) }
+    if($actual.Count-ne$records.Count){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Payload file set differs from its manifest' $root}
+    foreach($record in $records){$path=Join-Path $root ([string]$record.path).Replace('/','\');if(-not[IO.File]::Exists($path)-or-not$actual.Contains([string]$record.path)-or[int64](Get-Item -LiteralPath $path -Force).Length-ne[int64]$record.length-or(Get-CcodInstallerPackageSha256 $path)-cne[string]$record.sha256){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Payload file differs from its manifest' $record.path}}
+    $payloadSha=[Security.Cryptography.SHA256]::Create();try{$payloadHash=[BitConverter]::ToString($payloadSha.ComputeHash($payloadBytes)).Replace('-','').ToLowerInvariant()}finally{$payloadSha.Dispose()}
+    $packageManifest=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$Version;gitCommit=$GitCommit;payloadManifest=[ordered]@{name='installer-payload.manifest.json';length=[int64]$payloadBytes.Length;sha256=$payloadHash};files=$records}
+    $output=[IO.Path]::GetFullPath($OutputPath);$manifestOutput=[IO.Path]::GetFullPath($ManifestOutputPath);if(-not[IO.Path]::IsPathRooted($OutputPath)-or-not[IO.Path]::IsPathRooted($ManifestOutputPath)-or$output-eq$manifestOutput-or[IO.File]::Exists($output)-or[IO.Directory]::Exists($output)-or[IO.File]::Exists($manifestOutput)-or[IO.Directory]::Exists($manifestOutput)){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Package outputs must be distinct absent absolute paths' $output}
+    foreach($parent in @((Split-Path $output -Parent),(Split-Path $manifestOutput -Parent))){if(-not[IO.Directory]::Exists($parent)){[IO.Directory]::CreateDirectory($parent)|Out-Null}}
+    $tempPackage=Join-Path (Split-Path $output -Parent) ('.ccod.'+[guid]::NewGuid().ToString('N')+'.zip.tmp');$tempManifest=Join-Path (Split-Path $manifestOutput -Parent) ('.ccod.'+[guid]::NewGuid().ToString('N')+'.json.tmp')
+    try{
+        $archive=[IO.Compression.ZipFile]::Open($tempPackage,[IO.Compression.ZipArchiveMode]::Create);try{foreach($record in $records){$entry=$archive.CreateEntry([string]$record.path,[IO.Compression.CompressionLevel]::Optimal);$source=[IO.File]::OpenRead((Join-Path $root ([string]$record.path).Replace('/','\')));$dest=$entry.Open();try{$source.CopyTo($dest)}finally{$dest.Dispose();$source.Dispose()}};$entry=$archive.CreateEntry('installer-payload.manifest.json',[IO.Compression.CompressionLevel]::Optimal);$dest=$entry.Open();try{$dest.Write($payloadBytes,0,$payloadBytes.Length)}finally{$dest.Dispose()}}finally{$archive.Dispose()}
+        [IO.File]::WriteAllText($tempManifest,(($packageManifest|ConvertTo-Json -Depth 8)+[Environment]::NewLine),[Text.UTF8Encoding]::new($false))
+        $packageHash=Get-CcodInstallerPackageSha256 $tempPackage;$manifestHash=Get-CcodInstallerPackageSha256 $tempManifest
+        Test-CcodInstallerPackage -PackagePath $tempPackage -ManifestPath $tempManifest -ExpectedPackageSha256 $packageHash -ExpectedManifestSha256 $manifestHash -ExpectedVersion $Version -ExpectedGitCommit $GitCommit|Out-Null
+        [IO.File]::Move($tempPackage,$output);[IO.File]::Move($tempManifest,$manifestOutput)
+        return [pscustomobject]@{PackagePath=$output;ManifestPath=$manifestOutput;PackageSha256=$packageHash;ManifestSha256=$manifestHash;PayloadManifestSha256=$payloadHash;FileCount=$records.Count}
+    }catch{foreach($path in @($tempPackage,$tempManifest)){if([IO.File]::Exists($path)){[IO.File]::Delete($path)}};if([IO.File]::Exists($output)-and-not[IO.File]::Exists($manifestOutput)){[IO.File]::Delete($output)};throw}
+}
+
+Export-ModuleMember -Function New-CcodInstallerPackage,Test-CcodInstallerPackage,Open-CcodInstallerPackageSeal,Close-CcodInstallerPackageSeal,Expand-CcodInstallerPackageSeal,Get-CcodInstallerPackageSha256
diff --git a/build/SetupArtifact.psm1 b/build/SetupArtifact.psm1
index a5eda58..a2cdcd6 100644
--- a/build/SetupArtifact.psm1
+++ b/build/SetupArtifact.psm1
@@ -55,7 +55,10 @@ function Test-CcodSetupArtifact {
         [Parameter(Mandatory)][string]$SetupPath,
         [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion,
         [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit,
-        [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedPayloadManifestSha256
+        [ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedPayloadManifestSha256,
+        [ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedPackageSha256,
+        [ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedPackageManifestSha256,
+        [ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedActivationBootstrapSha256
     )
 
     $setup = Assert-CcodSetupRegularFile -Path $SetupPath -Kind 'Setup artifact'
@@ -69,12 +72,23 @@ function Test-CcodSetupArtifact {
     $fileDescription = ([string]$versionInfo.FileDescription).Trim()
     $companyName = ([string]$versionInfo.CompanyName).Trim()
     $legalCopyright = ([string]$versionInfo.LegalCopyright).Trim()
-    if ($fileVersion -cne $expectedPeVersion -or $productVersion -cne $expectedPeVersion) {
+    $originalFilename = ([string]$versionInfo.OriginalFilename).Trim()
+    $sealedContract = -not [string]::IsNullOrWhiteSpace($ExpectedPackageSha256) -or -not [string]::IsNullOrWhiteSpace($ExpectedPackageManifestSha256) -or -not [string]::IsNullOrWhiteSpace($ExpectedActivationBootstrapSha256)
+    if ($sealedContract -and ([string]::IsNullOrWhiteSpace($ExpectedPackageSha256) -or [string]::IsNullOrWhiteSpace($ExpectedPackageManifestSha256) -or [string]::IsNullOrWhiteSpace($ExpectedActivationBootstrapSha256))) {
+        Throw-CcodSetupArtifactError 'CCOD_SETUP_PAYLOAD_BINDING_INVALID' 'The sealed Setup PE contract requires all three hashes' $setup
+    }
+    $expectedProductVersion = if ($sealedContract) { $ExpectedPackageManifestSha256.Substring(0,32) } else { $expectedPeVersion }
+    if ($sealedContract) { $expectedDescription = $ExpectedPackageManifestSha256.Substring(32,32) }
+    $expectedProductName = if ($sealedContract) { $ExpectedActivationBootstrapSha256.Substring(32,32) } else { 'CodexRemote-fix' }
+    $expectedOriginalFilename = if ($sealedContract) { $ExpectedActivationBootstrapSha256.Substring(0,32) } else { $originalFilename }
+    if ($fileVersion -cne $expectedPeVersion -or $productVersion -cne $expectedProductVersion) {
         Throw-CcodSetupArtifactError 'CCOD_SETUP_PE_VERSION_INVALID' ("Setup PE FileVersion/ProductVersion do not match the release version: file={0}; product={1}; expected={2}" -f [string]$versionInfo.FileVersion,[string]$versionInfo.ProductVersion,$expectedPeVersion) $setup
     }
-    if ($productName -cne 'CodexRemote-fix' -or $fileDescription -cne $expectedDescription -or
-        $companyName -cne $ExpectedGitCommit -or $legalCopyright -cne $ExpectedPayloadManifestSha256) {
-        Throw-CcodSetupArtifactError 'CCOD_SETUP_PAYLOAD_BINDING_INVALID' ("Setup PE does not bind the expected version, commit, and activation payload manifest hash: product={0}; description={1}; company={2}; copyright={3}" -f $productName,$fileDescription,$companyName,$legalCopyright) $setup
+    $expectedCopyright = if ($sealedContract) { $ExpectedPackageSha256 } else { $ExpectedPayloadManifestSha256 }
+    if ($productName -cne $expectedProductName -or $fileDescription -cne $expectedDescription -or
+        $companyName -cne $ExpectedGitCommit -or $legalCopyright -cne $expectedCopyright -or
+        ($sealedContract -and $originalFilename -cne $expectedOriginalFilename)) {
+        Throw-CcodSetupArtifactError 'CCOD_SETUP_PAYLOAD_BINDING_INVALID' ("Setup PE does not bind the expected version, commit, package, manifest, and bootstrap hashes: product={0}; productVersion={1}; description={2}; company={3}; copyright={4}; original={5}" -f $productName,$productVersion,$fileDescription,$companyName,$legalCopyright,$originalFilename) $setup
     }
     return [pscustomobject][ordered]@{
         Valid = $true
@@ -85,6 +99,9 @@ function Test-CcodSetupArtifact {
         FileDescription = $fileDescription
         CompanyName = $companyName
         LegalCopyright = $legalCopyright
+        OriginalFilename = $originalFilename
+        PackageManifestSha256 = if ($sealedContract) { $productVersion + $fileDescription } else { $null }
+        ActivationBootstrapSha256 = if ($sealedContract) { $originalFilename + $productName } else { $null }
     }
 }
 
@@ -197,4 +214,55 @@ function Test-CcodSetupBuildProvenance {
     return $record
 }
 
-Export-ModuleMember -Function Get-CcodSetupArtifactHash,Get-CcodSetupDescription,New-CcodSetupBuildProvenance,Test-CcodSetupBuildProvenance,Test-CcodSetupArtifact
+function New-CcodSealedSetupBuildProvenance {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$Version,
+        [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$GitCommit,
+        [Parameter(Mandatory)][string]$BuildTimestampUtc,
+        [Parameter(Mandatory)][string]$PackagePath,
+        [Parameter(Mandatory)][string]$PackageManifestPath,
+        [Parameter(Mandatory)][string]$ActivationBootstrapPath,
+        [Parameter(Mandatory)][string]$InnoTemplatePath,
+        [Parameter(Mandatory)][string]$DestinationInventoryPath,
+        [Parameter(Mandatory)][string]$CompilerPath,
+        [Parameter(Mandatory)][string]$OutputPath
+    )
+    if (-not (Test-CcodSetupCanonicalUtc $BuildTimestampUtc)) { Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Sealed Setup provenance timestamp is invalid' $BuildTimestampUtc }
+    $package=Assert-CcodSetupRegularFile $PackagePath 'Installer package';$manifest=Assert-CcodSetupRegularFile $PackageManifestPath 'Installer package manifest';$bootstrap=Assert-CcodSetupRegularFile $ActivationBootstrapPath 'Activation bootstrap';$template=Assert-CcodSetupRegularFile $InnoTemplatePath 'Inno template';$inventory=Assert-CcodSetupRegularFile $DestinationInventoryPath 'Destination inventory';$compiler=Assert-CcodSetupRegularFile $CompilerPath 'Inno compiler'
+    try{$manifestRecord=[IO.File]::ReadAllText($manifest,[Text.UTF8Encoding]::new($false))|ConvertFrom-Json -ErrorAction Stop}catch{Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Installer package manifest JSON is invalid' $manifest}
+    if($manifestRecord.schemaVersion-isnot[int]-or$manifestRecord.schemaVersion-ne 1-or$manifestRecord.product-cne'CodexRemote-fix'-or$manifestRecord.version-cne$Version-or$manifestRecord.gitCommit-cne$GitCommit-or@($manifestRecord.files).Count-eq0){Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Installer package manifest identity is invalid' $manifest}
+    $packageHash=Get-CcodSetupArtifactHash $package;$manifestHash=Get-CcodSetupArtifactHash $manifest;$bootstrapHash=Get-CcodSetupArtifactHash $bootstrap;$compilerInfo=[Diagnostics.FileVersionInfo]::GetVersionInfo($compiler)
+    $record=[ordered]@{
+        schemaVersion=2;product='CodexRemote-fix';version=$Version;gitCommit=$GitCommit;buildTimestampUtc=$BuildTimestampUtc
+        installerPackage=[ordered]@{name='installer-package.zip';length=[int64](Get-Item $package -Force).Length;sha256=$packageHash}
+        installerPackageManifest=[ordered]@{name='installer-package.manifest.json';length=[int64](Get-Item $manifest -Force).Length;sha256=$manifestHash;fileCount=[int]@($manifestRecord.files).Count;payloadManifestSha256=[string]$manifestRecord.payloadManifest.sha256}
+        activationBootstrap=[ordered]@{name='Activate-CcodRemoteFix.ps1';length=[int64](Get-Item $bootstrap -Force).Length;sha256=$bootstrapHash}
+        buildInputs=[ordered]@{innoTemplateSha256=Get-CcodSetupArtifactHash $template;destinationInventorySha256=Get-CcodSetupArtifactHash $inventory;compilerSha256=Get-CcodSetupArtifactHash $compiler;compilerFileVersion=[string]$compilerInfo.FileVersion}
+        peContract=[ordered]@{fileVersion="$Version.0";packageManifestFirst=$manifestHash.Substring(0,32);packageManifestLast=$manifestHash.Substring(32,32);bootstrapFirst=$bootstrapHash.Substring(0,32);bootstrapLast=$bootstrapHash.Substring(32,32);companyName=$GitCommit;legalCopyright=$packageHash}
+    }
+    $output=[IO.Path]::GetFullPath($OutputPath);if([IO.File]::Exists($output)-or[IO.Directory]::Exists($output)){Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Refusing to overwrite sealed Setup provenance' $output}
+    [IO.File]::WriteAllText($output,(($record|ConvertTo-Json -Depth 8)+[Environment]::NewLine),[Text.UTF8Encoding]::new($false));return [pscustomobject]$record
+}
+
+function Test-CcodSealedSetupBuildProvenance {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string]$ProvenancePath,[Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion,[Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit,
+        [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedPackageSha256,[Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedPackageManifestSha256,[Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedActivationBootstrapSha256,[Parameter(Mandatory)][string]$ExpectedBuildTimestampUtc,
+        [Parameter(Mandatory)][string]$PackagePath,[Parameter(Mandatory)][string]$PackageManifestPath,[Parameter(Mandatory)][string]$ActivationBootstrapPath,[Parameter(Mandatory)][string]$InnoTemplatePath,[Parameter(Mandatory)][string]$DestinationInventoryPath,[Parameter(Mandatory)][string]$CompilerPath
+    )
+    $path=Assert-CcodSetupRegularFile $ProvenancePath 'Sealed Setup provenance';$package=Assert-CcodSetupRegularFile $PackagePath 'Installer package';$manifest=Assert-CcodSetupRegularFile $PackageManifestPath 'Installer package manifest';$bootstrap=Assert-CcodSetupRegularFile $ActivationBootstrapPath 'Activation bootstrap';$template=Assert-CcodSetupRegularFile $InnoTemplatePath 'Inno template';$inventory=Assert-CcodSetupRegularFile $DestinationInventoryPath 'Destination inventory';$compiler=Assert-CcodSetupRegularFile $CompilerPath 'Inno compiler'
+    try{$record=[IO.File]::ReadAllText($path,[Text.UTF8Encoding]::new($false))|ConvertFrom-Json -ErrorAction Stop}catch{Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Sealed Setup provenance JSON is invalid' $path}
+    $fields='schemaVersion,product,version,gitCommit,buildTimestampUtc,installerPackage,installerPackageManifest,activationBootstrap,buildInputs,peContract'
+    $actualCompilerVersion=([string][Diagnostics.FileVersionInfo]::GetVersionInfo($compiler).FileVersion).Trim()
+    if((@($record.PSObject.Properties.Name)-join',')-cne$fields-or$record.schemaVersion-ne 2-or$record.product-cne'CodexRemote-fix'-or$record.version-cne$ExpectedVersion-or$record.gitCommit-cne$ExpectedGitCommit-or$record.buildTimestampUtc-cne$ExpectedBuildTimestampUtc-or-not(Test-CcodSetupCanonicalUtc ([string]$record.buildTimestampUtc))-or
+       $record.installerPackage.sha256-cne$ExpectedPackageSha256-or$record.installerPackage.sha256-cne(Get-CcodSetupArtifactHash $package)-or[long]$record.installerPackage.length-ne(Get-Item $package -Force).Length-or
+       $record.installerPackageManifest.sha256-cne$ExpectedPackageManifestSha256-or$record.installerPackageManifest.sha256-cne(Get-CcodSetupArtifactHash $manifest)-or
+       $record.activationBootstrap.sha256-cne$ExpectedActivationBootstrapSha256-or$record.activationBootstrap.sha256-cne(Get-CcodSetupArtifactHash $bootstrap)-or
+       $record.buildInputs.innoTemplateSha256-cne(Get-CcodSetupArtifactHash $template)-or$record.buildInputs.destinationInventorySha256-cne(Get-CcodSetupArtifactHash $inventory)-or$record.buildInputs.compilerSha256-cne(Get-CcodSetupArtifactHash $compiler)-or([string]$record.buildInputs.compilerFileVersion).Trim()-cne$actualCompilerVersion-or
+       $record.peContract.fileVersion-cne"$ExpectedVersion.0"-or$record.peContract.packageManifestFirst-cne$ExpectedPackageManifestSha256.Substring(0,32)-or$record.peContract.packageManifestLast-cne$ExpectedPackageManifestSha256.Substring(32,32)-or$record.peContract.bootstrapFirst-cne$ExpectedActivationBootstrapSha256.Substring(0,32)-or$record.peContract.bootstrapLast-cne$ExpectedActivationBootstrapSha256.Substring(32,32)-or$record.peContract.companyName-cne$ExpectedGitCommit-or$record.peContract.legalCopyright-cne$ExpectedPackageSha256){Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Sealed Setup provenance is not exactly bound' $path}
+    return $record
+}
+
+Export-ModuleMember -Function Get-CcodSetupArtifactHash,Get-CcodSetupDescription,New-CcodSetupBuildProvenance,Test-CcodSetupBuildProvenance,New-CcodSealedSetupBuildProvenance,Test-CcodSealedSetupBuildProvenance,Test-CcodSetupArtifact
diff --git a/build/build.ps1 b/build/build.ps1
index cea0e03..b6f1359 100644
--- a/build/build.ps1
+++ b/build/build.ps1
@@ -130,6 +130,24 @@ function Assert-CcodBuildInnoPreprocessorLines {
         '#error InstallerPayloadDirectory must be supplied by the release builder',
         '#ifndef InstallerPayloadManifestSha256',
         '#error InstallerPayloadManifestSha256 must be supplied by the release builder',
+        '#ifndef ProjectVersion',
+        '#error ProjectVersion must be supplied by the release builder',
+        '#ifndef InstallerPackagePath',
+        '#error InstallerPackagePath must be supplied by the release builder',
+        '#ifndef InstallerPackageManifestPath',
+        '#error InstallerPackageManifestPath must be supplied by the release builder',
+        '#ifndef InstallerPackageSha256',
+        '#error InstallerPackageSha256 must be supplied by the release builder',
+        '#ifndef InstallerPackageManifestSha256',
+        '#error InstallerPackageManifestSha256 must be supplied by the release builder',
+        '#define InstallerPackageManifestSha256First Copy(InstallerPackageManifestSha256, 1, 32)',
+        '#define InstallerPackageManifestSha256Last Copy(InstallerPackageManifestSha256, 33, 32)',
+        '#ifndef ActivationBootstrapPath',
+        '#error ActivationBootstrapPath must be supplied by the release builder',
+        '#ifndef ActivationBootstrapSha256',
+        '#error ActivationBootstrapSha256 must be supplied by the release builder',
+        '#define ActivationBootstrapSha256First Copy(ActivationBootstrapSha256, 1, 32)',
+        '#define ActivationBootstrapSha256Last Copy(ActivationBootstrapSha256, 33, 32)',
         '#ifndef SetupGitCommit',
         '#error SetupGitCommit must be supplied by the release builder',
         '#ifndef SetupProvenancePath',
@@ -142,6 +160,16 @@ function Assert-CcodBuildInnoPreprocessorLines {
         '{#PortableArtifactDirectory}',
         '{#InstallerPayloadDirectory}',
         '{#InstallerPayloadManifestSha256}',
+        '{#InstallerPackagePath}',
+        '{#InstallerPackageManifestPath}',
+        '{#InstallerPackageSha256}',
+        '{#InstallerPackageManifestSha256}',
+        '{#InstallerPackageManifestSha256First}',
+        '{#InstallerPackageManifestSha256Last}',
+        '{#ActivationBootstrapPath}',
+        '{#ActivationBootstrapSha256}',
+        '{#ActivationBootstrapSha256First}',
+        '{#ActivationBootstrapSha256Last}',
         '{#SetupGitCommit}',
         '{#SetupProvenancePath}'
     )
@@ -409,6 +437,13 @@ try {
         }
     }
     $installerPayloadManifestSha256 = Get-CcodBuildFileSha256 -Path $installerPayloadManifestPath
+    $installerPackagePath = Join-Path $installerPayloadDirectory 'installer-package.zip'
+    $installerPackageManifestPath = Join-Path $installerPayloadDirectory 'installer-package.manifest.json'
+    Import-Module (Join-Path $PSScriptRoot 'InstallerPackage.psm1') -Force
+    $installerPackage = New-CcodInstallerPackage -PayloadRoot $installerPayloadDirectory -PayloadManifestPath $installerPayloadManifestPath -Version $Version -GitCommit $gitCommit -OutputPath $installerPackagePath -ManifestOutputPath $installerPackageManifestPath
+    Test-CcodInstallerPackage -PackagePath $installerPackagePath -ManifestPath $installerPackageManifestPath -ExpectedPackageSha256 $installerPackage.PackageSha256 -ExpectedManifestSha256 $installerPackage.ManifestSha256 -ExpectedVersion $Version -ExpectedGitCommit $gitCommit | Out-Null
+    $activationBootstrapPath = Assert-CcodBuildRegularFile -Path (Join-Path $repoRoot 'Activate-CcodRemoteFix.ps1') -Kind 'Activation bootstrap'
+    $activationBootstrapSha256 = Get-CcodBuildFileSha256 -Path $activationBootstrapPath
     $destinationInventoryGenerator = Join-Path $repoRoot 'tools\New-InstallerDestinationInventory.ps1'
     if (-not [IO.File]::Exists($destinationInventoryGenerator)) { throw "Installer destination inventory generator is missing: $destinationInventoryGenerator" }
     & $destinationInventoryGenerator -RepositoryRoot $repoRoot -PayloadRoot $installerPayloadDirectory -ProjectVersion $Version -InnoScriptPath (Join-Path $PSScriptRoot 'CodexControlOtherDevices.iss') -OutputPath $installerDestinationInventoryPath | Out-Null
@@ -483,22 +518,24 @@ $iscc = $isccCandidates | Where-Object { -not [string]::IsNullOrWhiteSpace($_) -
 if (-not $iscc) { throw 'Inno Setup 6 (ISCC.exe) was not found. Install it with: winget install --id JRSoftware.InnoSetup --exact' }
 $issPath = Join-Path $PSScriptRoot 'CodexControlOtherDevices.iss'
 Import-Module (Join-Path $PSScriptRoot 'SetupArtifact.psm1') -Force
-[IO.File]::Copy((Assert-CcodBuildRegularFile -Path $installerPayloadManifestPath -Kind 'Installer payload manifest'),$setupPayloadInput,$false)
+[IO.File]::Copy((Assert-CcodBuildRegularFile -Path $installerPackageManifestPath -Kind 'Installer package manifest'),$setupPayloadInput,$false)
 [IO.File]::Copy((Assert-CcodBuildRegularFile -Path $installerDestinationInventoryPath -Kind 'Installer destination inventory'),$setupInventoryInput,$false)
-$setupProvenanceRecord = New-CcodSetupBuildProvenance -Version $Version -GitCommit $gitCommit -BuildTimestampUtc $buildTimestampUtc -PayloadManifestPath $installerPayloadManifestPath -InnoTemplatePath $issPath -DestinationInventoryPath $installerDestinationInventoryPath -CompilerPath $iscc -OutputPath $setupProvenance
-Test-CcodSetupBuildProvenance -ProvenancePath $setupProvenance -ExpectedVersion $Version -ExpectedGitCommit $gitCommit -ExpectedPayloadManifestSha256 $installerPayloadManifestSha256 -ExpectedBuildTimestampUtc $buildTimestampUtc -InnoTemplatePath $issPath -DestinationInventoryPath $installerDestinationInventoryPath -CompilerPath $iscc -PayloadManifestPath $installerPayloadManifestPath | Out-Null
+$setupProvenanceRecord = New-CcodSealedSetupBuildProvenance -Version $Version -GitCommit $gitCommit -BuildTimestampUtc $buildTimestampUtc -PackagePath $installerPackagePath -PackageManifestPath $installerPackageManifestPath -ActivationBootstrapPath $activationBootstrapPath -InnoTemplatePath $issPath -DestinationInventoryPath $installerDestinationInventoryPath -CompilerPath $iscc -OutputPath $setupProvenance
+Test-CcodSealedSetupBuildProvenance -ProvenancePath $setupProvenance -ExpectedVersion $Version -ExpectedGitCommit $gitCommit -ExpectedPackageSha256 $installerPackage.PackageSha256 -ExpectedPackageManifestSha256 $installerPackage.ManifestSha256 -ExpectedActivationBootstrapSha256 $activationBootstrapSha256 -ExpectedBuildTimestampUtc $buildTimestampUtc -PackagePath $installerPackagePath -PackageManifestPath $installerPackageManifestPath -ActivationBootstrapPath $activationBootstrapPath -InnoTemplatePath $issPath -DestinationInventoryPath $installerDestinationInventoryPath -CompilerPath $iscc | Out-Null
 $isccArguments = @(
     "/DProjectVersion=$Version",
-    "/DTrayHostArtifactDirectory=$trayHostArtifact",
-    "/DPortableArtifactDirectory=$portableArtifact",
-    "/DInstallerPayloadDirectory=$installerPayloadDirectory",
-    "/DInstallerPayloadManifestSha256=$installerPayloadManifestSha256",
+    "/DInstallerPackagePath=$installerPackagePath",
+    "/DInstallerPackageManifestPath=$installerPackageManifestPath",
+    "/DInstallerPackageSha256=$($installerPackage.PackageSha256)",
+    "/DInstallerPackageManifestSha256=$($installerPackage.ManifestSha256)",
+    "/DActivationBootstrapPath=$activationBootstrapPath",
+    "/DActivationBootstrapSha256=$activationBootstrapSha256",
     "/DSetupGitCommit=$gitCommit",
     "/DSetupProvenancePath=$setupProvenance",
     "/O$dist\."
 )
 Invoke-CcodBuildInnoCompiler -TemplatePath $issPath -InventoryPath $installerDestinationInventoryPath -IsccPath $iscc -Arguments $isccArguments -SetupPath $setupExe
-$setupValidation = Test-CcodSetupArtifact -SetupPath $setupExe -ExpectedVersion $Version -ExpectedGitCommit $gitCommit -ExpectedPayloadManifestSha256 $installerPayloadManifestSha256
+$setupValidation = Test-CcodSetupArtifact -SetupPath $setupExe -ExpectedVersion $Version -ExpectedGitCommit $gitCommit -ExpectedPackageSha256 $installerPackage.PackageSha256 -ExpectedPackageManifestSha256 $installerPackage.ManifestSha256 -ExpectedActivationBootstrapSha256 $activationBootstrapSha256
 $setupHash = [string]$setupValidation.Sha256
 Write-CcodBuildUtf8 -Path $setupChecksum -Text ("{0} *{1}" -f $setupHash,[IO.Path]::GetFileName($setupExe))
 $setupRecord = [ordered]@{
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index 1fa38ac..ed948c6 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -649,6 +649,7 @@ $results += Invoke-CcodTest 'default installer validation uses the structural ru
     }
 }
 
+<# Superseded: Setup no longer parses mutable JSON progress or owns an app payload tree.
 # Production mutation caught: recognizing JSON members only when the colon has zero or one following space.
 $results += Invoke-CcodTest 'Inno activation progress parser accepts every legal JSON whitespace form' {
     $installerPath = Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss'
@@ -753,17 +754,27 @@ $results += Invoke-CcodTest 'Inno visibly starts and synchronously owns the boun
     Assert-CcodTrue ($activationWorker -cmatch '(?s)function Stop-CcodOwnedInstallProcess.*?WaitForExit\(5000\).*?while \(\$true\).*?\.Kill\(\).*?\.WaitForExit\(\).*?\.HasExited.*?return') 'an unproven bounded stop escalates to waiting until exact child exit instead of returning to Setup'
 }
 
+#>
+
+$results += Invoke-CcodTest 'sealed Setup delegates strict append-only receipt validation to the locked bootstrap' {
+    $installerScript = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw -Encoding UTF8
+    $activationWorker = Get-Content -LiteralPath (Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1') -Raw -Encoding UTF8
+    Assert-CcodTrue ($installerScript -cmatch '(?s)ExtractAndLockCcodInputs.*GetCcodBootstrapParameters.*ewWaitUntilTerminated, ActivationResultCode.*GetCcodBootstrapParameters\(ActivationId, True\).*ewWaitUntilTerminated, ValidationResultCode') 'Setup retains one locked bootstrap across activation and strict validation'
+    Assert-CcodTrue ($installerScript -cmatch '-PackagePath' -and $installerScript -cmatch '-ExpectedPackageSha256' -and $installerScript -cnotmatch 'post-install-activation\.json') 'Setup passes the compile-bound sealed package and owns no mutable receipt path'
+    Assert-CcodTrue ($activationWorker -cmatch 'state\\activation-receipts' -and $activationWorker -cmatch '\$ExpectedActivationId\.\$phase\.json' -and $activationWorker -cnotmatch "Join-Path \`$Root 'state\\post-install-activation\.json'") 'bootstrap validates only append-only activation receipts'
+}
+
 $results += Invoke-CcodTest 'activation owner kills and proves exit before a timed-out child can change the receipt' {
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-activation-owned-timeout-' + [guid]::NewGuid().ToString('N'))
     try {
-        [IO.Directory]::CreateDirectory((Join-Path $root 'state')) | Out-Null
+        [IO.Directory]::CreateDirectory((Join-Path $root 'state\activation-receipts')) | Out-Null
         $lateMarker = Join-Path $root 'late-write.txt'
         $installScript = Join-Path $root 'Install-CodexControlOtherDevices.ps1'
         $installSource = @"
 param([string]`$InstallRoot,[string]`$ActivationId,[switch]`$EnableCandidateCompatibleUpdates)
 Start-Sleep -Milliseconds 1200
 `$receipt=[ordered]@{schemaVersion=1;activationId=`$ActivationId;phase='Ready';runtimeId='late-runtime';previousRuntimeId=`$null;startedAtUtc='2030-02-03T04:05:06.0000000Z';updatedAtUtc='2030-02-03T04:05:07.0000000Z';ready=`$true;errorCode=`$null}
-[IO.File]::WriteAllText((Join-Path `$InstallRoot 'state\post-install-activation.json'),(`$receipt|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new(`$false))
+[IO.File]::WriteAllText((Join-Path `$InstallRoot "state\activation-receipts\`$ActivationId.Ready.json"),(`$receipt|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new(`$false))
 [IO.File]::WriteAllText('$lateMarker','late',[Text.UTF8Encoding]::new(`$false))
 exit 0
 "@
@@ -773,7 +784,7 @@ exit 0
         Assert-CcodEqual 1 $LASTEXITCODE 'missing first receipt makes the owned activation fail'
         Start-Sleep -Milliseconds 1400
         Assert-CcodTrue (-not (Test-Path -LiteralPath $lateMarker)) 'the exact install child cannot write after the activation owner returns'
-        Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $root 'state\post-install-activation.json'))) 'the killed child cannot later publish Ready'
+        Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $root "state\activation-receipts\$activationId.Ready.json"))) 'the killed child cannot later publish Ready'
         $log = Get-Content -LiteralPath (Join-Path $root 'logs\post-install-activation.log') -Raw -Encoding UTF8
         Assert-CcodTrue ($log -cmatch 'CCOD_ACTIVATION_FIRST_RECEIPT_TIMEOUT') 'the owner records the stable first-receipt timeout code'
         Assert-CcodTrue (($output -join "`n") -cmatch 'CCOD_ACTIVATION_FIRST_RECEIPT_TIMEOUT') 'the owner reports the bounded timeout without a safe terminal receipt'
@@ -785,16 +796,16 @@ exit 0
 $results += Invoke-CcodTest 'activation owner freezes a correlated progress receipt at the total deadline' {
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-activation-owned-total-timeout-' + [guid]::NewGuid().ToString('N'))
     try {
-        [IO.Directory]::CreateDirectory((Join-Path $root 'state')) | Out-Null
+        [IO.Directory]::CreateDirectory((Join-Path $root 'state\activation-receipts')) | Out-Null
         $lateMarker = Join-Path $root 'late-total-write.txt'
         $installScript = Join-Path $root 'Install-CodexControlOtherDevices.ps1'
         $installSource = @"
 param([string]`$InstallRoot,[string]`$ActivationId,[switch]`$EnableCandidateCompatibleUpdates)
 `$receipt=[ordered]@{schemaVersion=1;activationId=`$ActivationId;phase='StartingProtection';runtimeId='pending-runtime';previousRuntimeId=`$null;startedAtUtc='2030-02-03T04:05:06.0000000Z';updatedAtUtc='2030-02-03T04:05:07.0000000Z';ready=`$false;errorCode=`$null}
-[IO.File]::WriteAllText((Join-Path `$InstallRoot 'state\post-install-activation.json'),(`$receipt|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new(`$false))
+[IO.File]::WriteAllText((Join-Path `$InstallRoot "state\activation-receipts\`$ActivationId.StartingProtection.json"),(`$receipt|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new(`$false))
 Start-Sleep -Milliseconds 3000
 `$receipt.phase='Ready';`$receipt.ready=`$true;`$receipt.updatedAtUtc='2030-02-03T04:05:08.0000000Z'
-[IO.File]::WriteAllText((Join-Path `$InstallRoot 'state\post-install-activation.json'),(`$receipt|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new(`$false))
+[IO.File]::WriteAllText((Join-Path `$InstallRoot "state\activation-receipts\`$ActivationId.Ready.json"),(`$receipt|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new(`$false))
 [IO.File]::WriteAllText('$lateMarker','late',[Text.UTF8Encoding]::new(`$false))
 exit 0
 "@
@@ -804,7 +815,7 @@ exit 0
         Assert-CcodEqual 1 $LASTEXITCODE 'total deadline makes the owned activation fail after correlated progress'
         Start-Sleep -Milliseconds 3200
         Assert-CcodTrue (-not (Test-Path -LiteralPath $lateMarker)) 'the exact install child cannot write after the total deadline owner return'
-        $receipt = Get-Content -LiteralPath (Join-Path $root 'state\post-install-activation.json') -Raw -Encoding UTF8 | ConvertFrom-Json
+        $receipt = Get-Content -LiteralPath (Join-Path $root "state\activation-receipts\$activationId.StartingProtection.json") -Raw -Encoding UTF8 | ConvertFrom-Json
         Assert-CcodEqual 'StartingProtection' $receipt.phase 'the killed child cannot change progress into Ready after Setup regains control'
         $log = Get-Content -LiteralPath (Join-Path $root 'logs\post-install-activation.log') -Raw -Encoding UTF8
         Assert-CcodTrue ($log -cmatch 'CCOD_ACTIVATION_TIMEOUT') 'the owner records the stable total timeout code'
@@ -818,14 +829,14 @@ exit 0
 $results += Invoke-CcodTest 'activation worker reports the strict Failed receipt support code without prompting' {
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-activation-failed-report-' + [guid]::NewGuid().ToString('N'))
     try {
-        [IO.Directory]::CreateDirectory((Join-Path $root 'state')) | Out-Null
+        [IO.Directory]::CreateDirectory((Join-Path $root 'state\activation-receipts')) | Out-Null
         $promptMarker = Join-Path $root 'prompt-marker.txt'
         $installScript = Join-Path $root 'Install-CodexControlOtherDevices.ps1'
         $promptScript = Join-Path $root 'Prompt-CcodRestart.ps1'
         $installSource = @"
 param([string]`$InstallRoot,[string]`$ActivationId,[switch]`$EnableCandidateCompatibleUpdates)
 `$receipt=[ordered]@{schemaVersion=1;activationId=`$ActivationId;phase='Failed';runtimeId='runtime-new';previousRuntimeId='runtime-old';startedAtUtc='2030-02-03T04:05:06.0000000Z';updatedAtUtc='2030-02-03T04:05:07.0000000Z';ready=`$false;errorCode='CCOD_INSTALL_NEW_RUNTIME_NOT_READY'}
-[IO.File]::WriteAllText((Join-Path `$InstallRoot 'state\post-install-activation.json'),(`$receipt|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new(`$false))
+[IO.File]::WriteAllText((Join-Path `$InstallRoot "state\activation-receipts\`$ActivationId.Failed.json"),(`$receipt|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new(`$false))
 exit 1
 "@
         [IO.File]::WriteAllText($installScript,$installSource,[Text.UTF8Encoding]::new($false))
@@ -2466,10 +2477,7 @@ $results += Invoke-CcodTest 'portable release keeps the fail-closed bootstrap ha
     $inno = Get-Content -LiteralPath $innoPath -Raw
     $wrapper = Get-Content -LiteralPath $wrapperPath -Raw
     Assert-CcodTrue ($inno -notmatch '(?m)^\s*\[UninstallRun\]') 'Inno has no legacy pre-delete UninstallRun route'
-    Assert-CcodTrue ($inno -match 'function\s+InitializeUninstall\s*\(\)\s*:\s*Boolean') 'Inno has a pre-delete uninstall gate'
-    Assert-CcodTrue ($inno -match 'UninstallBootstrap\.ps1' -and $inno -match '-Mode\s+Prepare') 'Inno invokes the staged bootstrap prepare phase'
-    Assert-CcodTrue ($inno -match 'CurUninstallStepChanged' -and $inno -match '-Mode\s+FinalizeReceipt') 'Inno writes completion only after its file deletion phase'
-    Assert-CcodTrue ($inno -match 'CCOD_UNINSTALL_FINALIZATION_MISSING' -and $inno -match 'CCOD_UNINSTALL_FINALIZATION_FAILED') 'Inno propagates a missing or failed post-delete completion receipt instead of reporting a false successful uninstall'
+    Assert-CcodTrue ($inno -match '(?m)^Uninstallable=no\s*$' -and $inno -notmatch 'InitializeUninstall|CurUninstallStepChanged|UninstallBootstrap\.ps1') 'sealed Setup creates no pre-Ready Inno uninstall surface'
     Assert-CcodTrue ($inno -notmatch 'BackupDeviceKeyStore|RemoveDeviceKeyStore|KeepCurrentSpecialSession') 'Inno exposes no key or special-session uninstall options'
     Assert-CcodTrue (Test-Path -LiteralPath $finalizerPath -PathType Leaf) 'portable release includes an external finalizer'
     Assert-CcodTrue (Test-Path -LiteralPath $portableModulePath -PathType Leaf) 'portable release includes a marker-bound removal module'
@@ -2717,18 +2725,11 @@ $results += Invoke-CcodTest 'fallback rejects two verified supervisor children a
     }
 }
 
-$results += Invoke-CcodTest 'installer exposes a CodexRemote-fix desktop entry that only starts the stable tray bootstrap' {
+$results += Invoke-CcodTest 'sealed installer defers every desktop and Start menu entry until post-Ready registration' {
     $installerScript = Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss'
-    $entries = @(Get-Content -LiteralPath $installerScript | Where-Object { $_ -cmatch '^Name: "\{userdesktop\}\\' })
-    Assert-CcodEqual 1 $entries.Count 'installer defines exactly one desktop entry'
-    $entry = [string]$entries[0]
-    Assert-CcodTrue ($entry -cmatch 'Name: "\{userdesktop\}\\CodexRemote-fix"') 'desktop entry has the public product name'
-    Assert-CcodTrue ($entry -cmatch 'Filename: "\{sys\}\\WindowsPowerShell\\v1\.0\\powershell\.exe"') 'desktop entry uses the Windows PowerShell host'
-    Assert-CcodTrue ($entry -cmatch '-WindowStyle Hidden') 'desktop entry hides the bootstrap host window'
-    Assert-CcodTrue ($entry -cmatch '\{localappdata\}\\CodexControlOtherDevices\\bootstrap\.ps1') 'desktop entry targets the stable bootstrap'
-    Assert-CcodTrue ($entry -cmatch '-InstallRoot ""\{localappdata\}\\CodexControlOtherDevices""') 'desktop entry supplies the stable install root'
-    Assert-CcodTrue ($entry -cmatch 'IconFilename: "\{app\}\\assets\\CodexRemote-fix\.ico"') 'desktop entry uses the public product icon'
-    Assert-CcodTrue ($entry -cnotmatch 'Start-CodexControlOtherDevices\.ps1') 'desktop entry never invokes a direct repair session'
+    $content = Get-Content -LiteralPath $installerScript -Raw
+    Assert-CcodEqual 0 @(Get-Content -LiteralPath $installerScript | Where-Object { $_ -cmatch '^Name: "\{(userdesktop|group)\}\\' }).Count 'Task 3 defines no user-visible shortcut entry'
+    Assert-CcodTrue ($content -cnotmatch '(?m)^\[Icons\]\s*$|\{userdesktop\}|\{group\}') 'no shortcut destination is reachable before strict Ready'
 }
 
 $results += Invoke-CcodTest 'installer exposes CodexRemote-fix as the searchable primary bootstrap entry' {
@@ -2739,22 +2740,11 @@ $results += Invoke-CcodTest 'installer exposes CodexRemote-fix as the searchable
     Assert-CcodTrue ($lines -ccontains 'AppId={{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}') 'installer retains the v2.1.6 AppId for in-place upgrades'
     Assert-CcodTrue ($lines -ccontains 'AppName=CodexRemote-fix') 'installed app has the public CodexRemote-fix name'
     Assert-CcodTrue ($lines -ccontains 'AppVerName=CodexRemote-fix {#ProjectVersion}') 'installed app version has the public CodexRemote-fix name'
-    Assert-CcodTrue ($lines -ccontains 'DefaultGroupName=CodexRemote-fix') 'current-user Start menu group has the public CodexRemote-fix name'
     Assert-CcodTrue ($lines -ccontains 'SetupIconFile=..\assets\codexremote-fix\codexremote-fix.ico') 'setup uses the CodexRemote-fix icon'
-    Assert-CcodTrue ($lines -ccontains 'UninstallDisplayIcon={app}\assets\CodexRemote-fix.ico') 'Apps and Features uses the installed CodexRemote-fix icon'
     Assert-CcodTrue ($lines -ccontains 'OutputBaseFilename=CodexRemote-fix-{#ProjectVersion}-setup') 'build output uses the public release name'
-    Assert-CcodEqual 2 @($lines | Where-Object { $_ -match '^Name: "\{(group|userdesktop)\}\\CodexRemote-fix";.*bootstrap\.ps1"".*-EntryMode Explicit' }).Count 'Start menu and desktop shortcuts enter bootstrap Explicit mode'
-    Assert-CcodTrue ($content -cmatch 'Activate-CcodRemoteFix\.ps1') 'installer delegates upgrades to the durable activation worker instead of relying on uninstall metadata'
-
-    $primaryEntries = @($content -split "`r?`n" | Where-Object { $_ -cmatch '^Name: "\{(group|userdesktop)\}\\CodexRemote-fix";' })
-    Assert-CcodEqual 2 $primaryEntries.Count 'Start menu and desktop each expose one primary CodexRemote-fix entry'
-    foreach ($entry in $primaryEntries) {
-        Assert-CcodTrue ($entry -cmatch 'Filename: "\{sys\}\\WindowsPowerShell\\v1\.0\\powershell\.exe"') 'primary entry uses the PowerShell host'
-        Assert-CcodTrue ($entry -cmatch '\{localappdata\}\\CodexControlOtherDevices\\bootstrap\.ps1') 'primary entry invokes the verified stable bootstrap'
-        Assert-CcodTrue ($entry -cmatch '-InstallRoot ""\{localappdata\}\\CodexControlOtherDevices""') 'primary entry supplies the stable legacy install root'
-        Assert-CcodTrue ($entry -cmatch 'IconFilename: "\{app\}\\assets\\CodexRemote-fix\.ico"') 'primary entry uses the public product icon'
-        Assert-CcodTrue ($entry -cnotmatch 'README\.md') 'primary entry never opens documentation'
-    }
+    Assert-CcodTrue ($lines -ccontains 'CreateAppDir=no' -and $lines -ccontains 'Uninstallable=no') 'Task 3 Setup has no product registration surface before Ready'
+    Assert-CcodTrue ($content -cnotmatch '(?m)^\[(Icons|Registry|UninstallRun)\]\s*$|DefaultGroupName=|UninstallDisplayIcon=') 'shortcuts registry and uninstall registration remain deferred to Task 4'
+    Assert-CcodEqual 4 @($lines | Where-Object { $_ -cmatch '^Source: .*Flags: dontcopy$' }).Count 'Setup carries only four sealed temporary inputs'
 
     $buildScript = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\build.ps1') -Raw
     Assert-CcodTrue ($buildScript -cmatch 'CodexRemote-fix-\$Version-windows-x64\.zip') 'build script locates the public portable ZIP filename'
@@ -2777,19 +2767,15 @@ $results += Invoke-CcodTest 'installer accepts success only from the exited owne
     $installerScript = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw -Encoding UTF8
     $activationWorker = Get-Content -LiteralPath (Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1') -Raw -Encoding UTF8
     $activationScript = Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1'
-    $promptScript = Join-Path $repositoryRoot 'Prompt-CcodRestart.ps1'
     Assert-CcodTrue (Test-Path -LiteralPath $activationScript -PathType Leaf) 'post-install activation worker exists'
-    Assert-CcodTrue (Test-Path -LiteralPath $promptScript -PathType Leaf) 'post-install Codex restart prompt exists'
     Assert-CcodTrue ($installerScript -cmatch '(?m)^CloseApplications=no\r?$') 'installer never lets Restart Manager close Codex'
-    Assert-CcodTrue ($installerScript -cmatch 'Activate-CcodRemoteFix\.ps1') 'installer bundles the activation worker'
-    Assert-CcodTrue ($installerScript -cmatch '(?s)RefuseStaleActivationReceipt\(ReceiptPath\).*UpdateActivationStartingPresentation\(\).*Activate-CcodRemoteFix\.ps1.*ewWaitUntilTerminated, ActivationResultCode') 'installer clears stale state, shows startup, and waits for the exact owner to exit'
-    Assert-CcodTrue ($installerScript -cmatch '(?s)if ActivationResultCode <> 0 then.*RaiseException.*?-ValidateReceiptWithTimeout.*ewWaitUntilTerminated, ValidationResultCode') 'only a normal owner exit reaches the separate bounded validator'
-    $readyBranch=[regex]::Match($installerScript,'(?s)if ValidationResultCode = 0 then\s*begin(.*?)\s*end;')
-    Assert-CcodTrue ($readyBranch.Success -and $readyBranch.Groups[1].Value-cmatch'ProgressGauge\.Position\s*:=\s*100' -and $readyBranch.Groups[1].Value-cmatch'Prompt-CcodRestart\.ps1') 'only strict validator exit zero reaches completion and prompting'
-    Assert-CcodTrue ($installerScript -cmatch 'if ValidationResultCode <> 0 then' -and $installerScript -cmatch 'RaiseException') 'every nonzero validator result fails closed'
+    Assert-CcodTrue ($installerScript -cmatch 'ActivationBootstrapPath' -and $installerScript -cmatch 'Flags: dontcopy') 'installer embeds the activation worker only as a temporary sealed input'
+    Assert-CcodTrue ($installerScript -cmatch '(?s)ExtractAndLockCcodInputs\(\).*GetCcodBootstrapParameters\(ActivationId, False\).*ewWaitUntilTerminated, ActivationResultCode') 'installer locks inputs before waiting for the exact owner to exit'
+    Assert-CcodTrue ($installerScript -cmatch '(?s)ActivationResultCode <> 0.*RaiseException.*GetCcodBootstrapParameters\(ActivationId, True\).*ewWaitUntilTerminated, ValidationResultCode') 'only a normal owner exit reaches the strict one-shot validator'
+    Assert-CcodTrue ($installerScript -cmatch 'ProgressGauge\.Position := 100' -and $installerScript -cnotmatch 'Prompt-CcodRestart\.ps1') 'strict validation alone reaches completion while Task 4 registration and prompting stay absent'
+    Assert-CcodTrue ($installerScript -cmatch '\(ValidationResultCode <> 0\) then RaiseException\(.CCOD_SETUP_READY_VALIDATION_FAILED.' ) 'every nonzero validator result fails closed'
     Assert-CcodTrue ($installerScript -cnotmatch '(?s)Activate-CcodRemoteFix\.ps1[^;]*-Prompt') 'background activation worker never owns the prompt'
     Assert-CcodTrue ($activationWorker -cmatch '(?s)if \(\$ValidateReceiptOnly\).*Read-CcodTerminalActivationReceipt.*phase -ceq .Ready.*exit 0.*phase -ceq .Failed.*exit 2' -and $activationWorker -cnotmatch 'ValidationResultPath|ValidationId|Start-Sleep') 'inner validator is a one-shot strict receipt reader with only direct terminal exit codes'
-    Assert-CcodTrue ($activationWorker -cmatch '(?s)function Invoke-CcodBoundedReceiptValidator.*WaitForExit\(\$TimeoutMilliseconds\).*\.Kill\(\).*return 3' -and $activationWorker -cmatch '(?s)if \(\$ValidateReceiptWithTimeout\).*Invoke-CcodBoundedReceiptValidator.*exit \$validationResult') 'outer validator owns a finite child wait and reduces timeout to a fail-closed direct exit'
     Assert-CcodTrue ($installerScript -cnotmatch 'ValidationResultPath|ReadValidationResultState|post-install-activation\.validation') 'Inno never accepts a file sidecar as validator authority'
     Assert-CcodTrue ($installerScript -cnotmatch 'Prepare-CcodRemoteUpgrade\.ps1') 'installer does not pre-stop the supervisor outside the gated runtime activation transaction'
     Assert-CcodTrue ($installerScript -cnotmatch '(?ms)^\[Run\]\s*\r?\nFilename: "powershell\.exe"; Parameters: ".*Install-CodexControlOtherDevices\.ps1') 'installer does not silently ignore its runtime installer exit code through a Run entry'
@@ -2799,15 +2785,14 @@ $results += Invoke-CcodTest 'installer accepts success only from the exited owne
 $results += Invoke-CcodTest 'installer waits for its process owner and accepts terminal status only from its strict validator child' {
     $installerScript = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw -Encoding UTF8
     Assert-CcodTrue ($installerScript -cmatch 'CoCreateGuid@ole32\.dll' -and $installerScript -cmatch 'StringFromGUID2@ole32\.dll') 'installer generates a canonical activation GUID before worker launch'
-    Assert-CcodTrue ($installerScript -cmatch '(?s)ActivationId\s*:=\s*NewActivationId\(\).*ReceiptPath\s*:=.*RefuseStaleActivationReceipt\(ReceiptPath\).*Activate-CcodRemoteFix\.ps1.*-ActivationId\s+"' ) 'installer removes or refuses the stale receipt and passes its own activation id to the worker'
-    Assert-CcodTrue ($installerScript -cmatch 'ewWaitUntilTerminated, ActivationResultCode' -and $installerScript -cmatch 'ewWaitUntilTerminated, ValidationResultCode' -and $installerScript -cmatch '-ValidateReceiptWithTimeout' -and $installerScript -cmatch 'VALIDATION_TIMEOUT_MILLISECONDS') 'Inno waits for both the activation owner and bounded validator exit codes'
+    Assert-CcodTrue ($installerScript -cmatch '(?s)ActivationId\s*:=\s*NewActivationId\(\).*GetCcodBootstrapParameters\(ActivationId, False\).*GetCcodBootstrapParameters\(ActivationId, True\)' ) 'installer passes one fresh activation id to owner and validator without deleting append-only receipts'
+    Assert-CcodTrue ($installerScript -cmatch 'ewWaitUntilTerminated, ActivationResultCode' -and $installerScript -cmatch 'ewWaitUntilTerminated, ValidationResultCode' -and $installerScript -cmatch '-ValidateReceiptOnly') 'Inno waits for both owner and strict validator exit codes'
     Assert-CcodTrue ($installerScript -cnotmatch 'ewNoWait') 'Inno never releases an unowned activation worker'
     foreach($forbidden in @('OpenProcess@kernel32.dll','WaitForSingleObject@kernel32.dll','GetExitCodeProcess@kernel32.dll','PROCESS_QUERY_INFORMATION','ProcessHandle := OpenProcess')){Assert-CcodTrue ($installerScript -cnotmatch [regex]::Escape($forbidden)) "installer never uses $forbidden to infer worker identity"}
-    Assert-CcodTrue ($installerScript -cmatch '(?s)if ActivationResultCode <> 0 then.*RaiseException.*?-ValidateReceiptWithTimeout.*ewWaitUntilTerminated, ValidationResultCode.*if ValidationResultCode <> 0 then.*RaiseException') 'owner failure cannot reach validation and every nonzero validator result fails closed'
-    Assert-CcodTrue ($installerScript -cmatch '(?s)function IsSafeActivationFile.*ExtractFileDir.*DirectoryAttributes.*RootAttributes.*FILE_ATTRIBUTE_REPARSE_POINT') 'Inno rejects reparse-point state ancestors even for raw presentation reads'
+    Assert-CcodTrue ($installerScript -cmatch '(?s)ActivationResultCode <> 0.*RaiseException.*GetCcodBootstrapParameters\(ActivationId, True\).*ValidationResultCode <> 0.*RaiseException') 'owner failure cannot reach validation and every nonzero validator result fails closed'
+    Assert-CcodTrue ($installerScript -cnotmatch 'ReadActivationProgressPhase|LoadBoundedActivationReceipt') 'Inno delegates all receipt authority to the locked bootstrap'
     Assert-CcodTrue ($installerScript -cnotmatch 'ValidationResultPath|ReadValidationResultState|post-install-activation\.validation') 'no writable sidecar can impersonate the strict validator'
-    $readyBranch=[regex]::Match($installerScript,'(?s)if ValidationResultCode = 0 then\s*begin(.*?)\s+end;')
-    Assert-CcodTrue ($readyBranch.Groups[1].Value-cmatch'Prompt-CcodRestart\.ps1') 'only strict Ready exit zero reaches the restart prompt'
+    Assert-CcodTrue ($installerScript -cnotmatch 'Prompt-CcodRestart\.ps1') 'Task 3 does not create a post-Ready product prompt or registration path'
 }
 
 # Production mutation caught: compiling a script with an unrecognized built-in identifier, or leaving the bounded validator route uncompiled.
@@ -2847,8 +2832,8 @@ $results += Invoke-CcodTest 'activation terminal validator enforces the complete
     $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-activation-validator-'+[guid]::NewGuid().ToString('N'))
     $reparseTarget=Join-Path ([IO.Path]::GetTempPath()) ('ccod-activation-validator-target-'+[guid]::NewGuid().ToString('N'))
     try{
-        [IO.Directory]::CreateDirectory((Join-Path $root 'state'))|Out-Null
-        $activationId='77777777-6666-5555-4444-333333333333';$receiptPath=Join-Path $root 'state\post-install-activation.json'
+        $receiptDirectory=Join-Path $root 'state\activation-receipts';[IO.Directory]::CreateDirectory($receiptDirectory)|Out-Null
+        $activationId='77777777-6666-5555-4444-333333333333'
         $activationScript=Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1';$powershellExecutable=Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
         $invokeValidator={param([string]$ErrorPath)
             $outputPath="$ErrorPath.stdout"
@@ -2872,6 +2857,8 @@ $results += Invoke-CcodTest 'activation terminal validator enforces the complete
         )
         foreach($case in $cases){
             $receipt=[ordered]@{};foreach($key in $valid.Keys){$receipt[$key]=$valid[$key]};&$case.Mutate $receipt
+            Get-ChildItem -LiteralPath $receiptDirectory -File -Force -ErrorAction SilentlyContinue|Remove-Item -Force
+            $receiptPath=Join-Path $receiptDirectory ("$activationId.$($receipt.phase).json")
             [IO.File]::WriteAllText($receiptPath,($receipt|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
             $stderrPath=Join-Path $root (('validator-{0}.err' -f ($case.Name-replace'[^A-Za-z0-9]','-')))
             $invocation=&$invokeValidator $stderrPath
@@ -2879,6 +2866,7 @@ $results += Invoke-CcodTest 'activation terminal validator enforces the complete
             Assert-CcodEqual 0 $invocation.Stdout.Count "$($case.Name) emits no receipt data to stdout"
             if($case.Exit-ne0-and$case.Exit-ne2){Assert-CcodTrue ((Get-Content -LiteralPath $stderrPath -Raw)-cmatch'CCOD_ACTIVATION_RECEIPT_') "$($case.Name) retains a bounded support code on stderr"}
         }
+        $receiptPath=Join-Path $receiptDirectory "$activationId.Ready.json"
         [IO.File]::WriteAllText($receiptPath,'{"schemaVersion":1,"activationId":"77777777-6666-5555-4444-333333333333","phase":"Ready","runtimeId":"runtime-new"',[Text.UTF8Encoding]::new($false))
         $stderrPath=Join-Path $root 'validator-truncated.err';$invocation=&$invokeValidator $stderrPath
         Assert-CcodEqual 3 $invocation.ExitCode 'truncated Ready JSON is rejected by the executable validator'
@@ -2888,8 +2876,8 @@ $results += Invoke-CcodTest 'activation terminal validator enforces the complete
         Assert-CcodEqual 3 $invocation.ExitCode 'oversized receipt is refused before JSON parsing'
         Assert-CcodEqual 0 $invocation.Stdout.Count 'oversized receipt emits no data to stdout'
         Remove-Item -LiteralPath (Join-Path $root 'state') -Recurse -Force
-        [IO.Directory]::CreateDirectory($reparseTarget)|Out-Null
-        [IO.File]::WriteAllText((Join-Path $reparseTarget 'post-install-activation.json'),($valid|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
+        [IO.Directory]::CreateDirectory((Join-Path $reparseTarget 'activation-receipts'))|Out-Null
+        [IO.File]::WriteAllText((Join-Path $reparseTarget "activation-receipts\$activationId.Ready.json"),($valid|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
         New-Item -ItemType Junction -Path (Join-Path $root 'state') -Target $reparseTarget|Out-Null
         $stderrPath=Join-Path $root 'validator-reparse.err';$invocation=&$invokeValidator $stderrPath
         Assert-CcodEqual 3 $invocation.ExitCode 'receipt beneath a reparse-point parent is refused before parsing'
@@ -2907,25 +2895,28 @@ $results += Invoke-CcodTest 'activation terminal validator enforces the complete
 $results += Invoke-CcodTest 'activation validator watchdog preserves direct terminal exits and bounds a slow child' {
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-activation-watchdog-' + [guid]::NewGuid().ToString('N'))
     try {
-        [IO.Directory]::CreateDirectory((Join-Path $root 'state')) | Out-Null
+        [IO.Directory]::CreateDirectory((Join-Path $root 'state\activation-receipts')) | Out-Null
         $activationId = '88888888-7777-6666-5555-444444444444'
-        $receiptPath = Join-Path $root 'state\post-install-activation.json'
+        $readyPath = Join-Path $root "state\activation-receipts\$activationId.Ready.json"
+        $failedPath = Join-Path $root "state\activation-receipts\$activationId.Failed.json"
         $stderrPath = Join-Path $root 'watchdog.err'
         $activationScript = Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1'
         $ready = [ordered]@{schemaVersion=1;activationId=$activationId;phase='Ready';runtimeId='runtime-watchdog';previousRuntimeId=$null;startedAtUtc='2030-02-03T04:05:06.0000000Z';updatedAtUtc='2030-02-03T04:05:07.0000000Z';ready=$true;errorCode=$null}
-        [IO.File]::WriteAllText($receiptPath,($ready | ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($readyPath,($ready | ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
 
         $stdout = @(& $activationScript -AppRoot $repositoryRoot -InstallRoot $root -ActivationId $activationId -ValidateReceiptWithTimeout -ValidationTimeoutMilliseconds 10000 2>$stderrPath)
         Assert-CcodEqual 0 $LASTEXITCODE 'watchdog returns the strict Ready child exit directly'
         Assert-CcodEqual 0 $stdout.Count 'watchdog Ready path emits no receipt data to stdout'
 
         $failed = [ordered]@{}; foreach ($key in $ready.Keys) { $failed[$key] = $ready[$key] }; $failed.phase = 'Failed'; $failed.ready = $false; $failed.errorCode = 'CCOD_INSTALL_FAILED'
-        [IO.File]::WriteAllText($receiptPath,($failed | ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
+        Remove-Item -LiteralPath $readyPath -Force
+        [IO.File]::WriteAllText($failedPath,($failed | ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
         $stdout = @(& $activationScript -AppRoot $repositoryRoot -InstallRoot $root -ActivationId $activationId -ValidateReceiptWithTimeout -ValidationTimeoutMilliseconds 10000 2>$stderrPath)
         Assert-CcodEqual 2 $LASTEXITCODE 'watchdog returns the strict Failed child exit directly'
         Assert-CcodEqual 0 $stdout.Count 'watchdog Failed path emits no receipt data to stdout'
 
-        [IO.File]::WriteAllText($receiptPath,($ready | ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
+        Remove-Item -LiteralPath $failedPath -Force
+        [IO.File]::WriteAllText($readyPath,($ready | ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
         $stopwatch = [Diagnostics.Stopwatch]::StartNew()
         try {
             $stdout = @(& $activationScript -AppRoot $repositoryRoot -InstallRoot $root -ActivationId $activationId -ValidateReceiptWithTimeout -ValidationTimeoutMilliseconds 1 2>$stderrPath)
@@ -2966,11 +2957,11 @@ $results += Invoke-CcodTest 'post-install restart prompt does nothing when the u
 $results += Invoke-CcodTest 'activation worker installs first and prompts only after a successful runtime activation' {
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-activation-worker-' + [guid]::NewGuid().ToString('N'))
     try {
-        [IO.Directory]::CreateDirectory((Join-Path $root 'state')) | Out-Null
+        [IO.Directory]::CreateDirectory((Join-Path $root 'state\activation-receipts')) | Out-Null
         $marker = Join-Path $root 'marker.txt'
         $installScript = Join-Path $root 'Install-CodexControlOtherDevices.ps1'
         $promptScript = Join-Path $root 'Prompt-CcodRestart.ps1'
-        $installSource = "param([string]`$InstallRoot,[string]`$ActivationId,[switch]`$EnableCandidateCompatibleUpdates);[IO.File]::AppendAllText('$marker','install,',[Text.UTF8Encoding]::new(`$false));`$r=[ordered]@{schemaVersion=1;activationId=`$ActivationId;phase='Ready';runtimeId='runtime-new';previousRuntimeId=`$null;startedAtUtc='2030-02-03T04:05:06.0000000Z';updatedAtUtc='2030-02-03T04:05:07.0000000Z';ready=`$true;errorCode=`$null};[IO.File]::WriteAllText((Join-Path `$InstallRoot 'state\post-install-activation.json'),(`$r|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new(`$false));exit 0"
+        $installSource = "param([string]`$InstallRoot,[string]`$ActivationId,[switch]`$EnableCandidateCompatibleUpdates);[IO.File]::AppendAllText('$marker','install,',[Text.UTF8Encoding]::new(`$false));`$r=[ordered]@{schemaVersion=1;activationId=`$ActivationId;phase='Ready';runtimeId='runtime-new';previousRuntimeId=`$null;startedAtUtc='2030-02-03T04:05:06.0000000Z';updatedAtUtc='2030-02-03T04:05:07.0000000Z';ready=`$true;errorCode=`$null};[IO.File]::WriteAllText((Join-Path `$InstallRoot `"state\activation-receipts\`$ActivationId.Ready.json`"),(`$r|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new(`$false));exit 0"
         [IO.File]::WriteAllText($installScript, $installSource, [Text.UTF8Encoding]::new($false))
         [IO.File]::WriteAllText($promptScript, "param([string]`$AppRoot,[string]`$InstallRoot,[string]`$ActivationId,[switch]`$NoUi);[IO.File]::AppendAllText('$marker','prompt',[Text.UTF8Encoding]::new(`$false)); exit 0", [Text.UTF8Encoding]::new($false))
         $output = @(& (Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1') -AppRoot $root -InstallRoot $root -Prompt 2>&1)
@@ -2985,11 +2976,11 @@ $results += Invoke-CcodTest 'activation worker installs first and prompts only a
 $results += Invoke-CcodTest 'activation worker preserves an activated runtime when optional restart confirmation fails' {
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-activation-restart-warning-' + [guid]::NewGuid().ToString('N'))
     try {
-        [IO.Directory]::CreateDirectory((Join-Path $root 'state')) | Out-Null
+        [IO.Directory]::CreateDirectory((Join-Path $root 'state\activation-receipts')) | Out-Null
         $marker = Join-Path $root 'marker.txt'
         $installScript = Join-Path $root 'Install-CodexControlOtherDevices.ps1'
         $promptScript = Join-Path $root 'Prompt-CcodRestart.ps1'
-        $installSource = "param([string]`$InstallRoot,[string]`$ActivationId,[switch]`$EnableCandidateCompatibleUpdates);[IO.File]::AppendAllText('$marker','install,',[Text.UTF8Encoding]::new(`$false));`$r=[ordered]@{schemaVersion=1;activationId=`$ActivationId;phase='Ready';runtimeId='runtime-new';previousRuntimeId=`$null;startedAtUtc='2030-02-03T04:05:06.0000000Z';updatedAtUtc='2030-02-03T04:05:07.0000000Z';ready=`$true;errorCode=`$null};[IO.File]::WriteAllText((Join-Path `$InstallRoot 'state\post-install-activation.json'),(`$r|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new(`$false));exit 0"
+        $installSource = "param([string]`$InstallRoot,[string]`$ActivationId,[switch]`$EnableCandidateCompatibleUpdates);[IO.File]::AppendAllText('$marker','install,',[Text.UTF8Encoding]::new(`$false));`$r=[ordered]@{schemaVersion=1;activationId=`$ActivationId;phase='Ready';runtimeId='runtime-new';previousRuntimeId=`$null;startedAtUtc='2030-02-03T04:05:06.0000000Z';updatedAtUtc='2030-02-03T04:05:07.0000000Z';ready=`$true;errorCode=`$null};[IO.File]::WriteAllText((Join-Path `$InstallRoot `"state\activation-receipts\`$ActivationId.Ready.json`"),(`$r|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new(`$false));exit 0"
         [IO.File]::WriteAllText($installScript, $installSource, [Text.UTF8Encoding]::new($false))
         [IO.File]::WriteAllText($promptScript, "param([string]`$AppRoot,[string]`$InstallRoot,[string]`$ActivationId,[switch]`$NoUi);[IO.File]::AppendAllText('$marker','prompt',[Text.UTF8Encoding]::new(`$false)); exit 1", [Text.UTF8Encoding]::new($false))
         $output = @(& (Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1') -AppRoot $root -InstallRoot $root -Prompt -NoUi 2>&1)
@@ -3008,14 +2999,14 @@ $results += Invoke-CcodTest 'activation worker preserves an activated runtime wh
 $results += Invoke-CcodTest 'activation worker requires a strict Ready receipt before prompting' {
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-activation-nonterminal-' + [guid]::NewGuid().ToString('N'))
     try {
-        [IO.Directory]::CreateDirectory((Join-Path $root 'state')) | Out-Null
+        [IO.Directory]::CreateDirectory((Join-Path $root 'state\activation-receipts')) | Out-Null
         $marker = Join-Path $root 'prompt-marker.txt'
         $installScript = Join-Path $root 'Install-CodexControlOtherDevices.ps1'
         $promptScript = Join-Path $root 'Prompt-CcodRestart.ps1'
         $installSource = @"
 param([string]`$InstallRoot,[string]`$ActivationId,[switch]`$EnableCandidateCompatibleUpdates)
 `$receipt=[ordered]@{schemaVersion=1;activationId=`$ActivationId;phase='StartingProtection';runtimeId='runtime-new';previousRuntimeId='runtime-old';startedAtUtc='2030-02-03T04:05:06.0000000Z';updatedAtUtc='2030-02-03T04:05:07.0000000Z';ready=`$false;errorCode=`$null}
-[IO.File]::WriteAllText((Join-Path `$InstallRoot 'state\post-install-activation.json'),(`$receipt|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new(`$false))
+[IO.File]::WriteAllText((Join-Path `$InstallRoot "state\activation-receipts\`$ActivationId.StartingProtection.json"),(`$receipt|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new(`$false))
 exit 0
 "@
         [IO.File]::WriteAllText($installScript,$installSource,[Text.UTF8Encoding]::new($false))
@@ -3098,21 +3089,11 @@ $results += Invoke-CcodTest 'CodexRemote-fix icon is a bounded multi-resolution
     }
 }
 
-$results += Invoke-CcodTest 'setup uninstall Start menu and desktop use one installed CodexRemote-fix icon' {
+$results += Invoke-CcodTest 'sealed Setup uses its wizard icon without installing product icons or shortcuts' {
     $installerScript = Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss'
     $lines = @(Get-Content -LiteralPath $installerScript)
-    $installedIcon = '{app}\assets\CodexRemote-fix.ico'
     Assert-CcodTrue ($lines -ccontains 'SetupIconFile=..\assets\codexremote-fix\codexremote-fix.ico') 'setup uses the source product icon'
-    Assert-CcodTrue ($lines -ccontains "UninstallDisplayIcon=$installedIcon") 'uninstall registration uses the installed product icon'
-    Assert-CcodTrue ($lines -ccontains 'Source: "..\assets\codexremote-fix\codexremote-fix.ico"; DestDir: "{app}\assets"; DestName: "CodexRemote-fix.ico"; Flags: ignoreversion') 'installer carries the source icon to the common installed icon path'
-    Assert-CcodTrue ($lines -ccontains 'Source: "..\assets\codexremote-fix\codexremote-fix.ico"; DestDir: "{app}\assets\codexremote-fix"; Flags: ignoreversion') 'installer preserves the hermetic source icon path for installed validation'
-    Assert-CcodTrue ($lines -ccontains 'Source: "..\.github\workflows\release.yml"; DestDir: "{app}\.github\workflows"; Flags: ignoreversion') 'installer carries the release workflow required by installed validation'
-
-    $shortcutEntries = @($lines | Where-Object { $_ -cmatch '^Name: "\{(group|userdesktop)\}\\' })
-    Assert-CcodTrue ($shortcutEntries.Count -ge 3) 'installer exposes Start menu and desktop shortcuts'
-    foreach ($entry in $shortcutEntries) {
-        Assert-CcodTrue ($entry -cmatch ('IconFilename: "' + [regex]::Escape($installedIcon) + '"')) 'every Start menu and desktop shortcut uses the common installed icon'
-    }
+    Assert-CcodTrue (($lines -join "`n") -cnotmatch 'UninstallDisplayIcon=|DestDir:\s*"\{app\}|^Name:\s*"\{(group|userdesktop)\}') 'Task 3 installs no product icon registration workflow or shortcut before Ready'
 }
 
 $results += Invoke-CcodTest 'README and release workflow publish current portable-release branding' {
@@ -3161,6 +3142,7 @@ $results += Invoke-CcodTest 'README and release workflow publish current portabl
     }
 }
 
+<# Superseded by Task 3 sealed package and Task 4 post-Ready registration.
 $results += Invoke-CcodTest 'installer carries the Inno contract needed by its self-validation' {
     $installerScript = Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss'
     $sourceEntries = @(Get-Content -LiteralPath $installerScript | Where-Object { $_ -cmatch '^Source: "\.\.\\build\\CodexControlOtherDevices\.iss"; DestDir: "\{app\}\\build";' })
@@ -3201,5 +3183,12 @@ $results += Invoke-CcodTest 'installer carries build.ps1 so installed self-valid
     $sourceEntries = @(Get-Content -LiteralPath $installerScript | Where-Object { $_ -cmatch '^Source: "\.\.\\build\\build\.ps1"; DestDir: "\{app\}\\build";' })
     Assert-CcodEqual 1 $sourceEntries.Count 'installer carries build.ps1 required by Validate.ps1'
 }
+#>
+
+$results += Invoke-CcodTest 'sealed Setup carries no mutable validation or legacy shortcut migration payload' {
+    $installerScript = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw -Encoding UTF8
+    Assert-CcodTrue ($installerScript -cnotmatch 'DestDir:\s*"\{app\}|\[InstallDelete\]|CodexControlOtherDevices\.iss"; DestDir|build\.ps1"; DestDir') 'Task 3 leaves installed validation and legacy registration migration to immutable payload and Task 4'
+    Assert-CcodTrue ($installerScript -cmatch '(?m)^CreateAppDir=no\s*$' -and $installerScript -cmatch '(?m)^Uninstallable=no\s*$') 'Setup cannot create the old mutable validation root'
+}
 
 Write-Output "Install lifecycle self-tests passed: $($results.Count)"
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 332fde2..426b334 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -295,7 +295,78 @@ Invoke-CcodTest 'production installer payload generator writes ordered version-b
     }
 }
 
-Invoke-CcodTest 'production setup template has one inventory marker, no external includes, and derives every nested directory' {
+# Production mutation caught: accepting a ZIP whose entry set or identity no longer matches the manifest bound by Setup.
+Invoke-CcodTest 'sealed installer package rejects entry and identity changes before product state exists' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-sealed-installer-package-' + [guid]::NewGuid().ToString('N'))
+    $module = $null
+    try {
+        $payload = Join-Path $root 'payload'
+        foreach ($directory in @('src\persistence\modules')) { [IO.Directory]::CreateDirectory((Join-Path $payload $directory)) | Out-Null }
+        [IO.File]::WriteAllText((Join-Path $payload 'package.json'),'{"version":"2.5.22"}',[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText((Join-Path $payload 'Install-CodexControlOtherDevices.ps1'),'param()',[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText((Join-Path $payload 'src\persistence\modules\InstallLifecycle.psm1'),'# lifecycle',[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText((Join-Path $payload 'src\persistence\modules\RuntimeManifest.psm1'),'# manifest',[Text.UTF8Encoding]::new($false))
+        $payloadManifest = Join-Path $root 'installer-payload.manifest.json'
+        & (Join-Path $repositoryRoot 'tools\New-InstallerPayloadManifest.ps1') -PayloadRoot $payload -ProjectVersion '2.5.22' -OutputPath $payloadManifest | Out-Null
+        $package = Join-Path $root 'installer-package.zip'
+        $manifest = Join-Path $root 'installer-package.manifest.json'
+        $module = Import-Module (Join-Path $repositoryRoot 'build\InstallerPackage.psm1') -Force -PassThru
+        $created = New-CcodInstallerPackage -PayloadRoot $payload -PayloadManifestPath $payloadManifest -Version '2.5.22' -GitCommit ('a' * 40) -OutputPath $package -ManifestOutputPath $manifest
+        $validated = Test-CcodInstallerPackage -PackagePath $package -ManifestPath $manifest -ExpectedPackageSha256 $created.PackageSha256 -ExpectedManifestSha256 $created.ManifestSha256 -ExpectedVersion '2.5.22' -ExpectedGitCommit ('a' * 40)
+        Assert-CcodEqual $true ([bool]$validated.Valid) 'canonical sealed installer package validates'
+
+        Assert-CcodThrows {
+            Test-CcodInstallerPackage -PackagePath $package -ManifestPath $manifest -ExpectedPackageSha256 ('0' * 64) -ExpectedManifestSha256 $created.ManifestSha256 -ExpectedVersion '2.5.22' -ExpectedGitCommit ('a' * 40) | Out-Null
+        } 'CCOD_INSTALLER_PACKAGE_HASH_MISMATCH'
+        Assert-CcodThrows {
+            Test-CcodInstallerPackage -PackagePath $package -ManifestPath $manifest -ExpectedPackageSha256 $created.PackageSha256 -ExpectedManifestSha256 ('0' * 64) -ExpectedVersion '2.5.22' -ExpectedGitCommit ('a' * 40) | Out-Null
+        } 'CCOD_INSTALLER_PACKAGE_MANIFEST_HASH_MISMATCH'
+        Assert-CcodThrows {
+            Test-CcodInstallerPackage -PackagePath $package -ManifestPath $manifest -ExpectedPackageSha256 $created.PackageSha256 -ExpectedManifestSha256 $created.ManifestSha256 -ExpectedVersion '9.9.9' -ExpectedGitCommit ('a' * 40) | Out-Null
+        } 'CCOD_INSTALLER_PACKAGE_INVALID'
+        Assert-CcodThrows {
+            Test-CcodInstallerPackage -PackagePath $package -ManifestPath $manifest -ExpectedPackageSha256 $created.PackageSha256 -ExpectedManifestSha256 $created.ManifestSha256 -ExpectedVersion '2.5.22' -ExpectedGitCommit ('b' * 40) | Out-Null
+        } 'CCOD_INSTALLER_PACKAGE_INVALID'
+
+        Add-Type -AssemblyName System.IO.Compression.FileSystem -ErrorAction Stop
+        foreach ($variant in @(
+            [pscustomobject]@{Name='missing';Mutate={param($archive)$archive.GetEntry('package.json').Delete()}},
+            [pscustomobject]@{Name='extra';Mutate={param($archive)$entry=$archive.CreateEntry('extra.txt');$writer=[IO.StreamWriter]::new($entry.Open());try{$writer.Write('extra')}finally{$writer.Dispose()}}},
+            [pscustomobject]@{Name='duplicate';Mutate={param($archive)$entry=$archive.CreateEntry('package.json');$writer=[IO.StreamWriter]::new($entry.Open());try{$writer.Write('{}')}finally{$writer.Dispose()}}},
+            [pscustomobject]@{Name='unsafe';Mutate={param($archive)$entry=$archive.CreateEntry('../escape.txt');$writer=[IO.StreamWriter]::new($entry.Open());try{$writer.Write('escape')}finally{$writer.Dispose()}}},
+            [pscustomobject]@{Name='changed';Mutate={param($archive)$archive.GetEntry('package.json').Delete();$entry=$archive.CreateEntry('package.json');$writer=[IO.StreamWriter]::new($entry.Open());try{$writer.Write('{"version":"9.9.9"}')}finally{$writer.Dispose()}}}
+        )) {
+            $variantPath = Join-Path $root ("$($variant.Name).zip")
+            [IO.File]::Copy($package,$variantPath,$false)
+            $archive = [IO.Compression.ZipFile]::Open($variantPath,[IO.Compression.ZipArchiveMode]::Update)
+            try { & $variant.Mutate $archive } finally { $archive.Dispose() }
+            $variantHash = Get-CcodTestFileSha256 -Path $variantPath
+            Assert-CcodThrows {
+                Test-CcodInstallerPackage -PackagePath $variantPath -ManifestPath $manifest -ExpectedPackageSha256 $variantHash -ExpectedManifestSha256 $created.ManifestSha256 -ExpectedVersion '2.5.22' -ExpectedGitCommit ('a' * 40) | Out-Null
+            } 'CCOD_INSTALLER_PACKAGE_INVALID'
+        }
+        Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $root 'product-state'))) 'all package failures precede product state creation'
+    } finally {
+        if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
+# Production mutation caught: restoring any legacy recursive {app} copy or executing a writable app bootstrap before Ready.
+Invoke-CcodTest 'Setup contains only sealed temporary inputs and no pre-Ready app product write' {
+    $source = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw -Encoding UTF8
+    Assert-CcodTrue ($source -cmatch '(?m)^CreateAppDir=no\s*$') 'Setup never creates app before Ready'
+    Assert-CcodTrue ($source -cmatch '(?m)^Uninstallable=no\s*$') 'Setup never creates an Inno uninstaller before Ready'
+    Assert-CcodTrue ($source -cmatch 'InstallerPackageSha256' -and $source -cmatch 'InstallerPackageManifestSha256' -and $source -cmatch 'ActivationBootstrapSha256') 'Setup binds package manifest and bootstrap hashes'
+    Assert-CcodTrue ($source -cnotmatch '(?im)^\s*Source:.*DestDir:\s*"\{app\}' -and $source -cnotmatch '(?im)^\[(Icons|Registry|UninstallRun)\]\s*$') 'Setup has no pre-Ready app Files Icons Registry or UninstallRun writes'
+    Assert-CcodTrue ($source -cnotmatch 'recursesubdirs|createallsubdirs|Source:\s*"[^"]*\\\*"') 'Setup never recursively extracts an arbitrary payload tree'
+    Assert-CcodTrue ($source -cnotmatch '-File\s+"\{app\}\\Activate-CcodRemoteFix\.ps1"') 'Setup never executes activation from writable app'
+    $fileLines = @([regex]::Matches($source,'(?im)^\s*Source:\s*"[^\r\n]+$') | ForEach-Object { $_.Value })
+    Assert-CcodEqual 4 $fileLines.Count 'Setup embeds exactly package manifest bootstrap and provenance inputs'
+    foreach ($line in $fileLines) { Assert-CcodTrue ($line -cmatch 'Flags:\s*dontcopy\s*$') 'every Setup input is private temporary dontcopy data' }
+}
+
+Invoke-CcodTest 'production setup template has one inventory marker no external includes and no product destination inventory' {
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-installer-directory-inventory-' + [guid]::NewGuid().ToString('N'))
     try {
         $payload = Join-Path $root 'payload'
@@ -310,9 +381,8 @@ Invoke-CcodTest 'production setup template has one inventory marker, no external
         Assert-CcodEqual 0 $externalIncludes.Count 'production template has no external include directive'
         & (Join-Path $repositoryRoot 'tools\New-InstallerDestinationInventory.ps1') -RepositoryRoot $repositoryRoot -PayloadRoot $payload -ProjectVersion '2.5.22' -InnoScriptPath $innoPath -OutputPath $output | Out-Null
         $inventory = [IO.File]::ReadAllText($output,[Text.UTF8Encoding]::new($false))
-        foreach ($relative in @('src','src\persistence','src\persistence\modules','payload','payload\2.5.22','payload\2.5.22\src','payload\2.5.22\src\persistence','payload\2.5.22\src\persistence\modules')) {
-            Assert-CcodTrue ($inventory.Contains("Directories.Add('$relative');")) "generated setup inventory contains $relative"
-        }
+        Assert-CcodTrue ($inventory -cmatch '(?s)^procedure AddCcodExpectedSetupDirectories\(Directories: TStrings\);\s*begin\s*end;\s*$') 'sealed Setup produces an explicit empty product destination inventory'
+        Assert-CcodTrue ($inventory -cnotmatch 'Directories\.Add') 'no payload directory can be created before Ready'
     } finally {
         if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
     }
@@ -1076,8 +1146,11 @@ param(
     [string]$ActivationId,
     [string]$ExpectedVersion,
     [string]$PayloadManifestPath,
-    [string]$ExpectedPayloadManifestSha256
+    [string]$ExpectedPayloadManifestSha256,
+    [string]$SealedPackageSha256
 )
+$null = [IO.Directory]::CreateDirectory($InstallRoot)
+[IO.File]::WriteAllText((Join-Path $InstallRoot 'sealed-package-sha256.txt'),[string]$SealedPackageSha256,[Text.UTF8Encoding]::new($false))
 $manifest = [IO.File]::ReadAllText($PayloadManifestPath,[Text.Encoding]::UTF8) | ConvertFrom-Json
 Import-Module (Join-Path $PSScriptRoot 'src\persistence\modules\InstallLifecycle.psm1') -Force
 Invoke-CcodFixtureInstall -InstallRoot $InstallRoot -ActivationId $ActivationId -ManifestVersion ([string]$manifest.projectVersion)
@@ -1087,11 +1160,11 @@ exit 0
     $lifecycleSource = @'
 function Invoke-CcodFixtureInstall {
     param([string]$InstallRoot,[string]$ActivationId,[string]$ManifestVersion)
-    [IO.Directory]::CreateDirectory((Join-Path $InstallRoot 'state')) | Out-Null
+    [IO.Directory]::CreateDirectory((Join-Path $InstallRoot 'state\activation-receipts')) | Out-Null
     [IO.File]::WriteAllText((Join-Path $InstallRoot 'activation-byte-marker.txt'),('original:' + $ManifestVersion),[Text.UTF8Encoding]::new($false))
     [IO.File]::WriteAllText((Join-Path $InstallRoot 'active.json'),'{"activeRuntime":"runtime-fixture"}',[Text.UTF8Encoding]::new($false))
     $receipt=[ordered]@{schemaVersion=1;activationId=$ActivationId;phase='Ready';runtimeId='runtime-fixture';previousRuntimeId=$null;startedAtUtc='2030-02-03T04:05:06.0000000Z';updatedAtUtc='2030-02-03T04:05:07.0000000Z';ready=$true;errorCode=$null}
-    [IO.File]::WriteAllText((Join-Path $InstallRoot 'state\post-install-activation.json'),($receipt|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
+    [IO.File]::WriteAllText((Join-Path $InstallRoot "state\activation-receipts\$ActivationId.Ready.json"),($receipt|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
 }
 Export-ModuleMember -Function Invoke-CcodFixtureInstall
 '@
@@ -1168,6 +1241,28 @@ function Invoke-CcodActivationVerifierFixture {
     return [pscustomobject]@{ExitCode=$exitCode;Output=([IO.File]::ReadAllText($stdoutPath)+[IO.File]::ReadAllText($stderrPath))}
 }
 
+# Production mutation caught: verifying package bytes but invoking a legacy source root without propagating package identity.
+Invoke-CcodTest 'temporary bootstrap verifies the sealed package and propagates its exact hash to the installer child' {
+    $fixture = New-CcodActivationPayloadFixture
+    $module = $null
+    try {
+        $packagePath = Join-Path $fixture.AppRoot 'sealed-installer.zip'
+        $packageManifestPath = Join-Path $fixture.AppRoot 'sealed-installer.manifest.json'
+        $module = Import-Module (Join-Path $repositoryRoot 'build\InstallerPackage.psm1') -Force -PassThru
+        $created = New-CcodInstallerPackage -PayloadRoot $fixture.PayloadRoot -PayloadManifestPath $fixture.ManifestPath -Version '2.5.22' -GitCommit ('d' * 40) -OutputPath $packagePath -ManifestOutputPath $packageManifestPath
+        $installRoot = Join-Path $fixture.AppRoot 'installed-state'
+        $activationId = '77777777-6666-5555-4444-333333333333'
+        $output = @(& (Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1') -InstallRoot $installRoot -PackagePath $packagePath -PackageManifestPath $packageManifestPath -ExpectedPackageSha256 $created.PackageSha256 -ExpectedPackageManifestSha256 $created.ManifestSha256 -ExpectedVersion '2.5.22' -ExpectedGitCommit ('d' * 40) -ActivationId $activationId 2>&1)
+        Assert-CcodEqual 0 $LASTEXITCODE "sealed package bootstrap completes: $($output -join ' ')"
+        Assert-CcodEqual $created.PackageSha256 ([IO.File]::ReadAllText((Join-Path $installRoot 'sealed-package-sha256.txt'),[Text.UTF8Encoding]::new($false))) 'child receives the exact verified package identity'
+        Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $installRoot "state\activation-receipts\$activationId.Ready.json") -PathType Leaf) 'bootstrap accepts only the append-only Ready receipt'
+        Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $installRoot 'state\post-install-activation.json'))) 'bootstrap never creates or consumes the mutable legacy receipt'
+    } finally {
+        if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        if (Test-Path -LiteralPath $fixture.AppRoot) { Remove-Item -LiteralPath $fixture.AppRoot -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
 function Invoke-CcodInnoPayloadCompileFixture {
     param([switch]$IncludePayloadDefines,[switch]$OmitDestinationInventory)
 
@@ -1201,11 +1296,17 @@ function Invoke-CcodInnoPayloadCompileFixture {
     if (-not $iscc) { throw 'Inno Setup 6 is required for the setup payload contract' }
     $payloadManifestSha256 = Get-CcodTestFileSha256 -Path $manifestPath
     $setupGitCommit = 'c' * 40
+    Import-Module (Join-Path $repositoryRoot 'build\InstallerPackage.psm1') -Force
+    $installerPackagePath = Join-Path $root 'installer-package.zip'
+    $installerPackageManifestPath = Join-Path $root 'installer-package.manifest.json'
+    $installerPackage = New-CcodInstallerPackage -PayloadRoot $payload -PayloadManifestPath $manifestPath -Version '2.5.21' -GitCommit $setupGitCommit -OutputPath $installerPackagePath -ManifestOutputPath $installerPackageManifestPath
+    $activationBootstrapPath = Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1'
+    $activationBootstrapSha256 = Get-CcodTestFileSha256 -Path $activationBootstrapPath
     $setupProvenancePath = Join-Path $root 'setup-provenance.json'
     [IO.File]::WriteAllText($setupProvenancePath,'{}',[Text.UTF8Encoding]::new($false))
-    $arguments = @('/DProjectVersion=2.5.21',"/DTrayHostArtifactDirectory=$tray","/DPortableArtifactDirectory=$portable","/DSetupGitCommit=$setupGitCommit","/DSetupProvenancePath=$setupProvenancePath","/O$output\")
+    $arguments = @('/DProjectVersion=2.5.21',"/DSetupGitCommit=$setupGitCommit","/DSetupProvenancePath=$setupProvenancePath","/O$output\")
     if ($IncludePayloadDefines) {
-        $arguments = @('/DProjectVersion=2.5.21',"/DTrayHostArtifactDirectory=$tray","/DPortableArtifactDirectory=$portable","/DInstallerPayloadDirectory=$payload","/DInstallerPayloadManifestSha256=$payloadManifestSha256","/DSetupGitCommit=$setupGitCommit","/DSetupProvenancePath=$setupProvenancePath")
+        $arguments = @('/DProjectVersion=2.5.21',"/DInstallerPackagePath=$installerPackagePath","/DInstallerPackageManifestPath=$installerPackageManifestPath","/DInstallerPackageSha256=$($installerPackage.PackageSha256)","/DInstallerPackageManifestSha256=$($installerPackage.ManifestSha256)","/DActivationBootstrapPath=$activationBootstrapPath","/DActivationBootstrapSha256=$activationBootstrapSha256","/DSetupGitCommit=$setupGitCommit","/DSetupProvenancePath=$setupProvenancePath")
         $arguments += "/O$output\"
     }
     . (Join-Path $repositoryRoot 'build\build.ps1') -Library
@@ -1237,6 +1338,9 @@ function Invoke-CcodInnoPayloadCompileFixture {
         GeneratedPath = $generatedPath
         GeneratedSource = $generatedSource
         PayloadManifestSha256 = $payloadManifestSha256
+        PackageSha256 = $installerPackage.PackageSha256
+        PackageManifestSha256 = $installerPackage.ManifestSha256
+        ActivationBootstrapSha256 = $activationBootstrapSha256
         SetupGitCommit = $setupGitCommit
     }
 }
@@ -1246,12 +1350,14 @@ Invoke-CcodTest 'setup build and activation bind one immutable versioned payload
     $inno = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw -Encoding UTF8
     $activation = Get-Content -LiteralPath (Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1') -Raw -Encoding UTF8
     $installer = Get-Content -LiteralPath (Join-Path $repositoryRoot 'Install-CodexControlOtherDevices.ps1') -Raw -Encoding UTF8
-
-    Assert-CcodTrue ($build -cmatch 'New-InstallerPayloadManifest\.ps1' -and $build -cmatch 'New-InstallerDestinationInventory\.ps1' -and $build -cmatch 'InstallerPayloadManifestSha256' -and $build -cmatch 'New-CcodBuildGeneratedInnoScript') 'build invokes the tested generators and binds the inventory into generated setup compilation'
-    Assert-CcodTrue ($inno -cmatch 'InstallerPayloadDirectory' -and $inno -cmatch 'DestDir:\s*"\{app\}\\payload\\\{#ProjectVersion\}"') 'Inno copies the immutable build payload into its exact version directory'
-    Assert-CcodTrue ($inno -cmatch "ExpandConstant\('\{app\}\\payload\\\{#ProjectVersion\}'\)" -and $inno -cmatch '-ExpectedVersion\s+"\{#ProjectVersion\}') 'Inno binds activation to its compiled payload version'
-    Assert-CcodTrue ($activation -cmatch '\[string\]\$ExpectedVersion' -and $activation -cmatch '\[string\]\$ExpectedPayloadManifestSha256' -and $activation -cmatch 'installer-payload\.manifest\.json') 'activation accepts and resolves the expected payload contract'
-    Assert-CcodTrue ($installer -cmatch '\[string\]\$ExpectedVersion' -and $installer -cmatch '\[string\]\$PayloadManifestPath' -and $installer -cmatch '\[string\]\$ExpectedPayloadManifestSha256' -and $installer -cmatch 'Open-CcodInstallerPayloadSeal' -and $installer -cmatch 'PayloadManifestBytesBase64') 'installer revalidates and forwards the exact immutable payload bytes to lifecycle activation'
+    $setupArtifact = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\SetupArtifact.psm1') -Raw -Encoding UTF8
+
+    Assert-CcodTrue ($build -cmatch 'New-InstallerPayloadManifest\.ps1' -and $build -cmatch 'InstallerPackage\.psm1' -and $build -cmatch 'New-CcodInstallerPackage' -and $build -cmatch 'New-CcodBuildGeneratedInnoScript') 'build creates the sealed package and binds it into generated setup compilation'
+    Assert-CcodTrue ($inno -cmatch 'InstallerPackagePath' -and $inno -cmatch 'ExtractTemporaryFile\(.ccod-installer-package\.zip.' -and $inno -cnotmatch 'DestDir:\s*"\{app\}') 'Inno extracts only the sealed package to private temporary storage'
+    Assert-CcodTrue ($inno -cmatch '-ExpectedPackageSha256\s+"\{#InstallerPackageSha256' -and $inno -cmatch '-ExpectedVersion\s+"\{#ProjectVersion') 'Inno binds activation to its compiled package identity and version'
+    Assert-CcodTrue ($activation -cmatch '\[string\]\$PackagePath' -and $activation -cmatch '\[string\]\$ExpectedPackageSha256' -and $activation -cmatch 'Open-CcodInstallerPackageSeal') 'activation accepts and opens the sealed package contract'
+    Assert-CcodTrue ($installer -cmatch '\[string\]\$SealedPackageSha256' -and $installer -cmatch '\$invoke\.SealedPackageSha256\s*=\s*\$SealedPackageSha256') 'installer explicitly forwards the exact sealed package identity to lifecycle activation'
+    Assert-CcodTrue ($setupArtifact -cmatch 'New-CcodSealedSetupBuildProvenance' -and $setupArtifact -cmatch 'Test-CcodSealedSetupBuildProvenance' -and $build -cmatch 'New-CcodSealedSetupBuildProvenance' -and $build -cmatch 'Test-CcodSealedSetupBuildProvenance') 'Setup provenance creates and verifies package manifest and bootstrap bindings'
 }
 
 # Production mutation caught: reopening mutable payload paths after the parent accepted their manifest bytes.
@@ -1305,11 +1411,11 @@ exit 0
         $replacementModule = @'
 function Invoke-CcodFixtureInstall {
     param([string]$InstallRoot,[string]$ActivationId,[string]$ManifestVersion)
-    [IO.Directory]::CreateDirectory((Join-Path $InstallRoot 'state')) | Out-Null
+    [IO.Directory]::CreateDirectory((Join-Path $InstallRoot 'state\activation-receipts')) | Out-Null
     [IO.File]::WriteAllText((Join-Path $InstallRoot 'activation-byte-marker.txt'),('replacement:' + $ManifestVersion),[Text.UTF8Encoding]::new($false))
     [IO.File]::WriteAllText((Join-Path $InstallRoot 'active.json'),'{"activeRuntime":"runtime-fixture"}',[Text.UTF8Encoding]::new($false))
     $receipt=[ordered]@{schemaVersion=1;activationId=$ActivationId;phase='Ready';runtimeId='runtime-fixture';previousRuntimeId=$null;startedAtUtc='2030-02-03T04:05:06.0000000Z';updatedAtUtc='2030-02-03T04:05:07.0000000Z';ready=$true;errorCode=$null}
-    [IO.File]::WriteAllText((Join-Path $InstallRoot 'state\post-install-activation.json'),($receipt|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
+    [IO.File]::WriteAllText((Join-Path $InstallRoot "state\activation-receipts\$ActivationId.Ready.json"),($receipt|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
 }
 Export-ModuleMember -Function Invoke-CcodFixtureInstall
 '@
@@ -1505,8 +1611,8 @@ Invoke-CcodTest 'activation rejects an unlisted nested payload junction' {
 Invoke-CcodTest 'Inno compile refuses an implicit installer payload source' {
     $compile = Invoke-CcodInnoPayloadCompileFixture
     try {
-        Assert-CcodTrue ($compile.ExitCode -ne 0) 'setup compilation fails without an explicit installer payload directory and manifest hash'
-        Assert-CcodTrue ($compile.Output -cmatch 'InstallerPayloadDirectory') 'compiler identifies the missing immutable payload define'
+        Assert-CcodTrue ($compile.ExitCode -ne 0) 'setup compilation fails without an explicit sealed installer package contract'
+        Assert-CcodTrue ($compile.Output -cmatch 'InstallerPackagePath') 'compiler identifies the missing sealed package define'
         Assert-CcodTrue (-not (Test-Path -LiteralPath $compile.SetupPath)) 'missing payload define produces no setup artifact'
     } finally {
         if (Test-Path -LiteralPath $compile.Root) { Remove-Item -LiteralPath $compile.Root -Recurse -Force }
@@ -1518,28 +1624,28 @@ Invoke-CcodTest 'Inno compile packages the explicit manifest-bound installer pay
     try {
         Assert-CcodEqual 0 $compile.ExitCode "explicit setup payload contract compiles: $($compile.Output)"
         Assert-CcodTrue (Test-Path -LiteralPath $compile.SetupPath -PathType Leaf) 'explicit payload compile produces the setup artifact'
-        Assert-CcodTrue ($compile.GeneratedSource -cmatch 'procedure AddCcodExpectedSetupDirectories' -and $compile.GeneratedSource -cmatch "Directories\.Add\('payload\\2\.5\.21'") 'compiler input contains the generated destination inventory procedure'
+        Assert-CcodTrue ($compile.GeneratedSource -cmatch 'procedure AddCcodExpectedSetupDirectories' -and $compile.GeneratedSource -cnotmatch 'Directories\.Add') 'compiler input contains an explicit empty destination inventory procedure'
         Assert-CcodTrue ($compile.GeneratedSource -cnotmatch 'CCOD_INSTALLER_DESTINATION_INVENTORY' -and $compile.GeneratedSource -cnotmatch '(?m)^\s*#\s*(?:include\b|\+)') 'compiler input contains neither the marker nor an external include'
         Assert-CcodTrue (-not [IO.File]::Exists($compile.GeneratedPath)) 'payload compile cleans its generated compiler input'
-        Assert-CcodTrue ($compile.Output -cmatch 'installer-payload\.manifest\.json' -and $compile.Output -cmatch 'payload\\package\.json') 'compiler input trace contains the payload manifest and manifest-listed file'
+        Assert-CcodTrue ($compile.Output -cmatch 'installer-package\.zip' -and $compile.Output -cmatch 'installer-package\.manifest\.json' -and $compile.Output -cmatch 'Activate-CcodRemoteFix\.ps1') 'compiler input trace contains only the sealed package manifest and bootstrap inputs'
     } finally {
         if (Test-Path -LiteralPath $compile.Root) { Remove-Item -LiteralPath $compile.Root -Recurse -Force }
     }
 }
 
 # Production mutation caught: trusting ISCC exit zero and a newly computed sidecar without inspecting the final PE contract.
-Invoke-CcodTest 'compiled Setup independently binds PE versions commit and activation payload manifest hash' {
+Invoke-CcodTest 'compiled Setup independently binds PE version commit package manifest and bootstrap hashes' {
     $modulePath = Join-Path $repositoryRoot 'build\SetupArtifact.psm1'
     Assert-CcodTrue (Test-Path -LiteralPath $modulePath -PathType Leaf) 'independent Setup artifact validator exists'
     Import-Module $modulePath -Force
     $compile = Invoke-CcodInnoPayloadCompileFixture -IncludePayloadDefines
     try {
-        $validated = Test-CcodSetupArtifact -SetupPath $compile.SetupPath -ExpectedVersion '2.5.21' -ExpectedGitCommit $compile.SetupGitCommit -ExpectedPayloadManifestSha256 $compile.PayloadManifestSha256
+        $validated = Test-CcodSetupArtifact -SetupPath $compile.SetupPath -ExpectedVersion '2.5.21' -ExpectedGitCommit $compile.SetupGitCommit -ExpectedPackageSha256 $compile.PackageSha256 -ExpectedPackageManifestSha256 $compile.PackageManifestSha256 -ExpectedActivationBootstrapSha256 $compile.ActivationBootstrapSha256
         Assert-CcodEqual $true ([bool]$validated.Valid) 'real ISCC Setup PE satisfies the independent version and payload contract'
         Assert-CcodEqual '2.5.21.0' ([string]$validated.FileVersion) 'Setup PE FileVersion is exact'
-        Assert-CcodEqual '2.5.21.0' ([string]$validated.ProductVersion) 'Setup PE ProductVersion is exact'
+        Assert-CcodEqual $compile.PackageManifestSha256 ([string]$validated.PackageManifestSha256) 'Setup PE ProductVersion and description bind the full package manifest hash'
         Assert-CcodThrows {
-            Test-CcodSetupArtifact -SetupPath $compile.SetupPath -ExpectedVersion '2.5.21' -ExpectedGitCommit $compile.SetupGitCommit -ExpectedPayloadManifestSha256 ('0' * 64) | Out-Null
+            Test-CcodSetupArtifact -SetupPath $compile.SetupPath -ExpectedVersion '2.5.21' -ExpectedGitCommit $compile.SetupGitCommit -ExpectedPackageSha256 ('0' * 64) -ExpectedPackageManifestSha256 $compile.PackageManifestSha256 -ExpectedActivationBootstrapSha256 $compile.ActivationBootstrapSha256 | Out-Null
         } 'CCOD_SETUP_PAYLOAD_BINDING_INVALID'
     } finally {
         if (Test-Path -LiteralPath $compile.Root) { Remove-Item -LiteralPath $compile.Root -Recurse -Force }
@@ -1620,6 +1726,7 @@ Invoke-CcodTest 'Inno compile refuses a missing generated destination inventory'
     }
 }
 
+<# Superseded by the sealed no-product-write Setup boundary in Task 3.
 Invoke-CcodTest 'Inno exposes a pre-write payload-directory reparse gate' {
     $inno = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw -Encoding UTF8
     $helper = [regex]::Match($inno,'(?ms)^function IsSafeExistingPayloadDirectory\(.*?^end;')
@@ -1845,6 +1952,36 @@ end;
     }
 }
 
+#>
+
+# Production mutation caught: hashing one temporary bootstrap and later executing replacement bytes from the same path.
+Invoke-CcodTest 'temporary bootstrap lock makes the verified source bytes the executed bytes' {
+    $inno = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw -Encoding UTF8
+    Assert-CcodTrue ($inno -cmatch '(?s)function LockCcodInput.*GetSHA256OfFile\(Path\).*CreateFileW\(Path, CCOD_GENERIC_READ, CCOD_FILE_SHARE_READ.*GetSHA256OfFile\(Path\)') 'Setup hashes locks and rehashes each temporary input'
+    Assert-CcodTrue ($inno -cmatch '(?s)function GetCcodBootstrapParameters.*-File.*CcodBootstrapPath' -and $inno -cmatch '(?s)procedure CurStepChanged.*GetCcodBootstrapParameters.*Exec\(') 'Setup executes the exact locked temporary bootstrap path'
+    Assert-CcodTrue ($inno -cmatch '(?s)procedure DeinitializeSetup\(\);.*CloseCcodInputHandles') 'Setup retains input locks through terminal validation'
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-bootstrap-lock-' + [guid]::NewGuid().ToString('N'))
+    $lock = $null
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $scriptPath = Join-Path $root 'ccod-activation-bootstrap.ps1'
+        $marker = Join-Path $root 'executed.txt'
+        [IO.File]::WriteAllText($scriptPath,"[IO.File]::WriteAllText('$($marker.Replace("'","''"))','original',[Text.UTF8Encoding]::new(`$false))",[Text.UTF8Encoding]::new($false))
+        $expected = Get-CcodTestFileSha256 -Path $scriptPath
+        $lock = [IO.File]::Open($scriptPath,[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read)
+        Assert-CcodEqual $expected (Get-CcodTestFileSha256 -Path $scriptPath) 'locked bootstrap bytes retain the verified hash'
+        $replacementBlocked = $false
+        try { [IO.File]::WriteAllText($scriptPath,"[IO.File]::WriteAllText('$($marker.Replace("'","''"))','replacement')",[Text.UTF8Encoding]::new($false)) } catch [IO.IOException] { $replacementBlocked = $true }
+        Assert-CcodTrue $replacementBlocked 'replacement is blocked while the verified bootstrap handle is retained'
+        & (Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe') -NoProfile -NonInteractive -ExecutionPolicy Bypass -File $scriptPath
+        Assert-CcodEqual 0 $LASTEXITCODE 'locked verified bootstrap executes successfully'
+        Assert-CcodEqual 'original' ([IO.File]::ReadAllText($marker,[Text.UTF8Encoding]::new($false))) 'the executed bytes are the original verified bytes'
+    } finally {
+        if ($null -ne $lock) { $lock.Dispose() }
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
 Invoke-CcodTest 'release manifest binds the final asset names hashes version commit and timestamp' {
     . $defenderPath -Library
     $fixture = New-CcodReleaseFixture
@@ -2179,7 +2316,10 @@ Invoke-CcodTest 'package scripts build provenance and workflows retain the relea
     Assert-CcodTrue ($release -cmatch '(?ms)^  publish:\r?\n    needs: build\r?\n    runs-on: windows-latest\r?\n    permissions:\r?\n      contents: write\s*$') 'only the publish job receives release-write permission'
 }
 
-$iss = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw; Assert-CcodTrue ($iss -match 'PortableArtifactDirectory' -and $iss -match 'CodexRemote.Portable.exe' -and $iss -match 'portable-launcher-provenance.json') 'Inno installer packages the portable launcher into the verified bin set';
+$iss = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw
+$buildSource = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\build.ps1') -Raw
+Assert-CcodTrue ($buildSource -match 'CodexRemote\.Portable\.exe' -and $buildSource -match 'Copy-CcodBuildPayloadFile' -and $buildSource -match 'New-CcodInstallerPackage') 'build places the portable launcher only in the manifest-listed sealed package'
+Assert-CcodTrue ($iss -cnotmatch 'CodexRemote\.Portable\.exe|PortableArtifactDirectory') 'Inno never copies a product launcher outside the sealed package transaction'
 Invoke-CcodTest 'release notes extraction emits only the target release English section' {
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-release-notes-fixture-' + [guid]::NewGuid().ToString('N'))
     try {
diff --git a/tools/New-InstallerDestinationInventory.ps1 b/tools/New-InstallerDestinationInventory.ps1
index 7cb2706..bb54f98 100644
--- a/tools/New-InstallerDestinationInventory.ps1
+++ b/tools/New-InstallerDestinationInventory.ps1
@@ -43,6 +43,24 @@ function Assert-CcodInstallerInnoPreprocessorLines {
         '#error InstallerPayloadDirectory must be supplied by the release builder',
         '#ifndef InstallerPayloadManifestSha256',
         '#error InstallerPayloadManifestSha256 must be supplied by the release builder',
+        '#ifndef ProjectVersion',
+        '#error ProjectVersion must be supplied by the release builder',
+        '#ifndef InstallerPackagePath',
+        '#error InstallerPackagePath must be supplied by the release builder',
+        '#ifndef InstallerPackageManifestPath',
+        '#error InstallerPackageManifestPath must be supplied by the release builder',
+        '#ifndef InstallerPackageSha256',
+        '#error InstallerPackageSha256 must be supplied by the release builder',
+        '#ifndef InstallerPackageManifestSha256',
+        '#error InstallerPackageManifestSha256 must be supplied by the release builder',
+        '#define InstallerPackageManifestSha256First Copy(InstallerPackageManifestSha256, 1, 32)',
+        '#define InstallerPackageManifestSha256Last Copy(InstallerPackageManifestSha256, 33, 32)',
+        '#ifndef ActivationBootstrapPath',
+        '#error ActivationBootstrapPath must be supplied by the release builder',
+        '#ifndef ActivationBootstrapSha256',
+        '#error ActivationBootstrapSha256 must be supplied by the release builder',
+        '#define ActivationBootstrapSha256First Copy(ActivationBootstrapSha256, 1, 32)',
+        '#define ActivationBootstrapSha256Last Copy(ActivationBootstrapSha256, 33, 32)',
         '#ifndef SetupGitCommit',
         '#error SetupGitCommit must be supplied by the release builder',
         '#ifndef SetupProvenancePath',
@@ -55,6 +73,16 @@ function Assert-CcodInstallerInnoPreprocessorLines {
         '{#PortableArtifactDirectory}',
         '{#InstallerPayloadDirectory}',
         '{#InstallerPayloadManifestSha256}',
+        '{#InstallerPackagePath}',
+        '{#InstallerPackageManifestPath}',
+        '{#InstallerPackageSha256}',
+        '{#InstallerPackageManifestSha256}',
+        '{#InstallerPackageManifestSha256First}',
+        '{#InstallerPackageManifestSha256Last}',
+        '{#ActivationBootstrapPath}',
+        '{#ActivationBootstrapSha256}',
+        '{#ActivationBootstrapSha256First}',
+        '{#ActivationBootstrapSha256Last}',
         '{#SetupGitCommit}',
         '{#SetupProvenancePath}'
     )
@@ -91,6 +119,8 @@ foreach ($line in $lines) {
     if ($line -match '^\s*\[Files\]\s*$') { $insideFiles = $true; continue }
     if ($insideFiles -and $line -match '^\[') { break }
     if (-not $insideFiles -or [string]::IsNullOrWhiteSpace($line)) { continue }
+    $temporaryInput = [regex]::Match($line,'^Source:\s*"(?<source>[^"]+)";\s*DestName:\s*"(?<name>[A-Za-z0-9._-]+)";\s*Flags:\s*dontcopy\s*$')
+    if ($temporaryInput.Success) { continue }
     $match = [regex]::Match($line,'^Source:\s*"(?<source>[^"]+)";\s*DestDir:\s*"(?<destination>[^"]+)";(?<tail>.*)$')
     if (-not $match.Success) { throw "Unsupported [Files] entry for destination inventory: $line" }
     $destination = $match.Groups['destination'].Value.Replace('{#ProjectVersion}',$ProjectVersion)
@@ -123,7 +153,7 @@ foreach ($line in $lines) {
         }
     }
 }
-if (-not $insideFiles -or $directories.Count -eq 0) { throw 'No setup destination directories were generated.' }
+if (-not $insideFiles) { throw 'No setup Files section was inspected.' }
 $ordered = [Collections.Generic.List[string]]::new()
 foreach ($directory in $directories) { $ordered.Add($directory) }
 $ordered.Sort([StringComparer]::Ordinal)

From 51def5c9ae2f5e0722b9083e478b17c507e9cee8 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 15:50:58 +0800
Subject: [PATCH 087/187] fix: harden sealed setup evidence

---
 Install-CodexRemote-fix.ps1                   |  27 +++-
 build/CodexControlOtherDevices.iss            |  17 ++-
 build/SetupArtifact.psm1                      |  94 ++++++++++--
 .../persistence/InstallLifecycle.SelfTest.ps1 |   4 +-
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 141 +++++++++++++++++-
 5 files changed, 265 insertions(+), 18 deletions(-)

diff --git a/Install-CodexRemote-fix.ps1 b/Install-CodexRemote-fix.ps1
index 816a4e7..610bcc6 100644
--- a/Install-CodexRemote-fix.ps1
+++ b/Install-CodexRemote-fix.ps1
@@ -122,6 +122,26 @@ function Get-CcodPortableInstallerActiveRuntime {
     return [pscustomobject][ordered]@{ RuntimeId=$active.activeRuntime; Generation=$generation }
 }
 
+function Invoke-CcodPortableLifecycleInstaller {
+    param(
+        [Parameter(Mandatory)][string]$InstallerPath,
+        [Parameter(Mandatory)][string]$InstallRoot,
+        [Parameter(Mandatory)][string]$VerifiedSealedPackageSha256,
+        [Parameter(Mandatory)][string]$ExpectedSealedPackageSha256,
+        [switch]$EnableCandidateCompatibleUpdates,
+        [switch]$DoNotStart
+    )
+    if ($VerifiedSealedPackageSha256 -cnotmatch '^[0-9a-f]{64}$' -or
+        $ExpectedSealedPackageSha256 -cnotmatch '^[0-9a-f]{64}$' -or
+        $VerifiedSealedPackageSha256 -cne $ExpectedSealedPackageSha256) {
+        Throw-CcodPortableInstallerError 'CCOD_PORTABLE_PACKAGE_IDENTITY_INVALID' 'The revalidated portable payload identity changed before lifecycle activation.' $VerifiedSealedPackageSha256
+    }
+    return & $InstallerPath -InstallRoot $InstallRoot `
+        -EnableCandidateCompatibleUpdates:([bool]$EnableCandidateCompatibleUpdates) `
+        -DoNotStart:([bool]$DoNotStart) `
+        -SealedPackageSha256 $VerifiedSealedPackageSha256
+}
+
 $bundleRoot = Assert-CcodPortableInstallerPlainDirectory -Path $PSScriptRoot -Kind 'Portable bundle root'
 $payloadRoot = Assert-CcodPortableInstallerPlainDirectory -Path (Join-Path $bundleRoot 'payload') -Kind 'Portable payload root'
 $payloadManifestPath = Assert-CcodPortableInstallerRegularFile -Path (Join-Path $bundleRoot 'payload-manifest.json') -Kind 'Portable payload manifest'
@@ -137,7 +157,7 @@ if ($null -eq $package -or $package.version -isnot [string] -or $package.version
 
 $payload = Test-CcodPortablePayloadManifest -PayloadRoot $payloadRoot -ManifestPath $payloadManifestPath -ExpectedVersion $package.version
 $defender = Invoke-CcodPortableInstallerDefenderGate -PayloadRoot $payloadRoot
-Test-CcodPortablePayloadManifest -PayloadRoot $payloadRoot -ManifestPath $payloadManifestPath -ExpectedVersion $package.version -ExpectedGitCommit $payload.GitCommit | Out-Null
+$revalidatedPayload = Test-CcodPortablePayloadManifest -PayloadRoot $payloadRoot -ManifestPath $payloadManifestPath -ExpectedVersion $package.version -ExpectedGitCommit $payload.GitCommit
 
 $localAppData = [Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)
 if ([string]::IsNullOrWhiteSpace($localAppData) -or -not [IO.Path]::IsPathRooted($localAppData)) {
@@ -151,7 +171,10 @@ if (-not $PSCmdlet.ShouldProcess($installRoot,'Install the verified CodexRemote-
 $copied = Copy-CcodPortablePayload -PayloadRoot $payloadRoot -ManifestPath $payloadManifestPath
 $installerPath = Assert-CcodPortableInstallerRegularFile -Path (Join-Path $copied.InstallerRoot 'Install-CodexControlOtherDevices.ps1') -Kind 'Installed lifecycle installer'
 try {
-    $installReceipt = & $installerPath -InstallRoot $installRoot -EnableCandidateCompatibleUpdates:([bool]$EnableCandidateCompatibleUpdates) -DoNotStart:([bool]$DoNotStart)
+    $installReceipt = Invoke-CcodPortableLifecycleInstaller -InstallerPath $installerPath -InstallRoot $installRoot `
+        -VerifiedSealedPackageSha256 ([string]$revalidatedPayload.PayloadManifestSha256) `
+        -ExpectedSealedPackageSha256 ([string]$payload.PayloadManifestSha256) `
+        -EnableCandidateCompatibleUpdates:$EnableCandidateCompatibleUpdates -DoNotStart:$DoNotStart
 } catch {
     Throw-CcodPortableInstallerError 'CCOD_PORTABLE_INSTALL_FAILED' 'The verified portable payload could not activate the protected runtime.' $_
 }
diff --git a/build/CodexControlOtherDevices.iss b/build/CodexControlOtherDevices.iss
index b1bd096..7ab3d00 100644
--- a/build/CodexControlOtherDevices.iss
+++ b/build/CodexControlOtherDevices.iss
@@ -179,14 +179,27 @@ begin
   if ValidateOnly then Result := Result + ' -ValidateReceiptOnly';
 end;
 
+function PrepareToInstall(var NeedsRestart: Boolean): String;
+begin
+  Result := '';
+  CloseCcodInputHandles();
+  try
+    if not ExtractAndLockCcodInputs() then
+      Result := 'CCOD_SETUP_INPUT_BINDING_INVALID';
+  except
+    Result := 'CCOD_SETUP_INPUT_BINDING_INVALID';
+  end;
+  if Result <> '' then CloseCcodInputHandles();
+end;
+
 procedure CurStepChanged(CurStep: TSetupStep);
 var
   ActivationId, Parameters: String;
   ActivationResultCode, ValidationResultCode: Integer;
 begin
   if CurStep <> ssPostInstall then Exit;
-  CloseCcodInputHandles();
-  if not ExtractAndLockCcodInputs() then RaiseException('CCOD_SETUP_INPUT_BINDING_INVALID');
+  if GetArrayLength(CcodInputHandles) <> 3 then
+    RaiseException('CCOD_SETUP_INPUT_BINDING_INVALID');
   ActivationId := NewActivationId();
   Parameters := GetCcodBootstrapParameters(ActivationId, False);
   if (not Exec(ExpandConstant('{sys}\WindowsPowerShell\v1.0\powershell.exe'), Parameters,
diff --git a/build/SetupArtifact.psm1 b/build/SetupArtifact.psm1
index a2cdcd6..8f097fc 100644
--- a/build/SetupArtifact.psm1
+++ b/build/SetupArtifact.psm1
@@ -252,16 +252,92 @@ function Test-CcodSealedSetupBuildProvenance {
         [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedPackageSha256,[Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedPackageManifestSha256,[Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedActivationBootstrapSha256,[Parameter(Mandatory)][string]$ExpectedBuildTimestampUtc,
         [Parameter(Mandatory)][string]$PackagePath,[Parameter(Mandatory)][string]$PackageManifestPath,[Parameter(Mandatory)][string]$ActivationBootstrapPath,[Parameter(Mandatory)][string]$InnoTemplatePath,[Parameter(Mandatory)][string]$DestinationInventoryPath,[Parameter(Mandatory)][string]$CompilerPath
     )
-    $path=Assert-CcodSetupRegularFile $ProvenancePath 'Sealed Setup provenance';$package=Assert-CcodSetupRegularFile $PackagePath 'Installer package';$manifest=Assert-CcodSetupRegularFile $PackageManifestPath 'Installer package manifest';$bootstrap=Assert-CcodSetupRegularFile $ActivationBootstrapPath 'Activation bootstrap';$template=Assert-CcodSetupRegularFile $InnoTemplatePath 'Inno template';$inventory=Assert-CcodSetupRegularFile $DestinationInventoryPath 'Destination inventory';$compiler=Assert-CcodSetupRegularFile $CompilerPath 'Inno compiler'
-    try{$record=[IO.File]::ReadAllText($path,[Text.UTF8Encoding]::new($false))|ConvertFrom-Json -ErrorAction Stop}catch{Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Sealed Setup provenance JSON is invalid' $path}
-    $fields='schemaVersion,product,version,gitCommit,buildTimestampUtc,installerPackage,installerPackageManifest,activationBootstrap,buildInputs,peContract'
+    $path=Assert-CcodSetupRegularFile $ProvenancePath 'Sealed Setup provenance'
+    $package=Assert-CcodSetupRegularFile $PackagePath 'Installer package'
+    $manifest=Assert-CcodSetupRegularFile $PackageManifestPath 'Installer package manifest'
+    $bootstrap=Assert-CcodSetupRegularFile $ActivationBootstrapPath 'Activation bootstrap'
+    $template=Assert-CcodSetupRegularFile $InnoTemplatePath 'Inno template'
+    $inventory=Assert-CcodSetupRegularFile $DestinationInventoryPath 'Destination inventory'
+    $compiler=Assert-CcodSetupRegularFile $CompilerPath 'Inno compiler'
+    try {
+        $raw=[IO.File]::ReadAllText($path,[Text.UTF8Encoding]::new($false))
+        $record=$raw|ConvertFrom-Json -ErrorAction Stop
+        $manifestRaw=[IO.File]::ReadAllText($manifest,[Text.UTF8Encoding]::new($false))
+        $packageManifest=$manifestRaw|ConvertFrom-Json -ErrorAction Stop
+    } catch { Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Sealed Setup provenance or package manifest JSON is invalid' $path }
+
+    function Test-CcodExactObjectProperties {
+        param($Value,[string[]]$Names)
+        return $Value-is[pscustomobject]-and(@($Value.PSObject.Properties.Name)-join',')-ceq($Names-join',')
+    }
+    function Test-CcodJsonInteger {
+        param($Value)
+        return ($Value-is[int]-or$Value-is[long])-and[decimal]$Value-eq[decimal][long]$Value
+    }
+    function Test-CcodExactString {
+        param($Value,[string]$Expected)
+        return $Value-is[string]-and$Value-ceq$Expected
+    }
+
+    $top=@('schemaVersion','product','version','gitCommit','buildTimestampUtc','installerPackage','installerPackageManifest','activationBootstrap','buildInputs','peContract')
+    $artifactFields=@('name','length','sha256')
+    $manifestFields=@('name','length','sha256','fileCount','payloadManifestSha256')
+    $buildFields=@('innoTemplateSha256','destinationInventorySha256','compilerSha256','compilerFileVersion')
+    $peFields=@('fileVersion','packageManifestFirst','packageManifestLast','bootstrapFirst','bootstrapLast','companyName','legalCopyright')
+    $packageManifestFields=@('schemaVersion','product','version','gitCommit','payloadManifest','files')
+    $payloadManifestFields=@('name','length','sha256')
+    if(-not(Test-CcodExactObjectProperties $record $top)-or
+       -not(Test-CcodExactObjectProperties $record.installerPackage $artifactFields)-or
+       -not(Test-CcodExactObjectProperties $record.installerPackageManifest $manifestFields)-or
+       -not(Test-CcodExactObjectProperties $record.activationBootstrap $artifactFields)-or
+       -not(Test-CcodExactObjectProperties $record.buildInputs $buildFields)-or
+       -not(Test-CcodExactObjectProperties $record.peContract $peFields)-or
+       -not(Test-CcodExactObjectProperties $packageManifest $packageManifestFields)-or
+       -not(Test-CcodExactObjectProperties $packageManifest.payloadManifest $payloadManifestFields)){
+        Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Sealed Setup provenance property schema is invalid' $path
+    }
     $actualCompilerVersion=([string][Diagnostics.FileVersionInfo]::GetVersionInfo($compiler).FileVersion).Trim()
-    if((@($record.PSObject.Properties.Name)-join',')-cne$fields-or$record.schemaVersion-ne 2-or$record.product-cne'CodexRemote-fix'-or$record.version-cne$ExpectedVersion-or$record.gitCommit-cne$ExpectedGitCommit-or$record.buildTimestampUtc-cne$ExpectedBuildTimestampUtc-or-not(Test-CcodSetupCanonicalUtc ([string]$record.buildTimestampUtc))-or
-       $record.installerPackage.sha256-cne$ExpectedPackageSha256-or$record.installerPackage.sha256-cne(Get-CcodSetupArtifactHash $package)-or[long]$record.installerPackage.length-ne(Get-Item $package -Force).Length-or
-       $record.installerPackageManifest.sha256-cne$ExpectedPackageManifestSha256-or$record.installerPackageManifest.sha256-cne(Get-CcodSetupArtifactHash $manifest)-or
-       $record.activationBootstrap.sha256-cne$ExpectedActivationBootstrapSha256-or$record.activationBootstrap.sha256-cne(Get-CcodSetupArtifactHash $bootstrap)-or
-       $record.buildInputs.innoTemplateSha256-cne(Get-CcodSetupArtifactHash $template)-or$record.buildInputs.destinationInventorySha256-cne(Get-CcodSetupArtifactHash $inventory)-or$record.buildInputs.compilerSha256-cne(Get-CcodSetupArtifactHash $compiler)-or([string]$record.buildInputs.compilerFileVersion).Trim()-cne$actualCompilerVersion-or
-       $record.peContract.fileVersion-cne"$ExpectedVersion.0"-or$record.peContract.packageManifestFirst-cne$ExpectedPackageManifestSha256.Substring(0,32)-or$record.peContract.packageManifestLast-cne$ExpectedPackageManifestSha256.Substring(32,32)-or$record.peContract.bootstrapFirst-cne$ExpectedActivationBootstrapSha256.Substring(0,32)-or$record.peContract.bootstrapLast-cne$ExpectedActivationBootstrapSha256.Substring(32,32)-or$record.peContract.companyName-cne$ExpectedGitCommit-or$record.peContract.legalCopyright-cne$ExpectedPackageSha256){Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Sealed Setup provenance is not exactly bound' $path}
+    $packageLength=[long](Get-Item $package -Force).Length
+    $manifestLength=[long](Get-Item $manifest -Force).Length
+    $bootstrapLength=[long](Get-Item $bootstrap -Force).Length
+    if($record.schemaVersion-isnot[int]-or$record.schemaVersion-ne 2-or
+       -not(Test-CcodExactString $record.product 'CodexRemote-fix')-or
+       -not(Test-CcodExactString $record.version $ExpectedVersion)-or
+       -not(Test-CcodExactString $record.gitCommit $ExpectedGitCommit)-or
+       -not(Test-CcodExactString $record.buildTimestampUtc $ExpectedBuildTimestampUtc)-or
+       -not(Test-CcodSetupCanonicalUtc $record.buildTimestampUtc)-or
+       $packageManifest.schemaVersion-isnot[int]-or$packageManifest.schemaVersion-ne 1-or
+       -not(Test-CcodExactString $packageManifest.product 'CodexRemote-fix')-or
+       -not(Test-CcodExactString $packageManifest.version $ExpectedVersion)-or
+       -not(Test-CcodExactString $packageManifest.gitCommit $ExpectedGitCommit)-or
+       -not(Test-CcodExactString $packageManifest.payloadManifest.name 'installer-payload.manifest.json')-or
+       -not(Test-CcodJsonInteger $packageManifest.payloadManifest.length)-or[long]$packageManifest.payloadManifest.length-le0-or
+       @($packageManifest.files).Count-le0-or
+       -not(Test-CcodExactString $record.installerPackage.name 'installer-package.zip')-or
+       -not(Test-CcodJsonInteger $record.installerPackage.length)-or[long]$record.installerPackage.length-ne$packageLength-or
+       -not(Test-CcodExactString $record.installerPackage.sha256 $ExpectedPackageSha256)-or$record.installerPackage.sha256-cne(Get-CcodSetupArtifactHash $package)-or
+       -not(Test-CcodExactString $record.installerPackageManifest.name 'installer-package.manifest.json')-or
+       -not(Test-CcodJsonInteger $record.installerPackageManifest.length)-or[long]$record.installerPackageManifest.length-ne$manifestLength-or
+       -not(Test-CcodExactString $record.installerPackageManifest.sha256 $ExpectedPackageManifestSha256)-or$record.installerPackageManifest.sha256-cne(Get-CcodSetupArtifactHash $manifest)-or
+       $record.installerPackageManifest.fileCount-isnot[int]-or$record.installerPackageManifest.fileCount-ne@($packageManifest.files).Count-or
+       -not(Test-CcodExactString $record.installerPackageManifest.payloadManifestSha256 ([string]$packageManifest.payloadManifest.sha256))-or
+       $packageManifest.payloadManifest.sha256-isnot[string]-or$packageManifest.payloadManifest.sha256-cnotmatch'^[0-9a-f]{64}$'-or
+       -not(Test-CcodExactString $record.activationBootstrap.name 'Activate-CcodRemoteFix.ps1')-or
+       -not(Test-CcodJsonInteger $record.activationBootstrap.length)-or[long]$record.activationBootstrap.length-ne$bootstrapLength-or
+       -not(Test-CcodExactString $record.activationBootstrap.sha256 $ExpectedActivationBootstrapSha256)-or$record.activationBootstrap.sha256-cne(Get-CcodSetupArtifactHash $bootstrap)-or
+       -not(Test-CcodExactString $record.buildInputs.innoTemplateSha256 (Get-CcodSetupArtifactHash $template))-or
+       -not(Test-CcodExactString $record.buildInputs.destinationInventorySha256 (Get-CcodSetupArtifactHash $inventory))-or
+       -not(Test-CcodExactString $record.buildInputs.compilerSha256 (Get-CcodSetupArtifactHash $compiler))-or
+       -not(Test-CcodExactString $record.buildInputs.compilerFileVersion $actualCompilerVersion)-or
+       -not(Test-CcodExactString $record.peContract.fileVersion "$ExpectedVersion.0")-or
+       -not(Test-CcodExactString $record.peContract.packageManifestFirst $ExpectedPackageManifestSha256.Substring(0,32))-or
+       -not(Test-CcodExactString $record.peContract.packageManifestLast $ExpectedPackageManifestSha256.Substring(32,32))-or
+       -not(Test-CcodExactString $record.peContract.bootstrapFirst $ExpectedActivationBootstrapSha256.Substring(0,32))-or
+       -not(Test-CcodExactString $record.peContract.bootstrapLast $ExpectedActivationBootstrapSha256.Substring(32,32))-or
+       -not(Test-CcodExactString $record.peContract.companyName $ExpectedGitCommit)-or
+       -not(Test-CcodExactString $record.peContract.legalCopyright $ExpectedPackageSha256)){
+        Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Sealed Setup provenance is not exactly bound' $path
+    }
     return $record
 }
 
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index ed948c6..a93c2fb 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -759,7 +759,7 @@ $results += Invoke-CcodTest 'Inno visibly starts and synchronously owns the boun
 $results += Invoke-CcodTest 'sealed Setup delegates strict append-only receipt validation to the locked bootstrap' {
     $installerScript = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw -Encoding UTF8
     $activationWorker = Get-Content -LiteralPath (Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1') -Raw -Encoding UTF8
-    Assert-CcodTrue ($installerScript -cmatch '(?s)ExtractAndLockCcodInputs.*GetCcodBootstrapParameters.*ewWaitUntilTerminated, ActivationResultCode.*GetCcodBootstrapParameters\(ActivationId, True\).*ewWaitUntilTerminated, ValidationResultCode') 'Setup retains one locked bootstrap across activation and strict validation'
+    Assert-CcodTrue ($installerScript -cmatch '(?s)function PrepareToInstall.*ExtractAndLockCcodInputs.*procedure CurStepChanged.*GetArrayLength\(CcodInputHandles\) <> 3.*GetCcodBootstrapParameters.*ewWaitUntilTerminated, ActivationResultCode.*GetCcodBootstrapParameters\(ActivationId, True\).*ewWaitUntilTerminated, ValidationResultCode') 'Setup retains one pre-install locked bootstrap across activation and strict validation'
     Assert-CcodTrue ($installerScript -cmatch '-PackagePath' -and $installerScript -cmatch '-ExpectedPackageSha256' -and $installerScript -cnotmatch 'post-install-activation\.json') 'Setup passes the compile-bound sealed package and owns no mutable receipt path'
     Assert-CcodTrue ($activationWorker -cmatch 'state\\activation-receipts' -and $activationWorker -cmatch '\$ExpectedActivationId\.\$phase\.json' -and $activationWorker -cnotmatch "Join-Path \`$Root 'state\\post-install-activation\.json'") 'bootstrap validates only append-only activation receipts'
 }
@@ -2770,7 +2770,7 @@ $results += Invoke-CcodTest 'installer accepts success only from the exited owne
     Assert-CcodTrue (Test-Path -LiteralPath $activationScript -PathType Leaf) 'post-install activation worker exists'
     Assert-CcodTrue ($installerScript -cmatch '(?m)^CloseApplications=no\r?$') 'installer never lets Restart Manager close Codex'
     Assert-CcodTrue ($installerScript -cmatch 'ActivationBootstrapPath' -and $installerScript -cmatch 'Flags: dontcopy') 'installer embeds the activation worker only as a temporary sealed input'
-    Assert-CcodTrue ($installerScript -cmatch '(?s)ExtractAndLockCcodInputs\(\).*GetCcodBootstrapParameters\(ActivationId, False\).*ewWaitUntilTerminated, ActivationResultCode') 'installer locks inputs before waiting for the exact owner to exit'
+    Assert-CcodTrue ($installerScript -cmatch '(?s)function PrepareToInstall.*ExtractAndLockCcodInputs\(\).*procedure CurStepChanged.*GetArrayLength\(CcodInputHandles\) <> 3.*GetCcodBootstrapParameters\(ActivationId, False\).*ewWaitUntilTerminated, ActivationResultCode') 'installer locks inputs before waiting for the exact owner to exit'
     Assert-CcodTrue ($installerScript -cmatch '(?s)ActivationResultCode <> 0.*RaiseException.*GetCcodBootstrapParameters\(ActivationId, True\).*ewWaitUntilTerminated, ValidationResultCode') 'only a normal owner exit reaches the strict one-shot validator'
     Assert-CcodTrue ($installerScript -cmatch 'ProgressGauge\.Position := 100' -and $installerScript -cnotmatch 'Prompt-CcodRestart\.ps1') 'strict validation alone reaches completion while Task 4 registration and prompting stay absent'
     Assert-CcodTrue ($installerScript -cmatch '\(ValidationResultCode <> 0\) then RaiseException\(.CCOD_SETUP_READY_VALIDATION_FAILED.' ) 'every nonzero validator result fails closed'
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 426b334..22b5bb1 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -1264,7 +1264,7 @@ Invoke-CcodTest 'temporary bootstrap verifies the sealed package and propagates
 }
 
 function Invoke-CcodInnoPayloadCompileFixture {
-    param([switch]$IncludePayloadDefines,[switch]$OmitDestinationInventory)
+    param([switch]$IncludePayloadDefines,[switch]$OmitDestinationInventory,[switch]$BindWrongPackageHash,[switch]$UseInertActivationMarker)
 
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-inno-payload-contract-' + [guid]::NewGuid().ToString('N'))
     $tray = Join-Path $root 'tray'
@@ -1300,13 +1300,20 @@ function Invoke-CcodInnoPayloadCompileFixture {
     $installerPackagePath = Join-Path $root 'installer-package.zip'
     $installerPackageManifestPath = Join-Path $root 'installer-package.manifest.json'
     $installerPackage = New-CcodInstallerPackage -PayloadRoot $payload -PayloadManifestPath $manifestPath -Version '2.5.21' -GitCommit $setupGitCommit -OutputPath $installerPackagePath -ManifestOutputPath $installerPackageManifestPath
-    $activationBootstrapPath = Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1'
+    $activationMarker = Join-Path $root 'activation-executed.txt'
+    $activationBootstrapPath = if($UseInertActivationMarker){
+        $path=Join-Path $root 'inert-activation-bootstrap.ps1'
+        [IO.File]::WriteAllText($path,"[IO.File]::WriteAllText('$($activationMarker.Replace("'","''"))','executed',[Text.UTF8Encoding]::new(`$false));exit 97",[Text.UTF8Encoding]::new($false))
+        $path
+    }else{Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1'}
     $activationBootstrapSha256 = Get-CcodTestFileSha256 -Path $activationBootstrapPath
     $setupProvenancePath = Join-Path $root 'setup-provenance.json'
     [IO.File]::WriteAllText($setupProvenancePath,'{}',[Text.UTF8Encoding]::new($false))
+    $boundPackageHash=$null
     $arguments = @('/DProjectVersion=2.5.21',"/DSetupGitCommit=$setupGitCommit","/DSetupProvenancePath=$setupProvenancePath","/O$output\")
     if ($IncludePayloadDefines) {
-        $arguments = @('/DProjectVersion=2.5.21',"/DInstallerPackagePath=$installerPackagePath","/DInstallerPackageManifestPath=$installerPackageManifestPath","/DInstallerPackageSha256=$($installerPackage.PackageSha256)","/DInstallerPackageManifestSha256=$($installerPackage.ManifestSha256)","/DActivationBootstrapPath=$activationBootstrapPath","/DActivationBootstrapSha256=$activationBootstrapSha256","/DSetupGitCommit=$setupGitCommit","/DSetupProvenancePath=$setupProvenancePath")
+        $boundPackageHash=if($BindWrongPackageHash){'0'*64}else{[string]$installerPackage.PackageSha256}
+        $arguments = @('/DProjectVersion=2.5.21',"/DInstallerPackagePath=$installerPackagePath","/DInstallerPackageManifestPath=$installerPackageManifestPath","/DInstallerPackageSha256=$boundPackageHash","/DInstallerPackageManifestSha256=$($installerPackage.ManifestSha256)","/DActivationBootstrapPath=$activationBootstrapPath","/DActivationBootstrapSha256=$activationBootstrapSha256","/DSetupGitCommit=$setupGitCommit","/DSetupProvenancePath=$setupProvenancePath")
         $arguments += "/O$output\"
     }
     . (Join-Path $repositoryRoot 'build\build.ps1') -Library
@@ -1342,6 +1349,14 @@ function Invoke-CcodInnoPayloadCompileFixture {
         PackageManifestSha256 = $installerPackage.ManifestSha256
         ActivationBootstrapSha256 = $activationBootstrapSha256
         SetupGitCommit = $setupGitCommit
+        PackagePath = $installerPackagePath
+        PackageManifestPath = $installerPackageManifestPath
+        ActivationBootstrapPath = $activationBootstrapPath
+        InventoryPath = $inventoryPath
+        TemplatePath = $templatePath
+        CompilerPath = $iscc
+        ActivationMarker = $activationMarker
+        BoundPackageSha256 = $boundPackageHash
     }
 }
 
@@ -1652,6 +1667,36 @@ Invoke-CcodTest 'compiled Setup independently binds PE version commit package ma
     }
 }
 
+# Production mutation caught: compiled Setup metadata looks safe while CurStepChanged skips its runtime package hash/lock barrier.
+Invoke-CcodTest 'compiled production Setup rejects a wrong package hash before activation and product state' {
+    $fixture=Invoke-CcodInnoPayloadCompileFixture -IncludePayloadDefines -BindWrongPackageHash -UseInertActivationMarker
+    $process=$null
+    try {
+        Assert-CcodEqual 0 $fixture.ExitCode "wrong-hash production Setup fixture compiles: $($fixture.Output)"
+        Assert-CcodTrue (Test-Path -LiteralPath $fixture.SetupPath -PathType Leaf) 'wrong-hash compiled Setup exists'
+        Assert-CcodEqual ('0'*64) ([string]$fixture.BoundPackageSha256) 'fixture binds the deliberate wrong package hash'
+        Assert-CcodEqual ('0'*64) ([string][Diagnostics.FileVersionInfo]::GetVersionInfo($fixture.SetupPath).LegalCopyright).Trim() 'compiled PE independently retains the wrong expected package hash'
+        $appRoot=Join-Path $fixture.Root 'forbidden-app-output'
+        $logPath=Join-Path $fixture.Root 'executed-setup.log'
+        $arguments=@('/VERYSILENT','/SUPPRESSMSGBOXES','/NORESTART','/SP-',("/DIR=$appRoot"),("/LOG=$logPath"))
+        $startInfo=[Diagnostics.ProcessStartInfo]::new();$startInfo.FileName=$fixture.SetupPath;$startInfo.Arguments=(($arguments|ForEach-Object{'"'+([string]$_).Replace('"','\"')+'"'})-join' ');$startInfo.UseShellExecute=$false;$startInfo.CreateNoWindow=$true
+        $process=[Diagnostics.Process]::new();$process.StartInfo=$startInfo
+        Assert-CcodTrue $process.Start() 'wrong-hash compiled Setup starts'
+        Assert-CcodTrue $process.WaitForExit(20000) 'wrong-hash compiled Setup exits within the pre-activation bound'
+        Assert-CcodTrue (Test-Path -LiteralPath $logPath -PathType Leaf) 'executed Setup emits its isolated runtime log'
+        $log=[IO.File]::ReadAllText($logPath,[Text.UTF8Encoding]::new($false))
+        Assert-CcodTrue ([int]$process.ExitCode-ne0) "wrong-hash compiled Setup fails closed: exit=$([int]$process.ExitCode) log=$($log.Substring([Math]::Max(0,$log.Length-1000)))"
+        Assert-CcodTrue ($log-cmatch 'CCOD_SETUP_INPUT_BINDING_INVALID') 'runtime CurStepChanged reports the package hash/lock barrier failure'
+        Assert-CcodTrue (-not(Test-Path -LiteralPath $fixture.ActivationMarker)) 'temporary activation bootstrap never executes'
+        Assert-CcodTrue (-not(Test-Path -LiteralPath $appRoot)) 'CreateAppDir=no leaves no app product output'
+        $realProductRoot=Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)) 'CodexControlOtherDevices'
+        Assert-CcodTrue ($log.IndexOf($realProductRoot,[StringComparison]::OrdinalIgnoreCase)-lt0) 'failure log never reaches the real LocalAppData product root'
+    } finally {
+        if($null-ne$process){try{if(-not$process.HasExited){$process.Kill();[void]$process.WaitForExit(5000)}}catch{};$process.Dispose()}
+        if(Test-Path -LiteralPath $fixture.Root){Remove-Item -LiteralPath $fixture.Root -Recurse -Force -ErrorAction SilentlyContinue}
+    }
+}
+
 # Production mutation caught: accepting self-consistent but false Setup build-input hashes without comparing canonical files.
 Invoke-CcodTest 'Setup provenance rejects self-consistent wrong canonical build input hashes' {
     Import-Module (Join-Path $repositoryRoot 'build\SetupArtifact.psm1') -Force
@@ -1692,6 +1737,59 @@ Invoke-CcodTest 'Setup provenance rejects self-consistent wrong canonical build
     }
 }
 
+# Production mutation caught: schema-two provenance accepts cosmetic nested evidence not bound to the actual inputs.
+Invoke-CcodTest 'sealed Setup provenance rejects every field type name length count hash and property-order mutation' {
+    Import-Module (Join-Path $repositoryRoot 'build\SetupArtifact.psm1') -Force
+    $fixture=Invoke-CcodInnoPayloadCompileFixture -IncludePayloadDefines
+    try {
+        Assert-CcodEqual 0 $fixture.ExitCode "sealed provenance fixture compiles: $($fixture.Output)"
+        $provenance=Join-Path $fixture.Root 'sealed-setup-provenance.json'
+        $timestamp='2030-02-03T04:05:06.0000000Z'
+        $created=New-CcodSealedSetupBuildProvenance -Version '2.5.21' -GitCommit $fixture.SetupGitCommit -BuildTimestampUtc $timestamp -PackagePath $fixture.PackagePath -PackageManifestPath $fixture.PackageManifestPath -ActivationBootstrapPath $fixture.ActivationBootstrapPath -InnoTemplatePath $fixture.TemplatePath -DestinationInventoryPath $fixture.InventoryPath -CompilerPath $fixture.CompilerPath -OutputPath $provenance
+        $arguments=@{ExpectedVersion='2.5.21';ExpectedGitCommit=$fixture.SetupGitCommit;ExpectedPackageSha256=$fixture.PackageSha256;ExpectedPackageManifestSha256=$fixture.PackageManifestSha256;ExpectedActivationBootstrapSha256=$fixture.ActivationBootstrapSha256;ExpectedBuildTimestampUtc=$timestamp;PackagePath=$fixture.PackagePath;PackageManifestPath=$fixture.PackageManifestPath;ActivationBootstrapPath=$fixture.ActivationBootstrapPath;InnoTemplatePath=$fixture.TemplatePath;DestinationInventoryPath=$fixture.InventoryPath;CompilerPath=$fixture.CompilerPath}
+        $valid=Test-CcodSealedSetupBuildProvenance -ProvenancePath $provenance @arguments
+        Assert-CcodEqual 2 ([int]$valid.schemaVersion) 'canonical schema-two provenance validates'
+        $mutations=@(
+            [pscustomobject]@{Name='top-level-order';Apply={param($r)$copy=[ordered]@{product=$r.product;schemaVersion=$r.schemaVersion;version=$r.version;gitCommit=$r.gitCommit;buildTimestampUtc=$r.buildTimestampUtc;installerPackage=$r.installerPackage;installerPackageManifest=$r.installerPackageManifest;activationBootstrap=$r.activationBootstrap;buildInputs=$r.buildInputs;peContract=$r.peContract};return [pscustomobject]$copy}},
+            [pscustomobject]@{Name='schema-type';Apply={param($r)$r.schemaVersion='2';$r}},
+            [pscustomobject]@{Name='version-type';Apply={param($r)$r.version=2521;$r}},
+            [pscustomobject]@{Name='commit';Apply={param($r)$r.gitCommit='e'*40;$r}},
+            [pscustomobject]@{Name='package-order';Apply={param($r)$r.installerPackage=[pscustomobject][ordered]@{sha256=$r.installerPackage.sha256;name=$r.installerPackage.name;length=$r.installerPackage.length};$r}},
+            [pscustomobject]@{Name='package-name';Apply={param($r)$r.installerPackage.name='renamed.zip';$r}},
+            [pscustomobject]@{Name='package-length';Apply={param($r)$r.installerPackage.length=[long]$r.installerPackage.length+1;$r}},
+            [pscustomobject]@{Name='package-length-type';Apply={param($r)$r.installerPackage.length=[string]$r.installerPackage.length;$r}},
+            [pscustomobject]@{Name='manifest-order';Apply={param($r)$r.installerPackageManifest=[pscustomobject][ordered]@{name=$r.installerPackageManifest.name;sha256=$r.installerPackageManifest.sha256;length=$r.installerPackageManifest.length;fileCount=$r.installerPackageManifest.fileCount;payloadManifestSha256=$r.installerPackageManifest.payloadManifestSha256};$r}},
+            [pscustomobject]@{Name='manifest-name';Apply={param($r)$r.installerPackageManifest.name='renamed.json';$r}},
+            [pscustomobject]@{Name='manifest-length';Apply={param($r)$r.installerPackageManifest.length=[long]$r.installerPackageManifest.length+1;$r}},
+            [pscustomobject]@{Name='file-count';Apply={param($r)$r.installerPackageManifest.fileCount=[int]$r.installerPackageManifest.fileCount+1;$r}},
+            [pscustomobject]@{Name='file-count-type';Apply={param($r)$r.installerPackageManifest.fileCount=[string]$r.installerPackageManifest.fileCount;$r}},
+            [pscustomobject]@{Name='payload-manifest-sha';Apply={param($r)$r.installerPackageManifest.payloadManifestSha256='0'*64;$r}},
+            [pscustomobject]@{Name='bootstrap-order';Apply={param($r)$r.activationBootstrap=[pscustomobject][ordered]@{length=$r.activationBootstrap.length;name=$r.activationBootstrap.name;sha256=$r.activationBootstrap.sha256};$r}},
+            [pscustomobject]@{Name='bootstrap-name';Apply={param($r)$r.activationBootstrap.name='stale.ps1';$r}},
+            [pscustomobject]@{Name='bootstrap-length';Apply={param($r)$r.activationBootstrap.length=[long]$r.activationBootstrap.length+1;$r}},
+            [pscustomobject]@{Name='build-input-order';Apply={param($r)$r.buildInputs=[pscustomobject][ordered]@{compilerSha256=$r.buildInputs.compilerSha256;innoTemplateSha256=$r.buildInputs.innoTemplateSha256;destinationInventorySha256=$r.buildInputs.destinationInventorySha256;compilerFileVersion=$r.buildInputs.compilerFileVersion};$r}},
+            [pscustomobject]@{Name='template-hash';Apply={param($r)$r.buildInputs.innoTemplateSha256='1'*64;$r}},
+            [pscustomobject]@{Name='inventory-hash';Apply={param($r)$r.buildInputs.destinationInventorySha256='2'*64;$r}},
+            [pscustomobject]@{Name='compiler-hash';Apply={param($r)$r.buildInputs.compilerSha256='3'*64;$r}},
+            [pscustomobject]@{Name='compiler-version';Apply={param($r)$r.buildInputs.compilerFileVersion='9.9.9.9';$r}},
+            [pscustomobject]@{Name='pe-order';Apply={param($r)$r.peContract=[pscustomobject][ordered]@{legalCopyright=$r.peContract.legalCopyright;fileVersion=$r.peContract.fileVersion;packageManifestFirst=$r.peContract.packageManifestFirst;packageManifestLast=$r.peContract.packageManifestLast;bootstrapFirst=$r.peContract.bootstrapFirst;bootstrapLast=$r.peContract.bootstrapLast;companyName=$r.peContract.companyName};$r}},
+            [pscustomobject]@{Name='nested-extra';Apply={param($r)$r.activationBootstrap|Add-Member attacker 'x';$r}}
+        )
+        foreach($mutation in $mutations){
+            $record=([IO.File]::ReadAllText($provenance,[Text.UTF8Encoding]::new($false))|ConvertFrom-Json)
+            $record=&$mutation.Apply $record
+            $mutated=Join-Path $fixture.Root ("provenance-$($mutation.Name).json")
+            [IO.File]::WriteAllText($mutated,(($record|ConvertTo-Json -Depth 8)+[Environment]::NewLine),[Text.UTF8Encoding]::new($false))
+            $failure=$null
+            try{Test-CcodSealedSetupBuildProvenance -ProvenancePath $mutated @arguments|Out-Null}catch{$failure=$_}
+            Assert-CcodTrue ($null-ne$failure) "provenance mutation is rejected: $($mutation.Name)"
+            Assert-CcodTrue ($failure.FullyQualifiedErrorId-like'CCOD_SETUP_PROVENANCE_INVALID*') "provenance mutation has the bounded code: $($mutation.Name)"
+        }
+    } finally {
+        if(Test-Path -LiteralPath $fixture.Root){Remove-Item -LiteralPath $fixture.Root -Recurse -Force -ErrorAction SilentlyContinue}
+    }
+}
+
 # Production mutation caught: cleaning payload stage/inventory only after a successful Setup build.
 Invoke-CcodTest 'build temporary Setup inputs are cleaned from the exact finally boundary after failure' {
     . (Join-Path $repositoryRoot 'build\build.ps1') -Library
@@ -2504,4 +2602,41 @@ Invoke-CcodTest 'portable release manifest binds the ZIP payload manifest and ea
     }
 }
 
+# Production mutation caught: portable validates a payload identity but omits or changes it at the lifecycle child boundary.
+Invoke-CcodTest 'portable installer propagates only the exact revalidated sealed identity to its lifecycle child' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-portable-sealed-identity-' + [guid]::NewGuid().ToString('N'))
+    $module = $null
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $scriptPath = Join-Path $repositoryRoot 'Install-CodexRemote-fix.ps1'
+        $tokens=$null;$parseErrors=$null
+        $ast=[Management.Automation.Language.Parser]::ParseFile($scriptPath,[ref]$tokens,[ref]$parseErrors)
+        Assert-CcodEqual 0 @($parseErrors).Count 'portable installer parses before production function extraction'
+        $definitions=@($ast.EndBlock.Statements|Where-Object{$_-is[Management.Automation.Language.FunctionDefinitionAst]}|ForEach-Object{$_.Extent.Text})
+        $libraryPath=Join-Path $root 'PortableInstallerFunctions.psm1'
+        [IO.File]::WriteAllText($libraryPath,(($definitions-join"`r`n`r`n")+"`r`n"),[Text.UTF8Encoding]::new($false))
+        $module=Import-Module $libraryPath -Force -PassThru
+        $marker=Join-Path $root 'child-identity.txt'
+        $child=Join-Path $root 'Install-CodexControlOtherDevices.ps1'
+        $childSource=@"
+param([string]`$InstallRoot,[switch]`$EnableCandidateCompatibleUpdates,[switch]`$DoNotStart,[string]`$SealedPackageSha256)
+[IO.File]::WriteAllText('$($marker.Replace("'","''"))',[string]`$SealedPackageSha256,[Text.UTF8Encoding]::new(`$false))
+[pscustomobject]@{Outcome='Installed';RuntimeId='runtime-fixture'}
+"@
+        [IO.File]::WriteAllText($child,$childSource,[Text.UTF8Encoding]::new($false))
+        $verified='a'*64
+        $receipt=&$module {param($Path,$Root,$Identity)Invoke-CcodPortableLifecycleInstaller -InstallerPath $Path -InstallRoot $Root -VerifiedSealedPackageSha256 $Identity -ExpectedSealedPackageSha256 $Identity} $child $root $verified
+        Assert-CcodEqual 'runtime-fixture' ([string]$receipt.RuntimeId) 'portable helper returns the exact child receipt'
+        Assert-CcodEqual $verified ([IO.File]::ReadAllText($marker,[Text.UTF8Encoding]::new($false))) 'exact verified identity reaches the lifecycle child'
+        Remove-Item -LiteralPath $marker -Force
+        Assert-CcodThrows {
+            &$module {param($Path,$Root,$Verified,$Expected)Invoke-CcodPortableLifecycleInstaller -InstallerPath $Path -InstallRoot $Root -VerifiedSealedPackageSha256 $Verified -ExpectedSealedPackageSha256 $Expected} $child $root ('b'*64) $verified | Out-Null
+        } 'CCOD_PORTABLE_PACKAGE_IDENTITY_INVALID'
+        Assert-CcodTrue (-not(Test-Path -LiteralPath $marker)) 'changed identity fails before lifecycle child mutation'
+    } finally {
+        if($null-ne$module){Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue}
+        if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue}
+    }
+}
+
 Write-Host 'Release workflow self-tests passed.'

From 728b62710c0729b40908e92887d3fe70903edbba Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 15:52:31 +0800
Subject: [PATCH 088/187] docs: record sealed setup evidence

---
 .../task-3-report.md                          | 69 ++++++++++++++++++-
 1 file changed, 67 insertions(+), 2 deletions(-)

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md
index b2e43c6..affe544 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md
@@ -94,5 +94,70 @@ separately from production defects so they are not mistaken for regressions.
 
 ## Commit
 
-- `fix: bootstrap sealed installer package` (the Task 3 commit containing this
-  report; resolve the exact object as this worktree's Task 3 HEAD).
+- Initial implementation commit:
+  `9e1c41c72d296c2d0c014a45561a855699ebd39b`
+  (`fix: bootstrap sealed installer package`).
+
+## Fix round 1: portable identity, exact provenance, and executed Setup proof
+
+### Review findings and RED evidence
+
+Scoped review of `46692e7..9e1c41c72d296c2d0c014a45561a855699ebd39b`
+failed with four Important findings.
+
+- Portable identity RED: `ReleaseWorkflow.SelfTest.ps1` exited `1` because
+  `Invoke-CcodPortableLifecycleInstaller` did not exist. The portable wrapper
+  revalidated its manifest after Defender but discarded that result and called
+  `Install-CodexControlOtherDevices.ps1` without `-SealedPackageSha256`.
+- Exact provenance RED: the new schema-two mutation matrix exited `1` with
+  `ASSERT_THROWS: expected CCOD_SETUP_PROVENANCE_INVALID`. The validator
+  accepted altered nested evidence because it did not require every property
+  order/type/name/length/count/hash.
+- Executed Setup RED: the deliberately wrong-package-hash production Setup
+  compiled successfully and executed its real temporary input path, but the
+  test observed exit `0`. Its runtime log proved the hash gate did run:
+  `CurStepChanged raised an exception` with
+  `CCOD_SETUP_INPUT_BINDING_INVALID`; Inno defaulted the suppressed error box
+  to OK and still returned success.
+- Report RED: the initial report said only “Task 3 HEAD”, which did not provide
+  an immutable 40-hex object identity.
+
+### Remediated behavior
+
+- Portable now retains both the initial and post-Defender verified
+  `PayloadManifestSha256`, requires an exact canonical match before invoking
+  the lifecycle child, and passes that value explicitly as
+  `-SealedPackageSha256`. A changed canonical identity fails with
+  `CCOD_PORTABLE_PACKAGE_IDENTITY_INVALID` before the child marker can run.
+- `Test-CcodSealedSetupBuildProvenance` requires exact ordered top-level and
+  nested schemas, JSON types, artifact names, actual lengths and SHA-256s,
+  manifest `fileCount` and `payloadManifestSha256`, canonical version/commit/
+  timestamp, compiler/template/inventory identity, and the complete split PE
+  contract. Twenty-four independent mutations are rejected.
+- The same `ExtractAndLockCcodInputs` gate now runs from `PrepareToInstall`.
+  A nonempty error uses Inno's actual install-failure contract; `CurStepChanged`
+  consumes only the three already-held verified handles. The executed
+  wrong-hash fixture exits nonzero, records
+  `CCOD_SETUP_INPUT_BINDING_INVALID`, never runs its inert activation marker,
+  creates no `/DIR` app output, and never logs the real LocalAppData product
+  root.
+
+### GREEN and verification evidence
+
+- Final `ReleaseWorkflow.SelfTest.ps1`: exit `0`, including the portable exact
+  identity test, 24-case provenance mutation matrix, real production ISCC
+  compile, and bounded wrong-hash Setup execution.
+- Final `InstallLifecycle.SelfTest.ps1`: exit `0`;
+  `Install lifecycle self-tests passed: 113`.
+- Explicit parser checks passed all four changed PowerShell code/test files.
+- `git diff --check` exited `0`; only checkout LF-to-CRLF warnings were emitted.
+- Static no-`{app}` boundary audit reported `FIX1_BOUNDARY_VIOLATIONS=0`.
+- No aggregate run was performed in this fix round; no aggregate-pass claim is
+  made.
+- No release build, real install, product process control, external service,
+  WindowsApps, DPAPI, signing, push, tag, or publication action occurred.
+
+### Exact implementation commit
+
+- `51def5c9ae2f5e0722b9083e478b17c507e9cee8`
+  (`fix: harden sealed setup evidence`).

From 1cb91621f2565318143dffe08844a91a350a36d9 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 16:34:41 +0800
Subject: [PATCH 089/187] fix: bind portable sealed execution

---
 Install-CodexRemote-fix.ps1                   |  22 +--
 build/SetupArtifact.psm1                      | 128 ++++++++++++++++++
 src/persistence/modules/PortableRelease.psm1  |   4 +-
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 105 +++++++++++++-
 4 files changed, 246 insertions(+), 13 deletions(-)

diff --git a/Install-CodexRemote-fix.ps1 b/Install-CodexRemote-fix.ps1
index 610bcc6..b8c0eef 100644
--- a/Install-CodexRemote-fix.ps1
+++ b/Install-CodexRemote-fix.ps1
@@ -126,20 +126,23 @@ function Invoke-CcodPortableLifecycleInstaller {
     param(
         [Parameter(Mandatory)][string]$InstallerPath,
         [Parameter(Mandatory)][string]$InstallRoot,
-        [Parameter(Mandatory)][string]$VerifiedSealedPackageSha256,
-        [Parameter(Mandatory)][string]$ExpectedSealedPackageSha256,
+        [Parameter(Mandatory)][string]$CopiedSealedPackageSha256,
+        [Parameter(Mandatory)][string]$InitialSealedPackageSha256,
+        [Parameter(Mandatory)][string]$RevalidatedSourceSealedPackageSha256,
         [switch]$EnableCandidateCompatibleUpdates,
         [switch]$DoNotStart
     )
-    if ($VerifiedSealedPackageSha256 -cnotmatch '^[0-9a-f]{64}$' -or
-        $ExpectedSealedPackageSha256 -cnotmatch '^[0-9a-f]{64}$' -or
-        $VerifiedSealedPackageSha256 -cne $ExpectedSealedPackageSha256) {
-        Throw-CcodPortableInstallerError 'CCOD_PORTABLE_PACKAGE_IDENTITY_INVALID' 'The revalidated portable payload identity changed before lifecycle activation.' $VerifiedSealedPackageSha256
+    if ($CopiedSealedPackageSha256 -cnotmatch '^[0-9a-f]{64}$' -or
+        $InitialSealedPackageSha256 -cnotmatch '^[0-9a-f]{64}$' -or
+        $RevalidatedSourceSealedPackageSha256 -cnotmatch '^[0-9a-f]{64}$' -or
+        $CopiedSealedPackageSha256 -cne $InitialSealedPackageSha256 -or
+        $CopiedSealedPackageSha256 -cne $RevalidatedSourceSealedPackageSha256) {
+        Throw-CcodPortableInstallerError 'CCOD_PORTABLE_PACKAGE_IDENTITY_INVALID' 'The initial, revalidated source, and copied portable payload identities differ before lifecycle activation.' $CopiedSealedPackageSha256
     }
     return & $InstallerPath -InstallRoot $InstallRoot `
         -EnableCandidateCompatibleUpdates:([bool]$EnableCandidateCompatibleUpdates) `
         -DoNotStart:([bool]$DoNotStart) `
-        -SealedPackageSha256 $VerifiedSealedPackageSha256
+        -SealedPackageSha256 $CopiedSealedPackageSha256
 }
 
 $bundleRoot = Assert-CcodPortableInstallerPlainDirectory -Path $PSScriptRoot -Kind 'Portable bundle root'
@@ -172,8 +175,9 @@ $copied = Copy-CcodPortablePayload -PayloadRoot $payloadRoot -ManifestPath $payl
 $installerPath = Assert-CcodPortableInstallerRegularFile -Path (Join-Path $copied.InstallerRoot 'Install-CodexControlOtherDevices.ps1') -Kind 'Installed lifecycle installer'
 try {
     $installReceipt = Invoke-CcodPortableLifecycleInstaller -InstallerPath $installerPath -InstallRoot $installRoot `
-        -VerifiedSealedPackageSha256 ([string]$revalidatedPayload.PayloadManifestSha256) `
-        -ExpectedSealedPackageSha256 ([string]$payload.PayloadManifestSha256) `
+        -CopiedSealedPackageSha256 ([string]$copied.Manifest.PayloadManifestSha256) `
+        -InitialSealedPackageSha256 ([string]$payload.PayloadManifestSha256) `
+        -RevalidatedSourceSealedPackageSha256 ([string]$revalidatedPayload.PayloadManifestSha256) `
         -EnableCandidateCompatibleUpdates:$EnableCandidateCompatibleUpdates -DoNotStart:$DoNotStart
 } catch {
     Throw-CcodPortableInstallerError 'CCOD_PORTABLE_INSTALL_FAILED' 'The verified portable payload could not activate the protected runtime.' $_
diff --git a/build/SetupArtifact.psm1 b/build/SetupArtifact.psm1
index 8f097fc..629ec6f 100644
--- a/build/SetupArtifact.psm1
+++ b/build/SetupArtifact.psm1
@@ -33,6 +33,132 @@ function Test-CcodSetupCanonicalUtc {
         $parsed.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture) -ceq $Value
 }
 
+function Initialize-CcodSetupJsonMemberScanner {
+    if ($null -ne ('CcodSetupJsonMemberScannerV1' -as [type])) { return }
+    Add-Type -TypeDefinition @'
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Text;
+
+public static class CcodSetupJsonMemberScannerV1
+{
+    public static void AssertUnique(string json)
+    {
+        if (json == null || json.Length == 0 || json.Length > 1048576) throw new InvalidDataException("json bounds");
+        int index = 0;
+        ParseValue(json, ref index, 0);
+        Skip(json, ref index);
+        if (index != json.Length) throw new InvalidDataException("trailing json");
+    }
+
+    private static void ParseValue(string json, ref int index, int depth)
+    {
+        if (depth > 32) throw new InvalidDataException("json depth");
+        Skip(json, ref index);
+        if (index >= json.Length) throw new InvalidDataException("missing value");
+        char c = json[index];
+        if (c == '{') { ParseObject(json, ref index, depth + 1); return; }
+        if (c == '[') { ParseArray(json, ref index, depth + 1); return; }
+        if (c == '"') { ParseString(json, ref index); return; }
+        int start = index;
+        while (index < json.Length && json[index] != ',' && json[index] != '}' && json[index] != ']' && !Char.IsWhiteSpace(json[index])) index++;
+        if (index == start) throw new InvalidDataException("invalid scalar");
+    }
+
+    private static void ParseObject(string json, ref int index, int depth)
+    {
+        index++;
+        var names = new HashSet<string>(StringComparer.Ordinal);
+        Skip(json, ref index);
+        if (index < json.Length && json[index] == '}') { index++; return; }
+        while (true)
+        {
+            Skip(json, ref index);
+            if (index >= json.Length || json[index] != '"') throw new InvalidDataException("object key");
+            string name = ParseString(json, ref index);
+            if (!names.Add(name)) throw new InvalidDataException("duplicate object member: " + name);
+            Skip(json, ref index);
+            if (index >= json.Length || json[index] != ':') throw new InvalidDataException("object colon");
+            index++;
+            ParseValue(json, ref index, depth);
+            Skip(json, ref index);
+            if (index >= json.Length) throw new InvalidDataException("object end");
+            if (json[index] == '}') { index++; return; }
+            if (json[index] != ',') throw new InvalidDataException("object comma");
+            index++;
+        }
+    }
+
+    private static void ParseArray(string json, ref int index, int depth)
+    {
+        index++;
+        Skip(json, ref index);
+        if (index < json.Length && json[index] == ']') { index++; return; }
+        while (true)
+        {
+            ParseValue(json, ref index, depth);
+            Skip(json, ref index);
+            if (index >= json.Length) throw new InvalidDataException("array end");
+            if (json[index] == ']') { index++; return; }
+            if (json[index] != ',') throw new InvalidDataException("array comma");
+            index++;
+        }
+    }
+
+    private static string ParseString(string json, ref int index)
+    {
+        if (json[index] != '"') throw new InvalidDataException("string start");
+        index++;
+        var value = new StringBuilder();
+        while (index < json.Length)
+        {
+            char c = json[index++];
+            if (c == '"') return value.ToString();
+            if (c < 0x20) throw new InvalidDataException("string control");
+            if (c != '\\') { value.Append(c); continue; }
+            if (index >= json.Length) throw new InvalidDataException("string escape");
+            char escaped = json[index++];
+            switch (escaped)
+            {
+                case '"': value.Append('"'); break;
+                case '\\': value.Append('\\'); break;
+                case '/': value.Append('/'); break;
+                case 'b': value.Append('\b'); break;
+                case 'f': value.Append('\f'); break;
+                case 'n': value.Append('\n'); break;
+                case 'r': value.Append('\r'); break;
+                case 't': value.Append('\t'); break;
+                case 'u':
+                    if (index + 4 > json.Length) throw new InvalidDataException("unicode escape");
+                    int code;
+                    if (!Int32.TryParse(json.Substring(index, 4), NumberStyles.AllowHexSpecifier, CultureInfo.InvariantCulture, out code)) throw new InvalidDataException("unicode escape");
+                    value.Append((char)code); index += 4; break;
+                default: throw new InvalidDataException("unknown escape");
+            }
+        }
+        throw new InvalidDataException("unterminated string");
+    }
+
+    private static void Skip(string json, ref int index)
+    {
+        while (index < json.Length && Char.IsWhiteSpace(json[index])) index++;
+    }
+}
+'@
+}
+
+function Assert-CcodSetupUniqueJsonMembers {
+    param([Parameter(Mandatory)][string]$Json,[Parameter(Mandatory)]$Target)
+    try {
+        Initialize-CcodSetupJsonMemberScanner
+        [CcodSetupJsonMemberScannerV1]::AssertUnique($Json)
+    } catch {
+        Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'JSON contains duplicate members or is outside the bounded raw schema' $Target
+    }
+}
+
 function Get-CcodSetupDescription {
     param([Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$Version)
     return "CCODSETUP $Version"
@@ -261,8 +387,10 @@ function Test-CcodSealedSetupBuildProvenance {
     $compiler=Assert-CcodSetupRegularFile $CompilerPath 'Inno compiler'
     try {
         $raw=[IO.File]::ReadAllText($path,[Text.UTF8Encoding]::new($false))
+        Assert-CcodSetupUniqueJsonMembers -Json $raw -Target $path
         $record=$raw|ConvertFrom-Json -ErrorAction Stop
         $manifestRaw=[IO.File]::ReadAllText($manifest,[Text.UTF8Encoding]::new($false))
+        Assert-CcodSetupUniqueJsonMembers -Json $manifestRaw -Target $manifest
         $packageManifest=$manifestRaw|ConvertFrom-Json -ErrorAction Stop
     } catch { Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Sealed Setup provenance or package manifest JSON is invalid' $path }
 
diff --git a/src/persistence/modules/PortableRelease.psm1 b/src/persistence/modules/PortableRelease.psm1
index 859d1bd..c896c5f 100644
--- a/src/persistence/modules/PortableRelease.psm1
+++ b/src/persistence/modules/PortableRelease.psm1
@@ -356,7 +356,9 @@ function Copy-CcodPortablePayload {
         Clear-CcodPortableReleaseZoneIdentifier -Path $installedManifestPath
         Test-CcodPortablePayloadManifest -PayloadRoot $staging -ManifestPath $installedManifestPath -ExpectedVersion $manifest.Version -ExpectedGitCommit $manifest.GitCommit -AllowInstalledMetadata | Out-Null
         [IO.Directory]::Move($staging,$target)
-        return [pscustomobject][ordered]@{ InstallerRoot=$target; Manifest=$manifest }
+        $publishedManifestPath = Join-Path $target 'portable-payload-manifest.json'
+        $publishedManifest = Test-CcodPortablePayloadManifest -PayloadRoot $target -ManifestPath $publishedManifestPath -ExpectedVersion $manifest.Version -ExpectedGitCommit $manifest.GitCommit -AllowInstalledMetadata
+        return [pscustomobject][ordered]@{ InstallerRoot=$target; Manifest=$publishedManifest }
     } catch {
         if ([IO.Directory]::Exists($staging)) {
             try { Remove-Item -LiteralPath $staging -Recurse -Force -ErrorAction Stop } catch { }
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 22b5bb1..5287b07 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -264,6 +264,46 @@ function New-CcodPortableReleaseFixture {
     return [pscustomobject]@{Root=$root;Bundle=$bundle;Checksum=$checksum;PayloadManifest=$payloadAsset;Manifest=$manifest}
 }
 
+function Get-CcodReadOnlyProductTreeSnapshot {
+    param(
+        [Parameter(Mandatory)][string]$Root,
+        [int]$MaximumEntries=8192,
+        [long]$MaximumFileBytes=268435456,
+        [long]$MaximumTotalBytes=1073741824
+    )
+    $full=[IO.Path]::GetFullPath($Root).TrimEnd('\')
+    if([IO.File]::Exists($full)){throw 'CCOD_TEST_PRODUCT_SNAPSHOT_UNSAFE'}
+    if(-not[IO.Directory]::Exists($full)){
+        return [pscustomobject][ordered]@{root=$full;exists=$false;rootAttributes=$null;rootCreationTimeUtc=$null;rootLastWriteTimeUtc=$null;entryCount=0;totalBytes=[long]0;records=@()}
+    }
+    $rootItem=Get-Item -LiteralPath $full -Force -ErrorAction Stop
+    if(-not$rootItem.PSIsContainer-or($rootItem.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){throw 'CCOD_TEST_PRODUCT_SNAPSHOT_UNSAFE'}
+    $prefix=$full+'\';$pending=[Collections.Generic.Stack[string]]::new();$pending.Push($full);$records=[Collections.Generic.List[object]]::new();$seen=[Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase);$total=[long]0
+    while($pending.Count-gt0){
+        $directory=$pending.Pop()
+        foreach($item in @(Get-ChildItem -LiteralPath $directory -Force -ErrorAction Stop)){
+            if($records.Count-ge$MaximumEntries){throw 'CCOD_TEST_PRODUCT_SNAPSHOT_UNSAFE'}
+            $path=[IO.Path]::GetFullPath($item.FullName)
+            if(-not$path.StartsWith($prefix,[StringComparison]::OrdinalIgnoreCase)-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){throw 'CCOD_TEST_PRODUCT_SNAPSHOT_UNSAFE'}
+            $relative=$path.Substring($prefix.Length).Replace('\','/')
+            if([string]::IsNullOrWhiteSpace($relative)-or-not$seen.Add($relative)){throw 'CCOD_TEST_PRODUCT_SNAPSHOT_UNSAFE'}
+            if($item.PSIsContainer){
+                $records.Add([pscustomobject][ordered]@{path=$relative;kind='directory';attributes=[int]$item.Attributes;creationTimeUtc=$item.CreationTimeUtc.ToString('o',[Globalization.CultureInfo]::InvariantCulture);lastWriteTimeUtc=$item.LastWriteTimeUtc.ToString('o',[Globalization.CultureInfo]::InvariantCulture);length=$null;sha256=$null})
+                $pending.Push($path)
+            }else{
+                $length=[long]$item.Length
+                if($length-lt0-or$length-gt$MaximumFileBytes-or$total-gt($MaximumTotalBytes-$length)){throw 'CCOD_TEST_PRODUCT_SNAPSHOT_UNSAFE'}
+                $total+=$length
+                try{$streams=@(Get-Item -LiteralPath $path -Stream * -ErrorAction Stop|Where-Object{[string]$_.Stream-cnotin@(':$DATA','::$DATA','$DATA')})}catch{throw 'CCOD_TEST_PRODUCT_SNAPSHOT_UNSAFE'}
+                if($streams.Count-ne0){throw 'CCOD_TEST_PRODUCT_SNAPSHOT_UNSAFE'}
+                $records.Add([pscustomobject][ordered]@{path=$relative;kind='file';attributes=[int]$item.Attributes;creationTimeUtc=$item.CreationTimeUtc.ToString('o',[Globalization.CultureInfo]::InvariantCulture);lastWriteTimeUtc=$item.LastWriteTimeUtc.ToString('o',[Globalization.CultureInfo]::InvariantCulture);length=$length;sha256=Get-CcodTestFileSha256 -Path $path})
+            }
+        }
+    }
+    $comparison=[System.Comparison[object]]{param($left,$right)[StringComparer]::Ordinal.Compare([string]$left.path,[string]$right.path)};$records.Sort($comparison)
+    return [pscustomobject][ordered]@{root=$full;exists=$true;rootAttributes=[int]$rootItem.Attributes;rootCreationTimeUtc=$rootItem.CreationTimeUtc.ToString('o',[Globalization.CultureInfo]::InvariantCulture);rootLastWriteTimeUtc=$rootItem.LastWriteTimeUtc.ToString('o',[Globalization.CultureInfo]::InvariantCulture);entryCount=$records.Count;totalBytes=$total;records=@($records)}
+}
+
 Invoke-CcodTest 'release defender tool exposes manifest and scan functions without a live scan' {
     Assert-CcodTrue (Test-Path -LiteralPath $defenderPath -PathType Leaf) 'Defender release gate exists'
     . $defenderPath -Library
@@ -1676,6 +1716,8 @@ Invoke-CcodTest 'compiled production Setup rejects a wrong package hash before a
         Assert-CcodTrue (Test-Path -LiteralPath $fixture.SetupPath -PathType Leaf) 'wrong-hash compiled Setup exists'
         Assert-CcodEqual ('0'*64) ([string]$fixture.BoundPackageSha256) 'fixture binds the deliberate wrong package hash'
         Assert-CcodEqual ('0'*64) ([string][Diagnostics.FileVersionInfo]::GetVersionInfo($fixture.SetupPath).LegalCopyright).Trim() 'compiled PE independently retains the wrong expected package hash'
+        $realProductRoot=Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)) 'CodexControlOtherDevices'
+        $productStateBefore=Get-CcodReadOnlyProductTreeSnapshot -Root $realProductRoot
         $appRoot=Join-Path $fixture.Root 'forbidden-app-output'
         $logPath=Join-Path $fixture.Root 'executed-setup.log'
         $arguments=@('/VERYSILENT','/SUPPRESSMSGBOXES','/NORESTART','/SP-',("/DIR=$appRoot"),("/LOG=$logPath"))
@@ -1683,14 +1725,15 @@ Invoke-CcodTest 'compiled production Setup rejects a wrong package hash before a
         $process=[Diagnostics.Process]::new();$process.StartInfo=$startInfo
         Assert-CcodTrue $process.Start() 'wrong-hash compiled Setup starts'
         Assert-CcodTrue $process.WaitForExit(20000) 'wrong-hash compiled Setup exits within the pre-activation bound'
+        $productStateAfter=Get-CcodReadOnlyProductTreeSnapshot -Root $realProductRoot
         Assert-CcodTrue (Test-Path -LiteralPath $logPath -PathType Leaf) 'executed Setup emits its isolated runtime log'
         $log=[IO.File]::ReadAllText($logPath,[Text.UTF8Encoding]::new($false))
         Assert-CcodTrue ([int]$process.ExitCode-ne0) "wrong-hash compiled Setup fails closed: exit=$([int]$process.ExitCode) log=$($log.Substring([Math]::Max(0,$log.Length-1000)))"
         Assert-CcodTrue ($log-cmatch 'CCOD_SETUP_INPUT_BINDING_INVALID') 'runtime CurStepChanged reports the package hash/lock barrier failure'
         Assert-CcodTrue (-not(Test-Path -LiteralPath $fixture.ActivationMarker)) 'temporary activation bootstrap never executes'
         Assert-CcodTrue (-not(Test-Path -LiteralPath $appRoot)) 'CreateAppDir=no leaves no app product output'
-        $realProductRoot=Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)) 'CodexControlOtherDevices'
         Assert-CcodTrue ($log.IndexOf($realProductRoot,[StringComparison]::OrdinalIgnoreCase)-lt0) 'failure log never reaches the real LocalAppData product root'
+        Assert-CcodEqual ($productStateBefore|ConvertTo-Json -Depth 8 -Compress) ($productStateAfter|ConvertTo-Json -Depth 8 -Compress) 'actual LocalAppData product tree is byte-and-metadata unchanged'
     } finally {
         if($null-ne$process){try{if(-not$process.HasExited){$process.Kill();[void]$process.WaitForExit(5000)}}catch{};$process.Dispose()}
         if(Test-Path -LiteralPath $fixture.Root){Remove-Item -LiteralPath $fixture.Root -Recurse -Force -ErrorAction SilentlyContinue}
@@ -1785,6 +1828,27 @@ Invoke-CcodTest 'sealed Setup provenance rejects every field type name length co
             Assert-CcodTrue ($null-ne$failure) "provenance mutation is rejected: $($mutation.Name)"
             Assert-CcodTrue ($failure.FullyQualifiedErrorId-like'CCOD_SETUP_PROVENANCE_INVALID*') "provenance mutation has the bounded code: $($mutation.Name)"
         }
+        $rawProvenance=[IO.File]::ReadAllText($provenance,[Text.UTF8Encoding]::new($false))
+        $duplicatePatterns=@(
+            [pscustomobject]@{Name='top';Pattern='(?s)^\s*\{\s*(?<member>"schemaVersion"\s*:\s*2)'},
+            [pscustomobject]@{Name='installerPackage';Pattern='(?s)"installerPackage"\s*:\s*\{\s*(?<member>"name"\s*:\s*"[^"]+")'},
+            [pscustomobject]@{Name='installerPackageManifest';Pattern='(?s)"installerPackageManifest"\s*:\s*\{\s*(?<member>"name"\s*:\s*"[^"]+")'},
+            [pscustomobject]@{Name='activationBootstrap';Pattern='(?s)"activationBootstrap"\s*:\s*\{\s*(?<member>"name"\s*:\s*"[^"]+")'},
+            [pscustomobject]@{Name='buildInputs';Pattern='(?s)"buildInputs"\s*:\s*\{\s*(?<member>"innoTemplateSha256"\s*:\s*"[^"]+")'},
+            [pscustomobject]@{Name='peContract';Pattern='(?s)"peContract"\s*:\s*\{\s*(?<member>"fileVersion"\s*:\s*"[^"]+")'}
+        )
+        foreach($duplicate in $duplicatePatterns){
+            $match=[regex]::Match($rawProvenance,$duplicate.Pattern)
+            Assert-CcodTrue ($match.Success-and$match.Groups['member'].Success) "duplicate mutation locates object: $($duplicate.Name)"
+            $member=$match.Groups['member'].Value
+            $duplicateRaw=$rawProvenance.Insert($match.Groups['member'].Index+$match.Groups['member'].Length,(','+$member))
+            $mutated=Join-Path $fixture.Root ("provenance-duplicate-$($duplicate.Name).json")
+            [IO.File]::WriteAllText($mutated,$duplicateRaw,[Text.UTF8Encoding]::new($false))
+            $failure=$null
+            try{Test-CcodSealedSetupBuildProvenance -ProvenancePath $mutated @arguments|Out-Null}catch{$failure=$_}
+            Assert-CcodTrue ($null-ne$failure) "raw duplicate provenance member is rejected: $($duplicate.Name)"
+            Assert-CcodTrue ($failure.FullyQualifiedErrorId-like'CCOD_SETUP_PROVENANCE_INVALID*') "raw duplicate provenance member has bounded code: $($duplicate.Name)"
+        }
     } finally {
         if(Test-Path -LiteralPath $fixture.Root){Remove-Item -LiteralPath $fixture.Root -Recurse -Force -ErrorAction SilentlyContinue}
     }
@@ -2625,12 +2689,12 @@ param([string]`$InstallRoot,[switch]`$EnableCandidateCompatibleUpdates,[switch]`
 "@
         [IO.File]::WriteAllText($child,$childSource,[Text.UTF8Encoding]::new($false))
         $verified='a'*64
-        $receipt=&$module {param($Path,$Root,$Identity)Invoke-CcodPortableLifecycleInstaller -InstallerPath $Path -InstallRoot $Root -VerifiedSealedPackageSha256 $Identity -ExpectedSealedPackageSha256 $Identity} $child $root $verified
+        $receipt=&$module {param($Path,$Root,$Identity)Invoke-CcodPortableLifecycleInstaller -InstallerPath $Path -InstallRoot $Root -CopiedSealedPackageSha256 $Identity -InitialSealedPackageSha256 $Identity -RevalidatedSourceSealedPackageSha256 $Identity} $child $root $verified
         Assert-CcodEqual 'runtime-fixture' ([string]$receipt.RuntimeId) 'portable helper returns the exact child receipt'
         Assert-CcodEqual $verified ([IO.File]::ReadAllText($marker,[Text.UTF8Encoding]::new($false))) 'exact verified identity reaches the lifecycle child'
         Remove-Item -LiteralPath $marker -Force
         Assert-CcodThrows {
-            &$module {param($Path,$Root,$Verified,$Expected)Invoke-CcodPortableLifecycleInstaller -InstallerPath $Path -InstallRoot $Root -VerifiedSealedPackageSha256 $Verified -ExpectedSealedPackageSha256 $Expected} $child $root ('b'*64) $verified | Out-Null
+            &$module {param($Path,$Root,$Copied,$Expected)Invoke-CcodPortableLifecycleInstaller -InstallerPath $Path -InstallRoot $Root -CopiedSealedPackageSha256 $Copied -InitialSealedPackageSha256 $Expected -RevalidatedSourceSealedPackageSha256 $Expected} $child $root ('b'*64) $verified | Out-Null
         } 'CCOD_PORTABLE_PACKAGE_IDENTITY_INVALID'
         Assert-CcodTrue (-not(Test-Path -LiteralPath $marker)) 'changed identity fails before lifecycle child mutation'
     } finally {
@@ -2639,4 +2703,39 @@ param([string]`$InstallRoot,[switch]`$EnableCandidateCompatibleUpdates,[switch]`
     }
 }
 
+# Production mutation caught: source bytes change after manifest validation but before the full portable copy path executes.
+Invoke-CcodTest 'portable full copy path rejects a validation-to-copy source race before child or lifecycle state' {
+    $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-portable-copy-race-'+[guid]::NewGuid().ToString('N'))
+    $module=$null;$breakpoint=$null
+    try {
+        $payload=Join-Path $root 'payload';[IO.Directory]::CreateDirectory($payload)|Out-Null
+        $sourceFile=Join-Path $payload 'Install-CodexControlOtherDevices.ps1'
+        [IO.File]::WriteAllText($sourceFile,'original-child-bytes',[Text.UTF8Encoding]::new($false))
+        $sha=Get-CcodTestFileSha256 -Path $sourceFile
+        $manifestPath=Join-Path $root 'payload-manifest.json'
+        $manifest=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version='2.5.22';gitCommit=('a'*40);buildTimestampUtc='2030-02-03T04:05:06.0000000Z';files=@([ordered]@{path='Install-CodexControlOtherDevices.ps1';length=[int64](Get-Item $sourceFile).Length;sha256=$sha})}
+        [IO.File]::WriteAllText($manifestPath,(($manifest|ConvertTo-Json -Depth 8)+[Environment]::NewLine),[Text.UTF8Encoding]::new($false))
+        $modulePath=Join-Path $repositoryRoot 'src\persistence\modules\PortableRelease.psm1'
+        $module=Import-Module $modulePath -Force -PassThru
+        $target=Join-Path $root 'copied-installer'
+        &$module {param($ExpectedRoot)Set-Item -Path Function:Get-CcodPortableReleaseExpectedInstallerRoot -Value { $ExpectedRoot }.GetNewClosure()} $target
+        $line=@(Select-String -Path $modulePath -Pattern '^\s*\[IO\.File\]::Copy\(\$sourceFile,\$destination,\$false\)'|ForEach-Object{$_.LineNumber})
+        Assert-CcodEqual 1 $line.Count 'portable production copy barrier is unique'
+        $attack=[pscustomobject]@{Ran=$false}
+        $action={if(-not$attack.Ran){$attack.Ran=$true;[IO.File]::WriteAllText($sourceFile,'raced-child-bytes',[Text.UTF8Encoding]::new($false))}}.GetNewClosure()
+        $breakpoint=Set-PSBreakpoint -Script $modulePath -Line $line[0] -Action $action
+        $failure=$null
+        try{Copy-CcodPortablePayload -PayloadRoot $payload -ManifestPath $manifestPath -InstallerRoot $target|Out-Null}catch{$failure=$_}
+        Assert-CcodTrue $attack.Ran 'source race runs after validation at the production copy barrier'
+        Assert-CcodTrue ($null-ne$failure-and$failure.FullyQualifiedErrorId-like'CCOD_PORTABLE_COPY_HASH_MISMATCH*') 'raced source fails with the bounded copied-byte hash code'
+        Assert-CcodTrue (-not(Test-Path -LiteralPath $target)) 'raced copy publishes no installer root'
+        Assert-CcodTrue (-not(Test-Path -LiteralPath (Join-Path $root 'child-executed.txt'))) 'raced copy executes no lifecycle child'
+        Assert-CcodTrue (-not(Test-Path -LiteralPath (Join-Path $root 'lifecycle-state'))) 'raced copy creates no lifecycle state'
+    } finally {
+        if($null-ne$breakpoint){Remove-PSBreakpoint -Breakpoint $breakpoint -ErrorAction SilentlyContinue}
+        if($null-ne$module){Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue}
+        if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue}
+    }
+}
+
 Write-Host 'Release workflow self-tests passed.'

From a5d595892f134a5ef957feab4ec4e68228cec97b Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 16:35:52 +0800
Subject: [PATCH 090/187] docs: record portable sealed evidence

---
 .../task-3-report.md                          | 65 +++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md
index affe544..de04247 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md
@@ -161,3 +161,68 @@ failed with four Important findings.
 
 - `51def5c9ae2f5e0722b9083e478b17c507e9cee8`
   (`fix: harden sealed setup evidence`).
+
+## Fix round 2: copied portable identity and raw evidence binding
+
+### Review findings and RED evidence
+
+Scoped review of
+`9e1c41c72d296c2d0c014a45561a855699ebd39b..728b62710c0729b40908e92887d3fe70903edbba`
+remained FAIL with three Important findings.
+
+- Copied portable identity RED: `ReleaseWorkflow.SelfTest.ps1` exited `1`
+  with `NamedParameterNotFound` for `CopiedSealedPackageSha256`. The wrapper
+  still used a source identity and `Copy-CcodPortablePayload` returned its
+  pre-copy manifest result rather than an identity revalidated from the
+  published target.
+- Raw provenance RED: a top-level duplicate `schemaVersion` member remained
+  accepted because Windows PowerShell `ConvertFrom-Json` collapsed it before
+  the parsed-object exact-schema checks.
+- Product-state evidence RED: the executed wrong-hash Setup fixture exited `1`
+  because `Get-CcodReadOnlyProductTreeSnapshot` did not exist. The prior test
+  checked only its isolated `/DIR`, marker, and log rather than comparing the
+  actual current-user product root.
+
+### Remediated behavior
+
+- `Copy-CcodPortablePayload` now validates the moved published installer tree
+  and returns that copied manifest identity. The portable wrapper requires the
+  initial source, post-Defender source, and copied identities to be the same
+  canonical SHA-256, and only the copied value reaches the lifecycle child.
+- A production-module breakpoint regression changes source bytes exactly
+  between manifest validation and `File.Copy`. Destination rehashing returns
+  `CCOD_PORTABLE_COPY_HASH_MISMATCH`; no installer root, lifecycle child, or
+  lifecycle state becomes visible.
+- A bounded raw JSON scanner walks objects and arrays before any provenance or
+  package-manifest `ConvertFrom-Json`, decodes escaped property names, rejects
+  duplicate semantic member names at every depth, and enforces 1 MiB / depth
+  32 limits. Duplicate mutations at the top level and all five nested
+  provenance objects fail with `CCOD_SETUP_PROVENANCE_INVALID` while the prior
+  24 exact-schema mutations remain covered.
+- The wrong-hash production Setup fixture now snapshots the exact LocalAppData
+  product root before and after execution. The read-only snapshot manually
+  traverses without following reparse points, rejects alternate streams, is
+  bounded to 8192 entries / 256 MiB per file / 1 GiB total, and records root/
+  directory metadata plus file metadata and SHA-256. Before and after canonical
+  snapshots are identical. Fixture cleanup still targets only its unique temp
+  root and never creates, modifies, or removes the real product root.
+
+### GREEN and verification evidence
+
+- Final `ReleaseWorkflow.SelfTest.ps1`: exit `0`, including copied-identity,
+  full copy-race, six-level raw duplicate, and actual product-tree snapshot
+  coverage.
+- Final `InstallLifecycle.SelfTest.ps1`: exit `0`;
+  `Install lifecycle self-tests passed: 113`.
+- Explicit parser checks passed all four changed PowerShell code/test files.
+- `git diff --check` exited `0`; only checkout LF-to-CRLF warnings were emitted.
+- Static no-`{app}` audit reported `FIX2_BOUNDARY_VIOLATIONS=0`.
+- No aggregate run was performed in this fix round; no aggregate-pass claim is
+  made.
+- No release build, real install, product-process control, external service,
+  WindowsApps, DPAPI operation, signing, push, tag, or publication occurred.
+
+### Exact implementation commit
+
+- `1cb91621f2565318143dffe08844a91a350a36d9`
+  (`fix: bind portable sealed execution`).

From 58bd7603fa83133d78d2f62ac045ec00d25134c9 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 17:01:19 +0800
Subject: [PATCH 091/187] test: exercise portable sealed race end to end

---
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 52 +++++++++----------
 1 file changed, 25 insertions(+), 27 deletions(-)

diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 5287b07..19249d5 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -2703,37 +2703,35 @@ param([string]`$InstallRoot,[switch]`$EnableCandidateCompatibleUpdates,[switch]`
     }
 }
 
-# Production mutation caught: source bytes change after manifest validation but before the full portable copy path executes.
-Invoke-CcodTest 'portable full copy path rejects a validation-to-copy source race before child or lifecycle state' {
-    $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-portable-copy-race-'+[guid]::NewGuid().ToString('N'))
-    $module=$null;$breakpoint=$null
+# Production mutation caught: the real portable entrypoint ignores a source race between initial validation and copy.
+Invoke-CcodTest 'actual portable entrypoint rejects a validation-to-copy race before child or lifecycle state' {
+    $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-portable-entry-race-'+[guid]::NewGuid().ToString('N'))
     try {
-        $payload=Join-Path $root 'payload';[IO.Directory]::CreateDirectory($payload)|Out-Null
-        $sourceFile=Join-Path $payload 'Install-CodexControlOtherDevices.ps1'
-        [IO.File]::WriteAllText($sourceFile,'original-child-bytes',[Text.UTF8Encoding]::new($false))
-        $sha=Get-CcodTestFileSha256 -Path $sourceFile
-        $manifestPath=Join-Path $root 'payload-manifest.json'
-        $manifest=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version='2.5.22';gitCommit=('a'*40);buildTimestampUtc='2030-02-03T04:05:06.0000000Z';files=@([ordered]@{path='Install-CodexControlOtherDevices.ps1';length=[int64](Get-Item $sourceFile).Length;sha256=$sha})}
-        [IO.File]::WriteAllText($manifestPath,(($manifest|ConvertTo-Json -Depth 8)+[Environment]::NewLine),[Text.UTF8Encoding]::new($false))
-        $modulePath=Join-Path $repositoryRoot 'src\persistence\modules\PortableRelease.psm1'
-        $module=Import-Module $modulePath -Force -PassThru
-        $target=Join-Path $root 'copied-installer'
-        &$module {param($ExpectedRoot)Set-Item -Path Function:Get-CcodPortableReleaseExpectedInstallerRoot -Value { $ExpectedRoot }.GetNewClosure()} $target
-        $line=@(Select-String -Path $modulePath -Pattern '^\s*\[IO\.File\]::Copy\(\$sourceFile,\$destination,\$false\)'|ForEach-Object{$_.LineNumber})
-        Assert-CcodEqual 1 $line.Count 'portable production copy barrier is unique'
+        $payload=Join-Path $root 'payload';$modules=Join-Path $payload 'src\persistence\modules';[IO.Directory]::CreateDirectory($modules)|Out-Null
+        $entrypoint=Join-Path $root 'Install-CodexRemote-fix.ps1'
+        [IO.File]::Copy((Join-Path $repositoryRoot 'Install-CodexRemote-fix.ps1'),$entrypoint,$false)
+        Assert-CcodEqual (Get-CcodTestFileSha256 -Path (Join-Path $repositoryRoot 'Install-CodexRemote-fix.ps1')) (Get-CcodTestFileSha256 -Path $entrypoint) 'fixture invokes an exact copy of the production portable entrypoint'
+        [IO.File]::Copy((Join-Path $repositoryRoot 'src\persistence\modules\PortableRelease.psm1'),(Join-Path $modules 'PortableRelease.psm1'),$false)
+        [IO.File]::WriteAllText((Join-Path $payload 'package.json'),'{"version":"2.5.22"}',[Text.UTF8Encoding]::new($false))
+        $childMarker=Join-Path $root 'child-executed.txt';$lifecycleRoot=Join-Path $root 'lifecycle-state';$child=Join-Path $payload 'Install-CodexControlOtherDevices.ps1'
+        $childSource="param([string]`$InstallRoot,[string]`$SealedPackageSha256);[IO.Directory]::CreateDirectory('$($lifecycleRoot.Replace("'","''"))')|Out-Null;[IO.File]::WriteAllText('$($childMarker.Replace("'","''"))',[string]`$SealedPackageSha256,[Text.UTF8Encoding]::new(`$false));[pscustomobject]@{Outcome='Installed';RuntimeId='should-not-run'}"
+        [IO.File]::WriteAllText($child,$childSource,[Text.UTF8Encoding]::new($false))
+        $records=[Collections.Generic.List[object]]::new()
+        foreach($file in @(Get-ChildItem -LiteralPath $payload -File -Force -Recurse)){$relative=$file.FullName.Substring($payload.TrimEnd('\').Length+1).Replace('\','/');$records.Add([pscustomobject][ordered]@{path=$relative;length=[int64]$file.Length;sha256=Get-CcodTestFileSha256 -Path $file.FullName})}
+        $comparison=[System.Comparison[object]]{param($left,$right)[StringComparer]::Ordinal.Compare([string]$left.path,[string]$right.path)};$records.Sort($comparison)
+        $manifest=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version='2.5.22';gitCommit=('a'*40);buildTimestampUtc='2030-02-03T04:05:06.0000000Z';files=@($records)}
+        [IO.File]::WriteAllText((Join-Path $root 'payload-manifest.json'),(($manifest|ConvertTo-Json -Depth 8)+[Environment]::NewLine),[Text.UTF8Encoding]::new($false))
         $attack=[pscustomobject]@{Ran=$false}
-        $action={if(-not$attack.Ran){$attack.Ran=$true;[IO.File]::WriteAllText($sourceFile,'raced-child-bytes',[Text.UTF8Encoding]::new($false))}}.GetNewClosure()
-        $breakpoint=Set-PSBreakpoint -Script $modulePath -Line $line[0] -Action $action
+        function Get-MpComputerStatus {[pscustomobject]@{AMProductVersion='fixture-platform';AntivirusSignatureVersion='fixture-signature';RealTimeProtectionEnabled=$true}}
+        function Get-MpThreatDetection {param($ErrorAction)@()}
+        function Start-MpScan {param($ScanType,$ScanPath,$ErrorAction)$attack.Ran=$true;[IO.File]::WriteAllText($child,'raced-child-source',[Text.UTF8Encoding]::new($false))}
         $failure=$null
-        try{Copy-CcodPortablePayload -PayloadRoot $payload -ManifestPath $manifestPath -InstallerRoot $target|Out-Null}catch{$failure=$_}
-        Assert-CcodTrue $attack.Ran 'source race runs after validation at the production copy barrier'
-        Assert-CcodTrue ($null-ne$failure-and$failure.FullyQualifiedErrorId-like'CCOD_PORTABLE_COPY_HASH_MISMATCH*') 'raced source fails with the bounded copied-byte hash code'
-        Assert-CcodTrue (-not(Test-Path -LiteralPath $target)) 'raced copy publishes no installer root'
-        Assert-CcodTrue (-not(Test-Path -LiteralPath (Join-Path $root 'child-executed.txt'))) 'raced copy executes no lifecycle child'
-        Assert-CcodTrue (-not(Test-Path -LiteralPath (Join-Path $root 'lifecycle-state'))) 'raced copy creates no lifecycle state'
+        try{&$entrypoint -DoNotStart|Out-Null}catch{$failure=$_}
+        Assert-CcodTrue $attack.Ran 'controlled source mutation runs after initial entrypoint validation during its Defender gate'
+        Assert-CcodTrue ($null-ne$failure-and$failure.FullyQualifiedErrorId-like'CCOD_PORTABLE_MANIFEST_INVALID*') 'actual entrypoint rejects the raced source at revalidation'
+        Assert-CcodTrue (-not(Test-Path -LiteralPath $childMarker)) 'actual entrypoint never executes the marker child'
+        Assert-CcodTrue (-not(Test-Path -LiteralPath $lifecycleRoot)) 'actual entrypoint creates no fixture lifecycle state'
     } finally {
-        if($null-ne$breakpoint){Remove-PSBreakpoint -Breakpoint $breakpoint -ErrorAction SilentlyContinue}
-        if($null-ne$module){Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue}
         if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue}
     }
 }

From 9e971d1fe26c0f60d8e8519318c11006798dc493 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 17:02:05 +0800
Subject: [PATCH 092/187] docs: record portable entrypoint race

---
 .../task-3-report.md                          | 49 +++++++++++++++++++
 1 file changed, 49 insertions(+)

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md
index de04247..3ace5ce 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md
@@ -226,3 +226,52 @@ remained FAIL with three Important findings.
 
 - `1cb91621f2565318143dffe08844a91a350a36d9`
   (`fix: bind portable sealed execution`).
+
+## Fix round 3: actual portable entrypoint race evidence
+
+### Review finding and RED evidence
+
+Scoped review of
+`728b62710c0729b40908e92887d3fe70903edbba..a5d595892f134a5ef957feab4ec4e68228cec97b`
+remained FAIL with one Important test-compliance finding. The race test invoked
+`Copy-CcodPortablePayload` directly inside the module and therefore did not
+prove that the real `Install-CodexRemote-fix.ps1` control flow stopped before
+its child and lifecycle boundaries. This review failure is the RED evidence;
+the production post-Defender revalidation behavior itself did not require a
+code change.
+
+### Remediated evidence
+
+- The replacement fixture copies the production
+  `Install-CodexRemote-fix.ps1` byte-for-byte and asserts the copy hash before
+  invoking that actual script path.
+- It uses the production `PortableRelease.psm1`, a valid manifest, and an
+  isolated child installer that would create both a marker and fixture
+  lifecycle directory if execution reached it.
+- Test-local Defender commands remain entirely inside the fixture process.
+  `Start-MpScan` changes the child source after the entrypoint's initial
+  manifest validation and before its copy boundary.
+- The actual entrypoint returns `CCOD_PORTABLE_MANIFEST_INVALID` from its
+  post-Defender `Test-CcodPortablePayloadManifest` call. Only after it returns,
+  the test proves the marker and fixture lifecycle root are both absent.
+- The helper identity test remains as unit coverage, but no helper-only race
+  test is claimed as end-to-end evidence.
+
+### GREEN and verification evidence
+
+- Final `ReleaseWorkflow.SelfTest.ps1`: exit `0`; the named actual-entrypoint
+  validation-to-copy race case passed.
+- Final `InstallLifecycle.SelfTest.ps1`: exit `0`;
+  `Install lifecycle self-tests passed: 113`.
+- The changed PowerShell test file parsed with zero errors (`1/1`).
+- `git diff --check` exited `0`; only the checkout LF-to-CRLF warning was
+  emitted.
+- No aggregate run was performed in this fix round; no aggregate-pass claim is
+  made.
+- No external release, push, tag, signing, install, product-process,
+  WindowsApps, or DPAPI action occurred.
+
+### Exact implementation commit
+
+- `58bd7603fa83133d78d2f62ac045ec00d25134c9`
+  (`test: exercise portable sealed race end to end`).

From 141ab716001e7c1048db10e248101fa8cd3f54ae Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 17:39:06 +0800
Subject: [PATCH 093/187] test: exercise portable copy barrier race

---
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 62 ++++++++++++++++++-
 1 file changed, 60 insertions(+), 2 deletions(-)

diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 19249d5..d6f0e61 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -2703,8 +2703,8 @@ param([string]`$InstallRoot,[switch]`$EnableCandidateCompatibleUpdates,[switch]`
     }
 }
 
-# Production mutation caught: the real portable entrypoint ignores a source race between initial validation and copy.
-Invoke-CcodTest 'actual portable entrypoint rejects a validation-to-copy race before child or lifecycle state' {
+# Production mutation caught: the real portable entrypoint revalidates source bytes after Defender before copying them.
+Invoke-CcodTest 'actual portable entrypoint rejects a post-Defender source mutation before child or lifecycle state' {
     $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-portable-entry-race-'+[guid]::NewGuid().ToString('N'))
     try {
         $payload=Join-Path $root 'payload';$modules=Join-Path $payload 'src\persistence\modules';[IO.Directory]::CreateDirectory($modules)|Out-Null
@@ -2736,4 +2736,62 @@ Invoke-CcodTest 'actual portable entrypoint rejects a validation-to-copy race be
     }
 }
 
+# Production mutation caught: the real portable entrypoint ignores a child-source race at the final File.Copy barrier.
+Invoke-CcodTest 'actual portable entrypoint rejects the final File.Copy barrier race before child or lifecycle state' {
+    $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-portable-entry-copy-race-'+[guid]::NewGuid().ToString('N'))
+    $redirectBreakpoint=$null;$copyBreakpoint=$null
+    try {
+        $payload=Join-Path $root 'payload';$modules=Join-Path $payload 'src\persistence\modules';[IO.Directory]::CreateDirectory($modules)|Out-Null
+        $entrypoint=Join-Path $root 'Install-CodexRemote-fix.ps1'
+        $productionEntrypoint=Join-Path $repositoryRoot 'Install-CodexRemote-fix.ps1'
+        [IO.File]::Copy($productionEntrypoint,$entrypoint,$false)
+        Assert-CcodEqual (Get-CcodTestFileSha256 -Path $productionEntrypoint) (Get-CcodTestFileSha256 -Path $entrypoint) 'copy-barrier fixture invokes an exact copy of the production portable entrypoint'
+        $portableModulePath=Join-Path $modules 'PortableRelease.psm1';$productionPortableModule=Join-Path $repositoryRoot 'src\persistence\modules\PortableRelease.psm1'
+        [IO.File]::Copy($productionPortableModule,$portableModulePath,$false)
+        Assert-CcodEqual (Get-CcodTestFileSha256 -Path $productionPortableModule) (Get-CcodTestFileSha256 -Path $portableModulePath) 'copy-barrier fixture uses an exact copy of the production portable module'
+        [IO.File]::WriteAllText((Join-Path $payload 'package.json'),'{'+'"version":"2.5.22"}',[Text.UTF8Encoding]::new($false))
+        $childMarker=Join-Path $root 'child-executed.txt';$fixtureInstallRoot=Join-Path $root 'fixture-install-root';$installerRoot=Join-Path $root 'copied-installer';$child=Join-Path $payload 'Install-CodexControlOtherDevices.ps1'
+        $childSource="param([string]`$InstallRoot,[switch]`$EnableCandidateCompatibleUpdates,[switch]`$DoNotStart,[string]`$SealedPackageSha256);[IO.Directory]::CreateDirectory('$($fixtureInstallRoot.Replace("'","''"))')|Out-Null;[IO.File]::WriteAllText('$($childMarker.Replace("'","''"))',[string]`$SealedPackageSha256,[Text.UTF8Encoding]::new(`$false));[pscustomobject]@{Outcome='Installed';RuntimeId='should-not-run'}"
+        [IO.File]::WriteAllText($child,$childSource,[Text.UTF8Encoding]::new($false))
+        $records=[Collections.Generic.List[object]]::new()
+        foreach($file in @(Get-ChildItem -LiteralPath $payload -File -Force -Recurse)){$relative=$file.FullName.Substring($payload.TrimEnd('\').Length+1).Replace('\','/');$records.Add([pscustomobject][ordered]@{path=$relative;length=[int64]$file.Length;sha256=Get-CcodTestFileSha256 -Path $file.FullName})}
+        $comparison=[System.Comparison[object]]{param($left,$right)[StringComparer]::Ordinal.Compare([string]$left.path,[string]$right.path)};$records.Sort($comparison)
+        Assert-CcodEqual 'Install-CodexControlOtherDevices.ps1' ([string]$records[0].path) 'fixture child reaches the first production payload File.Copy barrier'
+        $manifest=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version='2.5.22';gitCommit=('a'*40);buildTimestampUtc='2030-02-03T04:05:06.0000000Z';files=@($records)}
+        [IO.File]::WriteAllText((Join-Path $root 'payload-manifest.json'),(($manifest|ConvertTo-Json -Depth 8)+[Environment]::NewLine),[Text.UTF8Encoding]::new($false))
+        function Get-MpComputerStatus {[pscustomobject]@{AMProductVersion='fixture-platform';AntivirusSignatureVersion='fixture-signature';RealTimeProtectionEnabled=$true}}
+        function Get-MpThreatDetection {param($ErrorAction)@()}
+        function Start-MpScan {param($ScanType,$ScanPath,$ErrorAction)}
+        $barrier=[pscustomobject]@{InstallerRootRedirected=$false;SourceMutated=$false}
+        $entryCopyLine=@(Select-String -Path $entrypoint -Pattern '^\s*\$copied = Copy-CcodPortablePayload\b'|ForEach-Object{$_.LineNumber})
+        Assert-CcodEqual 1 $entryCopyLine.Count 'production entrypoint copy call is unique'
+        $redirectAction={
+            $module=@(Get-Module|Where-Object{$_.Path -ceq $portableModulePath})
+            if($module.Count-ne 1){throw 'CCOD_TEST_PORTABLE_MODULE_NOT_LOADED'}
+            &$module[0] {param($ExpectedRoot)Set-Item -Path Function:Get-CcodPortableReleaseExpectedInstallerRoot -Value { $ExpectedRoot }.GetNewClosure()} $installerRoot
+            $barrier.InstallerRootRedirected=$true
+        }.GetNewClosure()
+        $redirectBreakpoint=Set-PSBreakpoint -Script $entrypoint -Line $entryCopyLine[0] -Action $redirectAction
+        $moduleCopyLine=@(Select-String -Path $portableModulePath -Pattern '^\s*\[IO\.File\]::Copy\(\$sourceFile,\$destination,\$false\)'|ForEach-Object{$_.LineNumber})
+        Assert-CcodEqual 1 $moduleCopyLine.Count 'production portable payload File.Copy barrier is unique'
+        $copyAction={
+            [IO.File]::WriteAllText($child,'raced-child-source-at-final-copy-boundary',[Text.UTF8Encoding]::new($false))
+            $barrier.SourceMutated=$true
+        }.GetNewClosure()
+        $copyBreakpoint=Set-PSBreakpoint -Script $portableModulePath -Line $moduleCopyLine[0] -Action $copyAction
+        $failure=$null
+        try{&$entrypoint -DoNotStart|Out-Null}catch{$failure=$_}
+        Assert-CcodTrue $barrier.InstallerRootRedirected 'fixture redirects only the private installer-root dependency before the production copy call'
+        Assert-CcodTrue ($null-ne$failure-and$failure.FullyQualifiedErrorId-like'CCOD_PORTABLE_COPY_HASH_MISMATCH*') 'actual entrypoint rejects the source child changed at the production File.Copy barrier'
+        Assert-CcodTrue $barrier.SourceMutated 'source child changes only at the production File.Copy barrier'
+        Assert-CcodTrue (-not(Test-Path -LiteralPath $childMarker)) 'copy-barrier failure never executes the marker child'
+        Assert-CcodTrue (-not(Test-Path -LiteralPath $fixtureInstallRoot)) 'copy-barrier failure creates no fixture lifecycle install root'
+        Assert-CcodTrue (-not(Test-Path -LiteralPath $installerRoot)) 'copy-barrier failure publishes no fixture installer root'
+    } finally {
+        if($null-ne$copyBreakpoint){Remove-PSBreakpoint -Breakpoint $copyBreakpoint -ErrorAction SilentlyContinue}
+        if($null-ne$redirectBreakpoint){Remove-PSBreakpoint -Breakpoint $redirectBreakpoint -ErrorAction SilentlyContinue}
+        if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue}
+    }
+}
+
 Write-Host 'Release workflow self-tests passed.'

From 70bc23123be197b2ed34ac7fee334a91f319756d Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 17:39:59 +0800
Subject: [PATCH 094/187] docs: record portable copy barrier evidence

---
 .../task-3-report.md                          | 64 +++++++++++++++++++
 1 file changed, 64 insertions(+)

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md
index 3ace5ce..b6f6a20 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-3-report.md
@@ -275,3 +275,67 @@ code change.
 
 - `58bd7603fa83133d78d2f62ac045ec00d25134c9`
   (`test: exercise portable sealed race end to end`).
+
+## Fix round 4: final portable copy-barrier evidence
+
+### Review finding and RED evidence
+
+Scoped review of
+`a5d595892f134a5ef957feab4ec4e68228cec97b..9e971d1fe26c0f60d8e8519318c11006798dc493`
+remained FAIL with one Important test-compliance finding. The actual-entrypoint
+fixture changed its child during the mocked Defender gate, so the production
+post-Defender manifest revalidation returned
+`CCOD_PORTABLE_MANIFEST_INVALID`; it did not exercise the later validated
+source-to-`File.Copy` barrier.
+
+The unfinished fix-round-4 test was run before completion. The full
+`ReleaseWorkflow.SelfTest.ps1` exited `1` in
+`actual portable entrypoint rejects the final File.Copy barrier race before
+child or lifecycle state`: its
+`CCOD_PORTABLE_COPY_HASH_MISMATCH` assertion failed because the fixture never
+performed the intended source mutation and `SourceMutated` remained false.
+This was the expected RED for the missing test-local copy-boundary condition.
+
+### Remediated evidence
+
+- The fixture invokes a byte-identical temporary copy of the production
+  `Install-CodexRemote-fix.ps1` and uses a byte-identical temporary copy of the
+  production `PortableRelease.psm1`; both identities are asserted before the
+  entrypoint runs.
+- The existing test-local entrypoint breakpoint redirects only the module's
+  private expected-installer-root function to a new disposable fixture root.
+  No public production parameter or externally reachable test switch was
+  added.
+- The manifest order is asserted so the marker-capable child reaches the first
+  production payload copy boundary. A breakpoint on the copied module's unique
+  ordinary `[IO.File]::Copy($sourceFile,$destination,$false)` line writes
+  distinct child text after the module has validated its source record and
+  immediately before that production copy executes.
+- The production copy and destination SHA-256 comparison then run unchanged
+  and return `CCOD_PORTABLE_COPY_HASH_MISMATCH`. Only after the actual
+  entrypoint returns does the test prove that the child marker, fixture
+  lifecycle/install root, and published fixture installer root are all absent.
+- The separate post-Defender source-revalidation fixture remains intact and
+  continues to cover its earlier `CCOD_PORTABLE_MANIFEST_INVALID` boundary.
+
+### GREEN and verification evidence
+
+- Final `ReleaseWorkflow.SelfTest.ps1`: exit `0`; final output
+  `Release workflow self-tests passed.` The actual-entrypoint final
+  `File.Copy` barrier case passed.
+- Final `InstallLifecycle.SelfTest.ps1`: exit `0`; final output
+  `Install lifecycle self-tests passed: 113`.
+- The changed PowerShell test file parsed with zero errors (`1/1`).
+- `git diff --check` exited `0`; only the checkout LF-to-CRLF warning was
+  emitted.
+- No aggregate run was performed in this fix round; no aggregate-pass claim is
+  made.
+- No real installer, network, external action, listener, product process
+  control, release, push, tag, signing, install, WindowsApps, or DPAPI action
+  occurred. All new runtime files were temporary fixture files below a unique
+  disposable root.
+
+### Exact implementation commit
+
+- `141ab716001e7c1048db10e248101fa8cd3f54ae`
+  (`test: exercise portable copy barrier race`).

From e43d9ce18c5d79bb438e08c9ff2973be592277aa Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 18:52:08 +0800
Subject: [PATCH 095/187] feat: register product only after readiness

---
 Uninstall-CodexControlOtherDevices.ps1        |  18 ++
 src/persistence/UninstallBootstrap.ps1        |  19 ++
 .../modules/InstallFileTransaction.psm1       |  70 ++++-
 src/persistence/modules/InstallLifecycle.psm1 |  53 +++-
 .../modules/ProductRegistration.psm1          | 291 ++++++++++++++++++
 .../InstallFileTransaction.SelfTest.ps1       |   2 +-
 .../persistence/InstallLifecycle.SelfTest.ps1 |  41 ++-
 .../ProductRegistration.SelfTest.ps1          | 179 +++++++++++
 .../UninstallBootstrap.SelfTest.ps1           |  18 +-
 9 files changed, 677 insertions(+), 14 deletions(-)
 create mode 100644 src/persistence/modules/ProductRegistration.psm1
 create mode 100644 tests/persistence/ProductRegistration.SelfTest.ps1

diff --git a/Uninstall-CodexControlOtherDevices.ps1 b/Uninstall-CodexControlOtherDevices.ps1
index 13b4e43..10356c0 100644
--- a/Uninstall-CodexControlOtherDevices.ps1
+++ b/Uninstall-CodexControlOtherDevices.ps1
@@ -29,6 +29,24 @@ if ([string]::IsNullOrWhiteSpace($localAppData) -or -not [IO.Path]::IsPathRooted
 }
 $expectedInstallerRoot = [IO.Path]::GetFullPath((Join-Path $localAppData 'CodexControlOtherDevices-installer'))
 $expectedInstallRoot = [IO.Path]::GetFullPath((Join-Path $localAppData 'CodexControlOtherDevices'))
+$runtimeParent = [IO.Path]::GetFullPath((Join-Path $expectedInstallRoot 'runtime'))
+$runtimePrefix = $runtimeParent.TrimEnd('\') + '\'
+$installedRuntimeId = if ($installerRoot.StartsWith($runtimePrefix,[StringComparison]::OrdinalIgnoreCase)) { $installerRoot.Substring($runtimePrefix.Length) } else { $null }
+if ($null -ne $installedRuntimeId -and $installedRuntimeId -cmatch '^2\.5\.22-[0-9a-f]{16}-[0-9a-f]{32}$' -and $installedRuntimeId.IndexOf('\') -lt 0) {
+    $bootstrapPath = [IO.Path]::GetFullPath((Join-Path $installerRoot 'src\persistence\UninstallBootstrap.ps1'))
+    if (-not [IO.File]::Exists($bootstrapPath)) { Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_INVALID' 'The sealed generation uninstall bootstrap is missing.' $bootstrapPath }
+    $bootstrapItem = Get-Item -LiteralPath $bootstrapPath -Force -ErrorAction Stop
+    if ($bootstrapItem.PSIsContainer -or (($bootstrapItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) { Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_INVALID' 'The sealed generation uninstall bootstrap is unsafe.' $bootstrapPath }
+    if (-not $PSCmdlet.ShouldProcess($expectedInstallRoot,'Run manifest-bound cleanup from the selected sealed generation')) { return [pscustomobject][ordered]@{Outcome='WhatIf';KeptDeviceKeyStore=$true} }
+    try { $prepared=& $bootstrapPath -InstallerRoot $installerRoot -InstallRoot $expectedInstallRoot -Mode Prepare }
+    catch { Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_PREPARE_FAILED' 'Sealed generation cleanup did not reach its external finalization boundary.' $_ }
+    if($null-eq$prepared-or$prepared.transactionId-isnot[string]-or$prepared.transactionId-cnotmatch'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'-or$prepared.phase-cne'ReadyForInno'-or$prepared.runtimeId-cne$installedRuntimeId){Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_PREPARE_FAILED' 'Sealed generation cleanup returned an invalid receipt.' $prepared}
+    $transactionRoot=[IO.Path]::GetFullPath((Join-Path $localAppData 'CodexRemote-fix-uninstall'))
+    $stagedBootstrap=[IO.Path]::GetFullPath((Join-Path (Join-Path (Join-Path $transactionRoot $prepared.transactionId) 'payload') 'src\persistence\UninstallBootstrap.ps1'))
+    if(-not[IO.File]::Exists($stagedBootstrap)){Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_FINALIZER_MISSING' 'The verified external finalization bootstrap is missing.' $stagedBootstrap}
+    & $stagedBootstrap -InstallerRoot $installerRoot -InstallRoot $expectedInstallRoot -Mode FinalizeReceipt
+    Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_FINALIZATION_FAILED' 'The external finalization bootstrap returned without completing the uninstall receipt.' $prepared.transactionId
+}
 $portableMarkerPath = Join-Path $installerRoot 'portable-release.json'
 if ([IO.File]::Exists($portableMarkerPath) -or [IO.Directory]::Exists($portableMarkerPath)) {
     if ($installerRoot -cne $expectedInstallerRoot) {
diff --git a/src/persistence/UninstallBootstrap.ps1 b/src/persistence/UninstallBootstrap.ps1
index a368c66..23367f7 100644
--- a/src/persistence/UninstallBootstrap.ps1
+++ b/src/persistence/UninstallBootstrap.ps1
@@ -924,6 +924,10 @@ function Get-CcodUninstallBootstrapAdapters {
                 Invoke-CcodUninstallCleanup -InstallRoot $Root -Transaction $Value -WriteTransaction $Writer
             } $InstallRoot $Transaction $writer)
         }
+        RemoveProductRegistration = {
+            param($Context)
+            Remove-CcodUninstallBootstrapProductRegistration -Context $Context
+        }
         TestInstallRootAbsent = { param($InstallerRoot) -not ([IO.Directory]::Exists($InstallerRoot) -or [IO.File]::Exists($InstallerRoot)) }
         GetUtcNow = { [DateTime]::UtcNow }
     }
@@ -940,6 +944,20 @@ function Get-CcodUninstallBootstrapAdapters {
     return $resolved
 }
 
+function Remove-CcodUninstallBootstrapProductRegistration {
+    param([Parameter(Mandatory)]$Context)
+    Assert-CcodUninstallBootstrapContext $Context
+    $registryPath='HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\CodexRemote-fix'
+    $programs=[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs);$desktop=[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop)
+    if([string]::IsNullOrWhiteSpace($programs)-or[string]::IsNullOrWhiteSpace($desktop)-or-not[IO.Path]::IsPathRooted($programs)-or-not[IO.Path]::IsPathRooted($desktop)){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PRODUCT_REGISTRATION_INVALID' 'Current-user product special folders are unavailable' $null}
+    $shortcuts=@([IO.Path]::GetFullPath((Join-Path (Join-Path $programs 'CodexRemote-fix') 'CodexRemote-fix.lnk')),[IO.Path]::GetFullPath((Join-Path $desktop 'CodexRemote-fix.lnk')))
+    $registryPresent=Test-Path -LiteralPath $registryPath -PathType Container
+    if($registryPresent){$value=Get-ItemProperty -LiteralPath $registryPath -ErrorAction Stop;if($value.CcodRuntimeId-isnot[string]-or[string]$value.CcodRuntimeId-cne[string]$Context.runtimeId){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PRODUCT_REGISTRATION_INVALID' 'Current product registration does not match the verified runtime' $registryPath}}
+    foreach($path in $shortcuts){if([IO.File]::Exists($path)-or[IO.Directory]::Exists($path)){$item=Get-Item -LiteralPath $path -Force -ErrorAction Stop;if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PRODUCT_REGISTRATION_INVALID' 'Current product shortcut is not an exact regular file' $path}}}
+    foreach($path in $shortcuts){if([IO.File]::Exists($path)){Remove-Item -LiteralPath $path -Force -ErrorAction Stop}}
+    if($registryPresent){Remove-Item -LiteralPath $registryPath -Force -ErrorAction Stop}
+}
+
 function Set-CcodUninstallBootstrapFailedTransaction {
     param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][string]$Code,[Parameter(Mandatory)][hashtable]$Adapters,[Parameter(Mandatory)][string]$TransactionRoot)
     if ($Transaction.phase -ne 'Failed') { $Transaction.resumePhase = $Transaction.phase }
@@ -1042,6 +1060,7 @@ function Invoke-CcodUninstallBootstrap {
         if ($null -eq $result) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PREPARE_FAILED' 'The staged cleanup returned no transaction receipt' $stageRoot }
         Assert-CcodUninstallBootstrapTransactionMatchesContext $result $context
         if ($result.phase -ne 'ReadyForInno') { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PREPARE_FAILED' 'The staged cleanup did not reach the Inno boundary' $result }
+        & $adapter.RemoveProductRegistration $context
         & $adapter.WriteReceipt $stageRoot $result
         return $result
     } catch {
diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index 194e887..61ce8d0 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -80,6 +80,7 @@ internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
     private readonly Dictionary<string,Pin> names = new Dictionary<string,Pin>(StringComparer.OrdinalIgnoreCase);
     private readonly HashSet<object> retainedRoots = new HashSet<object>(ReferenceComparer.Instance);
     private readonly HashSet<object> retainedScopes = new HashSet<object>(ReferenceComparer.Instance);
+    private readonly HashSet<object> productFolders = new HashSet<object>(ReferenceComparer.Instance);
     private readonly List<FileStream> externalStreams = new List<FileStream>();
     private bool disposed; private string cleanupError;
 
@@ -184,6 +185,40 @@ internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
         ValidateOwnedTree(generation);Pin state=OpenOrCreateDirectory(root,"state"),retirements=OpenOrCreateDirectory(state,"retired-generations");Write(retirements.Token,recordLeaf,record,false);return generation.Token;
     }
 
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object OpenProductFolder(string kind,string path)
+    {
+        if(disposed)throw new ObjectDisposedException("transaction");
+        string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle handle=OpenAbsoluteDirectory(full,true);Pin basePin=null;
+        try
+        {
+            basePin=ValidateDirectoryPin(null,"",full,false,handle);handle=null;AddPin(basePin);
+            Pin selected=basePin;
+            if(String.Equals(kind,"StartMenu",StringComparison.Ordinal))selected=OpenOrCreateDirectory(basePin,"CodexRemote-fix");
+            else if(!String.Equals(kind,"Desktop",StringComparison.Ordinal))throw new InvalidDataException("unknown product folder");
+            productFolders.Add(selected.Token);return selected.Token;
+        }
+        catch{if(handle!=null)handle.Dispose();throw;}
+    }
+
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object CopyProductShortcut(object folderToken,string kind,string source,string leaf,long expectedLength,string expectedSha)
+    {
+        Pin parent=Require(folderToken,true);ValidateCurrent(parent);
+        if(!productFolders.Contains(folderToken)||!String.Equals(leaf,"CodexRemote-fix.lnk",StringComparison.Ordinal)||
+           (!String.Equals(kind,"StartMenu",StringComparison.Ordinal)&&!String.Equals(kind,"Desktop",StringComparison.Ordinal)))throw new InvalidDataException("product shortcut scope");
+        string full=Path.GetFullPath(source);SafeFileHandle sourceHandle=CreateFileW(full,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,IntPtr.Zero,OPEN_EXISTING,FLAG_REPARSE,IntPtr.Zero);
+        if(sourceHandle.IsInvalid)throw new Win32Exception(Marshal.GetLastWin32Error());FileStream sourceStream=null;
+        try
+        {
+            FILE_INFO sourceInfo=Info(sourceHandle);ValidatePlain(sourceInfo,sourceHandle);if(!SamePath(FinalPath(sourceHandle),full))throw new InvalidDataException("source path changed");
+            sourceStream=new FileStream(sourceHandle,FileAccess.Read,65536,false);sourceHandle=null;externalStreams.Add(sourceStream);FileStream ownedSource=sourceStream;sourceStream=null;
+            if(ownedSource.Length!=expectedLength||Sha(ownedSource)!=expectedSha)throw new InvalidDataException("source mismatch");ownedSource.Position=0;
+            Pin destination=CreateTemporaryFile(parent);ownedSource.CopyTo(destination.Stream);destination.Stream.Flush(true);
+            if(destination.Stream.Length!=expectedLength||Sha(destination.Stream)!=expectedSha)throw new InvalidDataException("destination mismatch");
+            SealAndReplaceProduct(destination,leaf,expectedLength,expectedSha);EnsurePublishedPin(destination);return destination.Token;
+        }
+        finally{if(sourceStream!=null)sourceStream.Dispose();if(sourceHandle!=null)sourceHandle.Dispose();}
+    }
+
     [MethodImpl(MethodImplOptions.Synchronized)] internal void Close()
     {
         disposed=true;Exception first=null;List<FileStream> failedStreams=new List<FileStream>();foreach(FileStream stream in new List<FileStream>(externalStreams)){try{stream.Dispose();}catch(Exception exception){failedStreams.Add(stream);if(first==null)first=exception;}}externalStreams.Clear();externalStreams.AddRange(failedStreams);
@@ -241,6 +276,21 @@ internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
         catch(Exception exception){if(finalAlias&&!committed)names.Remove(finalKey);Win32Exception win32=exception as Win32Exception;if((stage=="rename"||stage=="rename-open")&&win32!=null&&(win32.NativeErrorCode==80||win32.NativeErrorCode==183))throw;throw new InvalidDataException("seal mismatch at "+stage+(win32==null?"":" win32="+win32.NativeErrorCode),exception);}
         finally{if(strictStream!=null)strictStream.Dispose();if(strict!=null&&strict.Handle!=null)strict.Handle.Dispose();if(renameHandle!=null&&renameHandle.Handle!=null)renameHandle.Handle.Dispose();}
     }
+    private void SealAndReplaceProduct(Pin pin,string finalLeaf,long expectedLength,string expectedSha)
+    {
+        string temporaryKey=Key(pin.Parent,pin.Leaf),finalKey=Key(pin.Parent,finalLeaf),finalPath=Path.Combine(pin.Parent.Path,finalLeaf);OpenResult renameHandle=null,strict=null;FileStream strictStream=null;
+        try
+        {
+            pin.Stream.Dispose();pin.Stream=null;strict=OpenRelative(pin.Parent.Native,pin.Leaf,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,OPEN,NON_DIRECTORY);strictStream=new FileStream(strict.Handle,FileAccess.Read,65536,false);strict.Handle=null;
+            FILE_INFO strictInfo=Info(strictStream.SafeFileHandle);ValidatePlain(strictInfo,strictStream.SafeFileHandle);if(strictInfo.VolumeSerialNumber!=pin.Volume||(((ulong)strictInfo.FileIndexHigh<<32)|strictInfo.FileIndexLow)!=pin.Index||!SamePath(FinalPath(strictStream.SafeFileHandle),pin.Path)||strictStream.Length!=expectedLength||Sha(strictStream)!=expectedSha)throw new InvalidDataException("seal mismatch");
+            strictStream.Dispose();strictStream=null;renameHandle=OpenRelative(pin.Parent.Native,pin.Leaf,READ|DELETE|READ_ATTRIBUTES|WRITE_ATTRIBUTES|SYNC,SHARE_READ,OPEN,NON_DIRECTORY);FILE_INFO renameInfo=Info(renameHandle.Handle);ValidatePlain(renameInfo,renameHandle.Handle);if(renameInfo.VolumeSerialNumber!=pin.Volume||(((ulong)renameInfo.FileIndexHigh<<32)|renameInfo.FileIndexLow)!=pin.Index||!SamePath(FinalPath(renameHandle.Handle),pin.Path))throw new InvalidDataException("pin changed");
+            pin.SealedLength=expectedLength;pin.SealedSha=expectedSha;pin.Sealed=true;
+            Pin old;if(names.TryGetValue(finalKey,out old)&&!Object.ReferenceEquals(old,pin))throw new InvalidDataException("product shortcut already scoped");
+            int error=RenameReplacing(renameHandle.Handle,pin.Parent.Native,finalLeaf);if(error!=0)throw new Win32Exception(error);names.Remove(temporaryKey);names[finalKey]=pin;pin.Leaf=finalLeaf;pin.Path=finalPath;pin.Published=true;
+        }
+        catch(Exception exception){throw new InvalidDataException("seal mismatch at product shortcut",exception);}
+        finally{if(strictStream!=null)strictStream.Dispose();if(strict!=null&&strict.Handle!=null)strict.Handle.Dispose();if(renameHandle!=null&&renameHandle.Handle!=null)renameHandle.Handle.Dispose();}
+    }
     private void EnsurePublishedPin(Pin pin){if(pin.Stream!=null){ValidateCurrent(pin);return;}OpenResult result=OpenRelative(pin.Parent.Native,pin.Leaf,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,OPEN,NON_DIRECTORY);FileStream stream=null;try{stream=new FileStream(result.Handle,FileAccess.Read,65536,false);result.Handle=null;FILE_INFO info=Info(stream.SafeFileHandle);ValidatePlain(info,stream.SafeFileHandle);if(info.VolumeSerialNumber!=pin.Volume||(((ulong)info.FileIndexHigh<<32)|info.FileIndexLow)!=pin.Index||!SamePath(FinalPath(stream.SafeFileHandle),pin.Path)||stream.Length!=pin.SealedLength||Sha(stream)!=pin.SealedSha)throw new InvalidDataException("seal mismatch");pin.Stream=stream;stream=null;}finally{if(stream!=null)stream.Dispose();if(result.Handle!=null)result.Handle.Dispose();}}
     private static int SetReadOnly(SafeFileHandle handle){IntPtr buffer=Marshal.AllocHGlobal(40);try{for(int i=0;i<40;i++)Marshal.WriteByte(buffer,i,0);Marshal.WriteInt32(buffer,32,1);IO_STATUS_BLOCK io;int status=NtSetInformationFile(handle,out io,buffer,40,4);return status>=0?0:(int)RtlNtStatusToDosError(status);}finally{Marshal.FreeHGlobal(buffer);}}
     private static SafeFileHandle OpenAbsoluteDirectory(string path,bool allowWrite){uint access=LIST_DIRECTORY|READ_ATTRIBUTES|SYNC;if(allowWrite)access|=ADD_FILE|ADD_SUBDIRECTORY;SafeFileHandle handle=CreateFileW(path,access,SHARE_READ|SHARE_WRITE,IntPtr.Zero,OPEN_EXISTING,FLAG_BACKUP|FLAG_REPARSE,IntPtr.Zero);if(handle.IsInvalid)throw new Win32Exception(Marshal.GetLastWin32Error());return handle;}
@@ -255,6 +305,7 @@ internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
     private static string[] Enumerate(SafeFileHandle handle){List<string> result=new List<string>();HashSet<string> seen=new HashSet<string>(StringComparer.OrdinalIgnoreCase);IntPtr buffer=Marshal.AllocHGlobal(65536);bool restart=true;try{while(true){IO_STATUS_BLOCK io;int status=NtQueryDirectoryFile(handle,IntPtr.Zero,IntPtr.Zero,IntPtr.Zero,out io,buffer,65536,FileDirectoryInformation,false,IntPtr.Zero,restart);restart=false;if(status==STATUS_NO_MORE_FILES)break;if(status<0)throw new Win32Exception((int)RtlNtStatusToDosError(status));int offset=0;while(true){uint next=(uint)Marshal.ReadInt32(buffer,offset),nameLength=(uint)Marshal.ReadInt32(buffer,offset+60);string name=Marshal.PtrToStringUni(IntPtr.Add(buffer,offset+64),(int)nameLength/2);if(name!="."&&name!=".."&&seen.Add(name))result.Add(name);if(next==0)break;offset+=(int)next;}}return result.ToArray();}finally{Marshal.FreeHGlobal(buffer);}}
     private static OpenResult OpenRelative(SafeFileHandle parent,string name,uint access,uint share,uint disposition,uint options){IntPtr nameBuffer=IntPtr.Zero,unicodePointer=IntPtr.Zero;bool added=false;try{parent.DangerousAddRef(ref added);nameBuffer=Marshal.StringToHGlobalUni(name);UNICODE_STRING unicode=new UNICODE_STRING{Length=(ushort)(name.Length*2),MaximumLength=(ushort)((name.Length+1)*2),Buffer=nameBuffer};unicodePointer=Marshal.AllocHGlobal(Marshal.SizeOf(typeof(UNICODE_STRING)));Marshal.StructureToPtr(unicode,unicodePointer,false);OBJECT_ATTRIBUTES attributes=new OBJECT_ATTRIBUTES{Length=Marshal.SizeOf(typeof(OBJECT_ATTRIBUTES)),RootDirectory=parent.DangerousGetHandle(),ObjectName=unicodePointer,Attributes=OBJ_CASE_INSENSITIVE};IO_STATUS_BLOCK io;IntPtr raw;int status=NtCreateFile(out raw,access,ref attributes,out io,IntPtr.Zero,0,share,disposition,options|SYNC_IO|OPEN_REPARSE,IntPtr.Zero,0);if(status<0)throw new Win32Exception((int)RtlNtStatusToDosError(status));return new OpenResult(new SafeFileHandle(raw,true),io.Information.ToUInt64()==2);}finally{if(unicodePointer!=IntPtr.Zero)Marshal.FreeHGlobal(unicodePointer);if(nameBuffer!=IntPtr.Zero)Marshal.FreeHGlobal(nameBuffer);if(added)parent.DangerousRelease();}}
     private static int Rename(SafeFileHandle source,SafeFileHandle parent,string destination){byte[] name=Encoding.Unicode.GetBytes(destination);int rootOffset=IntPtr.Size,lengthOffset=rootOffset+IntPtr.Size,nameOffset=lengthOffset+4,size=nameOffset+name.Length+2;IntPtr buffer=Marshal.AllocHGlobal(size);bool parentAdded=false,sourceAdded=false;try{source.DangerousAddRef(ref sourceAdded);parent.DangerousAddRef(ref parentAdded);for(int i=0;i<size;i++)Marshal.WriteByte(buffer,i,0);Marshal.WriteByte(buffer,0,0);Marshal.WriteIntPtr(buffer,rootOffset,parent.DangerousGetHandle());Marshal.WriteInt32(buffer,lengthOffset,name.Length);Marshal.Copy(name,0,IntPtr.Add(buffer,nameOffset),name.Length);IO_STATUS_BLOCK io;int status=NtSetInformationFile(source,out io,buffer,(uint)size,FileRenameInformation);return status>=0?0:(int)RtlNtStatusToDosError(status);}finally{if(parentAdded)parent.DangerousRelease();if(sourceAdded)source.DangerousRelease();Marshal.FreeHGlobal(buffer);}}
+    private static int RenameReplacing(SafeFileHandle source,SafeFileHandle parent,string destination){byte[] name=Encoding.Unicode.GetBytes(destination);int rootOffset=IntPtr.Size,lengthOffset=rootOffset+IntPtr.Size,nameOffset=lengthOffset+4,size=nameOffset+name.Length+2;IntPtr buffer=Marshal.AllocHGlobal(size);bool parentAdded=false,sourceAdded=false;try{source.DangerousAddRef(ref sourceAdded);parent.DangerousAddRef(ref parentAdded);for(int i=0;i<size;i++)Marshal.WriteByte(buffer,i,0);Marshal.WriteByte(buffer,0,1);Marshal.WriteIntPtr(buffer,rootOffset,parent.DangerousGetHandle());Marshal.WriteInt32(buffer,lengthOffset,name.Length);Marshal.Copy(name,0,IntPtr.Add(buffer,nameOffset),name.Length);IO_STATUS_BLOCK io;int status=NtSetInformationFile(source,out io,buffer,(uint)size,FileRenameInformation);return status>=0?0:(int)RtlNtStatusToDosError(status);}finally{if(parentAdded)parent.DangerousRelease();if(sourceAdded)source.DangerousRelease();Marshal.FreeHGlobal(buffer);}}
 }
 '@
         $marker = 'CcodInstallGenerationCapabilityMarkerV4' -as [type]
@@ -319,7 +370,24 @@ function Write-CcodInstallGenerationManifest { param([Parameter(Mandatory)]$Gene
 function Write-CcodInstallRecord { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$Parent,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)]$Record) Assert-CcodInstallLeaf $Leaf;$scope=Get-CcodInstallScopedDirectory $Transaction $Parent;Assert-CcodInstallWritableScope $scope;$bytes=ConvertTo-CcodInstallJsonBytes $Record;$result=[pscustomobject]@{Length=[int64]$bytes.LongLength;Sha256=(Get-CcodInstallBytesSha256 $bytes)};try{Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Write @($scope.Record.Token,$Leaf,$bytes,$false)|Out-Null} 'CCOD_INSTALL_RECORD_WRITE_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_RECORD_EXISTS' 'Install record already exists' $Leaf};throw};return $result }
 function Commit-CcodInstallActivePointer { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$TargetGeneration,[Parameter(Mandatory)][uint64]$ExpectedPreviousGeneration,[Parameter(Mandatory)]$FileTransaction) if($ExpectedPreviousGeneration-eq[uint64]::MaxValue){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW' 'Pointer generation cannot advance beyond UInt64.MaxValue' $ExpectedPreviousGeneration};$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$target=Get-CcodInstallTransaction $TargetGeneration 'CCOD_INSTALL_POINTER_TARGET_INVALID';if(-not[object]::ReferenceEquals($target.Record.Transaction,$FileTransaction)-or$target.Record.Kind-cne'Generation'-or[string]::IsNullOrWhiteSpace([string]$target.Record.RuntimeId)){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_TARGET_INVALID' 'Pointer target is outside the transaction scope' $null};$generation=[uint64]($ExpectedPreviousGeneration+1);$runtimeId=[string]$target.Record.RuntimeId;$pointer=[ordered]@{schemaVersion=1;generation=$generation;activeRuntime=$runtimeId;previousGeneration=$ExpectedPreviousGeneration};$bytes=ConvertTo-CcodInstallJsonBytes $pointer;$result=[pscustomobject]@{Generation=$generation;RuntimeId=$runtimeId};try{Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CommitPointer @($target.Record.Token,$ExpectedPreviousGeneration,$runtimeId,$bytes)|Out-Null} 'CCOD_INSTALL_POINTER_COMMIT_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' 'Pointer generation already exists' $generation};throw};return $result }
 function Retire-CcodInstallGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)]$FileTransaction) Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID' -AllowRetired;Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';if($RuntimeId-cne$scope.State.RuntimeId-or$scope.Record.Token-ne$scope.State.RootToken){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' 'Generation is not owned by this transaction' $RuntimeId};if($scope.State.Retired){return $scope.State.RetirementResult};$recordLeaf=$RuntimeId+'.json';$record=ConvertTo-CcodInstallJsonBytes ([ordered]@{schemaVersion=1;runtimeId=$RuntimeId;state='Retired'});$capability=Add-CcodInstallScope $scope.Record.Transaction $scope.State.RootToken;$result=[pscustomobject]@{Disposition='Retired';Capability=$capability};try{Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Retire @($scope.Record.Token,$RuntimeId,$recordLeaf,$record)|Out-Null} 'CCOD_INSTALL_RETIREMENT_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETIREMENT_RECORD_EXISTS' 'Retirement record already exists' $recordLeaf};throw};$scope.State.RetirementResult=$result;$scope.State.Retired=$true;return $result }
+function Open-CcodInstallProductSpecialFolder {
+    param([Parameter(Mandatory)]$FileTransaction,[Parameter(Mandatory)][ValidateSet('StartMenu','Desktop')][string]$Kind)
+    $scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID'
+    if(-not[object]::ReferenceEquals($scope.Record.Transaction,$FileTransaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_FOLDER_INVALID' 'Product special folder requires the transaction-root capability' $Kind}
+    $specialFolder=if($Kind-ceq'StartMenu'){[Environment+SpecialFolder]::Programs}else{[Environment+SpecialFolder]::Desktop}
+    $path=[Environment]::GetFolderPath($specialFolder)
+    if([string]::IsNullOrWhiteSpace($path)-or-not[IO.Path]::IsPathRooted($path)){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_FOLDER_INVALID' 'Current-user special folder is unavailable' $Kind}
+    $token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenProductFolder @($Kind,[IO.Path]::GetFullPath($path))} 'CCOD_INSTALL_PRODUCT_FOLDER_INVALID'
+    Add-CcodInstallScope $FileTransaction $token ProductFolder $false $null
+}
+function Copy-CcodInstallProductShortcut {
+    param([Parameter(Mandatory)]$Folder,[Parameter(Mandatory)][ValidateSet('StartMenu','Desktop')][string]$Kind,[Parameter(Mandatory)][string]$SourcePath,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)][int64]$ExpectedLength,[Parameter(Mandatory)][string]$ExpectedSha256,[Parameter(Mandatory)]$FileTransaction)
+    if($Leaf-cne'CodexRemote-fix.lnk'-or-not[IO.Path]::IsPathRooted($SourcePath)-or$ExpectedLength-lt 0-or$ExpectedSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Invalid fixed product shortcut contract' $Leaf}
+    $scope=Get-CcodInstallTransaction $Folder 'CCOD_INSTALL_PRODUCT_FOLDER_INVALID';if(-not[object]::ReferenceEquals($scope.Record.Transaction,$FileTransaction)-or$scope.Record.Kind-cne'ProductFolder'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_FOLDER_INVALID' 'Product folder capability is outside the file transaction' $Kind}
+    Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CopyProductShortcut @($scope.Record.Token,$Kind,[IO.Path]::GetFullPath($SourcePath),$Leaf,$ExpectedLength,$ExpectedSha256)} 'CCOD_INSTALL_PRODUCT_SHORTCUT_FAILED'|Out-Null
+    [pscustomobject]@{Kind=$Kind;Leaf=$Leaf;Length=$ExpectedLength;Sha256=$ExpectedSha256}
+}
 function Close-CcodInstallFileTransaction { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][ValidateSet('Ready','Failed')][string]$Disposition) $state=$null;if($null-eq$Transaction-or-not$script:CcodTransactions.TryGetValue($Transaction,[ref]$state)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Invalid install file transaction capability' $null};if($state.Closed-and-not$state.CleanupFailed){return};try{Invoke-CcodRuntimeMethod $state.Runtime Close @()|Out-Null;$state.CleanupFailed=$false}catch{$state.CleanupFailed=$true;$state.Closed=$true;$state.Disposition=$Disposition;Throw-CcodInstallFileError 'CCOD_INSTALL_CLOSE_FAILED' 'Install file transaction cleanup failed; registered failures are retained for retry' $null};$state.Closed=$true;$state.Disposition=$Disposition }
 
 Initialize-CcodInstallRuntime
-Export-ModuleMember -Function Open-CcodInstallGeneration,Open-CcodInstallStateTransaction,Open-CcodInstallRetainedGeneration,New-CcodInstallDirectory,New-CcodInstallGenerationLeaf,Copy-CcodInstallSealedSource,Write-CcodInstallGenerationManifest,Write-CcodInstallRecord,Commit-CcodInstallActivePointer,Retire-CcodInstallGeneration,Close-CcodInstallFileTransaction
+Export-ModuleMember -Function Open-CcodInstallGeneration,Open-CcodInstallStateTransaction,Open-CcodInstallRetainedGeneration,New-CcodInstallDirectory,New-CcodInstallGenerationLeaf,Copy-CcodInstallSealedSource,Write-CcodInstallGenerationManifest,Write-CcodInstallRecord,Commit-CcodInstallActivePointer,Retire-CcodInstallGeneration,Open-CcodInstallProductSpecialFolder,Copy-CcodInstallProductShortcut,Close-CcodInstallFileTransaction
diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index 8e809e2..9f5a670 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -11,6 +11,7 @@ Import-Module (Join-Path $PSScriptRoot 'UiPreferences.psm1') -Force
 Import-Module (Join-Path $PSScriptRoot 'LifecycleTransaction.psm1') -Force
 
 $script:CcodLifecycleTaskName = 'Codex Control Other Devices Supervisor'
+$script:CcodProductVersion = '2.5.22'
 $script:CcodLifecycleDefaultInstallRoot = Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)) 'CodexControlOtherDevices'
 $script:CcodActivationReceiptFields = @('schemaVersion','activationId','phase','runtimeId','previousRuntimeId','startedAtUtc','updatedAtUtc','ready','errorCode')
 $script:CcodActivationPhases = @('StoppingPreviousRuntime','InstallingRuntime','ActivatingRuntime','StartingProtection','Ready','Failed')
@@ -433,10 +434,10 @@ function Assert-CcodReadyFinalizationRecoveryProof {
 }
 
 function Complete-CcodReadyFinalizationRecovery {
-    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$TransactionRecord)
-    [void](Assert-CcodReadyFinalizationRecoveryProof -InstallRoot $InstallRoot -TransactionRecord $TransactionRecord)
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$TransactionRecord,[Parameter(Mandatory)][hashtable]$Adapters)
+    $proof=Assert-CcodReadyFinalizationRecoveryProof -InstallRoot $InstallRoot -TransactionRecord $TransactionRecord
     $fileTransaction=$null
-    $observed=$null
+    $observed=$null;$productRegistrationFailure=$null;$productRegistrationVerified=$false
     try{
         $fileTransaction=Open-CcodLifecycleInstallStateTransaction -InstallRoot $InstallRoot
         [void](Assert-CcodReadyFinalizationRecoveryProof -InstallRoot $InstallRoot -TransactionRecord $TransactionRecord)
@@ -446,6 +447,9 @@ function Complete-CcodReadyFinalizationRecovery {
         }
         $observed=Read-CcodInstallTransactionRecord -InstallRoot $InstallRoot -TransactionId $TransactionRecord.transactionId
         if($null-eq$observed-or$observed.phase-cne'Ready'){Throw-CcodLifecycleError 'CCOD_INSTALL_READY_FINALIZATION_PENDING' 'Ready finalization snapshot is not visible' $TransactionRecord.transactionId}
+        if([string]$proof.Validation.Manifest.projectVersion-ceq$script:CcodProductVersion){
+            try{$registration=&$Adapters.RegisterProduct $InstallRoot ([string]$observed.newRuntimeId) ([string]$proof.Validation.Manifest.projectVersion) ([string]$observed.sealedPackageSha256) $fileTransaction $observed;if($null-eq$registration-or$registration.verified-isnot[bool]-or-not$registration.verified){throw 'registration receipt invalid'};$productRegistrationVerified=$true}catch{$productRegistrationFailure=$_}
+        }
     }catch{
         try{$observed=Read-CcodInstallTransactionRecord -InstallRoot $InstallRoot -TransactionId $TransactionRecord.transactionId}catch{}
         if($null-eq$observed-or$observed.phase-cne'Ready'){
@@ -455,9 +459,10 @@ function Complete-CcodReadyFinalizationRecovery {
     }finally{
         if($null-ne$fileTransaction){try{Close-CcodInstallFileTransaction -Transaction $fileTransaction -Disposition $(if($null-ne$observed-and$observed.phase-ceq'Ready'){'Ready'}else{'Failed'})}catch{}}
     }
+    if($null-ne$productRegistrationFailure){if(([string]$productRegistrationFailure.FullyQualifiedErrorId-split',')[0]-ceq'CCOD_PRODUCT_REGISTRATION_FAILED'){throw $productRegistrationFailure};Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Recovered runtime is Ready but product registration failed; legacy state was retained' $TransactionRecord.newRuntimeId}
     $ready=Read-CcodInstallTransactionRecord -InstallRoot $InstallRoot -TransactionId $TransactionRecord.transactionId
     if($null-eq$ready-or$ready.phase-cne'Ready'){Throw-CcodLifecycleError 'CCOD_INSTALL_READY_FINALIZATION_PENDING' 'Ready finalization snapshot is not durable' $TransactionRecord.transactionId}
-    return [pscustomobject][ordered]@{Outcome='Recovered';Installed=$true;RuntimeId=[string]$ready.newRuntimeId;PreviousRuntimeId=$ready.oldRuntimeId;RepairCompleted=$false}
+    return [pscustomobject][ordered]@{Outcome='Recovered';Installed=$true;RuntimeId=[string]$ready.newRuntimeId;PreviousRuntimeId=$ready.oldRuntimeId;RepairCompleted=$false;ProductRegistrationVerified=[bool]$productRegistrationVerified}
 }
 
 function Test-CcodInstallPackageIdentity {
@@ -1936,6 +1941,22 @@ function Get-CcodLifecycleAdapters {
             param($InstallRoot,$TransactionId,$FileTransaction)
             Set-CcodInstallTransactionPhase -InstallRoot $InstallRoot -TransactionId $TransactionId -ExpectedPhase 'ProtectionReady' -NewPhase 'Ready' -FileTransaction $FileTransaction
         }
+        AddProductShortcutCandidates = {
+            param($Files)
+            $temporaryRoot=Join-Path ([IO.Path]::GetTempPath()) ('ccod-product-shortcuts-'+[guid]::NewGuid().ToString('N'))
+            $module=Import-Module (Join-Path $PSScriptRoot 'ProductRegistration.psm1') -Force -PassThru -ErrorAction Stop
+            $candidates=@(& $module {param($Root)New-CcodProductShortcutCandidates -Directory $Root} $temporaryRoot)
+            [pscustomobject]@{Files=@($Files)+$candidates;TemporaryRoot=$temporaryRoot}
+        }
+        RegisterProduct = {
+            param($InstallRoot,$RuntimeId,$Version,$PackageSha256,$FileTransaction,$TransactionRecord)
+            $module=Import-Module (Join-Path $PSScriptRoot 'ProductRegistration.psm1') -Force -PassThru -ErrorAction Stop
+            $registration=New-CcodProductRegistration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -Version $Version -PackageSha256 $PackageSha256 -FileTransaction $FileTransaction
+            $proof=[pscustomobject][ordered]@{phase=[string]$TransactionRecord.phase;runtimeId=$RuntimeId;version=$Version;packageSha256=$PackageSha256;bootstrapPath=$registration.bootstrapPath;uninstallerPath=$registration.uninstallerPath}
+            $receipt=Commit-CcodProductRegistration -Registration $registration -FileTransaction $FileTransaction -Adapters @{GetReadyProof={param($Ignored)$proof}.GetNewClosure()}
+            Remove-CcodLegacyProductRegistration -ExpectedAppId '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}'
+            [pscustomobject]@{verified=[bool]$receipt.verified;legacyRemoved=$true}
+        }
         NewRuntimeManifest = {
             param($RuntimeDirectory, $ProjectVersion)
             New-CcodRuntimeManifest -RuntimeDirectory $RuntimeDirectory -ProjectVersion $ProjectVersion
@@ -2289,7 +2310,7 @@ function Invoke-CcodInstall {
 
     $globalTransaction=Read-CcodInstallTransactionRecord -InstallRoot $root
     if($null-ne$globalTransaction-and$globalTransaction.phase-notin@('Ready','Failed')){
-        if($globalTransaction.phase-ceq'ProtectionReady'){return Complete-CcodReadyFinalizationRecovery -InstallRoot $root -TransactionRecord $globalTransaction}
+        if($globalTransaction.phase-ceq'ProtectionReady'){return Complete-CcodReadyFinalizationRecovery -InstallRoot $root -TransactionRecord $globalTransaction -Adapters $adapters}
         Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_BUSY' 'A nonterminal install transaction must be recovered before a new attempt' $globalTransaction.transactionId
     }
 
@@ -2329,6 +2350,12 @@ function Invoke-CcodInstall {
     }
     $nodeCandidates = @(Get-CcodLifecycleNodeCandidates -Adapters $adapters)
     if (-not $payloadBound) { $files = @(Get-CcodLifecycleSourceFiles -SourceRoot $sourceRoot -RequireTrayHost) }
+    $productShortcutTemporaryRoot=$null
+    if([string]$projectVersion-ceq$script:CcodProductVersion){
+        $preparedProductFiles=&$adapters.AddProductShortcutCandidates $files
+        if($null-eq$preparedProductFiles-or$null-eq$preparedProductFiles.Files){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product shortcut candidate preparation returned no files' $null}
+        $files=@($preparedProductFiles.Files);$productShortcutTemporaryRoot=[string]$preparedProductFiles.TemporaryRoot
+    }
 
     $oldManifestSha256=$null;$activeValidation=$null
     if($null-ne$existingPointer){
@@ -2370,7 +2397,7 @@ function Invoke-CcodInstall {
     $shutdownGate = $null
     $lifecycleOwnership = $null
     $previousProtectionStopped = $false
-    $fileTransaction=$null;$generationCapability=$null;$installRecord=$null;$readyReceiptCommitted=$false
+    $fileTransaction=$null;$generationCapability=$null;$installRecord=$null;$readyReceiptCommitted=$false;$productRegistrationVerified=$false;$productRegistrationFailure=$null
     try {
         $runtimeId=New-CcodUniqueRuntimeId -ProjectVersion $projectVersion -Files $files;$generation=New-CcodLifecycleImmutableGeneration -InstallRoot $root -RuntimeId $runtimeId -ProjectVersion $projectVersion -Files $files;$fileTransaction=$generation.FileTransaction;$generationCapability=$generation.Generation;$runtimeRoot=$generation.RuntimeRoot;$runtimeCreated=$true
         $newGeneration=if($null-eq$existingPointer){[uint64]1}else{[uint64]$existingPointer.generation+1};$installRecord=New-CcodInstallTransactionRecord -TransactionId ([guid]::NewGuid().ToString('D')) -OldRuntimeId $(if($upgrade){$existingPointer.activeRuntime}else{$null}) -OldGeneration $(if($upgrade){$existingPointer.generation}else{$null}) -OldManifestSha256 $oldManifestSha256 -NewRuntimeId $runtimeId -NewGeneration $newGeneration -NewManifestSha256 $generation.ManifestSha256 -SealedPackageSha256 $SealedPackageSha256 -OwnedObjectNames @($runtimeId)
@@ -2470,6 +2497,13 @@ function Invoke-CcodInstall {
         } catch {
             try { Write-CcodLifecycleLog -InstallRoot $root -Adapters $adapters -Stage 'PostReady' -Code 'CCOD_INSTALL_POST_READY_LOG_FAILED' -Outcome 'ReadyRetained' -FileTransaction $fileTransaction } catch { }
         }
+        if([string]$projectVersion-ceq$script:CcodProductVersion){
+            try{
+                $registrationReceipt=&$adapters.RegisterProduct $root $runtimeId ([string]$projectVersion) $SealedPackageSha256 $fileTransaction $installRecord
+                if($null-eq$registrationReceipt-or$registrationReceipt.verified-isnot[bool]-or-not$registrationReceipt.verified){throw 'registration receipt invalid'}
+                $productRegistrationVerified=$true
+            }catch{$productRegistrationFailure=$_}
+        }
     } catch {
         $caught = $_
         $errorCode = Get-CcodLifecycleErrorId $caught
@@ -2548,6 +2582,12 @@ function Invoke-CcodInstall {
             try { & $adapters.ExitLifecycleOwnership $lifecycleOwnership | Out-Null } catch { }
         }
         if($null-ne$fileTransaction){try{Close-CcodInstallFileTransaction -Transaction $fileTransaction -Disposition $(if($null-ne$installRecord-and$installRecord.phase-ceq'Ready'){'Ready'}else{'Failed'})}catch{}}
+        if(-not[string]::IsNullOrWhiteSpace($productShortcutTemporaryRoot)-and(Test-Path -LiteralPath $productShortcutTemporaryRoot)){try{Remove-Item -LiteralPath $productShortcutTemporaryRoot -Recurse -Force -ErrorAction Stop}catch{}}
+    }
+
+    if($null-ne$productRegistrationFailure){
+        if(([string]$productRegistrationFailure.FullyQualifiedErrorId-split',')[0]-ceq'CCOD_PRODUCT_REGISTRATION_FAILED'){throw $productRegistrationFailure}
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Runtime is Ready but post-Ready product registration failed; legacy state was retained' $runtimeId
     }
 
     return [pscustomobject][ordered]@{
@@ -2556,6 +2596,7 @@ function Invoke-CcodInstall {
         RuntimeId = $runtimeId
         PreviousRuntimeId = $pointer.previousRuntime
         RepairCompleted = $false
+        ProductRegistrationVerified = [bool]$productRegistrationVerified
     }
 }
 
diff --git a/src/persistence/modules/ProductRegistration.psm1 b/src/persistence/modules/ProductRegistration.psm1
new file mode 100644
index 0000000..47efd8a
--- /dev/null
+++ b/src/persistence/modules/ProductRegistration.psm1
@@ -0,0 +1,291 @@
+Set-StrictMode -Version Latest
+
+$script:CcodProductVersion = '2.5.22'
+$script:CcodProductAppId = '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}'
+$script:CcodProductKeyName = 'CodexRemote-fix'
+$script:CcodProductFields = @(
+    'schemaVersion','installRoot','runtimeId','version','packageSha256','runtimeRoot','bootstrapPath','uninstallerPath',
+    'productKeyName','startMenuShortcut','desktopShortcut'
+)
+$script:CcodShortcutFields = @('kind','leaf','relativePath','candidatePath','bootstrapPath','installRoot')
+$script:CcodReadyFields = @('phase','runtimeId','version','packageSha256','bootstrapPath','uninstallerPath')
+$script:CcodLegacyShortcutNames = @(
+    'Programs\Codex Control other devices\Codex Control other devices for Windows.lnk',
+    'Programs\Codex Control other devices\Open the tray supervisor.lnk',
+    'Programs\Codex Control other devices\Compatibility check.lnk',
+    'Programs\Codex Control other devices\Uninstall Codex Control other devices.lnk',
+    'Programs\Codex Control other devices\CodexRemote-fix.lnk',
+    'Programs\Codex Control other devices\CodexRemote-fix compatibility check.lnk',
+    'Programs\Codex Control other devices\Uninstall CodexRemote-fix.lnk',
+    ('Desktop\Codex ' + [char]0x8BBE + [char]0x5907 + [char]0x8FDE + [char]0x63A5 + ' (Device Connection).lnk')
+)
+
+function Throw-CcodProductRegistrationError {
+    param([Parameter(Mandatory)][string]$Id,[Parameter(Mandatory)][string]$Message,$Target)
+    throw [Management.Automation.ErrorRecord]::new(
+        [InvalidOperationException]::new($Message),$Id,[Management.Automation.ErrorCategory]::InvalidData,$Target)
+}
+
+function Test-CcodProductExactProperties {
+    param($Value,[Parameter(Mandatory)][string[]]$Names)
+    if ($null -eq $Value) { return $false }
+    $properties = @($Value.PSObject.Properties)
+    if ($properties.Count -ne $Names.Count) { return $false }
+    for ($index = 0; $index -lt $Names.Count; $index++) {
+        if ($properties[$index].Name -cne $Names[$index]) { return $false }
+    }
+    return $true
+}
+
+function Get-CcodProductFullPath {
+    param([Parameter(Mandatory)][string]$Path)
+    if ([string]::IsNullOrWhiteSpace($Path) -or -not [IO.Path]::IsPathRooted($Path)) {
+        Throw-CcodProductRegistrationError 'CCOD_PRODUCT_REGISTRATION_INVALID' 'Product registration paths must be absolute.' $Path
+    }
+    try { return [IO.Path]::GetFullPath($Path).TrimEnd('\') }
+    catch { Throw-CcodProductRegistrationError 'CCOD_PRODUCT_REGISTRATION_INVALID' 'Product registration path is invalid.' $Path }
+}
+
+function Test-CcodProductShortcut {
+    param($Shortcut,$Expected)
+    if (-not (Test-CcodProductExactProperties $Shortcut $script:CcodShortcutFields)) { return $false }
+    foreach ($name in $script:CcodShortcutFields) {
+        if ($Shortcut.$name -isnot [string] -or [string]$Shortcut.$name -cne [string]$Expected.$name) { return $false }
+    }
+    return $true
+}
+
+function New-CcodProductRegistration {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string]$InstallRoot,
+        [Parameter(Mandatory)][string]$RuntimeId,
+        [Parameter(Mandatory)][string]$Version,
+        [Parameter(Mandatory)][string]$PackageSha256,
+        [Parameter(Mandatory)]$FileTransaction
+    )
+    $root = Get-CcodProductFullPath $InstallRoot
+    if ($null -eq $FileTransaction -or $Version -cne $script:CcodProductVersion -or
+        $RuntimeId -cnotmatch ('^' + [regex]::Escape($Version) + '-[0-9a-f]{16}-[0-9a-f]{32}$') -or
+        $PackageSha256 -cnotmatch '^[0-9a-f]{64}$') {
+        Throw-CcodProductRegistrationError 'CCOD_PRODUCT_REGISTRATION_INVALID' 'Product registration identity is invalid.' $RuntimeId
+    }
+    $runtimeRoot = [IO.Path]::GetFullPath((Join-Path (Join-Path $root 'runtime') $RuntimeId))
+    $bootstrapPath = [IO.Path]::GetFullPath((Join-Path $runtimeRoot 'src\persistence\bootstrap.ps1'))
+    $uninstallerPath = [IO.Path]::GetFullPath((Join-Path $runtimeRoot 'Uninstall-CodexControlOtherDevices.ps1'))
+    $candidateRoot = [IO.Path]::GetFullPath((Join-Path $runtimeRoot 'registration'))
+    $startMenu = [pscustomobject][ordered]@{
+        kind = 'StartMenu'; leaf = 'CodexRemote-fix.lnk'; relativePath = 'CodexRemote-fix\CodexRemote-fix.lnk'
+        candidatePath = [IO.Path]::GetFullPath((Join-Path $candidateRoot 'StartMenu.CodexRemote-fix.lnk'))
+        bootstrapPath = $bootstrapPath; installRoot = $root
+    }
+    $desktop = [pscustomobject][ordered]@{
+        kind = 'Desktop'; leaf = 'CodexRemote-fix.lnk'; relativePath = 'CodexRemote-fix.lnk'
+        candidatePath = [IO.Path]::GetFullPath((Join-Path $candidateRoot 'Desktop.CodexRemote-fix.lnk'))
+        bootstrapPath = $bootstrapPath; installRoot = $root
+    }
+    return [pscustomobject][ordered]@{
+        schemaVersion = 1; installRoot = $root; runtimeId = $RuntimeId; version = $Version; packageSha256 = $PackageSha256
+        runtimeRoot = $runtimeRoot; bootstrapPath = $bootstrapPath; uninstallerPath = $uninstallerPath
+        productKeyName = $script:CcodProductKeyName; startMenuShortcut = $startMenu; desktopShortcut = $desktop
+    }
+}
+
+function Test-CcodProductRegistration {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)]$Registration,
+        [Parameter(Mandatory)][string]$ExpectedRuntimeId,
+        [Parameter(Mandatory)][string]$ExpectedVersion,
+        [Parameter(Mandatory)][string]$ExpectedPackageSha256
+    )
+    if (-not (Test-CcodProductExactProperties $Registration $script:CcodProductFields) -or
+        $Registration.schemaVersion -isnot [int] -or $Registration.schemaVersion -ne 1 -or
+        $Registration.installRoot -isnot [string] -or -not [IO.Path]::IsPathRooted([string]$Registration.installRoot) -or
+        $Registration.runtimeId -isnot [string] -or [string]$Registration.runtimeId -cne $ExpectedRuntimeId -or
+        $Registration.version -isnot [string] -or [string]$Registration.version -cne $ExpectedVersion -or
+        $Registration.packageSha256 -isnot [string] -or [string]$Registration.packageSha256 -cne $ExpectedPackageSha256 -or
+        $Registration.productKeyName -isnot [string] -or [string]$Registration.productKeyName -cne $script:CcodProductKeyName) { return $false }
+    try {
+        $expected = New-CcodProductRegistration -InstallRoot ([string]$Registration.installRoot) -RuntimeId $ExpectedRuntimeId -Version $ExpectedVersion -PackageSha256 $ExpectedPackageSha256 -FileTransaction ([pscustomobject]@{})
+    } catch { return $false }
+    foreach ($name in @('runtimeRoot','bootstrapPath','uninstallerPath','productKeyName')) {
+        if ($Registration.$name -isnot [string] -or [string]$Registration.$name -cne [string]$expected.$name) { return $false }
+    }
+    return (Test-CcodProductShortcut $Registration.startMenuShortcut $expected.startMenuShortcut) -and
+        (Test-CcodProductShortcut $Registration.desktopShortcut $expected.desktopShortcut)
+}
+
+function Test-CcodProductReadyProof {
+    param($Proof,$Registration)
+    if (-not (Test-CcodProductExactProperties $Proof $script:CcodReadyFields)) { return $false }
+    return $Proof.phase -is [string] -and [string]$Proof.phase -ceq 'Ready' -and
+        $Proof.runtimeId -is [string] -and [string]$Proof.runtimeId -ceq [string]$Registration.runtimeId -and
+        $Proof.version -is [string] -and [string]$Proof.version -ceq [string]$Registration.version -and
+        $Proof.packageSha256 -is [string] -and [string]$Proof.packageSha256 -ceq [string]$Registration.packageSha256 -and
+        $Proof.bootstrapPath -is [string] -and [string]$Proof.bootstrapPath -ceq [string]$Registration.bootstrapPath -and
+        $Proof.uninstallerPath -is [string] -and [string]$Proof.uninstallerPath -ceq [string]$Registration.uninstallerPath
+}
+
+function Get-CcodProductRegistrationAdapters {
+    param([hashtable]$Adapters)
+    $defaults = @{
+        GetReadyProof = { param($Registration) Throw-CcodProductRegistrationError 'CCOD_PRODUCT_REGISTRATION_NOT_READY' 'No independently verified Ready proof was supplied.' $Registration.runtimeId }
+        WriteProductRegistration = { param($Registration) Write-CcodCurrentUserProductRegistration $Registration }
+        ReadProductRegistration = { param($Registration) Read-CcodCurrentUserProductRegistration $Registration }
+        WriteShortcut = { param($Kind,$Shortcut,$FileTransaction) Write-CcodCurrentUserProductShortcut -Kind $Kind -Shortcut $Shortcut -FileTransaction $FileTransaction }
+        ReadShortcut = { param($Kind,$Shortcut) Read-CcodCurrentUserProductShortcut -Kind $Kind -Shortcut $Shortcut }
+        ReadLegacyRegistration = { param($ExpectedAppId) Read-CcodCurrentUserLegacyRegistration -ExpectedAppId $ExpectedAppId }
+        ReadVerifiedRegistration = { Read-CcodCurrentUserVerifiedRegistration }
+        RemoveLegacyRegistration = { param($ExpectedAppId,$ExpectedShortcutNames) Remove-CcodCurrentUserLegacyRegistration -ExpectedAppId $ExpectedAppId -ExpectedShortcutNames $ExpectedShortcutNames }
+    }
+    if ($null -eq $Adapters) { return $defaults }
+    if ($Adapters -isnot [hashtable]) { Throw-CcodProductRegistrationError 'CCOD_PRODUCT_ADAPTER_INVALID' 'Product adapters must be a hashtable.' $Adapters }
+    $resolved = @{}; foreach ($name in $defaults.Keys) { $resolved[$name] = $defaults[$name] }
+    foreach ($name in $Adapters.Keys) {
+        if ($name -isnot [string] -or -not $resolved.ContainsKey($name) -or $Adapters[$name] -isnot [scriptblock]) {
+            Throw-CcodProductRegistrationError 'CCOD_PRODUCT_ADAPTER_INVALID' 'Product adapter contract is invalid.' $name
+        }
+        $resolved[$name] = $Adapters[$name]
+    }
+    return $resolved
+}
+
+function Get-CcodProductRegistryPath { 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\CodexRemote-fix' }
+function Get-CcodLegacyRegistryPath([string]$AppId) { 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\' + $AppId + '_is1' }
+function Get-CcodProductPowerShellPath {
+    $system=[Environment]::GetFolderPath([Environment+SpecialFolder]::System);if([string]::IsNullOrWhiteSpace($system)){throw 'system folder missing'}
+    [IO.Path]::GetFullPath((Join-Path $system 'WindowsPowerShell\v1.0\powershell.exe'))
+}
+function Get-CcodProductUninstallCommand($Registration) {
+    '"{0}" -NoProfile -ExecutionPolicy Bypass -File "{1}"' -f (Get-CcodProductPowerShellPath),([string]$Registration.uninstallerPath).Replace('"','')
+}
+function Write-CcodCurrentUserProductRegistration {
+    param($Registration)
+    $path=Get-CcodProductRegistryPath;$command=Get-CcodProductUninstallCommand $Registration
+    New-Item -Path $path -Force -ErrorAction Stop|Out-Null
+    $values=[ordered]@{DisplayName='CodexRemote-fix';DisplayVersion=[string]$Registration.version;Publisher='naipi11';InstallLocation=[string]$Registration.runtimeRoot;UninstallString=$command;QuietUninstallString=($command+' -Confirm:$false');NoModify=1;NoRepair=1;CcodRuntimeId=[string]$Registration.runtimeId;CcodPackageSha256=[string]$Registration.packageSha256}
+    foreach($name in $values.Keys){$type=if($name-in@('NoModify','NoRepair')){'DWord'}else{'String'};New-ItemProperty -LiteralPath $path -Name $name -Value $values[$name] -PropertyType $type -Force -ErrorAction Stop|Out-Null}
+}
+function Read-CcodCurrentUserProductRegistration {
+    param($Registration)
+    try{$value=Get-ItemProperty -LiteralPath (Get-CcodProductRegistryPath) -ErrorAction Stop}catch{return $null}
+    $command=Get-CcodProductUninstallCommand $Registration
+    if($value.DisplayName-cne'CodexRemote-fix'-or$value.DisplayVersion-cne$Registration.version-or$value.Publisher-cne'naipi11'-or$value.InstallLocation-cne$Registration.runtimeRoot-or$value.UninstallString-cne$command-or$value.QuietUninstallString-cne($command+' -Confirm:$false')-or[int]$value.NoModify-ne1-or[int]$value.NoRepair-ne1-or$value.CcodRuntimeId-cne$Registration.runtimeId-or$value.CcodPackageSha256-cne$Registration.packageSha256){return $null}
+    $Registration
+}
+function Get-CcodProductShortcutDestination {
+    param([string]$Kind)
+    $base=if($Kind-ceq'StartMenu'){[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs)}else{[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop)}
+    if([string]::IsNullOrWhiteSpace($base)-or-not[IO.Path]::IsPathRooted($base)){throw 'special folder missing'}
+    if($Kind-ceq'StartMenu'){[IO.Path]::GetFullPath((Join-Path (Join-Path $base 'CodexRemote-fix') 'CodexRemote-fix.lnk'))}else{[IO.Path]::GetFullPath((Join-Path $base 'CodexRemote-fix.lnk'))}
+}
+function Get-CcodProductFileSha256([string]$Path){(Get-FileHash -LiteralPath $Path -Algorithm SHA256 -ErrorAction Stop).Hash.ToLowerInvariant()}
+function New-CcodProductShortcutCandidates {
+    param([Parameter(Mandatory)][string]$Directory)
+    $root=Get-CcodProductFullPath $Directory;if([IO.Directory]::Exists($root)-or[IO.File]::Exists($root)){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_REGISTRATION_INVALID' 'Shortcut candidate root must be create-only.' $root}
+    [IO.Directory]::CreateDirectory($root)|Out-Null;$shell=$null
+    try{
+        $shell=New-Object -ComObject WScript.Shell;$system=[Environment]::GetFolderPath([Environment+SpecialFolder]::System);$target=[IO.Path]::GetFullPath((Join-Path $system 'schtasks.exe'))
+        $records=[Collections.Generic.List[object]]::new()
+        foreach($name in @('StartMenu.CodexRemote-fix.lnk','Desktop.CodexRemote-fix.lnk')){
+            $path=Join-Path $root $name;$link=$shell.CreateShortcut($path);try{$link.TargetPath=$target;$link.Arguments='/Run /TN "Codex Control Other Devices Supervisor"';$link.Description='CodexRemote-fix';$link.Save()}finally{if($null-ne$link){[void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($link)}}
+            $item=Get-Item -LiteralPath $path -Force -ErrorAction Stop;$records.Add([pscustomobject]@{Relative=('registration/'+$name);Source=$path;ExpectedLength=[int64]$item.Length;ExpectedSha256=Get-CcodProductFileSha256 $path})
+        }
+        return @($records)
+    }finally{if($null-ne$shell){[void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($shell)}}
+}
+function Write-CcodCurrentUserProductShortcut {
+    param([string]$Kind,$Shortcut,$FileTransaction)
+    $source=[IO.Path]::GetFullPath([string]$Shortcut.candidatePath);$runtime=[IO.Path]::GetFullPath((Split-Path (Split-Path $source -Parent) -Parent));if(-not$source.StartsWith($runtime.TrimEnd('\')+'\',[StringComparison]::OrdinalIgnoreCase)-or-not[IO.File]::Exists($source)){throw 'shortcut candidate missing'}
+    $item=Get-Item -LiteralPath $source -Force -ErrorAction Stop;if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){throw 'shortcut candidate unsafe'}
+    Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop
+    $folder=Open-CcodInstallProductSpecialFolder -FileTransaction $FileTransaction -Kind $Kind
+    Copy-CcodInstallProductShortcut -Folder $folder -Kind $Kind -SourcePath $source -Leaf 'CodexRemote-fix.lnk' -ExpectedLength ([int64]$item.Length) -ExpectedSha256 (Get-CcodProductFileSha256 $source) -FileTransaction $FileTransaction|Out-Null
+}
+function Read-CcodCurrentUserProductShortcut {
+    param([string]$Kind,$Shortcut)
+    $destination=Get-CcodProductShortcutDestination $Kind;$source=[string]$Shortcut.candidatePath
+    if(-not[IO.File]::Exists($destination)-or-not[IO.File]::Exists($source)){return $null}
+    $item=Get-Item -LiteralPath $destination -Force -ErrorAction Stop;if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0-or(Get-CcodProductFileSha256 $destination)-cne(Get-CcodProductFileSha256 $source)){return $null}
+    $Shortcut
+}
+function Read-CcodCurrentUserLegacyRegistration {
+    param([string]$ExpectedAppId)
+    $path=Get-CcodLegacyRegistryPath $ExpectedAppId;if(-not(Test-Path -LiteralPath $path -PathType Container)){return $null}
+    $value=Get-ItemProperty -LiteralPath $path -ErrorAction Stop;$present=[Collections.Generic.List[string]]::new()
+    $programs=[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs);$desktop=[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop)
+    foreach($name in $script:CcodLegacyShortcutNames){$relative=$name.Substring($name.IndexOf('\')+1);$candidate=if($name.StartsWith('Programs\',[StringComparison]::Ordinal)){Join-Path $programs $relative}else{Join-Path $desktop $relative};if(Test-Path -LiteralPath $candidate -PathType Leaf){$present.Add($name)}}
+    [pscustomobject]@{appId=$ExpectedAppId;uninstallString=[string]$value.UninstallString;shortcutNames=@($present)}
+}
+function Read-CcodCurrentUserVerifiedRegistration {
+    $path=Get-CcodProductRegistryPath;if(-not(Test-Path -LiteralPath $path -PathType Container)){return $null}
+    $value=Get-ItemProperty -LiteralPath $path -ErrorAction Stop
+    if($value.CcodRuntimeId-isnot[string]-or$value.CcodRuntimeId-cnotmatch'^2\.5\.22-[0-9a-f]{16}-[0-9a-f]{32}$'-or$value.DisplayVersion-cne'2.5.22'-or$value.CcodPackageSha256-isnot[string]-or$value.CcodPackageSha256-cnotmatch'^[0-9a-f]{64}$'){return $null}
+    foreach($kind in @('StartMenu','Desktop')){if(-not[IO.File]::Exists((Get-CcodProductShortcutDestination $kind))){return $null}}
+    [pscustomobject]@{verified=$true;runtimeId=[string]$value.CcodRuntimeId;version=[string]$value.DisplayVersion;packageSha256=[string]$value.CcodPackageSha256}
+}
+function Remove-CcodCurrentUserLegacyRegistration {
+    param([string]$ExpectedAppId,[string[]]$ExpectedShortcutNames)
+    $programs=[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs);$desktop=[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop)
+    foreach($name in $ExpectedShortcutNames){$relative=$name.Substring($name.IndexOf('\')+1);$candidate=if($name.StartsWith('Programs\',[StringComparison]::Ordinal)){Join-Path $programs $relative}else{Join-Path $desktop $relative};if(Test-Path -LiteralPath $candidate -PathType Leaf){Remove-Item -LiteralPath $candidate -Force -ErrorAction Stop}}
+    $path=Get-CcodLegacyRegistryPath $ExpectedAppId;if(Test-Path -LiteralPath $path -PathType Container){Remove-Item -LiteralPath $path -Force -ErrorAction Stop}
+}
+
+function Commit-CcodProductRegistration {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)]$Registration,[Parameter(Mandatory)]$FileTransaction,[hashtable]$Adapters)
+    if ($null -eq $FileTransaction -or -not (Test-CcodProductRegistration -Registration $Registration -ExpectedRuntimeId ([string]$Registration.runtimeId) -ExpectedVersion $script:CcodProductVersion -ExpectedPackageSha256 ([string]$Registration.packageSha256))) {
+        Throw-CcodProductRegistrationError 'CCOD_PRODUCT_REGISTRATION_INVALID' 'Product registration contract is invalid.' $Registration
+    }
+    $adapter = Get-CcodProductRegistrationAdapters $Adapters
+    $ready = & $adapter.GetReadyProof $Registration
+    if (-not (Test-CcodProductReadyProof $ready $Registration)) {
+        Throw-CcodProductRegistrationError 'CCOD_PRODUCT_REGISTRATION_NOT_READY' 'Product registration requires the exact terminal Ready proof.' $Registration.runtimeId
+    }
+    try {
+        & $adapter.WriteProductRegistration $Registration
+        & $adapter.WriteShortcut 'StartMenu' $Registration.startMenuShortcut $FileTransaction
+        & $adapter.WriteShortcut 'Desktop' $Registration.desktopShortcut $FileTransaction
+        $product = & $adapter.ReadProductRegistration $Registration
+        $startMenu = & $adapter.ReadShortcut 'StartMenu' $Registration.startMenuShortcut
+        $desktop = & $adapter.ReadShortcut 'Desktop' $Registration.desktopShortcut
+        if (-not (Test-CcodProductRegistration -Registration $product -ExpectedRuntimeId $Registration.runtimeId -ExpectedVersion $Registration.version -ExpectedPackageSha256 $Registration.packageSha256) -or
+            -not (Test-CcodProductShortcut $startMenu $Registration.startMenuShortcut) -or
+            -not (Test-CcodProductShortcut $desktop $Registration.desktopShortcut)) {
+            throw 'three-record read-back mismatch'
+        }
+    } catch {
+        Throw-CcodProductRegistrationError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product registration write/read-back failed; legacy state was retained.' $Registration.runtimeId
+    }
+    return [pscustomobject][ordered]@{
+        schemaVersion = 1; verified = $true; runtimeId = [string]$Registration.runtimeId; version = [string]$Registration.version
+        packageSha256 = [string]$Registration.packageSha256; productKeyName = [string]$Registration.productKeyName
+        shortcutNames = @([string]$Registration.startMenuShortcut.relativePath,[string]$Registration.desktopShortcut.relativePath)
+    }
+}
+
+function Remove-CcodLegacyProductRegistration {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string]$ExpectedAppId,
+        [hashtable]$Adapters
+    )
+    if ($ExpectedAppId -cne $script:CcodProductAppId) {
+        Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration requires the canonical AppId and a verified new registration.' $ExpectedAppId
+    }
+    $adapter = Get-CcodProductRegistrationAdapters $Adapters
+    $verified=&$adapter.ReadVerifiedRegistration
+    if($null-eq$verified-or$verified.verified-isnot[bool]-or-not$verified.verified){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration requires a current three-record read-back proof.' $ExpectedAppId}
+    $legacy = & $adapter.ReadLegacyRegistration $ExpectedAppId
+    if($null-eq$legacy){return}
+    if ($legacy.appId -isnot [string] -or [string]$legacy.appId -cne $ExpectedAppId -or
+        $legacy.uninstallString -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$legacy.uninstallString) -or
+        $null -eq $legacy.shortcutNames -or (@($legacy.shortcutNames) -join '|') -cne ($script:CcodLegacyShortcutNames -join '|')) {
+        Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product entry or shortcut names do not match the exact migration allowlist.' $ExpectedAppId
+    }
+    try { & $adapter.RemoveLegacyRegistration $ExpectedAppId @($script:CcodLegacyShortcutNames) }
+    catch { Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration failed without authorizing broader deletion.' $ExpectedAppId }
+}
+
+Export-ModuleMember -Function New-CcodProductRegistration,Test-CcodProductRegistration,Commit-CcodProductRegistration,Remove-CcodLegacyProductRegistration
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index 31a4cfc..8126cc0 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -136,7 +136,7 @@ function New-CcodHardLink {
 }
 
 Invoke-CcodTest 'exports only immutable generation operations and an inert CLR marker' {
-    $expected=@('Close-CcodInstallFileTransaction','Commit-CcodInstallActivePointer','Copy-CcodInstallSealedSource','New-CcodInstallDirectory','New-CcodInstallGenerationLeaf','Open-CcodInstallGeneration','Open-CcodInstallRetainedGeneration','Open-CcodInstallStateTransaction','Retire-CcodInstallGeneration','Write-CcodInstallGenerationManifest','Write-CcodInstallRecord')
+    $expected=@('Close-CcodInstallFileTransaction','Commit-CcodInstallActivePointer','Copy-CcodInstallProductShortcut','Copy-CcodInstallSealedSource','New-CcodInstallDirectory','New-CcodInstallGenerationLeaf','Open-CcodInstallGeneration','Open-CcodInstallProductSpecialFolder','Open-CcodInstallRetainedGeneration','Open-CcodInstallStateTransaction','Retire-CcodInstallGeneration','Write-CcodInstallGenerationManifest','Write-CcodInstallRecord')
     Assert-CcodEqual ($expected -join '|') ((@($module.ExportedCommands.Keys)|Sort-Object)-join '|') 'module export surface is capability-only'
     Assert-CcodEqual 4 ([CcodInstallGenerationCapabilityMarkerV4]::CapabilityAbi) 'marker exposes the current non-mutating ABI value'
     Assert-CcodEqual 'CcodInstallGenerationCapabilityMarkerV4' ((@([CcodInstallGenerationCapabilityMarkerV4].Assembly.GetExportedTypes()|ForEach-Object FullName)) -join '|') 'current CLR bridge exports only the inert marker'
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index a93c2fb..b15dce2 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -185,6 +185,9 @@ function New-CcodLifecycleFake {
         FailLogCode = $null
         CopyOverride = $null
         TaskRuntimeIds = [Collections.Generic.List[string]]::new()
+        ProductRegistrationCalls = 0
+        ProductRegistrationFailure = $false
+        ProductRegistrationReadyObserved = $false
     }
     $adapters = @{}
     $adapters.ValidateSource = { param($SourceRoot) $world.Calls.Add("Validate:$([IO.Path]::GetFileName($SourceRoot))"); [bool]$world.ValidateSource }.GetNewClosure()
@@ -306,6 +309,15 @@ function New-CcodLifecycleFake {
         }
         $world.LogRecords.Add($Record)
     }.GetNewClosure()
+    $adapters.RegisterProduct = {
+        param($InstallRoot,$RuntimeId,$Version,$PackageSha256,$FileTransaction,$TransactionRecord)
+        $world.Calls.Add("RegisterProduct:$RuntimeId")
+        $world.ProductRegistrationCalls++
+        $world.ProductRegistrationReadyObserved = $null -ne $TransactionRecord -and $TransactionRecord.phase -ceq 'Ready'
+        if ($world.ProductRegistrationFailure) { throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new('fixture registration failed'),'CCOD_PRODUCT_REGISTRATION_FAILED',[Management.Automation.ErrorCategory]::InvalidData,$RuntimeId) }
+        [pscustomobject]@{ verified=$true; legacyRemoved=$true }
+    }.GetNewClosure()
+    $adapters.AddProductShortcutCandidates = { param($Files) [pscustomobject]@{Files=@($Files);TemporaryRoot=$null} }
     [pscustomobject]@{ World = $world; Adapters = $adapters }
 }
 
@@ -314,7 +326,7 @@ function New-CcodReadyFinalizationGapFixture {
     $install=New-CcodLifecycleTempRoot
     $nodeRoot=New-CcodLifecycleTempRoot
     try {
-        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22-finalization-recovery' | Out-Null
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22' | Out-Null
         $node=New-CcodLifecycleFakeNode -Root $nodeRoot
         $fake=New-CcodLifecycleFake -NodePath $node
         $fake.Adapters.CommitReadyTransaction={throw 'PRIVATE_FINAL_SNAPSHOT_FAILURE'}
@@ -1686,6 +1698,7 @@ $results += Invoke-CcodTest 'a later invocation recovers one missing Ready trans
         $recoveryFake=New-CcodLifecycleFake -NodePath $fixture.Node
         $result=Invoke-CcodInstall -SourceRoot $fixture.Source -InstallRoot $fixture.Install -Adapters $recoveryFake.Adapters
         Assert-CcodEqual 'Recovered' $result.Outcome 'finalization recovery reports a bounded recovered outcome'
+        Assert-CcodEqual 1 $recoveryFake.World.ProductRegistrationCalls 'Ready-finalization recovery completes post-Ready product registration exactly once'
         Assert-CcodEqual $fixture.Transaction.newRuntimeId $result.RuntimeId 'recovery result binds the pending transaction runtime'
         Assert-CcodEqual $runtimeCount @(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'runtime') -Directory -Force).Count 'recovery creates no runtime generation'
         Assert-CcodEqual $pointerCount @(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\active-generation') -File -Force).Count 'recovery appends no active pointer'
@@ -3191,4 +3204,30 @@ $results += Invoke-CcodTest 'sealed Setup carries no mutable validation or legac
     Assert-CcodTrue ($installerScript -cmatch '(?m)^CreateAppDir=no\s*$' -and $installerScript -cmatch '(?m)^Uninstallable=no\s*$') 'Setup cannot create the old mutable validation root'
 }
 
+# Production mutation caught: product state written from ProtectionReady or before the terminal transaction snapshot.
+$results += Invoke-CcodTest 'product registration runs exactly once only after the Task 2 Ready transaction is durable' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    try{
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null
+        $node=New-CcodLifecycleFakeNode -Root $nodeRoot;$fake=New-CcodLifecycleFake -NodePath $node
+        $result=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('3'*64) -Adapters $fake.Adapters
+        Assert-CcodEqual 1 $fake.World.ProductRegistrationCalls 'successful install commits product registration exactly once'
+        Assert-CcodTrue $fake.World.ProductRegistrationReadyObserved 'registration adapter receives only the durable Ready transaction'
+        Assert-CcodTrue $result.ProductRegistrationVerified 'install result reports verified post-Ready registration'
+    }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}}
+}
+
+# Production mutation caught: treating post-Ready registration failure as an install rollback or Failed lifecycle snapshot.
+$results += Invoke-CcodTest 'registration failure preserves durable Ready without rollback or Failed transaction' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    try{
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null
+        $node=New-CcodLifecycleFakeNode -Root $nodeRoot;$fake=New-CcodLifecycleFake -NodePath $node;$fake.World.ProductRegistrationFailure=$true
+        Assert-CcodThrows { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('3'*64) -Adapters $fake.Adapters|Out-Null } 'CCOD_PRODUCT_REGISTRATION_FAILED'
+        $module=Get-Module InstallLifecycle;$head=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install
+        Assert-CcodEqual 'Ready' $head.phase 'post-Ready registration failure cannot downgrade the lifecycle transaction'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Failed.*.json' -File).Count 'registration failure appends no Failed transaction snapshot'
+    }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}}
+}
+
 Write-Output "Install lifecycle self-tests passed: $($results.Count)"
diff --git a/tests/persistence/ProductRegistration.SelfTest.ps1 b/tests/persistence/ProductRegistration.SelfTest.ps1
new file mode 100644
index 0000000..ab08a00
--- /dev/null
+++ b/tests/persistence/ProductRegistration.SelfTest.ps1
@@ -0,0 +1,179 @@
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'TestSupport.ps1')
+
+$repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+$modulePath = Join-Path $repositoryRoot 'src\persistence\modules\ProductRegistration.psm1'
+if (-not (Test-Path -LiteralPath $modulePath -PathType Leaf)) {
+    throw "ProductRegistration module is missing: $modulePath"
+}
+Import-Module $modulePath -Force
+
+$runtimeId = '2.5.22-1111111111111111-22222222222222222222222222222222'
+$packageSha256 = '3' * 64
+$appId = '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}'
+
+function New-CcodRegistrationWorld {
+    param([string]$InstallRoot = 'C:\fixture\CodexControlOtherDevices')
+
+    $registration = New-CcodProductRegistration -InstallRoot $InstallRoot -RuntimeId $runtimeId -Version '2.5.22' -PackageSha256 $packageSha256 -FileTransaction ([pscustomobject]@{})
+    $world = [pscustomobject]@{
+        Registration = $registration
+        Ready = [pscustomobject][ordered]@{
+            phase = 'Ready'
+            runtimeId = $runtimeId
+            version = '2.5.22'
+            packageSha256 = $packageSha256
+            bootstrapPath = $registration.bootstrapPath
+            uninstallerPath = $registration.uninstallerPath
+        }
+        Product = $null
+        Shortcuts = @{}
+        WriteProductFailure = $false
+        WriteShortcutFailure = $null
+        ReadProductFailure = $false
+        ReadShortcutFailure = $null
+        Legacy = [pscustomobject]@{
+            appId = $appId
+            uninstallString = '"C:\legacy\unins000.exe"'
+            shortcutNames = @(
+                'Programs\Codex Control other devices\Codex Control other devices for Windows.lnk',
+                'Programs\Codex Control other devices\Open the tray supervisor.lnk',
+                'Programs\Codex Control other devices\Compatibility check.lnk',
+                'Programs\Codex Control other devices\Uninstall Codex Control other devices.lnk',
+                'Programs\Codex Control other devices\CodexRemote-fix.lnk',
+                'Programs\Codex Control other devices\CodexRemote-fix compatibility check.lnk',
+                'Programs\Codex Control other devices\Uninstall CodexRemote-fix.lnk',
+                ('Desktop\Codex ' + [char]0x8BBE + [char]0x5907 + [char]0x8FDE + [char]0x63A5 + ' (Device Connection).lnk')
+            )
+        }
+        LegacyRemoved = $false
+        LegacyRemovalCalls = 0
+        Calls = [Collections.Generic.List[string]]::new()
+    }
+    $world | Add-Member -NotePropertyName Adapters -NotePropertyValue @{
+        GetReadyProof = { param($Registration) $world.Calls.Add('Ready'); $world.Ready }.GetNewClosure()
+        WriteProductRegistration = {
+            param($Registration)
+            $world.Calls.Add('WriteProduct')
+            if ($world.WriteProductFailure) { throw 'fixture product write failed' }
+            $world.Product = $Registration
+        }.GetNewClosure()
+        ReadProductRegistration = {
+            param($Registration)
+            $world.Calls.Add('ReadProduct')
+            if ($world.ReadProductFailure) { throw 'fixture product read failed' }
+            $world.Product
+        }.GetNewClosure()
+        WriteShortcut = {
+            param($Kind,$Shortcut,$FileTransaction)
+            $world.Calls.Add("WriteShortcut:$Kind")
+            if ($world.WriteShortcutFailure -ceq $Kind) { throw 'fixture shortcut write failed' }
+            $world.Shortcuts[$Kind] = $Shortcut
+        }.GetNewClosure()
+        ReadShortcut = {
+            param($Kind,$Shortcut)
+            $world.Calls.Add("ReadShortcut:$Kind")
+            if ($world.ReadShortcutFailure -ceq $Kind) { throw 'fixture shortcut read failed' }
+            $world.Shortcuts[$Kind]
+        }.GetNewClosure()
+        ReadLegacyRegistration = { param($ExpectedAppId) $world.Calls.Add('ReadLegacy'); $world.Legacy }.GetNewClosure()
+        ReadVerifiedRegistration = { [pscustomobject]@{verified=($null-ne$world.Product-and$world.Shortcuts.Count-eq2)} }.GetNewClosure()
+        RemoveLegacyRegistration = { param($ExpectedAppId,$ExpectedShortcutNames) $world.Calls.Add('RemoveLegacy'); $world.LegacyRemovalCalls++; $world.LegacyRemoved = $true }.GetNewClosure()
+    }
+    return $world
+}
+
+$results = @()
+
+# Production mutation caught: accepting a caller-crafted path/runtime tuple as a registration contract.
+$results += Invoke-CcodTest 'registration rejects noncanonical runtime version hash and install targets' {
+    Assert-CcodThrows { New-CcodProductRegistration -InstallRoot 'relative' -RuntimeId $runtimeId -Version '2.5.22' -PackageSha256 $packageSha256 -FileTransaction ([pscustomobject]@{}) | Out-Null } 'CCOD_PRODUCT_REGISTRATION_INVALID'
+    Assert-CcodThrows { New-CcodProductRegistration -InstallRoot 'C:\fixture\root' -RuntimeId 'runtime' -Version '2.5.22' -PackageSha256 $packageSha256 -FileTransaction ([pscustomobject]@{}) | Out-Null } 'CCOD_PRODUCT_REGISTRATION_INVALID'
+    Assert-CcodThrows { New-CcodProductRegistration -InstallRoot 'C:\fixture\root' -RuntimeId $runtimeId -Version '2.5.21' -PackageSha256 $packageSha256 -FileTransaction ([pscustomobject]@{}) | Out-Null } 'CCOD_PRODUCT_REGISTRATION_INVALID'
+    Assert-CcodThrows { New-CcodProductRegistration -InstallRoot 'C:\fixture\root' -RuntimeId $runtimeId -Version '2.5.22' -PackageSha256 ('A' * 64) -FileTransaction ([pscustomobject]@{}) | Out-Null } 'CCOD_PRODUCT_REGISTRATION_INVALID'
+}
+
+# Production mutation caught: allowing product writes from ProtectionReady or a mismatched Ready proof.
+$results += Invoke-CcodTest 'registration performs no writes before an exact Ready proof' {
+    foreach ($mutation in @(
+        { param($ready) $ready.phase = 'ProtectionReady' },
+        { param($ready) $ready.runtimeId = '2.5.22-aaaaaaaaaaaaaaaa-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' },
+        { param($ready) $ready.version = '2.5.21' },
+        { param($ready) $ready.packageSha256 = '4' * 64 },
+        { param($ready) $ready.bootstrapPath = 'C:\outside\bootstrap.ps1' },
+        { param($ready) $ready.uninstallerPath = 'C:\outside\uninstall.ps1' }
+    )) {
+        $world = New-CcodRegistrationWorld
+        & $mutation $world.Ready
+        Assert-CcodThrows { Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters | Out-Null } 'CCOD_PRODUCT_REGISTRATION_NOT_READY'
+        Assert-CcodEqual 0 @($world.Calls | Where-Object { $_ -clike 'Write*' }).Count 'a non-Ready proof cannot reach product writes'
+        Assert-CcodEqual 0 $world.LegacyRemovalCalls 'a non-Ready proof cannot reach legacy removal'
+    }
+}
+
+# Production mutation caught: deleting compatibility state after a partial new registration.
+$results += Invoke-CcodTest 'write and read-back failures preserve every legacy entry and shortcut name' {
+    foreach ($failure in @('WriteProduct','WriteStartMenu','WriteDesktop','ReadProduct','ReadStartMenu','ReadDesktop')) {
+        $world = New-CcodRegistrationWorld
+        switch ($failure) {
+            'WriteProduct' { $world.WriteProductFailure = $true }
+            'WriteStartMenu' { $world.WriteShortcutFailure = 'StartMenu' }
+            'WriteDesktop' { $world.WriteShortcutFailure = 'Desktop' }
+            'ReadProduct' { $world.ReadProductFailure = $true }
+            'ReadStartMenu' { $world.ReadShortcutFailure = 'StartMenu' }
+            'ReadDesktop' { $world.ReadShortcutFailure = 'Desktop' }
+        }
+        $legacyUninstallString = $world.Legacy.uninstallString
+        $legacyShortcutNames = @($world.Legacy.shortcutNames)
+        Assert-CcodThrows { Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters | Out-Null } 'CCOD_PRODUCT_REGISTRATION_FAILED'
+        Assert-CcodEqual $legacyUninstallString $world.Legacy.uninstallString 'failure before read-back retains the legacy entry'
+        Assert-CcodEqual ($legacyShortcutNames -join '|') (@($world.Legacy.shortcutNames) -join '|') 'failure before read-back retains exact legacy shortcut names'
+        Assert-CcodEqual 0 $world.LegacyRemovalCalls 'failed registration never removes legacy state'
+    }
+}
+
+# Production mutation caught: trusting a shortcut read-back that resolves outside the selected sealed generation.
+$results += Invoke-CcodTest 'shortcut path and target mismatches fail the three-record read-back gate' {
+    foreach ($kind in @('StartMenu','Desktop')) {
+        $world = New-CcodRegistrationWorld
+        $originalRead = $world.Adapters.ReadShortcut
+        $world.Adapters.ReadShortcut = {
+            param($candidateKind,$expected)
+            $value = & $originalRead $candidateKind $expected
+            if ($candidateKind -ceq $kind) {
+                $value = $value.PSObject.Copy()
+                $value.bootstrapPath = 'C:\outside\bootstrap.ps1'
+            }
+            $value
+        }.GetNewClosure()
+        Assert-CcodThrows { Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters | Out-Null } 'CCOD_PRODUCT_REGISTRATION_FAILED'
+        Assert-CcodEqual 0 $world.LegacyRemovalCalls 'mismatched shortcut target retains legacy state'
+    }
+}
+
+# Production mutation caught: considering adapter write success equivalent to durable read-back.
+$results += Invoke-CcodTest 'valid Ready registration reads all three new records before exact legacy removal' {
+    $world = New-CcodRegistrationWorld
+    $receipt = Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
+    Assert-CcodTrue $receipt.verified 'registration returns a verified three-record receipt'
+    Assert-CcodEqual 'Ready,WriteProduct,WriteShortcut:StartMenu,WriteShortcut:Desktop,ReadProduct,ReadShortcut:StartMenu,ReadShortcut:Desktop' ($world.Calls -join ',') 'all new writes and read-backs precede legacy migration'
+    Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters
+    Assert-CcodEqual 1 $world.LegacyRemovalCalls 'exact legacy migration runs once after verified registration'
+    Assert-CcodTrue $world.LegacyRemoved 'exact legacy registration and shortcut set is removed'
+}
+
+# Production mutation caught: accepting an unexpected AppId/name set or an unverified registration receipt.
+$results += Invoke-CcodTest 'legacy migration rejects AppId and shortcut-name mismatches without deletion' {
+    foreach ($mismatch in @('AppId','Shortcut','Receipt')) {
+        $world = New-CcodRegistrationWorld
+        $receipt = Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
+        if ($mismatch -ceq 'AppId') { $world.Legacy.appId = '{AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE}' }
+        if ($mismatch -ceq 'Shortcut') { $world.Legacy.shortcutNames = @('Programs\unexpected.lnk') }
+        if ($mismatch -ceq 'Receipt') { $world.Product = $null }
+        Assert-CcodThrows { Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters } 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+        Assert-CcodEqual 0 $world.LegacyRemovalCalls 'legacy mismatch is rejected before any deletion'
+        Assert-CcodTrue (-not $world.LegacyRemoved) 'legacy state remains intact on mismatch'
+    }
+}
+
+Write-Output "Product registration self-tests passed: $($results.Count)"
diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index 622e3cb..b8e93fa 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -130,6 +130,12 @@ function New-CcodUninstallBootstrapAdapters {
             & $WriteTransaction $TransactionRoot $Transaction
             return $Transaction
         }.GetNewClosure()
+        RemoveProductRegistration = {
+            param($Context)
+            [void]$World.Calls.Add('RemoveProduct')
+            if($null-eq$World.PSObject.Properties['ProductRegistrationRemovals']){$World|Add-Member -NotePropertyName ProductRegistrationRemovals -NotePropertyValue 0}
+            [void]($World.ProductRegistrationRemovals++)
+        }.GetNewClosure()
         TestInstallRootAbsent = {
             param($InstallRoot)
             [void]$World.Calls.Add('RootAbsent')
@@ -205,10 +211,12 @@ $results += Invoke-CcodTest 'Prepare stages only the manifest-bound cleanup payl
         CleanupFailurePhase = $null
         InstallRootAbsent = $false
         StagedEntries = @()
+        ProductRegistrationRemovals = 0
     }
     $receipt = Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\installer' -InstallRoot 'C:\install' -Mode Prepare -Adapters (New-CcodUninstallBootstrapAdapters $world)
     Assert-CcodEqual 'ReadyForInno' $receipt.phase 'verified cleanup reaches the Inno boundary'
-    Assert-CcodEqual 'Validate,GetRoot,Read,NewId,Create,Write:Requested,Publish,Stage,Cleanup,Write:ReadyForInno,Receipt:ReadyForInno' ($world.Calls -join ',') 'Prepare publishes a recoverable transaction only after its durable transaction record exists'
+    Assert-CcodEqual 'Validate,GetRoot,Read,NewId,Create,Write:Requested,Publish,Stage,Cleanup,Write:ReadyForInno,RemoveProduct,Receipt:ReadyForInno' ($world.Calls -join ',') 'Prepare removes only verified product registration after protected application cleanup'
+    Assert-CcodEqual 1 $world.ProductRegistrationRemovals 'verified uninstall removes current product registration exactly once'
     Assert-CcodEqual 'src/persistence/UninstallBootstrap.ps1,src/persistence/PortableUninstallFinalizer.ps1,src/persistence/modules/InstallLifecycle.psm1,src/persistence/modules/PortableRelease.psm1,src/persistence/modules/PersistenceIO.psm1,src/persistence/modules/RuntimeManifest.psm1,src/persistence/modules/LifecycleEpoch.psm1,src/persistence/modules/StateStore.psm1,src/persistence/modules/TrustedLogonIdentity.psm1,src/persistence/modules/ScheduledTask.psm1,src/persistence/modules/KernelObjects.psm1,src/persistence/modules/CompatibilityProbe.psm1,src/persistence/modules/UiPreferences.psm1,src/persistence/modules/LifecycleTransaction.psm1' ($world.StagedEntries -join ',') 'staging has no device-key material'
     Assert-CcodEqual $null $receipt.errorCode 'ReadyForInno carries no failure code'
 }
@@ -405,7 +413,7 @@ $results += Invoke-CcodTest 'Prepare resumes only the exact durable transaction
     }
     $receipt = Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\installer' -InstallRoot 'C:\install' -Mode Prepare -Adapters (New-CcodUninstallBootstrapAdapters $world)
     Assert-CcodEqual 'ReadyForInno' $receipt.phase 'interrupted cleanup resumes to the Inno boundary'
-    Assert-CcodEqual 'Validate,GetRoot,Read,Cleanup,Write:ReadyForInno,Receipt:ReadyForInno' ($world.Calls -join ',') 'resume reuses the durable transaction and never makes a second payload'
+    Assert-CcodEqual 'Validate,GetRoot,Read,Cleanup,Write:ReadyForInno,RemoveProduct,Receipt:ReadyForInno' ($world.Calls -join ',') 'resume reuses the durable transaction and never makes a second payload'
 }
 
 $results += Invoke-CcodTest 'Prepare resumes a TaskRemoved transaction even after the runtime root and active pointer have been deleted' {
@@ -430,7 +438,7 @@ $results += Invoke-CcodTest 'Prepare resumes a TaskRemoved transaction even afte
         }
         $receipt = Invoke-CcodUninstallBootstrap -InstallerRoot $repositoryRoot -InstallRoot $installRoot -Mode Prepare -Adapters (New-CcodUninstallBootstrapAdapters $world)
         Assert-CcodEqual 'ReadyForInno' $receipt.phase 'partial application deletion can resume without an active runtime pointer'
-        Assert-CcodEqual 'Validate,GetRoot,Read,Cleanup,Write:ReadyForInno,Receipt:ReadyForInno' ($world.Calls -join ',') 'partial deletion resume neither creates another transaction nor restages payload'
+        Assert-CcodEqual 'Validate,GetRoot,Read,Cleanup,Write:ReadyForInno,RemoveProduct,Receipt:ReadyForInno' ($world.Calls -join ',') 'partial deletion resume neither creates another transaction nor restages payload'
     } finally {
         [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previousLocalAppData,'Process')
         if (Test-Path -LiteralPath $localAppData) { Remove-Item -LiteralPath $localAppData -Recurse -Force }
@@ -484,7 +492,7 @@ $results += Invoke-CcodTest 'failed recovery writes Failed and leaves the staged
     $world.CleanupError = $false
     $receipt = Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\installer' -InstallRoot 'C:\install' -Mode Prepare -Adapters (New-CcodUninstallBootstrapAdapters $world)
     Assert-CcodEqual 'ReadyForInno' $receipt.phase 'a recovery failure can resume after the proof becomes available'
-    Assert-CcodEqual 'Validate,GetRoot,Read,Cleanup,Write:ReadyForInno,Receipt:ReadyForInno' ($world.Calls -join ',') 'recovery retry reuses the same payload without a second staging pass'
+    Assert-CcodEqual 'Validate,GetRoot,Read,Cleanup,Write:ReadyForInno,RemoveProduct,Receipt:ReadyForInno' ($world.Calls -join ',') 'recovery retry reuses the same payload without a second staging pass'
 }
 
 $results += Invoke-CcodTest 'payload staging failure writes a durable Failed transaction and receipt before Inno can delete files' {
@@ -508,7 +516,7 @@ $results += Invoke-CcodTest 'payload staging failure writes a durable Failed tra
     $world.StageError = $false
     $receipt = Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\installer' -InstallRoot 'C:\install' -Mode Prepare -Adapters (New-CcodUninstallBootstrapAdapters $world)
     Assert-CcodEqual 'ReadyForInno' $receipt.phase 'a payload staging failure can retry the same durable transaction'
-    Assert-CcodEqual 'Validate,GetRoot,Read,Stage,Cleanup,Write:ReadyForInno,Receipt:ReadyForInno' ($world.Calls -join ',') 'staging retry restages only the existing transaction payload and never republishes a new locator'
+    Assert-CcodEqual 'Validate,GetRoot,Read,Stage,Cleanup,Write:ReadyForInno,RemoveProduct,Receipt:ReadyForInno' ($world.Calls -join ',') 'staging retry restages only the existing transaction payload and never republishes a new locator'
 }
 
 $results += Invoke-CcodTest 'FinalizeReceipt marks completion only after Inno has removed the application root' {

From 97cf17d804e46bee59dc81a008e266f36f795c77 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 19:04:00 +0800
Subject: [PATCH 096/187] docs: record post-readiness registration evidence

---
 .../task-4-report.md                          | 97 +++++++++++++++++++
 1 file changed, 97 insertions(+)
 create mode 100644 .superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
new file mode 100644
index 0000000..102248b
--- /dev/null
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
@@ -0,0 +1,97 @@
+# Task 4 report: post-Ready product registration
+
+## Status
+
+Implemented current-user uninstall registration and the exact Start-menu and
+desktop `CodexRemote-fix.lnk` records after the Task 2 terminal `Ready` proof.
+All three new records are read back before the exact legacy migration is
+authorized. Product-registration failures are reported after the file
+transaction closes and never enter install compensation, append `Failed`, or
+downgrade an already durable `Ready` transaction.
+
+The direct installed uninstaller now runs only from the canonical selected
+`2.5.22-<digest16>-<nonce32>` generation, invokes that generation's
+manifest-bound uninstall bootstrap, and completes through the verified
+external transaction payload. No Inno uninstaller is required.
+
+No real registry or shortcut mutation, installer/uninstaller/product
+execution, release build, network write, push, tag, signing, or publication was
+performed.
+
+## RED evidence
+
+- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ProductRegistration.SelfTest.ps1`
+  exited `1` because
+  `src\persistence\modules\ProductRegistration.psm1` did not exist.
+- After the six registration behavior groups were added, the lifecycle suite
+  exited `1` with `CCOD_INSTALL_ADAPTER_INVALID`, target
+  `RegisterProduct`; there was no post-Ready lifecycle seam.
+- The uninstall bootstrap suite exited `1` with
+  `CCOD_UNINSTALL_ADAPTER_INVALID`, target `RemoveProductRegistration`; there
+  was no verified post-cleanup product-state remover.
+- The file-transaction suite exited `1` because the exact capability export
+  surface did not contain the fixed SpecialFolder open/copy operations.
+- The Ready-finalization recovery regression exited `1`: expected one product
+  registration after the missing Ready snapshot was recovered, actual zero.
+
+## GREEN evidence
+
+- Product registration:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ProductRegistration.SelfTest.ps1`
+  exited `0`; `Product registration self-tests passed: 6`.
+- File capability:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+  exited `0`; all 26 named cases passed.
+- Uninstall bootstrap:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\UninstallBootstrap.SelfTest.ps1`
+  exited `0`; `Uninstall bootstrap self-tests passed: 17`.
+- Install lifecycle:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1`
+  exited `0`; `Install lifecycle self-tests passed: 115`.
+- Explicit PowerShell parser checks passed all nine changed `.ps1`/`.psm1`
+  implementation and test files (`PARSER_FAILURES=0`).
+- `git diff --check` exited `0`; only checkout LF-to-CRLF warnings were
+  emitted.
+- The aggregate `tests\PersistenceSelfTest.ps1` was not requested by the Task
+  4 brief and was not run; no aggregate-pass claim is made.
+
+## Implemented boundaries
+
+- `New-CcodProductRegistration`, `Test-CcodProductRegistration`,
+  `Commit-CcodProductRegistration`, and
+  `Remove-CcodLegacyProductRegistration` enforce the canonical runtime ID,
+  exact version/hash, exact runtime bootstrap/uninstaller paths, fixed HKCU
+  product key, and two fixed shortcut leaves.
+- Shortcut candidates are generated before runtime identity calculation,
+  copied into `registration/` inside the immutable generation, included in its
+  manifest/runtime-ID binding, and copied after Ready only through pinned
+  current-user Programs/Desktop handles. Arbitrary destination paths and
+  shortcut leaf names are not accepted.
+- The shortcut candidates start the one fixed current-user Supervisor task.
+  Task 2 already binds that task action to the selected generation bootstrap;
+  this avoids embedding a not-yet-computable runtime ID in candidate bytes
+  while still resolving the sealed bootstrap selected and proven Ready.
+- Normal install and the bounded missing-Ready-snapshot recovery both perform
+  post-Ready registration. The recovery uses the state transaction only for
+  fixed SpecialFolder capability operations; generation and pointer mutation
+  remain unavailable.
+- Uninstall removes only a matching current product runtime key and the two
+  exact new shortcut paths after protected application cleanup. Legacy
+  migration requires the canonical AppId, verified new registration, and the
+  exact legacy shortcut allowlist before deletion starts.
+
+## Compatibility concerns
+
+- Legacy migration is deliberately conservative: a missing or changed legacy
+  shortcut name, wrong AppId, or unreadable legacy entry retains all legacy
+  state for later diagnosis rather than attempting partial cleanup.
+- The ordinary same-user writer and in-process introspection limits documented
+  by the immutable-generation design remain unchanged.
+- No live Windows Settings launch, real shell-link promotion, or installed
+  uninstall was executed in this task; those remain part of later installed
+  acceptance.
+
+## Implementation commit
+
+- `e43d9ce18c5d79bb438e08c9ff2973be592277aa`
+  (`feat: register product only after readiness`).

From 2e76698d535e6e824df1c57d81314be1c2e053e8 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 20:22:53 +0800
Subject: [PATCH 097/187] fix: complete matched product lifecycle

---
 Uninstall-CodexControlOtherDevices.ps1        | 18 +++--
 build/build.ps1                               |  3 +-
 .../InstalledUninstallFinalizer.ps1           | 53 +++++++++++++
 src/persistence/UninstallBootstrap.ps1        | 39 +++++-----
 .../modules/InstallFileTransaction.psm1       | 77 ++++++++++---------
 src/persistence/modules/InstallLifecycle.psm1 | 25 ++++--
 .../modules/ProductRegistration.psm1          | 60 ++++++++++++---
 .../InstallFileTransaction.SelfTest.ps1       | 16 +++-
 .../persistence/InstallLifecycle.SelfTest.ps1 | 25 +++++-
 .../ProductRegistration.SelfTest.ps1          | 52 ++++++++++++-
 .../UninstallBootstrap.SelfTest.ps1           | 54 ++++++++++++-
 11 files changed, 329 insertions(+), 93 deletions(-)
 create mode 100644 src/persistence/InstalledUninstallFinalizer.ps1

diff --git a/Uninstall-CodexControlOtherDevices.ps1 b/Uninstall-CodexControlOtherDevices.ps1
index 10356c0..7ce0c5a 100644
--- a/Uninstall-CodexControlOtherDevices.ps1
+++ b/Uninstall-CodexControlOtherDevices.ps1
@@ -38,14 +38,20 @@ if ($null -ne $installedRuntimeId -and $installedRuntimeId -cmatch '^2\.5\.22-[0
     $bootstrapItem = Get-Item -LiteralPath $bootstrapPath -Force -ErrorAction Stop
     if ($bootstrapItem.PSIsContainer -or (($bootstrapItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) { Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_INVALID' 'The sealed generation uninstall bootstrap is unsafe.' $bootstrapPath }
     if (-not $PSCmdlet.ShouldProcess($expectedInstallRoot,'Run manifest-bound cleanup from the selected sealed generation')) { return [pscustomobject][ordered]@{Outcome='WhatIf';KeptDeviceKeyStore=$true} }
-    try { $prepared=& $bootstrapPath -InstallerRoot $installerRoot -InstallRoot $expectedInstallRoot -Mode Prepare }
+    try { $prepared=& $bootstrapPath -InstallerRoot $installerRoot -InstallRoot $expectedInstallRoot -Mode PrepareInstalled }
     catch { Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_PREPARE_FAILED' 'Sealed generation cleanup did not reach its external finalization boundary.' $_ }
-    if($null-eq$prepared-or$prepared.transactionId-isnot[string]-or$prepared.transactionId-cnotmatch'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'-or$prepared.phase-cne'ReadyForInno'-or$prepared.runtimeId-cne$installedRuntimeId){Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_PREPARE_FAILED' 'Sealed generation cleanup returned an invalid receipt.' $prepared}
+    if($null-eq$prepared-or$prepared.transactionId-isnot[string]-or$prepared.transactionId-cnotmatch'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'-or$prepared.phase-cne'TaskRemoved'-or$prepared.runtimeId-cne$installedRuntimeId){Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_PREPARE_FAILED' 'Sealed generation cleanup returned an invalid receipt.' $prepared}
     $transactionRoot=[IO.Path]::GetFullPath((Join-Path $localAppData 'CodexRemote-fix-uninstall'))
-    $stagedBootstrap=[IO.Path]::GetFullPath((Join-Path (Join-Path (Join-Path $transactionRoot $prepared.transactionId) 'payload') 'src\persistence\UninstallBootstrap.ps1'))
-    if(-not[IO.File]::Exists($stagedBootstrap)){Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_FINALIZER_MISSING' 'The verified external finalization bootstrap is missing.' $stagedBootstrap}
-    & $stagedBootstrap -InstallerRoot $installerRoot -InstallRoot $expectedInstallRoot -Mode FinalizeReceipt
-    Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_FINALIZATION_FAILED' 'The external finalization bootstrap returned without completing the uninstall receipt.' $prepared.transactionId
+    $transactionDirectory=[IO.Path]::GetFullPath((Join-Path $transactionRoot $prepared.transactionId))
+    $finalizer=[IO.Path]::GetFullPath((Join-Path $transactionDirectory 'payload\src\persistence\InstalledUninstallFinalizer.ps1'))
+    if(-not[IO.File]::Exists($finalizer)){Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_FINALIZER_MISSING' 'The verified external installed finalizer is missing.' $finalizer}
+    $powershellPath=Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'WindowsPowerShell\v1.0\powershell.exe'
+    if(-not[IO.File]::Exists($powershellPath)){Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_FINALIZER_MISSING' 'The Windows PowerShell host is unavailable.' $powershellPath}
+    $current=[Diagnostics.Process]::GetCurrentProcess();try{$wrapperId=[int]$current.Id;$wrapperCreated=$current.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)}finally{$current.Dispose()}
+    function ConvertTo-CcodInstalledUninstallLiteral([string]$Value){"'"+$Value.Replace("'","''")+"'"}
+    $arguments='-NoProfile -NonInteractive -ExecutionPolicy Bypass -File {0} -TransactionId {1} -RuntimeRoot {2} -InstallRoot {3} -WrapperProcessId {4} -WrapperCreationTimeUtc {5}'-f(ConvertTo-CcodInstalledUninstallLiteral $finalizer),(ConvertTo-CcodInstalledUninstallLiteral $prepared.transactionId),(ConvertTo-CcodInstalledUninstallLiteral $installerRoot),(ConvertTo-CcodInstalledUninstallLiteral $expectedInstallRoot),$wrapperId,(ConvertTo-CcodInstalledUninstallLiteral $wrapperCreated)
+    try{$process=Start-Process -FilePath $powershellPath -ArgumentList $arguments -WindowStyle Hidden -RedirectStandardOutput (Join-Path $transactionDirectory 'installed-finalizer.stdout.log') -RedirectStandardError (Join-Path $transactionDirectory 'installed-finalizer.stderr.log') -PassThru -ErrorAction Stop}catch{Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_FINALIZER_START_FAILED' 'The external installed finalizer could not be started; application state was retained.' $_}
+    return [pscustomobject][ordered]@{Outcome='InstalledFinalizationStarted';TransactionId=[string]$prepared.transactionId;FinalizerProcessId=[int]$process.Id;KeptDeviceKeyStore=$true}
 }
 $portableMarkerPath = Join-Path $installerRoot 'portable-release.json'
 if ([IO.File]::Exists($portableMarkerPath) -or [IO.Directory]::Exists($portableMarkerPath)) {
diff --git a/build/build.ps1 b/build/build.ps1
index b6f1359..8690e35 100644
--- a/build/build.ps1
+++ b/build/build.ps1
@@ -389,7 +389,8 @@ try {
         'src/persistence/LifecycleWorker.ps1',
         'src/persistence/bootstrap.ps1',
         'src/persistence/UninstallBootstrap.ps1',
-        'src/persistence/PortableUninstallFinalizer.ps1'
+        'src/persistence/PortableUninstallFinalizer.ps1',
+        'src/persistence/InstalledUninstallFinalizer.ps1'
     )) {
         Copy-CcodBuildPayloadFile -Source (Join-Path $repoRoot ($relative.Replace('/','\'))) -PayloadRoot $payloadRoot -Relative $relative
     }
diff --git a/src/persistence/InstalledUninstallFinalizer.ps1 b/src/persistence/InstalledUninstallFinalizer.ps1
new file mode 100644
index 0000000..888ed3e
--- /dev/null
+++ b/src/persistence/InstalledUninstallFinalizer.ps1
@@ -0,0 +1,53 @@
+[CmdletBinding()]
+param(
+    [ValidatePattern('^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$')][string]$TransactionId,
+    [string]$RuntimeRoot,
+    [string]$InstallRoot,
+    [int]$WrapperProcessId,
+    [string]$WrapperCreationTimeUtc
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference='Stop'
+
+function Throw-CcodInstalledFinalizerError {
+    param([string]$Id,[string]$Message,$Target)
+    throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new($Message),$Id,[Management.Automation.ErrorCategory]::InvalidData,$Target)
+}
+function Test-CcodInstalledFinalizerIdentity($Value){$Value.pid-is[int]-and$Value.pid-gt0-and$Value.creationTimeUtc-is[string]-and$Value.creationTimeUtc-cmatch'^\d{4}-\d{2}-\d{2}T'}
+function Get-CcodInstalledFinalizerAdapters {
+    param([hashtable]$Adapters,[string]$TransactionRoot,[string]$PayloadRoot)
+    $bootstrap=Join-Path $PayloadRoot 'src\persistence\UninstallBootstrap.ps1'
+    $lifecycle=Join-Path $PayloadRoot 'src\persistence\modules\InstallLifecycle.psm1'
+    $defaults=@{
+        WaitWrapperExit={param($Identity,$Timeout);$stopwatch=[Diagnostics.Stopwatch]::StartNew();while($stopwatch.ElapsedMilliseconds-lt$Timeout){$process=Get-Process -Id $Identity.pid -ErrorAction SilentlyContinue;if($null-eq$process){return $true};try{if($process.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)-cne$Identity.creationTimeUtc){return $true}}finally{$process.Dispose()};Start-Sleep -Milliseconds 100};$false}
+        ReadPreparedTransaction={param($Id);. $bootstrap;$identity=Get-CcodUninstallBootstrapCurrentIdentity;$value=Read-CcodUninstallBootstrapStoredTransaction -TransactionRoot $TransactionRoot -ExpectedUserSid $identity.userSid -IncludeCompleted;if($null-eq$value-or$value.transactionId-cne$Id){return $null};$value}.GetNewClosure()
+        ValidateSelectedGeneration={param($SelectedRuntime,$Root,$Transaction);. $bootstrap;$context=Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $SelectedRuntime -InstallRoot $Root -InvocationPath (Join-Path $SelectedRuntime 'src\persistence\UninstallBootstrap.ps1');$context.runtimeId-ceq$Transaction.runtimeId-and[uint64]$context.runtimeGeneration-eq[uint64]$Transaction.runtimeGeneration}.GetNewClosure()
+        RemoveMatchedApplicationState={param($SelectedRuntime,$Root,$Transaction);. $bootstrap;$module=Import-Module $lifecycle -Force -PassThru -ErrorAction Stop;$directory=Join-Path $TransactionRoot $Transaction.transactionId;$writer={param($Value)Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory $directory -Transaction $Value}.GetNewClosure();&$module {param($Install,$Value,$Write)Invoke-CcodUninstallCleanup -InstallRoot $Install -Transaction $Value -WriteTransaction $Write -StopAfterTaskRemoval:$false} $Root $Transaction $writer}.GetNewClosure()
+        TestInstallRootAbsent={param($Root)-not([IO.Directory]::Exists($Root)-or[IO.File]::Exists($Root))}
+        RemoveMatchedProductRegistration={param($Transaction);. $bootstrap;Remove-CcodUninstallBootstrapProductRegistration -Context ([pscustomobject][ordered]@{runtimeId=$Transaction.runtimeId;runtimeGeneration=[uint64]$Transaction.runtimeGeneration;leaseEpoch=[uint64]$Transaction.leaseEpoch;userSid=$Transaction.userSid;sessionId=[int]$Transaction.sessionId;payloadRecords=New-CcodUninstallBootstrapPayloadRecords -ResumeOnly})}
+        FinalizeReceipt={param($Transaction);& $bootstrap -InstallerRoot $RuntimeRoot -InstallRoot $InstallRoot -Mode FinalizeReceipt;Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Finalization bootstrap returned unexpectedly' $Transaction.transactionId}.GetNewClosure()
+    }
+    if($null-eq$Adapters){return $defaults};$resolved=@{};foreach($name in $defaults.Keys){$resolved[$name]=$defaults[$name]};foreach($name in $Adapters.Keys){if(-not$resolved.ContainsKey($name)-or$Adapters[$name]-isnot[scriptblock]){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Finalizer adapter contract is invalid' $name};$resolved[$name]=$Adapters[$name]};$resolved
+}
+function Invoke-CcodInstalledUninstallFinalizer {
+    param([Parameter(Mandatory)][string]$TransactionId,[Parameter(Mandatory)][string]$RuntimeRoot,[Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$WrapperIdentity,[hashtable]$Adapters)
+    if($TransactionId-cnotmatch'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'-or-not[IO.Path]::IsPathRooted($RuntimeRoot)-or-not[IO.Path]::IsPathRooted($InstallRoot)-or-not(Test-CcodInstalledFinalizerIdentity $WrapperIdentity)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer inputs are invalid' $TransactionId}
+    $runtime=[IO.Path]::GetFullPath($RuntimeRoot);$install=[IO.Path]::GetFullPath($InstallRoot);$expected=[IO.Path]::GetFullPath((Join-Path (Join-Path $install 'runtime') ([IO.Path]::GetFileName($runtime))));if($runtime-cne$expected){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Runtime root is outside the fixed install runtime parent' $runtime}
+    $local=[Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData);$transactionRoot=[IO.Path]::GetFullPath((Join-Path $local 'CodexRemote-fix-uninstall'));$payloadRoot=[IO.Path]::GetFullPath((Join-Path (Join-Path $transactionRoot $TransactionId) 'payload'));if($null-eq$Adapters){$expectedSelf=[IO.Path]::GetFullPath((Join-Path $payloadRoot 'src\persistence\InstalledUninstallFinalizer.ps1'));if([string]::IsNullOrWhiteSpace($PSCommandPath)-or[IO.Path]::GetFullPath($PSCommandPath)-cne$expectedSelf){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer is outside the durable staged payload' $PSCommandPath};$self=Get-Item -LiteralPath $expectedSelf -Force -ErrorAction Stop;if($self.PSIsContainer-or($self.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer path is unsafe' $expectedSelf}};$adapter=Get-CcodInstalledFinalizerAdapters -Adapters $Adapters -TransactionRoot $transactionRoot -PayloadRoot $payloadRoot
+    if(-not(& $adapter.WaitWrapperExit $WrapperIdentity 15000)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed wrapper did not exit with the expected identity' $WrapperIdentity}
+    $transaction=&$adapter.ReadPreparedTransaction $TransactionId
+    if($null-eq$transaction-or$transaction.transactionId-cne$TransactionId-or$transaction.phase-cne'TaskRemoved'-or$transaction.resumePhase-cne'TaskRemoved'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Durable installed uninstall transaction is not at TaskRemoved' $transaction}
+    if(-not(&$adapter.ValidateSelectedGeneration $runtime $install $transaction)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Selected generation proof does not match the transaction' $runtime}
+    $ready=&$adapter.RemoveMatchedApplicationState $runtime $install $transaction
+    if($null-eq$ready-or$ready.phase-cne'ReadyForInno'-or-not(&$adapter.TestInstallRootAbsent $install)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Matched application state removal was not proven' $install}
+    &$adapter.RemoveMatchedProductRegistration $ready
+    $receipt=&$adapter.FinalizeReceipt $ready
+    if($null-eq$receipt-or$receipt.phase-cne'Completed'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Completion receipt was not proven' $TransactionId}
+    $receipt
+}
+
+if($MyInvocation.InvocationName-ne'.'){
+    $identity=[pscustomobject]@{pid=[int]$WrapperProcessId;creationTimeUtc=$WrapperCreationTimeUtc}
+    try{Invoke-CcodInstalledUninstallFinalizer -TransactionId $TransactionId -RuntimeRoot $RuntimeRoot -InstallRoot $InstallRoot -WrapperIdentity $identity|Out-Null;exit 0}catch{Write-Error ([string]$_.FullyQualifiedErrorId);exit 3}
+}
diff --git a/src/persistence/UninstallBootstrap.ps1 b/src/persistence/UninstallBootstrap.ps1
index 23367f7..478d5e7 100644
--- a/src/persistence/UninstallBootstrap.ps1
+++ b/src/persistence/UninstallBootstrap.ps1
@@ -2,7 +2,7 @@
 param(
     [string]$InstallerRoot,
     [string]$InstallRoot,
-    [ValidateSet('Prepare','FinalizeReceipt')][string]$Mode
+    [ValidateSet('Prepare','PrepareInstalled','FinalizeReceipt')][string]$Mode
 )
 
 Set-StrictMode -Version Latest
@@ -20,7 +20,9 @@ $script:CcodUninstallContextFields = @('runtimeId','runtimeGeneration','leaseEpo
 $script:CcodUninstallPayloadEntries = @(
     'src/persistence/UninstallBootstrap.ps1',
     'src/persistence/PortableUninstallFinalizer.ps1',
+    'src/persistence/InstalledUninstallFinalizer.ps1',
     'src/persistence/modules/InstallLifecycle.psm1',
+    'src/persistence/modules/ProductRegistration.psm1',
     'src/persistence/modules/PortableRelease.psm1',
     'src/persistence/modules/PersistenceIO.psm1',
     'src/persistence/modules/RuntimeManifest.psm1',
@@ -353,7 +355,7 @@ function New-CcodUninstallBootstrapResumeContext {
 }
 
 function Get-CcodUninstallBootstrapVerifiedRuntimeContext {
-    param([Parameter(Mandatory)][string]$InstallerRoot,[Parameter(Mandatory)][string]$InstallRoot,[hashtable]$SelectorAdapters)
+    param([Parameter(Mandatory)][string]$InstallerRoot,[Parameter(Mandatory)][string]$InstallRoot,[hashtable]$SelectorAdapters,[string]$InvocationPath=$PSCommandPath)
     try {
         $installer = Get-CcodUninstallBootstrapComparablePath -Path $InstallerRoot -Kind 'Installer root'
         $install = Get-CcodUninstallBootstrapComparablePath -Path $InstallRoot -Kind 'Install root'
@@ -365,8 +367,8 @@ function Get-CcodUninstallBootstrapVerifiedRuntimeContext {
         }
         Assert-CcodUninstallBootstrapInstallRootOwner -Path $install -UserSid $identity.userSid
         $expectedScript = Resolve-CcodUninstallBootstrapChildPath -Root $installer -RelativePath 'src\persistence\UninstallBootstrap.ps1' -RequireLeafFile
-        if ([string]::IsNullOrWhiteSpace($PSCommandPath) -or (Get-CcodUninstallBootstrapFullPath -Path $PSCommandPath -Kind 'Bootstrap script') -cne $expectedScript) {
-            Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'The uninstall bootstrap was not launched from the installed application root' $PSCommandPath
+        if ([string]::IsNullOrWhiteSpace($InvocationPath) -or (Get-CcodUninstallBootstrapFullPath -Path $InvocationPath -Kind 'Bootstrap script') -cne $expectedScript) {
+            Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'The uninstall bootstrap was not launched from the installed application root' $InvocationPath
         }
         try{$stateRoot=Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath 'state' -AllowMissingLeaf}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The active generation selector path is unsafe' $install}
         $pointerRootItem=$null;$pointerRootAbsent=$false;$getSelectorRootItem=if($null-ne$SelectorAdapters-and$SelectorAdapters.ContainsKey('GetSelectorRootItem')){$SelectorAdapters.GetSelectorRootItem}else{{param($Path)Get-Item -LiteralPath $Path -Force -ErrorAction Stop}}
@@ -911,7 +913,7 @@ function Get-CcodUninstallBootstrapAdapters {
             Write-CcodUninstallBootstrapStoredReceipt -TransactionDirectory $TransactionRoot -Transaction $Transaction
         }
         RunCleanup = {
-            param($InstallerRoot,$InstallRoot,$TransactionRoot,$Transaction,$WriteTransaction)
+            param($InstallerRoot,$InstallRoot,$TransactionRoot,$Transaction,$WriteTransaction,$Mode)
             $payloadRoot = Resolve-CcodUninstallBootstrapChildPath -Root $TransactionRoot -RelativePath 'payload'
             $modulePath = Resolve-CcodUninstallBootstrapChildPath -Root $payloadRoot -RelativePath 'src\persistence\modules\InstallLifecycle.psm1' -RequireLeafFile
             $module = Import-Module -Name $modulePath -Force -PassThru -ErrorAction Stop
@@ -920,9 +922,9 @@ function Get-CcodUninstallBootstrapAdapters {
                 & $WriteTransaction $TransactionRoot $Value
             }.GetNewClosure()
             return (& $module {
-                param($Root,$Value,$Writer)
-                Invoke-CcodUninstallCleanup -InstallRoot $Root -Transaction $Value -WriteTransaction $Writer
-            } $InstallRoot $Transaction $writer)
+                param($Root,$Value,$Writer,$DeferRemoval)
+                Invoke-CcodUninstallCleanup -InstallRoot $Root -Transaction $Value -WriteTransaction $Writer -StopAfterTaskRemoval:([bool]$DeferRemoval)
+            } $InstallRoot $Transaction $writer ($Mode -ceq 'PrepareInstalled'))
         }
         RemoveProductRegistration = {
             param($Context)
@@ -947,15 +949,8 @@ function Get-CcodUninstallBootstrapAdapters {
 function Remove-CcodUninstallBootstrapProductRegistration {
     param([Parameter(Mandatory)]$Context)
     Assert-CcodUninstallBootstrapContext $Context
-    $registryPath='HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\CodexRemote-fix'
-    $programs=[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs);$desktop=[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop)
-    if([string]::IsNullOrWhiteSpace($programs)-or[string]::IsNullOrWhiteSpace($desktop)-or-not[IO.Path]::IsPathRooted($programs)-or-not[IO.Path]::IsPathRooted($desktop)){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PRODUCT_REGISTRATION_INVALID' 'Current-user product special folders are unavailable' $null}
-    $shortcuts=@([IO.Path]::GetFullPath((Join-Path (Join-Path $programs 'CodexRemote-fix') 'CodexRemote-fix.lnk')),[IO.Path]::GetFullPath((Join-Path $desktop 'CodexRemote-fix.lnk')))
-    $registryPresent=Test-Path -LiteralPath $registryPath -PathType Container
-    if($registryPresent){$value=Get-ItemProperty -LiteralPath $registryPath -ErrorAction Stop;if($value.CcodRuntimeId-isnot[string]-or[string]$value.CcodRuntimeId-cne[string]$Context.runtimeId){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PRODUCT_REGISTRATION_INVALID' 'Current product registration does not match the verified runtime' $registryPath}}
-    foreach($path in $shortcuts){if([IO.File]::Exists($path)-or[IO.Directory]::Exists($path)){$item=Get-Item -LiteralPath $path -Force -ErrorAction Stop;if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PRODUCT_REGISTRATION_INVALID' 'Current product shortcut is not an exact regular file' $path}}}
-    foreach($path in $shortcuts){if([IO.File]::Exists($path)){Remove-Item -LiteralPath $path -Force -ErrorAction Stop}}
-    if($registryPresent){Remove-Item -LiteralPath $registryPath -Force -ErrorAction Stop}
+    $modulePath=Join-Path $PSScriptRoot 'modules\ProductRegistration.psm1';if(-not[IO.File]::Exists($modulePath)){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PRODUCT_REGISTRATION_INVALID' 'Matched product registration module is missing' $modulePath}
+    try{Import-Module $modulePath -Force -ErrorAction Stop;Remove-CcodProductRegistration -ExpectedRuntimeId ([string]$Context.runtimeId)}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PRODUCT_REGISTRATION_INVALID' 'Current product registration did not match the verified uninstall runtime' $Context.runtimeId}
 }
 
 function Set-CcodUninstallBootstrapFailedTransaction {
@@ -976,7 +971,7 @@ function Invoke-CcodUninstallBootstrap {
     param(
         [Parameter(Mandatory)][string]$InstallerRoot,
         [Parameter(Mandatory)][string]$InstallRoot,
-        [Parameter(Mandatory)][ValidateSet('Prepare','FinalizeReceipt')][string]$Mode,
+        [Parameter(Mandatory)][ValidateSet('Prepare','PrepareInstalled','FinalizeReceipt')][string]$Mode,
         [hashtable]$Adapters
     )
 
@@ -1056,11 +1051,12 @@ function Invoke-CcodUninstallBootstrap {
             $stagePayload = $transaction.phase -ceq 'Requested' -or ($transaction.phase -ceq 'Failed' -and $transaction.resumePhase -ceq 'Requested')
         }
         if ($stagePayload) { & $adapter.StagePayload $InstallerRoot $InstallRoot $context $stageRoot }
-        $result = & $adapter.RunCleanup $InstallerRoot $InstallRoot $stageRoot $transaction $adapter.WriteTransaction
+        $result = & $adapter.RunCleanup $InstallerRoot $InstallRoot $stageRoot $transaction $adapter.WriteTransaction $Mode
         if ($null -eq $result) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PREPARE_FAILED' 'The staged cleanup returned no transaction receipt' $stageRoot }
         Assert-CcodUninstallBootstrapTransactionMatchesContext $result $context
-        if ($result.phase -ne 'ReadyForInno') { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PREPARE_FAILED' 'The staged cleanup did not reach the Inno boundary' $result }
-        & $adapter.RemoveProductRegistration $context
+        $expectedPhase=if($Mode-ceq'PrepareInstalled'){'TaskRemoved'}else{'ReadyForInno'}
+        if ($result.phase -cne $expectedPhase) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PREPARE_FAILED' 'The staged cleanup did not reach its expected external boundary' $result }
+        if($Mode-ceq'Prepare'){& $adapter.RemoveProductRegistration $context}
         & $adapter.WriteReceipt $stageRoot $result
         return $result
     } catch {
@@ -1078,6 +1074,7 @@ if ($MyInvocation.InvocationName -ne '.') {
     try {
         $receipt = Invoke-CcodUninstallBootstrap -InstallerRoot $InstallerRoot -InstallRoot $InstallRoot -Mode $Mode
         if ($Mode -eq 'Prepare' -and $receipt.phase -ne 'ReadyForInno') { exit 3 }
+        if ($Mode -eq 'PrepareInstalled' -and $receipt.phase -ne 'TaskRemoved') { exit 3 }
         if ($Mode -eq 'FinalizeReceipt' -and $receipt.phase -ne 'Completed') { exit 3 }
         exit 0
     } catch {
diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index 61ce8d0..c3ace77 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -84,9 +84,9 @@ internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
     private readonly List<FileStream> externalStreams = new List<FileStream>();
     private bool disposed; private string cleanupError;
 
-    private readonly bool stateOnly;
-    private CcodInstallGenerationRuntimeV4(string installRoot,Pin root,Pin runtimeParent,bool stateOnly)
-    { this.installRoot=installRoot;this.root=root;this.runtimeParent=runtimeParent;this.stateOnly=stateOnly;AddPin(root);if(runtimeParent!=null)AddPin(runtimeParent); }
+    private readonly bool stateOnly,productOnly;
+    private CcodInstallGenerationRuntimeV4(string installRoot,Pin root,Pin runtimeParent,bool stateOnly,bool productOnly)
+    { this.installRoot=installRoot;this.root=root;this.runtimeParent=runtimeParent;this.stateOnly=stateOnly;this.productOnly=productOnly;AddPin(root);if(runtimeParent!=null)AddPin(runtimeParent); }
 
     internal static object Open(string path,string runtimeId,out CcodInstallGenerationRuntimeV4 runtime)
     {
@@ -103,7 +103,7 @@ internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
             try
             {
                 Pin generation=ValidateDirectoryPin(runtimePin,runtimeId,Path.Combine(runtimePin.Path,runtimeId),true,generationResult.Handle);generationResult.Handle=null;
-                runtime=new CcodInstallGenerationRuntimeV4(full,rootPin,runtimePin,false);rootPin=null;runtimePin=null;runtime.AddPin(generation);return generation.Token;
+                runtime=new CcodInstallGenerationRuntimeV4(full,rootPin,runtimePin,false,false);rootPin=null;runtimePin=null;runtime.AddPin(generation);return generation.Token;
             }
             finally { if(generationResult.Handle!=null)generationResult.Handle.Dispose(); }
         }
@@ -113,12 +113,18 @@ internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
     internal static object OpenState(string path,out CcodInstallGenerationRuntimeV4 runtime)
     {
         runtime=null;string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle rootHandle=OpenAbsoluteDirectory(full,true);Pin rootPin=null;
-        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;runtime=new CcodInstallGenerationRuntimeV4(full,rootPin,null,true);rootPin=null;return runtime.root.Token;}
+        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;runtime=new CcodInstallGenerationRuntimeV4(full,rootPin,null,true,false);rootPin=null;return runtime.root.Token;}
         catch{if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw;}
     }
 
+    internal static object OpenProduct(string path,out CcodInstallGenerationRuntimeV4 runtime)
+    {
+        runtime=null;string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle rootHandle=OpenAbsoluteDirectory(full,false);Pin rootPin=null,runtimePin=null;
+        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;OpenResult result=OpenRelative(rootPin.Native,"runtime",LIST_DIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);try{runtimePin=ValidateDirectoryPin(rootPin,"runtime",Path.Combine(full,"runtime"),false,result.Handle);result.Handle=null;}finally{if(result.Handle!=null)result.Handle.Dispose();};runtime=new CcodInstallGenerationRuntimeV4(full,rootPin,runtimePin,false,true);rootPin=null;runtimePin=null;return runtime.root.Token;}catch{if(runtimePin!=null)runtimePin.Dispose();if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw;}
+    }
+
     private bool IsStateScope(Pin pin){for(Pin cursor=pin;cursor!=null;cursor=cursor.Parent)if(Object.ReferenceEquals(cursor.Parent,root)&&String.Equals(cursor.Leaf,"state",StringComparison.Ordinal))return true;return false;}
-    private void RequireStateDirectory(Pin parent,string leaf){if(!stateOnly)return;if(Object.ReferenceEquals(parent,root)){if(!String.Equals(leaf,"state",StringComparison.Ordinal))throw new InvalidOperationException("state-only scope");return;}if(!IsStateScope(parent))throw new InvalidOperationException("state-only scope");}
+    private void RequireStateDirectory(Pin parent,string leaf){if(productOnly)throw new InvalidOperationException("product-only scope");if(!stateOnly)return;if(Object.ReferenceEquals(parent,root)){if(!String.Equals(leaf,"state",StringComparison.Ordinal))throw new InvalidOperationException("state-only scope");return;}if(!IsStateScope(parent))throw new InvalidOperationException("state-only scope");}
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object CreateDirectory(object parentToken,string leaf)
     {
@@ -152,7 +158,7 @@ internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object Copy(object parentToken,string leaf,string source,long expectedLength,string expectedSha)
     {
-        if(stateOnly)throw new InvalidOperationException("state-only scope");Pin parent=Require(parentToken,true);ValidateCurrent(parent);string full=Path.GetFullPath(source);
+        if(stateOnly)throw new InvalidOperationException("state-only scope");if(productOnly)throw new InvalidOperationException("product-only scope");Pin parent=Require(parentToken,true);ValidateCurrent(parent);string full=Path.GetFullPath(source);
         SafeFileHandle sourceHandle=CreateFileW(full,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,IntPtr.Zero,OPEN_EXISTING,FLAG_REPARSE,IntPtr.Zero);
         if(sourceHandle.IsInvalid)throw new Win32Exception(Marshal.GetLastWin32Error());FileStream sourceStream=null;
         try
@@ -169,25 +175,25 @@ internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object Write(object parentToken,string leaf,byte[] bytes,bool manifest)
     {
-        Pin parent=Require(parentToken,true);ValidateCurrent(parent);if(stateOnly&&(manifest||!IsStateScope(parent)))throw new InvalidOperationException("state-only scope");Pin pin=CreateTemporaryFile(parent);pin.Stream.Write(bytes,0,bytes.Length);pin.Stream.Flush(true);string sha=Sha(pin.Stream);if(pin.Stream.Length!=bytes.LongLength)throw new InvalidDataException("destination mismatch");SealAndPublish(pin,leaf,bytes.LongLength,sha,manifest);return pin.Token;
+        if(productOnly)throw new InvalidOperationException("product-only scope");Pin parent=Require(parentToken,true);ValidateCurrent(parent);if(stateOnly&&(manifest||!IsStateScope(parent)))throw new InvalidOperationException("state-only scope");Pin pin=CreateTemporaryFile(parent);pin.Stream.Write(bytes,0,bytes.Length);pin.Stream.Flush(true);string sha=Sha(pin.Stream);if(pin.Stream.Length!=bytes.LongLength)throw new InvalidDataException("destination mismatch");SealAndPublish(pin,leaf,bytes.LongLength,sha,manifest);return pin.Token;
     }
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object CommitPointer(object generationToken,ulong previousGeneration,string runtimeId,byte[] bytes)
     {
-        if(stateOnly)throw new InvalidOperationException("state-only scope");Pin generation=Require(generationToken,true);ValidateCurrent(generation);if(!Object.ReferenceEquals(generation.Parent,runtimeParent)||!String.Equals(generation.Leaf,runtimeId,StringComparison.Ordinal))throw new InvalidDataException("transaction scope");
+        if(stateOnly)throw new InvalidOperationException("state-only scope");if(productOnly)throw new InvalidOperationException("product-only scope");Pin generation=Require(generationToken,true);ValidateCurrent(generation);if(!Object.ReferenceEquals(generation.Parent,runtimeParent)||!String.Equals(generation.Leaf,runtimeId,StringComparison.Ordinal))throw new InvalidDataException("transaction scope");
         if(retainedRoots.Contains(generationToken))ValidateRetainedTree(generation);else{Pin manifest=null;if(!names.TryGetValue(Key(generation,"manifest.json"),out manifest)||!manifest.Manifest||!manifest.Sealed)throw new InvalidDataException("manifest missing");EnsurePublishedPin(manifest);ValidateOwnedTree(generation);}
         if(previousGeneration==UInt64.MaxValue)throw new OverflowException("pointer generation overflow");Pin state=OpenOrCreateDirectory(root,"state"),pointer=OpenOrCreateDirectory(state,"active-generation");if(CurrentPointerGeneration(pointer)!=previousGeneration)throw new InvalidOperationException("pointer generation exists");string leaf=(previousGeneration+1).ToString("D20")+".json";return Write(pointer.Token,leaf,bytes,false);
     }
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object Retire(object generationToken,string runtimeId,string recordLeaf,byte[] record)
     {
-        if(stateOnly)throw new InvalidOperationException("state-only scope");Pin generation=Require(generationToken,true);ValidateCurrent(generation);if(!Object.ReferenceEquals(generation.Parent,runtimeParent)||!String.Equals(generation.Leaf,runtimeId,StringComparison.Ordinal)||!generation.Owned)throw new InvalidDataException("generation not owned");
+        if(stateOnly)throw new InvalidOperationException("state-only scope");if(productOnly)throw new InvalidOperationException("product-only scope");Pin generation=Require(generationToken,true);ValidateCurrent(generation);if(!Object.ReferenceEquals(generation.Parent,runtimeParent)||!String.Equals(generation.Leaf,runtimeId,StringComparison.Ordinal)||!generation.Owned)throw new InvalidDataException("generation not owned");
         ValidateOwnedTree(generation);Pin state=OpenOrCreateDirectory(root,"state"),retirements=OpenOrCreateDirectory(state,"retired-generations");Write(retirements.Token,recordLeaf,record,false);return generation.Token;
     }
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object OpenProductFolder(string kind,string path)
     {
-        if(disposed)throw new ObjectDisposedException("transaction");
+        if(stateOnly)throw new InvalidOperationException("state-only scope");if(disposed)throw new ObjectDisposedException("transaction");
         string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle handle=OpenAbsoluteDirectory(full,true);Pin basePin=null;
         try
         {
@@ -200,23 +206,20 @@ internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
         catch{if(handle!=null)handle.Dispose();throw;}
     }
 
-    [MethodImpl(MethodImplOptions.Synchronized)] internal object CopyProductShortcut(object folderToken,string kind,string source,string leaf,long expectedLength,string expectedSha)
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object OpenRetainedFile(object generationToken,string relative)
     {
-        Pin parent=Require(folderToken,true);ValidateCurrent(parent);
+        if(stateOnly)throw new InvalidOperationException("state-only scope");if(relative!="registration/StartMenu.CodexRemote-fix.lnk"&&relative!="registration/Desktop.CodexRemote-fix.lnk")throw new InvalidDataException("product shortcut source");Pin cursor=Require(generationToken,true);ValidateCurrent(cursor);string[] segments=relative.Split('/');for(int i=0;i<segments.Length;i++){Pin next;if(!names.TryGetValue(Key(cursor,segments[i]),out next))throw new InvalidDataException("product shortcut source");if(i<segments.Length-1){if(!next.Directory)throw new InvalidDataException("product shortcut source");ValidateCurrent(next);cursor=next;}else{if(next.Directory||!next.Sealed||!next.Published)throw new InvalidDataException("product shortcut source");ValidateCurrent(next);return new object[]{next.Token,next.SealedLength,next.SealedSha};}}throw new InvalidDataException("product shortcut source");
+    }
+
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object CopyProductShortcut(object folderToken,string kind,object sourceToken,string leaf)
+    {
+        if(stateOnly)throw new InvalidOperationException("state-only scope");Pin parent=Require(folderToken,true);ValidateCurrent(parent);Pin source=Require(sourceToken,false);ValidateCurrent(source);
         if(!productFolders.Contains(folderToken)||!String.Equals(leaf,"CodexRemote-fix.lnk",StringComparison.Ordinal)||
            (!String.Equals(kind,"StartMenu",StringComparison.Ordinal)&&!String.Equals(kind,"Desktop",StringComparison.Ordinal)))throw new InvalidDataException("product shortcut scope");
-        string full=Path.GetFullPath(source);SafeFileHandle sourceHandle=CreateFileW(full,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,IntPtr.Zero,OPEN_EXISTING,FLAG_REPARSE,IntPtr.Zero);
-        if(sourceHandle.IsInvalid)throw new Win32Exception(Marshal.GetLastWin32Error());FileStream sourceStream=null;
-        try
-        {
-            FILE_INFO sourceInfo=Info(sourceHandle);ValidatePlain(sourceInfo,sourceHandle);if(!SamePath(FinalPath(sourceHandle),full))throw new InvalidDataException("source path changed");
-            sourceStream=new FileStream(sourceHandle,FileAccess.Read,65536,false);sourceHandle=null;externalStreams.Add(sourceStream);FileStream ownedSource=sourceStream;sourceStream=null;
-            if(ownedSource.Length!=expectedLength||Sha(ownedSource)!=expectedSha)throw new InvalidDataException("source mismatch");ownedSource.Position=0;
-            Pin destination=CreateTemporaryFile(parent);ownedSource.CopyTo(destination.Stream);destination.Stream.Flush(true);
+        long expectedLength=source.SealedLength;string expectedSha=source.SealedSha;if(source.Stream.Length!=expectedLength||Sha(source.Stream)!=expectedSha)throw new InvalidDataException("source mismatch");source.Stream.Position=0;
+            Pin destination=CreateTemporaryFile(parent);source.Stream.CopyTo(destination.Stream);destination.Stream.Flush(true);
             if(destination.Stream.Length!=expectedLength||Sha(destination.Stream)!=expectedSha)throw new InvalidDataException("destination mismatch");
             SealAndReplaceProduct(destination,leaf,expectedLength,expectedSha);EnsurePublishedPin(destination);return destination.Token;
-        }
-        finally{if(sourceStream!=null)sourceStream.Dispose();if(sourceHandle!=null)sourceHandle.Dispose();}
     }
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal void Close()
@@ -324,7 +327,7 @@ function Get-CcodInstallTransaction($Capability,[string]$InvalidId='CCOD_INSTALL
 function Add-CcodInstallScope($Transaction,$Token,[string]$Kind='Directory',[bool]$ReadOnly=$false,[AllowNull()][string]$RuntimeId=$null){$capability=New-CcodInstallCapability;$script:CcodScopes.Add($capability,[pscustomobject]@{Transaction=$Transaction;Token=$Token;Kind=$Kind;ReadOnly=$ReadOnly;RuntimeId=$RuntimeId});$capability}
 function Get-CcodInstallScopedDirectory($Transaction,$Parent){$parentScope=Get-CcodInstallTransaction $Parent 'CCOD_INSTALL_DIRECTORY_INVALID';if(-not[object]::ReferenceEquals($parentScope.Record.Transaction,$Transaction)-or$parentScope.Record.Kind-cnotin@('Directory','Generation')){Throw-CcodInstallFileError 'CCOD_INSTALL_DIRECTORY_INVALID' 'Directory capability is outside the transaction scope' $null};return $parentScope}
 function Assert-CcodInstallWritableScope($Scope){if($Scope.Record.ReadOnly){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_READ_ONLY' 'Retained generation capability is read-only' $null}}
-function Convert-CcodInstallRuntimeError($Action,[string]$DefaultId){try{return&$Action}catch{$exception=$_.Exception;while($null-ne$exception.InnerException-and$exception-is[Management.Automation.RuntimeException]){$exception=$exception.InnerException};$message=[string]$exception.Message;if($exception-is[ObjectDisposedException]){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' $message $null};if($message-match'state-only scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_STATE_SCOPE' $message $null};if($exception-is[ComponentModel.Win32Exception]-and$exception.NativeErrorCode-in@(80,183)){Throw-CcodInstallFileError 'CCOD_INSTALL_LEAF_EXISTS' 'Install object already exists' $null};if($message-match'pointer generation exists'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' $message $null};if($message-match'pointer generation overflow'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW' $message $null};if($message-match'retained manifest mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_MANIFEST_MISMATCH' $message $null};if($message-match'retained runtime id mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH' $message $null};if($message-match'seal mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_SEAL_MISMATCH' $message $null};if($message-match'alternate stream'){Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' $message $null};if($message-match'multi-link'){Throw-CcodInstallFileError 'CCOD_INSTALL_MULTILINK_LEAF' $message $null};if($message-match'reparse'){Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' $message $null};if($message-match'transaction scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_SCOPE' $message $null};if($message-match'generation not owned'){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' $message $null};if($message-match'unknown|unsealed'){Throw-CcodInstallFileError 'CCOD_INSTALL_UNKNOWN_LEAF' $message $null};if($message-match'pin changed|path changed'){Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' $message $null};Throw-CcodInstallFileError $DefaultId $message $null}}
+function Convert-CcodInstallRuntimeError($Action,[string]$DefaultId){try{return&$Action}catch{$exception=$_.Exception;while($null-ne$exception.InnerException-and$exception-is[Management.Automation.RuntimeException]){$exception=$exception.InnerException};$message=[string]$exception.Message;if($exception-is[ObjectDisposedException]){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' $message $null};if($message-match'state-only scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_STATE_SCOPE' $message $null};if($message-match'product-only scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' $message $null};if($exception-is[ComponentModel.Win32Exception]-and$exception.NativeErrorCode-in@(80,183)){Throw-CcodInstallFileError 'CCOD_INSTALL_LEAF_EXISTS' 'Install object already exists' $null};if($message-match'pointer generation exists'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' $message $null};if($message-match'pointer generation overflow'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW' $message $null};if($message-match'retained manifest mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_MANIFEST_MISMATCH' $message $null};if($message-match'retained runtime id mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH' $message $null};if($message-match'product shortcut source'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' $message $null};if($message-match'seal mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_SEAL_MISMATCH' $message $null};if($message-match'alternate stream'){Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' $message $null};if($message-match'multi-link'){Throw-CcodInstallFileError 'CCOD_INSTALL_MULTILINK_LEAF' $message $null};if($message-match'reparse'){Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' $message $null};if($message-match'transaction scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_SCOPE' $message $null};if($message-match'generation not owned'){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' $message $null};if($message-match'unknown|unsealed'){Throw-CcodInstallFileError 'CCOD_INSTALL_UNKNOWN_LEAF' $message $null};if($message-match'pin changed|path changed'){Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' $message $null};Throw-CcodInstallFileError $DefaultId $message $null}}
 function Test-CcodInstallValue($Value,[int]$Depth=0) {
     if ($Depth -gt 12) { return $false }
     if ($null -eq $Value) { return $true }
@@ -359,10 +362,12 @@ function Open-CcodInstallGeneration {
     Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID'
     $arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$RuntimeId,$null)
     try{$token=Invoke-CcodRuntimeStatic Open $arguments}catch [ComponentModel.Win32Exception]{if($_.Exception.NativeErrorCode-in@(32,80,183)){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_EXISTS' 'Install generation already exists' $RuntimeId};throw}
-    $runtime=$arguments[2];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$RuntimeId;RootToken=$token;StateOnly=$false;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='Generation';ReadOnly=$false;RuntimeId=$RuntimeId});$transaction
+    $runtime=$arguments[2];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$RuntimeId;RootToken=$token;StateOnly=$false;ProductOnly=$false;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='Generation';ReadOnly=$false;RuntimeId=$RuntimeId});$transaction
 }
-function Open-CcodInstallStateTransaction { param([Parameter(Mandatory)][string]$InstallRoot) Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenState $arguments} 'CCOD_INSTALL_STATE_TRANSACTION_INVALID';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$null;RootToken=$token;StateOnly=$true;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='StateTransaction';ReadOnly=$false;RuntimeId=$null});$transaction }
+function Open-CcodInstallStateTransaction { param([Parameter(Mandatory)][string]$InstallRoot) Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenState $arguments} 'CCOD_INSTALL_STATE_TRANSACTION_INVALID';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$null;RootToken=$token;StateOnly=$true;ProductOnly=$false;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='StateTransaction';ReadOnly=$false;RuntimeId=$null});$transaction }
+function Open-CcodInstallProductRegistrationTransaction {param([Parameter(Mandatory)][string]$InstallRoot)Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenProduct $arguments} 'CCOD_INSTALL_PRODUCT_SCOPE';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$null;RootToken=$token;StateOnly=$false;ProductOnly=$true;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='ProductTransaction';ReadOnly=$true;RuntimeId=$null});$transaction}
 function Open-CcodInstallRetainedGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)][string]$ExpectedManifestSha256,[Parameter(Mandatory)]$FileTransaction) if(-not[IO.Path]::IsPathRooted($InstallRoot)-or$ExpectedManifestSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_GENERATION_INVALID' 'Invalid retained generation contract' $RuntimeId};Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';if(-not[object]::ReferenceEquals($scope.Record.Transaction,$FileTransaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'FileTransaction must be the transaction root capability' $null};Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$nativeResult=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetained @($RuntimeId,$ExpectedManifestSha256)} 'CCOD_INSTALL_RETAINED_GENERATION_INVALID';if(@($nativeResult).Count-ne 2-or-not(Test-CcodRetainedManifestIdentity ([string]$nativeResult[1]) $RuntimeId)){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH' 'Retained manifest must contain exactly one matching top-level runtimeId string' $RuntimeId};Add-CcodInstallScope $scope.Record.Transaction $nativeResult[0] Generation $true $RuntimeId }
+function Open-CcodInstallRetainedFile {param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$RelativePath)if($RelativePath-cnotin@('registration/StartMenu.CodexRemote-fix.lnk','registration/Desktop.CodexRemote-fix.lnk')){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Product shortcut source must be one fixed manifest-relative candidate' $RelativePath};$scope=Get-CcodInstallTransaction $Generation 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';$result=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetainedFile @($scope.Record.Token,$RelativePath)} 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';if(@($result).Count-ne3-or[int64]$result[1]-lt0-or[string]$result[2]-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Retained product shortcut identity is invalid' $RelativePath};Add-CcodInstallScope $scope.Record.Transaction $result[0] RetainedFile $true $scope.Record.RuntimeId}
 function New-CcodInstallDirectory { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$Parent,[Parameter(Mandatory)][string]$Leaf,[switch]$CreateIfMissing) Assert-CcodInstallLeaf $Leaf;$transactionScope=Get-CcodInstallTransaction $Transaction 'CCOD_INSTALL_TRANSACTION_INVALID';if(-not[object]::ReferenceEquals($transactionScope.Record.Transaction,$Transaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Transaction capability must be the transaction root' $null};if([object]::ReferenceEquals($Parent,$Transaction)){$token=Invoke-CcodRuntimeMethod $transactionScope.State.Runtime GetInstallRoot @();$parentScope=[pscustomobject]@{State=$transactionScope.State;Record=[pscustomobject]@{Transaction=$Transaction;Token=$token;Kind='Directory';ReadOnly=$false;RuntimeId=$null}}}else{$parentScope=Get-CcodInstallScopedDirectory $Transaction $Parent};Assert-CcodInstallWritableScope $parentScope;$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $parentScope.State.Runtime OpenDirectory @($parentScope.Record.Token,$Leaf,[bool]$CreateIfMissing)} 'CCOD_INSTALL_DIRECTORY_OPEN_FAILED';$readOnly=[bool](Invoke-CcodRuntimeMethod $parentScope.State.Runtime IsRetained @($token));Add-CcodInstallScope $Transaction $token Directory $readOnly $(if($readOnly){$parentScope.Record.RuntimeId}else{$null}) }
 function New-CcodInstallGenerationLeaf { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$Leaf) Assert-CcodInstallLeaf $Leaf;$scope=Get-CcodInstallTransaction $Generation;Assert-CcodInstallWritableScope $scope;if($scope.State.StateOnly){Throw-CcodInstallFileError 'CCOD_INSTALL_STATE_SCOPE' 'State-only transaction cannot create a generation leaf' $Leaf};$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CreateDirectory @($scope.Record.Token,$Leaf)} 'CCOD_INSTALL_LEAF_CREATE_FAILED';Add-CcodInstallScope $scope.Record.Transaction $token Directory $scope.Record.ReadOnly $scope.Record.RuntimeId }
 function Copy-CcodInstallSealedSource { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$SourcePath,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)][int64]$ExpectedLength,[Parameter(Mandatory)][string]$ExpectedSha256) Assert-CcodInstallLeaf $Leaf;if(-not[IO.Path]::IsPathRooted($SourcePath)-or$ExpectedLength-lt 0-or$ExpectedSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Invalid sealed source contract' $SourcePath};$scope=Get-CcodInstallTransaction $Generation;Assert-CcodInstallWritableScope $scope;$result=[pscustomobject]@{Length=$ExpectedLength;Sha256=$ExpectedSha256};Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Copy @($scope.Record.Token,$Leaf,[IO.Path]::GetFullPath($SourcePath),$ExpectedLength,$ExpectedSha256)|Out-Null} 'CCOD_INSTALL_SOURCE_MISMATCH';return $result }
@@ -371,23 +376,23 @@ function Write-CcodInstallRecord { param([Parameter(Mandatory)]$Transaction,[Par
 function Commit-CcodInstallActivePointer { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$TargetGeneration,[Parameter(Mandatory)][uint64]$ExpectedPreviousGeneration,[Parameter(Mandatory)]$FileTransaction) if($ExpectedPreviousGeneration-eq[uint64]::MaxValue){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW' 'Pointer generation cannot advance beyond UInt64.MaxValue' $ExpectedPreviousGeneration};$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$target=Get-CcodInstallTransaction $TargetGeneration 'CCOD_INSTALL_POINTER_TARGET_INVALID';if(-not[object]::ReferenceEquals($target.Record.Transaction,$FileTransaction)-or$target.Record.Kind-cne'Generation'-or[string]::IsNullOrWhiteSpace([string]$target.Record.RuntimeId)){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_TARGET_INVALID' 'Pointer target is outside the transaction scope' $null};$generation=[uint64]($ExpectedPreviousGeneration+1);$runtimeId=[string]$target.Record.RuntimeId;$pointer=[ordered]@{schemaVersion=1;generation=$generation;activeRuntime=$runtimeId;previousGeneration=$ExpectedPreviousGeneration};$bytes=ConvertTo-CcodInstallJsonBytes $pointer;$result=[pscustomobject]@{Generation=$generation;RuntimeId=$runtimeId};try{Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CommitPointer @($target.Record.Token,$ExpectedPreviousGeneration,$runtimeId,$bytes)|Out-Null} 'CCOD_INSTALL_POINTER_COMMIT_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' 'Pointer generation already exists' $generation};throw};return $result }
 function Retire-CcodInstallGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)]$FileTransaction) Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID' -AllowRetired;Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';if($RuntimeId-cne$scope.State.RuntimeId-or$scope.Record.Token-ne$scope.State.RootToken){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' 'Generation is not owned by this transaction' $RuntimeId};if($scope.State.Retired){return $scope.State.RetirementResult};$recordLeaf=$RuntimeId+'.json';$record=ConvertTo-CcodInstallJsonBytes ([ordered]@{schemaVersion=1;runtimeId=$RuntimeId;state='Retired'});$capability=Add-CcodInstallScope $scope.Record.Transaction $scope.State.RootToken;$result=[pscustomobject]@{Disposition='Retired';Capability=$capability};try{Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Retire @($scope.Record.Token,$RuntimeId,$recordLeaf,$record)|Out-Null} 'CCOD_INSTALL_RETIREMENT_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETIREMENT_RECORD_EXISTS' 'Retirement record already exists' $recordLeaf};throw};$scope.State.RetirementResult=$result;$scope.State.Retired=$true;return $result }
 function Open-CcodInstallProductSpecialFolder {
-    param([Parameter(Mandatory)]$FileTransaction,[Parameter(Mandatory)][ValidateSet('StartMenu','Desktop')][string]$Kind)
-    $scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID'
-    if(-not[object]::ReferenceEquals($scope.Record.Transaction,$FileTransaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_FOLDER_INVALID' 'Product special folder requires the transaction-root capability' $Kind}
+    param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][ValidateSet('StartMenu','Desktop')][string]$Kind)
+    $scope=Get-CcodInstallTransaction $Generation 'CCOD_INSTALL_TRANSACTION_INVALID'
+    if($scope.Record.Kind-cne'Generation'-or[string]::IsNullOrWhiteSpace([string]$scope.Record.RuntimeId)-or$scope.State.StateOnly){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_FOLDER_INVALID' 'Product special folder requires a generation or retained-generation capability' $Kind}
     $specialFolder=if($Kind-ceq'StartMenu'){[Environment+SpecialFolder]::Programs}else{[Environment+SpecialFolder]::Desktop}
     $path=[Environment]::GetFolderPath($specialFolder)
     if([string]::IsNullOrWhiteSpace($path)-or-not[IO.Path]::IsPathRooted($path)){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_FOLDER_INVALID' 'Current-user special folder is unavailable' $Kind}
     $token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenProductFolder @($Kind,[IO.Path]::GetFullPath($path))} 'CCOD_INSTALL_PRODUCT_FOLDER_INVALID'
-    Add-CcodInstallScope $FileTransaction $token ProductFolder $false $null
+    Add-CcodInstallScope $scope.Record.Transaction $token ProductFolder $false $scope.Record.RuntimeId
 }
 function Copy-CcodInstallProductShortcut {
-    param([Parameter(Mandatory)]$Folder,[Parameter(Mandatory)][ValidateSet('StartMenu','Desktop')][string]$Kind,[Parameter(Mandatory)][string]$SourcePath,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)][int64]$ExpectedLength,[Parameter(Mandatory)][string]$ExpectedSha256,[Parameter(Mandatory)]$FileTransaction)
-    if($Leaf-cne'CodexRemote-fix.lnk'-or-not[IO.Path]::IsPathRooted($SourcePath)-or$ExpectedLength-lt 0-or$ExpectedSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Invalid fixed product shortcut contract' $Leaf}
-    $scope=Get-CcodInstallTransaction $Folder 'CCOD_INSTALL_PRODUCT_FOLDER_INVALID';if(-not[object]::ReferenceEquals($scope.Record.Transaction,$FileTransaction)-or$scope.Record.Kind-cne'ProductFolder'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_FOLDER_INVALID' 'Product folder capability is outside the file transaction' $Kind}
-    Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CopyProductShortcut @($scope.Record.Token,$Kind,[IO.Path]::GetFullPath($SourcePath),$Leaf,$ExpectedLength,$ExpectedSha256)} 'CCOD_INSTALL_PRODUCT_SHORTCUT_FAILED'|Out-Null
-    [pscustomobject]@{Kind=$Kind;Leaf=$Leaf;Length=$ExpectedLength;Sha256=$ExpectedSha256}
+    param([Parameter(Mandatory)]$Folder,[Parameter(Mandatory)]$Source,[Parameter(Mandatory)][ValidateSet('StartMenu','Desktop')][string]$Kind,[Parameter(Mandatory)][string]$Leaf)
+    if($Leaf-cne'CodexRemote-fix.lnk'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Invalid fixed product shortcut contract' $Leaf}
+    $scope=Get-CcodInstallTransaction $Folder 'CCOD_INSTALL_PRODUCT_FOLDER_INVALID';$sourceScope=Get-CcodInstallTransaction $Source 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';if($scope.Record.Kind-cne'ProductFolder'-or$sourceScope.Record.Kind-cne'RetainedFile'-or-not[object]::ReferenceEquals($scope.Record.Transaction,$sourceScope.Record.Transaction)-or$scope.Record.RuntimeId-cne$sourceScope.Record.RuntimeId){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Product shortcut source and destination are outside one selected generation scope' $Kind}
+    Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CopyProductShortcut @($scope.Record.Token,$Kind,$sourceScope.Record.Token,$Leaf)} 'CCOD_INSTALL_PRODUCT_SHORTCUT_FAILED'|Out-Null
+    [pscustomobject]@{Kind=$Kind;Leaf=$Leaf}
 }
 function Close-CcodInstallFileTransaction { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][ValidateSet('Ready','Failed')][string]$Disposition) $state=$null;if($null-eq$Transaction-or-not$script:CcodTransactions.TryGetValue($Transaction,[ref]$state)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Invalid install file transaction capability' $null};if($state.Closed-and-not$state.CleanupFailed){return};try{Invoke-CcodRuntimeMethod $state.Runtime Close @()|Out-Null;$state.CleanupFailed=$false}catch{$state.CleanupFailed=$true;$state.Closed=$true;$state.Disposition=$Disposition;Throw-CcodInstallFileError 'CCOD_INSTALL_CLOSE_FAILED' 'Install file transaction cleanup failed; registered failures are retained for retry' $null};$state.Closed=$true;$state.Disposition=$Disposition }
 
 Initialize-CcodInstallRuntime
-Export-ModuleMember -Function Open-CcodInstallGeneration,Open-CcodInstallStateTransaction,Open-CcodInstallRetainedGeneration,New-CcodInstallDirectory,New-CcodInstallGenerationLeaf,Copy-CcodInstallSealedSource,Write-CcodInstallGenerationManifest,Write-CcodInstallRecord,Commit-CcodInstallActivePointer,Retire-CcodInstallGeneration,Open-CcodInstallProductSpecialFolder,Copy-CcodInstallProductShortcut,Close-CcodInstallFileTransaction
+Export-ModuleMember -Function Open-CcodInstallGeneration,Open-CcodInstallStateTransaction,Open-CcodInstallProductRegistrationTransaction,Open-CcodInstallRetainedGeneration,Open-CcodInstallRetainedFile,New-CcodInstallDirectory,New-CcodInstallGenerationLeaf,Copy-CcodInstallSealedSource,Write-CcodInstallGenerationManifest,Write-CcodInstallRecord,Commit-CcodInstallActivePointer,Retire-CcodInstallGeneration,Open-CcodInstallProductSpecialFolder,Copy-CcodInstallProductShortcut,Close-CcodInstallFileTransaction
diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index 9f5a670..4c97c37 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -448,7 +448,7 @@ function Complete-CcodReadyFinalizationRecovery {
         $observed=Read-CcodInstallTransactionRecord -InstallRoot $InstallRoot -TransactionId $TransactionRecord.transactionId
         if($null-eq$observed-or$observed.phase-cne'Ready'){Throw-CcodLifecycleError 'CCOD_INSTALL_READY_FINALIZATION_PENDING' 'Ready finalization snapshot is not visible' $TransactionRecord.transactionId}
         if([string]$proof.Validation.Manifest.projectVersion-ceq$script:CcodProductVersion){
-            try{$registration=&$Adapters.RegisterProduct $InstallRoot ([string]$observed.newRuntimeId) ([string]$proof.Validation.Manifest.projectVersion) ([string]$observed.sealedPackageSha256) $fileTransaction $observed;if($null-eq$registration-or$registration.verified-isnot[bool]-or-not$registration.verified){throw 'registration receipt invalid'};$productRegistrationVerified=$true}catch{$productRegistrationFailure=$_}
+            try{$registration=&$Adapters.RegisterProduct $InstallRoot ([string]$observed.newRuntimeId) ([string]$proof.Validation.Manifest.projectVersion) ([string]$observed.sealedPackageSha256) $null $observed;if($null-eq$registration-or$registration.verified-isnot[bool]-or-not$registration.verified){throw 'registration receipt invalid'};$productRegistrationVerified=$true}catch{$productRegistrationFailure=$_}
         }
     }catch{
         try{$observed=Read-CcodInstallTransactionRecord -InstallRoot $InstallRoot -TransactionId $TransactionRecord.transactionId}catch{}
@@ -664,6 +664,7 @@ function Get-CcodLifecycleSourceFiles {
         'src\persistence\bootstrap.ps1',
         'src\persistence\UninstallBootstrap.ps1',
         'src\persistence\PortableUninstallFinalizer.ps1',
+        'src\persistence\InstalledUninstallFinalizer.ps1',
         'Test-CodexControlOtherDevices.ps1',
         'Start-CodexControlOtherDevices.ps1',
         'Reset-CodexControlOtherDevices.ps1'
@@ -1951,11 +1952,15 @@ function Get-CcodLifecycleAdapters {
         RegisterProduct = {
             param($InstallRoot,$RuntimeId,$Version,$PackageSha256,$FileTransaction,$TransactionRecord)
             $module=Import-Module (Join-Path $PSScriptRoot 'ProductRegistration.psm1') -Force -PassThru -ErrorAction Stop
-            $registration=New-CcodProductRegistration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -Version $Version -PackageSha256 $PackageSha256 -FileTransaction $FileTransaction
-            $proof=[pscustomobject][ordered]@{phase=[string]$TransactionRecord.phase;runtimeId=$RuntimeId;version=$Version;packageSha256=$PackageSha256;bootstrapPath=$registration.bootstrapPath;uninstallerPath=$registration.uninstallerPath}
-            $receipt=Commit-CcodProductRegistration -Registration $registration -FileTransaction $FileTransaction -Adapters @{GetReadyProof={param($Ignored)$proof}.GetNewClosure()}
-            Remove-CcodLegacyProductRegistration -ExpectedAppId '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}'
-            [pscustomobject]@{verified=[bool]$receipt.verified;legacyRemoved=$true}
+            $ownedTransaction=$null;$sourceCapability=$FileTransaction
+            try{
+                if($null-eq$sourceCapability){Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop;$ownedTransaction=Open-CcodInstallProductRegistrationTransaction -InstallRoot $InstallRoot;$sourceCapability=Open-CcodInstallRetainedGeneration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -ExpectedManifestSha256 ([string]$TransactionRecord.newManifestSha256) -FileTransaction $ownedTransaction}
+                $registration=New-CcodProductRegistration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -Version $Version -PackageSha256 $PackageSha256 -FileTransaction $sourceCapability
+                $proof=[pscustomobject][ordered]@{phase=[string]$TransactionRecord.phase;runtimeId=$RuntimeId;version=$Version;packageSha256=$PackageSha256;bootstrapPath=$registration.bootstrapPath;uninstallerPath=$registration.uninstallerPath}
+                $receipt=Commit-CcodProductRegistration -Registration $registration -FileTransaction $sourceCapability -Adapters @{GetReadyProof={param($Ignored)$proof}.GetNewClosure()}
+                Remove-CcodLegacyProductRegistration -ExpectedAppId '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}'
+                [pscustomobject]@{verified=[bool]$receipt.verified;legacyRemoved=$true}
+            }finally{if($null-ne$ownedTransaction){try{Close-CcodInstallFileTransaction -Transaction $ownedTransaction -Disposition Ready}catch{}}}
         }
         NewRuntimeManifest = {
             param($RuntimeDirectory, $ProjectVersion)
@@ -2370,7 +2375,9 @@ function Invoke-CcodInstall {
         if($activeValidation.Valid){
             $sameIdentity=Test-CcodInstallPackageIdentity -TransactionRecord $globalTransaction -ProjectVersion ([string]$projectVersion) -ActiveProjectVersion ([string]$activeValidation.Manifest.projectVersion) -SealedPackageSha256 $SealedPackageSha256 -ActiveRuntimeId ([string]$existingPointer.activeRuntime) -ActiveGeneration ([uint64]$existingPointer.generation)
             if($sameIdentity){
-                return [pscustomobject][ordered]@{Outcome='AlreadyInstalled';Installed=$true;RuntimeId=[string]$existingPointer.activeRuntime;PreviousRuntimeId=$existingPointer.previousRuntime;RepairCompleted=$false}
+                $registration=&$adapters.RegisterProduct $root ([string]$existingPointer.activeRuntime) ([string]$projectVersion) $SealedPackageSha256 $null $globalTransaction
+                if($null-eq$registration-or$registration.verified-isnot[bool]-or-not$registration.verified){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'AlreadyInstalled product registration reconciliation did not verify' $existingPointer.activeRuntime}
+                return [pscustomobject][ordered]@{Outcome='AlreadyInstalled';Installed=$true;RuntimeId=[string]$existingPointer.activeRuntime;PreviousRuntimeId=$existingPointer.previousRuntime;RepairCompleted=$false;ProductRegistrationVerified=$true}
             }
         }
     }
@@ -2652,7 +2659,8 @@ function Invoke-CcodUninstallCleanup {
         [Parameter(Mandatory)][string]$InstallRoot,
         [Parameter(Mandatory)]$Transaction,
         [Parameter(Mandatory)][scriptblock]$WriteTransaction,
-        [hashtable]$Adapters
+        [hashtable]$Adapters,
+        [switch]$StopAfterTaskRemoval
     )
 
     $adapters = Get-CcodLifecycleAdapters -Adapters $Adapters
@@ -2759,6 +2767,7 @@ function Invoke-CcodUninstallCleanup {
             catch { Throw-CcodLifecycleError 'CCOD_UNINSTALL_TASK_REMOVAL_FAILED' 'The supervisor scheduled task could not be removed' $Transaction }
             Set-CcodUninstallTransactionPhase -Transaction $Transaction -Phase 'TaskRemoved' -WriteTransaction $WriteTransaction -Adapters $adapters
             $phase = 'TaskRemoved'
+            if($StopAfterTaskRemoval){return $Transaction}
         }
 
         if ($phase -eq 'TaskRemoved') {
diff --git a/src/persistence/modules/ProductRegistration.psm1 b/src/persistence/modules/ProductRegistration.psm1
index 47efd8a..f24a167 100644
--- a/src/persistence/modules/ProductRegistration.psm1
+++ b/src/persistence/modules/ProductRegistration.psm1
@@ -19,6 +19,7 @@ $script:CcodLegacyShortcutNames = @(
     'Programs\Codex Control other devices\Uninstall CodexRemote-fix.lnk',
     ('Desktop\Codex ' + [char]0x8BBE + [char]0x5907 + [char]0x8FDE + [char]0x63A5 + ' (Device Connection).lnk')
 )
+$script:CcodLegacyRegistryValueNames=@('DisplayName','DisplayVersion','UninstallString','QuietUninstallString','DisplayIcon','InstallLocation','Publisher','URLInfoAbout','HelpLink','URLUpdateInfo','NoModify','NoRepair','InstallDate','MajorVersion','MinorVersion','VersionMajor','VersionMinor','EstimatedSize','Language','Inno Setup: App Path','Inno Setup: Icon Group','Inno Setup: Setup Version','Inno Setup: User')
 
 function Throw-CcodProductRegistrationError {
     param([Parameter(Mandatory)][string]$Id,[Parameter(Mandatory)][string]$Message,$Target)
@@ -138,6 +139,12 @@ function Get-CcodProductRegistrationAdapters {
         ReadLegacyRegistration = { param($ExpectedAppId) Read-CcodCurrentUserLegacyRegistration -ExpectedAppId $ExpectedAppId }
         ReadVerifiedRegistration = { Read-CcodCurrentUserVerifiedRegistration }
         RemoveLegacyRegistration = { param($ExpectedAppId,$ExpectedShortcutNames) Remove-CcodCurrentUserLegacyRegistration -ExpectedAppId $ExpectedAppId -ExpectedShortcutNames $ExpectedShortcutNames }
+        ReadCurrentProductState = { param($ExpectedRuntimeId) Read-CcodCurrentProductState -ExpectedRuntimeId $ExpectedRuntimeId }
+        RemoveCurrentProductEntry = { param($Entry) Remove-CcodCurrentProductEntry -Entry $Entry }
+        ReadLegacySnapshot = { param($ExpectedAppId) Read-CcodLegacySnapshot -ExpectedAppId $ExpectedAppId }
+        RemoveLegacyEntry = { param($Entry) Remove-CcodLegacySnapshotEntry -Entry $Entry }
+        ReadLegacyEntry = { param($Entry) Read-CcodLegacySnapshotEntry -Entry $Entry }
+        RestoreLegacyEntry = { param($Entry) Restore-CcodLegacySnapshotEntry -Entry $Entry }
     }
     if ($null -eq $Adapters) { return $defaults }
     if ($Adapters -isnot [hashtable]) { Throw-CcodProductRegistrationError 'CCOD_PRODUCT_ADAPTER_INVALID' 'Product adapters must be a hashtable.' $Adapters }
@@ -163,16 +170,14 @@ function Get-CcodProductUninstallCommand($Registration) {
 function Write-CcodCurrentUserProductRegistration {
     param($Registration)
     $path=Get-CcodProductRegistryPath;$command=Get-CcodProductUninstallCommand $Registration
+    $shell=$null;$startLink=$null;$desktopLink=$null;try{$shell=New-Object -ComObject WScript.Shell;$startLink=$shell.CreateShortcut([string]$Registration.startMenuShortcut.candidatePath);$desktopLink=$shell.CreateShortcut([string]$Registration.desktopShortcut.candidatePath);$target=[IO.Path]::GetFullPath([string]$startLink.TargetPath);$arguments=[string]$startLink.Arguments;if([IO.Path]::GetFullPath([string]$desktopLink.TargetPath)-cne$target-or[string]$desktopLink.Arguments-cne$arguments){throw 'candidate target mismatch'}}finally{if($null-ne$startLink){[void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($startLink)};if($null-ne$desktopLink){[void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($desktopLink)};if($null-ne$shell){[void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($shell)}}
     New-Item -Path $path -Force -ErrorAction Stop|Out-Null
-    $values=[ordered]@{DisplayName='CodexRemote-fix';DisplayVersion=[string]$Registration.version;Publisher='naipi11';InstallLocation=[string]$Registration.runtimeRoot;UninstallString=$command;QuietUninstallString=($command+' -Confirm:$false');NoModify=1;NoRepair=1;CcodRuntimeId=[string]$Registration.runtimeId;CcodPackageSha256=[string]$Registration.packageSha256}
+    $values=[ordered]@{DisplayName='CodexRemote-fix';DisplayVersion=[string]$Registration.version;Publisher='naipi11';InstallLocation=[string]$Registration.runtimeRoot;UninstallString=$command;QuietUninstallString=($command+' -Confirm:$false');NoModify=1;NoRepair=1;CcodRuntimeId=[string]$Registration.runtimeId;CcodPackageSha256=[string]$Registration.packageSha256;CcodStartMenuSha256=Get-CcodProductFileSha256 ([string]$Registration.startMenuShortcut.candidatePath);CcodDesktopSha256=Get-CcodProductFileSha256 ([string]$Registration.desktopShortcut.candidatePath);CcodShortcutTarget=$target;CcodShortcutArguments=$arguments}
     foreach($name in $values.Keys){$type=if($name-in@('NoModify','NoRepair')){'DWord'}else{'String'};New-ItemProperty -LiteralPath $path -Name $name -Value $values[$name] -PropertyType $type -Force -ErrorAction Stop|Out-Null}
 }
 function Read-CcodCurrentUserProductRegistration {
     param($Registration)
-    try{$value=Get-ItemProperty -LiteralPath (Get-CcodProductRegistryPath) -ErrorAction Stop}catch{return $null}
-    $command=Get-CcodProductUninstallCommand $Registration
-    if($value.DisplayName-cne'CodexRemote-fix'-or$value.DisplayVersion-cne$Registration.version-or$value.Publisher-cne'naipi11'-or$value.InstallLocation-cne$Registration.runtimeRoot-or$value.UninstallString-cne$command-or$value.QuietUninstallString-cne($command+' -Confirm:$false')-or[int]$value.NoModify-ne1-or[int]$value.NoRepair-ne1-or$value.CcodRuntimeId-cne$Registration.runtimeId-or$value.CcodPackageSha256-cne$Registration.packageSha256){return $null}
-    $Registration
+    $state=Read-CcodCurrentProductState -ExpectedRuntimeId ([string]$Registration.runtimeId);if($null-ne$state-and$state.valid){$Registration}else{$null}
 }
 function Get-CcodProductShortcutDestination {
     param([string]$Kind)
@@ -197,11 +202,11 @@ function New-CcodProductShortcutCandidates {
 }
 function Write-CcodCurrentUserProductShortcut {
     param([string]$Kind,$Shortcut,$FileTransaction)
-    $source=[IO.Path]::GetFullPath([string]$Shortcut.candidatePath);$runtime=[IO.Path]::GetFullPath((Split-Path (Split-Path $source -Parent) -Parent));if(-not$source.StartsWith($runtime.TrimEnd('\')+'\',[StringComparison]::OrdinalIgnoreCase)-or-not[IO.File]::Exists($source)){throw 'shortcut candidate missing'}
-    $item=Get-Item -LiteralPath $source -Force -ErrorAction Stop;if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){throw 'shortcut candidate unsafe'}
     Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop
-    $folder=Open-CcodInstallProductSpecialFolder -FileTransaction $FileTransaction -Kind $Kind
-    Copy-CcodInstallProductShortcut -Folder $folder -Kind $Kind -SourcePath $source -Leaf 'CodexRemote-fix.lnk' -ExpectedLength ([int64]$item.Length) -ExpectedSha256 (Get-CcodProductFileSha256 $source) -FileTransaction $FileTransaction|Out-Null
+    $relative='registration/'+$(if($Kind-ceq'StartMenu'){'StartMenu.CodexRemote-fix.lnk'}else{'Desktop.CodexRemote-fix.lnk'})
+    $source=Open-CcodInstallRetainedFile -Generation $FileTransaction -RelativePath $relative
+    $folder=Open-CcodInstallProductSpecialFolder -Generation $FileTransaction -Kind $Kind
+    Copy-CcodInstallProductShortcut -Folder $folder -Source $source -Kind $Kind -Leaf 'CodexRemote-fix.lnk'|Out-Null
 }
 function Read-CcodCurrentUserProductShortcut {
     param([string]$Kind,$Shortcut)
@@ -232,6 +237,35 @@ function Remove-CcodCurrentUserLegacyRegistration {
     $path=Get-CcodLegacyRegistryPath $ExpectedAppId;if(Test-Path -LiteralPath $path -PathType Container){Remove-Item -LiteralPath $path -Force -ErrorAction Stop}
 }
 
+function Get-CcodProductShortcutEvidence([string]$Kind){
+    $path=Get-CcodProductShortcutDestination $Kind;if(-not[IO.File]::Exists($path)){return $null};$item=Get-Item -LiteralPath $path -Force -ErrorAction Stop;if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){return $null};$shell=$null;$link=$null;try{$shell=New-Object -ComObject WScript.Shell;$link=$shell.CreateShortcut($path);[pscustomobject]@{kind=$Kind;path=$path;sha256=Get-CcodProductFileSha256 $path;target=[IO.Path]::GetFullPath([string]$link.TargetPath);arguments=[string]$link.Arguments}}finally{if($null-ne$link){[void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($link)};if($null-ne$shell){[void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($shell)}}
+}
+function Read-CcodCurrentProductState {
+    param([string]$ExpectedRuntimeId)
+    try{
+        $subkey='Software\Microsoft\Windows\CurrentVersion\Uninstall\CodexRemote-fix';$key=[Microsoft.Win32.Registry]::CurrentUser.OpenSubKey($subkey,$false);if($null-eq$key){return [pscustomobject]@{valid=$true;reason=$null;entries=@()}}
+        try{$allowed=@('CcodDesktopSha256','CcodPackageSha256','CcodRuntimeId','CcodShortcutArguments','CcodShortcutTarget','CcodStartMenuSha256','DisplayName','DisplayVersion','InstallLocation','NoModify','NoRepair','Publisher','QuietUninstallString','UninstallString');$names=@($key.GetValueNames()|Sort-Object);if(($names-join'|')-cne(($allowed|Sort-Object)-join'|')){return [pscustomobject]@{valid=$false;reason='UnknownRegistryValue';entries=@()}};$runtime=[string]$key.GetValue('CcodRuntimeId',$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);$installLocation=[string]$key.GetValue('InstallLocation');$expectedUninstaller=Join-Path $installLocation 'Uninstall-CodexControlOtherDevices.ps1';$expectedCommand='"{0}" -NoProfile -ExecutionPolicy Bypass -File "{1}"'-f(Get-CcodProductPowerShellPath),$expectedUninstaller;if($runtime-cne$ExpectedRuntimeId-or$installLocation-cne[IO.Path]::GetFullPath((Join-Path (Join-Path (Split-Path (Split-Path $installLocation -Parent) -Parent) 'runtime') $runtime))-or[string]$key.GetValue('DisplayName')-cne'CodexRemote-fix'-or[string]$key.GetValue('DisplayVersion')-cne'2.5.22'-or[string]$key.GetValue('Publisher')-cne'naipi11'-or[string]$key.GetValue('UninstallString')-cne$expectedCommand-or[string]$key.GetValue('QuietUninstallString')-cne($expectedCommand+' -Confirm:$false')-or[int]$key.GetValue('NoModify')-ne1-or[int]$key.GetValue('NoRepair')-ne1-or[string]$key.GetValue('CcodPackageSha256')-cnotmatch'^[0-9a-f]{64}$'){return [pscustomobject]@{valid=$false;reason='RegistryMismatch';entries=@()}};foreach($dword in @('NoModify','NoRepair')){if($key.GetValueKind($dword)-ne[Microsoft.Win32.RegistryValueKind]::DWord){return [pscustomobject]@{valid=$false;reason='RegistryType';entries=@()}}};foreach($stringName in @($allowed|Where-Object{$_-notin@('NoModify','NoRepair')})){if($key.GetValueKind($stringName)-ne[Microsoft.Win32.RegistryValueKind]::String){return [pscustomobject]@{valid=$false;reason='RegistryType';entries=@()}}};$target=[string]$key.GetValue('CcodShortcutTarget');$arguments=[string]$key.GetValue('CcodShortcutArguments');$start=Get-CcodProductShortcutEvidence 'StartMenu';$desktop=Get-CcodProductShortcutEvidence 'Desktop';if($null-eq$start-or$null-eq$desktop-or$start.target-cne$target-or$desktop.target-cne$target-or$start.arguments-cne$arguments-or$desktop.arguments-cne$arguments-or$start.sha256-cne[string]$key.GetValue('CcodStartMenuSha256')-or$desktop.sha256-cne[string]$key.GetValue('CcodDesktopSha256')){return [pscustomobject]@{valid=$false;reason='ShortcutMismatch';entries=@()}};$captured=[ordered]@{};foreach($name in $names){$captured[$name]=[pscustomobject]@{value=$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);kind=[string]$key.GetValueKind($name)}};return [pscustomobject]@{valid=$true;reason=$null;entries=@([pscustomobject]@{kind='StartMenu';path=$start.path;sha256=$start.sha256},[pscustomobject]@{kind='Desktop';path=$desktop.path;sha256=$desktop.sha256},[pscustomobject]@{kind='Registry';path=$subkey;valueNames=$names;values=$captured})}}
+        finally{$key.Dispose()}
+    }catch{return [pscustomobject]@{valid=$false;reason='Ambiguous';entries=@()}}
+}
+function Remove-CcodCurrentProductEntry {
+    param($Entry)
+    if($Entry-is[string]){return}
+    if($Entry.kind-in@('StartMenu','Desktop')){$path=[IO.Path]::GetFullPath([string]$Entry.path);if(-not[IO.File]::Exists($path)-or(Get-CcodProductFileSha256 $path)-cne[string]$Entry.sha256){throw 'shortcut changed'};Remove-Item -LiteralPath $path -Force -ErrorAction Stop;return}
+    if($Entry.kind-cne'Registry'){throw 'unknown product entry'};$key=[Microsoft.Win32.Registry]::CurrentUser.OpenSubKey([string]$Entry.path,$true);if($null-eq$key){return};try{if((@($key.GetValueNames()|Sort-Object)-join'|')-cne((@($Entry.valueNames)|Sort-Object)-join'|')-or$key.GetSubKeyNames().Count-ne0){throw 'registry changed'};foreach($name in @($Entry.valueNames)){if([string]$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)-cne[string]$Entry.values[$name].value-or[string]$key.GetValueKind($name)-cne[string]$Entry.values[$name].kind){throw 'registry value changed'}};foreach($name in @($Entry.valueNames)){$key.DeleteValue($name,$true)};if($key.GetValueNames().Count-ne0){throw 'registry not empty'}}finally{$key.Dispose()};[Microsoft.Win32.Registry]::CurrentUser.DeleteSubKey([string]$Entry.path,$false)
+}
+function Remove-CcodProductRegistration {
+    [CmdletBinding()]param([Parameter(Mandatory)][string]$ExpectedRuntimeId,[hashtable]$Adapters)
+    if($ExpectedRuntimeId-cnotmatch'^2\.5\.22-[0-9a-f]{16}-[0-9a-f]{32}$'){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Expected product runtime ID is invalid' $ExpectedRuntimeId};$adapter=Get-CcodProductRegistrationAdapters $Adapters;$state=&$adapter.ReadCurrentProductState $ExpectedRuntimeId;if($null-eq$state-or$state.valid-isnot[bool]-or-not$state.valid-or$null-eq$state.entries){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Current product state is not an exact matched registration' $ExpectedRuntimeId};$entries=@($state.entries);if($entries.Count-notin@(0,3)){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Current product state is ambiguous' $ExpectedRuntimeId};foreach($entry in $entries){&$adapter.RemoveCurrentProductEntry $entry}
+}
+function Read-CcodLegacySnapshot {
+    param([string]$ExpectedAppId)
+    $legacy=Read-CcodCurrentUserLegacyRegistration $ExpectedAppId;if($null-eq$legacy){return $null};$entries=[Collections.Generic.List[object]]::new();$keyPath=Get-CcodLegacyRegistryPath $ExpectedAppId;$key=Get-Item -LiteralPath $keyPath -ErrorAction Stop;$names=@($key.GetValueNames());if($key.GetSubKeyNames().Count-ne0-or@($names|Where-Object{$script:CcodLegacyRegistryValueNames-cnotcontains$_}).Count-ne0){throw 'legacy registry contains unknown state'};$values=[ordered]@{};foreach($name in $names){$values[$name]=[pscustomobject]@{value=$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);kind=[string]$key.GetValueKind($name)}};$entries.Add([pscustomobject]@{kind='Registry';path=$keyPath;values=$values});$programs=[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs);$desktop=[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop);foreach($name in $legacy.shortcutNames){$relative=$name.Substring($name.IndexOf('\')+1);$path=[IO.Path]::GetFullPath($(if($name.StartsWith('Programs\',[StringComparison]::Ordinal)){Join-Path $programs $relative}else{Join-Path $desktop $relative}));$item=Get-Item -LiteralPath $path -Force -ErrorAction Stop;if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){throw 'legacy shortcut unsafe'};$bytes=[IO.File]::ReadAllBytes($path);$entries.Add([pscustomobject]@{kind='Shortcut';name=$name;path=$path;sha256=Get-CcodProductFileSha256 $path;bytesBase64=[Convert]::ToBase64String($bytes)})};[pscustomobject]@{appId=$ExpectedAppId;entries=@($entries)}
+}
+function Remove-CcodLegacySnapshotEntry {param($Entry);if($Entry-is[string]){return};if($Entry.kind-ceq'Registry'){$key=$null;try{$key=Get-Item -LiteralPath $Entry.path -ErrorAction Stop;if((@($key.GetValueNames()|Sort-Object)-join'|')-cne((@($Entry.values.Keys)|Sort-Object)-join'|')-or$key.GetSubKeyNames().Count-ne0){throw 'legacy registry changed'};foreach($name in @($Entry.values.Keys)){$current=$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);if([string]$current-cne[string]$Entry.values[$name].value-or[string]$key.GetValueKind($name)-cne[string]$Entry.values[$name].kind){throw 'legacy registry value changed'}};foreach($name in @($Entry.values.Keys)){$key.DeleteValue($name,$true)};$key.Dispose();$key=$null;Remove-Item -LiteralPath $Entry.path -Force -ErrorAction Stop;return}catch{if($null-ne$key){$key.Dispose()};if(-not(Test-Path -LiteralPath $Entry.path)){New-Item -Path $Entry.path -Force|Out-Null};foreach($name in $Entry.values.Keys){if($null-eq(Get-ItemProperty -LiteralPath $Entry.path -Name $name -ErrorAction SilentlyContinue)){$kind=[Enum]::Parse([Microsoft.Win32.RegistryValueKind],[string]$Entry.values[$name].kind);New-ItemProperty -LiteralPath $Entry.path -Name $name -Value $Entry.values[$name].value -PropertyType $kind -Force|Out-Null}};throw}};if(-not[IO.File]::Exists($Entry.path)-or(Get-CcodProductFileSha256 $Entry.path)-cne$Entry.sha256){throw 'legacy shortcut changed'};Remove-Item -LiteralPath $Entry.path -Force -ErrorAction Stop}
+function Read-CcodLegacySnapshotEntry {param($Entry);if($Entry-is[string]){return $null};if($Entry.kind-ceq'Registry'){if(Test-Path -LiteralPath $Entry.path){return 'Present'};return $null};if([IO.File]::Exists($Entry.path)){return Get-CcodProductFileSha256 $Entry.path};$null}
+function Restore-CcodLegacySnapshotEntry {param($Entry);if($Entry-is[string]){return};if($Entry.kind-ceq'Registry'){if(Test-Path -LiteralPath $Entry.path){throw 'legacy registry replacement present'};New-Item -Path $Entry.path -Force|Out-Null;foreach($name in $Entry.values.Keys){$kind=[Enum]::Parse([Microsoft.Win32.RegistryValueKind],[string]$Entry.values[$name].kind);New-ItemProperty -LiteralPath $Entry.path -Name $name -Value $Entry.values[$name].value -PropertyType $kind -Force|Out-Null};return};if([IO.File]::Exists($Entry.path)-or[IO.Directory]::Exists($Entry.path)){throw 'legacy shortcut replacement present'};[IO.Directory]::CreateDirectory((Split-Path $Entry.path -Parent))|Out-Null;$bytes=[Convert]::FromBase64String([string]$Entry.bytesBase64);$stream=[IO.File]::Open($Entry.path,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::Read);try{$stream.Write($bytes,0,$bytes.Length);$stream.Flush($true)}finally{$stream.Dispose()};if((Get-CcodProductFileSha256 $Entry.path)-cne$Entry.sha256){throw 'legacy shortcut restore mismatch'}}
+
 function Commit-CcodProductRegistration {
     [CmdletBinding()]
     param([Parameter(Mandatory)]$Registration,[Parameter(Mandatory)]$FileTransaction,[hashtable]$Adapters)
@@ -284,8 +318,10 @@ function Remove-CcodLegacyProductRegistration {
         $null -eq $legacy.shortcutNames -or (@($legacy.shortcutNames) -join '|') -cne ($script:CcodLegacyShortcutNames -join '|')) {
         Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product entry or shortcut names do not match the exact migration allowlist.' $ExpectedAppId
     }
-    try { & $adapter.RemoveLegacyRegistration $ExpectedAppId @($script:CcodLegacyShortcutNames) }
-    catch { Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration failed without authorizing broader deletion.' $ExpectedAppId }
+    $snapshot=&$adapter.ReadLegacySnapshot $ExpectedAppId
+    if($null-eq$snapshot-or$snapshot.appId-cne$ExpectedAppId-or@($snapshot.entries).Count-ne9){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy snapshot is incomplete or ambiguous' $ExpectedAppId}
+    $removed=[Collections.Generic.List[object]]::new()
+    try{foreach($entry in @($snapshot.entries)){&$adapter.RemoveLegacyEntry $entry;$removed.Add($entry)}}catch{for($index=$removed.Count-1;$index-ge0;$index--){$entry=$removed[$index];try{if($null-eq(&$adapter.ReadLegacyEntry $entry)){&$adapter.RestoreLegacyEntry $entry}}catch{}};Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration failed and exact prior entries were compensated where still absent.' $ExpectedAppId}
 }
 
-Export-ModuleMember -Function New-CcodProductRegistration,Test-CcodProductRegistration,Commit-CcodProductRegistration,Remove-CcodLegacyProductRegistration
+Export-ModuleMember -Function New-CcodProductRegistration,Test-CcodProductRegistration,Commit-CcodProductRegistration,Remove-CcodProductRegistration,Remove-CcodLegacyProductRegistration
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index 8126cc0..c2ad124 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -136,12 +136,26 @@ function New-CcodHardLink {
 }
 
 Invoke-CcodTest 'exports only immutable generation operations and an inert CLR marker' {
-    $expected=@('Close-CcodInstallFileTransaction','Commit-CcodInstallActivePointer','Copy-CcodInstallProductShortcut','Copy-CcodInstallSealedSource','New-CcodInstallDirectory','New-CcodInstallGenerationLeaf','Open-CcodInstallGeneration','Open-CcodInstallProductSpecialFolder','Open-CcodInstallRetainedGeneration','Open-CcodInstallStateTransaction','Retire-CcodInstallGeneration','Write-CcodInstallGenerationManifest','Write-CcodInstallRecord')
+    $expected=@('Close-CcodInstallFileTransaction','Commit-CcodInstallActivePointer','Copy-CcodInstallProductShortcut','Copy-CcodInstallSealedSource','New-CcodInstallDirectory','New-CcodInstallGenerationLeaf','Open-CcodInstallGeneration','Open-CcodInstallProductRegistrationTransaction','Open-CcodInstallProductSpecialFolder','Open-CcodInstallRetainedFile','Open-CcodInstallRetainedGeneration','Open-CcodInstallStateTransaction','Retire-CcodInstallGeneration','Write-CcodInstallGenerationManifest','Write-CcodInstallRecord')
     Assert-CcodEqual ($expected -join '|') ((@($module.ExportedCommands.Keys)|Sort-Object)-join '|') 'module export surface is capability-only'
     Assert-CcodEqual 4 ([CcodInstallGenerationCapabilityMarkerV4]::CapabilityAbi) 'marker exposes the current non-mutating ABI value'
     Assert-CcodEqual 'CcodInstallGenerationCapabilityMarkerV4' ((@([CcodInstallGenerationCapabilityMarkerV4].Assembly.GetExportedTypes()|ForEach-Object FullName)) -join '|') 'current CLR bridge exports only the inert marker'
     $dangerous=@([CcodInstallGenerationCapabilityMarkerV4].GetMethods([Reflection.BindingFlags]'Public,Static,DeclaredOnly')|Where-Object{@($_.GetParameters()|Where-Object{$_.ParameterType-in@([string],[IntPtr],[IO.Stream])-or[Microsoft.Win32.SafeHandles.SafeHandle].IsAssignableFrom($_.ParameterType)}).Count-ne 0})
     Assert-CcodEqual 0 $dangerous.Count 'marker accepts no path stream or bare handle'
+    Assert-CcodTrue (-not $module.ExportedCommands['Copy-CcodInstallProductShortcut'].Parameters.ContainsKey('SourcePath')) 'product shortcut copy accepts no arbitrary absolute source path'
+}
+
+# Production mutation caught: state-only recovery or an arbitrary absolute source can acquire product shortcut authority.
+Invoke-CcodTest 'product registration transaction exposes only a selected retained manifest file capability' {
+    $fixture=New-CcodInstallFileFixture
+    try{
+        $runtimeId='runtime-product-source';$source=New-CcodSourceFile $fixture 'product-source.lnk' 'sealed shortcut bytes';$generation=Open-CcodFixtureGeneration $fixture $runtimeId;$registration=New-CcodInstallGenerationLeaf -Generation $generation -Leaf 'registration';Copy-CcodInstallSealedSource -Generation $registration -SourcePath $source.Path -Leaf 'StartMenu.CodexRemote-fix.lnk' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null;$manifest=Write-CcodInstallGenerationManifest -Generation $generation -Manifest (New-CcodGenerationManifest $runtimeId @([ordered]@{path='registration/StartMenu.CodexRemote-fix.lnk';length=$source.Length;sha256=$source.Sha256}));Close-CcodInstallFileTransaction -Transaction $generation -Disposition Ready
+        $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install;$fixture.Transactions.Add($product);$retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $product;$file=Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk'
+        Assert-CcodTrue ($null-ne$file) 'selected manifest file returns an opaque retained source capability'
+        Assert-CcodThrows {Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'C:\outside\arbitrary.lnk'|Out-Null} 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID'
+        Assert-CcodThrows {New-CcodInstallDirectory -Transaction $product -Parent $product -Leaf 'state' -CreateIfMissing|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
+        $state=Open-CcodInstallStateTransaction -InstallRoot $fixture.Install;$fixture.Transactions.Add($state);Assert-CcodThrows {Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $state|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {Open-CcodInstallProductSpecialFolder -Generation $state -Kind Desktop|Out-Null} 'CCOD_INSTALL_PRODUCT_FOLDER_INVALID'
+    }finally{Remove-CcodInstallFileFixture $fixture}
 }
 
 Invoke-CcodTest 'V4 state-only transaction writes records but cannot reach generation or pointer operations' {
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index b15dce2..6c5fe10 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -46,6 +46,7 @@ function New-CcodLifecycleSourceFixture {
     [IO.File]::WriteAllText((Join-Path $Root 'src\persistence\UninstallBootstrap.ps1'), "# Uninstall bootstrap fixture`r`n", [Text.UTF8Encoding]::new($false))
     [IO.File]::WriteAllText((Join-Path $Root 'src\persistence\bootstrap.ps1'), ("# Stable bootstrap fixture" + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
     [IO.File]::WriteAllText((Join-Path $Root 'src\persistence\PortableUninstallFinalizer.ps1'), ("# Portable finalizer fixture" + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+    [IO.File]::WriteAllText((Join-Path $Root 'src\persistence\InstalledUninstallFinalizer.ps1'), ("# Installed finalizer fixture" + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
     foreach ($module in @('PersistenceIO.psm1', 'RuntimeManifest.psm1', 'CompatibilityProbe.psm1', 'ProcessControl.psm1', 'StateStore.psm1', 'TransitionJournal.psm1', 'SessionEngine.psm1', 'SupervisorEngine.psm1', 'KernelObjects.psm1', 'TrayUi.psm1', 'UiLocalization.psm1', 'UiPreferences.psm1', 'ScheduledTask.psm1', 'PortableRelease.psm1')) {
         [IO.File]::WriteAllText((Join-Path $Root "src\persistence\modules\$module"), "# $module`r`n", [Text.UTF8Encoding]::new($false))
     }
@@ -486,7 +487,7 @@ $results += Invoke-CcodTest 'same-version immutable install identity is idempote
 $results += Invoke-CcodTest 'Invoke-CcodInstall is idempotent only for the active Ready runtime and exact sealed package identity' {
     $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
     try{
-        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22-idempotent'|Out-Null
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null
         $nodePath=New-CcodLifecycleFakeNode -Root $nodeRoot
         $firstFake=New-CcodLifecycleFake -NodePath $nodePath
         $first=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('a'*64) -Adapters $firstFake.Adapters
@@ -500,6 +501,8 @@ $results += Invoke-CcodTest 'Invoke-CcodInstall is idempotent only for the activ
         Assert-CcodEqual 1 @(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory).Count 'idempotence creates no generation'
         Assert-CcodEqual 0 $sameFake.World.TaskInstalled 'idempotence performs no task mutation'
         Assert-CcodEqual 0 $sameFake.World.TaskStarted 'idempotence starts no process'
+        Assert-CcodEqual 1 $sameFake.World.ProductRegistrationCalls 'AlreadyInstalled reconciles product registration after revalidating exact Ready identity'
+        Assert-CcodTrue $same.ProductRegistrationVerified 'AlreadyInstalled reports a fresh verified registration reconciliation'
         $conflictFake=New-CcodLifecycleFake -NodePath $nodePath
         Assert-CcodThrows {Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('b'*64) -Adapters $conflictFake.Adapters|Out-Null} 'CCOD_INSTALL_PACKAGE_CONFLICT'
         $conflictPointer=Read-CcodActiveRuntime -InstallRoot $install
@@ -1714,6 +1717,22 @@ $results += Invoke-CcodTest 'a later invocation recovers one missing Ready trans
     } finally { Remove-CcodReadyFinalizationGapFixture $fixture }
 }
 
+$results += Invoke-CcodTest 'registration failure during Ready-finalization recovery is retried by a later same-package invocation' {
+    $fixture=New-CcodReadyFinalizationGapFixture
+    try{
+        Remove-Item -LiteralPath $fixture.Source -Recurse -Force
+        $failed=New-CcodLifecycleFake -NodePath $fixture.Node;$failed.World.ProductRegistrationFailure=$true
+        Assert-CcodThrows {Invoke-CcodInstall -SourceRoot $fixture.Source -InstallRoot $fixture.Install -Adapters $failed.Adapters|Out-Null} 'CCOD_PRODUCT_REGISTRATION_FAILED'
+        $module=Get-Module InstallLifecycle;$ready=&$module {param($Root,$Id)Read-CcodInstallTransactionRecord -InstallRoot $Root -TransactionId $Id} $fixture.Install $fixture.Transaction.transactionId
+        Assert-CcodEqual 'Ready' $ready.phase 'recovery registration failure leaves the recovered transaction Ready'
+        New-CcodLifecycleSourceFixture -Root $fixture.Source -Version '2.5.22'|Out-Null
+        $retry=New-CcodLifecycleFake -NodePath $fixture.Node
+        $result=Invoke-CcodInstall -SourceRoot $fixture.Source -InstallRoot $fixture.Install -SealedPackageSha256 ([string]$ready.sealedPackageSha256) -Adapters $retry.Adapters
+        Assert-CcodEqual 'AlreadyInstalled' $result.Outcome 'same-package invocation reconciles registration after recovery failure'
+        Assert-CcodEqual 1 $retry.World.ProductRegistrationCalls 'recovery registration retry occurs exactly once'
+    }finally{foreach($path in @($fixture.Source,$fixture.Install,$fixture.NodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}}
+}
+
 # Production mutation caught: finalizing ProtectionReady when any receipt, selected pointer, or recorded manifest proof no longer matches.
 $results += Invoke-CcodTest 'invalid Ready receipt pointer or manifest leaves ProtectionReady without runtime pointer or Failed writes' {
     $fixture=New-CcodReadyFinalizationGapFixture
@@ -3227,6 +3246,10 @@ $results += Invoke-CcodTest 'registration failure preserves durable Ready withou
         $module=Get-Module InstallLifecycle;$head=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install
         Assert-CcodEqual 'Ready' $head.phase 'post-Ready registration failure cannot downgrade the lifecycle transaction'
         Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Failed.*.json' -File).Count 'registration failure appends no Failed transaction snapshot'
+        $retry=New-CcodLifecycleFake -NodePath $node
+        $result=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('3'*64) -Adapters $retry.Adapters
+        Assert-CcodEqual 'AlreadyInstalled' $result.Outcome 'later same-package invocation retries after post-Ready registration failure'
+        Assert-CcodEqual 1 $retry.World.ProductRegistrationCalls 'normal Ready registration retry occurs exactly once'
     }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}}
 }
 
diff --git a/tests/persistence/ProductRegistration.SelfTest.ps1 b/tests/persistence/ProductRegistration.SelfTest.ps1
index ab08a00..27e94be 100644
--- a/tests/persistence/ProductRegistration.SelfTest.ps1
+++ b/tests/persistence/ProductRegistration.SelfTest.ps1
@@ -16,6 +16,7 @@ function New-CcodRegistrationWorld {
     param([string]$InstallRoot = 'C:\fixture\CodexControlOtherDevices')
 
     $registration = New-CcodProductRegistration -InstallRoot $InstallRoot -RuntimeId $runtimeId -Version '2.5.22' -PackageSha256 $packageSha256 -FileTransaction ([pscustomobject]@{})
+    $legacyEntries=[Collections.Generic.List[string]]::new();foreach($entry in @('Registry','StartMenu1','StartMenu2','StartMenu3','StartMenu4','StartMenu5','StartMenu6','StartMenu7','Desktop')){$legacyEntries.Add($entry)}
     $world = [pscustomobject]@{
         Registration = $registration
         Ready = [pscustomobject][ordered]@{
@@ -48,6 +49,13 @@ function New-CcodRegistrationWorld {
         }
         LegacyRemoved = $false
         LegacyRemovalCalls = 0
+        CurrentProductRemovals = 0
+        CurrentProductState = [pscustomobject]@{valid=$true;reason=$null;entries=@('Registry','StartMenu','Desktop')}
+        LegacyEntries = $legacyEntries
+        LegacyRemoveFailureAt = 0
+        LegacyRemoveAttempts = 0
+        LegacyRestores = 0
+        LegacyReplacementEntry = $null
         Calls = [Collections.Generic.List[string]]::new()
     }
     $world | Add-Member -NotePropertyName Adapters -NotePropertyValue @{
@@ -79,6 +87,12 @@ function New-CcodRegistrationWorld {
         ReadLegacyRegistration = { param($ExpectedAppId) $world.Calls.Add('ReadLegacy'); $world.Legacy }.GetNewClosure()
         ReadVerifiedRegistration = { [pscustomobject]@{verified=($null-ne$world.Product-and$world.Shortcuts.Count-eq2)} }.GetNewClosure()
         RemoveLegacyRegistration = { param($ExpectedAppId,$ExpectedShortcutNames) $world.Calls.Add('RemoveLegacy'); $world.LegacyRemovalCalls++; $world.LegacyRemoved = $true }.GetNewClosure()
+        ReadCurrentProductState = { param($ExpectedRuntimeId) $world.CurrentProductState }.GetNewClosure()
+        RemoveCurrentProductEntry = { param($Entry) $world.CurrentProductRemovals++ }.GetNewClosure()
+        ReadLegacySnapshot = { param($ExpectedAppId);if($world.Legacy.appId-cne$ExpectedAppId){return [pscustomobject]@{appId=$world.Legacy.appId;entries=@($world.LegacyEntries)}};if(@($world.Legacy.shortcutNames).Count-ne8){return [pscustomobject]@{appId=$ExpectedAppId;entries=@('Unexpected')}};[pscustomobject]@{appId=$ExpectedAppId;entries=@($world.LegacyEntries)} }.GetNewClosure()
+        RemoveLegacyEntry = { param($Entry);$world.LegacyRemoveAttempts++;if($world.LegacyRemoveFailureAt-eq$world.LegacyRemoveAttempts){throw 'fixture legacy delete failure'};[void]$world.LegacyEntries.Remove([string]$Entry) }.GetNewClosure()
+        ReadLegacyEntry = { param($Entry);if($world.LegacyReplacementEntry-ceq[string]$Entry){return 'Replacement'};if($world.LegacyEntries.Contains([string]$Entry)){[string]$Entry}else{$null} }.GetNewClosure()
+        RestoreLegacyEntry = { param($Entry);if(-not$world.LegacyEntries.Contains([string]$Entry)){$world.LegacyEntries.Add([string]$Entry)};$world.LegacyRestores++ }.GetNewClosure()
     }
     return $world
 }
@@ -158,8 +172,8 @@ $results += Invoke-CcodTest 'valid Ready registration reads all three new record
     Assert-CcodTrue $receipt.verified 'registration returns a verified three-record receipt'
     Assert-CcodEqual 'Ready,WriteProduct,WriteShortcut:StartMenu,WriteShortcut:Desktop,ReadProduct,ReadShortcut:StartMenu,ReadShortcut:Desktop' ($world.Calls -join ',') 'all new writes and read-backs precede legacy migration'
     Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters
-    Assert-CcodEqual 1 $world.LegacyRemovalCalls 'exact legacy migration runs once after verified registration'
-    Assert-CcodTrue $world.LegacyRemoved 'exact legacy registration and shortcut set is removed'
+    Assert-CcodEqual 9 $world.LegacyRemoveAttempts 'exact legacy migration removes each approved entry once'
+    Assert-CcodEqual 0 $world.LegacyEntries.Count 'exact legacy registration and shortcut set is removed'
 }
 
 # Production mutation caught: accepting an unexpected AppId/name set or an unverified registration receipt.
@@ -171,9 +185,39 @@ $results += Invoke-CcodTest 'legacy migration rejects AppId and shortcut-name mi
         if ($mismatch -ceq 'Shortcut') { $world.Legacy.shortcutNames = @('Programs\unexpected.lnk') }
         if ($mismatch -ceq 'Receipt') { $world.Product = $null }
         Assert-CcodThrows { Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters } 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
-        Assert-CcodEqual 0 $world.LegacyRemovalCalls 'legacy mismatch is rejected before any deletion'
-        Assert-CcodTrue (-not $world.LegacyRemoved) 'legacy state remains intact on mismatch'
+        Assert-CcodEqual 0 $world.LegacyRemoveAttempts 'legacy mismatch is rejected before any deletion'
+        Assert-CcodEqual 9 $world.LegacyEntries.Count 'legacy state remains intact on mismatch'
     }
 }
 
+# Production mutation caught: deleting a whole product key despite unknown values or mismatched shortcut evidence.
+$results += Invoke-CcodTest 'current product cleanup requires exact registry values and shortcut bytes targets and file identity' {
+    foreach($mutation in @('UnknownRegistryValue','ShortcutHash','ShortcutTarget','ShortcutReparse','Ambiguous')){
+        $world=New-CcodRegistrationWorld;$world.CurrentProductState.valid=$false;$world.CurrentProductState.reason=$mutation
+        Assert-CcodThrows {Remove-CcodProductRegistration -ExpectedRuntimeId $runtimeId -Adapters $world.Adapters} 'CCOD_PRODUCT_CLEANUP_INVALID'
+        Assert-CcodEqual 0 $world.CurrentProductRemovals "$mutation mismatch preserves every current product entry"
+    }
+    $world=New-CcodRegistrationWorld
+    Remove-CcodProductRegistration -ExpectedRuntimeId $runtimeId -Adapters $world.Adapters
+    Assert-CcodEqual 3 $world.CurrentProductRemovals 'matched cleanup removes only the exact registry and two shortcut entries'
+}
+
+# Production mutation caught: a mid-sequence legacy deletion failure leaves earlier exact entries missing.
+$results += Invoke-CcodTest 'legacy migration restores earlier exact deletions after a later deletion failure' {
+    $world=New-CcodRegistrationWorld
+    $receipt=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
+    $before=@($world.LegacyEntries)|Sort-Object
+    $world.LegacyRemoveFailureAt=4
+    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+    Assert-CcodEqual ($before-join'|') ((@($world.LegacyEntries)|Sort-Object)-join'|') 'failed migration restores the complete exact legacy set'
+    Assert-CcodEqual 3 $world.LegacyRestores 'only successfully removed entries are restored'
+}
+
+$results += Invoke-CcodTest 'legacy compensation never overwrites a replacement that appeared after deletion' {
+    $world=New-CcodRegistrationWorld;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;$world.LegacyRemoveFailureAt=4;$world.LegacyReplacementEntry='StartMenu1'
+    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+    Assert-CcodEqual 2 $world.LegacyRestores 'compensation restores only entries that remain absent'
+    Assert-CcodTrue (-not$world.LegacyEntries.Contains('StartMenu1')) 'replacement occupies the removed name and is not overwritten with captured bytes'
+}
+
 Write-Output "Product registration self-tests passed: $($results.Count)"
diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index b8e93fa..b1fe2df 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -3,12 +3,15 @@ $ErrorActionPreference = 'Stop'
 
 $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
 $bootstrapScript = Join-Path $repositoryRoot 'src\persistence\UninstallBootstrap.ps1'
+$installedFinalizerScript = Join-Path $repositoryRoot 'src\persistence\InstalledUninstallFinalizer.ps1'
 
 if (-not (Test-Path -LiteralPath $bootstrapScript -PathType Leaf)) {
     throw "Uninstall bootstrap script is missing: $bootstrapScript"
 }
 
 . $bootstrapScript
+if (-not (Test-Path -LiteralPath $installedFinalizerScript -PathType Leaf)) { throw "Installed uninstall finalizer is missing: $installedFinalizerScript" }
+. $installedFinalizerScript
 Import-Module (Join-Path $repositoryRoot 'src\persistence\modules\RuntimeManifest.psm1') -Force
 
 function New-CcodUninstallBootstrapContext {
@@ -167,7 +170,9 @@ function New-CcodVerifiedUninstallRuntimeFixture {
     foreach ($entry in @(
         'src/persistence/UninstallBootstrap.ps1',
         'src/persistence/PortableUninstallFinalizer.ps1',
+        'src/persistence/InstalledUninstallFinalizer.ps1',
         'src/persistence/modules/InstallLifecycle.psm1',
+        'src/persistence/modules/ProductRegistration.psm1',
         'src/persistence/modules/PortableRelease.psm1',
         'src/persistence/modules/PersistenceIO.psm1',
         'src/persistence/modules/RuntimeManifest.psm1',
@@ -217,7 +222,7 @@ $results += Invoke-CcodTest 'Prepare stages only the manifest-bound cleanup payl
     Assert-CcodEqual 'ReadyForInno' $receipt.phase 'verified cleanup reaches the Inno boundary'
     Assert-CcodEqual 'Validate,GetRoot,Read,NewId,Create,Write:Requested,Publish,Stage,Cleanup,Write:ReadyForInno,RemoveProduct,Receipt:ReadyForInno' ($world.Calls -join ',') 'Prepare removes only verified product registration after protected application cleanup'
     Assert-CcodEqual 1 $world.ProductRegistrationRemovals 'verified uninstall removes current product registration exactly once'
-    Assert-CcodEqual 'src/persistence/UninstallBootstrap.ps1,src/persistence/PortableUninstallFinalizer.ps1,src/persistence/modules/InstallLifecycle.psm1,src/persistence/modules/PortableRelease.psm1,src/persistence/modules/PersistenceIO.psm1,src/persistence/modules/RuntimeManifest.psm1,src/persistence/modules/LifecycleEpoch.psm1,src/persistence/modules/StateStore.psm1,src/persistence/modules/TrustedLogonIdentity.psm1,src/persistence/modules/ScheduledTask.psm1,src/persistence/modules/KernelObjects.psm1,src/persistence/modules/CompatibilityProbe.psm1,src/persistence/modules/UiPreferences.psm1,src/persistence/modules/LifecycleTransaction.psm1' ($world.StagedEntries -join ',') 'staging has no device-key material'
+    Assert-CcodEqual 'src/persistence/UninstallBootstrap.ps1,src/persistence/PortableUninstallFinalizer.ps1,src/persistence/InstalledUninstallFinalizer.ps1,src/persistence/modules/InstallLifecycle.psm1,src/persistence/modules/ProductRegistration.psm1,src/persistence/modules/PortableRelease.psm1,src/persistence/modules/PersistenceIO.psm1,src/persistence/modules/RuntimeManifest.psm1,src/persistence/modules/LifecycleEpoch.psm1,src/persistence/modules/StateStore.psm1,src/persistence/modules/TrustedLogonIdentity.psm1,src/persistence/modules/ScheduledTask.psm1,src/persistence/modules/KernelObjects.psm1,src/persistence/modules/CompatibilityProbe.psm1,src/persistence/modules/UiPreferences.psm1,src/persistence/modules/LifecycleTransaction.psm1' ($world.StagedEntries -join ',') 'staging has only bounded cleanup code and no device-key material'
     Assert-CcodEqual $null $receipt.errorCode 'ReadyForInno carries no failure code'
 }
 
@@ -232,7 +237,7 @@ $results += Invoke-CcodTest 'production runtime verification binds the installed
         Assert-CcodEqual $fixture.RuntimeId $context.runtimeId 'verified context binds the active manifest runtime'
         Assert-CcodEqual ([uint64]7) ([uint64]$context.runtimeGeneration) 'verified context binds active generation'
         Assert-CcodEqual ([uint64]11) ([uint64]$context.leaseEpoch) 'verified context binds lifecycle epoch'
-        Assert-CcodEqual 14 @($context.payloadRecords).Count 'only the cleanup entry, portable finalizer, and imported modules are staged'
+        Assert-CcodEqual 16 @($context.payloadRecords).Count 'only the cleanup entry, two bounded finalizers, matched registration module, and imported modules are staged'
         [IO.File]::AppendAllText((Join-Path $fixture.RuntimeRoot 'src\persistence\modules\InstallLifecycle.psm1'),'# altered',[Text.UTF8Encoding]::new($false))
         Assert-CcodThrows { Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $installRoot | Out-Null } 'CCOD_UNINSTALL_RUNTIME_INVALID'
     } finally {
@@ -335,7 +340,7 @@ $results += Invoke-CcodTest 'real external staging uses a protected current-user
         $payloadRoot = Join-Path $transactionDirectory 'payload'
         Assert-CcodUninstallBootstrapDirectoryAcl -Path $payloadRoot -UserSid $context.userSid
         $payloadFiles = @(Get-ChildItem -LiteralPath $payloadRoot -Recurse -File -Force)
-        Assert-CcodEqual 14 $payloadFiles.Count 'external payload contains the exact cleanup entry, portable finalizer, and required modules'
+        Assert-CcodEqual 16 $payloadFiles.Count 'external payload contains the exact cleanup entry, two bounded finalizers, matched registration module, and required modules'
         foreach ($record in @($context.payloadRecords)) {
             $entry = [string]$record.path
             $source = Join-Path $fixture.RuntimeRoot ($entry.Replace('/','\'))
@@ -552,5 +557,48 @@ $results += Invoke-CcodTest 'FinalizeReceipt fails closed when installer files r
     Assert-CcodEqual 'GetRoot,Read,FinalizeInvocation,RootAbsent' ($world.Calls -join ',') 'Inno residue never receives a false completion receipt'
 }
 
+# Production mutation caught: deleting the selected generation while its public wrapper is still executing from it.
+$results += Invoke-CcodTest 'installed Prepare stops at TaskRemoved and external finalizer completes only after wrapper exit' {
+    $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=$null;Receipt=$null;ValidationError=$false;StageError=$false;CleanupError=$false;CleanupFailurePhase=$null;InstallRootAbsent=$false;StagedEntries=@();ProductRegistrationRemovals=0}
+    $adapters=New-CcodUninstallBootstrapAdapters $world
+    $originalCleanup=$adapters.RunCleanup
+    $adapters.RunCleanup={param($InstallerRoot,$InstallRoot,$TransactionRoot,$Transaction,$WriteTransaction,$Mode);$world.Calls.Add("Cleanup:$Mode");$Transaction.phase='TaskRemoved';$Transaction.resumePhase='TaskRemoved';&$WriteTransaction $TransactionRoot $Transaction;$Transaction}.GetNewClosure()
+    $prepared=Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\runtime' -InstallRoot 'C:\install' -Mode PrepareInstalled -Adapters $adapters
+    Assert-CcodEqual 'TaskRemoved' $prepared.phase 'installed wrapper retains application state until it exits'
+    Assert-CcodEqual 0 $world.ProductRegistrationRemovals 'installed Prepare removes no product state before the external finalizer'
+
+    $final=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();WrapperExited=$true;ContextValid=$true;Transaction=$prepared;RootAbsent=$false;Finalized=$false;Deletes=0}
+    $finalAdapters=@{
+        WaitWrapperExit={param($Identity,$Timeout)$final.Calls.Add('WaitWrapper');$final.WrapperExited}.GetNewClosure()
+        ReadPreparedTransaction={param($Id)$final.Calls.Add('ReadTransaction');$final.Transaction}.GetNewClosure()
+        ValidateSelectedGeneration={param($RuntimeRoot,$InstallRoot,$Transaction)$final.Calls.Add('ValidateGeneration');$final.ContextValid}.GetNewClosure()
+        RemoveMatchedApplicationState={param($RuntimeRoot,$InstallRoot,$Transaction)$final.Calls.Add('RemoveMatched');$final.Deletes++;$final.RootAbsent=$true;$Transaction.phase='ReadyForInno';$Transaction.resumePhase='ReadyForInno';$Transaction}.GetNewClosure()
+        TestInstallRootAbsent={param($Root)$final.Calls.Add('RootAbsent');$final.RootAbsent}.GetNewClosure()
+        RemoveMatchedProductRegistration={param($Transaction)$final.Calls.Add('RemoveProduct')}.GetNewClosure()
+        FinalizeReceipt={param($Transaction)$final.Calls.Add('Finalize');$final.Finalized=$true;[pscustomobject]@{phase='Completed'}}.GetNewClosure()
+    }
+    $receipt=Invoke-CcodInstalledUninstallFinalizer -TransactionId $prepared.transactionId -RuntimeRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -WrapperIdentity ([pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z'}) -Adapters $finalAdapters
+    Assert-CcodEqual 'Completed' $receipt.phase 'external finalizer reaches the completion receipt'
+    Assert-CcodEqual 'WaitWrapper,ReadTransaction,ValidateGeneration,RemoveMatched,RootAbsent,RemoveProduct,Finalize' ($final.Calls -join ',') 'wrapper exit and selected generation proof precede matched removal and finalization'
+}
+
+# Production mutation caught: treating any durable transaction/path/process as authority to delete application state.
+$results += Invoke-CcodTest 'installed finalizer wrong wrapper generation path or transaction performs no deletion' {
+    foreach($kind in @('Wrapper','Generation','Transaction')){
+        $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Deletes=0}
+        $transaction=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved'
+        if($kind-ceq'Transaction'){$transaction.transactionId='aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee'}
+        $adapters=@{
+            WaitWrapperExit={param($Identity,$Timeout)$kind-cne'Wrapper'}.GetNewClosure()
+            ReadPreparedTransaction={param($Id)$transaction}.GetNewClosure()
+            ValidateSelectedGeneration={param($RuntimeRoot,$InstallRoot,$Transaction)$kind-cne'Generation'}.GetNewClosure()
+            RemoveMatchedApplicationState={param($RuntimeRoot,$InstallRoot,$Transaction)$world.Deletes++;$Transaction}.GetNewClosure()
+            TestInstallRootAbsent={param($Root)$false};RemoveMatchedProductRegistration={param($Transaction)};FinalizeReceipt={param($Transaction)[pscustomobject]@{phase='Completed'}}
+        }
+        Assert-CcodThrows {Invoke-CcodInstalledUninstallFinalizer -TransactionId '11111111-2222-3333-4444-555555555555' -RuntimeRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -WrapperIdentity ([pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z'}) -Adapters $adapters|Out-Null} 'CCOD_INSTALLED_FINALIZER_INVALID'
+        Assert-CcodEqual 0 $world.Deletes "$kind mismatch deletes no application state"
+    }
+}
+
 $results | ForEach-Object { "PASS $($_.Name)" }
 Write-Output "Uninstall bootstrap self-tests passed: $($results.Count)"

From 0fdc39236d9a9ac77d81dbf3c7c3712cfa0ab0be Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 20:23:32 +0800
Subject: [PATCH 098/187] docs: record matched product lifecycle evidence

---
 .../task-4-report.md                          | 80 +++++++++++++++++++
 1 file changed, 80 insertions(+)

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
index 102248b..878d731 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
@@ -95,3 +95,83 @@ performed.
 
 - `e43d9ce18c5d79bb438e08c9ff2973be592277aa`
   (`feat: register product only after readiness`).
+
+## Fix round 1: matched uninstall and retriable registration
+
+Scoped review of `70bc231..97cf17d` found one Critical and four Important
+issues. The installed wrapper could synchronously continue after deleting its
+own generation; product cleanup could remove an entire key without exact
+value/shortcut evidence; `AlreadyInstalled` skipped registration retry;
+legacy removal was not compensating; and shortcut copy accepted a state-only
+transaction plus arbitrary absolute source path.
+
+### RED evidence
+
+- UninstallBootstrap first exited `1` because
+  `src\persistence\InstalledUninstallFinalizer.ps1` did not exist.
+- ProductRegistration exited `1` with `CCOD_PRODUCT_ADAPTER_INVALID`, target
+  `ReadLegacyEntry`, before exact current-state and per-entry legacy
+  compensation adapters existed.
+- InstallLifecycle exited `1` in the exact Ready/package idempotence case:
+  registration calls expected `1`, actual `0`.
+- InstallFileTransaction exited `1` because the export surface lacked
+  `Open-CcodInstallProductRegistrationTransaction` and
+  `Open-CcodInstallRetainedFile`; product shortcut copy still exposed
+  `SourcePath`.
+
+### GREEN and verification evidence
+
+- ProductRegistration exited `0` with
+  `Product registration self-tests passed: 9`. Coverage includes exact
+  registry/shortcut evidence, unknown/replaced/reparse/ambiguous no-delete,
+  mid-sequence legacy restoration, and replacement-preserving compensation.
+- InstallFileTransaction exited `0`; all 27 named cases passed. The new case
+  proves product-only retained-file authority, no arbitrary shortcut source
+  path, state-only denial, and product-scope denial for state writes.
+- UninstallBootstrap exited `0` with
+  `Uninstall bootstrap self-tests passed: 19`. The installed path now stops at
+  `TaskRemoved`; its staged finalizer waits for exact wrapper exit, validates
+  transaction and selected generation, performs matched removal, proves root
+  absence, removes only matched product state, and then finalizes. Wrong
+  wrapper/generation/transaction cases delete nothing.
+- InstallLifecycle exited `0` with
+  `Install lifecycle self-tests passed: 116`. Both normal and missing-Ready
+  recovery registration failures remain outside rollback/Failed and are
+  reconciled by a later exact same-package `AlreadyInstalled` invocation.
+- Explicit parser checks passed all 11 changed PowerShell source/test files
+  (`PARSER_COUNT=11`, `FAILURES=0`).
+- `git diff --check` exited `0`; only checkout LF-to-CRLF warnings were
+  emitted.
+- The aggregate `tests\PersistenceSelfTest.ps1` was not run in this fix round;
+  no aggregate-pass claim is made.
+
+### Remediated boundaries
+
+- The selected-generation wrapper launches a hidden external finalizer from
+  the ACL-bound staged payload and returns. Application removal cannot begin
+  until the exact wrapper PID/creation-time identity has exited.
+- Current product cleanup accepts only the exact allowed registry value names,
+  kinds and values plus both shortcut hashes, targets, arguments, and regular
+  file identities. Registry values are revalidated and removed individually;
+  a key is deleted only after it is empty and has no subkeys.
+- Legacy migration captures exact registry kinds/values and shortcut bytes,
+  deletes entries one by one, and restores prior removals in reverse order
+  only while their names remain absent. A replacement is never overwritten.
+- Product shortcut promotion now accepts only an opaque file capability opened
+  from one selected generation at either fixed manifest-relative candidate.
+  Product-only transactions cannot write state, generations, manifests,
+  pointers, or retirements; state-only transactions cannot acquire shortcut
+  authority.
+
+### Compatibility and external boundaries
+
+- Conservative mismatch behavior may leave current or legacy registration for
+  diagnosis instead of partially deleting it.
+- No real registry, shortcut, installer, uninstaller, product process,
+  WindowsApps, DPAPI, network, release, push, tag, signing, or publication
+  action was performed.
+
+### Fix implementation commit
+
+- `2e76698d535e6e824df1c57d81314be1c2e053e8`
+  (`fix: complete matched product lifecycle`).

From 283ecbe3eb012f1e78377e9336aacc7b3acc9336 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 21:49:25 +0800
Subject: [PATCH 099/187] fix: bind matched product finalization

---
 Uninstall-CodexControlOtherDevices.ps1        |  4 +--
 .../InstalledUninstallFinalizer.ps1           | 25 ++++++-------
 src/persistence/UninstallBootstrap.ps1        | 34 ++++++++++++++----
 .../modules/InstallFileTransaction.psm1       |  4 +--
 src/persistence/modules/InstallLifecycle.psm1 |  4 +--
 .../modules/ProductRegistration.psm1          | 35 +++++++++++--------
 .../InstallFileTransaction.SelfTest.ps1       |  8 +++--
 .../ProductRegistration.SelfTest.ps1          | 35 +++++++++++++++----
 .../UninstallBootstrap.SelfTest.ps1           | 31 ++++++++++------
 9 files changed, 120 insertions(+), 60 deletions(-)

diff --git a/Uninstall-CodexControlOtherDevices.ps1 b/Uninstall-CodexControlOtherDevices.ps1
index 7ce0c5a..c536c69 100644
--- a/Uninstall-CodexControlOtherDevices.ps1
+++ b/Uninstall-CodexControlOtherDevices.ps1
@@ -38,7 +38,8 @@ if ($null -ne $installedRuntimeId -and $installedRuntimeId -cmatch '^2\.5\.22-[0
     $bootstrapItem = Get-Item -LiteralPath $bootstrapPath -Force -ErrorAction Stop
     if ($bootstrapItem.PSIsContainer -or (($bootstrapItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) { Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_INVALID' 'The sealed generation uninstall bootstrap is unsafe.' $bootstrapPath }
     if (-not $PSCmdlet.ShouldProcess($expectedInstallRoot,'Run manifest-bound cleanup from the selected sealed generation')) { return [pscustomobject][ordered]@{Outcome='WhatIf';KeptDeviceKeyStore=$true} }
-    try { $prepared=& $bootstrapPath -InstallerRoot $installerRoot -InstallRoot $expectedInstallRoot -Mode PrepareInstalled }
+    $current=[Diagnostics.Process]::GetCurrentProcess();$windowsIdentity=[Security.Principal.WindowsIdentity]::GetCurrent();try{$wrapperId=[int]$current.Id;$wrapperCreated=$current.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture);$wrapperIdentity=[pscustomobject]@{pid=$wrapperId;creationTimeUtc=$wrapperCreated;sessionId=[int]$current.SessionId;userSid=[string]$windowsIdentity.User.Value}}finally{$current.Dispose();$windowsIdentity.Dispose()}
+    try { $prepared=& $bootstrapPath -InstallerRoot $installerRoot -InstallRoot $expectedInstallRoot -Mode PrepareInstalled -WrapperIdentity $wrapperIdentity }
     catch { Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_PREPARE_FAILED' 'Sealed generation cleanup did not reach its external finalization boundary.' $_ }
     if($null-eq$prepared-or$prepared.transactionId-isnot[string]-or$prepared.transactionId-cnotmatch'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'-or$prepared.phase-cne'TaskRemoved'-or$prepared.runtimeId-cne$installedRuntimeId){Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_PREPARE_FAILED' 'Sealed generation cleanup returned an invalid receipt.' $prepared}
     $transactionRoot=[IO.Path]::GetFullPath((Join-Path $localAppData 'CodexRemote-fix-uninstall'))
@@ -47,7 +48,6 @@ if ($null -ne $installedRuntimeId -and $installedRuntimeId -cmatch '^2\.5\.22-[0
     if(-not[IO.File]::Exists($finalizer)){Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_FINALIZER_MISSING' 'The verified external installed finalizer is missing.' $finalizer}
     $powershellPath=Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'WindowsPowerShell\v1.0\powershell.exe'
     if(-not[IO.File]::Exists($powershellPath)){Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_FINALIZER_MISSING' 'The Windows PowerShell host is unavailable.' $powershellPath}
-    $current=[Diagnostics.Process]::GetCurrentProcess();try{$wrapperId=[int]$current.Id;$wrapperCreated=$current.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)}finally{$current.Dispose()}
     function ConvertTo-CcodInstalledUninstallLiteral([string]$Value){"'"+$Value.Replace("'","''")+"'"}
     $arguments='-NoProfile -NonInteractive -ExecutionPolicy Bypass -File {0} -TransactionId {1} -RuntimeRoot {2} -InstallRoot {3} -WrapperProcessId {4} -WrapperCreationTimeUtc {5}'-f(ConvertTo-CcodInstalledUninstallLiteral $finalizer),(ConvertTo-CcodInstalledUninstallLiteral $prepared.transactionId),(ConvertTo-CcodInstalledUninstallLiteral $installerRoot),(ConvertTo-CcodInstalledUninstallLiteral $expectedInstallRoot),$wrapperId,(ConvertTo-CcodInstalledUninstallLiteral $wrapperCreated)
     try{$process=Start-Process -FilePath $powershellPath -ArgumentList $arguments -WindowStyle Hidden -RedirectStandardOutput (Join-Path $transactionDirectory 'installed-finalizer.stdout.log') -RedirectStandardError (Join-Path $transactionDirectory 'installed-finalizer.stderr.log') -PassThru -ErrorAction Stop}catch{Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_FINALIZER_START_FAILED' 'The external installed finalizer could not be started; application state was retained.' $_}
diff --git a/src/persistence/InstalledUninstallFinalizer.ps1 b/src/persistence/InstalledUninstallFinalizer.ps1
index 888ed3e..edf7b19 100644
--- a/src/persistence/InstalledUninstallFinalizer.ps1
+++ b/src/persistence/InstalledUninstallFinalizer.ps1
@@ -14,18 +14,19 @@ function Throw-CcodInstalledFinalizerError {
     param([string]$Id,[string]$Message,$Target)
     throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new($Message),$Id,[Management.Automation.ErrorCategory]::InvalidData,$Target)
 }
-function Test-CcodInstalledFinalizerIdentity($Value){$Value.pid-is[int]-and$Value.pid-gt0-and$Value.creationTimeUtc-is[string]-and$Value.creationTimeUtc-cmatch'^\d{4}-\d{2}-\d{2}T'}
+function Test-CcodInstalledFinalizerIdentity($Value){$Value.pid-is[int]-and$Value.pid-gt0-and$Value.creationTimeUtc-is[string]-and$Value.creationTimeUtc-cmatch'^\d{4}-\d{2}-\d{2}T'-and$Value.sessionId-is[int]-and$Value.sessionId-ge0-and$Value.userSid-is[string]-and$Value.userSid-cmatch'^S-1-'}
 function Get-CcodInstalledFinalizerAdapters {
     param([hashtable]$Adapters,[string]$TransactionRoot,[string]$PayloadRoot)
     $bootstrap=Join-Path $PayloadRoot 'src\persistence\UninstallBootstrap.ps1'
     $lifecycle=Join-Path $PayloadRoot 'src\persistence\modules\InstallLifecycle.psm1'
     $defaults=@{
-        WaitWrapperExit={param($Identity,$Timeout);$stopwatch=[Diagnostics.Stopwatch]::StartNew();while($stopwatch.ElapsedMilliseconds-lt$Timeout){$process=Get-Process -Id $Identity.pid -ErrorAction SilentlyContinue;if($null-eq$process){return $true};try{if($process.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)-cne$Identity.creationTimeUtc){return $true}}finally{$process.Dispose()};Start-Sleep -Milliseconds 100};$false}
+        WaitWrapperExit={param($Identity,$Timeout);$process=Get-Process -Id $Identity.pid -ErrorAction SilentlyContinue;if($null-eq$process){return [pscustomobject]@{verifiedAtStart=$false;exited=$false}};try{if($process.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)-cne$Identity.creationTimeUtc-or[int]$process.SessionId-ne[int]$Identity.sessionId){return [pscustomobject]@{verifiedAtStart=$false;exited=$false}}}finally{$process.Dispose()};$owner=$null;try{$owner=(Get-CimInstance Win32_Process -Filter ('ProcessId='+$Identity.pid)-ErrorAction Stop|Invoke-CimMethod -MethodName GetOwnerSid -ErrorAction Stop)}catch{};if($null-eq$owner-or[int]$owner.ReturnValue-ne0-or[string]$owner.Sid-cne[string]$Identity.userSid){return [pscustomobject]@{verifiedAtStart=$false;exited=$false}};$stopwatch=[Diagnostics.Stopwatch]::StartNew();while($stopwatch.ElapsedMilliseconds-lt$Timeout){$current=Get-Process -Id $Identity.pid -ErrorAction SilentlyContinue;if($null-eq$current){return [pscustomobject]@{verifiedAtStart=$true;exited=$true}};try{if($current.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)-cne$Identity.creationTimeUtc){return [pscustomobject]@{verifiedAtStart=$true;exited=$true}}}finally{$current.Dispose()};Start-Sleep -Milliseconds 100};[pscustomobject]@{verifiedAtStart=$true;exited=$false}}
         ReadPreparedTransaction={param($Id);. $bootstrap;$identity=Get-CcodUninstallBootstrapCurrentIdentity;$value=Read-CcodUninstallBootstrapStoredTransaction -TransactionRoot $TransactionRoot -ExpectedUserSid $identity.userSid -IncludeCompleted;if($null-eq$value-or$value.transactionId-cne$Id){return $null};$value}.GetNewClosure()
-        ValidateSelectedGeneration={param($SelectedRuntime,$Root,$Transaction);. $bootstrap;$context=Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $SelectedRuntime -InstallRoot $Root -InvocationPath (Join-Path $SelectedRuntime 'src\persistence\UninstallBootstrap.ps1');$context.runtimeId-ceq$Transaction.runtimeId-and[uint64]$context.runtimeGeneration-eq[uint64]$Transaction.runtimeGeneration}.GetNewClosure()
-        RemoveMatchedApplicationState={param($SelectedRuntime,$Root,$Transaction);. $bootstrap;$module=Import-Module $lifecycle -Force -PassThru -ErrorAction Stop;$directory=Join-Path $TransactionRoot $Transaction.transactionId;$writer={param($Value)Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory $directory -Transaction $Value}.GetNewClosure();&$module {param($Install,$Value,$Write)Invoke-CcodUninstallCleanup -InstallRoot $Install -Transaction $Value -WriteTransaction $Write -StopAfterTaskRemoval:$false} $Root $Transaction $writer}.GetNewClosure()
-        TestInstallRootAbsent={param($Root)-not([IO.Directory]::Exists($Root)-or[IO.File]::Exists($Root))}
-        RemoveMatchedProductRegistration={param($Transaction);. $bootstrap;Remove-CcodUninstallBootstrapProductRegistration -Context ([pscustomobject][ordered]@{runtimeId=$Transaction.runtimeId;runtimeGeneration=[uint64]$Transaction.runtimeGeneration;leaseEpoch=[uint64]$Transaction.leaseEpoch;userSid=$Transaction.userSid;sessionId=[int]$Transaction.sessionId;payloadRecords=New-CcodUninstallBootstrapPayloadRecords -ResumeOnly})}
+        ValidateSelectedGeneration={param($SelectedRuntime,$Root,$Transaction);. $bootstrap;$context=Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $SelectedRuntime -InstallRoot $Root -InvocationPath (Join-Path $SelectedRuntime 'src\persistence\UninstallBootstrap.ps1');$manifest=Get-CcodUninstallBootstrapFileFingerprint -Path (Join-Path $SelectedRuntime 'manifest.json');$context.runtimeId-ceq$Transaction.runtimeId-and[uint64]$context.runtimeGeneration-eq[uint64]$Transaction.runtimeGeneration-and$manifest.sha256-ceq$Transaction.installedBinding.runtimeManifestSha256}.GetNewClosure()
+        ReadCurrentEpoch={param($Root);. $bootstrap;$record=Read-CcodUninstallBootstrapJson -Path (Join-Path $Root 'state\lifecycle-epoch.json') -Kind 'Lifecycle epoch';[uint64]$record.epoch}.GetNewClosure()
+        RemoveSelectedGeneration={param($SelectedRuntime,$Transaction);. $bootstrap;$expected=[IO.Path]::GetFullPath([string]$Transaction.installedBinding.selectedRuntimeRoot);if([IO.Path]::GetFullPath($SelectedRuntime)-cne$expected){throw 'selected root changed'};$item=Get-Item -LiteralPath $expected -Force -ErrorAction Stop;if(-not$item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){throw 'selected root unsafe'};Remove-Item -LiteralPath $expected -Recurse -Force -ErrorAction Stop;$Transaction.phase='ReadyForInno';$Transaction.resumePhase='ReadyForInno';Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory (Join-Path $TransactionRoot $Transaction.transactionId) -Transaction $Transaction;$Transaction}.GetNewClosure()
+        TestSelectedRootAbsent={param($Root)-not([IO.Directory]::Exists($Root)-or[IO.File]::Exists($Root))}
+        RemoveMatchedProductRegistration={param($Transaction);. $bootstrap;Remove-CcodUninstallBootstrapProductRegistration -Context ([pscustomobject][ordered]@{runtimeId=$Transaction.runtimeId;runtimeGeneration=[uint64]$Transaction.runtimeGeneration;leaseEpoch=[uint64]$Transaction.leaseEpoch;userSid=$Transaction.userSid;sessionId=[int]$Transaction.sessionId;readyEvidence=$Transaction.readyEvidence;payloadRecords=New-CcodUninstallBootstrapPayloadRecords -ResumeOnly})}
         FinalizeReceipt={param($Transaction);& $bootstrap -InstallerRoot $RuntimeRoot -InstallRoot $InstallRoot -Mode FinalizeReceipt;Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Finalization bootstrap returned unexpectedly' $Transaction.transactionId}.GetNewClosure()
     }
     if($null-eq$Adapters){return $defaults};$resolved=@{};foreach($name in $defaults.Keys){$resolved[$name]=$defaults[$name]};foreach($name in $Adapters.Keys){if(-not$resolved.ContainsKey($name)-or$Adapters[$name]-isnot[scriptblock]){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Finalizer adapter contract is invalid' $name};$resolved[$name]=$Adapters[$name]};$resolved
@@ -35,12 +36,12 @@ function Invoke-CcodInstalledUninstallFinalizer {
     if($TransactionId-cnotmatch'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'-or-not[IO.Path]::IsPathRooted($RuntimeRoot)-or-not[IO.Path]::IsPathRooted($InstallRoot)-or-not(Test-CcodInstalledFinalizerIdentity $WrapperIdentity)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer inputs are invalid' $TransactionId}
     $runtime=[IO.Path]::GetFullPath($RuntimeRoot);$install=[IO.Path]::GetFullPath($InstallRoot);$expected=[IO.Path]::GetFullPath((Join-Path (Join-Path $install 'runtime') ([IO.Path]::GetFileName($runtime))));if($runtime-cne$expected){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Runtime root is outside the fixed install runtime parent' $runtime}
     $local=[Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData);$transactionRoot=[IO.Path]::GetFullPath((Join-Path $local 'CodexRemote-fix-uninstall'));$payloadRoot=[IO.Path]::GetFullPath((Join-Path (Join-Path $transactionRoot $TransactionId) 'payload'));if($null-eq$Adapters){$expectedSelf=[IO.Path]::GetFullPath((Join-Path $payloadRoot 'src\persistence\InstalledUninstallFinalizer.ps1'));if([string]::IsNullOrWhiteSpace($PSCommandPath)-or[IO.Path]::GetFullPath($PSCommandPath)-cne$expectedSelf){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer is outside the durable staged payload' $PSCommandPath};$self=Get-Item -LiteralPath $expectedSelf -Force -ErrorAction Stop;if($self.PSIsContainer-or($self.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer path is unsafe' $expectedSelf}};$adapter=Get-CcodInstalledFinalizerAdapters -Adapters $Adapters -TransactionRoot $transactionRoot -PayloadRoot $payloadRoot
-    if(-not(& $adapter.WaitWrapperExit $WrapperIdentity 15000)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed wrapper did not exit with the expected identity' $WrapperIdentity}
+    $wrapperExit=&$adapter.WaitWrapperExit $WrapperIdentity 15000;if($null-eq$wrapperExit-or$wrapperExit.verifiedAtStart-isnot[bool]-or-not$wrapperExit.verifiedAtStart-or$wrapperExit.exited-isnot[bool]-or-not$wrapperExit.exited){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed wrapper was not verified before its exact exit' $WrapperIdentity}
     $transaction=&$adapter.ReadPreparedTransaction $TransactionId
-    if($null-eq$transaction-or$transaction.transactionId-cne$TransactionId-or$transaction.phase-cne'TaskRemoved'-or$transaction.resumePhase-cne'TaskRemoved'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Durable installed uninstall transaction is not at TaskRemoved' $transaction}
-    if(-not(&$adapter.ValidateSelectedGeneration $runtime $install $transaction)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Selected generation proof does not match the transaction' $runtime}
-    $ready=&$adapter.RemoveMatchedApplicationState $runtime $install $transaction
-    if($null-eq$ready-or$ready.phase-cne'ReadyForInno'-or-not(&$adapter.TestInstallRootAbsent $install)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Matched application state removal was not proven' $install}
+    $binding=if($null-ne$transaction){$transaction.installedBinding}else{$null};if($null-eq$transaction-or$transaction.transactionId-cne$TransactionId-or$transaction.phase-cne'TaskRemoved'-or$transaction.resumePhase-cne'TaskRemoved'-or$transaction.runtimeId-isnot[string]-or[IO.Path]::GetFileName($runtime)-cne[string]$transaction.runtimeId-or$null-eq$binding-or[IO.Path]::GetFullPath([string]$binding.selectedRuntimeRoot)-cne$runtime-or$binding.runtimeManifestSha256-isnot[string]-or$binding.runtimeManifestSha256-cnotmatch'^[0-9a-f]{64}$'-or[int]$binding.wrapperPid-ne$WrapperIdentity.pid-or[string]$binding.wrapperCreationTimeUtc-cne$WrapperIdentity.creationTimeUtc-or[int]$binding.wrapperSessionId-ne$WrapperIdentity.sessionId-or[string]$binding.wrapperUserSid-cne$WrapperIdentity.userSid){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Durable installed uninstall transaction identity is invalid' $transaction}
+    if([uint64](&$adapter.ReadCurrentEpoch $install)-ne[uint64]$transaction.leaseEpoch-or-not(&$adapter.ValidateSelectedGeneration $runtime $install $transaction)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Selected generation manifest or epoch does not match the transaction' $runtime}
+    $ready=&$adapter.RemoveSelectedGeneration $runtime $transaction
+    if($null-eq$ready-or$ready.phase-cne'ReadyForInno'-or-not(&$adapter.TestSelectedRootAbsent $runtime)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Selected generation removal was not proven' $runtime}
     &$adapter.RemoveMatchedProductRegistration $ready
     $receipt=&$adapter.FinalizeReceipt $ready
     if($null-eq$receipt-or$receipt.phase-cne'Completed'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Completion receipt was not proven' $TransactionId}
@@ -48,6 +49,6 @@ function Invoke-CcodInstalledUninstallFinalizer {
 }
 
 if($MyInvocation.InvocationName-ne'.'){
-    $identity=[pscustomobject]@{pid=[int]$WrapperProcessId;creationTimeUtc=$WrapperCreationTimeUtc}
+    $currentIdentity=[Security.Principal.WindowsIdentity]::GetCurrent();$process=[Diagnostics.Process]::GetCurrentProcess();try{$identity=[pscustomobject]@{pid=[int]$WrapperProcessId;creationTimeUtc=$WrapperCreationTimeUtc;sessionId=[int]$process.SessionId;userSid=[string]$currentIdentity.User.Value}}finally{$process.Dispose();$currentIdentity.Dispose()}
     try{Invoke-CcodInstalledUninstallFinalizer -TransactionId $TransactionId -RuntimeRoot $RuntimeRoot -InstallRoot $InstallRoot -WrapperIdentity $identity|Out-Null;exit 0}catch{Write-Error ([string]$_.FullyQualifiedErrorId);exit 3}
 }
diff --git a/src/persistence/UninstallBootstrap.ps1 b/src/persistence/UninstallBootstrap.ps1
index 478d5e7..1e545f6 100644
--- a/src/persistence/UninstallBootstrap.ps1
+++ b/src/persistence/UninstallBootstrap.ps1
@@ -2,7 +2,8 @@
 param(
     [string]$InstallerRoot,
     [string]$InstallRoot,
-    [ValidateSet('Prepare','PrepareInstalled','FinalizeReceipt')][string]$Mode
+    [ValidateSet('Prepare','PrepareInstalled','FinalizeReceipt')][string]$Mode,
+    $WrapperIdentity
 )
 
 Set-StrictMode -Version Latest
@@ -10,13 +11,13 @@ $ErrorActionPreference = 'Stop'
 
 $script:CcodUninstallTransactionFields = @(
     'schemaVersion','transactionId','runtimeId','runtimeGeneration','leaseEpoch','userSid','sessionId',
-    'phase','resumePhase','startedAtUtc','updatedAtUtc','errorCode'
+    'readyEvidence','installedBinding','phase','resumePhase','startedAtUtc','updatedAtUtc','errorCode'
 )
 $script:CcodUninstallPhases = @(
     'Requested','Recovering','RecoveryProven','StoppingProtection','ProtectionStopped','TaskRemoved',
     'ApplicationStateRemoved','ReadyForInno','Completed','Failed'
 )
-$script:CcodUninstallContextFields = @('runtimeId','runtimeGeneration','leaseEpoch','userSid','sessionId','payloadRecords')
+$script:CcodUninstallContextFields = @('runtimeId','runtimeGeneration','leaseEpoch','userSid','sessionId','readyEvidence','payloadRecords')
 $script:CcodUninstallPayloadEntries = @(
     'src/persistence/UninstallBootstrap.ps1',
     'src/persistence/PortableUninstallFinalizer.ps1',
@@ -348,6 +349,7 @@ function New-CcodUninstallBootstrapResumeContext {
         leaseEpoch = [uint64]$Transaction.leaseEpoch
         userSid = [string]$Transaction.userSid
         sessionId = [int]$Transaction.sessionId
+        readyEvidence = $Transaction.readyEvidence
         # Resume never re-stages payload after the application-state boundary.
         # Zero records therefore fail closed if a later change tries to stage them.
         payloadRecords = New-CcodUninstallBootstrapPayloadRecords -ResumeOnly
@@ -431,12 +433,15 @@ function Get-CcodUninstallBootstrapVerifiedRuntimeContext {
             Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The lifecycle epoch is invalid' $epochPath
         }
         $epoch = ConvertTo-CcodUninstallBootstrapUInt64 $epochState.epoch 'lifecycle epoch'
+        $manifestFingerprint=Get-CcodUninstallBootstrapFileFingerprint -Path $manifestPath;$readyTransaction=$null;if([string]$manifest.projectVersion-ceq'2.5.22'){$lifecycleModule=Import-Module (Join-Path $runtimeRoot 'src\persistence\modules\InstallLifecycle.psm1') -Force -PassThru -ErrorAction Stop;$readyTransaction=&$lifecycleModule {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install;if($null-eq$readyTransaction-or$readyTransaction.phase-cne'Ready'-or$readyTransaction.newRuntimeId-cne$active.activeRuntime-or[uint64]$readyTransaction.newGeneration-ne[uint64]$generation-or$readyTransaction.newManifestSha256-cne$manifestFingerprint.sha256){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'Exact Ready install transaction is missing' $runtimeRoot}}
+        $system=[Environment]::GetFolderPath([Environment+SpecialFolder]::System);$readyEvidence=[pscustomobject][ordered]@{phase='Ready';installRoot=$install;runtimeId=[string]$active.activeRuntime;runtimeGeneration=[uint64]$generation;packageSha256=$(if($null-ne$readyTransaction){[string]$readyTransaction.sealedPackageSha256}else{'0'*64});manifestSha256=[string]$manifestFingerprint.sha256;startMenuSha256=$(if($recordMap.ContainsKey('registration/StartMenu.CodexRemote-fix.lnk')){[string]$recordMap['registration/StartMenu.CodexRemote-fix.lnk'].sha256}else{'0'*64});desktopSha256=$(if($recordMap.ContainsKey('registration/Desktop.CodexRemote-fix.lnk')){[string]$recordMap['registration/Desktop.CodexRemote-fix.lnk'].sha256}else{'0'*64});targetPath=[IO.Path]::GetFullPath((Join-Path $system 'schtasks.exe'));arguments='/Run /TN "Codex Control Other Devices Supervisor"'}
         return [pscustomobject][ordered]@{
             runtimeId = [string]$active.activeRuntime
             runtimeGeneration = [uint64]$generation
             leaseEpoch = [uint64]$epoch
             userSid = [string]$identity.userSid
             sessionId = [int]$identity.sessionId
+            readyEvidence = $readyEvidence
             payloadRecords = New-CcodUninstallBootstrapPayloadRecords -RecordMap $recordMap
         }
     } catch {
@@ -792,11 +797,13 @@ function Assert-CcodUninstallBootstrapContext {
         $Context.runtimeId -isnot [string] -or $Context.runtimeId -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$' -or
         $Context.userSid -isnot [string] -or $Context.userSid -cnotmatch '^S-\d-\d+(?:-\d+)+$' -or
         $Context.sessionId -isnot [int] -or $Context.sessionId -lt 0 -or
+        $null -eq $Context.readyEvidence -or
         $null -eq $Context.payloadRecords) {
         Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'The uninstall bootstrap context is invalid' $Context
     }
     [void](ConvertTo-CcodUninstallBootstrapUInt64 $Context.runtimeGeneration 'runtimeGeneration')
     [void](ConvertTo-CcodUninstallBootstrapUInt64 $Context.leaseEpoch 'leaseEpoch')
+    $ready=$Context.readyEvidence;if(-not(Test-CcodUninstallBootstrapExactProperties $ready @('phase','installRoot','runtimeId','runtimeGeneration','packageSha256','manifestSha256','startMenuSha256','desktopSha256','targetPath','arguments'))-or$ready.phase-cne'Ready'-or$ready.installRoot-isnot[string]-or$ready.runtimeId-cne$Context.runtimeId-or[uint64]$ready.runtimeGeneration-ne[uint64]$Context.runtimeGeneration-or$ready.packageSha256-cnotmatch'^[0-9a-f]{64}$'-or$ready.manifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$ready.startMenuSha256-cnotmatch'^[0-9a-f]{64}$'-or$ready.desktopSha256-cnotmatch'^[0-9a-f]{64}$'-or$ready.targetPath-isnot[string]-or$ready.arguments-cne'/Run /TN "Codex Control Other Devices Supervisor"'){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'Ready cleanup evidence is invalid' $ready}
     $records = @($Context.payloadRecords)
     if ($records.Count -ne $script:CcodUninstallPayloadEntries.Count) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'The cleanup payload record set is incomplete' $Context }
     for ($index = 0; $index -lt $records.Count; $index++) {
@@ -828,6 +835,8 @@ function Assert-CcodUninstallBootstrapTransaction {
     }
     [void](ConvertTo-CcodUninstallBootstrapUInt64 $Transaction.runtimeGeneration 'runtimeGeneration')
     [void](ConvertTo-CcodUninstallBootstrapUInt64 $Transaction.leaseEpoch 'leaseEpoch')
+    if($null-eq$Transaction.readyEvidence-or$Transaction.readyEvidence.runtimeId-cne$Transaction.runtimeId-or[uint64]$Transaction.readyEvidence.runtimeGeneration-ne[uint64]$Transaction.runtimeGeneration){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_INVALID' 'Ready transaction evidence is missing or mismatched' $Transaction.readyEvidence}
+    if($null-ne$Transaction.installedBinding){$binding=$Transaction.installedBinding;if(-not(Test-CcodUninstallBootstrapExactProperties $binding @('selectedRuntimeRoot','runtimeManifestSha256','wrapperPid','wrapperCreationTimeUtc','wrapperSessionId','wrapperUserSid'))-or$binding.selectedRuntimeRoot-isnot[string]-or-not[IO.Path]::IsPathRooted($binding.selectedRuntimeRoot)-or$binding.runtimeManifestSha256-isnot[string]-or$binding.runtimeManifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$binding.wrapperPid-isnot[int]-or$binding.wrapperPid-lt1-or-not(Test-CcodUninstallBootstrapCanonicalUtc $binding.wrapperCreationTimeUtc)-or$binding.wrapperSessionId-isnot[int]-or$binding.wrapperSessionId-lt0-or$binding.wrapperUserSid-isnot[string]-or$binding.wrapperUserSid-cnotmatch'^S-'){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_INVALID' 'Installed finalization binding is invalid' $binding}}
     $started = [DateTime]::ParseExact($Transaction.startedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
     $updated = [DateTime]::ParseExact($Transaction.updatedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
     $resumable = @('Requested','Recovering','RecoveryProven','StoppingProtection','ProtectionStopped','TaskRemoved','ApplicationStateRemoved','ReadyForInno')
@@ -839,7 +848,7 @@ function Assert-CcodUninstallBootstrapTransaction {
 }
 
 function New-CcodUninstallBootstrapTransaction {
-    param([Parameter(Mandatory)]$Context,[Parameter(Mandatory)][string]$TransactionId,[Parameter(Mandatory)][DateTime]$NowUtc)
+    param([Parameter(Mandatory)]$Context,[Parameter(Mandatory)][string]$TransactionId,[Parameter(Mandatory)][DateTime]$NowUtc,$InstalledBinding)
     $timestamp = $NowUtc.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)
     $transaction = [pscustomobject][ordered]@{
         schemaVersion = 1
@@ -849,6 +858,8 @@ function New-CcodUninstallBootstrapTransaction {
         leaseEpoch = [uint64]$Context.leaseEpoch
         userSid = [string]$Context.userSid
         sessionId = [int]$Context.sessionId
+        readyEvidence = $Context.readyEvidence
+        installedBinding = $InstalledBinding
         phase = 'Requested'
         resumePhase = 'Requested'
         startedAtUtc = $timestamp
@@ -930,6 +941,12 @@ function Get-CcodUninstallBootstrapAdapters {
             param($Context)
             Remove-CcodUninstallBootstrapProductRegistration -Context $Context
         }
+        GetInstalledBinding = {
+            param($InstallerRoot,$InstallRoot,$Context,$WrapperIdentity)
+            $identity=Get-CcodUninstallBootstrapCurrentIdentity;$process=[Diagnostics.Process]::GetCurrentProcess();try{$created=$process.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture);if($WrapperIdentity.pid-ne[int]$process.Id-or$WrapperIdentity.creationTimeUtc-cne$created-or$WrapperIdentity.sessionId-ne[int]$process.SessionId-or$WrapperIdentity.userSid-cne$identity.userSid){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'Installed wrapper identity does not match the current verified process' $WrapperIdentity}}finally{$process.Dispose()}
+            $selected=[IO.Path]::GetFullPath((Join-Path (Join-Path $InstallRoot 'runtime') ([string]$Context.runtimeId)));if([IO.Path]::GetFullPath($InstallerRoot)-cne$selected){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'Installed wrapper is outside the selected runtime' $InstallerRoot};$manifest=Get-CcodUninstallBootstrapFileFingerprint -Path (Join-Path $selected 'manifest.json')
+            [pscustomobject][ordered]@{selectedRuntimeRoot=$selected;runtimeManifestSha256=[string]$manifest.sha256;wrapperPid=[int]$WrapperIdentity.pid;wrapperCreationTimeUtc=[string]$WrapperIdentity.creationTimeUtc;wrapperSessionId=[int]$WrapperIdentity.sessionId;wrapperUserSid=[string]$WrapperIdentity.userSid}
+        }
         TestInstallRootAbsent = { param($InstallerRoot) -not ([IO.Directory]::Exists($InstallerRoot) -or [IO.File]::Exists($InstallerRoot)) }
         GetUtcNow = { [DateTime]::UtcNow }
     }
@@ -950,7 +967,7 @@ function Remove-CcodUninstallBootstrapProductRegistration {
     param([Parameter(Mandatory)]$Context)
     Assert-CcodUninstallBootstrapContext $Context
     $modulePath=Join-Path $PSScriptRoot 'modules\ProductRegistration.psm1';if(-not[IO.File]::Exists($modulePath)){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PRODUCT_REGISTRATION_INVALID' 'Matched product registration module is missing' $modulePath}
-    try{Import-Module $modulePath -Force -ErrorAction Stop;Remove-CcodProductRegistration -ExpectedRuntimeId ([string]$Context.runtimeId)}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PRODUCT_REGISTRATION_INVALID' 'Current product registration did not match the verified uninstall runtime' $Context.runtimeId}
+    try{Import-Module $modulePath -Force -ErrorAction Stop;Remove-CcodProductRegistration -ReadyEvidence $Context.readyEvidence}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PRODUCT_REGISTRATION_INVALID' 'Current product registration did not match exact Ready uninstall evidence' $Context.runtimeId}
 }
 
 function Set-CcodUninstallBootstrapFailedTransaction {
@@ -972,6 +989,7 @@ function Invoke-CcodUninstallBootstrap {
         [Parameter(Mandatory)][string]$InstallerRoot,
         [Parameter(Mandatory)][string]$InstallRoot,
         [Parameter(Mandatory)][ValidateSet('Prepare','PrepareInstalled','FinalizeReceipt')][string]$Mode,
+        $WrapperIdentity,
         [hashtable]$Adapters
     )
 
@@ -1040,12 +1058,14 @@ function Invoke-CcodUninstallBootstrap {
             if ($stageRoot -isnot [string] -or [string]::IsNullOrWhiteSpace($stageRoot)) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_ROOT_INVALID' 'The external uninstall transaction root is invalid' $stageRoot }
             $now = & $adapter.GetUtcNow
             if ($now -isnot [DateTime]) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_CLOCK_INVALID' 'The uninstall clock is invalid' $now }
-            $transaction = New-CcodUninstallBootstrapTransaction -Context $context -TransactionId $transactionId -NowUtc $now
+            $installedBinding=if($Mode-ceq'PrepareInstalled'){&$adapter.GetInstalledBinding $InstallerRoot $InstallRoot $context $WrapperIdentity}else{$null}
+            $transaction = New-CcodUninstallBootstrapTransaction -Context $context -TransactionId $transactionId -NowUtc $now -InstalledBinding $installedBinding
             & $adapter.WriteTransaction $stageRoot $transaction
             & $adapter.PublishTransaction $transactionRoot $transactionId $context.userSid ([bool]$replaceCompletedLocator)
             $stagePayload = $true
         } else {
             Assert-CcodUninstallBootstrapTransactionMatchesContext $transaction $context
+            if($Mode-ceq'PrepareInstalled'){$binding=&$adapter.GetInstalledBinding $InstallerRoot $InstallRoot $context $WrapperIdentity;if($null-eq$transaction.installedBinding-or($binding|ConvertTo-Json -Compress)-cne($transaction.installedBinding|ConvertTo-Json -Compress)){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISMATCH' 'Installed wrapper binding changed during resume' $binding}}
             $stageRoot = & $adapter.GetTransactionDirectory $transactionRoot $transaction.transactionId
             if ($stageRoot -isnot [string] -or [string]::IsNullOrWhiteSpace($stageRoot)) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_ROOT_INVALID' 'The external uninstall transaction root is invalid' $stageRoot }
             $stagePayload = $transaction.phase -ceq 'Requested' -or ($transaction.phase -ceq 'Failed' -and $transaction.resumePhase -ceq 'Requested')
@@ -1072,7 +1092,7 @@ function Invoke-CcodUninstallBootstrap {
 
 if ($MyInvocation.InvocationName -ne '.') {
     try {
-        $receipt = Invoke-CcodUninstallBootstrap -InstallerRoot $InstallerRoot -InstallRoot $InstallRoot -Mode $Mode
+        $receipt = Invoke-CcodUninstallBootstrap -InstallerRoot $InstallerRoot -InstallRoot $InstallRoot -Mode $Mode -WrapperIdentity $WrapperIdentity
         if ($Mode -eq 'Prepare' -and $receipt.phase -ne 'ReadyForInno') { exit 3 }
         if ($Mode -eq 'PrepareInstalled' -and $receipt.phase -ne 'TaskRemoved') { exit 3 }
         if ($Mode -eq 'FinalizeReceipt' -and $receipt.phase -ne 'Completed') { exit 3 }
diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index c3ace77..b58b62d 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -365,9 +365,9 @@ function Open-CcodInstallGeneration {
     $runtime=$arguments[2];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$RuntimeId;RootToken=$token;StateOnly=$false;ProductOnly=$false;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='Generation';ReadOnly=$false;RuntimeId=$RuntimeId});$transaction
 }
 function Open-CcodInstallStateTransaction { param([Parameter(Mandatory)][string]$InstallRoot) Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenState $arguments} 'CCOD_INSTALL_STATE_TRANSACTION_INVALID';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$null;RootToken=$token;StateOnly=$true;ProductOnly=$false;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='StateTransaction';ReadOnly=$false;RuntimeId=$null});$transaction }
-function Open-CcodInstallProductRegistrationTransaction {param([Parameter(Mandatory)][string]$InstallRoot)Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenProduct $arguments} 'CCOD_INSTALL_PRODUCT_SCOPE';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$null;RootToken=$token;StateOnly=$false;ProductOnly=$true;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='ProductTransaction';ReadOnly=$true;RuntimeId=$null});$transaction}
+function Open-CcodInstallProductRegistrationTransaction {param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$ReadyEvidence)Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$properties=@($ReadyEvidence.PSObject.Properties);$names=@('phase','runtimeId','runtimeGeneration','manifestSha256','packageSha256');if($properties.Count-ne$names.Count-or(@($properties.Name)-join'|')-cne($names-join'|')-or$ReadyEvidence.phase-cne'Ready'-or$ReadyEvidence.runtimeId-isnot[string]-or[uint64]$ReadyEvidence.runtimeGeneration-lt1-or$ReadyEvidence.manifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.packageSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Product transaction requires exact Ready evidence' $ReadyEvidence};$root=[IO.Path]::GetFullPath($InstallRoot);$pointerRoot=Join-Path $root 'state\active-generation';$pointerLeaves=@(Get-ChildItem -LiteralPath $pointerRoot -File -Force -ErrorAction Stop|Sort-Object Name);if($pointerLeaves.Count-eq0-or$pointerLeaves[-1].Name-cne('{0:D20}.json'-f[uint64]$ReadyEvidence.runtimeGeneration)){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Ready evidence is not the latest selected generation' $ReadyEvidence};$pointerPath=Join-Path $root ('state\active-generation\{0:D20}.json'-f[uint64]$ReadyEvidence.runtimeGeneration);$manifestPath=Join-Path (Join-Path (Join-Path $root 'runtime') $ReadyEvidence.runtimeId) 'manifest.json';try{$pointer=Get-Content -LiteralPath $pointerPath -Raw -ErrorAction Stop|ConvertFrom-Json -ErrorAction Stop;if([string]$pointer.activeRuntime-cne[string]$ReadyEvidence.runtimeId-or[uint64]$pointer.generation-ne[uint64]$ReadyEvidence.runtimeGeneration-or(Get-FileHash -LiteralPath $manifestPath -Algorithm SHA256 -ErrorAction Stop).Hash.ToLowerInvariant()-cne[string]$ReadyEvidence.manifestSha256){throw 'selected pointer or manifest mismatch'};$matches=@();foreach($file in @(Get-ChildItem -LiteralPath (Join-Path $root 'state\install-transactions') -File -Force -ErrorAction Stop)){try{$record=Get-Content -LiteralPath $file.FullName -Raw -ErrorAction Stop|ConvertFrom-Json -ErrorAction Stop;if($record.phase-ceq'Ready'-and$record.newRuntimeId-ceq$ReadyEvidence.runtimeId-and[uint64]$record.newGeneration-eq[uint64]$ReadyEvidence.runtimeGeneration-and$record.newManifestSha256-ceq$ReadyEvidence.manifestSha256-and$record.sealedPackageSha256-ceq$ReadyEvidence.packageSha256){$matches+=,$record}}catch{throw}};if($matches.Count-ne1){throw 'matching Ready record missing or ambiguous'}}catch{Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Selected pointer manifest and Ready record could not be proven' $ReadyEvidence};$arguments=[object[]]@($root,$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenProduct $arguments} 'CCOD_INSTALL_PRODUCT_SCOPE';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=$root.TrimEnd('\');RuntimeId=$ReadyEvidence.runtimeId;RootToken=$token;StateOnly=$false;ProductOnly=$true;ReadyEvidence=$ReadyEvidence;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='ProductTransaction';ReadOnly=$true;RuntimeId=$ReadyEvidence.runtimeId});$transaction}
 function Open-CcodInstallRetainedGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)][string]$ExpectedManifestSha256,[Parameter(Mandatory)]$FileTransaction) if(-not[IO.Path]::IsPathRooted($InstallRoot)-or$ExpectedManifestSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_GENERATION_INVALID' 'Invalid retained generation contract' $RuntimeId};Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';if(-not[object]::ReferenceEquals($scope.Record.Transaction,$FileTransaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'FileTransaction must be the transaction root capability' $null};Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$nativeResult=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetained @($RuntimeId,$ExpectedManifestSha256)} 'CCOD_INSTALL_RETAINED_GENERATION_INVALID';if(@($nativeResult).Count-ne 2-or-not(Test-CcodRetainedManifestIdentity ([string]$nativeResult[1]) $RuntimeId)){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH' 'Retained manifest must contain exactly one matching top-level runtimeId string' $RuntimeId};Add-CcodInstallScope $scope.Record.Transaction $nativeResult[0] Generation $true $RuntimeId }
-function Open-CcodInstallRetainedFile {param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$RelativePath)if($RelativePath-cnotin@('registration/StartMenu.CodexRemote-fix.lnk','registration/Desktop.CodexRemote-fix.lnk')){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Product shortcut source must be one fixed manifest-relative candidate' $RelativePath};$scope=Get-CcodInstallTransaction $Generation 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';$result=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetainedFile @($scope.Record.Token,$RelativePath)} 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';if(@($result).Count-ne3-or[int64]$result[1]-lt0-or[string]$result[2]-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Retained product shortcut identity is invalid' $RelativePath};Add-CcodInstallScope $scope.Record.Transaction $result[0] RetainedFile $true $scope.Record.RuntimeId}
+function Open-CcodInstallRetainedFile {param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$RelativePath,[Parameter(Mandatory)]$ReadyEvidence)if($RelativePath-cnotin@('registration/StartMenu.CodexRemote-fix.lnk','registration/Desktop.CodexRemote-fix.lnk')){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Product shortcut source must be one fixed manifest-relative candidate' $RelativePath};$scope=Get-CcodInstallTransaction $Generation 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';if($ReadyEvidence.phase-cne'Ready'-or$ReadyEvidence.runtimeId-cne$scope.Record.RuntimeId-or[uint64]$ReadyEvidence.runtimeGeneration-lt1-or$ReadyEvidence.manifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.packageSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Retained shortcut source lacks exact Ready selection evidence' $ReadyEvidence};$root=$scope.State.InstallRoot;$pointer=Get-Content -LiteralPath (Join-Path $root ('state\active-generation\{0:D20}.json'-f[uint64]$ReadyEvidence.runtimeGeneration)) -Raw -ErrorAction Stop|ConvertFrom-Json -ErrorAction Stop;if($pointer.activeRuntime-cne$ReadyEvidence.runtimeId-or[uint64]$pointer.generation-ne[uint64]$ReadyEvidence.runtimeGeneration){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Retained shortcut source is not selected' $ReadyEvidence};$result=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetainedFile @($scope.Record.Token,$RelativePath)} 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';if(@($result).Count-ne3-or[int64]$result[1]-lt0-or[string]$result[2]-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Retained product shortcut identity is invalid' $RelativePath};Add-CcodInstallScope $scope.Record.Transaction $result[0] RetainedFile $true $scope.Record.RuntimeId}
 function New-CcodInstallDirectory { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$Parent,[Parameter(Mandatory)][string]$Leaf,[switch]$CreateIfMissing) Assert-CcodInstallLeaf $Leaf;$transactionScope=Get-CcodInstallTransaction $Transaction 'CCOD_INSTALL_TRANSACTION_INVALID';if(-not[object]::ReferenceEquals($transactionScope.Record.Transaction,$Transaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Transaction capability must be the transaction root' $null};if([object]::ReferenceEquals($Parent,$Transaction)){$token=Invoke-CcodRuntimeMethod $transactionScope.State.Runtime GetInstallRoot @();$parentScope=[pscustomobject]@{State=$transactionScope.State;Record=[pscustomobject]@{Transaction=$Transaction;Token=$token;Kind='Directory';ReadOnly=$false;RuntimeId=$null}}}else{$parentScope=Get-CcodInstallScopedDirectory $Transaction $Parent};Assert-CcodInstallWritableScope $parentScope;$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $parentScope.State.Runtime OpenDirectory @($parentScope.Record.Token,$Leaf,[bool]$CreateIfMissing)} 'CCOD_INSTALL_DIRECTORY_OPEN_FAILED';$readOnly=[bool](Invoke-CcodRuntimeMethod $parentScope.State.Runtime IsRetained @($token));Add-CcodInstallScope $Transaction $token Directory $readOnly $(if($readOnly){$parentScope.Record.RuntimeId}else{$null}) }
 function New-CcodInstallGenerationLeaf { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$Leaf) Assert-CcodInstallLeaf $Leaf;$scope=Get-CcodInstallTransaction $Generation;Assert-CcodInstallWritableScope $scope;if($scope.State.StateOnly){Throw-CcodInstallFileError 'CCOD_INSTALL_STATE_SCOPE' 'State-only transaction cannot create a generation leaf' $Leaf};$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CreateDirectory @($scope.Record.Token,$Leaf)} 'CCOD_INSTALL_LEAF_CREATE_FAILED';Add-CcodInstallScope $scope.Record.Transaction $token Directory $scope.Record.ReadOnly $scope.Record.RuntimeId }
 function Copy-CcodInstallSealedSource { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$SourcePath,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)][int64]$ExpectedLength,[Parameter(Mandatory)][string]$ExpectedSha256) Assert-CcodInstallLeaf $Leaf;if(-not[IO.Path]::IsPathRooted($SourcePath)-or$ExpectedLength-lt 0-or$ExpectedSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Invalid sealed source contract' $SourcePath};$scope=Get-CcodInstallTransaction $Generation;Assert-CcodInstallWritableScope $scope;$result=[pscustomobject]@{Length=$ExpectedLength;Sha256=$ExpectedSha256};Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Copy @($scope.Record.Token,$Leaf,[IO.Path]::GetFullPath($SourcePath),$ExpectedLength,$ExpectedSha256)|Out-Null} 'CCOD_INSTALL_SOURCE_MISMATCH';return $result }
diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index 4c97c37..dd3745a 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -1954,9 +1954,9 @@ function Get-CcodLifecycleAdapters {
             $module=Import-Module (Join-Path $PSScriptRoot 'ProductRegistration.psm1') -Force -PassThru -ErrorAction Stop
             $ownedTransaction=$null;$sourceCapability=$FileTransaction
             try{
-                if($null-eq$sourceCapability){Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop;$ownedTransaction=Open-CcodInstallProductRegistrationTransaction -InstallRoot $InstallRoot;$sourceCapability=Open-CcodInstallRetainedGeneration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -ExpectedManifestSha256 ([string]$TransactionRecord.newManifestSha256) -FileTransaction $ownedTransaction}
+                if($null-eq$sourceCapability){Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop;$fileReady=[pscustomobject][ordered]@{phase='Ready';runtimeId=$RuntimeId;runtimeGeneration=[uint64]$TransactionRecord.newGeneration;manifestSha256=[string]$TransactionRecord.newManifestSha256;packageSha256=$PackageSha256};$ownedTransaction=Open-CcodInstallProductRegistrationTransaction -InstallRoot $InstallRoot -ReadyEvidence $fileReady;$sourceCapability=Open-CcodInstallRetainedGeneration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -ExpectedManifestSha256 ([string]$TransactionRecord.newManifestSha256) -FileTransaction $ownedTransaction}
                 $registration=New-CcodProductRegistration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -Version $Version -PackageSha256 $PackageSha256 -FileTransaction $sourceCapability
-                $proof=[pscustomobject][ordered]@{phase=[string]$TransactionRecord.phase;runtimeId=$RuntimeId;version=$Version;packageSha256=$PackageSha256;bootstrapPath=$registration.bootstrapPath;uninstallerPath=$registration.uninstallerPath}
+                $system=[Environment]::GetFolderPath([Environment+SpecialFolder]::System);$proof=[pscustomobject][ordered]@{phase=[string]$TransactionRecord.phase;runtimeId=$RuntimeId;version=$Version;packageSha256=$PackageSha256;runtimeGeneration=[uint64]$TransactionRecord.newGeneration;manifestSha256=[string]$TransactionRecord.newManifestSha256;startMenuSha256=(Get-CcodLifecycleFileSha256 $registration.startMenuShortcut.candidatePath);desktopSha256=(Get-CcodLifecycleFileSha256 $registration.desktopShortcut.candidatePath);targetPath=[IO.Path]::GetFullPath((Join-Path $system 'schtasks.exe'));arguments='/Run /TN "Codex Control Other Devices Supervisor"';bootstrapPath=$registration.bootstrapPath;uninstallerPath=$registration.uninstallerPath}
                 $receipt=Commit-CcodProductRegistration -Registration $registration -FileTransaction $sourceCapability -Adapters @{GetReadyProof={param($Ignored)$proof}.GetNewClosure()}
                 Remove-CcodLegacyProductRegistration -ExpectedAppId '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}'
                 [pscustomobject]@{verified=[bool]$receipt.verified;legacyRemoved=$true}
diff --git a/src/persistence/modules/ProductRegistration.psm1 b/src/persistence/modules/ProductRegistration.psm1
index f24a167..3de4b65 100644
--- a/src/persistence/modules/ProductRegistration.psm1
+++ b/src/persistence/modules/ProductRegistration.psm1
@@ -8,7 +8,7 @@ $script:CcodProductFields = @(
     'productKeyName','startMenuShortcut','desktopShortcut'
 )
 $script:CcodShortcutFields = @('kind','leaf','relativePath','candidatePath','bootstrapPath','installRoot')
-$script:CcodReadyFields = @('phase','runtimeId','version','packageSha256','bootstrapPath','uninstallerPath')
+$script:CcodReadyFields = @('phase','runtimeId','version','packageSha256','runtimeGeneration','manifestSha256','startMenuSha256','desktopSha256','targetPath','arguments','bootstrapPath','uninstallerPath')
 $script:CcodLegacyShortcutNames = @(
     'Programs\Codex Control other devices\Codex Control other devices for Windows.lnk',
     'Programs\Codex Control other devices\Open the tray supervisor.lnk',
@@ -120,10 +120,12 @@ function Test-CcodProductRegistration {
 function Test-CcodProductReadyProof {
     param($Proof,$Registration)
     if (-not (Test-CcodProductExactProperties $Proof $script:CcodReadyFields)) { return $false }
+    $canonicalTarget=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'schtasks.exe'))
     return $Proof.phase -is [string] -and [string]$Proof.phase -ceq 'Ready' -and
         $Proof.runtimeId -is [string] -and [string]$Proof.runtimeId -ceq [string]$Registration.runtimeId -and
         $Proof.version -is [string] -and [string]$Proof.version -ceq [string]$Registration.version -and
         $Proof.packageSha256 -is [string] -and [string]$Proof.packageSha256 -ceq [string]$Registration.packageSha256 -and
+        [uint64]$Proof.runtimeGeneration -gt 0 -and $Proof.manifestSha256 -cmatch '^[0-9a-f]{64}$' -and $Proof.startMenuSha256 -cmatch '^[0-9a-f]{64}$' -and $Proof.desktopSha256 -cmatch '^[0-9a-f]{64}$' -and $Proof.targetPath -is [string] -and [IO.Path]::GetFullPath([string]$Proof.targetPath) -ceq $canonicalTarget -and $Proof.arguments -ceq '/Run /TN "Codex Control Other Devices Supervisor"' -and
         $Proof.bootstrapPath -is [string] -and [string]$Proof.bootstrapPath -ceq [string]$Registration.bootstrapPath -and
         $Proof.uninstallerPath -is [string] -and [string]$Proof.uninstallerPath -ceq [string]$Registration.uninstallerPath
 }
@@ -132,9 +134,9 @@ function Get-CcodProductRegistrationAdapters {
     param([hashtable]$Adapters)
     $defaults = @{
         GetReadyProof = { param($Registration) Throw-CcodProductRegistrationError 'CCOD_PRODUCT_REGISTRATION_NOT_READY' 'No independently verified Ready proof was supplied.' $Registration.runtimeId }
-        WriteProductRegistration = { param($Registration) Write-CcodCurrentUserProductRegistration $Registration }
+        WriteProductRegistration = { param($Registration,$ReadyEvidence) Write-CcodCurrentUserProductRegistration $Registration $ReadyEvidence }
         ReadProductRegistration = { param($Registration) Read-CcodCurrentUserProductRegistration $Registration }
-        WriteShortcut = { param($Kind,$Shortcut,$FileTransaction) Write-CcodCurrentUserProductShortcut -Kind $Kind -Shortcut $Shortcut -FileTransaction $FileTransaction }
+        WriteShortcut = { param($Kind,$Shortcut,$FileTransaction,$ReadyEvidence) Write-CcodCurrentUserProductShortcut -Kind $Kind -Shortcut $Shortcut -FileTransaction $FileTransaction -ReadyEvidence $ReadyEvidence }
         ReadShortcut = { param($Kind,$Shortcut) Read-CcodCurrentUserProductShortcut -Kind $Kind -Shortcut $Shortcut }
         ReadLegacyRegistration = { param($ExpectedAppId) Read-CcodCurrentUserLegacyRegistration -ExpectedAppId $ExpectedAppId }
         ReadVerifiedRegistration = { Read-CcodCurrentUserVerifiedRegistration }
@@ -145,6 +147,7 @@ function Get-CcodProductRegistrationAdapters {
         RemoveLegacyEntry = { param($Entry) Remove-CcodLegacySnapshotEntry -Entry $Entry }
         ReadLegacyEntry = { param($Entry) Read-CcodLegacySnapshotEntry -Entry $Entry }
         RestoreLegacyEntry = { param($Entry) Restore-CcodLegacySnapshotEntry -Entry $Entry }
+        WriteLegacyCompensationFailure = {param($Record)Write-CcodLegacyCompensationFailure -Record $Record}
     }
     if ($null -eq $Adapters) { return $defaults }
     if ($Adapters -isnot [hashtable]) { Throw-CcodProductRegistrationError 'CCOD_PRODUCT_ADAPTER_INVALID' 'Product adapters must be a hashtable.' $Adapters }
@@ -168,12 +171,13 @@ function Get-CcodProductUninstallCommand($Registration) {
     '"{0}" -NoProfile -ExecutionPolicy Bypass -File "{1}"' -f (Get-CcodProductPowerShellPath),([string]$Registration.uninstallerPath).Replace('"','')
 }
 function Write-CcodCurrentUserProductRegistration {
-    param($Registration)
+    param($Registration,$ReadyEvidence)
     $path=Get-CcodProductRegistryPath;$command=Get-CcodProductUninstallCommand $Registration
     $shell=$null;$startLink=$null;$desktopLink=$null;try{$shell=New-Object -ComObject WScript.Shell;$startLink=$shell.CreateShortcut([string]$Registration.startMenuShortcut.candidatePath);$desktopLink=$shell.CreateShortcut([string]$Registration.desktopShortcut.candidatePath);$target=[IO.Path]::GetFullPath([string]$startLink.TargetPath);$arguments=[string]$startLink.Arguments;if([IO.Path]::GetFullPath([string]$desktopLink.TargetPath)-cne$target-or[string]$desktopLink.Arguments-cne$arguments){throw 'candidate target mismatch'}}finally{if($null-ne$startLink){[void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($startLink)};if($null-ne$desktopLink){[void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($desktopLink)};if($null-ne$shell){[void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($shell)}}
     New-Item -Path $path -Force -ErrorAction Stop|Out-Null
-    $values=[ordered]@{DisplayName='CodexRemote-fix';DisplayVersion=[string]$Registration.version;Publisher='naipi11';InstallLocation=[string]$Registration.runtimeRoot;UninstallString=$command;QuietUninstallString=($command+' -Confirm:$false');NoModify=1;NoRepair=1;CcodRuntimeId=[string]$Registration.runtimeId;CcodPackageSha256=[string]$Registration.packageSha256;CcodStartMenuSha256=Get-CcodProductFileSha256 ([string]$Registration.startMenuShortcut.candidatePath);CcodDesktopSha256=Get-CcodProductFileSha256 ([string]$Registration.desktopShortcut.candidatePath);CcodShortcutTarget=$target;CcodShortcutArguments=$arguments}
-    foreach($name in $values.Keys){$type=if($name-in@('NoModify','NoRepair')){'DWord'}else{'String'};New-ItemProperty -LiteralPath $path -Name $name -Value $values[$name] -PropertyType $type -Force -ErrorAction Stop|Out-Null}
+    if($ReadyEvidence.startMenuSha256-cne(Get-CcodProductFileSha256 ([string]$Registration.startMenuShortcut.candidatePath))-or$ReadyEvidence.desktopSha256-cne(Get-CcodProductFileSha256 ([string]$Registration.desktopShortcut.candidatePath))-or[IO.Path]::GetFullPath([string]$ReadyEvidence.targetPath)-cne$target-or[string]$ReadyEvidence.arguments-cne$arguments){throw 'Ready shortcut evidence mismatch'}
+    $values=[ordered]@{DisplayName='CodexRemote-fix';DisplayVersion=[string]$Registration.version;Publisher='naipi11';InstallLocation=[string]$Registration.runtimeRoot;UninstallString=$command;QuietUninstallString=($command+' -Confirm:$false');NoModify=1;NoRepair=1;CcodRuntimeId=[string]$Registration.runtimeId;CcodRuntimeGeneration=[int64]$ReadyEvidence.runtimeGeneration;CcodPackageSha256=[string]$Registration.packageSha256;CcodManifestSha256=[string]$ReadyEvidence.manifestSha256;CcodStartMenuSha256=[string]$ReadyEvidence.startMenuSha256;CcodDesktopSha256=[string]$ReadyEvidence.desktopSha256;CcodShortcutTarget=$target;CcodShortcutArguments=$arguments}
+    foreach($name in $values.Keys){$type=if($name-in@('NoModify','NoRepair')){'DWord'}elseif($name-ceq'CcodRuntimeGeneration'){'QWord'}else{'String'};New-ItemProperty -LiteralPath $path -Name $name -Value $values[$name] -PropertyType $type -Force -ErrorAction Stop|Out-Null}
 }
 function Read-CcodCurrentUserProductRegistration {
     param($Registration)
@@ -201,10 +205,10 @@ function New-CcodProductShortcutCandidates {
     }finally{if($null-ne$shell){[void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($shell)}}
 }
 function Write-CcodCurrentUserProductShortcut {
-    param([string]$Kind,$Shortcut,$FileTransaction)
+    param([string]$Kind,$Shortcut,$FileTransaction,$ReadyEvidence)
     Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop
     $relative='registration/'+$(if($Kind-ceq'StartMenu'){'StartMenu.CodexRemote-fix.lnk'}else{'Desktop.CodexRemote-fix.lnk'})
-    $source=Open-CcodInstallRetainedFile -Generation $FileTransaction -RelativePath $relative
+    $fileReady=[pscustomobject][ordered]@{phase='Ready';runtimeId=[string]$ReadyEvidence.runtimeId;runtimeGeneration=[uint64]$ReadyEvidence.runtimeGeneration;manifestSha256=[string]$ReadyEvidence.manifestSha256;packageSha256=[string]$ReadyEvidence.packageSha256};$source=Open-CcodInstallRetainedFile -Generation $FileTransaction -RelativePath $relative -ReadyEvidence $fileReady
     $folder=Open-CcodInstallProductSpecialFolder -Generation $FileTransaction -Kind $Kind
     Copy-CcodInstallProductShortcut -Folder $folder -Source $source -Kind $Kind -Leaf 'CodexRemote-fix.lnk'|Out-Null
 }
@@ -244,7 +248,7 @@ function Read-CcodCurrentProductState {
     param([string]$ExpectedRuntimeId)
     try{
         $subkey='Software\Microsoft\Windows\CurrentVersion\Uninstall\CodexRemote-fix';$key=[Microsoft.Win32.Registry]::CurrentUser.OpenSubKey($subkey,$false);if($null-eq$key){return [pscustomobject]@{valid=$true;reason=$null;entries=@()}}
-        try{$allowed=@('CcodDesktopSha256','CcodPackageSha256','CcodRuntimeId','CcodShortcutArguments','CcodShortcutTarget','CcodStartMenuSha256','DisplayName','DisplayVersion','InstallLocation','NoModify','NoRepair','Publisher','QuietUninstallString','UninstallString');$names=@($key.GetValueNames()|Sort-Object);if(($names-join'|')-cne(($allowed|Sort-Object)-join'|')){return [pscustomobject]@{valid=$false;reason='UnknownRegistryValue';entries=@()}};$runtime=[string]$key.GetValue('CcodRuntimeId',$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);$installLocation=[string]$key.GetValue('InstallLocation');$expectedUninstaller=Join-Path $installLocation 'Uninstall-CodexControlOtherDevices.ps1';$expectedCommand='"{0}" -NoProfile -ExecutionPolicy Bypass -File "{1}"'-f(Get-CcodProductPowerShellPath),$expectedUninstaller;if($runtime-cne$ExpectedRuntimeId-or$installLocation-cne[IO.Path]::GetFullPath((Join-Path (Join-Path (Split-Path (Split-Path $installLocation -Parent) -Parent) 'runtime') $runtime))-or[string]$key.GetValue('DisplayName')-cne'CodexRemote-fix'-or[string]$key.GetValue('DisplayVersion')-cne'2.5.22'-or[string]$key.GetValue('Publisher')-cne'naipi11'-or[string]$key.GetValue('UninstallString')-cne$expectedCommand-or[string]$key.GetValue('QuietUninstallString')-cne($expectedCommand+' -Confirm:$false')-or[int]$key.GetValue('NoModify')-ne1-or[int]$key.GetValue('NoRepair')-ne1-or[string]$key.GetValue('CcodPackageSha256')-cnotmatch'^[0-9a-f]{64}$'){return [pscustomobject]@{valid=$false;reason='RegistryMismatch';entries=@()}};foreach($dword in @('NoModify','NoRepair')){if($key.GetValueKind($dword)-ne[Microsoft.Win32.RegistryValueKind]::DWord){return [pscustomobject]@{valid=$false;reason='RegistryType';entries=@()}}};foreach($stringName in @($allowed|Where-Object{$_-notin@('NoModify','NoRepair')})){if($key.GetValueKind($stringName)-ne[Microsoft.Win32.RegistryValueKind]::String){return [pscustomobject]@{valid=$false;reason='RegistryType';entries=@()}}};$target=[string]$key.GetValue('CcodShortcutTarget');$arguments=[string]$key.GetValue('CcodShortcutArguments');$start=Get-CcodProductShortcutEvidence 'StartMenu';$desktop=Get-CcodProductShortcutEvidence 'Desktop';if($null-eq$start-or$null-eq$desktop-or$start.target-cne$target-or$desktop.target-cne$target-or$start.arguments-cne$arguments-or$desktop.arguments-cne$arguments-or$start.sha256-cne[string]$key.GetValue('CcodStartMenuSha256')-or$desktop.sha256-cne[string]$key.GetValue('CcodDesktopSha256')){return [pscustomobject]@{valid=$false;reason='ShortcutMismatch';entries=@()}};$captured=[ordered]@{};foreach($name in $names){$captured[$name]=[pscustomobject]@{value=$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);kind=[string]$key.GetValueKind($name)}};return [pscustomobject]@{valid=$true;reason=$null;entries=@([pscustomobject]@{kind='StartMenu';path=$start.path;sha256=$start.sha256},[pscustomobject]@{kind='Desktop';path=$desktop.path;sha256=$desktop.sha256},[pscustomobject]@{kind='Registry';path=$subkey;valueNames=$names;values=$captured})}}
+        try{$allowed=@('CcodDesktopSha256','CcodPackageSha256','CcodRuntimeId','CcodRuntimeGeneration','CcodManifestSha256','CcodShortcutArguments','CcodShortcutTarget','CcodStartMenuSha256','DisplayName','DisplayVersion','InstallLocation','NoModify','NoRepair','Publisher','QuietUninstallString','UninstallString');$names=@($key.GetValueNames()|Sort-Object);if(($names-join'|')-cne(($allowed|Sort-Object)-join'|')){return [pscustomobject]@{valid=$false;reason='UnknownRegistryValue';entries=@()}};$runtime=[string]$key.GetValue('CcodRuntimeId',$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);$installLocation=[string]$key.GetValue('InstallLocation');$expectedUninstaller=Join-Path $installLocation 'Uninstall-CodexControlOtherDevices.ps1';$expectedCommand='"{0}" -NoProfile -ExecutionPolicy Bypass -File "{1}"'-f(Get-CcodProductPowerShellPath),$expectedUninstaller;if($runtime-cne$ExpectedRuntimeId-or$installLocation-cne[IO.Path]::GetFullPath((Join-Path (Join-Path (Split-Path (Split-Path $installLocation -Parent) -Parent) 'runtime') $runtime))-or[string]$key.GetValue('DisplayName')-cne'CodexRemote-fix'-or[string]$key.GetValue('DisplayVersion')-cne'2.5.22'-or[string]$key.GetValue('Publisher')-cne'naipi11'-or[string]$key.GetValue('UninstallString')-cne$expectedCommand-or[string]$key.GetValue('QuietUninstallString')-cne($expectedCommand+' -Confirm:$false')-or[int]$key.GetValue('NoModify')-ne1-or[int]$key.GetValue('NoRepair')-ne1-or[string]$key.GetValue('CcodPackageSha256')-cnotmatch'^[0-9a-f]{64}$'){return [pscustomobject]@{valid=$false;reason='RegistryMismatch';entries=@()}};foreach($dword in @('NoModify','NoRepair')){if($key.GetValueKind($dword)-ne[Microsoft.Win32.RegistryValueKind]::DWord){return [pscustomobject]@{valid=$false;reason='RegistryType';entries=@()}}};if($key.GetValueKind('CcodRuntimeGeneration')-ne[Microsoft.Win32.RegistryValueKind]::QWord){return [pscustomobject]@{valid=$false;reason='RegistryType';entries=@()}};foreach($stringName in @($allowed|Where-Object{$_-notin@('NoModify','NoRepair','CcodRuntimeGeneration')})){if($key.GetValueKind($stringName)-ne[Microsoft.Win32.RegistryValueKind]::String){return [pscustomobject]@{valid=$false;reason='RegistryType';entries=@()}}};$target=[string]$key.GetValue('CcodShortcutTarget');$arguments=[string]$key.GetValue('CcodShortcutArguments');$start=Get-CcodProductShortcutEvidence 'StartMenu';$desktop=Get-CcodProductShortcutEvidence 'Desktop';if($null-eq$start-or$null-eq$desktop-or$start.target-cne$target-or$desktop.target-cne$target-or$start.arguments-cne$arguments-or$desktop.arguments-cne$arguments-or$start.sha256-cne[string]$key.GetValue('CcodStartMenuSha256')-or$desktop.sha256-cne[string]$key.GetValue('CcodDesktopSha256')){return [pscustomobject]@{valid=$false;reason='ShortcutMismatch';entries=@()}};$captured=[ordered]@{};foreach($name in $names){$captured[$name]=[pscustomobject]@{value=$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);kind=[string]$key.GetValueKind($name)}};$installRoot=[IO.Path]::GetFullPath((Split-Path (Split-Path $installLocation -Parent) -Parent));$readyEvidence=[pscustomobject][ordered]@{phase='Ready';installRoot=$installRoot;runtimeId=$runtime;runtimeGeneration=[uint64]$key.GetValue('CcodRuntimeGeneration');packageSha256=[string]$key.GetValue('CcodPackageSha256');manifestSha256=[string]$key.GetValue('CcodManifestSha256');startMenuSha256=$start.sha256;desktopSha256=$desktop.sha256;targetPath=$target;arguments=$arguments};return [pscustomobject]@{valid=$true;reason=$null;readyEvidence=$readyEvidence;entries=@([pscustomobject]@{kind='StartMenu';path=$start.path;sha256=$start.sha256},[pscustomobject]@{kind='Desktop';path=$desktop.path;sha256=$desktop.sha256},[pscustomobject]@{kind='Registry';path=$subkey;valueNames=$names;values=$captured})}}
         finally{$key.Dispose()}
     }catch{return [pscustomobject]@{valid=$false;reason='Ambiguous';entries=@()}}
 }
@@ -255,8 +259,8 @@ function Remove-CcodCurrentProductEntry {
     if($Entry.kind-cne'Registry'){throw 'unknown product entry'};$key=[Microsoft.Win32.Registry]::CurrentUser.OpenSubKey([string]$Entry.path,$true);if($null-eq$key){return};try{if((@($key.GetValueNames()|Sort-Object)-join'|')-cne((@($Entry.valueNames)|Sort-Object)-join'|')-or$key.GetSubKeyNames().Count-ne0){throw 'registry changed'};foreach($name in @($Entry.valueNames)){if([string]$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)-cne[string]$Entry.values[$name].value-or[string]$key.GetValueKind($name)-cne[string]$Entry.values[$name].kind){throw 'registry value changed'}};foreach($name in @($Entry.valueNames)){$key.DeleteValue($name,$true)};if($key.GetValueNames().Count-ne0){throw 'registry not empty'}}finally{$key.Dispose()};[Microsoft.Win32.Registry]::CurrentUser.DeleteSubKey([string]$Entry.path,$false)
 }
 function Remove-CcodProductRegistration {
-    [CmdletBinding()]param([Parameter(Mandatory)][string]$ExpectedRuntimeId,[hashtable]$Adapters)
-    if($ExpectedRuntimeId-cnotmatch'^2\.5\.22-[0-9a-f]{16}-[0-9a-f]{32}$'){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Expected product runtime ID is invalid' $ExpectedRuntimeId};$adapter=Get-CcodProductRegistrationAdapters $Adapters;$state=&$adapter.ReadCurrentProductState $ExpectedRuntimeId;if($null-eq$state-or$state.valid-isnot[bool]-or-not$state.valid-or$null-eq$state.entries){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Current product state is not an exact matched registration' $ExpectedRuntimeId};$entries=@($state.entries);if($entries.Count-notin@(0,3)){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Current product state is ambiguous' $ExpectedRuntimeId};foreach($entry in $entries){&$adapter.RemoveCurrentProductEntry $entry}
+    [CmdletBinding()]param([Parameter(Mandatory)]$ReadyEvidence,[hashtable]$Adapters)
+    $fields=@('phase','installRoot','runtimeId','runtimeGeneration','packageSha256','manifestSha256','startMenuSha256','desktopSha256','targetPath','arguments');$canonicalTarget=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'schtasks.exe'));if(-not(Test-CcodProductExactProperties $ReadyEvidence $fields)-or$ReadyEvidence.phase-cne'Ready'-or$ReadyEvidence.installRoot-isnot[string]-or-not[IO.Path]::IsPathRooted($ReadyEvidence.installRoot)-or$ReadyEvidence.runtimeId-cnotmatch'^2\.5\.22-[0-9a-f]{16}-[0-9a-f]{32}$'-or[uint64]$ReadyEvidence.runtimeGeneration-lt1-or$ReadyEvidence.packageSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.manifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.startMenuSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.desktopSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.targetPath-isnot[string]-or[IO.Path]::GetFullPath([string]$ReadyEvidence.targetPath)-cne$canonicalTarget-or$ReadyEvidence.arguments-cne'/Run /TN "Codex Control Other Devices Supervisor"'){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Exact Ready cleanup evidence is invalid' $ReadyEvidence};$adapter=Get-CcodProductRegistrationAdapters $Adapters;$state=&$adapter.ReadCurrentProductState $ReadyEvidence.runtimeId;if($null-eq$state-or$state.valid-isnot[bool]-or-not$state.valid-or$null-eq$state.readyEvidence-or($state.readyEvidence|ConvertTo-Json -Compress)-cne($ReadyEvidence|ConvertTo-Json -Compress)-or$null-eq$state.entries){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Current product state is not bound to exact Ready evidence' $ReadyEvidence.runtimeId};$entries=@($state.entries);if($entries.Count-notin@(0,3)){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Current product state is ambiguous' $ReadyEvidence.runtimeId};foreach($entry in $entries){&$adapter.RemoveCurrentProductEntry $entry}
 }
 function Read-CcodLegacySnapshot {
     param([string]$ExpectedAppId)
@@ -265,6 +269,7 @@ function Read-CcodLegacySnapshot {
 function Remove-CcodLegacySnapshotEntry {param($Entry);if($Entry-is[string]){return};if($Entry.kind-ceq'Registry'){$key=$null;try{$key=Get-Item -LiteralPath $Entry.path -ErrorAction Stop;if((@($key.GetValueNames()|Sort-Object)-join'|')-cne((@($Entry.values.Keys)|Sort-Object)-join'|')-or$key.GetSubKeyNames().Count-ne0){throw 'legacy registry changed'};foreach($name in @($Entry.values.Keys)){$current=$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);if([string]$current-cne[string]$Entry.values[$name].value-or[string]$key.GetValueKind($name)-cne[string]$Entry.values[$name].kind){throw 'legacy registry value changed'}};foreach($name in @($Entry.values.Keys)){$key.DeleteValue($name,$true)};$key.Dispose();$key=$null;Remove-Item -LiteralPath $Entry.path -Force -ErrorAction Stop;return}catch{if($null-ne$key){$key.Dispose()};if(-not(Test-Path -LiteralPath $Entry.path)){New-Item -Path $Entry.path -Force|Out-Null};foreach($name in $Entry.values.Keys){if($null-eq(Get-ItemProperty -LiteralPath $Entry.path -Name $name -ErrorAction SilentlyContinue)){$kind=[Enum]::Parse([Microsoft.Win32.RegistryValueKind],[string]$Entry.values[$name].kind);New-ItemProperty -LiteralPath $Entry.path -Name $name -Value $Entry.values[$name].value -PropertyType $kind -Force|Out-Null}};throw}};if(-not[IO.File]::Exists($Entry.path)-or(Get-CcodProductFileSha256 $Entry.path)-cne$Entry.sha256){throw 'legacy shortcut changed'};Remove-Item -LiteralPath $Entry.path -Force -ErrorAction Stop}
 function Read-CcodLegacySnapshotEntry {param($Entry);if($Entry-is[string]){return $null};if($Entry.kind-ceq'Registry'){if(Test-Path -LiteralPath $Entry.path){return 'Present'};return $null};if([IO.File]::Exists($Entry.path)){return Get-CcodProductFileSha256 $Entry.path};$null}
 function Restore-CcodLegacySnapshotEntry {param($Entry);if($Entry-is[string]){return};if($Entry.kind-ceq'Registry'){if(Test-Path -LiteralPath $Entry.path){throw 'legacy registry replacement present'};New-Item -Path $Entry.path -Force|Out-Null;foreach($name in $Entry.values.Keys){$kind=[Enum]::Parse([Microsoft.Win32.RegistryValueKind],[string]$Entry.values[$name].kind);New-ItemProperty -LiteralPath $Entry.path -Name $name -Value $Entry.values[$name].value -PropertyType $kind -Force|Out-Null};return};if([IO.File]::Exists($Entry.path)-or[IO.Directory]::Exists($Entry.path)){throw 'legacy shortcut replacement present'};[IO.Directory]::CreateDirectory((Split-Path $Entry.path -Parent))|Out-Null;$bytes=[Convert]::FromBase64String([string]$Entry.bytesBase64);$stream=[IO.File]::Open($Entry.path,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::Read);try{$stream.Write($bytes,0,$bytes.Length);$stream.Flush($true)}finally{$stream.Dispose()};if((Get-CcodProductFileSha256 $Entry.path)-cne$Entry.sha256){throw 'legacy shortcut restore mismatch'}}
+function Write-CcodLegacyCompensationFailure {param($Record)$local=[Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData);$root=Join-Path $local 'CodexControlOtherDevices\state\legacy-registration-compensation';[IO.Directory]::CreateDirectory($root)|Out-Null;$path=Join-Path $root (([guid]::NewGuid().ToString('D'))+'.json');$bytes=[Text.UTF8Encoding]::new($false).GetBytes(($Record|ConvertTo-Json -Depth 8 -Compress)+"`n");$stream=[IO.File]::Open($path,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::Read);try{$stream.Write($bytes,0,$bytes.Length);$stream.Flush($true)}finally{$stream.Dispose()}}
 
 function Commit-CcodProductRegistration {
     [CmdletBinding()]
@@ -278,9 +283,9 @@ function Commit-CcodProductRegistration {
         Throw-CcodProductRegistrationError 'CCOD_PRODUCT_REGISTRATION_NOT_READY' 'Product registration requires the exact terminal Ready proof.' $Registration.runtimeId
     }
     try {
-        & $adapter.WriteProductRegistration $Registration
-        & $adapter.WriteShortcut 'StartMenu' $Registration.startMenuShortcut $FileTransaction
-        & $adapter.WriteShortcut 'Desktop' $Registration.desktopShortcut $FileTransaction
+        & $adapter.WriteProductRegistration $Registration $ready
+        & $adapter.WriteShortcut 'StartMenu' $Registration.startMenuShortcut $FileTransaction $ready
+        & $adapter.WriteShortcut 'Desktop' $Registration.desktopShortcut $FileTransaction $ready
         $product = & $adapter.ReadProductRegistration $Registration
         $startMenu = & $adapter.ReadShortcut 'StartMenu' $Registration.startMenuShortcut
         $desktop = & $adapter.ReadShortcut 'Desktop' $Registration.desktopShortcut
@@ -321,7 +326,7 @@ function Remove-CcodLegacyProductRegistration {
     $snapshot=&$adapter.ReadLegacySnapshot $ExpectedAppId
     if($null-eq$snapshot-or$snapshot.appId-cne$ExpectedAppId-or@($snapshot.entries).Count-ne9){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy snapshot is incomplete or ambiguous' $ExpectedAppId}
     $removed=[Collections.Generic.List[object]]::new()
-    try{foreach($entry in @($snapshot.entries)){&$adapter.RemoveLegacyEntry $entry;$removed.Add($entry)}}catch{for($index=$removed.Count-1;$index-ge0;$index--){$entry=$removed[$index];try{if($null-eq(&$adapter.ReadLegacyEntry $entry)){&$adapter.RestoreLegacyEntry $entry}}catch{}};Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration failed and exact prior entries were compensated where still absent.' $ExpectedAppId}
+    try{foreach($entry in @($snapshot.entries)){&$adapter.RemoveLegacyEntry $entry;$removed.Add($entry)}}catch{$unresolved=[Collections.Generic.List[string]]::new();for($index=$removed.Count-1;$index-ge0;$index--){$entry=$removed[$index];$name=if($entry-is[string]){[string]$entry}elseif($entry.kind-ceq'Registry'){'Registry'}else{[string]$entry.name};try{if($null-ne(&$adapter.ReadLegacyEntry $entry)){$unresolved.Add($name);continue};&$adapter.RestoreLegacyEntry $entry;if($null-eq(&$adapter.ReadLegacyEntry $entry)){$unresolved.Add($name)}}catch{$unresolved.Add($name)}};if($unresolved.Count-gt0){$record=[pscustomobject][ordered]@{schemaVersion=1;appId=$ExpectedAppId;state='CompensationFailed';entries=@($unresolved);createdAtUtc=[DateTime]::UtcNow.ToString('o',[Globalization.CultureInfo]::InvariantCulture)};try{&$adapter.WriteLegacyCompensationFailure $record}catch{Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED' 'Legacy compensation failure record could not be persisted.' $record};Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED' 'Legacy migration compensation remains unresolved; exact entries were recorded.' $record};Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration failed and the exact prior set was restored.' $ExpectedAppId}
 }
 
 Export-ModuleMember -Function New-CcodProductRegistration,Test-CcodProductRegistration,Commit-CcodProductRegistration,Remove-CcodProductRegistration,Remove-CcodLegacyProductRegistration
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index c2ad124..0649f44 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -149,11 +149,13 @@ Invoke-CcodTest 'exports only immutable generation operations and an inert CLR m
 Invoke-CcodTest 'product registration transaction exposes only a selected retained manifest file capability' {
     $fixture=New-CcodInstallFileFixture
     try{
-        $runtimeId='runtime-product-source';$source=New-CcodSourceFile $fixture 'product-source.lnk' 'sealed shortcut bytes';$generation=Open-CcodFixtureGeneration $fixture $runtimeId;$registration=New-CcodInstallGenerationLeaf -Generation $generation -Leaf 'registration';Copy-CcodInstallSealedSource -Generation $registration -SourcePath $source.Path -Leaf 'StartMenu.CodexRemote-fix.lnk' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null;$manifest=Write-CcodInstallGenerationManifest -Generation $generation -Manifest (New-CcodGenerationManifest $runtimeId @([ordered]@{path='registration/StartMenu.CodexRemote-fix.lnk';length=$source.Length;sha256=$source.Sha256}));Close-CcodInstallFileTransaction -Transaction $generation -Disposition Ready
-        $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install;$fixture.Transactions.Add($product);$retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $product;$file=Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk'
+        $runtimeId='runtime-product-source';$source=New-CcodSourceFile $fixture 'product-source.lnk' 'sealed shortcut bytes';$generation=Open-CcodFixtureGeneration $fixture $runtimeId;$registration=New-CcodInstallGenerationLeaf -Generation $generation -Leaf 'registration';Copy-CcodInstallSealedSource -Generation $registration -SourcePath $source.Path -Leaf 'StartMenu.CodexRemote-fix.lnk' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null;$manifest=Write-CcodInstallGenerationManifest -Generation $generation -Manifest (New-CcodGenerationManifest $runtimeId @([ordered]@{path='registration/StartMenu.CodexRemote-fix.lnk';length=$source.Length;sha256=$source.Sha256}));$pointer=Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $generation -ExpectedPreviousGeneration 0 -FileTransaction $generation;Close-CcodInstallFileTransaction -Transaction $generation -Disposition Ready
+        $ready=[pscustomobject][ordered]@{phase='Ready';runtimeId=$runtimeId;runtimeGeneration=[uint64]1;manifestSha256=$manifest.Sha256;packageSha256=('d'*64)};$transactions=Join-Path $fixture.Install 'state\install-transactions';[IO.Directory]::CreateDirectory($transactions)|Out-Null;[IO.File]::WriteAllText((Join-Path $transactions 'ready.json'),([ordered]@{phase='Ready';newRuntimeId=$runtimeId;newGeneration=[uint64]1;newManifestSha256=$manifest.Sha256;sealedPackageSha256=('d'*64)}|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false));$product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyEvidence $ready;$fixture.Transactions.Add($product);$retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $product;$file=Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyEvidence $ready
         Assert-CcodTrue ($null-ne$file) 'selected manifest file returns an opaque retained source capability'
-        Assert-CcodThrows {Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'C:\outside\arbitrary.lnk'|Out-Null} 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID'
+        Assert-CcodThrows {Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'C:\outside\arbitrary.lnk' -ReadyEvidence $ready|Out-Null} 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID'
         Assert-CcodThrows {New-CcodInstallDirectory -Transaction $product -Parent $product -Leaf 'state' -CreateIfMissing|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
+        $preReady=$ready.PSObject.Copy();$preReady.phase='ProtectionReady';Assert-CcodThrows {Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyEvidence $preReady|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
+        [IO.File]::WriteAllText((Join-Path $fixture.Install 'state\active-generation\00000000000000000002.json'),'{'+'"schemaVersion":1,"generation":2,"activeRuntime":"sibling","previousGeneration":1}',[Text.UTF8Encoding]::new($false));Assert-CcodThrows {Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyEvidence $ready|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
         $state=Open-CcodInstallStateTransaction -InstallRoot $fixture.Install;$fixture.Transactions.Add($state);Assert-CcodThrows {Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $state|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {Open-CcodInstallProductSpecialFolder -Generation $state -Kind Desktop|Out-Null} 'CCOD_INSTALL_PRODUCT_FOLDER_INVALID'
     }finally{Remove-CcodInstallFileFixture $fixture}
 }
diff --git a/tests/persistence/ProductRegistration.SelfTest.ps1 b/tests/persistence/ProductRegistration.SelfTest.ps1
index 27e94be..7015e29 100644
--- a/tests/persistence/ProductRegistration.SelfTest.ps1
+++ b/tests/persistence/ProductRegistration.SelfTest.ps1
@@ -11,6 +11,8 @@ Import-Module $modulePath -Force
 $runtimeId = '2.5.22-1111111111111111-22222222222222222222222222222222'
 $packageSha256 = '3' * 64
 $appId = '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}'
+$canonicalTaskTarget=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'schtasks.exe'))
+$cleanupReady=[pscustomobject][ordered]@{phase='Ready';installRoot='C:\fixture\CodexControlOtherDevices';runtimeId=$runtimeId;runtimeGeneration=[uint64]7;packageSha256=$packageSha256;manifestSha256=('a'*64);startMenuSha256=('b'*64);desktopSha256=('c'*64);targetPath=$canonicalTaskTarget;arguments='/Run /TN "Codex Control Other Devices Supervisor"'}
 
 function New-CcodRegistrationWorld {
     param([string]$InstallRoot = 'C:\fixture\CodexControlOtherDevices')
@@ -24,6 +26,12 @@ function New-CcodRegistrationWorld {
             runtimeId = $runtimeId
             version = '2.5.22'
             packageSha256 = $packageSha256
+            runtimeGeneration = [uint64]7
+            manifestSha256 = 'a'*64
+            startMenuSha256 = 'b'*64
+            desktopSha256 = 'c'*64
+            targetPath = $canonicalTaskTarget
+            arguments = '/Run /TN "Codex Control Other Devices Supervisor"'
             bootstrapPath = $registration.bootstrapPath
             uninstallerPath = $registration.uninstallerPath
         }
@@ -50,12 +58,14 @@ function New-CcodRegistrationWorld {
         LegacyRemoved = $false
         LegacyRemovalCalls = 0
         CurrentProductRemovals = 0
-        CurrentProductState = [pscustomobject]@{valid=$true;reason=$null;entries=@('Registry','StartMenu','Desktop')}
+        CurrentProductState = [pscustomobject]@{valid=$true;reason=$null;readyEvidence=$cleanupReady;entries=@('Registry','StartMenu','Desktop')}
         LegacyEntries = $legacyEntries
         LegacyRemoveFailureAt = 0
         LegacyRemoveAttempts = 0
         LegacyRestores = 0
         LegacyReplacementEntry = $null
+        LegacyRestoreFailureEntry = $null
+        LegacyUnresolvedRecords = [Collections.Generic.List[object]]::new()
         Calls = [Collections.Generic.List[string]]::new()
     }
     $world | Add-Member -NotePropertyName Adapters -NotePropertyValue @{
@@ -92,7 +102,8 @@ function New-CcodRegistrationWorld {
         ReadLegacySnapshot = { param($ExpectedAppId);if($world.Legacy.appId-cne$ExpectedAppId){return [pscustomobject]@{appId=$world.Legacy.appId;entries=@($world.LegacyEntries)}};if(@($world.Legacy.shortcutNames).Count-ne8){return [pscustomobject]@{appId=$ExpectedAppId;entries=@('Unexpected')}};[pscustomobject]@{appId=$ExpectedAppId;entries=@($world.LegacyEntries)} }.GetNewClosure()
         RemoveLegacyEntry = { param($Entry);$world.LegacyRemoveAttempts++;if($world.LegacyRemoveFailureAt-eq$world.LegacyRemoveAttempts){throw 'fixture legacy delete failure'};[void]$world.LegacyEntries.Remove([string]$Entry) }.GetNewClosure()
         ReadLegacyEntry = { param($Entry);if($world.LegacyReplacementEntry-ceq[string]$Entry){return 'Replacement'};if($world.LegacyEntries.Contains([string]$Entry)){[string]$Entry}else{$null} }.GetNewClosure()
-        RestoreLegacyEntry = { param($Entry);if(-not$world.LegacyEntries.Contains([string]$Entry)){$world.LegacyEntries.Add([string]$Entry)};$world.LegacyRestores++ }.GetNewClosure()
+        RestoreLegacyEntry = { param($Entry);if($world.LegacyRestoreFailureEntry-ceq[string]$Entry){throw 'fixture restore failed'};if(-not$world.LegacyEntries.Contains([string]$Entry)){$world.LegacyEntries.Add([string]$Entry)};$world.LegacyRestores++ }.GetNewClosure()
+        WriteLegacyCompensationFailure = {param($Record)$world.LegacyUnresolvedRecords.Add($Record)}.GetNewClosure()
     }
     return $world
 }
@@ -114,6 +125,7 @@ $results += Invoke-CcodTest 'registration performs no writes before an exact Rea
         { param($ready) $ready.runtimeId = '2.5.22-aaaaaaaaaaaaaaaa-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' },
         { param($ready) $ready.version = '2.5.21' },
         { param($ready) $ready.packageSha256 = '4' * 64 },
+        { param($ready) $ready.targetPath = 'C:\outside\task.exe' },
         { param($ready) $ready.bootstrapPath = 'C:\outside\bootstrap.ps1' },
         { param($ready) $ready.uninstallerPath = 'C:\outside\uninstall.ps1' }
     )) {
@@ -192,14 +204,17 @@ $results += Invoke-CcodTest 'legacy migration rejects AppId and shortcut-name mi
 
 # Production mutation caught: deleting a whole product key despite unknown values or mismatched shortcut evidence.
 $results += Invoke-CcodTest 'current product cleanup requires exact registry values and shortcut bytes targets and file identity' {
-    foreach($mutation in @('UnknownRegistryValue','ShortcutHash','ShortcutTarget','ShortcutReparse','Ambiguous')){
+    foreach($mutation in @('UnknownRegistryValue','ShortcutHash','ShortcutTarget','ShortcutReparse','Ambiguous','CoherentReplacement')){
         $world=New-CcodRegistrationWorld;$world.CurrentProductState.valid=$false;$world.CurrentProductState.reason=$mutation
-        Assert-CcodThrows {Remove-CcodProductRegistration -ExpectedRuntimeId $runtimeId -Adapters $world.Adapters} 'CCOD_PRODUCT_CLEANUP_INVALID'
+        Assert-CcodThrows {Remove-CcodProductRegistration -ReadyEvidence $cleanupReady -Adapters $world.Adapters} 'CCOD_PRODUCT_CLEANUP_INVALID'
         Assert-CcodEqual 0 $world.CurrentProductRemovals "$mutation mismatch preserves every current product entry"
     }
     $world=New-CcodRegistrationWorld
-    Remove-CcodProductRegistration -ExpectedRuntimeId $runtimeId -Adapters $world.Adapters
+    Remove-CcodProductRegistration -ReadyEvidence $cleanupReady -Adapters $world.Adapters
     Assert-CcodEqual 3 $world.CurrentProductRemovals 'matched cleanup removes only the exact registry and two shortcut entries'
+    $wrong=$cleanupReady.PSObject.Copy();$wrong.targetPath='C:\outside\task.exe';$world=New-CcodRegistrationWorld;$world.CurrentProductState.readyEvidence=$wrong
+    Assert-CcodThrows {Remove-CcodProductRegistration -ReadyEvidence $wrong -Adapters $world.Adapters} 'CCOD_PRODUCT_CLEANUP_INVALID'
+    Assert-CcodEqual 0 $world.CurrentProductRemovals 'coherent arbitrary target evidence cannot authorize cleanup'
 }
 
 # Production mutation caught: a mid-sequence legacy deletion failure leaves earlier exact entries missing.
@@ -215,9 +230,17 @@ $results += Invoke-CcodTest 'legacy migration restores earlier exact deletions a
 
 $results += Invoke-CcodTest 'legacy compensation never overwrites a replacement that appeared after deletion' {
     $world=New-CcodRegistrationWorld;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;$world.LegacyRemoveFailureAt=4;$world.LegacyReplacementEntry='StartMenu1'
-    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED'
     Assert-CcodEqual 2 $world.LegacyRestores 'compensation restores only entries that remain absent'
     Assert-CcodTrue (-not$world.LegacyEntries.Contains('StartMenu1')) 'replacement occupies the removed name and is not overwritten with captured bytes'
+    Assert-CcodEqual 1 $world.LegacyUnresolvedRecords.Count 'replacement-blocked restoration is recorded explicitly'
+}
+
+$results += Invoke-CcodTest 'legacy restore failure is explicit and records the unresolved exact entries' {
+    $world=New-CcodRegistrationWorld;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;$world.LegacyRemoveFailureAt=4;$world.LegacyRestoreFailureEntry='StartMenu2'
+    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED'
+    Assert-CcodEqual 1 $world.LegacyUnresolvedRecords.Count 'failed compensation writes one explicit unresolved record'
+    Assert-CcodTrue (@($world.LegacyUnresolvedRecords[0].entries)-ccontains'StartMenu2') 'unresolved record names the exact entry whose restoration failed'
 }
 
 Write-Output "Product registration self-tests passed: $($results.Count)"
diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index b1fe2df..941776c 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -21,6 +21,7 @@ function New-CcodUninstallBootstrapContext {
         leaseEpoch = [uint64]11
         userSid = 'S-1-5-21-111-222-333-1001'
         sessionId = 1
+        readyEvidence = [pscustomobject][ordered]@{phase='Ready';installRoot='C:\install';runtimeId='2.5.0-uninstall-test';runtimeGeneration=[uint64]7;packageSha256=('0'*64);manifestSha256=('a'*64);startMenuSha256=('0'*64);desktopSha256=('0'*64);targetPath='C:\Windows\System32\schtasks.exe';arguments='/Run /TN "Codex Control Other Devices Supervisor"'}
         payloadRecords = New-CcodUninstallBootstrapPayloadRecords -ResumeOnly
     }
 }
@@ -40,6 +41,8 @@ function New-CcodUninstallBootstrapTestTransaction {
         leaseEpoch = [uint64]11
         userSid = 'S-1-5-21-111-222-333-1001'
         sessionId = 1
+        readyEvidence = [pscustomobject][ordered]@{phase='Ready';installRoot='C:\install';runtimeId='2.5.0-uninstall-test';runtimeGeneration=[uint64]7;packageSha256=('0'*64);manifestSha256=('a'*64);startMenuSha256=('0'*64);desktopSha256=('0'*64);targetPath='C:\Windows\System32\schtasks.exe';arguments='/Run /TN "Codex Control Other Devices Supervisor"'}
+        installedBinding = $null
         phase = $Phase
         resumePhase = $Phase
         startedAtUtc = '2030-02-03T03:04:05.0000000Z'
@@ -64,6 +67,7 @@ function New-CcodUninstallBootstrapAdapters {
                 leaseEpoch = [uint64]11
                 userSid = 'S-1-5-21-111-222-333-1001'
                 sessionId = 1
+                readyEvidence = [pscustomobject][ordered]@{phase='Ready';installRoot='C:\install';runtimeId='2.5.0-uninstall-test';runtimeGeneration=[uint64]7;packageSha256=('0'*64);manifestSha256=('a'*64);startMenuSha256=('0'*64);desktopSha256=('0'*64);targetPath='C:\Windows\System32\schtasks.exe';arguments='/Run /TN "Codex Control Other Devices Supervisor"'}
                 payloadRecords = New-CcodUninstallBootstrapPayloadRecords -ResumeOnly
             }
         }.GetNewClosure()
@@ -563,39 +567,44 @@ $results += Invoke-CcodTest 'installed Prepare stops at TaskRemoved and external
     $adapters=New-CcodUninstallBootstrapAdapters $world
     $originalCleanup=$adapters.RunCleanup
     $adapters.RunCleanup={param($InstallerRoot,$InstallRoot,$TransactionRoot,$Transaction,$WriteTransaction,$Mode);$world.Calls.Add("Cleanup:$Mode");$Transaction.phase='TaskRemoved';$Transaction.resumePhase='TaskRemoved';&$WriteTransaction $TransactionRoot $Transaction;$Transaction}.GetNewClosure()
-    $prepared=Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\runtime' -InstallRoot 'C:\install' -Mode PrepareInstalled -Adapters $adapters
+    $adapters.GetInstalledBinding={param($InstallerRoot,$InstallRoot,$Context,$WrapperIdentity)[pscustomobject]@{selectedRuntimeRoot='C:\install\runtime\2.5.0-uninstall-test';runtimeManifestSha256=('a'*64);wrapperPid=42;wrapperCreationTimeUtc='2030-02-03T03:04:05.0000000Z';wrapperSessionId=1;wrapperUserSid='S-1-5-21-111-222-333-1001'}}
+    $wrapperIdentity=[pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=1;userSid='S-1-5-21-111-222-333-1001'}
+    $prepared=Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\runtime' -InstallRoot 'C:\install' -Mode PrepareInstalled -WrapperIdentity $wrapperIdentity -Adapters $adapters
     Assert-CcodEqual 'TaskRemoved' $prepared.phase 'installed wrapper retains application state until it exits'
     Assert-CcodEqual 0 $world.ProductRegistrationRemovals 'installed Prepare removes no product state before the external finalizer'
 
     $final=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();WrapperExited=$true;ContextValid=$true;Transaction=$prepared;RootAbsent=$false;Finalized=$false;Deletes=0}
     $finalAdapters=@{
-        WaitWrapperExit={param($Identity,$Timeout)$final.Calls.Add('WaitWrapper');$final.WrapperExited}.GetNewClosure()
+        WaitWrapperExit={param($Identity,$Timeout)$final.Calls.Add('WaitWrapper');[pscustomobject]@{verifiedAtStart=$true;exited=$final.WrapperExited}}.GetNewClosure()
         ReadPreparedTransaction={param($Id)$final.Calls.Add('ReadTransaction');$final.Transaction}.GetNewClosure()
         ValidateSelectedGeneration={param($RuntimeRoot,$InstallRoot,$Transaction)$final.Calls.Add('ValidateGeneration');$final.ContextValid}.GetNewClosure()
-        RemoveMatchedApplicationState={param($RuntimeRoot,$InstallRoot,$Transaction)$final.Calls.Add('RemoveMatched');$final.Deletes++;$final.RootAbsent=$true;$Transaction.phase='ReadyForInno';$Transaction.resumePhase='ReadyForInno';$Transaction}.GetNewClosure()
-        TestInstallRootAbsent={param($Root)$final.Calls.Add('RootAbsent');$final.RootAbsent}.GetNewClosure()
+        ReadCurrentEpoch={param($InstallRoot)[uint64]11}
+        RemoveSelectedGeneration={param($RuntimeRoot,$Transaction)$final.Calls.Add('RemoveSelected');$final.Deletes++;$final.RootAbsent=$true;$Transaction.phase='ReadyForInno';$Transaction.resumePhase='ReadyForInno';$Transaction}.GetNewClosure()
+        TestSelectedRootAbsent={param($Root)$final.Calls.Add('RootAbsent');$final.RootAbsent}.GetNewClosure()
         RemoveMatchedProductRegistration={param($Transaction)$final.Calls.Add('RemoveProduct')}.GetNewClosure()
         FinalizeReceipt={param($Transaction)$final.Calls.Add('Finalize');$final.Finalized=$true;[pscustomobject]@{phase='Completed'}}.GetNewClosure()
     }
-    $receipt=Invoke-CcodInstalledUninstallFinalizer -TransactionId $prepared.transactionId -RuntimeRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -WrapperIdentity ([pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z'}) -Adapters $finalAdapters
+    $receipt=Invoke-CcodInstalledUninstallFinalizer -TransactionId $prepared.transactionId -RuntimeRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -WrapperIdentity $wrapperIdentity -Adapters $finalAdapters
     Assert-CcodEqual 'Completed' $receipt.phase 'external finalizer reaches the completion receipt'
-    Assert-CcodEqual 'WaitWrapper,ReadTransaction,ValidateGeneration,RemoveMatched,RootAbsent,RemoveProduct,Finalize' ($final.Calls -join ',') 'wrapper exit and selected generation proof precede matched removal and finalization'
+    Assert-CcodEqual 'WaitWrapper,ReadTransaction,ValidateGeneration,RemoveSelected,RootAbsent,RemoveProduct,Finalize' ($final.Calls -join ',') 'wrapper exit and selected generation proof precede selected-root removal and finalization'
 }
 
 # Production mutation caught: treating any durable transaction/path/process as authority to delete application state.
 $results += Invoke-CcodTest 'installed finalizer wrong wrapper generation path or transaction performs no deletion' {
-    foreach($kind in @('Wrapper','Generation','Transaction')){
+    foreach($kind in @('Wrapper','Generation','Transaction','Epoch','Sibling')){
         $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Deletes=0}
         $transaction=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved'
+        $transaction.installedBinding=[pscustomobject][ordered]@{selectedRuntimeRoot=$(if($kind-ceq'Sibling'){'C:\install\runtime\sibling'}else{'C:\install\runtime\2.5.0-uninstall-test'});runtimeManifestSha256=('a'*64);wrapperPid=42;wrapperCreationTimeUtc='2030-02-03T03:04:05.0000000Z';wrapperSessionId=1;wrapperUserSid='S-1-5-21-111-222-333-1001'}
         if($kind-ceq'Transaction'){$transaction.transactionId='aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee'}
         $adapters=@{
-            WaitWrapperExit={param($Identity,$Timeout)$kind-cne'Wrapper'}.GetNewClosure()
+            WaitWrapperExit={param($Identity,$Timeout)[pscustomobject]@{verifiedAtStart=($kind-cne'Wrapper');exited=$true}}.GetNewClosure()
             ReadPreparedTransaction={param($Id)$transaction}.GetNewClosure()
             ValidateSelectedGeneration={param($RuntimeRoot,$InstallRoot,$Transaction)$kind-cne'Generation'}.GetNewClosure()
-            RemoveMatchedApplicationState={param($RuntimeRoot,$InstallRoot,$Transaction)$world.Deletes++;$Transaction}.GetNewClosure()
-            TestInstallRootAbsent={param($Root)$false};RemoveMatchedProductRegistration={param($Transaction)};FinalizeReceipt={param($Transaction)[pscustomobject]@{phase='Completed'}}
+            ReadCurrentEpoch={param($InstallRoot)if($kind-ceq'Epoch'){[uint64]12}else{[uint64]11}}.GetNewClosure()
+            RemoveSelectedGeneration={param($RuntimeRoot,$Transaction)$world.Deletes++;$Transaction}.GetNewClosure()
+            TestSelectedRootAbsent={param($Root)$false};RemoveMatchedProductRegistration={param($Transaction)};FinalizeReceipt={param($Transaction)[pscustomobject]@{phase='Completed'}}
         }
-        Assert-CcodThrows {Invoke-CcodInstalledUninstallFinalizer -TransactionId '11111111-2222-3333-4444-555555555555' -RuntimeRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -WrapperIdentity ([pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z'}) -Adapters $adapters|Out-Null} 'CCOD_INSTALLED_FINALIZER_INVALID'
+        Assert-CcodThrows {Invoke-CcodInstalledUninstallFinalizer -TransactionId '11111111-2222-3333-4444-555555555555' -RuntimeRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -WrapperIdentity ([pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=1;userSid='S-1-5-21-111-222-333-1001'}) -Adapters $adapters|Out-Null} 'CCOD_INSTALLED_FINALIZER_INVALID'
         Assert-CcodEqual 0 $world.Deletes "$kind mismatch deletes no application state"
     }
 }

From 2f8ff2f8d0edc401bce23d168b1374815715f18b Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 21:50:11 +0800
Subject: [PATCH 100/187] docs: record Ready-bound product evidence

---
 .../task-4-report.md                          | 57 +++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
index 878d731..7e36c36 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
@@ -175,3 +175,60 @@ transaction plus arbitrary absolute source path.
 
 - `2e76698d535e6e824df1c57d81314be1c2e053e8`
   (`fix: complete matched product lifecycle`).
+
+## Fix round 2: exact Ready-bound finalization and cleanup
+
+Scoped review of `97cf17d..0fdc392` found four Important gaps: installed
+finalization did not durably bind wrapper/manifest/epoch and removed too broad
+a root; coherent registration replacement could self-authorize cleanup;
+product source authority did not require latest selected Ready evidence; and
+legacy restore failures were suppressed.
+
+### RED evidence
+
+- UninstallBootstrap exited `1` with `CCOD_INSTALLED_FINALIZER_INVALID`, target
+  `RemoveSelectedGeneration`, then separately with `NamedParameterNotFound`
+  for `Invoke-CcodUninstallBootstrap -WrapperIdentity`.
+- ProductRegistration exited `1` because `Remove-CcodProductRegistration`
+  lacked `ReadyEvidence`; the fixed `schtasks.exe` negative later failed by not
+  throwing `CCOD_PRODUCT_REGISTRATION_NOT_READY`.
+- InstallFileTransaction exited `1` because
+  `Open-CcodInstallProductRegistrationTransaction` lacked `ReadyEvidence`.
+- ProductRegistration exited `1` with `CCOD_PRODUCT_ADAPTER_INVALID`, target
+  `WriteLegacyCompensationFailure`.
+
+### GREEN evidence
+
+- ProductRegistration: `10/10`, exit `0`.
+- InstallFileTransaction: `27/27`, exit `0`.
+- UninstallBootstrap: `19/19`, exit `0`.
+- InstallLifecycle: `116/116`, exit `0`.
+- Explicit parser checks: `10/10`, zero failures.
+- `git diff --check`: exit `0`; only LF-to-CRLF checkout warnings.
+- Aggregate was not run; no aggregate-pass claim is made.
+
+### Boundaries
+
+- Prepare durably records exact wrapper PID/creation/session/SID, selected
+  runtime root, manifest hash, generation, Ready evidence and lease epoch.
+  Finalizer requires an initially verified wrapper and its later exact exit,
+  current epoch, matching leaf/manifest, and deletes only that generation.
+- Registration and cleanup bind canonical install root, Ready runtime and
+  generation, package/manifest/candidate hashes, exact arguments, and the
+  canonical `%System%\schtasks.exe` target. Coherent arbitrary replacements
+  preserve every entry.
+- Product-only and retained-file capabilities require the latest append-only
+  pointer, matching manifest and one matching Ready install record; pre-Ready,
+  stale/unselected, absolute, state-only and wrong-relative sources fail.
+- Legacy compensation verifies absence before each restore. Replacement or
+  restore failure is never overwritten or swallowed: it writes an explicit
+  unresolved record and returns `CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED`.
+  A normal migration failure is reported only after full restoration.
+
+No real registry, shortcut, uninstall, product process, WindowsApps, DPAPI,
+network, release, push, tag, signing, or publication action was performed.
+
+### Fix implementation commit
+
+- `283ecbe3eb012f1e78377e9336aacc7b3acc9336`
+  (`fix: bind matched product finalization`).

From 67c79d82e18c805f27aec8e05553938f1f706380 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 21:58:28 +0800
Subject: [PATCH 101/187] fix: reject invalid Ready evidence before cleanup

---
 src/persistence/UninstallBootstrap.ps1            | 5 +++--
 tests/persistence/UninstallBootstrap.SelfTest.ps1 | 6 ++++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/persistence/UninstallBootstrap.ps1 b/src/persistence/UninstallBootstrap.ps1
index 1e545f6..1989ba7 100644
--- a/src/persistence/UninstallBootstrap.ps1
+++ b/src/persistence/UninstallBootstrap.ps1
@@ -803,7 +803,7 @@ function Assert-CcodUninstallBootstrapContext {
     }
     [void](ConvertTo-CcodUninstallBootstrapUInt64 $Context.runtimeGeneration 'runtimeGeneration')
     [void](ConvertTo-CcodUninstallBootstrapUInt64 $Context.leaseEpoch 'leaseEpoch')
-    $ready=$Context.readyEvidence;if(-not(Test-CcodUninstallBootstrapExactProperties $ready @('phase','installRoot','runtimeId','runtimeGeneration','packageSha256','manifestSha256','startMenuSha256','desktopSha256','targetPath','arguments'))-or$ready.phase-cne'Ready'-or$ready.installRoot-isnot[string]-or$ready.runtimeId-cne$Context.runtimeId-or[uint64]$ready.runtimeGeneration-ne[uint64]$Context.runtimeGeneration-or$ready.packageSha256-cnotmatch'^[0-9a-f]{64}$'-or$ready.manifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$ready.startMenuSha256-cnotmatch'^[0-9a-f]{64}$'-or$ready.desktopSha256-cnotmatch'^[0-9a-f]{64}$'-or$ready.targetPath-isnot[string]-or$ready.arguments-cne'/Run /TN "Codex Control Other Devices Supervisor"'){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'Ready cleanup evidence is invalid' $ready}
+    $ready=$Context.readyEvidence;$canonicalTarget=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'schtasks.exe'));if(-not(Test-CcodUninstallBootstrapExactProperties $ready @('phase','installRoot','runtimeId','runtimeGeneration','packageSha256','manifestSha256','startMenuSha256','desktopSha256','targetPath','arguments'))-or$ready.phase-cne'Ready'-or$ready.installRoot-isnot[string]-or$ready.runtimeId-cne$Context.runtimeId-or[uint64]$ready.runtimeGeneration-ne[uint64]$Context.runtimeGeneration-or$ready.packageSha256-cnotmatch'^[0-9a-f]{64}$'-or$ready.manifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$ready.startMenuSha256-cnotmatch'^[0-9a-f]{64}$'-or$ready.desktopSha256-cnotmatch'^[0-9a-f]{64}$'-or$ready.targetPath-isnot[string]-or[IO.Path]::GetFullPath([string]$ready.targetPath)-ine$canonicalTarget-or$ready.arguments-cne'/Run /TN "Codex Control Other Devices Supervisor"'){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'Ready cleanup evidence is invalid' $ready}
     $records = @($Context.payloadRecords)
     if ($records.Count -ne $script:CcodUninstallPayloadEntries.Count) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'The cleanup payload record set is incomplete' $Context }
     for ($index = 0; $index -lt $records.Count; $index++) {
@@ -835,7 +835,7 @@ function Assert-CcodUninstallBootstrapTransaction {
     }
     [void](ConvertTo-CcodUninstallBootstrapUInt64 $Transaction.runtimeGeneration 'runtimeGeneration')
     [void](ConvertTo-CcodUninstallBootstrapUInt64 $Transaction.leaseEpoch 'leaseEpoch')
-    if($null-eq$Transaction.readyEvidence-or$Transaction.readyEvidence.runtimeId-cne$Transaction.runtimeId-or[uint64]$Transaction.readyEvidence.runtimeGeneration-ne[uint64]$Transaction.runtimeGeneration){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_INVALID' 'Ready transaction evidence is missing or mismatched' $Transaction.readyEvidence}
+    $transactionReady=$Transaction.readyEvidence;$canonicalTaskTarget=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'schtasks.exe'));if($null-eq$transactionReady-or$transactionReady.phase-cne'Ready'-or$transactionReady.installRoot-isnot[string]-or-not[IO.Path]::IsPathRooted($transactionReady.installRoot)-or$transactionReady.runtimeId-cne$Transaction.runtimeId-or[uint64]$transactionReady.runtimeGeneration-ne[uint64]$Transaction.runtimeGeneration-or$transactionReady.packageSha256-cnotmatch'^[0-9a-f]{64}$'-or$transactionReady.manifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$transactionReady.startMenuSha256-cnotmatch'^[0-9a-f]{64}$'-or$transactionReady.desktopSha256-cnotmatch'^[0-9a-f]{64}$'-or$transactionReady.targetPath-isnot[string]-or[IO.Path]::GetFullPath([string]$transactionReady.targetPath)-ine$canonicalTaskTarget-or$transactionReady.arguments-cne'/Run /TN "Codex Control Other Devices Supervisor"'){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_INVALID' 'Ready transaction evidence is missing or mismatched' $transactionReady}
     if($null-ne$Transaction.installedBinding){$binding=$Transaction.installedBinding;if(-not(Test-CcodUninstallBootstrapExactProperties $binding @('selectedRuntimeRoot','runtimeManifestSha256','wrapperPid','wrapperCreationTimeUtc','wrapperSessionId','wrapperUserSid'))-or$binding.selectedRuntimeRoot-isnot[string]-or-not[IO.Path]::IsPathRooted($binding.selectedRuntimeRoot)-or$binding.runtimeManifestSha256-isnot[string]-or$binding.runtimeManifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$binding.wrapperPid-isnot[int]-or$binding.wrapperPid-lt1-or-not(Test-CcodUninstallBootstrapCanonicalUtc $binding.wrapperCreationTimeUtc)-or$binding.wrapperSessionId-isnot[int]-or$binding.wrapperSessionId-lt0-or$binding.wrapperUserSid-isnot[string]-or$binding.wrapperUserSid-cnotmatch'^S-'){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_INVALID' 'Installed finalization binding is invalid' $binding}}
     $started = [DateTime]::ParseExact($Transaction.startedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
     $updated = [DateTime]::ParseExact($Transaction.updatedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
@@ -1035,6 +1035,7 @@ function Invoke-CcodUninstallBootstrap {
             Assert-CcodUninstallBootstrapContext $context
         } catch {
             $validationFailure = $_
+            $context = $null
         }
         $transactionRoot = & $adapter.GetTransactionRoot
         $identity = if ($null -ne $context) {
diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index 941776c..5b83382 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -609,5 +609,11 @@ $results += Invoke-CcodTest 'installed finalizer wrong wrapper generation path o
     }
 }
 
+$results += Invoke-CcodTest 'noncanonical Ready shortcut target is rejected before uninstall cleanup' {
+    $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=$null;Receipt=$null;ValidationError=$false;StageError=$false;CleanupError=$false;CleanupFailurePhase=$null;InstallRootAbsent=$false;StagedEntries=@();ProductRegistrationRemovals=0};$adapters=New-CcodUninstallBootstrapAdapters $world;$context=New-CcodUninstallBootstrapContext;$context.readyEvidence.targetPath='C:\outside\task.exe';$adapters.ValidateInvocation={param($InstallerRoot,$InstallRoot)$context}.GetNewClosure()
+    Assert-CcodThrows {Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\runtime' -InstallRoot 'C:\install' -Mode Prepare -Adapters $adapters|Out-Null} 'CCOD_UNINSTALL_BOOTSTRAP_INVALID'
+    Assert-CcodEqual 0 @($world.Calls|Where-Object{$_-ceq'Cleanup'}).Count 'invalid target evidence reaches no cleanup deletion'
+}
+
 $results | ForEach-Object { "PASS $($_.Name)" }
 Write-Output "Uninstall bootstrap self-tests passed: $($results.Count)"

From 7c333e09d97262cdab6fdc82232636b0733a0183 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 21:59:25 +0800
Subject: [PATCH 102/187] docs: record pre-cleanup Ready gate evidence

---
 .../task-4-report.md                                 | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
index 7e36c36..b879f27 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
@@ -232,3 +232,15 @@ network, release, push, tag, signing, or publication action was performed.
 
 - `283ecbe3eb012f1e78377e9336aacc7b3acc9336`
   (`fix: bind matched product finalization`).
+
+### Supplemental pre-cleanup target gate
+
+Final pre-commit audit added a noncanonical Ready target negative. Its RED
+returned the expected validation error but observed `Cleanup=1`: validation
+failure was captured without clearing the fresh context. The fix clears every
+failed fresh context, validates the same canonical Ready invariant on stored
+resume transactions, and rejects before cleanup. Fresh UninstallBootstrap is
+`20/20`, exit `0`; focused parser `4/4` and diff check exit `0`.
+
+- Supplemental commit: `67c79d82e18c805f27aec8e05553938f1f706380`
+  (`fix: reject invalid Ready evidence before cleanup`).

From 1ff17bb8759e3d5312c11336ca3b2188bb3a4fe2 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 22:48:13 +0800
Subject: [PATCH 103/187] fix: enforce strict retained product authority

---
 src/persistence/modules/InstallFileTransaction.psm1   |  4 ++--
 src/persistence/modules/InstallLifecycle.psm1         |  4 ++--
 src/persistence/modules/ProductRegistration.psm1      | 10 +++++-----
 tests/persistence/InstallFileTransaction.SelfTest.ps1 |  8 ++++----
 tests/persistence/ProductRegistration.SelfTest.ps1    | 10 +++++++++-
 tests/persistence/UninstallBootstrap.SelfTest.ps1     |  7 +++++++
 6 files changed, 29 insertions(+), 14 deletions(-)

diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index b58b62d..08775ad 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -365,9 +365,9 @@ function Open-CcodInstallGeneration {
     $runtime=$arguments[2];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$RuntimeId;RootToken=$token;StateOnly=$false;ProductOnly=$false;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='Generation';ReadOnly=$false;RuntimeId=$RuntimeId});$transaction
 }
 function Open-CcodInstallStateTransaction { param([Parameter(Mandatory)][string]$InstallRoot) Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenState $arguments} 'CCOD_INSTALL_STATE_TRANSACTION_INVALID';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$null;RootToken=$token;StateOnly=$true;ProductOnly=$false;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='StateTransaction';ReadOnly=$false;RuntimeId=$null});$transaction }
-function Open-CcodInstallProductRegistrationTransaction {param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$ReadyEvidence)Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$properties=@($ReadyEvidence.PSObject.Properties);$names=@('phase','runtimeId','runtimeGeneration','manifestSha256','packageSha256');if($properties.Count-ne$names.Count-or(@($properties.Name)-join'|')-cne($names-join'|')-or$ReadyEvidence.phase-cne'Ready'-or$ReadyEvidence.runtimeId-isnot[string]-or[uint64]$ReadyEvidence.runtimeGeneration-lt1-or$ReadyEvidence.manifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.packageSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Product transaction requires exact Ready evidence' $ReadyEvidence};$root=[IO.Path]::GetFullPath($InstallRoot);$pointerRoot=Join-Path $root 'state\active-generation';$pointerLeaves=@(Get-ChildItem -LiteralPath $pointerRoot -File -Force -ErrorAction Stop|Sort-Object Name);if($pointerLeaves.Count-eq0-or$pointerLeaves[-1].Name-cne('{0:D20}.json'-f[uint64]$ReadyEvidence.runtimeGeneration)){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Ready evidence is not the latest selected generation' $ReadyEvidence};$pointerPath=Join-Path $root ('state\active-generation\{0:D20}.json'-f[uint64]$ReadyEvidence.runtimeGeneration);$manifestPath=Join-Path (Join-Path (Join-Path $root 'runtime') $ReadyEvidence.runtimeId) 'manifest.json';try{$pointer=Get-Content -LiteralPath $pointerPath -Raw -ErrorAction Stop|ConvertFrom-Json -ErrorAction Stop;if([string]$pointer.activeRuntime-cne[string]$ReadyEvidence.runtimeId-or[uint64]$pointer.generation-ne[uint64]$ReadyEvidence.runtimeGeneration-or(Get-FileHash -LiteralPath $manifestPath -Algorithm SHA256 -ErrorAction Stop).Hash.ToLowerInvariant()-cne[string]$ReadyEvidence.manifestSha256){throw 'selected pointer or manifest mismatch'};$matches=@();foreach($file in @(Get-ChildItem -LiteralPath (Join-Path $root 'state\install-transactions') -File -Force -ErrorAction Stop)){try{$record=Get-Content -LiteralPath $file.FullName -Raw -ErrorAction Stop|ConvertFrom-Json -ErrorAction Stop;if($record.phase-ceq'Ready'-and$record.newRuntimeId-ceq$ReadyEvidence.runtimeId-and[uint64]$record.newGeneration-eq[uint64]$ReadyEvidence.runtimeGeneration-and$record.newManifestSha256-ceq$ReadyEvidence.manifestSha256-and$record.sealedPackageSha256-ceq$ReadyEvidence.packageSha256){$matches+=,$record}}catch{throw}};if($matches.Count-ne1){throw 'matching Ready record missing or ambiguous'}}catch{Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Selected pointer manifest and Ready record could not be proven' $ReadyEvidence};$arguments=[object[]]@($root,$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenProduct $arguments} 'CCOD_INSTALL_PRODUCT_SCOPE';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=$root.TrimEnd('\');RuntimeId=$ReadyEvidence.runtimeId;RootToken=$token;StateOnly=$false;ProductOnly=$true;ReadyEvidence=$ReadyEvidence;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='ProductTransaction';ReadOnly=$true;RuntimeId=$ReadyEvidence.runtimeId});$transaction}
+function Open-CcodInstallProductRegistrationTransaction {param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$ReadyTransaction)$strictNames=@('schemaVersion','transactionId','oldRuntimeId','oldGeneration','oldManifestSha256','newRuntimeId','newGeneration','newManifestSha256','sealedPackageSha256','ownedObjectNames','phase','errorCode');if((@($ReadyTransaction.PSObject.Properties.Name)-join'|')-cne($strictNames-join'|')){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Complete Ready transaction identity is required' $ReadyTransaction};$ReadyEvidence=[pscustomobject][ordered]@{phase=$ReadyTransaction.phase;runtimeId=$ReadyTransaction.newRuntimeId;runtimeGeneration=[uint64]$ReadyTransaction.newGeneration;manifestSha256=$ReadyTransaction.newManifestSha256;packageSha256=$ReadyTransaction.sealedPackageSha256};Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$properties=@($ReadyEvidence.PSObject.Properties);$names=@('phase','runtimeId','runtimeGeneration','manifestSha256','packageSha256');if($properties.Count-ne$names.Count-or(@($properties.Name)-join'|')-cne($names-join'|')-or$ReadyEvidence.phase-cne'Ready'-or$ReadyEvidence.runtimeId-isnot[string]-or[uint64]$ReadyEvidence.runtimeGeneration-lt1-or$ReadyEvidence.manifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.packageSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Product transaction requires exact Ready evidence' $ReadyEvidence};$root=[IO.Path]::GetFullPath($InstallRoot);$pointerRoot=Join-Path $root 'state\active-generation';$pointerLeaves=@(Get-ChildItem -LiteralPath $pointerRoot -File -Force -ErrorAction Stop|Sort-Object Name);if($pointerLeaves.Count-eq0-or$pointerLeaves[-1].Name-cne('{0:D20}.json'-f[uint64]$ReadyEvidence.runtimeGeneration)){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Ready evidence is not the latest selected generation' $ReadyEvidence};$pointerPath=Join-Path $root ('state\active-generation\{0:D20}.json'-f[uint64]$ReadyEvidence.runtimeGeneration);$manifestPath=Join-Path (Join-Path (Join-Path $root 'runtime') $ReadyEvidence.runtimeId) 'manifest.json';try{$pointer=Get-Content -LiteralPath $pointerPath -Raw -ErrorAction Stop|ConvertFrom-Json -ErrorAction Stop;if([string]$pointer.activeRuntime-cne[string]$ReadyEvidence.runtimeId-or[uint64]$pointer.generation-ne[uint64]$ReadyEvidence.runtimeGeneration-or(Get-FileHash -LiteralPath $manifestPath -Algorithm SHA256 -ErrorAction Stop).Hash.ToLowerInvariant()-cne[string]$ReadyEvidence.manifestSha256){throw 'selected pointer or manifest mismatch'};$matches=@();foreach($file in @(Get-ChildItem -LiteralPath (Join-Path $root 'state\install-transactions') -File -Force -ErrorAction Stop)){try{$record=Get-Content -LiteralPath $file.FullName -Raw -ErrorAction Stop|ConvertFrom-Json -ErrorAction Stop;$recordNames=@($record.PSObject.Properties.Name);$strictNames=@('schemaVersion','transactionId','oldRuntimeId','oldGeneration','oldManifestSha256','newRuntimeId','newGeneration','newManifestSha256','sealedPackageSha256','ownedObjectNames','phase','errorCode');if(($recordNames-join'|')-cne($strictNames-join'|')){throw 'noncanonical transaction record'};if($record.phase-ceq'Ready'-and$record.newRuntimeId-ceq$ReadyEvidence.runtimeId-and[uint64]$record.newGeneration-eq[uint64]$ReadyEvidence.runtimeGeneration-and$record.newManifestSha256-ceq$ReadyEvidence.manifestSha256-and$record.sealedPackageSha256-ceq$ReadyEvidence.packageSha256){$matches+=,$record}}catch{throw}};if($matches.Count-ne1){throw 'matching Ready record missing or ambiguous'}}catch{Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Selected pointer manifest and Ready record could not be proven' $ReadyEvidence};$arguments=[object[]]@($root,$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenProduct $arguments} 'CCOD_INSTALL_PRODUCT_SCOPE';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=$root.TrimEnd('\');RuntimeId=$ReadyEvidence.runtimeId;RootToken=$token;StateOnly=$false;ProductOnly=$true;ReadyEvidence=$ReadyEvidence;ReadyCanonical=($ReadyTransaction|ConvertTo-Json -Depth 8 -Compress);Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='ProductTransaction';ReadOnly=$true;RuntimeId=$ReadyEvidence.runtimeId});$transaction}
 function Open-CcodInstallRetainedGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)][string]$ExpectedManifestSha256,[Parameter(Mandatory)]$FileTransaction) if(-not[IO.Path]::IsPathRooted($InstallRoot)-or$ExpectedManifestSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_GENERATION_INVALID' 'Invalid retained generation contract' $RuntimeId};Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';if(-not[object]::ReferenceEquals($scope.Record.Transaction,$FileTransaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'FileTransaction must be the transaction root capability' $null};Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$nativeResult=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetained @($RuntimeId,$ExpectedManifestSha256)} 'CCOD_INSTALL_RETAINED_GENERATION_INVALID';if(@($nativeResult).Count-ne 2-or-not(Test-CcodRetainedManifestIdentity ([string]$nativeResult[1]) $RuntimeId)){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH' 'Retained manifest must contain exactly one matching top-level runtimeId string' $RuntimeId};Add-CcodInstallScope $scope.Record.Transaction $nativeResult[0] Generation $true $RuntimeId }
-function Open-CcodInstallRetainedFile {param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$RelativePath,[Parameter(Mandatory)]$ReadyEvidence)if($RelativePath-cnotin@('registration/StartMenu.CodexRemote-fix.lnk','registration/Desktop.CodexRemote-fix.lnk')){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Product shortcut source must be one fixed manifest-relative candidate' $RelativePath};$scope=Get-CcodInstallTransaction $Generation 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';if($ReadyEvidence.phase-cne'Ready'-or$ReadyEvidence.runtimeId-cne$scope.Record.RuntimeId-or[uint64]$ReadyEvidence.runtimeGeneration-lt1-or$ReadyEvidence.manifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.packageSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Retained shortcut source lacks exact Ready selection evidence' $ReadyEvidence};$root=$scope.State.InstallRoot;$pointer=Get-Content -LiteralPath (Join-Path $root ('state\active-generation\{0:D20}.json'-f[uint64]$ReadyEvidence.runtimeGeneration)) -Raw -ErrorAction Stop|ConvertFrom-Json -ErrorAction Stop;if($pointer.activeRuntime-cne$ReadyEvidence.runtimeId-or[uint64]$pointer.generation-ne[uint64]$ReadyEvidence.runtimeGeneration){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Retained shortcut source is not selected' $ReadyEvidence};$result=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetainedFile @($scope.Record.Token,$RelativePath)} 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';if(@($result).Count-ne3-or[int64]$result[1]-lt0-or[string]$result[2]-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Retained product shortcut identity is invalid' $RelativePath};Add-CcodInstallScope $scope.Record.Transaction $result[0] RetainedFile $true $scope.Record.RuntimeId}
+function Open-CcodInstallRetainedFile {param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$RelativePath,[Parameter(Mandatory)]$ReadyTransaction)$canonical=$ReadyTransaction|ConvertTo-Json -Depth 8 -Compress;$ReadyEvidence=[pscustomobject][ordered]@{phase=$ReadyTransaction.phase;runtimeId=$ReadyTransaction.newRuntimeId;runtimeGeneration=[uint64]$ReadyTransaction.newGeneration;manifestSha256=$ReadyTransaction.newManifestSha256;packageSha256=$ReadyTransaction.sealedPackageSha256};if($RelativePath-cnotin@('registration/StartMenu.CodexRemote-fix.lnk','registration/Desktop.CodexRemote-fix.lnk')){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Product shortcut source must be one fixed manifest-relative candidate' $RelativePath};$scope=Get-CcodInstallTransaction $Generation 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';if($scope.State.ReadyCanonical-cne$canonical-or$ReadyEvidence.phase-cne'Ready'-or$ReadyEvidence.runtimeId-cne$scope.Record.RuntimeId-or[uint64]$ReadyEvidence.runtimeGeneration-lt1-or$ReadyEvidence.manifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.packageSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Retained shortcut source lacks exact Ready selection evidence' $ReadyEvidence};$root=$scope.State.InstallRoot;$pointer=Get-Content -LiteralPath (Join-Path $root ('state\active-generation\{0:D20}.json'-f[uint64]$ReadyEvidence.runtimeGeneration)) -Raw -ErrorAction Stop|ConvertFrom-Json -ErrorAction Stop;if($pointer.activeRuntime-cne$ReadyEvidence.runtimeId-or[uint64]$pointer.generation-ne[uint64]$ReadyEvidence.runtimeGeneration){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Retained shortcut source is not selected' $ReadyEvidence};$result=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetainedFile @($scope.Record.Token,$RelativePath)} 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';if(@($result).Count-ne3-or[int64]$result[1]-lt0-or[string]$result[2]-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Retained product shortcut identity is invalid' $RelativePath};Add-CcodInstallScope $scope.Record.Transaction $result[0] RetainedFile $true $scope.Record.RuntimeId}
 function New-CcodInstallDirectory { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$Parent,[Parameter(Mandatory)][string]$Leaf,[switch]$CreateIfMissing) Assert-CcodInstallLeaf $Leaf;$transactionScope=Get-CcodInstallTransaction $Transaction 'CCOD_INSTALL_TRANSACTION_INVALID';if(-not[object]::ReferenceEquals($transactionScope.Record.Transaction,$Transaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Transaction capability must be the transaction root' $null};if([object]::ReferenceEquals($Parent,$Transaction)){$token=Invoke-CcodRuntimeMethod $transactionScope.State.Runtime GetInstallRoot @();$parentScope=[pscustomobject]@{State=$transactionScope.State;Record=[pscustomobject]@{Transaction=$Transaction;Token=$token;Kind='Directory';ReadOnly=$false;RuntimeId=$null}}}else{$parentScope=Get-CcodInstallScopedDirectory $Transaction $Parent};Assert-CcodInstallWritableScope $parentScope;$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $parentScope.State.Runtime OpenDirectory @($parentScope.Record.Token,$Leaf,[bool]$CreateIfMissing)} 'CCOD_INSTALL_DIRECTORY_OPEN_FAILED';$readOnly=[bool](Invoke-CcodRuntimeMethod $parentScope.State.Runtime IsRetained @($token));Add-CcodInstallScope $Transaction $token Directory $readOnly $(if($readOnly){$parentScope.Record.RuntimeId}else{$null}) }
 function New-CcodInstallGenerationLeaf { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$Leaf) Assert-CcodInstallLeaf $Leaf;$scope=Get-CcodInstallTransaction $Generation;Assert-CcodInstallWritableScope $scope;if($scope.State.StateOnly){Throw-CcodInstallFileError 'CCOD_INSTALL_STATE_SCOPE' 'State-only transaction cannot create a generation leaf' $Leaf};$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CreateDirectory @($scope.Record.Token,$Leaf)} 'CCOD_INSTALL_LEAF_CREATE_FAILED';Add-CcodInstallScope $scope.Record.Transaction $token Directory $scope.Record.ReadOnly $scope.Record.RuntimeId }
 function Copy-CcodInstallSealedSource { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$SourcePath,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)][int64]$ExpectedLength,[Parameter(Mandatory)][string]$ExpectedSha256) Assert-CcodInstallLeaf $Leaf;if(-not[IO.Path]::IsPathRooted($SourcePath)-or$ExpectedLength-lt 0-or$ExpectedSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Invalid sealed source contract' $SourcePath};$scope=Get-CcodInstallTransaction $Generation;Assert-CcodInstallWritableScope $scope;$result=[pscustomobject]@{Length=$ExpectedLength;Sha256=$ExpectedSha256};Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Copy @($scope.Record.Token,$Leaf,[IO.Path]::GetFullPath($SourcePath),$ExpectedLength,$ExpectedSha256)|Out-Null} 'CCOD_INSTALL_SOURCE_MISMATCH';return $result }
diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index dd3745a..b06af5c 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -1954,9 +1954,9 @@ function Get-CcodLifecycleAdapters {
             $module=Import-Module (Join-Path $PSScriptRoot 'ProductRegistration.psm1') -Force -PassThru -ErrorAction Stop
             $ownedTransaction=$null;$sourceCapability=$FileTransaction
             try{
-                if($null-eq$sourceCapability){Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop;$fileReady=[pscustomobject][ordered]@{phase='Ready';runtimeId=$RuntimeId;runtimeGeneration=[uint64]$TransactionRecord.newGeneration;manifestSha256=[string]$TransactionRecord.newManifestSha256;packageSha256=$PackageSha256};$ownedTransaction=Open-CcodInstallProductRegistrationTransaction -InstallRoot $InstallRoot -ReadyEvidence $fileReady;$sourceCapability=Open-CcodInstallRetainedGeneration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -ExpectedManifestSha256 ([string]$TransactionRecord.newManifestSha256) -FileTransaction $ownedTransaction}
+                if($null-eq$sourceCapability){Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop;$fileReady=[pscustomobject][ordered]@{phase='Ready';runtimeId=$RuntimeId;runtimeGeneration=[uint64]$TransactionRecord.newGeneration;manifestSha256=[string]$TransactionRecord.newManifestSha256;packageSha256=$PackageSha256};$ownedTransaction=Open-CcodInstallProductRegistrationTransaction -InstallRoot $InstallRoot -ReadyTransaction $TransactionRecord;$sourceCapability=Open-CcodInstallRetainedGeneration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -ExpectedManifestSha256 ([string]$TransactionRecord.newManifestSha256) -FileTransaction $ownedTransaction}
                 $registration=New-CcodProductRegistration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -Version $Version -PackageSha256 $PackageSha256 -FileTransaction $sourceCapability
-                $system=[Environment]::GetFolderPath([Environment+SpecialFolder]::System);$proof=[pscustomobject][ordered]@{phase=[string]$TransactionRecord.phase;runtimeId=$RuntimeId;version=$Version;packageSha256=$PackageSha256;runtimeGeneration=[uint64]$TransactionRecord.newGeneration;manifestSha256=[string]$TransactionRecord.newManifestSha256;startMenuSha256=(Get-CcodLifecycleFileSha256 $registration.startMenuShortcut.candidatePath);desktopSha256=(Get-CcodLifecycleFileSha256 $registration.desktopShortcut.candidatePath);targetPath=[IO.Path]::GetFullPath((Join-Path $system 'schtasks.exe'));arguments='/Run /TN "Codex Control Other Devices Supervisor"';bootstrapPath=$registration.bootstrapPath;uninstallerPath=$registration.uninstallerPath}
+                $system=[Environment]::GetFolderPath([Environment+SpecialFolder]::System);$proof=[pscustomobject][ordered]@{phase=[string]$TransactionRecord.phase;runtimeId=$RuntimeId;version=$Version;packageSha256=$PackageSha256;runtimeGeneration=[uint64]$TransactionRecord.newGeneration;manifestSha256=[string]$TransactionRecord.newManifestSha256;startMenuSha256=(Get-CcodLifecycleFileSha256 $registration.startMenuShortcut.candidatePath);desktopSha256=(Get-CcodLifecycleFileSha256 $registration.desktopShortcut.candidatePath);targetPath=[IO.Path]::GetFullPath((Join-Path $system 'schtasks.exe'));arguments='/Run /TN "Codex Control Other Devices Supervisor"';transactionRecord=$TransactionRecord;bootstrapPath=$registration.bootstrapPath;uninstallerPath=$registration.uninstallerPath}
                 $receipt=Commit-CcodProductRegistration -Registration $registration -FileTransaction $sourceCapability -Adapters @{GetReadyProof={param($Ignored)$proof}.GetNewClosure()}
                 Remove-CcodLegacyProductRegistration -ExpectedAppId '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}'
                 [pscustomobject]@{verified=[bool]$receipt.verified;legacyRemoved=$true}
diff --git a/src/persistence/modules/ProductRegistration.psm1 b/src/persistence/modules/ProductRegistration.psm1
index 3de4b65..ee3f7bc 100644
--- a/src/persistence/modules/ProductRegistration.psm1
+++ b/src/persistence/modules/ProductRegistration.psm1
@@ -8,7 +8,7 @@ $script:CcodProductFields = @(
     'productKeyName','startMenuShortcut','desktopShortcut'
 )
 $script:CcodShortcutFields = @('kind','leaf','relativePath','candidatePath','bootstrapPath','installRoot')
-$script:CcodReadyFields = @('phase','runtimeId','version','packageSha256','runtimeGeneration','manifestSha256','startMenuSha256','desktopSha256','targetPath','arguments','bootstrapPath','uninstallerPath')
+$script:CcodReadyFields = @('phase','runtimeId','version','packageSha256','runtimeGeneration','manifestSha256','startMenuSha256','desktopSha256','targetPath','arguments','transactionRecord','bootstrapPath','uninstallerPath')
 $script:CcodLegacyShortcutNames = @(
     'Programs\Codex Control other devices\Codex Control other devices for Windows.lnk',
     'Programs\Codex Control other devices\Open the tray supervisor.lnk',
@@ -125,7 +125,7 @@ function Test-CcodProductReadyProof {
         $Proof.runtimeId -is [string] -and [string]$Proof.runtimeId -ceq [string]$Registration.runtimeId -and
         $Proof.version -is [string] -and [string]$Proof.version -ceq [string]$Registration.version -and
         $Proof.packageSha256 -is [string] -and [string]$Proof.packageSha256 -ceq [string]$Registration.packageSha256 -and
-        [uint64]$Proof.runtimeGeneration -gt 0 -and $Proof.manifestSha256 -cmatch '^[0-9a-f]{64}$' -and $Proof.startMenuSha256 -cmatch '^[0-9a-f]{64}$' -and $Proof.desktopSha256 -cmatch '^[0-9a-f]{64}$' -and $Proof.targetPath -is [string] -and [IO.Path]::GetFullPath([string]$Proof.targetPath) -ceq $canonicalTarget -and $Proof.arguments -ceq '/Run /TN "Codex Control Other Devices Supervisor"' -and
+        [uint64]$Proof.runtimeGeneration -gt 0 -and $Proof.manifestSha256 -cmatch '^[0-9a-f]{64}$' -and $Proof.startMenuSha256 -cmatch '^[0-9a-f]{64}$' -and $Proof.desktopSha256 -cmatch '^[0-9a-f]{64}$' -and $Proof.targetPath -is [string] -and [IO.Path]::GetFullPath([string]$Proof.targetPath) -ceq $canonicalTarget -and $Proof.arguments -ceq '/Run /TN "Codex Control Other Devices Supervisor"' -and $null-ne$Proof.transactionRecord -and $Proof.transactionRecord.phase-ceq'Ready' -and $Proof.transactionRecord.newRuntimeId-ceq$Proof.runtimeId -and
         $Proof.bootstrapPath -is [string] -and [string]$Proof.bootstrapPath -ceq [string]$Registration.bootstrapPath -and
         $Proof.uninstallerPath -is [string] -and [string]$Proof.uninstallerPath -ceq [string]$Registration.uninstallerPath
 }
@@ -208,7 +208,7 @@ function Write-CcodCurrentUserProductShortcut {
     param([string]$Kind,$Shortcut,$FileTransaction,$ReadyEvidence)
     Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop
     $relative='registration/'+$(if($Kind-ceq'StartMenu'){'StartMenu.CodexRemote-fix.lnk'}else{'Desktop.CodexRemote-fix.lnk'})
-    $fileReady=[pscustomobject][ordered]@{phase='Ready';runtimeId=[string]$ReadyEvidence.runtimeId;runtimeGeneration=[uint64]$ReadyEvidence.runtimeGeneration;manifestSha256=[string]$ReadyEvidence.manifestSha256;packageSha256=[string]$ReadyEvidence.packageSha256};$source=Open-CcodInstallRetainedFile -Generation $FileTransaction -RelativePath $relative -ReadyEvidence $fileReady
+    $source=Open-CcodInstallRetainedFile -Generation $FileTransaction -RelativePath $relative -ReadyTransaction $ReadyEvidence.transactionRecord
     $folder=Open-CcodInstallProductSpecialFolder -Generation $FileTransaction -Kind $Kind
     Copy-CcodInstallProductShortcut -Folder $folder -Source $source -Kind $Kind -Leaf 'CodexRemote-fix.lnk'|Out-Null
 }
@@ -248,7 +248,7 @@ function Read-CcodCurrentProductState {
     param([string]$ExpectedRuntimeId)
     try{
         $subkey='Software\Microsoft\Windows\CurrentVersion\Uninstall\CodexRemote-fix';$key=[Microsoft.Win32.Registry]::CurrentUser.OpenSubKey($subkey,$false);if($null-eq$key){return [pscustomobject]@{valid=$true;reason=$null;entries=@()}}
-        try{$allowed=@('CcodDesktopSha256','CcodPackageSha256','CcodRuntimeId','CcodRuntimeGeneration','CcodManifestSha256','CcodShortcutArguments','CcodShortcutTarget','CcodStartMenuSha256','DisplayName','DisplayVersion','InstallLocation','NoModify','NoRepair','Publisher','QuietUninstallString','UninstallString');$names=@($key.GetValueNames()|Sort-Object);if(($names-join'|')-cne(($allowed|Sort-Object)-join'|')){return [pscustomobject]@{valid=$false;reason='UnknownRegistryValue';entries=@()}};$runtime=[string]$key.GetValue('CcodRuntimeId',$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);$installLocation=[string]$key.GetValue('InstallLocation');$expectedUninstaller=Join-Path $installLocation 'Uninstall-CodexControlOtherDevices.ps1';$expectedCommand='"{0}" -NoProfile -ExecutionPolicy Bypass -File "{1}"'-f(Get-CcodProductPowerShellPath),$expectedUninstaller;if($runtime-cne$ExpectedRuntimeId-or$installLocation-cne[IO.Path]::GetFullPath((Join-Path (Join-Path (Split-Path (Split-Path $installLocation -Parent) -Parent) 'runtime') $runtime))-or[string]$key.GetValue('DisplayName')-cne'CodexRemote-fix'-or[string]$key.GetValue('DisplayVersion')-cne'2.5.22'-or[string]$key.GetValue('Publisher')-cne'naipi11'-or[string]$key.GetValue('UninstallString')-cne$expectedCommand-or[string]$key.GetValue('QuietUninstallString')-cne($expectedCommand+' -Confirm:$false')-or[int]$key.GetValue('NoModify')-ne1-or[int]$key.GetValue('NoRepair')-ne1-or[string]$key.GetValue('CcodPackageSha256')-cnotmatch'^[0-9a-f]{64}$'){return [pscustomobject]@{valid=$false;reason='RegistryMismatch';entries=@()}};foreach($dword in @('NoModify','NoRepair')){if($key.GetValueKind($dword)-ne[Microsoft.Win32.RegistryValueKind]::DWord){return [pscustomobject]@{valid=$false;reason='RegistryType';entries=@()}}};if($key.GetValueKind('CcodRuntimeGeneration')-ne[Microsoft.Win32.RegistryValueKind]::QWord){return [pscustomobject]@{valid=$false;reason='RegistryType';entries=@()}};foreach($stringName in @($allowed|Where-Object{$_-notin@('NoModify','NoRepair','CcodRuntimeGeneration')})){if($key.GetValueKind($stringName)-ne[Microsoft.Win32.RegistryValueKind]::String){return [pscustomobject]@{valid=$false;reason='RegistryType';entries=@()}}};$target=[string]$key.GetValue('CcodShortcutTarget');$arguments=[string]$key.GetValue('CcodShortcutArguments');$start=Get-CcodProductShortcutEvidence 'StartMenu';$desktop=Get-CcodProductShortcutEvidence 'Desktop';if($null-eq$start-or$null-eq$desktop-or$start.target-cne$target-or$desktop.target-cne$target-or$start.arguments-cne$arguments-or$desktop.arguments-cne$arguments-or$start.sha256-cne[string]$key.GetValue('CcodStartMenuSha256')-or$desktop.sha256-cne[string]$key.GetValue('CcodDesktopSha256')){return [pscustomobject]@{valid=$false;reason='ShortcutMismatch';entries=@()}};$captured=[ordered]@{};foreach($name in $names){$captured[$name]=[pscustomobject]@{value=$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);kind=[string]$key.GetValueKind($name)}};$installRoot=[IO.Path]::GetFullPath((Split-Path (Split-Path $installLocation -Parent) -Parent));$readyEvidence=[pscustomobject][ordered]@{phase='Ready';installRoot=$installRoot;runtimeId=$runtime;runtimeGeneration=[uint64]$key.GetValue('CcodRuntimeGeneration');packageSha256=[string]$key.GetValue('CcodPackageSha256');manifestSha256=[string]$key.GetValue('CcodManifestSha256');startMenuSha256=$start.sha256;desktopSha256=$desktop.sha256;targetPath=$target;arguments=$arguments};return [pscustomobject]@{valid=$true;reason=$null;readyEvidence=$readyEvidence;entries=@([pscustomobject]@{kind='StartMenu';path=$start.path;sha256=$start.sha256},[pscustomobject]@{kind='Desktop';path=$desktop.path;sha256=$desktop.sha256},[pscustomobject]@{kind='Registry';path=$subkey;valueNames=$names;values=$captured})}}
+        try{$allowed=@('CcodDesktopSha256','CcodPackageSha256','CcodRuntimeId','CcodRuntimeGeneration','CcodManifestSha256','CcodShortcutArguments','CcodShortcutTarget','CcodStartMenuSha256','DisplayName','DisplayVersion','InstallLocation','NoModify','NoRepair','Publisher','QuietUninstallString','UninstallString');$names=@($key.GetValueNames()|Sort-Object);if(($names-join'|')-cne(($allowed|Sort-Object)-join'|')-or$key.GetSubKeyNames().Count-ne0){return [pscustomobject]@{valid=$false;reason='UnknownRegistryValue';entries=@()}};$runtime=[string]$key.GetValue('CcodRuntimeId',$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);$installLocation=[string]$key.GetValue('InstallLocation');$expectedUninstaller=Join-Path $installLocation 'Uninstall-CodexControlOtherDevices.ps1';$expectedCommand='"{0}" -NoProfile -ExecutionPolicy Bypass -File "{1}"'-f(Get-CcodProductPowerShellPath),$expectedUninstaller;if($runtime-cne$ExpectedRuntimeId-or$installLocation-cne[IO.Path]::GetFullPath((Join-Path (Join-Path (Split-Path (Split-Path $installLocation -Parent) -Parent) 'runtime') $runtime))-or[string]$key.GetValue('DisplayName')-cne'CodexRemote-fix'-or[string]$key.GetValue('DisplayVersion')-cne'2.5.22'-or[string]$key.GetValue('Publisher')-cne'naipi11'-or[string]$key.GetValue('UninstallString')-cne$expectedCommand-or[string]$key.GetValue('QuietUninstallString')-cne($expectedCommand+' -Confirm:$false')-or[int]$key.GetValue('NoModify')-ne1-or[int]$key.GetValue('NoRepair')-ne1-or[string]$key.GetValue('CcodPackageSha256')-cnotmatch'^[0-9a-f]{64}$'){return [pscustomobject]@{valid=$false;reason='RegistryMismatch';entries=@()}};foreach($dword in @('NoModify','NoRepair')){if($key.GetValueKind($dword)-ne[Microsoft.Win32.RegistryValueKind]::DWord){return [pscustomobject]@{valid=$false;reason='RegistryType';entries=@()}}};if($key.GetValueKind('CcodRuntimeGeneration')-ne[Microsoft.Win32.RegistryValueKind]::QWord){return [pscustomobject]@{valid=$false;reason='RegistryType';entries=@()}};foreach($stringName in @($allowed|Where-Object{$_-notin@('NoModify','NoRepair','CcodRuntimeGeneration')})){if($key.GetValueKind($stringName)-ne[Microsoft.Win32.RegistryValueKind]::String){return [pscustomobject]@{valid=$false;reason='RegistryType';entries=@()}}};$target=[string]$key.GetValue('CcodShortcutTarget');$arguments=[string]$key.GetValue('CcodShortcutArguments');$start=Get-CcodProductShortcutEvidence 'StartMenu';$desktop=Get-CcodProductShortcutEvidence 'Desktop';if($null-eq$start-or$null-eq$desktop-or$start.target-cne$target-or$desktop.target-cne$target-or$start.arguments-cne$arguments-or$desktop.arguments-cne$arguments-or$start.sha256-cne[string]$key.GetValue('CcodStartMenuSha256')-or$desktop.sha256-cne[string]$key.GetValue('CcodDesktopSha256')){return [pscustomobject]@{valid=$false;reason='ShortcutMismatch';entries=@()}};$captured=[ordered]@{};foreach($name in $names){$captured[$name]=[pscustomobject]@{value=$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);kind=[string]$key.GetValueKind($name)}};$installRoot=[IO.Path]::GetFullPath((Split-Path (Split-Path $installLocation -Parent) -Parent));$readyEvidence=[pscustomobject][ordered]@{phase='Ready';installRoot=$installRoot;runtimeId=$runtime;runtimeGeneration=[uint64]$key.GetValue('CcodRuntimeGeneration');packageSha256=[string]$key.GetValue('CcodPackageSha256');manifestSha256=[string]$key.GetValue('CcodManifestSha256');startMenuSha256=$start.sha256;desktopSha256=$desktop.sha256;targetPath=$target;arguments=$arguments};return [pscustomobject]@{valid=$true;reason=$null;readyEvidence=$readyEvidence;entries=@([pscustomobject]@{kind='StartMenu';path=$start.path;sha256=$start.sha256},[pscustomobject]@{kind='Desktop';path=$desktop.path;sha256=$desktop.sha256},[pscustomobject]@{kind='Registry';path=$subkey;valueNames=$names;values=$captured})}}
         finally{$key.Dispose()}
     }catch{return [pscustomobject]@{valid=$false;reason='Ambiguous';entries=@()}}
 }
@@ -326,7 +326,7 @@ function Remove-CcodLegacyProductRegistration {
     $snapshot=&$adapter.ReadLegacySnapshot $ExpectedAppId
     if($null-eq$snapshot-or$snapshot.appId-cne$ExpectedAppId-or@($snapshot.entries).Count-ne9){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy snapshot is incomplete or ambiguous' $ExpectedAppId}
     $removed=[Collections.Generic.List[object]]::new()
-    try{foreach($entry in @($snapshot.entries)){&$adapter.RemoveLegacyEntry $entry;$removed.Add($entry)}}catch{$unresolved=[Collections.Generic.List[string]]::new();for($index=$removed.Count-1;$index-ge0;$index--){$entry=$removed[$index];$name=if($entry-is[string]){[string]$entry}elseif($entry.kind-ceq'Registry'){'Registry'}else{[string]$entry.name};try{if($null-ne(&$adapter.ReadLegacyEntry $entry)){$unresolved.Add($name);continue};&$adapter.RestoreLegacyEntry $entry;if($null-eq(&$adapter.ReadLegacyEntry $entry)){$unresolved.Add($name)}}catch{$unresolved.Add($name)}};if($unresolved.Count-gt0){$record=[pscustomobject][ordered]@{schemaVersion=1;appId=$ExpectedAppId;state='CompensationFailed';entries=@($unresolved);createdAtUtc=[DateTime]::UtcNow.ToString('o',[Globalization.CultureInfo]::InvariantCulture)};try{&$adapter.WriteLegacyCompensationFailure $record}catch{Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED' 'Legacy compensation failure record could not be persisted.' $record};Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED' 'Legacy migration compensation remains unresolved; exact entries were recorded.' $record};Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration failed and the exact prior set was restored.' $ExpectedAppId}
+    try{foreach($entry in @($snapshot.entries)){&$adapter.RemoveLegacyEntry $entry;$removed.Add($entry)}}catch{$unresolved=[Collections.Generic.List[string]]::new();$failedEntry=$entry;$failedName=if($failedEntry-is[string]){[string]$failedEntry}elseif($failedEntry.kind-ceq'Registry'){'Registry'}else{[string]$failedEntry.name};try{if($null-eq(&$adapter.ReadLegacyEntry $failedEntry)){&$adapter.RestoreLegacyEntry $failedEntry;if($null-eq(&$adapter.ReadLegacyEntry $failedEntry)){$unresolved.Add($failedName)}}}catch{$unresolved.Add($failedName)};for($index=$removed.Count-1;$index-ge0;$index--){$entry=$removed[$index];$name=if($entry-is[string]){[string]$entry}elseif($entry.kind-ceq'Registry'){'Registry'}else{[string]$entry.name};try{if($null-ne(&$adapter.ReadLegacyEntry $entry)){$unresolved.Add($name);continue};&$adapter.RestoreLegacyEntry $entry;if($null-eq(&$adapter.ReadLegacyEntry $entry)){$unresolved.Add($name)}}catch{$unresolved.Add($name)}};if($unresolved.Count-gt0){$record=[pscustomobject][ordered]@{schemaVersion=1;appId=$ExpectedAppId;state='CompensationFailed';entries=@($unresolved);createdAtUtc=[DateTime]::UtcNow.ToString('o',[Globalization.CultureInfo]::InvariantCulture)};try{&$adapter.WriteLegacyCompensationFailure $record}catch{Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED' 'Legacy compensation failure record could not be persisted.' $record};Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED' 'Legacy migration compensation remains unresolved; exact entries were recorded.' $record};Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration failed and the exact prior set was restored.' $ExpectedAppId}
 }
 
 Export-ModuleMember -Function New-CcodProductRegistration,Test-CcodProductRegistration,Commit-CcodProductRegistration,Remove-CcodProductRegistration,Remove-CcodLegacyProductRegistration
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index 0649f44..fb7dd45 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -150,12 +150,12 @@ Invoke-CcodTest 'product registration transaction exposes only a selected retain
     $fixture=New-CcodInstallFileFixture
     try{
         $runtimeId='runtime-product-source';$source=New-CcodSourceFile $fixture 'product-source.lnk' 'sealed shortcut bytes';$generation=Open-CcodFixtureGeneration $fixture $runtimeId;$registration=New-CcodInstallGenerationLeaf -Generation $generation -Leaf 'registration';Copy-CcodInstallSealedSource -Generation $registration -SourcePath $source.Path -Leaf 'StartMenu.CodexRemote-fix.lnk' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null;$manifest=Write-CcodInstallGenerationManifest -Generation $generation -Manifest (New-CcodGenerationManifest $runtimeId @([ordered]@{path='registration/StartMenu.CodexRemote-fix.lnk';length=$source.Length;sha256=$source.Sha256}));$pointer=Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $generation -ExpectedPreviousGeneration 0 -FileTransaction $generation;Close-CcodInstallFileTransaction -Transaction $generation -Disposition Ready
-        $ready=[pscustomobject][ordered]@{phase='Ready';runtimeId=$runtimeId;runtimeGeneration=[uint64]1;manifestSha256=$manifest.Sha256;packageSha256=('d'*64)};$transactions=Join-Path $fixture.Install 'state\install-transactions';[IO.Directory]::CreateDirectory($transactions)|Out-Null;[IO.File]::WriteAllText((Join-Path $transactions 'ready.json'),([ordered]@{phase='Ready';newRuntimeId=$runtimeId;newGeneration=[uint64]1;newManifestSha256=$manifest.Sha256;sealedPackageSha256=('d'*64)}|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false));$product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyEvidence $ready;$fixture.Transactions.Add($product);$retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $product;$file=Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyEvidence $ready
+        $readyRecord=[pscustomobject][ordered]@{schemaVersion=1;transactionId='11111111-2222-3333-4444-555555555555';oldRuntimeId=$null;oldGeneration=$null;oldManifestSha256=$null;newRuntimeId=$runtimeId;newGeneration=[uint64]1;newManifestSha256=$manifest.Sha256;sealedPackageSha256=('d'*64);ownedObjectNames=@($runtimeId);phase='Ready';errorCode=$null};$transactions=Join-Path $fixture.Install 'state\install-transactions';[IO.Directory]::CreateDirectory($transactions)|Out-Null;[IO.File]::WriteAllText((Join-Path $transactions 'ready.json'),($readyRecord|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false));$product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $readyRecord;$fixture.Transactions.Add($product);$retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $product;$file=Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyTransaction $readyRecord
         Assert-CcodTrue ($null-ne$file) 'selected manifest file returns an opaque retained source capability'
-        Assert-CcodThrows {Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'C:\outside\arbitrary.lnk' -ReadyEvidence $ready|Out-Null} 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID'
+        Assert-CcodThrows {Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'C:\outside\arbitrary.lnk' -ReadyTransaction $readyRecord|Out-Null} 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID'
         Assert-CcodThrows {New-CcodInstallDirectory -Transaction $product -Parent $product -Leaf 'state' -CreateIfMissing|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
-        $preReady=$ready.PSObject.Copy();$preReady.phase='ProtectionReady';Assert-CcodThrows {Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyEvidence $preReady|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
-        [IO.File]::WriteAllText((Join-Path $fixture.Install 'state\active-generation\00000000000000000002.json'),'{'+'"schemaVersion":1,"generation":2,"activeRuntime":"sibling","previousGeneration":1}',[Text.UTF8Encoding]::new($false));Assert-CcodThrows {Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyEvidence $ready|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
+        $preReady=$readyRecord.PSObject.Copy();$preReady.phase='ProtectionReady';Assert-CcodThrows {Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $preReady|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE';$changed=$readyRecord.PSObject.Copy();$changed.oldRuntimeId='changed-old';Assert-CcodThrows {Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyTransaction $changed|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
+        [IO.File]::WriteAllText((Join-Path $fixture.Install 'state\active-generation\00000000000000000002.json'),'{'+'"schemaVersion":1,"generation":2,"activeRuntime":"sibling","previousGeneration":1}',[Text.UTF8Encoding]::new($false));Assert-CcodThrows {Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $readyRecord|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
         $state=Open-CcodInstallStateTransaction -InstallRoot $fixture.Install;$fixture.Transactions.Add($state);Assert-CcodThrows {Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $state|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {Open-CcodInstallProductSpecialFolder -Generation $state -Kind Desktop|Out-Null} 'CCOD_INSTALL_PRODUCT_FOLDER_INVALID'
     }finally{Remove-CcodInstallFileFixture $fixture}
 }
diff --git a/tests/persistence/ProductRegistration.SelfTest.ps1 b/tests/persistence/ProductRegistration.SelfTest.ps1
index 7015e29..cf43f4a 100644
--- a/tests/persistence/ProductRegistration.SelfTest.ps1
+++ b/tests/persistence/ProductRegistration.SelfTest.ps1
@@ -13,6 +13,7 @@ $packageSha256 = '3' * 64
 $appId = '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}'
 $canonicalTaskTarget=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'schtasks.exe'))
 $cleanupReady=[pscustomobject][ordered]@{phase='Ready';installRoot='C:\fixture\CodexControlOtherDevices';runtimeId=$runtimeId;runtimeGeneration=[uint64]7;packageSha256=$packageSha256;manifestSha256=('a'*64);startMenuSha256=('b'*64);desktopSha256=('c'*64);targetPath=$canonicalTaskTarget;arguments='/Run /TN "Codex Control Other Devices Supervisor"'}
+$fullReadyRecord=[pscustomobject][ordered]@{schemaVersion=1;transactionId='11111111-2222-3333-4444-555555555555';oldRuntimeId=$null;oldGeneration=$null;oldManifestSha256=$null;newRuntimeId=$runtimeId;newGeneration=[uint64]7;newManifestSha256=('a'*64);sealedPackageSha256=$packageSha256;ownedObjectNames=@($runtimeId);phase='Ready';errorCode=$null}
 
 function New-CcodRegistrationWorld {
     param([string]$InstallRoot = 'C:\fixture\CodexControlOtherDevices')
@@ -32,6 +33,7 @@ function New-CcodRegistrationWorld {
             desktopSha256 = 'c'*64
             targetPath = $canonicalTaskTarget
             arguments = '/Run /TN "Codex Control Other Devices Supervisor"'
+            transactionRecord = $fullReadyRecord
             bootstrapPath = $registration.bootstrapPath
             uninstallerPath = $registration.uninstallerPath
         }
@@ -204,7 +206,7 @@ $results += Invoke-CcodTest 'legacy migration rejects AppId and shortcut-name mi
 
 # Production mutation caught: deleting a whole product key despite unknown values or mismatched shortcut evidence.
 $results += Invoke-CcodTest 'current product cleanup requires exact registry values and shortcut bytes targets and file identity' {
-    foreach($mutation in @('UnknownRegistryValue','ShortcutHash','ShortcutTarget','ShortcutReparse','Ambiguous','CoherentReplacement')){
+    foreach($mutation in @('UnknownRegistryValue','RegistrySubkey','ShortcutHash','ShortcutTarget','ShortcutReparse','Ambiguous','CoherentReplacement')){
         $world=New-CcodRegistrationWorld;$world.CurrentProductState.valid=$false;$world.CurrentProductState.reason=$mutation
         Assert-CcodThrows {Remove-CcodProductRegistration -ReadyEvidence $cleanupReady -Adapters $world.Adapters} 'CCOD_PRODUCT_CLEANUP_INVALID'
         Assert-CcodEqual 0 $world.CurrentProductRemovals "$mutation mismatch preserves every current product entry"
@@ -243,4 +245,10 @@ $results += Invoke-CcodTest 'legacy restore failure is explicit and records the
     Assert-CcodTrue (@($world.LegacyUnresolvedRecords[0].entries)-ccontains'StartMenu2') 'unresolved record names the exact entry whose restoration failed'
 }
 
+$results += Invoke-CcodTest 'partially removed current registry entry is included in unresolved compensation' {
+    $world=New-CcodRegistrationWorld;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;$world.LegacyRemoveFailureAt=1;$world.LegacyRestoreFailureEntry='Registry';$originalRemove=$world.Adapters.RemoveLegacyEntry;$world.Adapters.RemoveLegacyEntry={param($Entry)if([string]$Entry-ceq'Registry'){[void]$world.LegacyEntries.Remove('Registry');throw 'partial registry failure'};&$originalRemove $Entry}.GetNewClosure()
+    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED'
+    Assert-CcodTrue (@($world.LegacyUnresolvedRecords[0].entries)-ccontains'Registry') 'current partially removed registry entry is recorded unresolved'
+}
+
 Write-Output "Product registration self-tests passed: $($results.Count)"
diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index 5b83382..ce49d65 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -615,5 +615,12 @@ $results += Invoke-CcodTest 'noncanonical Ready shortcut target is rejected befo
     Assert-CcodEqual 0 @($world.Calls|Where-Object{$_-ceq'Cleanup'}).Count 'invalid target evidence reaches no cleanup deletion'
 }
 
+$results += Invoke-CcodTest 'default installed finalizer validates and removes only the exact selected generation fixture' {
+    $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-installed-finalizer-'+[guid]::NewGuid().ToString('N'));$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
+    try{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$install=Join-Path $local 'CodexControlOtherDevices';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$identity=Get-CcodUninstallBootstrapCurrentIdentity;$transactionRoot=Get-CcodUninstallBootstrapDefaultTransactionRoot;$id='11111111-2222-3333-4444-555555555555';$directory=New-CcodUninstallBootstrapTransactionDirectory -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid;$tx=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$tx.runtimeId=$fixture.RuntimeId;$tx.runtimeGeneration=[uint64]7;$tx.userSid=$identity.userSid;$tx.sessionId=$identity.sessionId;$tx.readyEvidence.runtimeId=$fixture.RuntimeId;$tx.readyEvidence.runtimeGeneration=[uint64]7;$tx.readyEvidence.installRoot=$install;$manifest=(Get-FileHash (Join-Path $fixture.RuntimeRoot 'manifest.json') -Algorithm SHA256).Hash.ToLowerInvariant();$tx.readyEvidence.manifestSha256=$manifest;$tx.installedBinding=[pscustomobject][ordered]@{selectedRuntimeRoot=$fixture.RuntimeRoot;runtimeManifestSha256=$manifest;wrapperPid=42;wrapperCreationTimeUtc='2030-02-03T03:04:05.0000000Z';wrapperSessionId=$identity.sessionId;wrapperUserSid=$identity.userSid};Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory $directory -Transaction $tx;Publish-CcodUninstallBootstrapCurrentTransaction -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid
+        $payload=Join-Path $directory 'payload';[IO.Directory]::CreateDirectory((Join-Path $payload 'src\persistence'))|Out-Null;Copy-Item $bootstrapScript (Join-Path $payload 'src\persistence\UninstallBootstrap.ps1');$adapters=Get-CcodInstalledFinalizerAdapters -Adapters @{WaitWrapperExit={param($I,$T)[pscustomobject]@{verifiedAtStart=$true;exited=$true}};RemoveMatchedProductRegistration={param($T)};FinalizeReceipt={param($T)[pscustomobject]@{phase='Completed'}}} -TransactionRoot $transactionRoot -PayloadRoot $payload;$receipt=Invoke-CcodInstalledUninstallFinalizer -TransactionId $id -RuntimeRoot $fixture.RuntimeRoot -InstallRoot $install -WrapperIdentity ([pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=$identity.sessionId;userSid=$identity.userSid}) -Adapters $adapters;Assert-CcodEqual 'Completed' $receipt.phase 'default finalizer reaches completion';Assert-CcodTrue (-not(Test-Path $fixture.RuntimeRoot)) 'default finalizer deletes exact selected runtime';Assert-CcodTrue (Test-Path (Join-Path $install 'state')) 'default finalizer preserves sibling install state'
+    }finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $local){Remove-Item $local -Recurse -Force}}
+}
+
 $results | ForEach-Object { "PASS $($_.Name)" }
 Write-Output "Uninstall bootstrap self-tests passed: $($results.Count)"

From a83840bfaffd595c38aebd9daf8daf26d3b9b3ef Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Tue, 1 Sep 2026 22:49:31 +0800
Subject: [PATCH 104/187] docs: record strict retained authority evidence

---
 .../task-4-report.md                          | 54 +++++++++++++++++++
 1 file changed, 54 insertions(+)

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
index b879f27..6145121 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
@@ -244,3 +244,57 @@ resume transactions, and rejects before cleanup. Fresh UninstallBootstrap is
 
 - Supplemental commit: `67c79d82e18c805f27aec8e05553938f1f706380`
   (`fix: reject invalid Ready evidence before cleanup`).
+
+## Fix round 3: strict retained authority and default finalizer proof
+
+Independent review found five Important gaps in stored Ready validation,
+retained authority, current-state preflight, the current partially removed
+legacy entry, and mock-only finalizer coverage.
+
+### RED evidence
+
+- Stored noncanonical Ready target returned the expected error but observed
+  `Cleanup=1`; failed fresh validation retained its context.
+- Product authority accepted a fabricated five-field Ready object and did not
+  bind non-derived fields such as `oldRuntimeId`.
+- Current product inspection did not reject an unknown registry subkey before
+  returning deletable entries.
+- A partially mutated current Registry entry was absent from the outer
+  unresolved compensation set.
+- Installed finalizer tests replaced all five filesystem/identity boundaries
+  rather than exercising their defaults.
+
+### GREEN evidence
+
+- ProductRegistration: `11/11`, exit `0`.
+- InstallFileTransaction: `27/27`, exit `0`.
+- UninstallBootstrap: `21/21`, exit `0`.
+- InstallLifecycle: `116/116`, exit `0`.
+- Full `tests\PersistenceSelfTest.ps1` aggregate: exit `0` after about
+  7 minutes 15 seconds; it emitted no failure output.
+- Parser: `8/8`, zero failures. `git diff --check`: exit `0`.
+
+### Remediated boundaries
+
+- Product authority accepts the complete ordered 12-field lifecycle Ready
+  record. The product capability stores its canonical complete identity; each
+  retained-file open compares the caller's complete record, including
+  `oldRuntimeId`, then rechecks the latest append-only selector and unique
+  strict Ready record.
+- Current cleanup rejects registry subkeys before returning any entry.
+- Legacy compensation includes the entry whose removal itself failed; partial
+  Registry restore failure is recorded unresolved and cannot be reported as a
+  fully restored migration failure.
+- A disposable default finalizer fixture preserves the production transaction
+  reader, selected-generation/manifest validator, epoch reader, selected-root
+  remover, and absence proof. Only wrapper wait, product registry cleanup and
+  receipt finalization are replaced. It deletes the selected runtime while
+  preserving sibling install state.
+- Normal/recovery registration retry and durable Ready preservation remain
+  green. No real registry, shortcut, uninstall, product, network, release,
+  signing, tag, push, or publication action occurred.
+
+### Implementation commit
+
+- `1ff17bb8759e3d5312c11336ca3b2188bb3a4fe2`
+  (`fix: enforce strict retained product authority`).

From 3cd891221acfd569fd29e2244b5200fa28e43106 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 00:16:13 +0800
Subject: [PATCH 105/187] fix: prove durable Ready product authority

---
 .../InstalledUninstallFinalizer.ps1           | 18 ++++-
 src/persistence/UninstallBootstrap.ps1        | 76 ++++++++++++++-----
 .../modules/InstallFileTransaction.psm1       | 51 ++++++++++++-
 src/persistence/modules/InstallLifecycle.psm1 |  2 +-
 .../modules/ProductRegistration.psm1          | 36 ++++++++-
 .../InstallFileTransaction.SelfTest.ps1       | 64 +++++++++++++++-
 .../ProductRegistration.SelfTest.ps1          | 25 +++++-
 .../UninstallBootstrap.SelfTest.ps1           | 51 ++++++++++++-
 8 files changed, 285 insertions(+), 38 deletions(-)

diff --git a/src/persistence/InstalledUninstallFinalizer.ps1 b/src/persistence/InstalledUninstallFinalizer.ps1
index edf7b19..980aca1 100644
--- a/src/persistence/InstalledUninstallFinalizer.ps1
+++ b/src/persistence/InstalledUninstallFinalizer.ps1
@@ -15,13 +15,23 @@ function Throw-CcodInstalledFinalizerError {
     throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new($Message),$Id,[Management.Automation.ErrorCategory]::InvalidData,$Target)
 }
 function Test-CcodInstalledFinalizerIdentity($Value){$Value.pid-is[int]-and$Value.pid-gt0-and$Value.creationTimeUtc-is[string]-and$Value.creationTimeUtc-cmatch'^\d{4}-\d{2}-\d{2}T'-and$Value.sessionId-is[int]-and$Value.sessionId-ge0-and$Value.userSid-is[string]-and$Value.userSid-cmatch'^S-1-'}
+function Get-CcodInstalledFinalizerLocalAppData {
+    $value=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
+    if(-not[string]::IsNullOrWhiteSpace($value)){
+        try{if([IO.Path]::IsPathRooted($value)){return [IO.Path]::GetFullPath($value).TrimEnd('\')}}catch{}
+        Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Process LOCALAPPDATA is not a canonical absolute path' $value
+    }
+    $value=[Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)
+    if([string]::IsNullOrWhiteSpace($value)-or-not[IO.Path]::IsPathRooted($value)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Current-user local application data is unavailable' $value}
+    [IO.Path]::GetFullPath($value).TrimEnd('\')
+}
 function Get-CcodInstalledFinalizerAdapters {
     param([hashtable]$Adapters,[string]$TransactionRoot,[string]$PayloadRoot)
     $bootstrap=Join-Path $PayloadRoot 'src\persistence\UninstallBootstrap.ps1'
     $lifecycle=Join-Path $PayloadRoot 'src\persistence\modules\InstallLifecycle.psm1'
     $defaults=@{
         WaitWrapperExit={param($Identity,$Timeout);$process=Get-Process -Id $Identity.pid -ErrorAction SilentlyContinue;if($null-eq$process){return [pscustomobject]@{verifiedAtStart=$false;exited=$false}};try{if($process.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)-cne$Identity.creationTimeUtc-or[int]$process.SessionId-ne[int]$Identity.sessionId){return [pscustomobject]@{verifiedAtStart=$false;exited=$false}}}finally{$process.Dispose()};$owner=$null;try{$owner=(Get-CimInstance Win32_Process -Filter ('ProcessId='+$Identity.pid)-ErrorAction Stop|Invoke-CimMethod -MethodName GetOwnerSid -ErrorAction Stop)}catch{};if($null-eq$owner-or[int]$owner.ReturnValue-ne0-or[string]$owner.Sid-cne[string]$Identity.userSid){return [pscustomobject]@{verifiedAtStart=$false;exited=$false}};$stopwatch=[Diagnostics.Stopwatch]::StartNew();while($stopwatch.ElapsedMilliseconds-lt$Timeout){$current=Get-Process -Id $Identity.pid -ErrorAction SilentlyContinue;if($null-eq$current){return [pscustomobject]@{verifiedAtStart=$true;exited=$true}};try{if($current.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)-cne$Identity.creationTimeUtc){return [pscustomobject]@{verifiedAtStart=$true;exited=$true}}}finally{$current.Dispose()};Start-Sleep -Milliseconds 100};[pscustomobject]@{verifiedAtStart=$true;exited=$false}}
-        ReadPreparedTransaction={param($Id);. $bootstrap;$identity=Get-CcodUninstallBootstrapCurrentIdentity;$value=Read-CcodUninstallBootstrapStoredTransaction -TransactionRoot $TransactionRoot -ExpectedUserSid $identity.userSid -IncludeCompleted;if($null-eq$value-or$value.transactionId-cne$Id){return $null};$value}.GetNewClosure()
+        ReadPreparedTransaction={param($Id,$ExpectedInstallRoot);. $bootstrap;$identity=Get-CcodUninstallBootstrapCurrentIdentity;$value=Read-CcodUninstallBootstrapStoredTransaction -TransactionRoot $TransactionRoot -ExpectedUserSid $identity.userSid -IncludeCompleted -ExpectedInstallRoot $ExpectedInstallRoot;if($null-eq$value-or$value.transactionId-cne$Id){return $null};$value}.GetNewClosure()
         ValidateSelectedGeneration={param($SelectedRuntime,$Root,$Transaction);. $bootstrap;$context=Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $SelectedRuntime -InstallRoot $Root -InvocationPath (Join-Path $SelectedRuntime 'src\persistence\UninstallBootstrap.ps1');$manifest=Get-CcodUninstallBootstrapFileFingerprint -Path (Join-Path $SelectedRuntime 'manifest.json');$context.runtimeId-ceq$Transaction.runtimeId-and[uint64]$context.runtimeGeneration-eq[uint64]$Transaction.runtimeGeneration-and$manifest.sha256-ceq$Transaction.installedBinding.runtimeManifestSha256}.GetNewClosure()
         ReadCurrentEpoch={param($Root);. $bootstrap;$record=Read-CcodUninstallBootstrapJson -Path (Join-Path $Root 'state\lifecycle-epoch.json') -Kind 'Lifecycle epoch';[uint64]$record.epoch}.GetNewClosure()
         RemoveSelectedGeneration={param($SelectedRuntime,$Transaction);. $bootstrap;$expected=[IO.Path]::GetFullPath([string]$Transaction.installedBinding.selectedRuntimeRoot);if([IO.Path]::GetFullPath($SelectedRuntime)-cne$expected){throw 'selected root changed'};$item=Get-Item -LiteralPath $expected -Force -ErrorAction Stop;if(-not$item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){throw 'selected root unsafe'};Remove-Item -LiteralPath $expected -Recurse -Force -ErrorAction Stop;$Transaction.phase='ReadyForInno';$Transaction.resumePhase='ReadyForInno';Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory (Join-Path $TransactionRoot $Transaction.transactionId) -Transaction $Transaction;$Transaction}.GetNewClosure()
@@ -35,9 +45,9 @@ function Invoke-CcodInstalledUninstallFinalizer {
     param([Parameter(Mandatory)][string]$TransactionId,[Parameter(Mandatory)][string]$RuntimeRoot,[Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$WrapperIdentity,[hashtable]$Adapters)
     if($TransactionId-cnotmatch'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'-or-not[IO.Path]::IsPathRooted($RuntimeRoot)-or-not[IO.Path]::IsPathRooted($InstallRoot)-or-not(Test-CcodInstalledFinalizerIdentity $WrapperIdentity)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer inputs are invalid' $TransactionId}
     $runtime=[IO.Path]::GetFullPath($RuntimeRoot);$install=[IO.Path]::GetFullPath($InstallRoot);$expected=[IO.Path]::GetFullPath((Join-Path (Join-Path $install 'runtime') ([IO.Path]::GetFileName($runtime))));if($runtime-cne$expected){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Runtime root is outside the fixed install runtime parent' $runtime}
-    $local=[Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData);$transactionRoot=[IO.Path]::GetFullPath((Join-Path $local 'CodexRemote-fix-uninstall'));$payloadRoot=[IO.Path]::GetFullPath((Join-Path (Join-Path $transactionRoot $TransactionId) 'payload'));if($null-eq$Adapters){$expectedSelf=[IO.Path]::GetFullPath((Join-Path $payloadRoot 'src\persistence\InstalledUninstallFinalizer.ps1'));if([string]::IsNullOrWhiteSpace($PSCommandPath)-or[IO.Path]::GetFullPath($PSCommandPath)-cne$expectedSelf){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer is outside the durable staged payload' $PSCommandPath};$self=Get-Item -LiteralPath $expectedSelf -Force -ErrorAction Stop;if($self.PSIsContainer-or($self.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer path is unsafe' $expectedSelf}};$adapter=Get-CcodInstalledFinalizerAdapters -Adapters $Adapters -TransactionRoot $transactionRoot -PayloadRoot $payloadRoot
+    $local=Get-CcodInstalledFinalizerLocalAppData;$transactionRoot=[IO.Path]::GetFullPath((Join-Path $local 'CodexRemote-fix-uninstall'));$payloadRoot=[IO.Path]::GetFullPath((Join-Path (Join-Path $transactionRoot $TransactionId) 'payload'));if($null-eq$Adapters){$expectedSelf=[IO.Path]::GetFullPath((Join-Path $payloadRoot 'src\persistence\InstalledUninstallFinalizer.ps1'));if([string]::IsNullOrWhiteSpace($PSCommandPath)-or[IO.Path]::GetFullPath($PSCommandPath)-cne$expectedSelf){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer is outside the durable staged payload' $PSCommandPath};$self=Get-Item -LiteralPath $expectedSelf -Force -ErrorAction Stop;if($self.PSIsContainer-or($self.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer path is unsafe' $expectedSelf}};$adapter=Get-CcodInstalledFinalizerAdapters -Adapters $Adapters -TransactionRoot $transactionRoot -PayloadRoot $payloadRoot
     $wrapperExit=&$adapter.WaitWrapperExit $WrapperIdentity 15000;if($null-eq$wrapperExit-or$wrapperExit.verifiedAtStart-isnot[bool]-or-not$wrapperExit.verifiedAtStart-or$wrapperExit.exited-isnot[bool]-or-not$wrapperExit.exited){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed wrapper was not verified before its exact exit' $WrapperIdentity}
-    $transaction=&$adapter.ReadPreparedTransaction $TransactionId
+    $transaction=&$adapter.ReadPreparedTransaction $TransactionId $install
     $binding=if($null-ne$transaction){$transaction.installedBinding}else{$null};if($null-eq$transaction-or$transaction.transactionId-cne$TransactionId-or$transaction.phase-cne'TaskRemoved'-or$transaction.resumePhase-cne'TaskRemoved'-or$transaction.runtimeId-isnot[string]-or[IO.Path]::GetFileName($runtime)-cne[string]$transaction.runtimeId-or$null-eq$binding-or[IO.Path]::GetFullPath([string]$binding.selectedRuntimeRoot)-cne$runtime-or$binding.runtimeManifestSha256-isnot[string]-or$binding.runtimeManifestSha256-cnotmatch'^[0-9a-f]{64}$'-or[int]$binding.wrapperPid-ne$WrapperIdentity.pid-or[string]$binding.wrapperCreationTimeUtc-cne$WrapperIdentity.creationTimeUtc-or[int]$binding.wrapperSessionId-ne$WrapperIdentity.sessionId-or[string]$binding.wrapperUserSid-cne$WrapperIdentity.userSid){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Durable installed uninstall transaction identity is invalid' $transaction}
     if([uint64](&$adapter.ReadCurrentEpoch $install)-ne[uint64]$transaction.leaseEpoch-or-not(&$adapter.ValidateSelectedGeneration $runtime $install $transaction)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Selected generation manifest or epoch does not match the transaction' $runtime}
     $ready=&$adapter.RemoveSelectedGeneration $runtime $transaction
@@ -50,5 +60,5 @@ function Invoke-CcodInstalledUninstallFinalizer {
 
 if($MyInvocation.InvocationName-ne'.'){
     $currentIdentity=[Security.Principal.WindowsIdentity]::GetCurrent();$process=[Diagnostics.Process]::GetCurrentProcess();try{$identity=[pscustomobject]@{pid=[int]$WrapperProcessId;creationTimeUtc=$WrapperCreationTimeUtc;sessionId=[int]$process.SessionId;userSid=[string]$currentIdentity.User.Value}}finally{$process.Dispose();$currentIdentity.Dispose()}
-    try{Invoke-CcodInstalledUninstallFinalizer -TransactionId $TransactionId -RuntimeRoot $RuntimeRoot -InstallRoot $InstallRoot -WrapperIdentity $identity|Out-Null;exit 0}catch{Write-Error ([string]$_.FullyQualifiedErrorId);exit 3}
+    try{Invoke-CcodInstalledUninstallFinalizer -TransactionId $TransactionId -RuntimeRoot $RuntimeRoot -InstallRoot $InstallRoot -WrapperIdentity $identity|Out-Null;exit 0}catch{[Console]::Error.WriteLine([string]$_.FullyQualifiedErrorId);exit 3}
 }
diff --git a/src/persistence/UninstallBootstrap.ps1 b/src/persistence/UninstallBootstrap.ps1
index 1989ba7..fbed4ae 100644
--- a/src/persistence/UninstallBootstrap.ps1
+++ b/src/persistence/UninstallBootstrap.ps1
@@ -325,7 +325,7 @@ function New-CcodUninstallBootstrapResumeContext {
         [Parameter(Mandatory)]$Transaction,
         [Parameter(Mandatory)]$Identity
     )
-    Assert-CcodUninstallBootstrapTransaction $Transaction
+    Assert-CcodUninstallBootstrapTransaction $Transaction -ExpectedInstallRoot $InstallRoot
     if ($Transaction.userSid -cne $Identity.userSid -or $Transaction.sessionId -ne $Identity.sessionId) {
         Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISMATCH' 'The interrupted uninstall transaction does not match the current user and session' $Transaction
     }
@@ -604,7 +604,8 @@ function Read-CcodUninstallBootstrapStoredTransaction {
     param(
         [Parameter(Mandatory)][string]$TransactionRoot,
         [string]$ExpectedUserSid,
-        [switch]$IncludeCompleted
+        [switch]$IncludeCompleted,
+        [string]$ExpectedInstallRoot
     )
     if (-not [IO.Directory]::Exists($TransactionRoot)) { return $null }
     $root = Get-CcodUninstallBootstrapComparablePath -Path $TransactionRoot -Kind 'External uninstall transaction root'
@@ -622,7 +623,7 @@ function Read-CcodUninstallBootstrapStoredTransaction {
     Assert-CcodUninstallBootstrapSafePath -Root $root -Path $transactionDirectory | Out-Null
     $transactionPath = Resolve-CcodUninstallBootstrapChildPath -Root $transactionDirectory -RelativePath 'transaction.json' -RequireLeafFile
     $transaction = Read-CcodUninstallBootstrapJson -Path $transactionPath -Kind 'Uninstall transaction'
-    Assert-CcodUninstallBootstrapTransaction $transaction
+    Assert-CcodUninstallBootstrapTransaction $transaction -ExpectedInstallRoot $ExpectedInstallRoot
     if ($transaction.transactionId -cne $current.transactionId) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_INVALID' 'The uninstall transaction locator does not match its receipt' $transactionPath }
     if (-not [string]::IsNullOrWhiteSpace($ExpectedUserSid) -and $transaction.userSid -cne $ExpectedUserSid) {
         Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISMATCH' 'The external uninstall transaction belongs to another user' $transactionPath
@@ -726,7 +727,7 @@ function Write-CcodUninstallBootstrapStoredReceipt {
 
 function Stage-CcodUninstallBootstrapPayload {
     param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$Context,[Parameter(Mandatory)][string]$TransactionDirectory)
-    Assert-CcodUninstallBootstrapContext $Context
+    Assert-CcodUninstallBootstrapContext $Context -ExpectedInstallRoot $InstallRoot
     $install = Get-CcodUninstallBootstrapComparablePath -Path $InstallRoot -Kind 'Install root'
     $runtimeRoot = Resolve-CcodUninstallBootstrapChildPath -Root $install -RelativePath ('runtime\' + $Context.runtimeId)
     $transactionDirectory = Get-CcodUninstallBootstrapComparablePath -Path $TransactionDirectory -Kind 'Uninstall transaction directory'
@@ -791,8 +792,38 @@ function ConvertTo-CcodUninstallBootstrapUInt64 {
     try { return [uint64]$Value } catch { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_INVALID' "$Name is outside the unsigned range" $Value }
 }
 
+function Assert-CcodUninstallBootstrapReadyEvidence {
+    param(
+        [Parameter(Mandatory)]$ReadyEvidence,
+        [Parameter(Mandatory)][string]$ExpectedInstallRoot,
+        [Parameter(Mandatory)][string]$ExpectedRuntimeId,
+        [Parameter(Mandatory)]$ExpectedRuntimeGeneration,
+        [Parameter(Mandatory)][string]$ErrorId
+    )
+    $fields=@('phase','installRoot','runtimeId','runtimeGeneration','packageSha256','manifestSha256','startMenuSha256','desktopSha256','targetPath','arguments')
+    try{
+        $install=Get-CcodUninstallBootstrapComparablePath -Path $ExpectedInstallRoot -Kind 'Install root'
+        $readyInstall=Get-CcodUninstallBootstrapComparablePath -Path ([string]$ReadyEvidence.installRoot) -Kind 'Ready install root'
+        $canonicalTarget=Get-CcodUninstallBootstrapFullPath -Path (Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'schtasks.exe') -Kind 'Task target'
+        $generation=ConvertTo-CcodUninstallBootstrapUInt64 $ReadyEvidence.runtimeGeneration 'Ready runtimeGeneration'
+        $expectedGeneration=ConvertTo-CcodUninstallBootstrapUInt64 $ExpectedRuntimeGeneration 'Expected runtimeGeneration'
+        if(-not(Test-CcodUninstallBootstrapExactProperties $ReadyEvidence $fields)-or
+            $ReadyEvidence.phase-isnot[string]-or$ReadyEvidence.phase-cne'Ready'-or
+            $readyInstall-cne$install-or$ReadyEvidence.runtimeId-isnot[string]-or$ReadyEvidence.runtimeId-cne$ExpectedRuntimeId-or
+            $generation-ne$expectedGeneration-or$ReadyEvidence.packageSha256-isnot[string]-or$ReadyEvidence.packageSha256-cnotmatch'^[0-9a-f]{64}$'-or
+            $ReadyEvidence.manifestSha256-isnot[string]-or$ReadyEvidence.manifestSha256-cnotmatch'^[0-9a-f]{64}$'-or
+            $ReadyEvidence.startMenuSha256-isnot[string]-or$ReadyEvidence.startMenuSha256-cnotmatch'^[0-9a-f]{64}$'-or
+            $ReadyEvidence.desktopSha256-isnot[string]-or$ReadyEvidence.desktopSha256-cnotmatch'^[0-9a-f]{64}$'-or
+            $ReadyEvidence.targetPath-isnot[string]-or(Get-CcodUninstallBootstrapFullPath -Path $ReadyEvidence.targetPath -Kind 'Ready task target')-cne$canonicalTarget-or
+            $ReadyEvidence.arguments-isnot[string]-or$ReadyEvidence.arguments-cne'/Run /TN "Codex Control Other Devices Supervisor"'){throw 'Ready evidence mismatch'}
+    }catch{
+        Throw-CcodUninstallBootstrapError $ErrorId 'Ready cleanup evidence is invalid' $ReadyEvidence
+    }
+    return $ReadyEvidence
+}
+
 function Assert-CcodUninstallBootstrapContext {
-    param([Parameter(Mandatory)]$Context)
+    param([Parameter(Mandatory)]$Context,[string]$ExpectedInstallRoot)
     if (-not (Test-CcodUninstallBootstrapExactProperties $Context $script:CcodUninstallContextFields) -or
         $Context.runtimeId -isnot [string] -or $Context.runtimeId -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$' -or
         $Context.userSid -isnot [string] -or $Context.userSid -cnotmatch '^S-\d-\d+(?:-\d+)+$' -or
@@ -803,7 +834,8 @@ function Assert-CcodUninstallBootstrapContext {
     }
     [void](ConvertTo-CcodUninstallBootstrapUInt64 $Context.runtimeGeneration 'runtimeGeneration')
     [void](ConvertTo-CcodUninstallBootstrapUInt64 $Context.leaseEpoch 'leaseEpoch')
-    $ready=$Context.readyEvidence;$canonicalTarget=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'schtasks.exe'));if(-not(Test-CcodUninstallBootstrapExactProperties $ready @('phase','installRoot','runtimeId','runtimeGeneration','packageSha256','manifestSha256','startMenuSha256','desktopSha256','targetPath','arguments'))-or$ready.phase-cne'Ready'-or$ready.installRoot-isnot[string]-or$ready.runtimeId-cne$Context.runtimeId-or[uint64]$ready.runtimeGeneration-ne[uint64]$Context.runtimeGeneration-or$ready.packageSha256-cnotmatch'^[0-9a-f]{64}$'-or$ready.manifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$ready.startMenuSha256-cnotmatch'^[0-9a-f]{64}$'-or$ready.desktopSha256-cnotmatch'^[0-9a-f]{64}$'-or$ready.targetPath-isnot[string]-or[IO.Path]::GetFullPath([string]$ready.targetPath)-ine$canonicalTarget-or$ready.arguments-cne'/Run /TN "Codex Control Other Devices Supervisor"'){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'Ready cleanup evidence is invalid' $ready}
+    $readyRoot=if([string]::IsNullOrWhiteSpace($ExpectedInstallRoot)){[string]$Context.readyEvidence.installRoot}else{$ExpectedInstallRoot}
+    [void](Assert-CcodUninstallBootstrapReadyEvidence -ReadyEvidence $Context.readyEvidence -ExpectedInstallRoot $readyRoot -ExpectedRuntimeId $Context.runtimeId -ExpectedRuntimeGeneration $Context.runtimeGeneration -ErrorId 'CCOD_UNINSTALL_BOOTSTRAP_INVALID')
     $records = @($Context.payloadRecords)
     if ($records.Count -ne $script:CcodUninstallPayloadEntries.Count) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'The cleanup payload record set is incomplete' $Context }
     for ($index = 0; $index -lt $records.Count; $index++) {
@@ -819,7 +851,7 @@ function Assert-CcodUninstallBootstrapContext {
 }
 
 function Assert-CcodUninstallBootstrapTransaction {
-    param([Parameter(Mandatory)]$Transaction)
+    param([Parameter(Mandatory)]$Transaction,[string]$ExpectedInstallRoot)
     if (-not (Test-CcodUninstallBootstrapExactProperties $Transaction $script:CcodUninstallTransactionFields) -or
         $Transaction.schemaVersion -isnot [int] -or $Transaction.schemaVersion -ne 1 -or
         -not (Test-CcodUninstallBootstrapCanonicalGuid $Transaction.transactionId) -or
@@ -835,7 +867,8 @@ function Assert-CcodUninstallBootstrapTransaction {
     }
     [void](ConvertTo-CcodUninstallBootstrapUInt64 $Transaction.runtimeGeneration 'runtimeGeneration')
     [void](ConvertTo-CcodUninstallBootstrapUInt64 $Transaction.leaseEpoch 'leaseEpoch')
-    $transactionReady=$Transaction.readyEvidence;$canonicalTaskTarget=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'schtasks.exe'));if($null-eq$transactionReady-or$transactionReady.phase-cne'Ready'-or$transactionReady.installRoot-isnot[string]-or-not[IO.Path]::IsPathRooted($transactionReady.installRoot)-or$transactionReady.runtimeId-cne$Transaction.runtimeId-or[uint64]$transactionReady.runtimeGeneration-ne[uint64]$Transaction.runtimeGeneration-or$transactionReady.packageSha256-cnotmatch'^[0-9a-f]{64}$'-or$transactionReady.manifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$transactionReady.startMenuSha256-cnotmatch'^[0-9a-f]{64}$'-or$transactionReady.desktopSha256-cnotmatch'^[0-9a-f]{64}$'-or$transactionReady.targetPath-isnot[string]-or[IO.Path]::GetFullPath([string]$transactionReady.targetPath)-ine$canonicalTaskTarget-or$transactionReady.arguments-cne'/Run /TN "Codex Control Other Devices Supervisor"'){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_INVALID' 'Ready transaction evidence is missing or mismatched' $transactionReady}
+    $readyRoot=if([string]::IsNullOrWhiteSpace($ExpectedInstallRoot)){[string]$Transaction.readyEvidence.installRoot}else{$ExpectedInstallRoot}
+    [void](Assert-CcodUninstallBootstrapReadyEvidence -ReadyEvidence $Transaction.readyEvidence -ExpectedInstallRoot $readyRoot -ExpectedRuntimeId $Transaction.runtimeId -ExpectedRuntimeGeneration $Transaction.runtimeGeneration -ErrorId 'CCOD_UNINSTALL_TRANSACTION_INVALID')
     if($null-ne$Transaction.installedBinding){$binding=$Transaction.installedBinding;if(-not(Test-CcodUninstallBootstrapExactProperties $binding @('selectedRuntimeRoot','runtimeManifestSha256','wrapperPid','wrapperCreationTimeUtc','wrapperSessionId','wrapperUserSid'))-or$binding.selectedRuntimeRoot-isnot[string]-or-not[IO.Path]::IsPathRooted($binding.selectedRuntimeRoot)-or$binding.runtimeManifestSha256-isnot[string]-or$binding.runtimeManifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$binding.wrapperPid-isnot[int]-or$binding.wrapperPid-lt1-or-not(Test-CcodUninstallBootstrapCanonicalUtc $binding.wrapperCreationTimeUtc)-or$binding.wrapperSessionId-isnot[int]-or$binding.wrapperSessionId-lt0-or$binding.wrapperUserSid-isnot[string]-or$binding.wrapperUserSid-cnotmatch'^S-'){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_INVALID' 'Installed finalization binding is invalid' $binding}}
     $started = [DateTime]::ParseExact($Transaction.startedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
     $updated = [DateTime]::ParseExact($Transaction.updatedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
@@ -871,11 +904,12 @@ function New-CcodUninstallBootstrapTransaction {
 }
 
 function Assert-CcodUninstallBootstrapTransactionMatchesContext {
-    param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$Context)
-    Assert-CcodUninstallBootstrapTransaction $Transaction
-    Assert-CcodUninstallBootstrapContext $Context
+    param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$Context,[string]$ExpectedInstallRoot)
+    Assert-CcodUninstallBootstrapTransaction $Transaction -ExpectedInstallRoot $ExpectedInstallRoot
+    Assert-CcodUninstallBootstrapContext $Context -ExpectedInstallRoot $ExpectedInstallRoot
     if ($Transaction.runtimeId -cne $Context.runtimeId -or [uint64]$Transaction.runtimeGeneration -ne [uint64]$Context.runtimeGeneration -or
-        [uint64]$Transaction.leaseEpoch -ne [uint64]$Context.leaseEpoch -or $Transaction.userSid -cne $Context.userSid -or $Transaction.sessionId -ne $Context.sessionId) {
+        [uint64]$Transaction.leaseEpoch -ne [uint64]$Context.leaseEpoch -or $Transaction.userSid -cne $Context.userSid -or $Transaction.sessionId -ne $Context.sessionId -or
+        ($Transaction.readyEvidence|ConvertTo-Json -Depth 8 -Compress)-cne($Context.readyEvidence|ConvertTo-Json -Depth 8 -Compress)) {
         Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISMATCH' 'The existing uninstall transaction does not match the current verified runtime' $Transaction
     }
 }
@@ -891,8 +925,8 @@ function Get-CcodUninstallBootstrapAdapters {
             Get-CcodUninstallBootstrapDefaultTransactionRoot
         }
         ReadTransaction = {
-            param($TransactionRoot,$ExpectedUserSid,$IncludeCompleted)
-            Read-CcodUninstallBootstrapStoredTransaction -TransactionRoot $TransactionRoot -ExpectedUserSid $ExpectedUserSid -IncludeCompleted:([bool]$IncludeCompleted)
+            param($TransactionRoot,$ExpectedUserSid,$IncludeCompleted,$ExpectedInstallRoot)
+            Read-CcodUninstallBootstrapStoredTransaction -TransactionRoot $TransactionRoot -ExpectedUserSid $ExpectedUserSid -IncludeCompleted:([bool]$IncludeCompleted) -ExpectedInstallRoot $ExpectedInstallRoot
         }
         ValidateFinalizationInvocation = {
             param($TransactionRoot,$Transaction,$Identity)
@@ -999,9 +1033,9 @@ function Invoke-CcodUninstallBootstrap {
         $identity = Get-CcodUninstallBootstrapCurrentIdentity
         $transactionLock = Enter-CcodUninstallBootstrapTransactionLock -UserSid $identity.userSid
         try {
-            $transaction = & $adapter.ReadTransaction $transactionRoot $identity.userSid $true
+            $transaction = & $adapter.ReadTransaction $transactionRoot $identity.userSid $true $InstallRoot
             if ($null -eq $transaction) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISSING' 'No resumable uninstall transaction exists' $transactionRoot }
-            Assert-CcodUninstallBootstrapTransaction $transaction
+            Assert-CcodUninstallBootstrapTransaction $transaction -ExpectedInstallRoot $InstallRoot
             if ($transaction.phase -ne 'ReadyForInno') { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_FINALIZATION_INVALID' 'The uninstall transaction is not ready for Inno finalization' $transaction }
             & $adapter.ValidateFinalizationInvocation $transactionRoot $transaction $identity
             if (-not (& $adapter.TestInstallRootAbsent $InstallerRoot)) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_FINALIZATION_INCOMPLETE' 'Inno did not remove the application root' $InstallerRoot }
@@ -1032,7 +1066,7 @@ function Invoke-CcodUninstallBootstrap {
         $validationFailure = $null
         try {
             $context = & $adapter.ValidateInvocation $InstallerRoot $InstallRoot
-            Assert-CcodUninstallBootstrapContext $context
+            Assert-CcodUninstallBootstrapContext $context -ExpectedInstallRoot $InstallRoot
         } catch {
             $validationFailure = $_
             $context = $null
@@ -1044,7 +1078,7 @@ function Invoke-CcodUninstallBootstrap {
             Get-CcodUninstallBootstrapCurrentIdentity
         }
         $transactionLock = Enter-CcodUninstallBootstrapTransactionLock -UserSid $identity.userSid
-        $existing = & $adapter.ReadTransaction $transactionRoot $identity.userSid $true
+        $existing = & $adapter.ReadTransaction $transactionRoot $identity.userSid $true $InstallRoot
         if ($null -eq $context) {
             if ($null -eq $existing) { throw $validationFailure }
             $context = New-CcodUninstallBootstrapResumeContext -InstallerRoot $InstallerRoot -InstallRoot $InstallRoot -Transaction $existing -Identity $identity
@@ -1065,7 +1099,7 @@ function Invoke-CcodUninstallBootstrap {
             & $adapter.PublishTransaction $transactionRoot $transactionId $context.userSid ([bool]$replaceCompletedLocator)
             $stagePayload = $true
         } else {
-            Assert-CcodUninstallBootstrapTransactionMatchesContext $transaction $context
+            Assert-CcodUninstallBootstrapTransactionMatchesContext $transaction $context $InstallRoot
             if($Mode-ceq'PrepareInstalled'){$binding=&$adapter.GetInstalledBinding $InstallerRoot $InstallRoot $context $WrapperIdentity;if($null-eq$transaction.installedBinding-or($binding|ConvertTo-Json -Compress)-cne($transaction.installedBinding|ConvertTo-Json -Compress)){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISMATCH' 'Installed wrapper binding changed during resume' $binding}}
             $stageRoot = & $adapter.GetTransactionDirectory $transactionRoot $transaction.transactionId
             if ($stageRoot -isnot [string] -or [string]::IsNullOrWhiteSpace($stageRoot)) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_ROOT_INVALID' 'The external uninstall transaction root is invalid' $stageRoot }
@@ -1074,7 +1108,7 @@ function Invoke-CcodUninstallBootstrap {
         if ($stagePayload) { & $adapter.StagePayload $InstallerRoot $InstallRoot $context $stageRoot }
         $result = & $adapter.RunCleanup $InstallerRoot $InstallRoot $stageRoot $transaction $adapter.WriteTransaction $Mode
         if ($null -eq $result) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PREPARE_FAILED' 'The staged cleanup returned no transaction receipt' $stageRoot }
-        Assert-CcodUninstallBootstrapTransactionMatchesContext $result $context
+        Assert-CcodUninstallBootstrapTransactionMatchesContext $result $context $InstallRoot
         $expectedPhase=if($Mode-ceq'PrepareInstalled'){'TaskRemoved'}else{'ReadyForInno'}
         if ($result.phase -cne $expectedPhase) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PREPARE_FAILED' 'The staged cleanup did not reach its expected external boundary' $result }
         if($Mode-ceq'Prepare'){& $adapter.RemoveProductRegistration $context}
@@ -1083,7 +1117,7 @@ function Invoke-CcodUninstallBootstrap {
     } catch {
         $code = Get-CcodUninstallBootstrapErrorId $_
         if ($code -notmatch '^CCOD_[A-Z0-9_]+$') { $code = 'CCOD_UNINSTALL_PREPARE_FAILED' }
-        if ($null -ne $transaction) { Set-CcodUninstallBootstrapFailedTransaction -Transaction $transaction -Code $code -Adapters $adapter -TransactionRoot $stageRoot }
+        if ($null -ne $transaction -and -not [string]::IsNullOrWhiteSpace([string]$stageRoot)) { Set-CcodUninstallBootstrapFailedTransaction -Transaction $transaction -Code $code -Adapters $adapter -TransactionRoot $stageRoot }
         if ((Get-CcodUninstallBootstrapErrorId $_) -ceq $code) { throw }
         Throw-CcodUninstallBootstrapError $code 'The uninstall bootstrap failed before Inno deletion' $stageRoot
     } finally {
diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index 08775ad..5461485 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -299,6 +299,7 @@ internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
     private static SafeFileHandle OpenAbsoluteDirectory(string path,bool allowWrite){uint access=LIST_DIRECTORY|READ_ATTRIBUTES|SYNC;if(allowWrite)access|=ADD_FILE|ADD_SUBDIRECTORY;SafeFileHandle handle=CreateFileW(path,access,SHARE_READ|SHARE_WRITE,IntPtr.Zero,OPEN_EXISTING,FLAG_BACKUP|FLAG_REPARSE,IntPtr.Zero);if(handle.IsInvalid)throw new Win32Exception(Marshal.GetLastWin32Error());return handle;}
     private static void ValidateCurrent(Pin pin){FILE_INFO info=Info(pin.Native);if(info.VolumeSerialNumber!=pin.Volume||(((ulong)info.FileIndexHigh<<32)|info.FileIndexLow)!=pin.Index||IsDirectory(info)!=pin.Directory||(info.FileAttributes&ATTR_REPARSE)!=0||!SamePath(FinalPath(pin.Native),pin.Path))throw new InvalidDataException("pin changed");if(!OnlyDefaultStream(pin.Native))throw new InvalidDataException("alternate stream");if(!pin.Directory&&info.NumberOfLinks!=1)throw new InvalidDataException("multi-link");}
     private static void ValidatePlain(FILE_INFO info,SafeFileHandle handle){if(IsDirectory(info))throw new InvalidDataException("file type");if((info.FileAttributes&ATTR_REPARSE)!=0)throw new InvalidDataException("reparse leaf");if(info.NumberOfLinks!=1)throw new InvalidDataException("multi-link");if(!OnlyDefaultStream(handle))throw new InvalidDataException("alternate stream");}
+    internal static object[] ReadAuthorityFile(string path){SafeFileHandle handle=CreateFileW(path,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,IntPtr.Zero,OPEN_EXISTING,NON_DIRECTORY|FLAG_BACKUP|FLAG_REPARSE,IntPtr.Zero);if(handle.IsInvalid){int error=Marshal.GetLastWin32Error();handle.Dispose();throw new Win32Exception(error);}FileStream stream=null;try{stream=new FileStream(handle,FileAccess.Read,65536,false);handle=null;FILE_INFO before=Info(stream.SafeFileHandle);ValidatePlain(before,stream.SafeFileHandle);string finalPath=FinalPath(stream.SafeFileHandle);if(!SamePath(finalPath,path)||stream.Length<0||stream.Length>4194304)throw new InvalidDataException("authority file invalid");byte[] bytes=new byte[(int)stream.Length];int offset=0;while(offset<bytes.Length){int read=stream.Read(bytes,offset,bytes.Length-offset);if(read==0)throw new EndOfStreamException();offset+=read;}FILE_INFO after=Info(stream.SafeFileHandle);ValidatePlain(after,stream.SafeFileHandle);if(before.VolumeSerialNumber!=after.VolumeSerialNumber||before.FileIndexHigh!=after.FileIndexHigh||before.FileIndexLow!=after.FileIndexLow||!SamePath(FinalPath(stream.SafeFileHandle),finalPath))throw new InvalidDataException("path changed");string sha;using(SHA256 hash=SHA256.Create()){sha=BitConverter.ToString(hash.ComputeHash(bytes)).Replace("-","").ToLowerInvariant();}return new object[]{Convert.ToBase64String(bytes),sha};}finally{if(stream!=null)stream.Dispose();if(handle!=null)handle.Dispose();}}
     private static bool IsDirectory(FILE_INFO info){return(info.FileAttributes&ATTR_DIRECTORY)!=0;}
     private static FILE_INFO Info(SafeFileHandle handle){FILE_INFO info;if(handle==null||handle.IsClosed||!GetFileInformationByHandle(handle,out info))throw new Win32Exception(Marshal.GetLastWin32Error());return info;}
     private static string Sha(FileStream stream){long position=stream.Position;using(SHA256 hash=SHA256.Create()){stream.Position=0;string value=BitConverter.ToString(hash.ComputeHash(stream)).Replace("-","").ToLowerInvariant();stream.Position=position;return value;}}
@@ -365,9 +366,55 @@ function Open-CcodInstallGeneration {
     $runtime=$arguments[2];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$RuntimeId;RootToken=$token;StateOnly=$false;ProductOnly=$false;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='Generation';ReadOnly=$false;RuntimeId=$RuntimeId});$transaction
 }
 function Open-CcodInstallStateTransaction { param([Parameter(Mandatory)][string]$InstallRoot) Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenState $arguments} 'CCOD_INSTALL_STATE_TRANSACTION_INVALID';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$null;RootToken=$token;StateOnly=$true;ProductOnly=$false;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='StateTransaction';ReadOnly=$false;RuntimeId=$null});$transaction }
-function Open-CcodInstallProductRegistrationTransaction {param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$ReadyTransaction)$strictNames=@('schemaVersion','transactionId','oldRuntimeId','oldGeneration','oldManifestSha256','newRuntimeId','newGeneration','newManifestSha256','sealedPackageSha256','ownedObjectNames','phase','errorCode');if((@($ReadyTransaction.PSObject.Properties.Name)-join'|')-cne($strictNames-join'|')){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Complete Ready transaction identity is required' $ReadyTransaction};$ReadyEvidence=[pscustomobject][ordered]@{phase=$ReadyTransaction.phase;runtimeId=$ReadyTransaction.newRuntimeId;runtimeGeneration=[uint64]$ReadyTransaction.newGeneration;manifestSha256=$ReadyTransaction.newManifestSha256;packageSha256=$ReadyTransaction.sealedPackageSha256};Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$properties=@($ReadyEvidence.PSObject.Properties);$names=@('phase','runtimeId','runtimeGeneration','manifestSha256','packageSha256');if($properties.Count-ne$names.Count-or(@($properties.Name)-join'|')-cne($names-join'|')-or$ReadyEvidence.phase-cne'Ready'-or$ReadyEvidence.runtimeId-isnot[string]-or[uint64]$ReadyEvidence.runtimeGeneration-lt1-or$ReadyEvidence.manifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.packageSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Product transaction requires exact Ready evidence' $ReadyEvidence};$root=[IO.Path]::GetFullPath($InstallRoot);$pointerRoot=Join-Path $root 'state\active-generation';$pointerLeaves=@(Get-ChildItem -LiteralPath $pointerRoot -File -Force -ErrorAction Stop|Sort-Object Name);if($pointerLeaves.Count-eq0-or$pointerLeaves[-1].Name-cne('{0:D20}.json'-f[uint64]$ReadyEvidence.runtimeGeneration)){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Ready evidence is not the latest selected generation' $ReadyEvidence};$pointerPath=Join-Path $root ('state\active-generation\{0:D20}.json'-f[uint64]$ReadyEvidence.runtimeGeneration);$manifestPath=Join-Path (Join-Path (Join-Path $root 'runtime') $ReadyEvidence.runtimeId) 'manifest.json';try{$pointer=Get-Content -LiteralPath $pointerPath -Raw -ErrorAction Stop|ConvertFrom-Json -ErrorAction Stop;if([string]$pointer.activeRuntime-cne[string]$ReadyEvidence.runtimeId-or[uint64]$pointer.generation-ne[uint64]$ReadyEvidence.runtimeGeneration-or(Get-FileHash -LiteralPath $manifestPath -Algorithm SHA256 -ErrorAction Stop).Hash.ToLowerInvariant()-cne[string]$ReadyEvidence.manifestSha256){throw 'selected pointer or manifest mismatch'};$matches=@();foreach($file in @(Get-ChildItem -LiteralPath (Join-Path $root 'state\install-transactions') -File -Force -ErrorAction Stop)){try{$record=Get-Content -LiteralPath $file.FullName -Raw -ErrorAction Stop|ConvertFrom-Json -ErrorAction Stop;$recordNames=@($record.PSObject.Properties.Name);$strictNames=@('schemaVersion','transactionId','oldRuntimeId','oldGeneration','oldManifestSha256','newRuntimeId','newGeneration','newManifestSha256','sealedPackageSha256','ownedObjectNames','phase','errorCode');if(($recordNames-join'|')-cne($strictNames-join'|')){throw 'noncanonical transaction record'};if($record.phase-ceq'Ready'-and$record.newRuntimeId-ceq$ReadyEvidence.runtimeId-and[uint64]$record.newGeneration-eq[uint64]$ReadyEvidence.runtimeGeneration-and$record.newManifestSha256-ceq$ReadyEvidence.manifestSha256-and$record.sealedPackageSha256-ceq$ReadyEvidence.packageSha256){$matches+=,$record}}catch{throw}};if($matches.Count-ne1){throw 'matching Ready record missing or ambiguous'}}catch{Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Selected pointer manifest and Ready record could not be proven' $ReadyEvidence};$arguments=[object[]]@($root,$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenProduct $arguments} 'CCOD_INSTALL_PRODUCT_SCOPE';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=$root.TrimEnd('\');RuntimeId=$ReadyEvidence.runtimeId;RootToken=$token;StateOnly=$false;ProductOnly=$true;ReadyEvidence=$ReadyEvidence;ReadyCanonical=($ReadyTransaction|ConvertTo-Json -Depth 8 -Compress);Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='ProductTransaction';ReadOnly=$true;RuntimeId=$ReadyEvidence.runtimeId});$transaction}
 function Open-CcodInstallRetainedGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)][string]$ExpectedManifestSha256,[Parameter(Mandatory)]$FileTransaction) if(-not[IO.Path]::IsPathRooted($InstallRoot)-or$ExpectedManifestSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_GENERATION_INVALID' 'Invalid retained generation contract' $RuntimeId};Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';if(-not[object]::ReferenceEquals($scope.Record.Transaction,$FileTransaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'FileTransaction must be the transaction root capability' $null};Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$nativeResult=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetained @($RuntimeId,$ExpectedManifestSha256)} 'CCOD_INSTALL_RETAINED_GENERATION_INVALID';if(@($nativeResult).Count-ne 2-or-not(Test-CcodRetainedManifestIdentity ([string]$nativeResult[1]) $RuntimeId)){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH' 'Retained manifest must contain exactly one matching top-level runtimeId string' $RuntimeId};Add-CcodInstallScope $scope.Record.Transaction $nativeResult[0] Generation $true $RuntimeId }
-function Open-CcodInstallRetainedFile {param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$RelativePath,[Parameter(Mandatory)]$ReadyTransaction)$canonical=$ReadyTransaction|ConvertTo-Json -Depth 8 -Compress;$ReadyEvidence=[pscustomobject][ordered]@{phase=$ReadyTransaction.phase;runtimeId=$ReadyTransaction.newRuntimeId;runtimeGeneration=[uint64]$ReadyTransaction.newGeneration;manifestSha256=$ReadyTransaction.newManifestSha256;packageSha256=$ReadyTransaction.sealedPackageSha256};if($RelativePath-cnotin@('registration/StartMenu.CodexRemote-fix.lnk','registration/Desktop.CodexRemote-fix.lnk')){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Product shortcut source must be one fixed manifest-relative candidate' $RelativePath};$scope=Get-CcodInstallTransaction $Generation 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';if($scope.State.ReadyCanonical-cne$canonical-or$ReadyEvidence.phase-cne'Ready'-or$ReadyEvidence.runtimeId-cne$scope.Record.RuntimeId-or[uint64]$ReadyEvidence.runtimeGeneration-lt1-or$ReadyEvidence.manifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.packageSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Retained shortcut source lacks exact Ready selection evidence' $ReadyEvidence};$root=$scope.State.InstallRoot;$pointer=Get-Content -LiteralPath (Join-Path $root ('state\active-generation\{0:D20}.json'-f[uint64]$ReadyEvidence.runtimeGeneration)) -Raw -ErrorAction Stop|ConvertFrom-Json -ErrorAction Stop;if($pointer.activeRuntime-cne$ReadyEvidence.runtimeId-or[uint64]$pointer.generation-ne[uint64]$ReadyEvidence.runtimeGeneration){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Retained shortcut source is not selected' $ReadyEvidence};$result=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetainedFile @($scope.Record.Token,$RelativePath)} 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';if(@($result).Count-ne3-or[int64]$result[1]-lt0-or[string]$result[2]-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Retained product shortcut identity is invalid' $RelativePath};Add-CcodInstallScope $scope.Record.Transaction $result[0] RetainedFile $true $scope.Record.RuntimeId}
+
+$script:CcodProductReadyFields=@('schemaVersion','transactionId','oldRuntimeId','oldGeneration','oldManifestSha256','newRuntimeId','newGeneration','newManifestSha256','sealedPackageSha256','ownedObjectNames','phase','errorCode')
+$script:CcodProductReadyPhases=@('Prepared','PackageVerified','RuntimeStaged','PreviousProtectionStopped','RuntimePromoted','PointerCommitted','StableShellCommitted','ProtectionReady','Ready')
+function Test-CcodInstallOrderedProperties($Value,[string[]]$Names){if($null-eq$Value){return $false};$actual=@($Value.PSObject.Properties.Name);return(($actual-join"`0")-ceq($Names-join"`0"))}
+function Test-CcodInstallUnsignedInteger($Value){return $Value-is[byte]-or$Value-is[uint16]-or$Value-is[uint32]-or$Value-is[uint64]-or$Value-is[int16]-or$Value-is[int32]-or$Value-is[int64]}
+function Read-CcodInstallAuthorityFile {
+    param([Parameter(Mandatory)][string]$Path)
+    Initialize-CcodInstallRuntime
+    try{$result=@(Invoke-CcodRuntimeStatic ReadAuthorityFile @([IO.Path]::GetFullPath($Path)));if($result.Count-ne2-or$result[0]-isnot[string]-or$result[1]-isnot[string]-or$result[1]-cnotmatch'^[0-9a-f]{64}$'){throw 'authority read result invalid'};$bytes=[Convert]::FromBase64String([string]$result[0]);return [pscustomobject]@{Bytes=$bytes;Sha256=[string]$result[1]}}
+    catch{if(([string]$_.FullyQualifiedErrorId-split',')[0]-ceq'CCOD_INSTALL_PRODUCT_SCOPE'){throw};Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Authority file could not be read from one verified native handle' $Path}
+}
+function Assert-CcodInstallProductReadyRecord($Record){
+    $valid=Test-CcodInstallOrderedProperties $Record $script:CcodProductReadyFields
+    if(-not$valid){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Complete strict Ready transaction identity is required' $Record}
+    $valid=$valid-and$Record.schemaVersion-is[int]-and$Record.schemaVersion-eq1-and$Record.transactionId-is[string]-and$Record.transactionId-cmatch'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
+    $valid=$valid-and$Record.newRuntimeId-is[string]-and$Record.newRuntimeId-cmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$'-and(Test-CcodInstallUnsignedInteger $Record.newGeneration)-and[uint64]$Record.newGeneration-gt0
+    $valid=$valid-and$Record.newManifestSha256-is[string]-and$Record.newManifestSha256-cmatch'^[0-9a-f]{64}$'-and$Record.sealedPackageSha256-is[string]-and$Record.sealedPackageSha256-cmatch'^[0-9a-f]{64}$'
+    $oldNull=$null-eq$Record.oldRuntimeId;$valid=$valid-and($oldNull-eq($null-eq$Record.oldGeneration))-and($oldNull-eq($null-eq$Record.oldManifestSha256))
+    if(-not$oldNull){$valid=$valid-and$Record.oldRuntimeId-is[string]-and$Record.oldRuntimeId-cmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$'-and(Test-CcodInstallUnsignedInteger $Record.oldGeneration)-and[uint64]$Record.oldGeneration-gt0-and$Record.oldManifestSha256-is[string]-and$Record.oldManifestSha256-cmatch'^[0-9a-f]{64}$'}
+    $valid=$valid-and($Record.ownedObjectNames-is[Array]);$owned=@($Record.ownedObjectNames);$seen=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal);$valid=$valid-and$owned.Count-le64;foreach($name in $owned){$valid=$valid-and$name-is[string]-and$name-cmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$'-and$seen.Add([string]$name)}
+    $valid=$valid-and$Record.phase-is[string]-and(@($script:CcodProductReadyPhases)+'Failed')-ccontains$Record.phase-and(($Record.phase-ceq'Failed'-and$Record.errorCode-is[string]-and$Record.errorCode-cmatch'^CCOD_[A-Z0-9_]{1,96}$')-or($Record.phase-cne'Failed'-and$null-eq$Record.errorCode))
+    if(-not$valid){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Complete strict Ready transaction identity is required' $Record};return $true
+}
+function Read-CcodInstallProductStrictJson([string]$Path,[string[]]$Fields){$read=Read-CcodInstallAuthorityFile -Path $Path;$json=[Text.UTF8Encoding]::new($false,$true).GetString($read.Bytes);foreach($field in $Fields){if((Get-CcodTopLevelJsonPropertyCount $json $field)-ne1){throw 'duplicate or missing authority member'}};$value=$json|ConvertFrom-Json -ErrorAction Stop;if(-not(Test-CcodInstallOrderedProperties $value $Fields)){throw 'noncanonical authority record'};return $value}
+function Get-CcodInstallProductReadyAuthority([string]$InstallRoot,$ReadyTransaction){
+    [void](Assert-CcodInstallProductReadyRecord $ReadyTransaction);if($ReadyTransaction.phase-cne'Ready'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Terminal Ready transaction is required' $ReadyTransaction}
+    $root=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');try{
+        foreach($directory in @((Join-Path $root 'state'),(Join-Path $root 'state\active-generation'),(Join-Path $root 'state\install-transactions'))){$item=Get-Item -LiteralPath $directory -Force -ErrorAction Stop;if(-not$item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){throw 'unsafe authority directory'}}
+        $pointerRoot=Join-Path $root 'state\active-generation';$pointerObjects=@(Get-ChildItem -LiteralPath $pointerRoot -Force -ErrorAction Stop|Sort-Object Name);if($pointerObjects.Count-eq0){throw 'pointer chain missing'};$latest=$null
+        for($index=0;$index-lt$pointerObjects.Count;$index++){$expectedGeneration=[uint64]($index+1);$file=$pointerObjects[$index];$expectedLeaf='{0:D20}.json'-f$expectedGeneration;if($file.PSIsContainer-or$file.Name-cne$expectedLeaf){throw 'pointer chain is not contiguous'};$pointer=Read-CcodInstallProductStrictJson $file.FullName @('schemaVersion','generation','activeRuntime','previousGeneration');if($pointer.schemaVersion-isnot[int]-or$pointer.schemaVersion-ne1-or-not(Test-CcodInstallUnsignedInteger $pointer.generation)-or[uint64]$pointer.generation-ne$expectedGeneration-or$pointer.activeRuntime-isnot[string]-or$pointer.activeRuntime-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$'-or-not(Test-CcodInstallUnsignedInteger $pointer.previousGeneration)-or[uint64]$pointer.previousGeneration-ne[uint64]$index){throw 'pointer record invalid'};$latest=$pointer}
+        if([uint64]$latest.generation-ne[uint64]$ReadyTransaction.newGeneration-or$latest.activeRuntime-cne$ReadyTransaction.newRuntimeId){throw 'Ready transaction is stale'}
+        $manifestPath=Join-Path (Join-Path (Join-Path $root 'runtime') $ReadyTransaction.newRuntimeId) 'manifest.json';$manifestRead=Read-CcodInstallAuthorityFile -Path $manifestPath;$manifestSha=$manifestRead.Sha256;if($manifestSha-cne$ReadyTransaction.newManifestSha256){throw 'manifest mismatch'}
+        $store=Join-Path $root 'state\install-transactions';$records=@();foreach($file in @(Get-ChildItem -LiteralPath $store -Force -ErrorAction Stop|Sort-Object Name)){if($file.PSIsContainer-or$file.Name-cnotmatch'^\d{20}\.\d{2}\.[A-Za-z]+\.[0-9a-f-]{36}\.json$'){throw 'unknown transaction object'};$record=Read-CcodInstallProductStrictJson $file.FullName $script:CcodProductReadyFields;[void](Assert-CcodInstallProductReadyRecord $record);$phaseIndex=if($record.phase-ceq'Failed'){99}else{[Array]::IndexOf($script:CcodProductReadyPhases,[string]$record.phase)};$expectedLeaf='{0:D20}.{1:D2}.{2}.{3}.json'-f[uint64]$record.newGeneration,$phaseIndex,$record.phase,$record.transactionId;if($file.Name-cne$expectedLeaf){throw 'transaction leaf is noncanonical'};$records+=,$record}
+        $heads=@();foreach($group in @($records|Group-Object transactionId)){$chain=@($group.Group|Sort-Object @{Expression={if($_.phase-ceq'Failed'){99}else{[Array]::IndexOf($script:CcodProductReadyPhases,[string]$_.phase)}}});if($chain.Count-eq0-or$chain[0].phase-cne'Prepared'){throw 'transaction chain start'};$identity=$chain[0].PSObject.Copy();$identity.phase='Ready';$identity.errorCode=$null;for($index=0;$index-lt$chain.Count;$index++){$current=$chain[$index];$comparison=$current.PSObject.Copy();$comparison.phase='Ready';$comparison.errorCode=$null;if(($comparison|ConvertTo-Json -Depth 8 -Compress)-cne($identity|ConvertTo-Json -Depth 8 -Compress)){throw 'transaction identity changed'};if($index-gt0-and$current.phase-cne'Failed'-and[Array]::IndexOf($script:CcodProductReadyPhases,[string]$current.phase)-ne([Array]::IndexOf($script:CcodProductReadyPhases,[string]$chain[$index-1].phase)+1)){throw 'transaction chain gap'}};$heads+=,$chain[-1]}
+        $wanted=$ReadyTransaction|ConvertTo-Json -Depth 8 -Compress;$matches=@($heads|Where-Object{$_.phase-ceq'Ready'-and($_|ConvertTo-Json -Depth 8 -Compress)-ceq$wanted});if($matches.Count-ne1){throw 'unique full Ready record missing'}
+        return [pscustomobject]@{ReadyCanonical=$wanted;PersistedReadyCanonical=($matches[0]|ConvertTo-Json -Depth 8 -Compress);RuntimeId=[string]$ReadyTransaction.newRuntimeId;Generation=[uint64]$ReadyTransaction.newGeneration;ManifestSha256=[string]$manifestSha;PackageSha256=[string]$ReadyTransaction.sealedPackageSha256}
+    }catch{if(([string]$_.FullyQualifiedErrorId-split',')[0]-ceq'CCOD_INSTALL_PRODUCT_SCOPE'){throw};Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Complete selector manifest and persisted Ready authority could not be proven' $ReadyTransaction}
+}
+
+function Open-CcodInstallProductRegistrationTransaction {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$ReadyTransaction)
+    Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$root=[IO.Path]::GetFullPath($InstallRoot);$authority=Get-CcodInstallProductReadyAuthority $root $ReadyTransaction
+    $arguments=[object[]]@($root,$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenProduct $arguments} 'CCOD_INSTALL_PRODUCT_SCOPE';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=$root.TrimEnd('\');RuntimeId=$authority.RuntimeId;RootToken=$token;StateOnly=$false;ProductOnly=$true;ReadyAuthority=$authority;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='ProductTransaction';ReadOnly=$true;RuntimeId=$authority.RuntimeId});$transaction
+}
+function Open-CcodInstallRetainedFile {
+    param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$RelativePath,[Parameter(Mandatory)]$ReadyTransaction)
+    if($RelativePath-cnotin@('registration/StartMenu.CodexRemote-fix.lnk','registration/Desktop.CodexRemote-fix.lnk')){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Product shortcut source must be one fixed manifest-relative candidate' $RelativePath};$scope=Get-CcodInstallTransaction $Generation 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';$authority=Get-CcodInstallProductReadyAuthority $scope.State.InstallRoot $ReadyTransaction;$stored=$scope.State.ReadyAuthority;if($null-eq$stored-or$authority.ReadyCanonical-cne$stored.ReadyCanonical-or$authority.PersistedReadyCanonical-cne$stored.PersistedReadyCanonical-or$authority.RuntimeId-cne$stored.RuntimeId-or$authority.Generation-ne$stored.Generation-or$authority.ManifestSha256-cne$stored.ManifestSha256-or$authority.PackageSha256-cne$stored.PackageSha256-or$authority.RuntimeId-cne$scope.Record.RuntimeId){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Retained shortcut source authority changed after capability open' $ReadyTransaction};$result=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetainedFile @($scope.Record.Token,$RelativePath)} 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';if(@($result).Count-ne3-or[int64]$result[1]-lt0-or[string]$result[2]-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Retained product shortcut identity is invalid' $RelativePath};Add-CcodInstallScope $scope.Record.Transaction $result[0] RetainedFile $true $scope.Record.RuntimeId
+}
 function New-CcodInstallDirectory { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$Parent,[Parameter(Mandatory)][string]$Leaf,[switch]$CreateIfMissing) Assert-CcodInstallLeaf $Leaf;$transactionScope=Get-CcodInstallTransaction $Transaction 'CCOD_INSTALL_TRANSACTION_INVALID';if(-not[object]::ReferenceEquals($transactionScope.Record.Transaction,$Transaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Transaction capability must be the transaction root' $null};if([object]::ReferenceEquals($Parent,$Transaction)){$token=Invoke-CcodRuntimeMethod $transactionScope.State.Runtime GetInstallRoot @();$parentScope=[pscustomobject]@{State=$transactionScope.State;Record=[pscustomobject]@{Transaction=$Transaction;Token=$token;Kind='Directory';ReadOnly=$false;RuntimeId=$null}}}else{$parentScope=Get-CcodInstallScopedDirectory $Transaction $Parent};Assert-CcodInstallWritableScope $parentScope;$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $parentScope.State.Runtime OpenDirectory @($parentScope.Record.Token,$Leaf,[bool]$CreateIfMissing)} 'CCOD_INSTALL_DIRECTORY_OPEN_FAILED';$readOnly=[bool](Invoke-CcodRuntimeMethod $parentScope.State.Runtime IsRetained @($token));Add-CcodInstallScope $Transaction $token Directory $readOnly $(if($readOnly){$parentScope.Record.RuntimeId}else{$null}) }
 function New-CcodInstallGenerationLeaf { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$Leaf) Assert-CcodInstallLeaf $Leaf;$scope=Get-CcodInstallTransaction $Generation;Assert-CcodInstallWritableScope $scope;if($scope.State.StateOnly){Throw-CcodInstallFileError 'CCOD_INSTALL_STATE_SCOPE' 'State-only transaction cannot create a generation leaf' $Leaf};$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CreateDirectory @($scope.Record.Token,$Leaf)} 'CCOD_INSTALL_LEAF_CREATE_FAILED';Add-CcodInstallScope $scope.Record.Transaction $token Directory $scope.Record.ReadOnly $scope.Record.RuntimeId }
 function Copy-CcodInstallSealedSource { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$SourcePath,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)][int64]$ExpectedLength,[Parameter(Mandatory)][string]$ExpectedSha256) Assert-CcodInstallLeaf $Leaf;if(-not[IO.Path]::IsPathRooted($SourcePath)-or$ExpectedLength-lt 0-or$ExpectedSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_SOURCE_INVALID' 'Invalid sealed source contract' $SourcePath};$scope=Get-CcodInstallTransaction $Generation;Assert-CcodInstallWritableScope $scope;$result=[pscustomobject]@{Length=$ExpectedLength;Sha256=$ExpectedSha256};Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime Copy @($scope.Record.Token,$Leaf,[IO.Path]::GetFullPath($SourcePath),$ExpectedLength,$ExpectedSha256)|Out-Null} 'CCOD_INSTALL_SOURCE_MISMATCH';return $result }
diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index b06af5c..5cce5bb 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -1954,7 +1954,7 @@ function Get-CcodLifecycleAdapters {
             $module=Import-Module (Join-Path $PSScriptRoot 'ProductRegistration.psm1') -Force -PassThru -ErrorAction Stop
             $ownedTransaction=$null;$sourceCapability=$FileTransaction
             try{
-                if($null-eq$sourceCapability){Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop;$fileReady=[pscustomobject][ordered]@{phase='Ready';runtimeId=$RuntimeId;runtimeGeneration=[uint64]$TransactionRecord.newGeneration;manifestSha256=[string]$TransactionRecord.newManifestSha256;packageSha256=$PackageSha256};$ownedTransaction=Open-CcodInstallProductRegistrationTransaction -InstallRoot $InstallRoot -ReadyTransaction $TransactionRecord;$sourceCapability=Open-CcodInstallRetainedGeneration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -ExpectedManifestSha256 ([string]$TransactionRecord.newManifestSha256) -FileTransaction $ownedTransaction}
+                if($null-eq$sourceCapability){Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop;$ownedTransaction=Open-CcodInstallProductRegistrationTransaction -InstallRoot $InstallRoot -ReadyTransaction $TransactionRecord;$sourceCapability=Open-CcodInstallRetainedGeneration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -ExpectedManifestSha256 ([string]$TransactionRecord.newManifestSha256) -FileTransaction $ownedTransaction}
                 $registration=New-CcodProductRegistration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -Version $Version -PackageSha256 $PackageSha256 -FileTransaction $sourceCapability
                 $system=[Environment]::GetFolderPath([Environment+SpecialFolder]::System);$proof=[pscustomobject][ordered]@{phase=[string]$TransactionRecord.phase;runtimeId=$RuntimeId;version=$Version;packageSha256=$PackageSha256;runtimeGeneration=[uint64]$TransactionRecord.newGeneration;manifestSha256=[string]$TransactionRecord.newManifestSha256;startMenuSha256=(Get-CcodLifecycleFileSha256 $registration.startMenuShortcut.candidatePath);desktopSha256=(Get-CcodLifecycleFileSha256 $registration.desktopShortcut.candidatePath);targetPath=[IO.Path]::GetFullPath((Join-Path $system 'schtasks.exe'));arguments='/Run /TN "Codex Control Other Devices Supervisor"';transactionRecord=$TransactionRecord;bootstrapPath=$registration.bootstrapPath;uninstallerPath=$registration.uninstallerPath}
                 $receipt=Commit-CcodProductRegistration -Registration $registration -FileTransaction $sourceCapability -Adapters @{GetReadyProof={param($Ignored)$proof}.GetNewClosure()}
diff --git a/src/persistence/modules/ProductRegistration.psm1 b/src/persistence/modules/ProductRegistration.psm1
index ee3f7bc..09a36a9 100644
--- a/src/persistence/modules/ProductRegistration.psm1
+++ b/src/persistence/modules/ProductRegistration.psm1
@@ -244,11 +244,16 @@ function Remove-CcodCurrentUserLegacyRegistration {
 function Get-CcodProductShortcutEvidence([string]$Kind){
     $path=Get-CcodProductShortcutDestination $Kind;if(-not[IO.File]::Exists($path)){return $null};$item=Get-Item -LiteralPath $path -Force -ErrorAction Stop;if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){return $null};$shell=$null;$link=$null;try{$shell=New-Object -ComObject WScript.Shell;$link=$shell.CreateShortcut($path);[pscustomobject]@{kind=$Kind;path=$path;sha256=Get-CcodProductFileSha256 $path;target=[IO.Path]::GetFullPath([string]$link.TargetPath);arguments=[string]$link.Arguments}}finally{if($null-ne$link){[void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($link)};if($null-ne$shell){[void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($shell)}}
 }
+function Test-CcodCurrentProductRegistryPreflight {
+    param([string[]]$ValueNames,[string[]]$SubKeyNames,[string[]]$AllowedValueNames)
+    if($null-eq$ValueNames-or$null-eq$SubKeyNames-or$null-eq$AllowedValueNames-or@($SubKeyNames).Count-ne0){return $false}
+    return ((@($ValueNames|Sort-Object)-join"`0")-ceq(@($AllowedValueNames|Sort-Object)-join"`0"))
+}
 function Read-CcodCurrentProductState {
     param([string]$ExpectedRuntimeId)
     try{
         $subkey='Software\Microsoft\Windows\CurrentVersion\Uninstall\CodexRemote-fix';$key=[Microsoft.Win32.Registry]::CurrentUser.OpenSubKey($subkey,$false);if($null-eq$key){return [pscustomobject]@{valid=$true;reason=$null;entries=@()}}
-        try{$allowed=@('CcodDesktopSha256','CcodPackageSha256','CcodRuntimeId','CcodRuntimeGeneration','CcodManifestSha256','CcodShortcutArguments','CcodShortcutTarget','CcodStartMenuSha256','DisplayName','DisplayVersion','InstallLocation','NoModify','NoRepair','Publisher','QuietUninstallString','UninstallString');$names=@($key.GetValueNames()|Sort-Object);if(($names-join'|')-cne(($allowed|Sort-Object)-join'|')-or$key.GetSubKeyNames().Count-ne0){return [pscustomobject]@{valid=$false;reason='UnknownRegistryValue';entries=@()}};$runtime=[string]$key.GetValue('CcodRuntimeId',$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);$installLocation=[string]$key.GetValue('InstallLocation');$expectedUninstaller=Join-Path $installLocation 'Uninstall-CodexControlOtherDevices.ps1';$expectedCommand='"{0}" -NoProfile -ExecutionPolicy Bypass -File "{1}"'-f(Get-CcodProductPowerShellPath),$expectedUninstaller;if($runtime-cne$ExpectedRuntimeId-or$installLocation-cne[IO.Path]::GetFullPath((Join-Path (Join-Path (Split-Path (Split-Path $installLocation -Parent) -Parent) 'runtime') $runtime))-or[string]$key.GetValue('DisplayName')-cne'CodexRemote-fix'-or[string]$key.GetValue('DisplayVersion')-cne'2.5.22'-or[string]$key.GetValue('Publisher')-cne'naipi11'-or[string]$key.GetValue('UninstallString')-cne$expectedCommand-or[string]$key.GetValue('QuietUninstallString')-cne($expectedCommand+' -Confirm:$false')-or[int]$key.GetValue('NoModify')-ne1-or[int]$key.GetValue('NoRepair')-ne1-or[string]$key.GetValue('CcodPackageSha256')-cnotmatch'^[0-9a-f]{64}$'){return [pscustomobject]@{valid=$false;reason='RegistryMismatch';entries=@()}};foreach($dword in @('NoModify','NoRepair')){if($key.GetValueKind($dword)-ne[Microsoft.Win32.RegistryValueKind]::DWord){return [pscustomobject]@{valid=$false;reason='RegistryType';entries=@()}}};if($key.GetValueKind('CcodRuntimeGeneration')-ne[Microsoft.Win32.RegistryValueKind]::QWord){return [pscustomobject]@{valid=$false;reason='RegistryType';entries=@()}};foreach($stringName in @($allowed|Where-Object{$_-notin@('NoModify','NoRepair','CcodRuntimeGeneration')})){if($key.GetValueKind($stringName)-ne[Microsoft.Win32.RegistryValueKind]::String){return [pscustomobject]@{valid=$false;reason='RegistryType';entries=@()}}};$target=[string]$key.GetValue('CcodShortcutTarget');$arguments=[string]$key.GetValue('CcodShortcutArguments');$start=Get-CcodProductShortcutEvidence 'StartMenu';$desktop=Get-CcodProductShortcutEvidence 'Desktop';if($null-eq$start-or$null-eq$desktop-or$start.target-cne$target-or$desktop.target-cne$target-or$start.arguments-cne$arguments-or$desktop.arguments-cne$arguments-or$start.sha256-cne[string]$key.GetValue('CcodStartMenuSha256')-or$desktop.sha256-cne[string]$key.GetValue('CcodDesktopSha256')){return [pscustomobject]@{valid=$false;reason='ShortcutMismatch';entries=@()}};$captured=[ordered]@{};foreach($name in $names){$captured[$name]=[pscustomobject]@{value=$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);kind=[string]$key.GetValueKind($name)}};$installRoot=[IO.Path]::GetFullPath((Split-Path (Split-Path $installLocation -Parent) -Parent));$readyEvidence=[pscustomobject][ordered]@{phase='Ready';installRoot=$installRoot;runtimeId=$runtime;runtimeGeneration=[uint64]$key.GetValue('CcodRuntimeGeneration');packageSha256=[string]$key.GetValue('CcodPackageSha256');manifestSha256=[string]$key.GetValue('CcodManifestSha256');startMenuSha256=$start.sha256;desktopSha256=$desktop.sha256;targetPath=$target;arguments=$arguments};return [pscustomobject]@{valid=$true;reason=$null;readyEvidence=$readyEvidence;entries=@([pscustomobject]@{kind='StartMenu';path=$start.path;sha256=$start.sha256},[pscustomobject]@{kind='Desktop';path=$desktop.path;sha256=$desktop.sha256},[pscustomobject]@{kind='Registry';path=$subkey;valueNames=$names;values=$captured})}}
+        try{$allowed=@('CcodDesktopSha256','CcodPackageSha256','CcodRuntimeId','CcodRuntimeGeneration','CcodManifestSha256','CcodShortcutArguments','CcodShortcutTarget','CcodStartMenuSha256','DisplayName','DisplayVersion','InstallLocation','NoModify','NoRepair','Publisher','QuietUninstallString','UninstallString');$names=@($key.GetValueNames()|Sort-Object);if(-not(Test-CcodCurrentProductRegistryPreflight -ValueNames $names -SubKeyNames @($key.GetSubKeyNames()) -AllowedValueNames $allowed)){return [pscustomobject]@{valid=$false;reason='UnknownRegistryValue';entries=@()}};$runtime=[string]$key.GetValue('CcodRuntimeId',$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);$installLocation=[string]$key.GetValue('InstallLocation');$expectedUninstaller=Join-Path $installLocation 'Uninstall-CodexControlOtherDevices.ps1';$expectedCommand='"{0}" -NoProfile -ExecutionPolicy Bypass -File "{1}"'-f(Get-CcodProductPowerShellPath),$expectedUninstaller;if($runtime-cne$ExpectedRuntimeId-or$installLocation-cne[IO.Path]::GetFullPath((Join-Path (Join-Path (Split-Path (Split-Path $installLocation -Parent) -Parent) 'runtime') $runtime))-or[string]$key.GetValue('DisplayName')-cne'CodexRemote-fix'-or[string]$key.GetValue('DisplayVersion')-cne'2.5.22'-or[string]$key.GetValue('Publisher')-cne'naipi11'-or[string]$key.GetValue('UninstallString')-cne$expectedCommand-or[string]$key.GetValue('QuietUninstallString')-cne($expectedCommand+' -Confirm:$false')-or[int]$key.GetValue('NoModify')-ne1-or[int]$key.GetValue('NoRepair')-ne1-or[string]$key.GetValue('CcodPackageSha256')-cnotmatch'^[0-9a-f]{64}$'){return [pscustomobject]@{valid=$false;reason='RegistryMismatch';entries=@()}};foreach($dword in @('NoModify','NoRepair')){if($key.GetValueKind($dword)-ne[Microsoft.Win32.RegistryValueKind]::DWord){return [pscustomobject]@{valid=$false;reason='RegistryType';entries=@()}}};if($key.GetValueKind('CcodRuntimeGeneration')-ne[Microsoft.Win32.RegistryValueKind]::QWord){return [pscustomobject]@{valid=$false;reason='RegistryType';entries=@()}};foreach($stringName in @($allowed|Where-Object{$_-notin@('NoModify','NoRepair','CcodRuntimeGeneration')})){if($key.GetValueKind($stringName)-ne[Microsoft.Win32.RegistryValueKind]::String){return [pscustomobject]@{valid=$false;reason='RegistryType';entries=@()}}};$target=[string]$key.GetValue('CcodShortcutTarget');$arguments=[string]$key.GetValue('CcodShortcutArguments');$start=Get-CcodProductShortcutEvidence 'StartMenu';$desktop=Get-CcodProductShortcutEvidence 'Desktop';if($null-eq$start-or$null-eq$desktop-or$start.target-cne$target-or$desktop.target-cne$target-or$start.arguments-cne$arguments-or$desktop.arguments-cne$arguments-or$start.sha256-cne[string]$key.GetValue('CcodStartMenuSha256')-or$desktop.sha256-cne[string]$key.GetValue('CcodDesktopSha256')){return [pscustomobject]@{valid=$false;reason='ShortcutMismatch';entries=@()}};$captured=[ordered]@{};foreach($name in $names){$captured[$name]=[pscustomobject]@{value=$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);kind=[string]$key.GetValueKind($name)}};$installRoot=[IO.Path]::GetFullPath((Split-Path (Split-Path $installLocation -Parent) -Parent));$readyEvidence=[pscustomobject][ordered]@{phase='Ready';installRoot=$installRoot;runtimeId=$runtime;runtimeGeneration=[uint64]$key.GetValue('CcodRuntimeGeneration');packageSha256=[string]$key.GetValue('CcodPackageSha256');manifestSha256=[string]$key.GetValue('CcodManifestSha256');startMenuSha256=$start.sha256;desktopSha256=$desktop.sha256;targetPath=$target;arguments=$arguments};return [pscustomobject]@{valid=$true;reason=$null;readyEvidence=$readyEvidence;entries=@([pscustomobject]@{kind='StartMenu';path=$start.path;sha256=$start.sha256},[pscustomobject]@{kind='Desktop';path=$desktop.path;sha256=$desktop.sha256},[pscustomobject]@{kind='Registry';path=$subkey;valueNames=$names;values=$captured})}}
         finally{$key.Dispose()}
     }catch{return [pscustomobject]@{valid=$false;reason='Ambiguous';entries=@()}}
 }
@@ -267,7 +272,26 @@ function Read-CcodLegacySnapshot {
     $legacy=Read-CcodCurrentUserLegacyRegistration $ExpectedAppId;if($null-eq$legacy){return $null};$entries=[Collections.Generic.List[object]]::new();$keyPath=Get-CcodLegacyRegistryPath $ExpectedAppId;$key=Get-Item -LiteralPath $keyPath -ErrorAction Stop;$names=@($key.GetValueNames());if($key.GetSubKeyNames().Count-ne0-or@($names|Where-Object{$script:CcodLegacyRegistryValueNames-cnotcontains$_}).Count-ne0){throw 'legacy registry contains unknown state'};$values=[ordered]@{};foreach($name in $names){$values[$name]=[pscustomobject]@{value=$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);kind=[string]$key.GetValueKind($name)}};$entries.Add([pscustomobject]@{kind='Registry';path=$keyPath;values=$values});$programs=[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs);$desktop=[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop);foreach($name in $legacy.shortcutNames){$relative=$name.Substring($name.IndexOf('\')+1);$path=[IO.Path]::GetFullPath($(if($name.StartsWith('Programs\',[StringComparison]::Ordinal)){Join-Path $programs $relative}else{Join-Path $desktop $relative}));$item=Get-Item -LiteralPath $path -Force -ErrorAction Stop;if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){throw 'legacy shortcut unsafe'};$bytes=[IO.File]::ReadAllBytes($path);$entries.Add([pscustomobject]@{kind='Shortcut';name=$name;path=$path;sha256=Get-CcodProductFileSha256 $path;bytesBase64=[Convert]::ToBase64String($bytes)})};[pscustomobject]@{appId=$ExpectedAppId;entries=@($entries)}
 }
 function Remove-CcodLegacySnapshotEntry {param($Entry);if($Entry-is[string]){return};if($Entry.kind-ceq'Registry'){$key=$null;try{$key=Get-Item -LiteralPath $Entry.path -ErrorAction Stop;if((@($key.GetValueNames()|Sort-Object)-join'|')-cne((@($Entry.values.Keys)|Sort-Object)-join'|')-or$key.GetSubKeyNames().Count-ne0){throw 'legacy registry changed'};foreach($name in @($Entry.values.Keys)){$current=$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);if([string]$current-cne[string]$Entry.values[$name].value-or[string]$key.GetValueKind($name)-cne[string]$Entry.values[$name].kind){throw 'legacy registry value changed'}};foreach($name in @($Entry.values.Keys)){$key.DeleteValue($name,$true)};$key.Dispose();$key=$null;Remove-Item -LiteralPath $Entry.path -Force -ErrorAction Stop;return}catch{if($null-ne$key){$key.Dispose()};if(-not(Test-Path -LiteralPath $Entry.path)){New-Item -Path $Entry.path -Force|Out-Null};foreach($name in $Entry.values.Keys){if($null-eq(Get-ItemProperty -LiteralPath $Entry.path -Name $name -ErrorAction SilentlyContinue)){$kind=[Enum]::Parse([Microsoft.Win32.RegistryValueKind],[string]$Entry.values[$name].kind);New-ItemProperty -LiteralPath $Entry.path -Name $name -Value $Entry.values[$name].value -PropertyType $kind -Force|Out-Null}};throw}};if(-not[IO.File]::Exists($Entry.path)-or(Get-CcodProductFileSha256 $Entry.path)-cne$Entry.sha256){throw 'legacy shortcut changed'};Remove-Item -LiteralPath $Entry.path -Force -ErrorAction Stop}
-function Read-CcodLegacySnapshotEntry {param($Entry);if($Entry-is[string]){return $null};if($Entry.kind-ceq'Registry'){if(Test-Path -LiteralPath $Entry.path){return 'Present'};return $null};if([IO.File]::Exists($Entry.path)){return Get-CcodProductFileSha256 $Entry.path};$null}
+function Compare-CcodLegacySnapshotEntry {
+    param($Expected,$Current)
+    if($null-eq$Current){return 'Absent'}
+    if($null-eq$Expected-or$Expected.kind-cne$Current.kind){return 'Mismatch'};$pathMatches=if($Expected.kind-ceq'Registry'){[string]$Expected.path-ceq[string]$Current.path}else{[IO.Path]::GetFullPath([string]$Expected.path)-ceq[IO.Path]::GetFullPath([string]$Current.path)};if(-not$pathMatches){return 'Mismatch'}
+    if($Expected.kind-ceq'Registry'){
+        $subkeys=@(if($null-ne$Current.PSObject.Properties['subKeyNames']){@($Current.subKeyNames)});if($subkeys.Count-ne0-or(@($Expected.values.Keys|Sort-Object)-join"`0")-cne(@($Current.values.Keys|Sort-Object)-join"`0")){return 'Mismatch'}
+        foreach($name in @($Expected.values.Keys)){if([string]$Expected.values[$name].kind-cne[string]$Current.values[$name].kind-or($Expected.values[$name].value|ConvertTo-Json -Compress)-cne($Current.values[$name].value|ConvertTo-Json -Compress)){return 'Mismatch'}}
+        return 'Exact'
+    }
+    if($Expected.kind-ceq'Shortcut'-and$Expected.sha256-is[string]-and$Current.sha256-is[string]-and$Expected.sha256-ceq$Current.sha256){return 'Exact'}
+    return 'Mismatch'
+}
+function Read-CcodLegacySnapshotEntry {
+    param($Entry)
+    if($Entry-is[string]){return $null}
+    if($Entry.kind-ceq'Registry'){
+        if(-not(Test-Path -LiteralPath $Entry.path -PathType Container)){return $null};$key=Get-Item -LiteralPath $Entry.path -ErrorAction Stop;try{$values=[ordered]@{};foreach($name in @($key.GetValueNames())){$values[$name]=[pscustomobject]@{value=$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);kind=[string]$key.GetValueKind($name)}};$current=[pscustomobject]@{kind='Registry';path=[string]$Entry.path;subKeyNames=@($key.GetSubKeyNames());values=$values};return Compare-CcodLegacySnapshotEntry -Expected $Entry -Current $current}finally{$key.Dispose()}
+    }
+    if([IO.File]::Exists($Entry.path)){$current=[pscustomobject]@{kind='Shortcut';path=[string]$Entry.path;sha256=Get-CcodProductFileSha256 $Entry.path};return Compare-CcodLegacySnapshotEntry -Expected $Entry -Current $current};$null
+}
 function Restore-CcodLegacySnapshotEntry {param($Entry);if($Entry-is[string]){return};if($Entry.kind-ceq'Registry'){if(Test-Path -LiteralPath $Entry.path){throw 'legacy registry replacement present'};New-Item -Path $Entry.path -Force|Out-Null;foreach($name in $Entry.values.Keys){$kind=[Enum]::Parse([Microsoft.Win32.RegistryValueKind],[string]$Entry.values[$name].kind);New-ItemProperty -LiteralPath $Entry.path -Name $name -Value $Entry.values[$name].value -PropertyType $kind -Force|Out-Null};return};if([IO.File]::Exists($Entry.path)-or[IO.Directory]::Exists($Entry.path)){throw 'legacy shortcut replacement present'};[IO.Directory]::CreateDirectory((Split-Path $Entry.path -Parent))|Out-Null;$bytes=[Convert]::FromBase64String([string]$Entry.bytesBase64);$stream=[IO.File]::Open($Entry.path,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::Read);try{$stream.Write($bytes,0,$bytes.Length);$stream.Flush($true)}finally{$stream.Dispose()};if((Get-CcodProductFileSha256 $Entry.path)-cne$Entry.sha256){throw 'legacy shortcut restore mismatch'}}
 function Write-CcodLegacyCompensationFailure {param($Record)$local=[Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData);$root=Join-Path $local 'CodexControlOtherDevices\state\legacy-registration-compensation';[IO.Directory]::CreateDirectory($root)|Out-Null;$path=Join-Path $root (([guid]::NewGuid().ToString('D'))+'.json');$bytes=[Text.UTF8Encoding]::new($false).GetBytes(($Record|ConvertTo-Json -Depth 8 -Compress)+"`n");$stream=[IO.File]::Open($path,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::Read);try{$stream.Write($bytes,0,$bytes.Length);$stream.Flush($true)}finally{$stream.Dispose()}}
 
@@ -326,7 +350,13 @@ function Remove-CcodLegacyProductRegistration {
     $snapshot=&$adapter.ReadLegacySnapshot $ExpectedAppId
     if($null-eq$snapshot-or$snapshot.appId-cne$ExpectedAppId-or@($snapshot.entries).Count-ne9){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy snapshot is incomplete or ambiguous' $ExpectedAppId}
     $removed=[Collections.Generic.List[object]]::new()
-    try{foreach($entry in @($snapshot.entries)){&$adapter.RemoveLegacyEntry $entry;$removed.Add($entry)}}catch{$unresolved=[Collections.Generic.List[string]]::new();$failedEntry=$entry;$failedName=if($failedEntry-is[string]){[string]$failedEntry}elseif($failedEntry.kind-ceq'Registry'){'Registry'}else{[string]$failedEntry.name};try{if($null-eq(&$adapter.ReadLegacyEntry $failedEntry)){&$adapter.RestoreLegacyEntry $failedEntry;if($null-eq(&$adapter.ReadLegacyEntry $failedEntry)){$unresolved.Add($failedName)}}}catch{$unresolved.Add($failedName)};for($index=$removed.Count-1;$index-ge0;$index--){$entry=$removed[$index];$name=if($entry-is[string]){[string]$entry}elseif($entry.kind-ceq'Registry'){'Registry'}else{[string]$entry.name};try{if($null-ne(&$adapter.ReadLegacyEntry $entry)){$unresolved.Add($name);continue};&$adapter.RestoreLegacyEntry $entry;if($null-eq(&$adapter.ReadLegacyEntry $entry)){$unresolved.Add($name)}}catch{$unresolved.Add($name)}};if($unresolved.Count-gt0){$record=[pscustomobject][ordered]@{schemaVersion=1;appId=$ExpectedAppId;state='CompensationFailed';entries=@($unresolved);createdAtUtc=[DateTime]::UtcNow.ToString('o',[Globalization.CultureInfo]::InvariantCulture)};try{&$adapter.WriteLegacyCompensationFailure $record}catch{Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED' 'Legacy compensation failure record could not be persisted.' $record};Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED' 'Legacy migration compensation remains unresolved; exact entries were recorded.' $record};Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration failed and the exact prior set was restored.' $ExpectedAppId}
+    try{foreach($entry in @($snapshot.entries)){&$adapter.RemoveLegacyEntry $entry;$removed.Add($entry)}}catch{
+        $unresolved=[Collections.Generic.List[string]]::new();$failedEntry=$entry;$failedName=if($failedEntry-is[string]){[string]$failedEntry}elseif($failedEntry.kind-ceq'Registry'){'Registry'}else{[string]$failedEntry.name}
+        try{$state=&$adapter.ReadLegacyEntry $failedEntry;if($null-eq$state){&$adapter.RestoreLegacyEntry $failedEntry;$state=&$adapter.ReadLegacyEntry $failedEntry};if($state-cne'Exact'){$unresolved.Add($failedName)}}catch{$unresolved.Add($failedName)}
+        for($index=$removed.Count-1;$index-ge0;$index--){$entry=$removed[$index];$name=if($entry-is[string]){[string]$entry}elseif($entry.kind-ceq'Registry'){'Registry'}else{[string]$entry.name};try{$state=&$adapter.ReadLegacyEntry $entry;if($null-eq$state){&$adapter.RestoreLegacyEntry $entry;$state=&$adapter.ReadLegacyEntry $entry};if($state-cne'Exact'){$unresolved.Add($name)}}catch{$unresolved.Add($name)}}
+        if($unresolved.Count-gt0){$record=[pscustomobject][ordered]@{schemaVersion=1;appId=$ExpectedAppId;state='CompensationFailed';entries=@($unresolved);createdAtUtc=[DateTime]::UtcNow.ToString('o',[Globalization.CultureInfo]::InvariantCulture)};try{&$adapter.WriteLegacyCompensationFailure $record}catch{Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED' 'Legacy compensation failure record could not be persisted.' $record};Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED' 'Legacy migration compensation remains unresolved; exact entries were recorded.' $record}
+        Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration failed and the exact prior set was restored.' $ExpectedAppId
+    }
 }
 
 Export-ModuleMember -Function New-CcodProductRegistration,Test-CcodProductRegistration,Commit-CcodProductRegistration,Remove-CcodProductRegistration,Remove-CcodLegacyProductRegistration
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index fb7dd45..2ad5666 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -135,6 +135,18 @@ function New-CcodHardLink {
     if($exitCode-ne 0){throw "Could not create hard link: $($output -join ' ')"}
 }
 
+function Assert-CcodProductTransactionRejected {
+    param([Parameter(Mandatory)][scriptblock]$Action,[Parameter(Mandatory)]$Fixture)
+    try{
+        $unexpected=&$Action
+        if($null-ne$unexpected){$Fixture.Transactions.Add($unexpected)}
+    }catch{
+        if(([string]$_.FullyQualifiedErrorId-split',')[0]-ceq'CCOD_INSTALL_PRODUCT_SCOPE'){return}
+        throw
+    }
+    throw 'ASSERT_THROWS: expected CCOD_INSTALL_PRODUCT_SCOPE'
+}
+
 Invoke-CcodTest 'exports only immutable generation operations and an inert CLR marker' {
     $expected=@('Close-CcodInstallFileTransaction','Commit-CcodInstallActivePointer','Copy-CcodInstallProductShortcut','Copy-CcodInstallSealedSource','New-CcodInstallDirectory','New-CcodInstallGenerationLeaf','Open-CcodInstallGeneration','Open-CcodInstallProductRegistrationTransaction','Open-CcodInstallProductSpecialFolder','Open-CcodInstallRetainedFile','Open-CcodInstallRetainedGeneration','Open-CcodInstallStateTransaction','Retire-CcodInstallGeneration','Write-CcodInstallGenerationManifest','Write-CcodInstallRecord')
     Assert-CcodEqual ($expected -join '|') ((@($module.ExportedCommands.Keys)|Sort-Object)-join '|') 'module export surface is capability-only'
@@ -145,21 +157,69 @@ Invoke-CcodTest 'exports only immutable generation operations and an inert CLR m
     Assert-CcodTrue (-not $module.ExportedCommands['Copy-CcodInstallProductShortcut'].Parameters.ContainsKey('SourcePath')) 'product shortcut copy accepts no arbitrary absolute source path'
 }
 
+Invoke-CcodTest 'authority reader returns bytes and hash from one verified native file handle' {
+    $fixture=New-CcodInstallFileFixture
+    try{
+        $source=New-CcodSourceFile $fixture 'authority-reader.json' '{"schemaVersion":1,"value":"bound"}'
+        $read=&$module {param($Path)Read-CcodInstallAuthorityFile -Path $Path} $source.Path
+        Assert-CcodEqual $source.Sha256 $read.Sha256 'authority reader hashes the bytes from its verified handle'
+        Assert-CcodEqual '{"schemaVersion":1,"value":"bound"}' ([Text.Encoding]::UTF8.GetString($read.Bytes)) 'authority reader returns the same verified-handle bytes'
+        New-CcodHardLink -Path (Join-Path $fixture.Base 'authority-reader-link.json') -Existing $source.Path
+        Assert-CcodThrows {&$module {param($Path)Read-CcodInstallAuthorityFile -Path $Path|Out-Null} $source.Path} 'CCOD_INSTALL_PRODUCT_SCOPE'
+    }finally{Remove-CcodInstallFileFixture $fixture}
+}
+
+function Write-CcodProductReadyTransactionChain {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$ReadyRecord)
+    $phases=@('Prepared','PackageVerified','RuntimeStaged','PreviousProtectionStopped','RuntimePromoted','PointerCommitted','StableShellCommitted','ProtectionReady','Ready')
+    $transactions=Join-Path $InstallRoot 'state\install-transactions';[IO.Directory]::CreateDirectory($transactions)|Out-Null
+    for($index=0;$index-lt$phases.Count;$index++){
+        $record=$ReadyRecord.PSObject.Copy();$record.phase=$phases[$index]
+        $leaf='{0:D20}.{1:D2}.{2}.{3}.json'-f[uint64]$record.newGeneration,$index,$record.phase,$record.transactionId
+        [IO.File]::WriteAllText((Join-Path $transactions $leaf),($record|ConvertTo-Json -Depth 8 -Compress),[Text.UTF8Encoding]::new($false))
+    }
+    return (Join-Path $transactions ('{0:D20}.08.Ready.{1}.json'-f[uint64]$ReadyRecord.newGeneration,$ReadyRecord.transactionId))
+}
+
 # Production mutation caught: state-only recovery or an arbitrary absolute source can acquire product shortcut authority.
 Invoke-CcodTest 'product registration transaction exposes only a selected retained manifest file capability' {
     $fixture=New-CcodInstallFileFixture
     try{
         $runtimeId='runtime-product-source';$source=New-CcodSourceFile $fixture 'product-source.lnk' 'sealed shortcut bytes';$generation=Open-CcodFixtureGeneration $fixture $runtimeId;$registration=New-CcodInstallGenerationLeaf -Generation $generation -Leaf 'registration';Copy-CcodInstallSealedSource -Generation $registration -SourcePath $source.Path -Leaf 'StartMenu.CodexRemote-fix.lnk' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null;$manifest=Write-CcodInstallGenerationManifest -Generation $generation -Manifest (New-CcodGenerationManifest $runtimeId @([ordered]@{path='registration/StartMenu.CodexRemote-fix.lnk';length=$source.Length;sha256=$source.Sha256}));$pointer=Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $generation -ExpectedPreviousGeneration 0 -FileTransaction $generation;Close-CcodInstallFileTransaction -Transaction $generation -Disposition Ready
-        $readyRecord=[pscustomobject][ordered]@{schemaVersion=1;transactionId='11111111-2222-3333-4444-555555555555';oldRuntimeId=$null;oldGeneration=$null;oldManifestSha256=$null;newRuntimeId=$runtimeId;newGeneration=[uint64]1;newManifestSha256=$manifest.Sha256;sealedPackageSha256=('d'*64);ownedObjectNames=@($runtimeId);phase='Ready';errorCode=$null};$transactions=Join-Path $fixture.Install 'state\install-transactions';[IO.Directory]::CreateDirectory($transactions)|Out-Null;[IO.File]::WriteAllText((Join-Path $transactions 'ready.json'),($readyRecord|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false));$product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $readyRecord;$fixture.Transactions.Add($product);$retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $product;$file=Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyTransaction $readyRecord
+        $readyRecord=[pscustomobject][ordered]@{schemaVersion=1;transactionId='11111111-2222-3333-4444-555555555555';oldRuntimeId=$null;oldGeneration=$null;oldManifestSha256=$null;newRuntimeId=$runtimeId;newGeneration=[uint64]1;newManifestSha256=$manifest.Sha256;sealedPackageSha256=('d'*64);ownedObjectNames=@($runtimeId);phase='Ready';errorCode=$null};$readyPath=Write-CcodProductReadyTransactionChain -InstallRoot $fixture.Install -ReadyRecord $readyRecord
+        foreach($field in @('oldRuntimeId','transactionId','ownedObjectNames')){$changed=$readyRecord.PSObject.Copy();if($field-ceq'oldRuntimeId'){$changed.oldRuntimeId='runtime-old'}elseif($field-ceq'transactionId'){$changed.transactionId='aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee'}else{$changed.ownedObjectNames=@($runtimeId,'unexpected-owned-object')};Assert-CcodProductTransactionRejected -Fixture $fixture -Action {Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $changed}}
+        $fabricated=[pscustomobject][ordered]@{phase='Ready';runtimeId=$runtimeId;runtimeGeneration=[uint64]1;manifestSha256=$manifest.Sha256;packageSha256=('d'*64)};Assert-CcodThrows {Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $fabricated|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
+        $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $readyRecord;$fixture.Transactions.Add($product);$retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $product;$file=Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyTransaction $readyRecord
         Assert-CcodTrue ($null-ne$file) 'selected manifest file returns an opaque retained source capability'
         Assert-CcodThrows {Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'C:\outside\arbitrary.lnk' -ReadyTransaction $readyRecord|Out-Null} 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID'
         Assert-CcodThrows {New-CcodInstallDirectory -Transaction $product -Parent $product -Leaf 'state' -CreateIfMissing|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
         $preReady=$readyRecord.PSObject.Copy();$preReady.phase='ProtectionReady';Assert-CcodThrows {Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $preReady|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE';$changed=$readyRecord.PSObject.Copy();$changed.oldRuntimeId='changed-old';Assert-CcodThrows {Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyTransaction $changed|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
-        [IO.File]::WriteAllText((Join-Path $fixture.Install 'state\active-generation\00000000000000000002.json'),'{'+'"schemaVersion":1,"generation":2,"activeRuntime":"sibling","previousGeneration":1}',[Text.UTF8Encoding]::new($false));Assert-CcodThrows {Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $readyRecord|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
+        [IO.File]::WriteAllText((Join-Path $fixture.Install 'state\active-generation\00000000000000000002.json'),'{'+'"schemaVersion":1,"generation":2,"activeRuntime":"sibling","previousGeneration":1}',[Text.UTF8Encoding]::new($false));Assert-CcodThrows {Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyTransaction $readyRecord|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
         $state=Open-CcodInstallStateTransaction -InstallRoot $fixture.Install;$fixture.Transactions.Add($state);Assert-CcodThrows {Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $state|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {Open-CcodInstallProductSpecialFolder -Generation $state -Kind Desktop|Out-Null} 'CCOD_INSTALL_PRODUCT_FOLDER_INVALID'
     }finally{Remove-CcodInstallFileFixture $fixture}
 }
 
+Invoke-CcodTest 'product authority rejects incomplete pointer stores and changed persisted full Ready identity' {
+    foreach($mutation in @('PointerGap','UnexpectedDirectory','HardlinkPointer','HardlinkTransaction','HardlinkManifest','ScalarOwnedSet','ChangedPersistedReady')){
+        $fixture=New-CcodInstallFileFixture
+        try{
+            $runtimeId='runtime-product-authority';$source=New-CcodSourceFile $fixture 'authority.lnk' 'authority shortcut';$generation=Open-CcodFixtureGeneration $fixture $runtimeId;$registration=New-CcodInstallGenerationLeaf -Generation $generation -Leaf 'registration';Copy-CcodInstallSealedSource -Generation $registration -SourcePath $source.Path -Leaf 'StartMenu.CodexRemote-fix.lnk' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null;$manifest=Write-CcodInstallGenerationManifest -Generation $generation -Manifest (New-CcodGenerationManifest $runtimeId @([ordered]@{path='registration/StartMenu.CodexRemote-fix.lnk';length=$source.Length;sha256=$source.Sha256}));$null=Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $generation -ExpectedPreviousGeneration 0 -FileTransaction $generation;Close-CcodInstallFileTransaction -Transaction $generation -Disposition Ready
+            $ready=[pscustomobject][ordered]@{schemaVersion=1;transactionId='22222222-3333-4444-5555-666666666666';oldRuntimeId=$null;oldGeneration=$null;oldManifestSha256=$null;newRuntimeId=$runtimeId;newGeneration=[uint64]1;newManifestSha256=$manifest.Sha256;sealedPackageSha256=('e'*64);ownedObjectNames=@($runtimeId);phase='Ready';errorCode=$null}
+            if($mutation-ceq'PointerGap'){$ready.newGeneration=[uint64]3;[IO.File]::WriteAllText((Join-Path $fixture.Install 'state\active-generation\00000000000000000003.json'),([ordered]@{schemaVersion=1;generation=[uint64]3;activeRuntime=$runtimeId;previousGeneration=[uint64]2}|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))}
+            if($mutation-ceq'UnexpectedDirectory'){[IO.Directory]::CreateDirectory((Join-Path $fixture.Install 'state\active-generation\unexpected'))|Out-Null}
+            if($mutation-ceq'ScalarOwnedSet'){$ready.ownedObjectNames=$runtimeId}
+            $readyPath=Write-CcodProductReadyTransactionChain -InstallRoot $fixture.Install -ReadyRecord $ready
+            if($mutation-ceq'HardlinkPointer'){New-CcodHardLink -Path (Join-Path $fixture.Base 'pointer-hardlink.json') -Existing (Join-Path $fixture.Install 'state\active-generation\00000000000000000001.json')}
+            elseif($mutation-ceq'HardlinkTransaction'){New-CcodHardLink -Path (Join-Path $fixture.Base 'transaction-hardlink.json') -Existing $readyPath}
+            elseif($mutation-ceq'HardlinkManifest'){New-CcodHardLink -Path (Join-Path $fixture.Base 'manifest-hardlink.json') -Existing (Join-Path $fixture.Install "runtime\$runtimeId\manifest.json")}
+            if($mutation-in@('PointerGap','UnexpectedDirectory','HardlinkPointer','HardlinkTransaction','HardlinkManifest','ScalarOwnedSet')){Assert-CcodProductTransactionRejected -Fixture $fixture -Action {Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $ready};continue}
+            $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $ready;$fixture.Transactions.Add($product);$retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $product
+            $changed=$ready.PSObject.Copy();$changed.sealedPackageSha256=('f'*64);[IO.File]::WriteAllText($readyPath,($changed|ConvertTo-Json -Depth 8 -Compress),[Text.UTF8Encoding]::new($false))
+            Assert-CcodThrows {Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyTransaction $ready|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
+        }finally{Remove-CcodInstallFileFixture $fixture}
+    }
+}
+
 Invoke-CcodTest 'V4 state-only transaction writes records but cannot reach generation or pointer operations' {
     $fixture=New-CcodInstallFileFixture;$transaction=$null
     try{$transaction=Open-CcodInstallStateTransaction -InstallRoot $fixture.Install;$fixture.Transactions.Add($transaction);$state=New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'state' -CreateIfMissing;$records=New-CcodInstallDirectory -Transaction $transaction -Parent $state -Leaf 'install-transactions' -CreateIfMissing;Write-CcodInstallRecord -Transaction $transaction -Parent $records -Leaf 'ready.json' -Record ([ordered]@{schemaVersion=1;phase='Ready'})|Out-Null;Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $fixture.Install 'state\install-transactions\ready.json')) 'state-only transaction writes a create-only state record';Assert-CcodThrows {Write-CcodInstallRecord -Transaction $transaction -Parent $records -Leaf 'ready.json' -Record ([ordered]@{schemaVersion=1;phase='Ready'})|Out-Null} 'CCOD_INSTALL_RECORD_EXISTS';Assert-CcodThrows {New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'runtime' -CreateIfMissing|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {New-CcodInstallGenerationLeaf -Generation $transaction -Leaf 'payload'|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';$source=New-CcodSourceFile $fixture 'state-source.txt' 'x';Assert-CcodThrows {Copy-CcodInstallSealedSource -Generation $transaction -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {Write-CcodInstallGenerationManifest -Generation $transaction -Manifest (New-CcodGenerationManifest 'state-runtime')|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId 'state-runtime' -ExpectedManifestSha256 ('0'*64) -FileTransaction $transaction|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $transaction -ExpectedPreviousGeneration 0 -FileTransaction $transaction|Out-Null} 'CCOD_INSTALL_POINTER_TARGET_INVALID';Assert-CcodThrows {Retire-CcodInstallGeneration -InstallRoot $fixture.Install -RuntimeId 'state-runtime' -FileTransaction $transaction|Out-Null} 'CCOD_INSTALL_GENERATION_NOT_OWNED';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $fixture.Install 'runtime')) 'state-only transaction creates no runtime tree';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $fixture.Install 'state\active-generation')) 'state-only transaction creates no active pointer';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $fixture.Install 'state\retired-generations')) 'state-only transaction creates no retirement record'}finally{Remove-CcodInstallFileFixture $fixture}
diff --git a/tests/persistence/ProductRegistration.SelfTest.ps1 b/tests/persistence/ProductRegistration.SelfTest.ps1
index cf43f4a..9460b85 100644
--- a/tests/persistence/ProductRegistration.SelfTest.ps1
+++ b/tests/persistence/ProductRegistration.SelfTest.ps1
@@ -6,7 +6,7 @@ $modulePath = Join-Path $repositoryRoot 'src\persistence\modules\ProductRegistra
 if (-not (Test-Path -LiteralPath $modulePath -PathType Leaf)) {
     throw "ProductRegistration module is missing: $modulePath"
 }
-Import-Module $modulePath -Force
+$module=Import-Module $modulePath -Force -PassThru
 
 $runtimeId = '2.5.22-1111111111111111-22222222222222222222222222222222'
 $packageSha256 = '3' * 64
@@ -103,7 +103,7 @@ function New-CcodRegistrationWorld {
         RemoveCurrentProductEntry = { param($Entry) $world.CurrentProductRemovals++ }.GetNewClosure()
         ReadLegacySnapshot = { param($ExpectedAppId);if($world.Legacy.appId-cne$ExpectedAppId){return [pscustomobject]@{appId=$world.Legacy.appId;entries=@($world.LegacyEntries)}};if(@($world.Legacy.shortcutNames).Count-ne8){return [pscustomobject]@{appId=$ExpectedAppId;entries=@('Unexpected')}};[pscustomobject]@{appId=$ExpectedAppId;entries=@($world.LegacyEntries)} }.GetNewClosure()
         RemoveLegacyEntry = { param($Entry);$world.LegacyRemoveAttempts++;if($world.LegacyRemoveFailureAt-eq$world.LegacyRemoveAttempts){throw 'fixture legacy delete failure'};[void]$world.LegacyEntries.Remove([string]$Entry) }.GetNewClosure()
-        ReadLegacyEntry = { param($Entry);if($world.LegacyReplacementEntry-ceq[string]$Entry){return 'Replacement'};if($world.LegacyEntries.Contains([string]$Entry)){[string]$Entry}else{$null} }.GetNewClosure()
+        ReadLegacyEntry = { param($Entry);if($world.LegacyReplacementEntry-ceq[string]$Entry){return 'Mismatch'};if($world.LegacyEntries.Contains([string]$Entry)){'Exact'}else{$null} }.GetNewClosure()
         RestoreLegacyEntry = { param($Entry);if($world.LegacyRestoreFailureEntry-ceq[string]$Entry){throw 'fixture restore failed'};if(-not$world.LegacyEntries.Contains([string]$Entry)){$world.LegacyEntries.Add([string]$Entry)};$world.LegacyRestores++ }.GetNewClosure()
         WriteLegacyCompensationFailure = {param($Record)$world.LegacyUnresolvedRecords.Add($Record)}.GetNewClosure()
     }
@@ -219,6 +219,17 @@ $results += Invoke-CcodTest 'current product cleanup requires exact registry val
     Assert-CcodEqual 0 $world.CurrentProductRemovals 'coherent arbitrary target evidence cannot authorize cleanup'
 }
 
+# Production mutation caught: the registry reader starts reading shortcut evidence even though an unknown
+# product subkey already makes the entire current registration ambiguous.
+$results += Invoke-CcodTest 'current product registry preflight rejects a subkey before returning shortcut entries' {
+    $allowed=@('CcodRuntimeId','DisplayVersion')
+    $accepted=&$module {param($ValueNames,$SubKeyNames,$Allowed)Test-CcodCurrentProductRegistryPreflight -ValueNames $ValueNames -SubKeyNames $SubKeyNames -AllowedValueNames $Allowed} $allowed @('unexpected-child') $allowed
+    Assert-CcodEqual $false $accepted 'an unknown subkey invalidates the complete state before shortcut evidence is read'
+    $world=New-CcodRegistrationWorld;$world.CurrentProductState.valid=$accepted;$world.CurrentProductState.entries=@()
+    Assert-CcodThrows {Remove-CcodProductRegistration -ReadyEvidence $cleanupReady -Adapters $world.Adapters} 'CCOD_PRODUCT_CLEANUP_INVALID'
+    Assert-CcodEqual 0 $world.CurrentProductRemovals 'subkey preflight failure performs zero removals'
+}
+
 # Production mutation caught: a mid-sequence legacy deletion failure leaves earlier exact entries missing.
 $results += Invoke-CcodTest 'legacy migration restores earlier exact deletions after a later deletion failure' {
     $world=New-CcodRegistrationWorld
@@ -251,4 +262,14 @@ $results += Invoke-CcodTest 'partially removed current registry entry is include
     Assert-CcodTrue (@($world.LegacyUnresolvedRecords[0].entries)-ccontains'Registry') 'current partially removed registry entry is recorded unresolved'
 }
 
+$results += Invoke-CcodTest 'legacy registry snapshot comparison treats a present partial key as unresolved compensation' {
+    $captured=[pscustomobject]@{kind='Registry';path='HKCU:\fixture';values=[ordered]@{DisplayName=[pscustomobject]@{value='Codex';kind='String'};NoModify=[pscustomobject]@{value=1;kind='DWord'}}}
+    $partial=[pscustomobject]@{kind='Registry';path='HKCU:\fixture';values=[ordered]@{DisplayName=[pscustomobject]@{value='Codex';kind='String'}}}
+    $state=&$module {param($Expected,$Current)Compare-CcodLegacySnapshotEntry -Expected $Expected -Current $Current} $captured $partial
+    Assert-CcodEqual 'Mismatch' $state 'a still-present key missing one captured value is not restored'
+    $world=New-CcodRegistrationWorld;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;$world.LegacyRemoveFailureAt=1;$world.Adapters.RemoveLegacyEntry={param($Entry)if([string]$Entry-ceq'Registry'){throw 'partial registry removal and internal restore failed'}};$world.Adapters.ReadLegacyEntry={param($Entry)if([string]$Entry-ceq'Registry'){return $state};if($world.LegacyEntries.Contains([string]$Entry)){return 'Exact'};$null}.GetNewClosure()
+    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED'
+    Assert-CcodTrue (@($world.LegacyUnresolvedRecords[0].entries)-ccontains'Registry') 'partial registry key is persisted in the unresolved create-only record'
+}
+
 Write-Output "Product registration self-tests passed: $($results.Count)"
diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index ce49d65..00ec5b2 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -13,6 +13,7 @@ if (-not (Test-Path -LiteralPath $bootstrapScript -PathType Leaf)) {
 if (-not (Test-Path -LiteralPath $installedFinalizerScript -PathType Leaf)) { throw "Installed uninstall finalizer is missing: $installedFinalizerScript" }
 . $installedFinalizerScript
 Import-Module (Join-Path $repositoryRoot 'src\persistence\modules\RuntimeManifest.psm1') -Force
+$canonicalTaskTarget=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'schtasks.exe'))
 
 function New-CcodUninstallBootstrapContext {
     return [pscustomobject][ordered]@{
@@ -21,7 +22,7 @@ function New-CcodUninstallBootstrapContext {
         leaseEpoch = [uint64]11
         userSid = 'S-1-5-21-111-222-333-1001'
         sessionId = 1
-        readyEvidence = [pscustomobject][ordered]@{phase='Ready';installRoot='C:\install';runtimeId='2.5.0-uninstall-test';runtimeGeneration=[uint64]7;packageSha256=('0'*64);manifestSha256=('a'*64);startMenuSha256=('0'*64);desktopSha256=('0'*64);targetPath='C:\Windows\System32\schtasks.exe';arguments='/Run /TN "Codex Control Other Devices Supervisor"'}
+        readyEvidence = [pscustomobject][ordered]@{phase='Ready';installRoot='C:\install';runtimeId='2.5.0-uninstall-test';runtimeGeneration=[uint64]7;packageSha256=('0'*64);manifestSha256=('a'*64);startMenuSha256=('0'*64);desktopSha256=('0'*64);targetPath=$canonicalTaskTarget;arguments='/Run /TN "Codex Control Other Devices Supervisor"'}
         payloadRecords = New-CcodUninstallBootstrapPayloadRecords -ResumeOnly
     }
 }
@@ -41,7 +42,7 @@ function New-CcodUninstallBootstrapTestTransaction {
         leaseEpoch = [uint64]11
         userSid = 'S-1-5-21-111-222-333-1001'
         sessionId = 1
-        readyEvidence = [pscustomobject][ordered]@{phase='Ready';installRoot='C:\install';runtimeId='2.5.0-uninstall-test';runtimeGeneration=[uint64]7;packageSha256=('0'*64);manifestSha256=('a'*64);startMenuSha256=('0'*64);desktopSha256=('0'*64);targetPath='C:\Windows\System32\schtasks.exe';arguments='/Run /TN "Codex Control Other Devices Supervisor"'}
+        readyEvidence = [pscustomobject][ordered]@{phase='Ready';installRoot='C:\install';runtimeId='2.5.0-uninstall-test';runtimeGeneration=[uint64]7;packageSha256=('0'*64);manifestSha256=('a'*64);startMenuSha256=('0'*64);desktopSha256=('0'*64);targetPath=$canonicalTaskTarget;arguments='/Run /TN "Codex Control Other Devices Supervisor"'}
         installedBinding = $null
         phase = $Phase
         resumePhase = $Phase
@@ -67,7 +68,7 @@ function New-CcodUninstallBootstrapAdapters {
                 leaseEpoch = [uint64]11
                 userSid = 'S-1-5-21-111-222-333-1001'
                 sessionId = 1
-                readyEvidence = [pscustomobject][ordered]@{phase='Ready';installRoot='C:\install';runtimeId='2.5.0-uninstall-test';runtimeGeneration=[uint64]7;packageSha256=('0'*64);manifestSha256=('a'*64);startMenuSha256=('0'*64);desktopSha256=('0'*64);targetPath='C:\Windows\System32\schtasks.exe';arguments='/Run /TN "Codex Control Other Devices Supervisor"'}
+                readyEvidence = [pscustomobject][ordered]@{phase='Ready';installRoot='C:\install';runtimeId='2.5.0-uninstall-test';runtimeGeneration=[uint64]7;packageSha256=('0'*64);manifestSha256=('a'*64);startMenuSha256=('0'*64);desktopSha256=('0'*64);targetPath=$canonicalTaskTarget;arguments='/Run /TN "Codex Control Other Devices Supervisor"'}
                 payloadRecords = New-CcodUninstallBootstrapPayloadRecords -ResumeOnly
             }
         }.GetNewClosure()
@@ -433,6 +434,7 @@ $results += Invoke-CcodTest 'Prepare resumes a TaskRemoved transaction even afte
         [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$localAppData,'Process')
         $identity = Get-CcodUninstallBootstrapCurrentIdentity
         $transaction = New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved'
+        $transaction.readyEvidence.installRoot = $installRoot
         $transaction.userSid = $identity.userSid
         $transaction.sessionId = [int]$identity.sessionId
         $world = [pscustomobject]@{
@@ -461,6 +463,7 @@ $results += Invoke-CcodTest 'Prepare rejects a partial-deletion transaction from
     try {
         [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$localAppData,'Process')
         $transaction = New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved'
+        $transaction.readyEvidence.installRoot = $installRoot
         $transaction.userSid = 'S-1-5-21-999-888-777-1001'
         $world = [pscustomobject]@{
             Calls = [Collections.Generic.List[string]]::new()
@@ -615,6 +618,24 @@ $results += Invoke-CcodTest 'noncanonical Ready shortcut target is rejected befo
     Assert-CcodEqual 0 @($world.Calls|Where-Object{$_-ceq'Cleanup'}).Count 'invalid target evidence reaches no cleanup deletion'
 }
 
+# Production mutation caught: a rooted but unrelated installRoot, or an added field, survives a weaker
+# fresh/stored Ready check and reaches application cleanup.
+$results += Invoke-CcodTest 'fresh and stored Ready evidence require one exact current-install-root invariant before cleanup' {
+    foreach($source in @('Fresh','Stored')){
+        foreach($mutation in @('WrongRoot','ExtraField')){
+            $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=$null;Receipt=$null;ValidationError=$false;StageError=$false;CleanupError=$false;CleanupFailurePhase=$null;InstallRootAbsent=$false;StagedEntries=@();ProductRegistrationRemovals=0}
+            $context=New-CcodUninstallBootstrapContext
+            if($source-ceq'Stored'){$world.Transaction=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved'}
+            $ready=if($source-ceq'Fresh'){$context.readyEvidence}else{$world.Transaction.readyEvidence}
+            if($mutation-ceq'WrongRoot'){$ready.installRoot='C:\unrelated\CodexControlOtherDevices'}else{$ready|Add-Member -NotePropertyName unexpectedReadyField -NotePropertyValue 'reject'}
+            $adapters=New-CcodUninstallBootstrapAdapters $world
+            $adapters.ValidateInvocation={param($InstallerRoot,$InstallRoot)$context}.GetNewClosure()
+            Assert-CcodThrows {Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\runtime' -InstallRoot 'C:\install' -Mode Prepare -Adapters $adapters|Out-Null} $(if($source-ceq'Fresh'){'CCOD_UNINSTALL_BOOTSTRAP_INVALID'}else{'CCOD_UNINSTALL_TRANSACTION_INVALID'})
+            Assert-CcodEqual 0 @($world.Calls|Where-Object{$_-ceq'Cleanup'}).Count "$source $mutation Ready mutation reaches no cleanup"
+        }
+    }
+}
+
 $results += Invoke-CcodTest 'default installed finalizer validates and removes only the exact selected generation fixture' {
     $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-installed-finalizer-'+[guid]::NewGuid().ToString('N'));$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
     try{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$install=Join-Path $local 'CodexControlOtherDevices';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$identity=Get-CcodUninstallBootstrapCurrentIdentity;$transactionRoot=Get-CcodUninstallBootstrapDefaultTransactionRoot;$id='11111111-2222-3333-4444-555555555555';$directory=New-CcodUninstallBootstrapTransactionDirectory -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid;$tx=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$tx.runtimeId=$fixture.RuntimeId;$tx.runtimeGeneration=[uint64]7;$tx.userSid=$identity.userSid;$tx.sessionId=$identity.sessionId;$tx.readyEvidence.runtimeId=$fixture.RuntimeId;$tx.readyEvidence.runtimeGeneration=[uint64]7;$tx.readyEvidence.installRoot=$install;$manifest=(Get-FileHash (Join-Path $fixture.RuntimeRoot 'manifest.json') -Algorithm SHA256).Hash.ToLowerInvariant();$tx.readyEvidence.manifestSha256=$manifest;$tx.installedBinding=[pscustomobject][ordered]@{selectedRuntimeRoot=$fixture.RuntimeRoot;runtimeManifestSha256=$manifest;wrapperPid=42;wrapperCreationTimeUtc='2030-02-03T03:04:05.0000000Z';wrapperSessionId=$identity.sessionId;wrapperUserSid=$identity.userSid};Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory $directory -Transaction $tx;Publish-CcodUninstallBootstrapCurrentTransaction -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid
@@ -622,5 +643,29 @@ $results += Invoke-CcodTest 'default installed finalizer validates and removes o
     }finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $local){Remove-Item $local -Recurse -Force}}
 }
 
+function Invoke-CcodDefaultInstalledFinalizerNegative {
+    param([Parameter(Mandatory)][ValidateSet('Sibling','WrongPath','StaleEpoch','WrapperIdentity','WrongReadyRoot','ExtraReadyField')][string]$Mutation)
+    $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-finalizer-negative-'+[guid]::NewGuid().ToString('N'));$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process');$wrapper=$null
+    try{
+        [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$install=Join-Path $local 'CodexControlOtherDevices';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$selected=$fixture.RuntimeRoot;$runtime=$selected
+        if($Mutation-ceq'Sibling'){$runtime=Join-Path $install 'runtime\same-bootstrap-sibling';Copy-Item -LiteralPath $selected -Destination $runtime -Recurse -Force}
+        elseif($Mutation-ceq'WrongPath'){$runtime=Join-Path $selected 'nested-wrong-runtime'}
+        $identity=Get-CcodUninstallBootstrapCurrentIdentity;$id=[guid]::NewGuid().ToString('D');$transactionRoot=Get-CcodUninstallBootstrapDefaultTransactionRoot;$directory=New-CcodUninstallBootstrapTransactionDirectory -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid
+        $wrapper=Start-Process -FilePath 'powershell.exe' -ArgumentList @('-NoProfile','-Command','Start-Sleep -Milliseconds 1400') -WindowStyle Hidden -PassThru;$wrapperCreation=$wrapper.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)
+        $tx=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$tx.transactionId=$id;$tx.runtimeId=[IO.Path]::GetFileName($runtime);$tx.runtimeGeneration=[uint64]7;$tx.leaseEpoch=if($Mutation-ceq'StaleEpoch'){[uint64]12}else{[uint64]11};$tx.userSid=$identity.userSid;$tx.sessionId=$identity.sessionId;$tx.readyEvidence.installRoot=$install;$tx.readyEvidence.runtimeId=$tx.runtimeId;$tx.readyEvidence.runtimeGeneration=[uint64]7;$manifest=(Get-FileHash (Join-Path $selected 'manifest.json') -Algorithm SHA256).Hash.ToLowerInvariant();$tx.readyEvidence.manifestSha256=$manifest;$tx.installedBinding=[pscustomobject][ordered]@{selectedRuntimeRoot=$runtime;runtimeManifestSha256=$manifest;wrapperPid=[int]$wrapper.Id;wrapperCreationTimeUtc=$wrapperCreation;wrapperSessionId=$identity.sessionId;wrapperUserSid=$identity.userSid}
+        Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory $directory -Transaction $tx;Publish-CcodUninstallBootstrapCurrentTransaction -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid
+        if($Mutation-ceq'WrongReadyRoot'){$tx.readyEvidence.installRoot=Join-Path $local 'unrelated-root';[IO.File]::WriteAllText((Join-Path $directory 'transaction.json'),($tx|ConvertTo-Json -Depth 12 -Compress),[Text.UTF8Encoding]::new($false))}
+        elseif($Mutation-ceq'ExtraReadyField'){$tx.readyEvidence|Add-Member -NotePropertyName unexpectedReadyField -NotePropertyValue 'reject';[IO.File]::WriteAllText((Join-Path $directory 'transaction.json'),($tx|ConvertTo-Json -Depth 12 -Compress),[Text.UTF8Encoding]::new($false))}
+        $payload=Join-Path $directory 'payload';foreach($relative in @('src\persistence\InstalledUninstallFinalizer.ps1','src\persistence\UninstallBootstrap.ps1')){$destination=Join-Path $payload $relative;[IO.Directory]::CreateDirectory((Split-Path $destination -Parent))|Out-Null;[IO.File]::Copy((Join-Path $selected $relative),$destination,$true)}
+        $creationArgument=if($Mutation-ceq'WrapperIdentity'){'2001-02-03T04:05:06.0000000Z'}else{$wrapperCreation};$previousPreference=$ErrorActionPreference;try{$ErrorActionPreference='Continue';$output=& powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $payload 'src\persistence\InstalledUninstallFinalizer.ps1') -TransactionId $id -RuntimeRoot $runtime -InstallRoot $install -WrapperProcessId $wrapper.Id -WrapperCreationTimeUtc $creationArgument 2>&1;$exit=$LASTEXITCODE}finally{$ErrorActionPreference=$previousPreference}
+        if($exit-ne3){throw("FINALIZER_DIAGNOSTIC mutation={0} exit={1} output={2}"-f$Mutation,$exit,(@($output)-join' | '))};Assert-CcodEqual 3 $exit "$Mutation default child rejects before finalization";Assert-CcodTrue (Test-Path -LiteralPath $selected -PathType Container) "$Mutation preserves the selected generation";Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $install 'state') -PathType Container) "$Mutation preserves sibling/root state"
+        if($Mutation-notin@('WrongPath','WrapperIdentity')){$wrapper.Refresh();Assert-CcodTrue $wrapper.HasExited "$Mutation reaches the default wrapper wait before its later negative boundary"}
+    }finally{if($null-ne$wrapper){try{if(-not$wrapper.HasExited){$wrapper.Kill();$wrapper.WaitForExit()}}catch{};$wrapper.Dispose()};[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path -LiteralPath $local){Remove-Item -LiteralPath $local -Recurse -Force}}
+}
+
+$results += Invoke-CcodTest 'default staged installed finalizer child rejects the full negative authorization matrix without deletion' {
+    foreach($mutation in @('Sibling','WrongPath','StaleEpoch','WrapperIdentity','WrongReadyRoot','ExtraReadyField')){Invoke-CcodDefaultInstalledFinalizerNegative -Mutation $mutation}
+}
+
 $results | ForEach-Object { "PASS $($_.Name)" }
 Write-Output "Uninstall bootstrap self-tests passed: $($results.Count)"

From a60759bcc68693a8fbf75d83486e4f5f9bf46ddb Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 00:18:21 +0800
Subject: [PATCH 106/187] docs: record durable Ready authority evidence

---
 .../task-4-report.md                          | 97 +++++++++++++++++++
 1 file changed, 97 insertions(+)

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
index 6145121..5692cce 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
@@ -298,3 +298,100 @@ legacy entry, and mock-only finalizer coverage.
 
 - `1ff17bb8759e3d5312c11336ca3b2188bb3a4fe2`
   (`fix: enforce strict retained product authority`).
+
+## Fix round 4: durable Ready identity and real finalizer negatives
+
+Independent review of `7c333e0..a83840b` found five Important gaps: fresh and
+stored uninstall paths did not share one current-root Ready invariant; product
+authority still reduced a strict lifecycle record to five fields and did not
+prove a complete selector/store at every retained-file open; legacy/current
+registry negatives were adapter-shaped rather than production comparisons; and
+the installed-finalizer evidence covered only a safe adapter-assisted positive.
+
+### RED evidence
+
+- UninstallBootstrap exited `1` in
+  `fresh and stored Ready evidence require one exact current-install-root
+  invariant before cleanup`: a fresh rooted but unrelated `installRoot` was
+  accepted instead of throwing `CCOD_UNINSTALL_BOOTSTRAP_INVALID`. The same
+  case also covers stored `TaskRemoved` wrong-root and extra-field records with
+  an explicit zero-cleanup assertion.
+- InstallFileTransaction exited `1` with
+  `ASSERT_THROWS: expected CCOD_INSTALL_PRODUCT_SCOPE`: capability open first
+  accepted a caller record whose `oldRuntimeId` differed while all five derived
+  fields matched. The completed matrix also covers transaction ID/owned-set
+  mismatch, a fabricated five-field object, pointer gap/unexpected directory,
+  a stale N capability after N+1, changed persisted Ready identity, and a
+  scalar `ownedObjectNames` value.
+- ProductRegistration exited `1` because the production-private
+  `Test-CcodCurrentProductRegistryPreflight` did not exist. The regression calls
+  that same helper with an unexpected subkey and proves zero removals.
+- ProductRegistration exited `1` because the production-private
+  `Compare-CcodLegacySnapshotEntry` did not exist. Its fixture keeps the
+  Registry key present while removing one captured value; the result must be
+  `Mismatch`, the unresolved create-only record must contain `Registry`, and
+  the stable error must be `CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED`.
+- The first no-adapter staged-finalizer child matrix exited `1` instead of the
+  stable `3`: `Write-Error` re-threw under the script's Stop preference. After
+  that was fixed, the wrong stored Ready root reached selected-generation
+  deletion, exposing a dot-sourced `$InstallRoot` parameter collision in the
+  default transaction reader. Both failures occurred before the final GREEN.
+- InstallFileTransaction exited `1` with
+  `ASSERT_THROWS: expected CCOD_INSTALL_PRODUCT_SCOPE` after hard-linked
+  pointer, transaction, and manifest leaves were added; the first hard-linked
+  authority leaf was accepted.
+- InstallFileTransaction exited `1` because the production-private
+  `Read-CcodInstallAuthorityFile` did not exist. The wished-for contract returns
+  bytes and SHA-256 from one verified native handle and rejects a multi-link.
+
+### GREEN and final verification evidence
+
+- ProductRegistration: `13/13`, exit `0`.
+- InstallFileTransaction: `29/29`, exit `0`.
+- UninstallBootstrap: `23/23`, exit `0`. The no-adapter child matrix stages the
+  real `InstalledUninstallFinalizer.ps1` below a fake process `LOCALAPPDATA` and
+  covers same-bootstrap sibling, wrong runtime path, stale epoch, wrapper
+  PID/creation mismatch, wrong stored Ready root, and an extra Ready field.
+  Every case preserves the selected generation and sibling/root state; cases
+  beyond the early path/identity gates also prove the disposable wrapper exited.
+- InstallLifecycle: `116/116`, exit `0`, preserving normal/recovery registration
+  retry and durable Ready behavior.
+- Explicit PowerShell parser: `8/8`, `PARSER_FAILURES=0`, exit `0`.
+- Static gates: `WEAK_SUBSTITUTE_COUNT=0` and
+  `AUTHORITY_PATH_READ_COUNT=0`, exit `0`; the default finalizer reader receives
+  and forwards `ExpectedInstallRoot`.
+- `git diff --check`: exit `0`; only checkout LF-to-CRLF warnings were emitted.
+- Full `tests\PersistenceSelfTest.ps1` aggregate: exit `0`; no failure output.
+- Final independent scoped re-review found no remaining Critical or Important
+  findings.
+
+### Remediated boundaries
+
+- One ordered ten-field Ready helper validates fresh contexts, durable stored
+  transactions/resume, and default finalizer authorization against the exact
+  current install root before selected-root deletion.
+- Product capability open validates the ordered/type-strict 12-field lifecycle
+  record, complete canonical contiguous selector, all canonical transaction
+  chains, the unique full persisted terminal Ready record, and the selected
+  manifest/package identity. Every retained-file open repeats that proof and
+  compares caller, persisted, and stored capability identities.
+- Selector JSON, lifecycle JSON, and manifest hashes are read from one native
+  no-write/no-delete-share handle. The handle rejects reparse, ADS and
+  multi-link leaves, checks final path and file identity before and after the
+  read, and hashes the returned bytes rather than reopening by path.
+- Current-product subkeys fail a production pure preflight before shortcut
+  inspection. Legacy Registry compensation distinguishes exact, absent, and
+  mismatched key/value/kind snapshots; a partial key is never called restored
+  or overwritten.
+- The installed finalizer accepts only a canonical absolute process
+  `LOCALAPPDATA` when it is present, otherwise falls back to the current-user
+  special folder. The staged default reader carries the expected install root
+  through dot-sourcing without a parameter-name collision.
+
+No real registry, shortcut, installer, uninstaller, product, network, release,
+signing, tag, push, or publication action occurred.
+
+### Fix implementation commit
+
+- `3cd891221acfd569fd29e2244b5200fa28e43106`
+  (`fix: prove durable Ready product authority`).

From a9900a4b00508f9ed694375ea94a2bfb97437e96 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 01:55:49 +0800
Subject: [PATCH 107/187] fix: serialize strict product authority

---
 .../modules/InstallFileTransaction.psm1       | 83 +++++++++++-----
 src/persistence/modules/InstallLifecycle.psm1 | 76 +++++++++------
 .../InstallFileTransaction.SelfTest.ps1       | 94 ++++++++++++++++++-
 .../persistence/InstallLifecycle.SelfTest.ps1 | 86 +++++++++++++++++
 4 files changed, 287 insertions(+), 52 deletions(-)

diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index 5461485..5497b0c 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -369,7 +369,6 @@ function Open-CcodInstallStateTransaction { param([Parameter(Mandatory)][string]
 function Open-CcodInstallRetainedGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)][string]$ExpectedManifestSha256,[Parameter(Mandatory)]$FileTransaction) if(-not[IO.Path]::IsPathRooted($InstallRoot)-or$ExpectedManifestSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_GENERATION_INVALID' 'Invalid retained generation contract' $RuntimeId};Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';if(-not[object]::ReferenceEquals($scope.Record.Transaction,$FileTransaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'FileTransaction must be the transaction root capability' $null};Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$nativeResult=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetained @($RuntimeId,$ExpectedManifestSha256)} 'CCOD_INSTALL_RETAINED_GENERATION_INVALID';if(@($nativeResult).Count-ne 2-or-not(Test-CcodRetainedManifestIdentity ([string]$nativeResult[1]) $RuntimeId)){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH' 'Retained manifest must contain exactly one matching top-level runtimeId string' $RuntimeId};Add-CcodInstallScope $scope.Record.Transaction $nativeResult[0] Generation $true $RuntimeId }
 
 $script:CcodProductReadyFields=@('schemaVersion','transactionId','oldRuntimeId','oldGeneration','oldManifestSha256','newRuntimeId','newGeneration','newManifestSha256','sealedPackageSha256','ownedObjectNames','phase','errorCode')
-$script:CcodProductReadyPhases=@('Prepared','PackageVerified','RuntimeStaged','PreviousProtectionStopped','RuntimePromoted','PointerCommitted','StableShellCommitted','ProtectionReady','Ready')
 function Test-CcodInstallOrderedProperties($Value,[string[]]$Names){if($null-eq$Value){return $false};$actual=@($Value.PSObject.Properties.Name);return(($actual-join"`0")-ceq($Names-join"`0"))}
 function Test-CcodInstallUnsignedInteger($Value){return $Value-is[byte]-or$Value-is[uint16]-or$Value-is[uint32]-or$Value-is[uint64]-or$Value-is[int16]-or$Value-is[int32]-or$Value-is[int64]}
 function Read-CcodInstallAuthorityFile {
@@ -378,42 +377,76 @@ function Read-CcodInstallAuthorityFile {
     try{$result=@(Invoke-CcodRuntimeStatic ReadAuthorityFile @([IO.Path]::GetFullPath($Path)));if($result.Count-ne2-or$result[0]-isnot[string]-or$result[1]-isnot[string]-or$result[1]-cnotmatch'^[0-9a-f]{64}$'){throw 'authority read result invalid'};$bytes=[Convert]::FromBase64String([string]$result[0]);return [pscustomobject]@{Bytes=$bytes;Sha256=[string]$result[1]}}
     catch{if(([string]$_.FullyQualifiedErrorId-split',')[0]-ceq'CCOD_INSTALL_PRODUCT_SCOPE'){throw};Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Authority file could not be read from one verified native handle' $Path}
 }
-function Assert-CcodInstallProductReadyRecord($Record){
-    $valid=Test-CcodInstallOrderedProperties $Record $script:CcodProductReadyFields
-    if(-not$valid){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Complete strict Ready transaction identity is required' $Record}
-    $valid=$valid-and$Record.schemaVersion-is[int]-and$Record.schemaVersion-eq1-and$Record.transactionId-is[string]-and$Record.transactionId-cmatch'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
-    $valid=$valid-and$Record.newRuntimeId-is[string]-and$Record.newRuntimeId-cmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$'-and(Test-CcodInstallUnsignedInteger $Record.newGeneration)-and[uint64]$Record.newGeneration-gt0
-    $valid=$valid-and$Record.newManifestSha256-is[string]-and$Record.newManifestSha256-cmatch'^[0-9a-f]{64}$'-and$Record.sealedPackageSha256-is[string]-and$Record.sealedPackageSha256-cmatch'^[0-9a-f]{64}$'
-    $oldNull=$null-eq$Record.oldRuntimeId;$valid=$valid-and($oldNull-eq($null-eq$Record.oldGeneration))-and($oldNull-eq($null-eq$Record.oldManifestSha256))
-    if(-not$oldNull){$valid=$valid-and$Record.oldRuntimeId-is[string]-and$Record.oldRuntimeId-cmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$'-and(Test-CcodInstallUnsignedInteger $Record.oldGeneration)-and[uint64]$Record.oldGeneration-gt0-and$Record.oldManifestSha256-is[string]-and$Record.oldManifestSha256-cmatch'^[0-9a-f]{64}$'}
-    $valid=$valid-and($Record.ownedObjectNames-is[Array]);$owned=@($Record.ownedObjectNames);$seen=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal);$valid=$valid-and$owned.Count-le64;foreach($name in $owned){$valid=$valid-and$name-is[string]-and$name-cmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$'-and$seen.Add([string]$name)}
-    $valid=$valid-and$Record.phase-is[string]-and(@($script:CcodProductReadyPhases)+'Failed')-ccontains$Record.phase-and(($Record.phase-ceq'Failed'-and$Record.errorCode-is[string]-and$Record.errorCode-cmatch'^CCOD_[A-Z0-9_]{1,96}$')-or($Record.phase-cne'Failed'-and$null-eq$Record.errorCode))
-    if(-not$valid){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Complete strict Ready transaction identity is required' $Record};return $true
+function Get-CcodInstallLifecycleValidationModule {
+    $path=[IO.Path]::GetFullPath((Join-Path $PSScriptRoot 'InstallLifecycle.psm1'))
+    $module=Get-Module|Where-Object{$null-ne$_.Path-and[IO.Path]::GetFullPath($_.Path)-ceq$path}|Select-Object -First 1
+    if($null-eq$module){$module=Import-Module $path -PassThru -ErrorAction Stop}
+    if($null-eq$module){throw 'canonical lifecycle module unavailable'}
+    return $module
+}
+function Assert-CcodInstallCanonicalTransactionRecord($Record){
+    $module=Get-CcodInstallLifecycleValidationModule
+    return (&$module {param($Value)[void](Assert-CcodInstallTransactionRecord -Record $Value);Get-CcodInstallTransactionRecordLeaf -Record $Value} $Record)
+}
+function Resolve-CcodInstallCanonicalTransactionHead([object[]]$Records,$ActiveRuntime){
+    $module=Get-CcodInstallLifecycleValidationModule
+    return (&$module {param($Values,$Active)Resolve-CcodInstallTransactionRecordHead -Records $Values -ActiveRuntime $Active} $Records $ActiveRuntime)
+}
+function Get-CcodInstallKernelObjectsModule {
+    $path=[IO.Path]::GetFullPath((Join-Path $PSScriptRoot 'KernelObjects.psm1'))
+    $module=Get-Module|Where-Object{$null-ne$_.Path-and[IO.Path]::GetFullPath($_.Path)-ceq$path}|Select-Object -First 1
+    if($null-eq$module){$module=Import-Module $path -PassThru -ErrorAction Stop}
+    if($null-eq$module){throw 'kernel coordination module unavailable'}
+    return $module
+}
+function Enter-CcodInstallProductAuthorityLease {
+    $identity=$null
+    try{
+        $identity=[Security.Principal.WindowsIdentity]::GetCurrent();if($null-eq$identity-or$null-eq$identity.User){throw 'current user identity unavailable'}
+        $module=Get-CcodInstallKernelObjectsModule
+        $lease=&$module {param($Sid)Enter-CcodMutex -Kind AccountTransition -UserSid $Sid -TimeoutMilliseconds 30000} $identity.User.Value
+        if($null-eq$lease-or$lease.Outcome-cne'Acquired'){throw 'product authority coordination timed out'}
+        return $lease
+    }catch{Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Product authority coordination lease could not be acquired' $null}
+    finally{if($null-ne$identity){$identity.Dispose()}}
+}
+function Exit-CcodInstallProductAuthorityLease($Lease){
+    if($null-eq$Lease){return}
+    $module=Get-CcodInstallKernelObjectsModule
+    &$module {param($Value)Exit-CcodMutex -Lease $Value} $Lease|Out-Null
+}
+function Assert-CcodInstallProductAuthorityLease($State){
+    $lease=if($null-ne$State.PSObject.Properties['AuthorityLease']){$State.AuthorityLease}else{$null}
+    if(-not$State.ProductOnly-or$null-eq$lease-or$lease.SchemaVersion-isnot[int]-or$lease.SchemaVersion-ne1-or$lease.Kind-cne'AccountTransition'-or$lease.Outcome-cne'Acquired'-or$lease.Released-isnot[bool]-or$lease.Released-or$lease.OwnerManagedThreadId-isnot[int]-or$lease.OwnerManagedThreadId-ne[Threading.Thread]::CurrentThread.ManagedThreadId){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Retained product authority requires its live proof-to-use coordination lease' $null}
+    return $true
 }
 function Read-CcodInstallProductStrictJson([string]$Path,[string[]]$Fields){$read=Read-CcodInstallAuthorityFile -Path $Path;$json=[Text.UTF8Encoding]::new($false,$true).GetString($read.Bytes);foreach($field in $Fields){if((Get-CcodTopLevelJsonPropertyCount $json $field)-ne1){throw 'duplicate or missing authority member'}};$value=$json|ConvertFrom-Json -ErrorAction Stop;if(-not(Test-CcodInstallOrderedProperties $value $Fields)){throw 'noncanonical authority record'};return $value}
 function Get-CcodInstallProductReadyAuthority([string]$InstallRoot,$ReadyTransaction){
-    [void](Assert-CcodInstallProductReadyRecord $ReadyTransaction);if($ReadyTransaction.phase-cne'Ready'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Terminal Ready transaction is required' $ReadyTransaction}
+    try{[void](Assert-CcodInstallCanonicalTransactionRecord $ReadyTransaction)}catch{Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Complete strict Ready transaction identity is required' $ReadyTransaction};if($ReadyTransaction.phase-cne'Ready'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Terminal Ready transaction is required' $ReadyTransaction}
     $root=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');try{
         foreach($directory in @((Join-Path $root 'state'),(Join-Path $root 'state\active-generation'),(Join-Path $root 'state\install-transactions'))){$item=Get-Item -LiteralPath $directory -Force -ErrorAction Stop;if(-not$item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){throw 'unsafe authority directory'}}
         $pointerRoot=Join-Path $root 'state\active-generation';$pointerObjects=@(Get-ChildItem -LiteralPath $pointerRoot -Force -ErrorAction Stop|Sort-Object Name);if($pointerObjects.Count-eq0){throw 'pointer chain missing'};$latest=$null
         for($index=0;$index-lt$pointerObjects.Count;$index++){$expectedGeneration=[uint64]($index+1);$file=$pointerObjects[$index];$expectedLeaf='{0:D20}.json'-f$expectedGeneration;if($file.PSIsContainer-or$file.Name-cne$expectedLeaf){throw 'pointer chain is not contiguous'};$pointer=Read-CcodInstallProductStrictJson $file.FullName @('schemaVersion','generation','activeRuntime','previousGeneration');if($pointer.schemaVersion-isnot[int]-or$pointer.schemaVersion-ne1-or-not(Test-CcodInstallUnsignedInteger $pointer.generation)-or[uint64]$pointer.generation-ne$expectedGeneration-or$pointer.activeRuntime-isnot[string]-or$pointer.activeRuntime-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$'-or-not(Test-CcodInstallUnsignedInteger $pointer.previousGeneration)-or[uint64]$pointer.previousGeneration-ne[uint64]$index){throw 'pointer record invalid'};$latest=$pointer}
         if([uint64]$latest.generation-ne[uint64]$ReadyTransaction.newGeneration-or$latest.activeRuntime-cne$ReadyTransaction.newRuntimeId){throw 'Ready transaction is stale'}
         $manifestPath=Join-Path (Join-Path (Join-Path $root 'runtime') $ReadyTransaction.newRuntimeId) 'manifest.json';$manifestRead=Read-CcodInstallAuthorityFile -Path $manifestPath;$manifestSha=$manifestRead.Sha256;if($manifestSha-cne$ReadyTransaction.newManifestSha256){throw 'manifest mismatch'}
-        $store=Join-Path $root 'state\install-transactions';$records=@();foreach($file in @(Get-ChildItem -LiteralPath $store -Force -ErrorAction Stop|Sort-Object Name)){if($file.PSIsContainer-or$file.Name-cnotmatch'^\d{20}\.\d{2}\.[A-Za-z]+\.[0-9a-f-]{36}\.json$'){throw 'unknown transaction object'};$record=Read-CcodInstallProductStrictJson $file.FullName $script:CcodProductReadyFields;[void](Assert-CcodInstallProductReadyRecord $record);$phaseIndex=if($record.phase-ceq'Failed'){99}else{[Array]::IndexOf($script:CcodProductReadyPhases,[string]$record.phase)};$expectedLeaf='{0:D20}.{1:D2}.{2}.{3}.json'-f[uint64]$record.newGeneration,$phaseIndex,$record.phase,$record.transactionId;if($file.Name-cne$expectedLeaf){throw 'transaction leaf is noncanonical'};$records+=,$record}
-        $heads=@();foreach($group in @($records|Group-Object transactionId)){$chain=@($group.Group|Sort-Object @{Expression={if($_.phase-ceq'Failed'){99}else{[Array]::IndexOf($script:CcodProductReadyPhases,[string]$_.phase)}}});if($chain.Count-eq0-or$chain[0].phase-cne'Prepared'){throw 'transaction chain start'};$identity=$chain[0].PSObject.Copy();$identity.phase='Ready';$identity.errorCode=$null;for($index=0;$index-lt$chain.Count;$index++){$current=$chain[$index];$comparison=$current.PSObject.Copy();$comparison.phase='Ready';$comparison.errorCode=$null;if(($comparison|ConvertTo-Json -Depth 8 -Compress)-cne($identity|ConvertTo-Json -Depth 8 -Compress)){throw 'transaction identity changed'};if($index-gt0-and$current.phase-cne'Failed'-and[Array]::IndexOf($script:CcodProductReadyPhases,[string]$current.phase)-ne([Array]::IndexOf($script:CcodProductReadyPhases,[string]$chain[$index-1].phase)+1)){throw 'transaction chain gap'}};$heads+=,$chain[-1]}
-        $wanted=$ReadyTransaction|ConvertTo-Json -Depth 8 -Compress;$matches=@($heads|Where-Object{$_.phase-ceq'Ready'-and($_|ConvertTo-Json -Depth 8 -Compress)-ceq$wanted});if($matches.Count-ne1){throw 'unique full Ready record missing'}
-        return [pscustomobject]@{ReadyCanonical=$wanted;PersistedReadyCanonical=($matches[0]|ConvertTo-Json -Depth 8 -Compress);RuntimeId=[string]$ReadyTransaction.newRuntimeId;Generation=[uint64]$ReadyTransaction.newGeneration;ManifestSha256=[string]$manifestSha;PackageSha256=[string]$ReadyTransaction.sealedPackageSha256}
+        $store=Join-Path $root 'state\install-transactions';$records=[Collections.Generic.List[object]]::new();foreach($file in @(Get-ChildItem -LiteralPath $store -Force -ErrorAction Stop|Sort-Object Name)){if($file.PSIsContainer-or$file.Name-cnotmatch'^\d{20}\.\d{2}\.[A-Za-z]+\.[0-9a-f-]{36}\.json$'){throw 'unknown transaction object'};$record=Read-CcodInstallProductStrictJson $file.FullName $script:CcodProductReadyFields;$expectedLeaf=Assert-CcodInstallCanonicalTransactionRecord $record;if($file.Name-cne$expectedLeaf){throw 'transaction leaf is noncanonical'};$records.Add($record)}
+        $canonicalHead=Resolve-CcodInstallCanonicalTransactionHead $records.ToArray() $latest;$wanted=$ReadyTransaction|ConvertTo-Json -Depth 8 -Compress;if($null-eq$canonicalHead-or$canonicalHead.phase-cne'Ready'-or($canonicalHead|ConvertTo-Json -Depth 8 -Compress)-cne$wanted){throw 'canonical lifecycle head is not the selected Ready record'}
+        return [pscustomobject]@{ReadyCanonical=$wanted;PersistedReadyCanonical=($canonicalHead|ConvertTo-Json -Depth 8 -Compress);RuntimeId=[string]$ReadyTransaction.newRuntimeId;Generation=[uint64]$ReadyTransaction.newGeneration;ManifestSha256=[string]$manifestSha;PackageSha256=[string]$ReadyTransaction.sealedPackageSha256}
     }catch{if(([string]$_.FullyQualifiedErrorId-split',')[0]-ceq'CCOD_INSTALL_PRODUCT_SCOPE'){throw};Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Complete selector manifest and persisted Ready authority could not be proven' $ReadyTransaction}
 }
 
 function Open-CcodInstallProductRegistrationTransaction {
     param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$ReadyTransaction)
-    Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$root=[IO.Path]::GetFullPath($InstallRoot);$authority=Get-CcodInstallProductReadyAuthority $root $ReadyTransaction
-    $arguments=[object[]]@($root,$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenProduct $arguments} 'CCOD_INSTALL_PRODUCT_SCOPE';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=$root.TrimEnd('\');RuntimeId=$authority.RuntimeId;RootToken=$token;StateOnly=$false;ProductOnly=$true;ReadyAuthority=$authority;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='ProductTransaction';ReadOnly=$true;RuntimeId=$authority.RuntimeId});$transaction
+    Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$root=[IO.Path]::GetFullPath($InstallRoot);$lease=$null
+    try{
+        $lease=Enter-CcodInstallProductAuthorityLease
+        $authority=Get-CcodInstallProductReadyAuthority $root $ReadyTransaction
+        $arguments=[object[]]@($root,$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenProduct $arguments} 'CCOD_INSTALL_PRODUCT_SCOPE';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=$root.TrimEnd('\');RuntimeId=$authority.RuntimeId;RootToken=$token;StateOnly=$false;ProductOnly=$true;ReadyAuthority=$authority;AuthorityLease=$lease;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='ProductTransaction';ReadOnly=$true;RuntimeId=$authority.RuntimeId});$lease=$null;return $transaction
+    }finally{if($null-ne$lease){try{Exit-CcodInstallProductAuthorityLease $lease}catch{}}}
 }
 function Open-CcodInstallRetainedFile {
     param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$RelativePath,[Parameter(Mandatory)]$ReadyTransaction)
-    if($RelativePath-cnotin@('registration/StartMenu.CodexRemote-fix.lnk','registration/Desktop.CodexRemote-fix.lnk')){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Product shortcut source must be one fixed manifest-relative candidate' $RelativePath};$scope=Get-CcodInstallTransaction $Generation 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';$authority=Get-CcodInstallProductReadyAuthority $scope.State.InstallRoot $ReadyTransaction;$stored=$scope.State.ReadyAuthority;if($null-eq$stored-or$authority.ReadyCanonical-cne$stored.ReadyCanonical-or$authority.PersistedReadyCanonical-cne$stored.PersistedReadyCanonical-or$authority.RuntimeId-cne$stored.RuntimeId-or$authority.Generation-ne$stored.Generation-or$authority.ManifestSha256-cne$stored.ManifestSha256-or$authority.PackageSha256-cne$stored.PackageSha256-or$authority.RuntimeId-cne$scope.Record.RuntimeId){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Retained shortcut source authority changed after capability open' $ReadyTransaction};$result=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetainedFile @($scope.Record.Token,$RelativePath)} 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';if(@($result).Count-ne3-or[int64]$result[1]-lt0-or[string]$result[2]-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Retained product shortcut identity is invalid' $RelativePath};Add-CcodInstallScope $scope.Record.Transaction $result[0] RetainedFile $true $scope.Record.RuntimeId
+    if($RelativePath-cnotin@('registration/StartMenu.CodexRemote-fix.lnk','registration/Desktop.CodexRemote-fix.lnk')){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Product shortcut source must be one fixed manifest-relative candidate' $RelativePath};$scope=Get-CcodInstallTransaction $Generation 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';[void](Assert-CcodInstallProductAuthorityLease $scope.State);$authority=Get-CcodInstallProductReadyAuthority $scope.State.InstallRoot $ReadyTransaction;$stored=$scope.State.ReadyAuthority;if($null-eq$stored-or$authority.ReadyCanonical-cne$stored.ReadyCanonical-or$authority.PersistedReadyCanonical-cne$stored.PersistedReadyCanonical-or$authority.RuntimeId-cne$stored.RuntimeId-or$authority.Generation-ne$stored.Generation-or$authority.ManifestSha256-cne$stored.ManifestSha256-or$authority.PackageSha256-cne$stored.PackageSha256-or$authority.RuntimeId-cne$scope.Record.RuntimeId){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Retained shortcut source authority changed after capability open' $ReadyTransaction};$result=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetainedFile @($scope.Record.Token,$RelativePath)} 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';if(@($result).Count-ne3-or[int64]$result[1]-lt0-or[string]$result[2]-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Retained product shortcut identity is invalid' $RelativePath};Add-CcodInstallScope $scope.Record.Transaction $result[0] RetainedFile $true $scope.Record.RuntimeId
 }
 function New-CcodInstallDirectory { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$Parent,[Parameter(Mandatory)][string]$Leaf,[switch]$CreateIfMissing) Assert-CcodInstallLeaf $Leaf;$transactionScope=Get-CcodInstallTransaction $Transaction 'CCOD_INSTALL_TRANSACTION_INVALID';if(-not[object]::ReferenceEquals($transactionScope.Record.Transaction,$Transaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Transaction capability must be the transaction root' $null};if([object]::ReferenceEquals($Parent,$Transaction)){$token=Invoke-CcodRuntimeMethod $transactionScope.State.Runtime GetInstallRoot @();$parentScope=[pscustomobject]@{State=$transactionScope.State;Record=[pscustomobject]@{Transaction=$Transaction;Token=$token;Kind='Directory';ReadOnly=$false;RuntimeId=$null}}}else{$parentScope=Get-CcodInstallScopedDirectory $Transaction $Parent};Assert-CcodInstallWritableScope $parentScope;$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $parentScope.State.Runtime OpenDirectory @($parentScope.Record.Token,$Leaf,[bool]$CreateIfMissing)} 'CCOD_INSTALL_DIRECTORY_OPEN_FAILED';$readOnly=[bool](Invoke-CcodRuntimeMethod $parentScope.State.Runtime IsRetained @($token));Add-CcodInstallScope $Transaction $token Directory $readOnly $(if($readOnly){$parentScope.Record.RuntimeId}else{$null}) }
 function New-CcodInstallGenerationLeaf { param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$Leaf) Assert-CcodInstallLeaf $Leaf;$scope=Get-CcodInstallTransaction $Generation;Assert-CcodInstallWritableScope $scope;if($scope.State.StateOnly){Throw-CcodInstallFileError 'CCOD_INSTALL_STATE_SCOPE' 'State-only transaction cannot create a generation leaf' $Leaf};$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CreateDirectory @($scope.Record.Token,$Leaf)} 'CCOD_INSTALL_LEAF_CREATE_FAILED';Add-CcodInstallScope $scope.Record.Transaction $token Directory $scope.Record.ReadOnly $scope.Record.RuntimeId }
@@ -439,7 +472,15 @@ function Copy-CcodInstallProductShortcut {
     Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CopyProductShortcut @($scope.Record.Token,$Kind,$sourceScope.Record.Token,$Leaf)} 'CCOD_INSTALL_PRODUCT_SHORTCUT_FAILED'|Out-Null
     [pscustomobject]@{Kind=$Kind;Leaf=$Leaf}
 }
-function Close-CcodInstallFileTransaction { param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][ValidateSet('Ready','Failed')][string]$Disposition) $state=$null;if($null-eq$Transaction-or-not$script:CcodTransactions.TryGetValue($Transaction,[ref]$state)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Invalid install file transaction capability' $null};if($state.Closed-and-not$state.CleanupFailed){return};try{Invoke-CcodRuntimeMethod $state.Runtime Close @()|Out-Null;$state.CleanupFailed=$false}catch{$state.CleanupFailed=$true;$state.Closed=$true;$state.Disposition=$Disposition;Throw-CcodInstallFileError 'CCOD_INSTALL_CLOSE_FAILED' 'Install file transaction cleanup failed; registered failures are retained for retry' $null};$state.Closed=$true;$state.Disposition=$Disposition }
+function Close-CcodInstallFileTransaction {
+    param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][ValidateSet('Ready','Failed')][string]$Disposition)
+    $state=$null;if($null-eq$Transaction-or-not$script:CcodTransactions.TryGetValue($Transaction,[ref]$state)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Invalid install file transaction capability' $null};if($state.Closed-and-not$state.CleanupFailed){return}
+    $cleanupFailed=$false
+    try{Invoke-CcodRuntimeMethod $state.Runtime Close @()|Out-Null}catch{$cleanupFailed=$true}
+    if($null-ne$state.PSObject.Properties['AuthorityLease']-and$null-ne$state.AuthorityLease){try{Exit-CcodInstallProductAuthorityLease $state.AuthorityLease;$state.AuthorityLease=$null}catch{$cleanupFailed=$true}}
+    $state.CleanupFailed=$cleanupFailed;$state.Closed=$true;$state.Disposition=$Disposition
+    if($cleanupFailed){Throw-CcodInstallFileError 'CCOD_INSTALL_CLOSE_FAILED' 'Install file transaction cleanup failed; registered failures are retained for retry' $null}
+}
 
 Initialize-CcodInstallRuntime
 Export-ModuleMember -Function Open-CcodInstallGeneration,Open-CcodInstallStateTransaction,Open-CcodInstallProductRegistrationTransaction,Open-CcodInstallRetainedGeneration,Open-CcodInstallRetainedFile,New-CcodInstallDirectory,New-CcodInstallGenerationLeaf,Copy-CcodInstallSealedSource,Write-CcodInstallGenerationManifest,Write-CcodInstallRecord,Commit-CcodInstallActivePointer,Retire-CcodInstallGeneration,Open-CcodInstallProductSpecialFolder,Copy-CcodInstallProductShortcut,Close-CcodInstallFileTransaction
diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index 5cce5bb..3a2f283 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -178,6 +178,9 @@ function Assert-CcodInstallTransactionRecord {
     } catch {
         Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction generations are invalid' $null
     }
+    if ($Record.ownedObjectNames -isnot [Array]) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction object names must be an array' $null
+    }
     $owned = @($Record.ownedObjectNames)
     if ($owned.Count -gt 64) { Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction owns too many objects' $null }
     $seen = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
@@ -307,29 +310,16 @@ function Write-CcodInstallTransactionRecord {
     return $TransactionRecord
 }
 
-function Read-CcodInstallTransactionRecord {
-    param([Parameter(Mandatory)][string]$InstallRoot,[string]$TransactionId)
-    $root = Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
-    $directory = Join-Path (Join-Path $root 'state') 'install-transactions'
-    if (-not [IO.Directory]::Exists($directory)) { return $null }
-    try { [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $directory) }
-    catch { Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction store is unsafe' $directory }
-    $records = [Collections.Generic.List[object]]::new()
-    foreach ($file in @(Get-ChildItem -LiteralPath $directory -Force -ErrorAction Stop)) {
-        if ($file.PSIsContainer -or $file.Name -cnotmatch '^\d{20}\.\d{2}\.[A-Za-z]+\.[0-9a-f-]{36}\.json$') { Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction store contains an unknown object' $file.FullName }
-        try { $record = Read-CcodStrictJson -Path $file.FullName -ExpectedSchema 1 -Kind 'install transaction' }
-        catch { Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction snapshot is malformed' $file.FullName }
-        [void](Assert-CcodInstallTransactionRecord $record)
-        if ((Get-CcodInstallTransactionRecordLeaf $record) -cne $file.Name) { Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction snapshot name is not canonical' $file.FullName }
-        if ([string]::IsNullOrWhiteSpace($TransactionId) -or [string]$record.transactionId -ceq $TransactionId) { $records.Add($record) }
-    }
-    if ($records.Count -eq 0) { return $null }
+function Resolve-CcodInstallTransactionRecordHead {
+    param([Parameter(Mandatory)][object[]]$Records,[string]$TransactionId,$ActiveRuntime)
+    if ($Records.Count -eq 0) { return $null }
     $heads = [Collections.Generic.List[object]]::new()
-    foreach ($group in @($records | Group-Object transactionId)) {
+    foreach ($group in @($Records | Group-Object transactionId)) {
         $chain = @($group.Group | Sort-Object @{Expression={if ($_.phase -ceq 'Failed') { 99 } else { [Array]::IndexOf($script:CcodInstallTransactionPhases,[string]$_.phase) }}})
         if ($chain[0].phase -cne 'Prepared') { Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction chain does not begin at Prepared' $group.Name }
         for ($index=0; $index -lt $chain.Count; $index++) {
             $current = $chain[$index]
+            [void](Assert-CcodInstallTransactionRecord $current)
             $head=$chain[0]
             $oldGenerationChanged=($null-eq$head.oldGeneration)-ne($null-eq$current.oldGeneration)
             if(-not$oldGenerationChanged-and$null-ne$head.oldGeneration){$oldGenerationChanged=[uint64]$current.oldGeneration-ne[uint64]$head.oldGeneration}
@@ -354,12 +344,31 @@ function Read-CcodInstallTransactionRecord {
         $matched=@($heads|Where-Object{$_.transactionId -ceq $TransactionId});if($matched.Count-ne 1){return $null};return $matched[0]
     }
     $nonterminal=@($heads|Where-Object{$_.phase -notin @('Ready','Failed')})
-    if($nonterminal.Count-gt 1){Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_AMBIGUOUS' 'More than one nonterminal install transaction exists' $directory}
+    if($nonterminal.Count-gt 1){Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_AMBIGUOUS' 'More than one nonterminal install transaction exists' $null}
     if($nonterminal.Count-eq 1){return $nonterminal[0]}
-    $active=$null;try{$active=Read-CcodActiveRuntime -InstallRoot $root}catch{}
-    if($null-ne$active){$ready=@($heads|Where-Object{$_.phase-ceq'Ready'-and$_.newRuntimeId-ceq$active.activeRuntime-and[uint64]$_.newGeneration-eq[uint64]$active.generation});if($ready.Count-ne 0){if($ready.Count-ne 1){Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_AMBIGUOUS' 'Active generation has multiple Ready records' $directory};return $ready[0]}}
+    if($null-ne$ActiveRuntime){$ready=@($heads|Where-Object{$_.phase-ceq'Ready'-and$_.newRuntimeId-ceq$ActiveRuntime.activeRuntime-and[uint64]$_.newGeneration-eq[uint64]$ActiveRuntime.generation});if($ready.Count-ne 0){if($ready.Count-ne 1){Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_AMBIGUOUS' 'Active generation has multiple Ready records' $null};return $ready[0]}}
     $failed=@($heads|Where-Object{$_.phase-ceq'Failed'}|Sort-Object @{Expression={[uint64]$_.newGeneration}})
-    if($failed.Count-eq 0){return $null};$max=[uint64]$failed[-1].newGeneration;$same=@($failed|Where-Object{[uint64]$_.newGeneration-eq$max});if($same.Count-ne 1){Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_AMBIGUOUS' 'Latest failed generation is ambiguous' $directory};return $same[0]
+    if($failed.Count-eq 0){return $null};$max=[uint64]$failed[-1].newGeneration;$same=@($failed|Where-Object{[uint64]$_.newGeneration-eq$max});if($same.Count-ne 1){Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_AMBIGUOUS' 'Latest failed generation is ambiguous' $null};return $same[0]
+}
+
+function Read-CcodInstallTransactionRecord {
+    param([Parameter(Mandatory)][string]$InstallRoot,[string]$TransactionId)
+    $root = Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
+    $directory = Join-Path (Join-Path $root 'state') 'install-transactions'
+    if (-not [IO.Directory]::Exists($directory)) { return $null }
+    try { [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $directory) }
+    catch { Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction store is unsafe' $directory }
+    $records = [Collections.Generic.List[object]]::new()
+    foreach ($file in @(Get-ChildItem -LiteralPath $directory -Force -ErrorAction Stop)) {
+        if ($file.PSIsContainer -or $file.Name -cnotmatch '^\d{20}\.\d{2}\.[A-Za-z]+\.[0-9a-f-]{36}\.json$') { Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction store contains an unknown object' $file.FullName }
+        try { $record = Read-CcodStrictJson -Path $file.FullName -ExpectedSchema 1 -Kind 'install transaction' }
+        catch { Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction snapshot is malformed' $file.FullName }
+        [void](Assert-CcodInstallTransactionRecord $record)
+        if ((Get-CcodInstallTransactionRecordLeaf $record) -cne $file.Name) { Throw-CcodLifecycleError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Install transaction snapshot name is not canonical' $file.FullName }
+        if ([string]::IsNullOrWhiteSpace($TransactionId) -or [string]$record.transactionId -ceq $TransactionId) { $records.Add($record) }
+    }
+    $active=$null;if([string]::IsNullOrWhiteSpace($TransactionId)){try{$active=Read-CcodActiveRuntime -InstallRoot $root}catch{}}
+    return Resolve-CcodInstallTransactionRecordHead -Records $records.ToArray() -TransactionId $TransactionId -ActiveRuntime $active
 }
 
 function Set-CcodInstallTransactionPhase {
@@ -448,7 +457,7 @@ function Complete-CcodReadyFinalizationRecovery {
         $observed=Read-CcodInstallTransactionRecord -InstallRoot $InstallRoot -TransactionId $TransactionRecord.transactionId
         if($null-eq$observed-or$observed.phase-cne'Ready'){Throw-CcodLifecycleError 'CCOD_INSTALL_READY_FINALIZATION_PENDING' 'Ready finalization snapshot is not visible' $TransactionRecord.transactionId}
         if([string]$proof.Validation.Manifest.projectVersion-ceq$script:CcodProductVersion){
-            try{$registration=&$Adapters.RegisterProduct $InstallRoot ([string]$observed.newRuntimeId) ([string]$proof.Validation.Manifest.projectVersion) ([string]$observed.sealedPackageSha256) $null $observed;if($null-eq$registration-or$registration.verified-isnot[bool]-or-not$registration.verified){throw 'registration receipt invalid'};$productRegistrationVerified=$true}catch{$productRegistrationFailure=$_}
+            try{&$Adapters.CloseReadyGeneration $fileTransaction;$fileTransaction=$null;$productAdapters=&$Adapters.GetProductRegistrationAdapters;$registration=&$Adapters.RegisterProduct $InstallRoot ([string]$observed.newRuntimeId) ([string]$proof.Validation.Manifest.projectVersion) ([string]$observed.sealedPackageSha256) $null $observed $productAdapters;if($null-eq$registration-or$registration.verified-isnot[bool]-or-not$registration.verified){throw 'registration receipt invalid'};$productRegistrationVerified=$true}catch{$productRegistrationFailure=$_}
         }
     }catch{
         try{$observed=Read-CcodInstallTransactionRecord -InstallRoot $InstallRoot -TransactionId $TransactionRecord.transactionId}catch{}
@@ -1942,6 +1951,10 @@ function Get-CcodLifecycleAdapters {
             param($InstallRoot,$TransactionId,$FileTransaction)
             Set-CcodInstallTransactionPhase -InstallRoot $InstallRoot -TransactionId $TransactionId -ExpectedPhase 'ProtectionReady' -NewPhase 'Ready' -FileTransaction $FileTransaction
         }
+        CloseReadyGeneration = {
+            param($FileTransaction)
+            Close-CcodInstallFileTransaction -Transaction $FileTransaction -Disposition Ready
+        }
         AddProductShortcutCandidates = {
             param($Files)
             $temporaryRoot=Join-Path ([IO.Path]::GetTempPath()) ('ccod-product-shortcuts-'+[guid]::NewGuid().ToString('N'))
@@ -1949,16 +1962,18 @@ function Get-CcodLifecycleAdapters {
             $candidates=@(& $module {param($Root)New-CcodProductShortcutCandidates -Directory $Root} $temporaryRoot)
             [pscustomobject]@{Files=@($Files)+$candidates;TemporaryRoot=$temporaryRoot}
         }
+        GetProductRegistrationAdapters = { $null }
         RegisterProduct = {
-            param($InstallRoot,$RuntimeId,$Version,$PackageSha256,$FileTransaction,$TransactionRecord)
+            param($InstallRoot,$RuntimeId,$Version,$PackageSha256,$FileTransaction,$TransactionRecord,$ProductAdapters)
             $module=Import-Module (Join-Path $PSScriptRoot 'ProductRegistration.psm1') -Force -PassThru -ErrorAction Stop
-            $ownedTransaction=$null;$sourceCapability=$FileTransaction
+            $ownedTransaction=$null;$sourceCapability=$null
             try{
-                if($null-eq$sourceCapability){Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop;$ownedTransaction=Open-CcodInstallProductRegistrationTransaction -InstallRoot $InstallRoot -ReadyTransaction $TransactionRecord;$sourceCapability=Open-CcodInstallRetainedGeneration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -ExpectedManifestSha256 ([string]$TransactionRecord.newManifestSha256) -FileTransaction $ownedTransaction}
+                Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop;$ownedTransaction=Open-CcodInstallProductRegistrationTransaction -InstallRoot $InstallRoot -ReadyTransaction $TransactionRecord;$sourceCapability=Open-CcodInstallRetainedGeneration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -ExpectedManifestSha256 ([string]$TransactionRecord.newManifestSha256) -FileTransaction $ownedTransaction
                 $registration=New-CcodProductRegistration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -Version $Version -PackageSha256 $PackageSha256 -FileTransaction $sourceCapability
                 $system=[Environment]::GetFolderPath([Environment+SpecialFolder]::System);$proof=[pscustomobject][ordered]@{phase=[string]$TransactionRecord.phase;runtimeId=$RuntimeId;version=$Version;packageSha256=$PackageSha256;runtimeGeneration=[uint64]$TransactionRecord.newGeneration;manifestSha256=[string]$TransactionRecord.newManifestSha256;startMenuSha256=(Get-CcodLifecycleFileSha256 $registration.startMenuShortcut.candidatePath);desktopSha256=(Get-CcodLifecycleFileSha256 $registration.desktopShortcut.candidatePath);targetPath=[IO.Path]::GetFullPath((Join-Path $system 'schtasks.exe'));arguments='/Run /TN "Codex Control Other Devices Supervisor"';transactionRecord=$TransactionRecord;bootstrapPath=$registration.bootstrapPath;uninstallerPath=$registration.uninstallerPath}
-                $receipt=Commit-CcodProductRegistration -Registration $registration -FileTransaction $sourceCapability -Adapters @{GetReadyProof={param($Ignored)$proof}.GetNewClosure()}
-                Remove-CcodLegacyProductRegistration -ExpectedAppId '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}'
+                $commitAdapters=@{};if($null-ne$ProductAdapters){if($ProductAdapters-isnot[hashtable]){throw 'product side-effect adapters invalid'};foreach($key in $ProductAdapters.Keys){$commitAdapters[$key]=$ProductAdapters[$key]}};$commitAdapters.GetReadyProof={param($Ignored)$proof}.GetNewClosure()
+                $receipt=Commit-CcodProductRegistration -Registration $registration -FileTransaction $sourceCapability -Adapters $commitAdapters
+                Remove-CcodLegacyProductRegistration -ExpectedAppId '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}' -Adapters $ProductAdapters
                 [pscustomobject]@{verified=[bool]$receipt.verified;legacyRemoved=$true}
             }finally{if($null-ne$ownedTransaction){try{Close-CcodInstallFileTransaction -Transaction $ownedTransaction -Disposition Ready}catch{}}}
         }
@@ -2375,7 +2390,7 @@ function Invoke-CcodInstall {
         if($activeValidation.Valid){
             $sameIdentity=Test-CcodInstallPackageIdentity -TransactionRecord $globalTransaction -ProjectVersion ([string]$projectVersion) -ActiveProjectVersion ([string]$activeValidation.Manifest.projectVersion) -SealedPackageSha256 $SealedPackageSha256 -ActiveRuntimeId ([string]$existingPointer.activeRuntime) -ActiveGeneration ([uint64]$existingPointer.generation)
             if($sameIdentity){
-                $registration=&$adapters.RegisterProduct $root ([string]$existingPointer.activeRuntime) ([string]$projectVersion) $SealedPackageSha256 $null $globalTransaction
+                $productAdapters=&$adapters.GetProductRegistrationAdapters;$registration=&$adapters.RegisterProduct $root ([string]$existingPointer.activeRuntime) ([string]$projectVersion) $SealedPackageSha256 $null $globalTransaction $productAdapters
                 if($null-eq$registration-or$registration.verified-isnot[bool]-or-not$registration.verified){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'AlreadyInstalled product registration reconciliation did not verify' $existingPointer.activeRuntime}
                 return [pscustomobject][ordered]@{Outcome='AlreadyInstalled';Installed=$true;RuntimeId=[string]$existingPointer.activeRuntime;PreviousRuntimeId=$existingPointer.previousRuntime;RepairCompleted=$false;ProductRegistrationVerified=$true}
             }
@@ -2506,7 +2521,8 @@ function Invoke-CcodInstall {
         }
         if([string]$projectVersion-ceq$script:CcodProductVersion){
             try{
-                $registrationReceipt=&$adapters.RegisterProduct $root $runtimeId ([string]$projectVersion) $SealedPackageSha256 $fileTransaction $installRecord
+                &$adapters.CloseReadyGeneration $fileTransaction;$fileTransaction=$null
+                $productAdapters=&$adapters.GetProductRegistrationAdapters;$registrationReceipt=&$adapters.RegisterProduct $root $runtimeId ([string]$projectVersion) $SealedPackageSha256 $fileTransaction $installRecord $productAdapters
                 if($null-eq$registrationReceipt-or$registrationReceipt.verified-isnot[bool]-or-not$registrationReceipt.verified){throw 'registration receipt invalid'}
                 $productRegistrationVerified=$true
             }catch{$productRegistrationFailure=$_}
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index 2ad5666..8e78a3b 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -181,6 +181,95 @@ function Write-CcodProductReadyTransactionChain {
     return (Join-Path $transactions ('{0:D20}.08.Ready.{1}.json'-f[uint64]$ReadyRecord.newGeneration,$ReadyRecord.transactionId))
 }
 
+function New-CcodProductAuthorityFixture {
+    $fixture=New-CcodInstallFileFixture
+    $runtimeId='runtime-product-canonical-authority'
+    $source=New-CcodSourceFile $fixture 'canonical-authority.lnk' 'canonical authority shortcut'
+    $generation=Open-CcodFixtureGeneration $fixture $runtimeId
+    $registration=New-CcodInstallGenerationLeaf -Generation $generation -Leaf 'registration'
+    Copy-CcodInstallSealedSource -Generation $registration -SourcePath $source.Path -Leaf 'StartMenu.CodexRemote-fix.lnk' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null
+    $manifest=Write-CcodInstallGenerationManifest -Generation $generation -Manifest (New-CcodGenerationManifest $runtimeId @([ordered]@{path='registration/StartMenu.CodexRemote-fix.lnk';length=$source.Length;sha256=$source.Sha256}))
+    Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $generation -ExpectedPreviousGeneration 0 -FileTransaction $generation|Out-Null
+    Close-CcodInstallFileTransaction -Transaction $generation -Disposition Ready
+    $ready=[pscustomobject][ordered]@{schemaVersion=1;transactionId='33333333-4444-4555-8666-777777777777';oldRuntimeId=$null;oldGeneration=$null;oldManifestSha256=$null;newRuntimeId=$runtimeId;newGeneration=[uint64]1;newManifestSha256=$manifest.Sha256;sealedPackageSha256=('a'*64);ownedObjectNames=@($runtimeId);phase='Ready';errorCode=$null}
+    $readyPath=Write-CcodProductReadyTransactionChain -InstallRoot $fixture.Install -ReadyRecord $ready
+    [pscustomobject]@{Fixture=$fixture;RuntimeId=$runtimeId;Manifest=$manifest;Ready=$ready;ReadyPath=$readyPath}
+}
+
+# Production mutation caught: a selected Ready chain cannot authorize product access while an unrelated install remains nonterminal.
+Invoke-CcodTest 'product authority uses the canonical global lifecycle head and retains no authority after unrelated Prepared rejection' {
+    $authority=New-CcodProductAuthorityFixture;$fixture=$authority.Fixture
+    try{
+        $unrelated=[pscustomobject][ordered]@{schemaVersion=1;transactionId='44444444-5555-4666-8777-888888888888';oldRuntimeId=$authority.RuntimeId;oldGeneration=[uint64]1;oldManifestSha256=$authority.Manifest.Sha256;newRuntimeId='runtime-unrelated-prepared';newGeneration=[uint64]2;newManifestSha256=('b'*64);sealedPackageSha256=('c'*64);ownedObjectNames=@('runtime-unrelated-prepared');phase='Prepared';errorCode=$null}
+        $leaf='{0:D20}.00.Prepared.{1}.json'-f[uint64]$unrelated.newGeneration,$unrelated.transactionId;$path=Join-Path $fixture.Install "state\install-transactions\$leaf"
+        [IO.File]::WriteAllText($path,($unrelated|ConvertTo-Json -Depth 8 -Compress),[Text.UTF8Encoding]::new($false))
+        Assert-CcodProductTransactionRejected -Fixture $fixture -Action {Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $authority.Ready}
+        Remove-Item -LiteralPath $path -Force
+        $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $authority.Ready;$fixture.Transactions.Add($product)
+        Assert-CcodTrue ($null-ne$product) 'rejected global head leaves no product authority or coordination lease behind'
+    }finally{Remove-CcodInstallFileFixture $fixture}
+}
+
+# Production mutation caught: Failed may not be appended after terminal Ready and must not leave product authority behind.
+Invoke-CcodTest 'product authority rejects the canonical Ready to Failed post-terminal continuation without retaining authority' {
+    $authority=New-CcodProductAuthorityFixture;$fixture=$authority.Fixture
+    try{
+        $failed=$authority.Ready.PSObject.Copy();$failed.phase='Failed';$failed.errorCode='CCOD_TEST_POST_TERMINAL'
+        $leaf='{0:D20}.99.Failed.{1}.json'-f[uint64]$failed.newGeneration,$failed.transactionId;$path=Join-Path $fixture.Install "state\install-transactions\$leaf"
+        [IO.File]::WriteAllText($path,($failed|ConvertTo-Json -Depth 8 -Compress),[Text.UTF8Encoding]::new($false))
+        Assert-CcodProductTransactionRejected -Fixture $fixture -Action {Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $authority.Ready}
+        Remove-Item -LiteralPath $path -Force
+        $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $authority.Ready;$fixture.Transactions.Add($product)
+        Assert-CcodTrue ($null-ne$product) 'post-terminal rejection leaves no product authority or coordination lease behind'
+    }finally{Remove-CcodInstallFileFixture $fixture}
+}
+
+# Production mutation caught: selector proof without the committing install's AccountTransition lease permits N+1 to commit across N proof/use.
+Invoke-CcodTest 'product authority holds the real commit coordination lease across proof and retained-file use' {
+    $authority=New-CcodProductAuthorityFixture;$fixture=$authority.Fixture;$product=$null;$commitProcess=$null
+    $readyMarker=Join-Path $fixture.Base 'commit-ready.marker';$resultPath=Join-Path $fixture.Base 'commit-result.json';$stdout=Join-Path $fixture.Base 'commit.stdout.txt';$stderr=Join-Path $fixture.Base 'commit.stderr.txt';$childScript=Join-Path $fixture.Base 'commit-next-generation.ps1'
+    $moduleRoot=Join-Path $projectRoot 'src\persistence\modules';$nextRuntime='runtime-product-canonical-authority-next'
+    $child=@'
+param([string]$ModuleRoot,[string]$InstallRoot,[string]$CurrentRuntime,[string]$NextRuntime,[string]$ReadyMarker,[string]$ResultPath)
+$ErrorActionPreference='Stop';$transaction=$null;$ownership=$null;$identity=$null;$process=$null
+try{
+    $fileModule=Import-Module (Join-Path $ModuleRoot 'InstallFileTransaction.psm1') -Force -PassThru -ErrorAction Stop
+    $runtimeModule=Import-Module (Join-Path $ModuleRoot 'RuntimeManifest.psm1') -Force -PassThru -ErrorAction Stop
+    $epochModule=Import-Module (Join-Path $ModuleRoot 'LifecycleEpoch.psm1') -Force -PassThru -ErrorAction Stop
+    $transaction=&$fileModule {param($Root,$Id)Open-CcodInstallGeneration -InstallRoot $Root -RuntimeId $Id} $InstallRoot $NextRuntime
+    &$fileModule {param($Generation,$Id)Write-CcodInstallGenerationManifest -Generation $Generation -Manifest ([ordered]@{schemaVersion=1;projectVersion='2.5.22';runtimeId=$Id;commit='0123456789abcdef0123456789abcdef01234567';files=@()})|Out-Null} $transaction $NextRuntime
+    [IO.File]::WriteAllText($ReadyMarker,'ready',[Text.UTF8Encoding]::new($false))
+    $process=[Diagnostics.Process]::GetCurrentProcess();$owner=[pscustomobject][ordered]@{pid=[int]$process.Id;creationTimeUtc=$process.StartTime.ToUniversalTime().ToString('o')}
+    $identity=[Security.Principal.WindowsIdentity]::GetCurrent();$sid=$identity.User.Value
+    $ownership=&$epochModule {param($Root,$Runtime,$Owner,$Sid,$Session)Enter-CcodLifecycleOwnership -InstallRoot $Root -RuntimeId $Runtime -RuntimeGeneration 1 -OwnerIdentity $Owner -UserSid $Sid -SessionId $Session -TimeoutMilliseconds 15000} $InstallRoot $CurrentRuntime $owner $sid $process.SessionId
+    $pointer=&$runtimeModule {param($Root,$Runtime,$Generation,$Transaction,$Owner)Set-CcodActiveRuntime -InstallRoot $Root -NewRuntimeId $Runtime -TargetGeneration $Generation -FileTransaction $Transaction -Ownership $Owner} $InstallRoot $NextRuntime $transaction $transaction $ownership
+    [IO.File]::WriteAllText($ResultPath,($pointer|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
+    exit 0
+}catch{$message=$_|Out-String;[Console]::Error.WriteLine($message);exit 3}
+finally{if($null-ne$ownership){try{&$epochModule {param($Owner)Exit-CcodLifecycleOwnership -Ownership $Owner|Out-Null} $ownership}catch{}};if($null-ne$transaction){try{&$fileModule {param($Transaction)Close-CcodInstallFileTransaction -Transaction $Transaction -Disposition Ready} $transaction}catch{}};if($null-ne$identity){$identity.Dispose()};if($null-ne$process){$process.Dispose()}}
+'@
+    [IO.File]::WriteAllText($childScript,$child,[Text.UTF8Encoding]::new($false))
+    try{
+        $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $authority.Ready;$fixture.Transactions.Add($product)
+        $retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $authority.RuntimeId -ExpectedManifestSha256 $authority.Manifest.Sha256 -FileTransaction $product
+        $powershell=(Get-Process -Id $PID).Path
+        $commitProcess=Start-Process -FilePath $powershell -ArgumentList @('-NoProfile','-ExecutionPolicy','Bypass','-File',$childScript,'-ModuleRoot',$moduleRoot,'-InstallRoot',$fixture.Install,'-CurrentRuntime',$authority.RuntimeId,'-NextRuntime',$nextRuntime,'-ReadyMarker',$readyMarker,'-ResultPath',$resultPath) -WindowStyle Hidden -RedirectStandardOutput $stdout -RedirectStandardError $stderr -PassThru
+        $deadline=[DateTime]::UtcNow.AddSeconds(20);while(-not[IO.File]::Exists($readyMarker)-and[DateTime]::UtcNow-lt$deadline){$commitProcess.Refresh();if($commitProcess.HasExited){break};Start-Sleep -Milliseconds 25}
+        if(-not[IO.File]::Exists($readyMarker)){if(-not$commitProcess.HasExited){Stop-Process -Id $commitProcess.Id -Force};$commitProcess.WaitForExit();throw "real N+1 commit child did not reach lifecycle ownership: $($(if([IO.File]::Exists($stderr)){[IO.File]::ReadAllText($stderr)}else{'no stderr'}))"}
+        $commitBlocked=$true;$watch=[Diagnostics.Stopwatch]::StartNew();while($watch.ElapsedMilliseconds-lt1200){if([IO.File]::Exists($resultPath)-or$commitProcess.HasExited){$commitBlocked=$false;break};Start-Sleep -Milliseconds 20};$watch.Stop()
+        if($commitBlocked){$opened=Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyTransaction $authority.Ready;Assert-CcodTrue ($null-ne$opened) 'N retained shortcut opens while its authority lease excludes N+1'}
+        Close-CcodInstallFileTransaction -Transaction $product -Disposition Ready
+        if(-not$commitProcess.WaitForExit(20000)){Stop-Process -Id $commitProcess.Id -Force;throw 'real N+1 commit child timed out'}
+        $commitProcess.Refresh();if(-not[IO.File]::Exists($resultPath)){throw "real N+1 commit child produced no committed pointer exit=$($commitProcess.ExitCode) stdout=$([IO.File]::ReadAllText($stdout)) stderr=$([IO.File]::ReadAllText($stderr))"}
+        $pointer=[IO.File]::ReadAllText($resultPath)|ConvertFrom-Json;Assert-CcodEqual 2 ([uint64]$pointer.generation) 'real commit advances to N+1 only after N authority closes'
+        Assert-CcodThrows {Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyTransaction $authority.Ready|Out-Null} 'CCOD_INSTALL_TRANSACTION_CLOSED'
+        Assert-CcodTrue $commitBlocked 'N+1 commit is blocked for the complete N proof-to-use boundary'
+    }finally{
+        if($null-ne$commitProcess-and-not$commitProcess.HasExited){try{Stop-Process -Id $commitProcess.Id -Force}catch{}};if($null-ne$commitProcess){$commitProcess.Dispose()}
+        Remove-CcodInstallFileFixture $fixture
+    }
+}
+
 # Production mutation caught: state-only recovery or an arbitrary absolute source can acquire product shortcut authority.
 Invoke-CcodTest 'product registration transaction exposes only a selected retained manifest file capability' {
     $fixture=New-CcodInstallFileFixture
@@ -189,7 +278,10 @@ Invoke-CcodTest 'product registration transaction exposes only a selected retain
         $readyRecord=[pscustomobject][ordered]@{schemaVersion=1;transactionId='11111111-2222-3333-4444-555555555555';oldRuntimeId=$null;oldGeneration=$null;oldManifestSha256=$null;newRuntimeId=$runtimeId;newGeneration=[uint64]1;newManifestSha256=$manifest.Sha256;sealedPackageSha256=('d'*64);ownedObjectNames=@($runtimeId);phase='Ready';errorCode=$null};$readyPath=Write-CcodProductReadyTransactionChain -InstallRoot $fixture.Install -ReadyRecord $readyRecord
         foreach($field in @('oldRuntimeId','transactionId','ownedObjectNames')){$changed=$readyRecord.PSObject.Copy();if($field-ceq'oldRuntimeId'){$changed.oldRuntimeId='runtime-old'}elseif($field-ceq'transactionId'){$changed.transactionId='aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee'}else{$changed.ownedObjectNames=@($runtimeId,'unexpected-owned-object')};Assert-CcodProductTransactionRejected -Fixture $fixture -Action {Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $changed}}
         $fabricated=[pscustomobject][ordered]@{phase='Ready';runtimeId=$runtimeId;runtimeGeneration=[uint64]1;manifestSha256=$manifest.Sha256;packageSha256=('d'*64)};Assert-CcodThrows {Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $fabricated|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
-        $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $readyRecord;$fixture.Transactions.Add($product);$retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $product;$file=Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyTransaction $readyRecord
+        $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $readyRecord;$fixture.Transactions.Add($product);$retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $product
+        $heldLease=&$module {param($Capability)$scope=Get-CcodInstallTransaction $Capability;$lease=$scope.State.AuthorityLease;$scope.State.AuthorityLease=$null;return $lease} $product
+        try{Assert-CcodThrows {Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyTransaction $readyRecord|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'}finally{&$module {param($Capability,$Lease)$scope=Get-CcodInstallTransaction $Capability;$scope.State.AuthorityLease=$Lease} $product $heldLease}
+        $file=Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyTransaction $readyRecord
         Assert-CcodTrue ($null-ne$file) 'selected manifest file returns an opaque retained source capability'
         Assert-CcodThrows {Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'C:\outside\arbitrary.lnk' -ReadyTransaction $readyRecord|Out-Null} 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID'
         Assert-CcodThrows {New-CcodInstallDirectory -Transaction $product -Parent $product -Leaf 'state' -CreateIfMissing|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index 6c5fe10..5ad27de 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -322,6 +322,38 @@ function New-CcodLifecycleFake {
     [pscustomobject]@{ World = $world; Adapters = $adapters }
 }
 
+function New-CcodLifecycleProductSideEffectAdapters {
+    param([Parameter(Mandatory)][hashtable]$State)
+    @{
+        WriteProductRegistration={param($Registration,$ReadyEvidence)if($State.FailWrites){throw 'TEST_PRODUCT_WRITE_FAILURE'};$State.Registration=$Registration;$State.ReadyEvidence=$ReadyEvidence;$State.Writes++}.GetNewClosure()
+        ReadProductRegistration={param($Registration)$State.Registration}.GetNewClosure()
+        WriteShortcut={
+            param($Kind,$Shortcut,$FileTransaction,$ReadyEvidence)
+            $relative='registration/'+$(if($Kind-ceq'StartMenu'){'StartMenu.CodexRemote-fix.lnk'}else{'Desktop.CodexRemote-fix.lnk'})
+            try{$fileModule=Get-Module -All|Where-Object{$null-ne$_.Path-and[IO.Path]::GetFileName($_.Path)-ceq'InstallFileTransaction.psm1'}|Select-Object -First 1;if($null-eq$fileModule){throw 'install file transaction module unavailable'};$source=&$fileModule {param($Generation,$Path,$Record)Open-CcodInstallRetainedFile -Generation $Generation -RelativePath $Path -ReadyTransaction $Record} $FileTransaction $relative $ReadyEvidence.transactionRecord}catch{$State.RetainedError=([string]$_.FullyQualifiedErrorId-split',')[0];throw}
+            if($null-eq$source){throw 'retained shortcut capability missing'}
+            $State.ProductOnlyObserved=$true;$State.Shortcuts[$Kind]=$Shortcut;$State.ShortcutWrites++
+        }.GetNewClosure()
+        ReadShortcut={param($Kind,$Shortcut)$State.Shortcuts[$Kind]}.GetNewClosure()
+        ReadVerifiedRegistration={ [pscustomobject]@{verified=$true} }
+        ReadLegacyRegistration={param($ExpectedAppId)$null}
+    }
+}
+
+function Set-CcodLifecycleDefaultProductRegistrationFixture {
+    param([Parameter(Mandatory)]$Fake,[Parameter(Mandatory)][hashtable]$ProductState)
+    [void]$Fake.Adapters.Remove('RegisterProduct')
+    $sideEffects=New-CcodLifecycleProductSideEffectAdapters -State $ProductState
+    $Fake.Adapters.GetProductRegistrationAdapters={$sideEffects}.GetNewClosure()
+    $Fake.Adapters.AddProductShortcutCandidates={
+        param($Files)
+        $temporaryRoot=Join-Path ([IO.Path]::GetTempPath()) ('ccod-lifecycle-product-'+[guid]::NewGuid().ToString('N'));[IO.Directory]::CreateDirectory($temporaryRoot)|Out-Null
+        $records=[Collections.Generic.List[object]]::new()
+        foreach($leaf in @('StartMenu.CodexRemote-fix.lnk','Desktop.CodexRemote-fix.lnk')){$path=Join-Path $temporaryRoot $leaf;[IO.File]::WriteAllText($path,"sealed $leaf",[Text.UTF8Encoding]::new($false));$item=Get-Item -LiteralPath $path;$sha=(Get-FileHash -LiteralPath $path -Algorithm SHA256).Hash.ToLowerInvariant();$records.Add([pscustomobject]@{Relative=('registration/'+$leaf);Source=$path;ExpectedLength=[int64]$item.Length;ExpectedSha256=$sha})}
+        [pscustomobject]@{Files=@($Files)+@($records);TemporaryRoot=$temporaryRoot}
+    }
+}
+
 function New-CcodReadyFinalizationGapFixture {
     $source=New-CcodLifecycleTempRoot
     $install=New-CcodLifecycleTempRoot
@@ -3253,4 +3285,58 @@ $results += Invoke-CcodTest 'registration failure preserves durable Ready withou
     }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}}
 }
 
+# Production mutation caught: normal first install passed its writable generation transaction to the default product path instead of reopening strict Ready authority.
+$results += Invoke-CcodTest 'normal first install reaches the default registration path with only a strict product capability' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    try{
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null;$node=New-CcodLifecycleFakeNode -Root $nodeRoot;$fake=New-CcodLifecycleFake -NodePath $node
+        $productState=@{FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{}}
+        Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $fake -ProductState $productState
+        $result=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('6'*64) -Adapters $fake.Adapters
+        Assert-CcodEqual 'Installed' $result.Outcome 'normal first install completes through the real default registration adapter'
+        Assert-CcodTrue $result.ProductRegistrationVerified 'normal first install reports verified product registration'
+        Assert-CcodTrue $productState.ProductOnlyObserved 'lower shortcut side effect receives a product-only retained capability'
+        Assert-CcodEqual 1 $productState.Writes 'registry side effect boundary is invoked once'
+        Assert-CcodEqual 2 $productState.ShortcutWrites 'both shortcut side effect boundaries are invoked once'
+    }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}}
+}
+
+# Production mutation caught: default registration failure after durable Ready must remain outside lifecycle failure and reconcile through AlreadyInstalled.
+$results += Invoke-CcodTest 'default first-install registration failure leaves Ready and retries with strict product authority' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    try{
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null;$node=New-CcodLifecycleFakeNode -Root $nodeRoot;$first=New-CcodLifecycleFake -NodePath $node
+        $failedState=@{FailWrites=$true;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{}};Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $first -ProductState $failedState
+        Assert-CcodThrows {Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('7'*64) -Adapters $first.Adapters|Out-Null} 'CCOD_PRODUCT_REGISTRATION_FAILED'
+        $module=Get-Module InstallLifecycle -ErrorAction Stop;$head=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install
+        Assert-CcodEqual 'Ready' $head.phase 'default registration failure leaves the lifecycle transaction durably Ready'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Failed.*.json' -File).Count 'default registration failure appends no Failed lifecycle snapshot'
+        $retry=New-CcodLifecycleFake -NodePath $node;$retryState=@{FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{}};Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $retry -ProductState $retryState
+        $result=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('7'*64) -Adapters $retry.Adapters
+        Assert-CcodEqual 'AlreadyInstalled' $result.Outcome 'later same-package invocation retries default product registration'
+        Assert-CcodTrue $retryState.ProductOnlyObserved 'recovery retry receives only strict product authority'
+        Assert-CcodEqual 2 $retryState.ShortcutWrites 'recovery retry publishes both shortcut records through lower side effects'
+    }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}}
+}
+
+# Production mutation caught: failure to close the writable generation at the post-Ready handoff must not enter lifecycle rollback or prevent reconciliation.
+$results += Invoke-CcodTest 'post-Ready writable close failure preserves Ready and retries before product side effects' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    try{
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null;$node=New-CcodLifecycleFakeNode -Root $nodeRoot;$first=New-CcodLifecycleFake -NodePath $node
+        $failedState=@{FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{}};Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $first -ProductState $failedState
+        $first.Adapters.CloseReadyGeneration={param($Transaction)throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new('fixture Ready close failed'),'CCOD_INSTALL_CLOSE_FAILED',[Management.Automation.ErrorCategory]::InvalidData,$null)}
+        Assert-CcodThrows {Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('8'*64) -Adapters $first.Adapters|Out-Null} 'CCOD_PRODUCT_REGISTRATION_FAILED'
+        $module=Get-Module InstallLifecycle -ErrorAction Stop;$head=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install
+        Assert-CcodEqual 'Ready' $head.phase 'post-Ready writable close failure leaves the lifecycle transaction Ready'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Failed.*.json' -File).Count 'post-Ready writable close failure appends no Failed snapshot'
+        Assert-CcodEqual 0 $failedState.Writes 'no product side effect begins before the writable generation closes'
+        $retry=New-CcodLifecycleFake -NodePath $node;$retryState=@{FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{}};Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $retry -ProductState $retryState
+        $result=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('8'*64) -Adapters $retry.Adapters
+        Assert-CcodEqual 'AlreadyInstalled' $result.Outcome 'same-package retry reconciles after post-Ready writable close failure'
+        Assert-CcodTrue $retryState.ProductOnlyObserved 'retry uses strict product authority after cleanup succeeds'
+        Assert-CcodEqual 2 $retryState.ShortcutWrites 'retry completes both lower shortcut side effects'
+    }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}}
+}
+
 Write-Output "Install lifecycle self-tests passed: $($results.Count)"

From 03b611bbc6436dd41ef8db4b587ef26f2926dd91 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 01:57:04 +0800
Subject: [PATCH 108/187] docs: record canonical product authority evidence

---
 .../task-4-report.md                          | 92 +++++++++++++++++++
 1 file changed, 92 insertions(+)

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
index 5692cce..0ec79af 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
@@ -395,3 +395,95 @@ signing, tag, push, or publication action occurred.
 
 - `3cd891221acfd569fd29e2244b5200fa28e43106`
   (`fix: prove durable Ready product authority`).
+
+## Fix round 5: canonical lifecycle authority, proof-to-use lease, and first-install handoff
+
+Independent review of `a83840b..a60759b` found three Important production
+gaps: product authority maintained a weaker parallel transaction-chain reader;
+selector proof and retained-file use were not serialized against an N+1
+commit; and normal first install passed its still-writable generation
+transaction to the default product-registration path.
+
+This was the fifth and final permitted Task 4 repair round. The implementation
+below is submitted for a new independent review; Task 4 is not claimed complete.
+
+### RED evidence
+
+- InstallFileTransaction exited `1` because a selected terminal Ready chain
+  plus an unrelated strict Prepared head was accepted instead of throwing
+  `CCOD_INSTALL_PRODUCT_SCOPE`. The companion Ready-to-Failed continuation
+  regression was added to the same canonical-head boundary.
+- The real two-process coordination regression reached
+  `Enter-CcodLifecycleOwnership` and `Set-CcodActiveRuntime` for N+1 while an N
+  product transaction was active. Before the lease fix, N+1 committed and the
+  subsequent N retained-file use failed with `CCOD_INSTALL_PRODUCT_SCOPE`;
+  proof and use were not one stable authority operation.
+- Clearing only the product transaction's stored authority-lease state while
+  retaining the real mutex still allowed a retained-file open; the test exited
+  `1` with `ASSERT_THROWS: expected CCOD_INSTALL_PRODUCT_SCOPE`.
+- The safe default first-install integration initially failed adapter
+  resolution because no lower product-side-effect seam existed. Once only the
+  registry/shortcut side effects were isolated, the old path failed with
+  `CCOD_PRODUCT_REGISTRATION_FAILED`; a targeted diagnostic recorded
+  `CCOD_INSTALL_RETAINED_GENERATION_INVALID` and a sharing violation because
+  the writable generation transaction was still pinned after Ready.
+- The new post-Ready close-failure case first exited `1` with
+  `CCOD_INSTALL_ADAPTER_INVALID`, target `CloseReadyGeneration`, before the
+  narrow close handoff existed.
+
+### GREEN and final verification evidence
+
+- InstallFileTransaction: all 32 named cases passed, exit `0`. Coverage includes
+  the unrelated Prepared head, Ready-to-Failed continuation, missing live
+  authority lease, and a real N/N+1 coordination process pair.
+- ProductRegistration: `13/13`, exit `0`.
+- UninstallBootstrap: `23/23`, exit `0`.
+- InstallLifecycle: `119/119`, exit `0`. The real default registration path
+  opens both retained shortcut candidates through product-only authority;
+  normal first install succeeds, product-write failure remains durable Ready
+  and retries through AlreadyInstalled, and post-Ready writable-close failure
+  performs zero product writes, appends no Failed snapshot, and retries.
+- Explicit PowerShell parser checks passed all four changed source/test files:
+  `PARSER_COUNT=4`, `PARSER_FAILURES=0`.
+- Static gates passed: `WEAK_SUBSTITUTE_COUNT=0`,
+  `AUTHORITY_PATH_READ_COUNT=0`, `CANONICAL_RESOLVER_CALL_COUNT=1`,
+  `WRITABLE_REGISTRATION_SOURCE_COUNT=0`, `STRICT_PRODUCT_OPEN_COUNT=1`, and
+  `READY_CLOSE_ADAPTER_CALL_COUNT=2`.
+- `git diff --check` exited `0`; only checkout LF-to-CRLF warnings were emitted.
+- Full `tests\PersistenceSelfTest.ps1` aggregate exited `0` with no failure
+  output. Its long-running child at the observed midpoint was the existing
+  TrayHost production-trace suite, not the new authority/lifecycle tests.
+
+### Remediated boundaries
+
+- InstallLifecycle owns the one canonical pure
+  `Resolve-CcodInstallTransactionRecordHead` implementation. Its normal reader
+  and InstallFileTransaction's native-handle authority reader both call that
+  implementation; product authority no longer carries a reduced parallel
+  chain checker. The native-handle selector, manifest, and transaction-file
+  reads remain intact, and the canonical record validator now also requires
+  `ownedObjectNames` to be an array.
+- Product transaction open acquires the same current-user global
+  `AccountTransition` mutex used by lifecycle ownership before reading the
+  selector. The opaque transaction retains that lease through canonical
+  selector/manifest/transaction proof and retained-file opens. Close attempts
+  both native cleanup and lease release on failure paths; retained-file open
+  explicitly requires the live product-only lease on its owning thread.
+- The deterministic N/N+1 test uses the real lifecycle-ownership and active
+  pointer commit paths. N+1 blocks while N opens its retained shortcut, commits
+  generation 2 only after N closes, and the closed stale N capability cannot
+  be reused.
+- Normal and recovered Ready paths close their writable generation/state
+  transaction before product registration. The default RegisterProduct adapter
+  always opens and owns a separate strict selected product transaction; the
+  writable input is never used as shortcut authority. A close or registration
+  failure is post-Ready, performs no lifecycle rollback, and is reconciled by
+  a later same-package invocation.
+
+No real registry, shortcut, installer, uninstaller, product process, network,
+release, signing, tag, push, or publication action occurred.
+
+### Fix implementation commit
+
+- `a9900a4b00508f9ed694375ea94a2bfb97437e96`
+  (`fix: serialize strict product authority`).

From 2e86de17a7c454cc56edd123b6c6487c5194f32d Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 09:54:05 +0800
Subject: [PATCH 109/187] fix: retain failed product transaction cleanup

---
 src/persistence/modules/InstallLifecycle.psm1 | 58 ++++++++++++++++---
 .../InstallFileTransaction.SelfTest.ps1       | 37 ++++++++----
 .../persistence/InstallLifecycle.SelfTest.ps1 | 34 +++++++++++
 3 files changed, 109 insertions(+), 20 deletions(-)

diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index 3a2f283..eae6f93 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -18,6 +18,7 @@ $script:CcodActivationPhases = @('StoppingPreviousRuntime','InstallingRuntime','
 $script:CcodInstallTransactionPhases = @('Prepared','PackageVerified','RuntimeStaged','PreviousProtectionStopped','RuntimePromoted','PointerCommitted','StableShellCommitted','ProtectionReady','Ready')
 $script:CcodInstallTransactionFields = @('schemaVersion','transactionId','oldRuntimeId','oldGeneration','oldManifestSha256','newRuntimeId','newGeneration','newManifestSha256','sealedPackageSha256','ownedObjectNames','phase','errorCode')
 $script:CcodInstallTransactionRoots = [Runtime.CompilerServices.ConditionalWeakTable[object,object]]::new()
+$script:CcodPendingProductTransactionCleanups = [Collections.Hashtable]::Synchronized(@{})
 
 function Throw-CcodLifecycleError {
     param(
@@ -39,6 +40,26 @@ function Get-CcodLifecycleErrorId {
     return ([string]$ErrorRecord.FullyQualifiedErrorId -split ',')[0]
 }
 
+function Get-CcodLifecycleProductCleanupKey {
+    param([Parameter(Mandatory)][string]$InstallRoot)
+    return Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
+}
+
+function Invoke-CcodLifecycleProductTransactionClose {
+    param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][scriptblock]$CloseProductTransaction,[Parameter(Mandatory)][scriptblock]$DefaultClose)
+    & $CloseProductTransaction $Transaction $defaultClose
+}
+
+function Resolve-CcodLifecyclePendingProductTransactionCleanup {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][scriptblock]$CloseProductTransaction)
+    $key=Get-CcodLifecycleProductCleanupKey -InstallRoot $InstallRoot
+    if(-not$script:CcodPendingProductTransactionCleanups.ContainsKey($key)){return}
+    $pending=$script:CcodPendingProductTransactionCleanups[$key]
+    if($pending.OwnerManagedThreadId-ne[Threading.Thread]::CurrentThread.ManagedThreadId){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Pending product transaction cleanup belongs to a different thread' $InstallRoot}
+    try{Invoke-CcodLifecycleProductTransactionClose -Transaction $pending.Transaction -CloseProductTransaction $CloseProductTransaction -DefaultClose $pending.DefaultClose}catch{Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Pending product transaction cleanup remains retryable' $InstallRoot}
+    [void]$script:CcodPendingProductTransactionCleanups.Remove($key)
+}
+
 function Test-CcodActivationExactProperties {
     param($Value)
     if ($null -eq $Value -or $Value -isnot [pscustomobject]) { return $false }
@@ -457,7 +478,7 @@ function Complete-CcodReadyFinalizationRecovery {
         $observed=Read-CcodInstallTransactionRecord -InstallRoot $InstallRoot -TransactionId $TransactionRecord.transactionId
         if($null-eq$observed-or$observed.phase-cne'Ready'){Throw-CcodLifecycleError 'CCOD_INSTALL_READY_FINALIZATION_PENDING' 'Ready finalization snapshot is not visible' $TransactionRecord.transactionId}
         if([string]$proof.Validation.Manifest.projectVersion-ceq$script:CcodProductVersion){
-            try{&$Adapters.CloseReadyGeneration $fileTransaction;$fileTransaction=$null;$productAdapters=&$Adapters.GetProductRegistrationAdapters;$registration=&$Adapters.RegisterProduct $InstallRoot ([string]$observed.newRuntimeId) ([string]$proof.Validation.Manifest.projectVersion) ([string]$observed.sealedPackageSha256) $null $observed $productAdapters;if($null-eq$registration-or$registration.verified-isnot[bool]-or-not$registration.verified){throw 'registration receipt invalid'};$productRegistrationVerified=$true}catch{$productRegistrationFailure=$_}
+            try{&$Adapters.CloseReadyGeneration $fileTransaction;$fileTransaction=$null;$productAdapters=&$Adapters.GetProductRegistrationAdapters;$registration=&$Adapters.RegisterProduct $InstallRoot ([string]$observed.newRuntimeId) ([string]$proof.Validation.Manifest.projectVersion) ([string]$observed.sealedPackageSha256) $null $observed $productAdapters $Adapters.CloseProductTransaction;if($null-eq$registration-or$registration.verified-isnot[bool]-or-not$registration.verified){throw 'registration receipt invalid'};$productRegistrationVerified=$true}catch{$productRegistrationFailure=$_}
         }
     }catch{
         try{$observed=Read-CcodInstallTransactionRecord -InstallRoot $InstallRoot -TransactionId $TransactionRecord.transactionId}catch{}
@@ -1955,6 +1976,10 @@ function Get-CcodLifecycleAdapters {
             param($FileTransaction)
             Close-CcodInstallFileTransaction -Transaction $FileTransaction -Disposition Ready
         }
+        CloseProductTransaction = {
+            param($FileTransaction,$DefaultClose)
+            & $DefaultClose $FileTransaction
+        }
         AddProductShortcutCandidates = {
             param($Files)
             $temporaryRoot=Join-Path ([IO.Path]::GetTempPath()) ('ccod-product-shortcuts-'+[guid]::NewGuid().ToString('N'))
@@ -1964,18 +1989,35 @@ function Get-CcodLifecycleAdapters {
         }
         GetProductRegistrationAdapters = { $null }
         RegisterProduct = {
-            param($InstallRoot,$RuntimeId,$Version,$PackageSha256,$FileTransaction,$TransactionRecord,$ProductAdapters)
+            param($InstallRoot,$RuntimeId,$Version,$PackageSha256,$FileTransaction,$TransactionRecord,$ProductAdapters,$CloseProductTransaction)
+            if($CloseProductTransaction-isnot[scriptblock]){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product transaction close adapter is invalid' $InstallRoot}
+            Resolve-CcodLifecyclePendingProductTransactionCleanup -InstallRoot $InstallRoot -CloseProductTransaction $CloseProductTransaction
             $module=Import-Module (Join-Path $PSScriptRoot 'ProductRegistration.psm1') -Force -PassThru -ErrorAction Stop
-            $ownedTransaction=$null;$sourceCapability=$null
+            $fileModule=$null;$ownedTransaction=$null;$sourceCapability=$null;$receiptResult=$null;$firstCloseFailure=$null;$defaultClose=$null
             try{
-                Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop;$ownedTransaction=Open-CcodInstallProductRegistrationTransaction -InstallRoot $InstallRoot -ReadyTransaction $TransactionRecord;$sourceCapability=Open-CcodInstallRetainedGeneration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -ExpectedManifestSha256 ([string]$TransactionRecord.newManifestSha256) -FileTransaction $ownedTransaction
+                $fileModule=Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -PassThru -ErrorAction Stop
+                $defaultClose={param($Value)&$fileModule {param($Transaction)Close-CcodInstallFileTransaction -Transaction $Transaction -Disposition Ready} $Value}.GetNewClosure()
+                $ownedTransaction=&$fileModule {param($Root,$Record)Open-CcodInstallProductRegistrationTransaction -InstallRoot $Root -ReadyTransaction $Record} $InstallRoot $TransactionRecord
+                $sourceCapability=&$fileModule {param($Root,$Id,$Manifest,$Transaction)Open-CcodInstallRetainedGeneration -InstallRoot $Root -RuntimeId $Id -ExpectedManifestSha256 $Manifest -FileTransaction $Transaction} $InstallRoot $RuntimeId ([string]$TransactionRecord.newManifestSha256) $ownedTransaction
                 $registration=New-CcodProductRegistration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -Version $Version -PackageSha256 $PackageSha256 -FileTransaction $sourceCapability
                 $system=[Environment]::GetFolderPath([Environment+SpecialFolder]::System);$proof=[pscustomobject][ordered]@{phase=[string]$TransactionRecord.phase;runtimeId=$RuntimeId;version=$Version;packageSha256=$PackageSha256;runtimeGeneration=[uint64]$TransactionRecord.newGeneration;manifestSha256=[string]$TransactionRecord.newManifestSha256;startMenuSha256=(Get-CcodLifecycleFileSha256 $registration.startMenuShortcut.candidatePath);desktopSha256=(Get-CcodLifecycleFileSha256 $registration.desktopShortcut.candidatePath);targetPath=[IO.Path]::GetFullPath((Join-Path $system 'schtasks.exe'));arguments='/Run /TN "Codex Control Other Devices Supervisor"';transactionRecord=$TransactionRecord;bootstrapPath=$registration.bootstrapPath;uninstallerPath=$registration.uninstallerPath}
                 $commitAdapters=@{};if($null-ne$ProductAdapters){if($ProductAdapters-isnot[hashtable]){throw 'product side-effect adapters invalid'};foreach($key in $ProductAdapters.Keys){$commitAdapters[$key]=$ProductAdapters[$key]}};$commitAdapters.GetReadyProof={param($Ignored)$proof}.GetNewClosure()
                 $receipt=Commit-CcodProductRegistration -Registration $registration -FileTransaction $sourceCapability -Adapters $commitAdapters
                 Remove-CcodLegacyProductRegistration -ExpectedAppId '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}' -Adapters $ProductAdapters
-                [pscustomobject]@{verified=[bool]$receipt.verified;legacyRemoved=$true}
-            }finally{if($null-ne$ownedTransaction){try{Close-CcodInstallFileTransaction -Transaction $ownedTransaction -Disposition Ready}catch{}}}
+                $receiptResult=[pscustomobject]@{verified=[bool]$receipt.verified;legacyRemoved=$true}
+            }finally{
+                if($null-ne$ownedTransaction){
+                    try{Invoke-CcodLifecycleProductTransactionClose -Transaction $ownedTransaction -CloseProductTransaction $CloseProductTransaction -DefaultClose $defaultClose}catch{
+                        $firstCloseFailure=$_
+                        try{Invoke-CcodLifecycleProductTransactionClose -Transaction $ownedTransaction -CloseProductTransaction $CloseProductTransaction -DefaultClose $defaultClose}catch{
+                            $key=Get-CcodLifecycleProductCleanupKey -InstallRoot $InstallRoot
+                            $script:CcodPendingProductTransactionCleanups[$key]=[pscustomobject]@{Transaction=$ownedTransaction;DefaultClose=$defaultClose;OwnerManagedThreadId=[Threading.Thread]::CurrentThread.ManagedThreadId}
+                        }
+                    }
+                }
+            }
+            if($null-ne$firstCloseFailure){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product transaction cleanup failed after registration and requires reconciliation' $InstallRoot}
+            return $receiptResult
         }
         NewRuntimeManifest = {
             param($RuntimeDirectory, $ProjectVersion)
@@ -2390,7 +2432,7 @@ function Invoke-CcodInstall {
         if($activeValidation.Valid){
             $sameIdentity=Test-CcodInstallPackageIdentity -TransactionRecord $globalTransaction -ProjectVersion ([string]$projectVersion) -ActiveProjectVersion ([string]$activeValidation.Manifest.projectVersion) -SealedPackageSha256 $SealedPackageSha256 -ActiveRuntimeId ([string]$existingPointer.activeRuntime) -ActiveGeneration ([uint64]$existingPointer.generation)
             if($sameIdentity){
-                $productAdapters=&$adapters.GetProductRegistrationAdapters;$registration=&$adapters.RegisterProduct $root ([string]$existingPointer.activeRuntime) ([string]$projectVersion) $SealedPackageSha256 $null $globalTransaction $productAdapters
+                $productAdapters=&$adapters.GetProductRegistrationAdapters;$registration=&$adapters.RegisterProduct $root ([string]$existingPointer.activeRuntime) ([string]$projectVersion) $SealedPackageSha256 $null $globalTransaction $productAdapters $adapters.CloseProductTransaction
                 if($null-eq$registration-or$registration.verified-isnot[bool]-or-not$registration.verified){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'AlreadyInstalled product registration reconciliation did not verify' $existingPointer.activeRuntime}
                 return [pscustomobject][ordered]@{Outcome='AlreadyInstalled';Installed=$true;RuntimeId=[string]$existingPointer.activeRuntime;PreviousRuntimeId=$existingPointer.previousRuntime;RepairCompleted=$false;ProductRegistrationVerified=$true}
             }
@@ -2522,7 +2564,7 @@ function Invoke-CcodInstall {
         if([string]$projectVersion-ceq$script:CcodProductVersion){
             try{
                 &$adapters.CloseReadyGeneration $fileTransaction;$fileTransaction=$null
-                $productAdapters=&$adapters.GetProductRegistrationAdapters;$registrationReceipt=&$adapters.RegisterProduct $root $runtimeId ([string]$projectVersion) $SealedPackageSha256 $fileTransaction $installRecord $productAdapters
+                $productAdapters=&$adapters.GetProductRegistrationAdapters;$registrationReceipt=&$adapters.RegisterProduct $root $runtimeId ([string]$projectVersion) $SealedPackageSha256 $fileTransaction $installRecord $productAdapters $adapters.CloseProductTransaction
                 if($null-eq$registrationReceipt-or$registrationReceipt.verified-isnot[bool]-or-not$registrationReceipt.verified){throw 'registration receipt invalid'}
                 $productRegistrationVerified=$true
             }catch{$productRegistrationFailure=$_}
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index 8e78a3b..809bfcb 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -226,46 +226,59 @@ Invoke-CcodTest 'product authority rejects the canonical Ready to Failed post-te
 
 # Production mutation caught: selector proof without the committing install's AccountTransition lease permits N+1 to commit across N proof/use.
 Invoke-CcodTest 'product authority holds the real commit coordination lease across proof and retained-file use' {
-    $authority=New-CcodProductAuthorityFixture;$fixture=$authority.Fixture;$product=$null;$commitProcess=$null
-    $readyMarker=Join-Path $fixture.Base 'commit-ready.marker';$resultPath=Join-Path $fixture.Base 'commit-result.json';$stdout=Join-Path $fixture.Base 'commit.stdout.txt';$stderr=Join-Path $fixture.Base 'commit.stderr.txt';$childScript=Join-Path $fixture.Base 'commit-next-generation.ps1'
+    $authority=New-CcodProductAuthorityFixture;$fixture=$authority.Fixture;$product=$null;$commitProcess=$null;$attemptEvent=$null
+    $attemptEventName='Local\CcodInstallProductAuthorityAttempt.'+[guid]::NewGuid().ToString('N');$eventCreated=$false;$attemptEvent=[Threading.EventWaitHandle]::new($false,[Threading.EventResetMode]::ManualReset,$attemptEventName,[ref]$eventCreated)
+    Assert-CcodTrue $eventCreated 'atomic attempt event is create-only for this test'
+    $resultPath=Join-Path $fixture.Base 'commit-result.json';$stdout=Join-Path $fixture.Base 'commit.stdout.txt';$stderr=Join-Path $fixture.Base 'commit.stderr.txt';$childScript=Join-Path $fixture.Base 'commit-next-generation.ps1'
     $moduleRoot=Join-Path $projectRoot 'src\persistence\modules';$nextRuntime='runtime-product-canonical-authority-next'
     $child=@'
-param([string]$ModuleRoot,[string]$InstallRoot,[string]$CurrentRuntime,[string]$NextRuntime,[string]$ReadyMarker,[string]$ResultPath)
-$ErrorActionPreference='Stop';$transaction=$null;$ownership=$null;$identity=$null;$process=$null
+param([string]$ModuleRoot,[string]$InstallRoot,[string]$CurrentRuntime,[string]$NextRuntime,[string]$AttemptEventName,[string]$ResultPath)
+$ErrorActionPreference='Stop';$transaction=$null;$ownership=$null;$identity=$null;$process=$null;$attemptEvent=$null
 try{
     $fileModule=Import-Module (Join-Path $ModuleRoot 'InstallFileTransaction.psm1') -Force -PassThru -ErrorAction Stop
     $runtimeModule=Import-Module (Join-Path $ModuleRoot 'RuntimeManifest.psm1') -Force -PassThru -ErrorAction Stop
     $epochModule=Import-Module (Join-Path $ModuleRoot 'LifecycleEpoch.psm1') -Force -PassThru -ErrorAction Stop
+    $kernelModule=Import-Module (Join-Path $ModuleRoot 'KernelObjects.psm1') -Force -PassThru -ErrorAction Stop
     $transaction=&$fileModule {param($Root,$Id)Open-CcodInstallGeneration -InstallRoot $Root -RuntimeId $Id} $InstallRoot $NextRuntime
     &$fileModule {param($Generation,$Id)Write-CcodInstallGenerationManifest -Generation $Generation -Manifest ([ordered]@{schemaVersion=1;projectVersion='2.5.22';runtimeId=$Id;commit='0123456789abcdef0123456789abcdef01234567';files=@()})|Out-Null} $transaction $NextRuntime
-    [IO.File]::WriteAllText($ReadyMarker,'ready',[Text.UTF8Encoding]::new($false))
+    $attemptEvent=[Threading.EventWaitHandle]::OpenExisting($AttemptEventName)
+    $enterRealMutex={
+        param($UserSid,$SessionId,$TimeoutMilliseconds)
+        try{
+            &$kernelModule {
+                param($Sid,$Timeout,$EnteredEvent)
+                $wait={param($MutexHandle,$WaitTimeout)try{[Threading.WaitHandle]::SignalAndWait($EnteredEvent,$MutexHandle,$WaitTimeout,$false)}catch{[Console]::Error.WriteLine('SIGNAL_AND_WAIT_FAILURE: '+($_|Out-String));throw}}.GetNewClosure()
+                Enter-CcodMutex -Kind AccountTransition -UserSid $Sid -TimeoutMilliseconds $Timeout -Adapters @{WaitMutex=$wait}
+            } $UserSid $TimeoutMilliseconds $attemptEvent
+        }catch{[Console]::Error.WriteLine('ATOMIC_WAIT_FAILURE: '+($_|Out-String));throw}
+    }.GetNewClosure()
     $process=[Diagnostics.Process]::GetCurrentProcess();$owner=[pscustomobject][ordered]@{pid=[int]$process.Id;creationTimeUtc=$process.StartTime.ToUniversalTime().ToString('o')}
     $identity=[Security.Principal.WindowsIdentity]::GetCurrent();$sid=$identity.User.Value
-    $ownership=&$epochModule {param($Root,$Runtime,$Owner,$Sid,$Session)Enter-CcodLifecycleOwnership -InstallRoot $Root -RuntimeId $Runtime -RuntimeGeneration 1 -OwnerIdentity $Owner -UserSid $Sid -SessionId $Session -TimeoutMilliseconds 15000} $InstallRoot $CurrentRuntime $owner $sid $process.SessionId
+    $ownership=&$epochModule {param($Root,$Runtime,$Owner,$Sid,$Session,$EnterMutex)Enter-CcodLifecycleOwnership -InstallRoot $Root -RuntimeId $Runtime -RuntimeGeneration 1 -OwnerIdentity $Owner -UserSid $Sid -SessionId $Session -TimeoutMilliseconds 15000 -Adapters @{EnterMutex=$EnterMutex}} $InstallRoot $CurrentRuntime $owner $sid $process.SessionId $enterRealMutex
     $pointer=&$runtimeModule {param($Root,$Runtime,$Generation,$Transaction,$Owner)Set-CcodActiveRuntime -InstallRoot $Root -NewRuntimeId $Runtime -TargetGeneration $Generation -FileTransaction $Transaction -Ownership $Owner} $InstallRoot $NextRuntime $transaction $transaction $ownership
     [IO.File]::WriteAllText($ResultPath,($pointer|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
     exit 0
 }catch{$message=$_|Out-String;[Console]::Error.WriteLine($message);exit 3}
-finally{if($null-ne$ownership){try{&$epochModule {param($Owner)Exit-CcodLifecycleOwnership -Ownership $Owner|Out-Null} $ownership}catch{}};if($null-ne$transaction){try{&$fileModule {param($Transaction)Close-CcodInstallFileTransaction -Transaction $Transaction -Disposition Ready} $transaction}catch{}};if($null-ne$identity){$identity.Dispose()};if($null-ne$process){$process.Dispose()}}
+finally{if($null-ne$ownership){try{&$epochModule {param($Owner)Exit-CcodLifecycleOwnership -Ownership $Owner|Out-Null} $ownership}catch{}};if($null-ne$transaction){try{&$fileModule {param($Transaction)Close-CcodInstallFileTransaction -Transaction $Transaction -Disposition Ready} $transaction}catch{}};if($null-ne$attemptEvent){$attemptEvent.Dispose()};if($null-ne$identity){$identity.Dispose()};if($null-ne$process){$process.Dispose()}}
 '@
     [IO.File]::WriteAllText($childScript,$child,[Text.UTF8Encoding]::new($false))
     try{
         $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $authority.Ready;$fixture.Transactions.Add($product)
         $retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $authority.RuntimeId -ExpectedManifestSha256 $authority.Manifest.Sha256 -FileTransaction $product
         $powershell=(Get-Process -Id $PID).Path
-        $commitProcess=Start-Process -FilePath $powershell -ArgumentList @('-NoProfile','-ExecutionPolicy','Bypass','-File',$childScript,'-ModuleRoot',$moduleRoot,'-InstallRoot',$fixture.Install,'-CurrentRuntime',$authority.RuntimeId,'-NextRuntime',$nextRuntime,'-ReadyMarker',$readyMarker,'-ResultPath',$resultPath) -WindowStyle Hidden -RedirectStandardOutput $stdout -RedirectStandardError $stderr -PassThru
-        $deadline=[DateTime]::UtcNow.AddSeconds(20);while(-not[IO.File]::Exists($readyMarker)-and[DateTime]::UtcNow-lt$deadline){$commitProcess.Refresh();if($commitProcess.HasExited){break};Start-Sleep -Milliseconds 25}
-        if(-not[IO.File]::Exists($readyMarker)){if(-not$commitProcess.HasExited){Stop-Process -Id $commitProcess.Id -Force};$commitProcess.WaitForExit();throw "real N+1 commit child did not reach lifecycle ownership: $($(if([IO.File]::Exists($stderr)){[IO.File]::ReadAllText($stderr)}else{'no stderr'}))"}
-        $commitBlocked=$true;$watch=[Diagnostics.Stopwatch]::StartNew();while($watch.ElapsedMilliseconds-lt1200){if([IO.File]::Exists($resultPath)-or$commitProcess.HasExited){$commitBlocked=$false;break};Start-Sleep -Milliseconds 20};$watch.Stop()
+        $commitProcess=Start-Process -FilePath $powershell -ArgumentList @('-Mta','-NoProfile','-ExecutionPolicy','Bypass','-File',$childScript,'-ModuleRoot',$moduleRoot,'-InstallRoot',$fixture.Install,'-CurrentRuntime',$authority.RuntimeId,'-NextRuntime',$nextRuntime,'-AttemptEventName',$attemptEventName,'-ResultPath',$resultPath) -WindowStyle Hidden -RedirectStandardOutput $stdout -RedirectStandardError $stderr -PassThru
+        if(-not$attemptEvent.WaitOne(20000)){if(-not$commitProcess.HasExited){Stop-Process -Id $commitProcess.Id -Force};$commitProcess.WaitForExit();throw "real N+1 commit child did not atomically enter the AccountTransition wait: $($(if([IO.File]::Exists($stderr)){[IO.File]::ReadAllText($stderr)}else{'no stderr'}))"}
+        $commitBlocked=$true;$watch=[Diagnostics.Stopwatch]::StartNew();while($watch.ElapsedMilliseconds-lt5000){if([IO.File]::Exists($resultPath)-or$commitProcess.HasExited){$commitBlocked=$false;break};Start-Sleep -Milliseconds 20};$watch.Stop()
+        Assert-CcodTrue $commitBlocked 'N+1 commit is blocked after its atomic real AccountTransition wait signal'
         if($commitBlocked){$opened=Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyTransaction $authority.Ready;Assert-CcodTrue ($null-ne$opened) 'N retained shortcut opens while its authority lease excludes N+1'}
         Close-CcodInstallFileTransaction -Transaction $product -Disposition Ready
         if(-not$commitProcess.WaitForExit(20000)){Stop-Process -Id $commitProcess.Id -Force;throw 'real N+1 commit child timed out'}
         $commitProcess.Refresh();if(-not[IO.File]::Exists($resultPath)){throw "real N+1 commit child produced no committed pointer exit=$($commitProcess.ExitCode) stdout=$([IO.File]::ReadAllText($stdout)) stderr=$([IO.File]::ReadAllText($stderr))"}
         $pointer=[IO.File]::ReadAllText($resultPath)|ConvertFrom-Json;Assert-CcodEqual 2 ([uint64]$pointer.generation) 'real commit advances to N+1 only after N authority closes'
         Assert-CcodThrows {Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyTransaction $authority.Ready|Out-Null} 'CCOD_INSTALL_TRANSACTION_CLOSED'
-        Assert-CcodTrue $commitBlocked 'N+1 commit is blocked for the complete N proof-to-use boundary'
     }finally{
         if($null-ne$commitProcess-and-not$commitProcess.HasExited){try{Stop-Process -Id $commitProcess.Id -Force}catch{}};if($null-ne$commitProcess){$commitProcess.Dispose()}
+        if($null-ne$attemptEvent){$attemptEvent.Dispose()}
         Remove-CcodInstallFileFixture $fixture
     }
 }
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index 5ad27de..bc93b98 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -354,6 +354,18 @@ function Set-CcodLifecycleDefaultProductRegistrationFixture {
     }
 }
 
+function Set-CcodLifecycleProductCloseFailureFixture {
+    param([Parameter(Mandatory)]$Fake,[Parameter(Mandatory)][hashtable]$State)
+    $State.CloseAttempts=0
+    if(-not$State.ContainsKey('CloseFailuresRemaining')){$State.CloseFailuresRemaining=1}
+    $Fake.Adapters.CloseProductTransaction={
+        param($Transaction,$DefaultClose)
+        $State.CloseAttempts++
+        if($State.CloseAttempts-le[int]$State.CloseFailuresRemaining){throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new('fixture owned product close failed'),'CCOD_INSTALL_CLOSE_FAILED',[Management.Automation.ErrorCategory]::CloseError,$Transaction)}
+        &$DefaultClose $Transaction
+    }.GetNewClosure()
+}
+
 function New-CcodReadyFinalizationGapFixture {
     $source=New-CcodLifecycleTempRoot
     $install=New-CcodLifecycleTempRoot
@@ -3339,4 +3351,26 @@ $results += Invoke-CcodTest 'post-Ready writable close failure preserves Ready a
     }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}}
 }
 
+# Production mutation caught: a strict owned product transaction close failure must not be discarded after a verified registration body.
+$results += Invoke-CcodTest 'default product close failure is retryable and never returns a successful post-Ready receipt' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    try{
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null;$node=New-CcodLifecycleFakeNode -Root $nodeRoot;$first=New-CcodLifecycleFake -NodePath $node
+        $failedState=@{FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{};CloseFailuresRemaining=2};Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $first -ProductState $failedState;Set-CcodLifecycleProductCloseFailureFixture -Fake $first -State $failedState
+        $unexpectedReceipt=$null;$failure=$null
+        try{$unexpectedReceipt=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('9'*64) -Adapters $first.Adapters}catch{$failure=$_}
+        Assert-CcodEqual $null $unexpectedReceipt 'owned product close failure emits no successful install or registration receipt'
+        Assert-CcodEqual 'CCOD_PRODUCT_REGISTRATION_FAILED' (([string]$failure.FullyQualifiedErrorId-split',')[0]) 'owned product close failure surfaces as stable product registration failure'
+        $module=Get-Module InstallLifecycle -ErrorAction Stop;$head=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install
+        Assert-CcodEqual 'Ready' $head.phase 'owned product close failure retains the durable lifecycle Ready record'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Failed.*.json' -File).Count 'owned product close failure appends no lifecycle Failed snapshot'
+        Assert-CcodEqual 2 $failedState.CloseAttempts 'real default registration performs one bounded same-thread close retry before deferring cleanup'
+        $retry=New-CcodLifecycleFake -NodePath $node;$retryState=@{FailWrites=$false;Registration=$failedState.Registration;ReadyEvidence=$failedState.ReadyEvidence;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=$failedState.Shortcuts};Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $retry -ProductState $retryState
+        $result=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('9'*64) -Adapters $retry.Adapters
+        Assert-CcodEqual 'AlreadyInstalled' $result.Outcome 'later exact same-package invocation retries after owned product cleanup recovers'
+        Assert-CcodTrue $result.ProductRegistrationVerified 'later reconciliation reports success only after its owned transaction closes'
+        Assert-CcodTrue $retryState.ProductOnlyObserved 'cleanup recovery retry reacquires real strict product authority'
+    }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}}
+}
+
 Write-Output "Install lifecycle self-tests passed: $($results.Count)"

From 320b954a466c751b43cfeb54e5757d0c52e9ffc8 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 09:55:01 +0800
Subject: [PATCH 110/187] docs: record product cleanup repair evidence

---
 .../task-4-report.md                          | 63 +++++++++++++++++++
 1 file changed, 63 insertions(+)

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
index 0ec79af..a9145e5 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-4-report.md
@@ -487,3 +487,66 @@ release, signing, tag, push, or publication action occurred.
 
 - `a9900a4b00508f9ed694375ea94a2bfb97437e96`
   (`fix: serialize strict product authority`).
+
+## Fix round 6: durable product-close outcome and atomic lock-wait proof
+
+This architecture-level repair addresses the two remaining product-close and
+concurrency-proof gaps. It does not claim Task 4 complete. No real registry,
+shortcut, installer, uninstaller, product, network, release, signing, tag,
+push, or publication action was performed.
+
+### RED evidence
+
+- The default-registration close regression initially failed with
+  `CCOD_INSTALL_ADAPTER_INVALID`: there was no narrow
+  `CloseProductTransaction` seam at the owned strict-product-transaction
+  boundary. The prior default `RegisterProduct` `finally` also discarded an
+  owned transaction close exception and could return a verified receipt.
+- The previous N/N+1 test announced a marker before it had reached the real
+  `AccountTransition` wait, so it could not prove that the child was actually
+  blocked on the same mutex.
+
+### GREEN evidence
+
+- `tests\persistence\InstallFileTransaction.SelfTest.ps1`: exit `0`; all 32
+  named cases passed. The N/N+1 case runs the child with `-Mta`, atomically
+  signals its real mutex attempt through `SignalAndWait`, proves N can open its
+  retained shortcut while the child waits, then proves N+1 commits only after
+  N closes and stale N is unusable.
+- `tests\persistence\InstallLifecycle.SelfTest.ps1`: exit `0`; `120/120`.
+  The new default-path integration forces both the initial owned close and its
+  bounded same-thread retry to fail, observes no successful receipt and a
+  durable `Ready` record with no `Failed` snapshot, then proves an exact
+  same-package reconciliation drains the pending cleanup before opening fresh
+  strict product authority and returns verified success.
+- `tests\persistence\ProductRegistration.SelfTest.ps1`: exit `0`;
+  `13/13`.
+- `tests\persistence\UninstallBootstrap.SelfTest.ps1`: exit `0`; `23/23`.
+- Explicit PowerShell parser checks on the three changed PowerShell files
+  passed with `PARSER_FAILURES=0`. `git diff --check` exited `0`; only
+  checkout LF-to-CRLF warnings were emitted.
+- A fresh full `tests\PersistenceSelfTest.ps1` aggregate remains pending at
+  this evidence point. No aggregate-pass or Task 4 completion claim is made.
+
+### Remediated boundaries
+
+- `CloseProductTransaction` is a narrow lifecycle adapter. The default
+  delegates to the normal `Ready` file-transaction close. A first close
+  failure always makes the current registration call fail as
+  `CCOD_PRODUCT_REGISTRATION_FAILED`, even if its one bounded same-thread
+  cleanup retry succeeds; no verified receipt is returned from that call.
+- If both close attempts fail, the exact opaque transaction and its bound
+  same-module close delegate remain in a synchronized, process-local pending
+  table keyed by the canonical install root and owner managed-thread ID. The
+  next registration on that same thread drains it before opening fresh product
+  authority. A different thread or another cleanup failure fails closed; no
+  lease or capability is transferred across threads or processes.
+- The normal install, Ready-finalization recovery, and exact
+  `AlreadyInstalled` reconciliation all pass the same close adapter to the
+  default registration path. The writable generation/state handoff remains
+  closed before product registration begins.
+
+### Fix implementation commit
+
+- `2e86de17a7c454cc56edd123b6c6487c5194f32d`
+  (`fix: retain failed product transaction cleanup`).

From 25eedda46a7963e8951a44d472b902015d38697d Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 11:31:49 +0800
Subject: [PATCH 111/187] docs: plan durable product cleanup

---
 ...026-09-02-v2522-durable-product-cleanup.md | 186 ++++++++++++++++++
 1 file changed, 186 insertions(+)
 create mode 100644 docs/superpowers/plans/2026-09-02-v2522-durable-product-cleanup.md

diff --git a/docs/superpowers/plans/2026-09-02-v2522-durable-product-cleanup.md b/docs/superpowers/plans/2026-09-02-v2522-durable-product-cleanup.md
new file mode 100644
index 0000000..991346b
--- /dev/null
+++ b/docs/superpowers/plans/2026-09-02-v2522-durable-product-cleanup.md
@@ -0,0 +1,186 @@
+# Durable Product Cleanup Fence Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Make post-Ready product-transaction cleanup fail closed across processes, so no installation can report verified product registration while a prior strict product transaction remains unresolved.
+
+**Architecture:** A product registration attempt obtains the existing account transition lease, writes an exact durable cleanup fence while that lease is held, then closes its strict product transaction. Completion is recorded durably before the fence is released; close failure leaves a durable pending record that blocks other processes from reconciling or reporting success until the original owner resolves it or a proven-dead owner is safely recovered. The existing `SignalAndWait` test protocol remains test-only and proves an actual wait on the real mutex.
+
+**Tech Stack:** Windows PowerShell, .NET named mutex/event primitives, native V4 install file transaction runtime, append-only state records, existing persistence self-tests.
+
+**Spec:** `docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md`
+
+## Global Constraints
+
+- Work only in `codex/v2522-install-runtime-reliability`; do not alter `main`.
+- No real registry, shortcut, installer, uninstaller, product process, network, release, tag, signing, push, publication, installation, or reboot action.
+- All cleanup identity is exact: canonical install root, full Ready transaction identity, runtime ID/generation, manifest/package hashes, owner PID/creation time/SID, and account transition lease.
+- State records are append-only/create-only, reject duplicate/extra fields and unsafe path objects, and never overwrite a replacement.
+- A failure after lifecycle `Ready` never appends lifecycle `Failed`, never rolls back the selected generation, and never returns a verified product-registration receipt.
+- Cross-process recovery may not transfer a thread-bound mutex lease. An owner still alive blocks reconciliation; a proven-dead owner may only be reconciled under a fresh real account-transition lease and exact Ready identity proof.
+- Every production behavior change starts with an observed failing test; all claims require fresh focused suites, parser/diff checks, full aggregate, and independent review.
+
+---
+
+### Task 1: Durable cross-process product-cleanup fence
+
+**Files:**
+
+- Modify: `src/persistence/modules/InstallLifecycle.psm1`
+- Modify: `src/persistence/modules/InstallFileTransaction.psm1`
+- Test: `tests/persistence/InstallLifecycle.SelfTest.ps1`
+- Test: `tests/persistence/InstallFileTransaction.SelfTest.ps1`
+- Report: `.superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/task-1-report.md`
+
+**Interfaces:**
+
+- Consumes: exact `Ready` install transaction (ordered 12-field lifecycle record), `AccountTransition` mutex, `Close-CcodInstallFileTransaction` retry contract.
+- Produces:
+  - `New-CcodLifecycleProductCleanupFence -InstallRoot -ReadyTransaction -OwnerIdentity`
+  - `Resolve-CcodLifecycleProductCleanupFence -InstallRoot -ReadyTransaction -CurrentIdentity -CloseProductTransaction`
+  - `Complete-CcodLifecycleProductCleanupFence -Fence -Outcome Completed|Pending`
+  - a private test-only lower close seam whose default invokes the real native runtime close.
+
+- [ ] **Step 1: Write failing cross-process cleanup tests**
+
+Add a fixture that opens a real strict product transaction, injects one lower native-close failure while still executing the real lease-release path, and records a durable fence before the close call. Start a second PowerShell process that acquires the real `AccountTransition` mutex after the first close failure. Assert it sees the exact pending fence and exits `CCOD_PRODUCT_REGISTRATION_FAILED` without opening product authority, writing shortcuts, or returning `{ verified = true }`.
+
+Add a same-process retry test that forces two close failures, verifies `Ready` remains and no `Failed` snapshot appears, then makes the lower close succeed. Its exact same-package `AlreadyInstalled` invocation must drain the original capability, append a completed fence record, and only then return verified registration.
+
+```powershell
+Assert-CcodThrows {
+    Invoke-CcodInstall -InstallRoot $fixture.Install -SealedPackageSha256 $fixture.PackageHash -Adapters $firstFailureAdapters
+} 'CCOD_PRODUCT_REGISTRATION_FAILED'
+Assert-CcodEqual 'Ready' (Read-CcodInstallTransactionRecord -InstallRoot $fixture.Install).phase
+Assert-CcodEqual 0 (Get-CcodFailedInstallSnapshotCount $fixture.Install)
+Assert-CcodThrows {
+    Invoke-CcodOtherProcessReconciliation -InstallRoot $fixture.Install -PackageHash $fixture.PackageHash
+} 'CCOD_PRODUCT_REGISTRATION_FAILED'
+```
+
+- [ ] **Step 2: Run test to verify RED**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+```
+
+Expected: nonzero exit. The failure must show that the second process can currently proceed after the first product close fails, or that the durable fence API is absent. Do not accept an adapter-contract or test-harness failure as the RED.
+
+- [ ] **Step 3: Implement durable fence and close ordering**
+
+While an outer real `AccountTransition` lease is held, create a create-only durable record under the proven state plane before invoking strict product close. It contains only:
+
+```powershell
+[ordered]@{
+    schemaVersion = 1
+    transactionId = $ReadyTransaction.transactionId
+    runtimeId = $ReadyTransaction.newRuntimeId
+    runtimeGeneration = [uint64]$ReadyTransaction.newGeneration
+    manifestSha256 = $ReadyTransaction.newManifestSha256
+    packageSha256 = $ReadyTransaction.sealedPackageSha256
+    ownerPid = [int]$OwnerIdentity.pid
+    ownerCreationTimeUtc = [string]$OwnerIdentity.creationTimeUtc
+    ownerSid = [string]$OwnerIdentity.userSid
+    state = 'Pending'
+}
+```
+
+Append a second create-only `Completed` record only after exact original close succeeds. Resolve the latest valid record under the same real account lease before opening authority:
+
+- pending owner alive with matching PID/creation/SID: fail closed;
+- pending owner proven dead: verify exact Ready/selected generation, reconcile under a fresh real account-transition lease, then append `Completed`;
+- same owner/current thread: retry the retained original capability; never transfer its mutex lease.
+
+Change `Close-CcodInstallFileTransaction` so a failed native runtime close cannot create a release-before-fence window. It may release an inner reentrant lease only while the outer durable-fence lease remains held. Preserve same-thread retry and return `CCOD_INSTALL_CLOSE_FAILED` on unresolved cleanup.
+
+- [ ] **Step 4: Run focused GREEN**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1
+```
+
+Expected: all existing cases plus cross-process pending-fence cases pass. Verify first failed close returns no verified receipt, other process opens no product authority, and exact retry returns `AlreadyInstalled` only after durable completion.
+
+- [ ] **Step 5: Commit implementation and report**
+
+```powershell
+git add src/persistence/modules/InstallLifecycle.psm1 src/persistence/modules/InstallFileTransaction.psm1 tests/persistence/InstallLifecycle.SelfTest.ps1 tests/persistence/InstallFileTransaction.SelfTest.ps1
+git commit -m "fix: fence durable product cleanup"
+```
+
+Write the report with exact RED output, GREEN commands/counts, cross-process proof, no-real-action statement, implementation SHA, and compatibility impact.
+
+### Task 2: Atomic real-mutex proof and final Task 4 verification
+
+**Files:**
+
+- Modify: `tests/persistence/InstallFileTransaction.SelfTest.ps1`
+- Test: `tests/persistence/KernelObjects.SelfTest.ps1`
+- Test: `tests/PersistenceSelfTest.ps1`
+- Report: `.superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/task-2-report.md`
+
+**Interfaces:**
+
+- Consumes: `Enter-CcodLifecycleOwnership -Adapters`, real `Enter-CcodMutex -Kind AccountTransition`, Task 1 durable cleanup fence.
+- Produces: an OS-level deterministic child wait proof that does not change production mutex code.
+
+- [ ] **Step 1: Write atomic wait RED**
+
+In the MTA child, use the `EnterMutex` adapter only to call real `Enter-CcodMutex` with a `WaitMutex` adapter that performs:
+
+```powershell
+[Threading.WaitHandle]::SignalAndWait($enteredActualWaitEvent, $mutexHandle, 15000, $false)
+```
+
+The parent holds real N product authority, waits for `enteredActualWaitEvent`, proves child cannot write acquired/commit record while N is open, opens N retained shortcut, closes N, then requires child to acquire/commit N+1. Temporary removal of N outer lease must fail at blocked assertion; restore it before GREEN.
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1
+```
+
+Expected: nonzero exit on blocked-after-atomic-wait assertion with temporary lease removal. It must not fail from STA, adapter loading, marker timing, or a mocked mutex.
+
+- [ ] **Step 3: Preserve atomic protocol and mutex invariants**
+
+Keep production `KernelObjects` unchanged unless a concrete failure proves it needs alteration. Child uses `-Mta`; real mutex creation, ACL, timeout, abandoned handling, and same-thread release remain default behavior. Assert stale N fails after N+1 and closed N cannot be reused.
+
+- [ ] **Step 4: Run GREEN and full verification**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\KernelObjects.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ProductRegistration.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\UninstallBootstrap.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+git diff --check
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\PersistenceSelfTest.ps1
+```
+
+Parse every changed PowerShell file with `[System.Management.Automation.Language.Parser]::ParseFile`. All commands must exit zero after final source changes.
+
+- [ ] **Step 5: Commit evidence and request independent review**
+
+```powershell
+git add tests/persistence/InstallFileTransaction.SelfTest.ps1 tests/persistence/KernelObjects.SelfTest.ps1 .superpowers/sdd/2026-09-02-v2522-durable-product-cleanup
+git commit -m "docs: record durable cleanup fence evidence"
+```
+
+The report distinguishes temporary mutation RED from final GREEN, states full aggregate result, makes no release-readiness claim, and requests fresh independent review.
+
+## Self-Review
+
+- Spec coverage: Task 1 covers durable cross-process cleanup and no false receipt; Task 2 covers atomic actual-wait evidence and final verification.
+- Placeholder scan: no TBD/TODO markers; every test command, record schema, and failure boundary is explicit.
+- Type consistency: both tasks use the same ordered Ready transaction identity, `AccountTransition` mutex, and create-only fence records; Task 2 consumes Task 1 fence rather than a second cleanup source.
+
+## Execution Handoff
+
+The user requested continued execution. Execute this plan with subagent-driven development: one fresh implementer and independent review per task, then a final Task 4 review.
+

From 271a6e57ccfcc0568151f620c5cef0e3d43e1416 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 13:02:06 +0800
Subject: [PATCH 112/187] fix: fence durable product cleanup

---
 .../modules/InstallFileTransaction.psm1       |  44 +-
 src/persistence/modules/InstallLifecycle.psm1 | 455 ++++++++++++++++--
 .../InstallFileTransaction.SelfTest.ps1       |  39 +-
 .../persistence/InstallLifecycle.SelfTest.ps1 | 269 ++++++++++-
 4 files changed, 758 insertions(+), 49 deletions(-)

diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index 5497b0c..1f4a24d 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -2,6 +2,7 @@ Set-StrictMode -Version Latest
 
 $script:CcodTransactions = [Runtime.CompilerServices.ConditionalWeakTable[object,object]]::new()
 $script:CcodScopes = [Runtime.CompilerServices.ConditionalWeakTable[object,object]]::new()
+$script:CcodInstallFileTransactionLowerCloseForTest = $null
 
 function Throw-CcodInstallFileError {
     param([string]$Id,[string]$Message,$Target)
@@ -369,6 +370,7 @@ function Open-CcodInstallStateTransaction { param([Parameter(Mandatory)][string]
 function Open-CcodInstallRetainedGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)][string]$ExpectedManifestSha256,[Parameter(Mandatory)]$FileTransaction) if(-not[IO.Path]::IsPathRooted($InstallRoot)-or$ExpectedManifestSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_GENERATION_INVALID' 'Invalid retained generation contract' $RuntimeId};Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';if(-not[object]::ReferenceEquals($scope.Record.Transaction,$FileTransaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'FileTransaction must be the transaction root capability' $null};Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$nativeResult=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetained @($RuntimeId,$ExpectedManifestSha256)} 'CCOD_INSTALL_RETAINED_GENERATION_INVALID';if(@($nativeResult).Count-ne 2-or-not(Test-CcodRetainedManifestIdentity ([string]$nativeResult[1]) $RuntimeId)){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH' 'Retained manifest must contain exactly one matching top-level runtimeId string' $RuntimeId};Add-CcodInstallScope $scope.Record.Transaction $nativeResult[0] Generation $true $RuntimeId }
 
 $script:CcodProductReadyFields=@('schemaVersion','transactionId','oldRuntimeId','oldGeneration','oldManifestSha256','newRuntimeId','newGeneration','newManifestSha256','sealedPackageSha256','ownedObjectNames','phase','errorCode')
+$script:CcodInstallProductCleanupFields=@('schemaVersion','transactionId','runtimeId','runtimeGeneration','manifestSha256','packageSha256','ownerPid','ownerCreationTimeUtc','ownerSid','state')
 function Test-CcodInstallOrderedProperties($Value,[string[]]$Names){if($null-eq$Value){return $false};$actual=@($Value.PSObject.Properties.Name);return(($actual-join"`0")-ceq($Names-join"`0"))}
 function Test-CcodInstallUnsignedInteger($Value){return $Value-is[byte]-or$Value-is[uint16]-or$Value-is[uint32]-or$Value-is[uint64]-or$Value-is[int16]-or$Value-is[int32]-or$Value-is[int64]}
 function Read-CcodInstallAuthorityFile {
@@ -444,6 +446,39 @@ function Open-CcodInstallProductRegistrationTransaction {
         $arguments=[object[]]@($root,$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenProduct $arguments} 'CCOD_INSTALL_PRODUCT_SCOPE';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=$root.TrimEnd('\');RuntimeId=$authority.RuntimeId;RootToken=$token;StateOnly=$false;ProductOnly=$true;ReadyAuthority=$authority;AuthorityLease=$lease;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='ProductTransaction';ReadOnly=$true;RuntimeId=$authority.RuntimeId});$lease=$null;return $transaction
     }finally{if($null-ne$lease){try{Exit-CcodInstallProductAuthorityLease $lease}catch{}}}
 }
+function Get-CcodInstallProductCleanupFenceProof($State,$Fence){
+    if($null-eq$State-or-not$State.ProductOnly-or$null-eq$State.ReadyAuthority-or$null-eq$Fence-or-not(Test-CcodInstallOrderedProperties $Fence @('InstallRoot','ReadyTransaction','OwnerIdentity','Attempt'))){Throw-CcodInstallFileError 'CCOD_INSTALL_CLOSE_FAILED' 'Product cleanup fence binding is invalid' $null}
+    $root=[IO.Path]::GetFullPath([string]$Fence.InstallRoot).TrimEnd('\')
+    $readyCanonical=$Fence.ReadyTransaction|ConvertTo-Json -Depth 8 -Compress
+    $owner=$Fence.OwnerIdentity
+    if($root-cne$State.InstallRoot-or$readyCanonical-cne$State.ReadyAuthority.ReadyCanonical-or-not(Test-CcodInstallUnsignedInteger $Fence.Attempt)-or[uint64]$Fence.Attempt-eq0-or$null-eq$owner-or-not(Test-CcodInstallOrderedProperties $owner @('pid','creationTimeUtc','userSid'))-or$owner.pid-isnot[int]-or$owner.pid-le0-or$owner.creationTimeUtc-isnot[string]-or$owner.userSid-isnot[string]){Throw-CcodInstallFileError 'CCOD_INSTALL_CLOSE_FAILED' 'Product cleanup fence does not match strict Ready authority' $Fence}
+    $leaf='{0:D20}.Pending.{1}.json'-f[uint64]$Fence.Attempt,[string]$Fence.ReadyTransaction.transactionId
+    $path=Join-Path $root ('state\product-cleanup-fences\'+$leaf)
+    try{$record=Read-CcodInstallProductStrictJson -Path $path -Fields $script:CcodInstallProductCleanupFields}catch{Throw-CcodInstallFileError 'CCOD_INSTALL_CLOSE_FAILED' 'Durable Pending product cleanup fence is unavailable' $path}
+    if($record.schemaVersion-isnot[int]-or$record.schemaVersion-ne1-or$record.state-isnot[string]-or$record.state-cne'Pending'-or
+        $record.transactionId-cne$Fence.ReadyTransaction.transactionId-or$record.runtimeId-cne$State.ReadyAuthority.RuntimeId-or
+        -not(Test-CcodInstallUnsignedInteger $record.runtimeGeneration)-or[uint64]$record.runtimeGeneration-ne[uint64]$State.ReadyAuthority.Generation-or
+        $record.manifestSha256-cne$State.ReadyAuthority.ManifestSha256-or$record.packageSha256-cne$State.ReadyAuthority.PackageSha256-or
+        $record.ownerPid-isnot[int]-or[int]$record.ownerPid-ne[int]$owner.pid-or$record.ownerCreationTimeUtc-isnot[string]-or$record.ownerCreationTimeUtc-cne[string]$owner.creationTimeUtc-or
+        $record.ownerSid-isnot[string]-or$record.ownerSid-cne[string]$owner.userSid){Throw-CcodInstallFileError 'CCOD_INSTALL_CLOSE_FAILED' 'Durable Pending product cleanup fence changed before close' $path}
+    return [pscustomobject]@{Path=$path;Canonical=($record|ConvertTo-Json -Depth 8 -Compress)}
+}
+function Set-CcodInstallProductCleanupFence {
+    param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$Fence)
+    $scope=Get-CcodInstallTransaction $Transaction 'CCOD_INSTALL_TRANSACTION_INVALID'
+    if(-not[object]::ReferenceEquals($scope.Record.Transaction,$Transaction)-or$scope.Record.Kind-cne'ProductTransaction'){Throw-CcodInstallFileError 'CCOD_INSTALL_CLOSE_FAILED' 'Product cleanup fence requires the strict transaction root' $null}
+    [void](Assert-CcodInstallProductAuthorityLease $scope.State)
+    if($null-ne$scope.State.PSObject.Properties['ProductCleanupFence']-and$null-ne$scope.State.ProductCleanupFence){Throw-CcodInstallFileError 'CCOD_INSTALL_CLOSE_FAILED' 'Product cleanup fence is already bound' $null}
+    $scope.State|Add-Member -NotePropertyName ProductCleanupFence -NotePropertyValue (Get-CcodInstallProductCleanupFenceProof $scope.State $Fence)
+    return $true
+}
+function Assert-CcodInstallProductCleanupFenceBound($State){
+    $proof=if($null-ne$State.PSObject.Properties['ProductCleanupFence']){$State.ProductCleanupFence}else{$null}
+    if($null-eq$proof-or$proof.Path-isnot[string]-or$proof.Canonical-isnot[string]){Throw-CcodInstallFileError 'CCOD_INSTALL_CLOSE_FAILED' 'Ready product close requires a durable Pending cleanup fence' $null}
+    try{$record=Read-CcodInstallProductStrictJson -Path $proof.Path -Fields $script:CcodInstallProductCleanupFields}catch{Throw-CcodInstallFileError 'CCOD_INSTALL_CLOSE_FAILED' 'Durable Pending cleanup fence is unavailable at close' $proof.Path}
+    if(($record|ConvertTo-Json -Depth 8 -Compress)-cne$proof.Canonical-or$record.state-cne'Pending'){Throw-CcodInstallFileError 'CCOD_INSTALL_CLOSE_FAILED' 'Durable Pending cleanup fence changed before close' $proof.Path}
+    return $true
+}
 function Open-CcodInstallRetainedFile {
     param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$RelativePath,[Parameter(Mandatory)]$ReadyTransaction)
     if($RelativePath-cnotin@('registration/StartMenu.CodexRemote-fix.lnk','registration/Desktop.CodexRemote-fix.lnk')){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Product shortcut source must be one fixed manifest-relative candidate' $RelativePath};$scope=Get-CcodInstallTransaction $Generation 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';[void](Assert-CcodInstallProductAuthorityLease $scope.State);$authority=Get-CcodInstallProductReadyAuthority $scope.State.InstallRoot $ReadyTransaction;$stored=$scope.State.ReadyAuthority;if($null-eq$stored-or$authority.ReadyCanonical-cne$stored.ReadyCanonical-or$authority.PersistedReadyCanonical-cne$stored.PersistedReadyCanonical-or$authority.RuntimeId-cne$stored.RuntimeId-or$authority.Generation-ne$stored.Generation-or$authority.ManifestSha256-cne$stored.ManifestSha256-or$authority.PackageSha256-cne$stored.PackageSha256-or$authority.RuntimeId-cne$scope.Record.RuntimeId){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Retained shortcut source authority changed after capability open' $ReadyTransaction};$result=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetainedFile @($scope.Record.Token,$RelativePath)} 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';if(@($result).Count-ne3-or[int64]$result[1]-lt0-or[string]$result[2]-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Retained product shortcut identity is invalid' $RelativePath};Add-CcodInstallScope $scope.Record.Transaction $result[0] RetainedFile $true $scope.Record.RuntimeId
@@ -472,11 +507,18 @@ function Copy-CcodInstallProductShortcut {
     Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime CopyProductShortcut @($scope.Record.Token,$Kind,$sourceScope.Record.Token,$Leaf)} 'CCOD_INSTALL_PRODUCT_SHORTCUT_FAILED'|Out-Null
     [pscustomobject]@{Kind=$Kind;Leaf=$Leaf}
 }
+function Invoke-CcodInstallFileTransactionLowerClose {
+    param([Parameter(Mandatory)]$State)
+    $defaultClose={param($Value)Invoke-CcodRuntimeMethod $Value.Runtime Close @()|Out-Null}
+    if($script:CcodInstallFileTransactionLowerCloseForTest-is[scriptblock]){&$script:CcodInstallFileTransactionLowerCloseForTest $State $defaultClose;return}
+    &$defaultClose $State
+}
 function Close-CcodInstallFileTransaction {
     param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][ValidateSet('Ready','Failed')][string]$Disposition)
     $state=$null;if($null-eq$Transaction-or-not$script:CcodTransactions.TryGetValue($Transaction,[ref]$state)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'Invalid install file transaction capability' $null};if($state.Closed-and-not$state.CleanupFailed){return}
+    if($state.ProductOnly-and$Disposition-ceq'Ready'){[void](Assert-CcodInstallProductCleanupFenceBound $state)}
     $cleanupFailed=$false
-    try{Invoke-CcodRuntimeMethod $state.Runtime Close @()|Out-Null}catch{$cleanupFailed=$true}
+    try{Invoke-CcodInstallFileTransactionLowerClose -State $state}catch{$cleanupFailed=$true}
     if($null-ne$state.PSObject.Properties['AuthorityLease']-and$null-ne$state.AuthorityLease){try{Exit-CcodInstallProductAuthorityLease $state.AuthorityLease;$state.AuthorityLease=$null}catch{$cleanupFailed=$true}}
     $state.CleanupFailed=$cleanupFailed;$state.Closed=$true;$state.Disposition=$Disposition
     if($cleanupFailed){Throw-CcodInstallFileError 'CCOD_INSTALL_CLOSE_FAILED' 'Install file transaction cleanup failed; registered failures are retained for retry' $null}
diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index eae6f93..6316775 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -18,7 +18,9 @@ $script:CcodActivationPhases = @('StoppingPreviousRuntime','InstallingRuntime','
 $script:CcodInstallTransactionPhases = @('Prepared','PackageVerified','RuntimeStaged','PreviousProtectionStopped','RuntimePromoted','PointerCommitted','StableShellCommitted','ProtectionReady','Ready')
 $script:CcodInstallTransactionFields = @('schemaVersion','transactionId','oldRuntimeId','oldGeneration','oldManifestSha256','newRuntimeId','newGeneration','newManifestSha256','sealedPackageSha256','ownedObjectNames','phase','errorCode')
 $script:CcodInstallTransactionRoots = [Runtime.CompilerServices.ConditionalWeakTable[object,object]]::new()
+$script:CcodProductCleanupFenceFields = @('schemaVersion','transactionId','runtimeId','runtimeGeneration','manifestSha256','packageSha256','ownerPid','ownerCreationTimeUtc','ownerSid','state')
 $script:CcodPendingProductTransactionCleanups = [Collections.Hashtable]::Synchronized(@{})
+$script:CcodProductCleanupLeaseContexts = [Collections.Hashtable]::Synchronized(@{})
 
 function Throw-CcodLifecycleError {
     param(
@@ -45,19 +47,391 @@ function Get-CcodLifecycleProductCleanupKey {
     return Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
 }
 
+function Get-CcodLifecycleInstallFileTransactionModule {
+    $path = [IO.Path]::GetFullPath((Join-Path $PSScriptRoot 'InstallFileTransaction.psm1'))
+    $command = Get-Command Close-CcodInstallFileTransaction -ErrorAction SilentlyContinue
+    $module = if ($null -ne $command -and $null -ne $command.Module -and $null -ne $command.Module.Path -and [IO.Path]::GetFullPath($command.Module.Path) -ceq $path) { $command.Module } else { $null }
+    if ($null -eq $module) { $module = Import-Module $path -PassThru -DisableNameChecking -ErrorAction Stop }
+    if ($null -eq $module) { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Install file transaction module is unavailable' $path }
+    return $module
+}
+
+function Test-CcodLifecycleProductCleanupInteger {
+    param($Value)
+    return $Value -is [byte] -or $Value -is [uint16] -or $Value -is [uint32] -or $Value -is [uint64] -or
+        $Value -is [int16] -or $Value -is [int32] -or $Value -is [int64]
+}
+
+function Test-CcodLifecycleOrderedProperties {
+    param($Value,[string[]]$Expected)
+    if ($null -eq $Value -or ($Value -isnot [pscustomobject] -and $Value -isnot [Collections.IDictionary])) { return $false }
+    $actual = if ($Value -is [Collections.IDictionary]) { @($Value.Keys) } else { @($Value.PSObject.Properties.Name) }
+    return ($actual -join "`0") -ceq ($Expected -join "`0")
+}
+
+function Assert-CcodLifecycleProductCleanupIdentity {
+    param([Parameter(Mandatory)]$Identity)
+    if (-not (Test-CcodLifecycleOrderedProperties $Identity @('pid','creationTimeUtc','userSid')) -or
+        $Identity.pid -isnot [int] -or $Identity.pid -le 0 -or
+        $Identity.creationTimeUtc -isnot [string] -or $Identity.creationTimeUtc -cnotmatch 'Z$' -or
+        $Identity.userSid -isnot [string] -or $Identity.userSid -cnotmatch '^S-\d-\d+(?:-\d+)+$') {
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup owner identity is invalid' $Identity
+    }
+    $parsed = [DateTime]::MinValue
+    if (-not [DateTime]::TryParseExact($Identity.creationTimeUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind,[ref]$parsed) -or
+        $parsed.Kind -cne [DateTimeKind]::Utc -or
+        $parsed.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture) -cne $Identity.creationTimeUtc) {
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup owner creation time is invalid' $Identity
+    }
+    return $true
+}
+
+function Get-CcodLifecycleCurrentProductCleanupIdentity {
+    $process = $null
+    $identity = $null
+    try {
+        $process = [Diagnostics.Process]::GetCurrentProcess()
+        $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+        if ($null -eq $identity -or $null -eq $identity.User) { throw 'current user SID unavailable' }
+        $result = [pscustomobject][ordered]@{
+            pid = [int]$process.Id
+            creationTimeUtc = $process.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)
+            userSid = [string]$identity.User.Value
+        }
+        [void](Assert-CcodLifecycleProductCleanupIdentity $result)
+        return $result
+    } catch {
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Current product cleanup identity could not be proven' $null
+    } finally {
+        if ($null -ne $process) { $process.Dispose() }
+        if ($null -ne $identity) { $identity.Dispose() }
+    }
+}
+
+function Enter-CcodLifecycleProductCleanupLease {
+    $owner = Get-CcodLifecycleCurrentProductCleanupIdentity
+    $lease = $null
+    try {
+        $lease = Enter-CcodMutex -Kind AccountTransition -UserSid $owner.userSid -TimeoutMilliseconds 30000
+        if ($null -eq $lease -or $lease.Outcome -cne 'Acquired' -or $lease.Kind -cne 'AccountTransition' -or
+            $lease.Released -isnot [bool] -or $lease.Released -or
+            $lease.OwnerManagedThreadId -isnot [int] -or $lease.OwnerManagedThreadId -ne [Threading.Thread]::CurrentThread.ManagedThreadId) {
+            throw 'outer product cleanup lease was not acquired exactly'
+        }
+        $threadKey = [string][Threading.Thread]::CurrentThread.ManagedThreadId
+        if ($script:CcodProductCleanupLeaseContexts.ContainsKey($threadKey)) { throw 'outer product cleanup lease context is already active' }
+        $context = [pscustomobject]@{ Lease=$lease; OwnerIdentity=$owner; ThreadKey=$threadKey }
+        $script:CcodProductCleanupLeaseContexts[$threadKey] = $context
+        return $context
+    } catch {
+        if ($null -ne $lease -and $lease.Outcome -ceq 'Acquired' -and -not $lease.Released) { try { Exit-CcodMutex -Lease $lease | Out-Null } catch { } }
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Outer product cleanup lease could not be acquired' $owner.userSid
+    }
+}
+
+function Assert-CcodLifecycleProductCleanupLease {
+    $threadKey = [string][Threading.Thread]::CurrentThread.ManagedThreadId
+    if (-not $script:CcodProductCleanupLeaseContexts.ContainsKey($threadKey)) {
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Durable product cleanup requires the outer account-transition lease' $null
+    }
+    $context = $script:CcodProductCleanupLeaseContexts[$threadKey]
+    if ($null -eq $context -or $null -eq $context.Lease -or $context.Lease.Kind -cne 'AccountTransition' -or
+        $context.Lease.Outcome -cne 'Acquired' -or $context.Lease.Released -or
+        $context.Lease.OwnerManagedThreadId -ne [Threading.Thread]::CurrentThread.ManagedThreadId) {
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Outer product cleanup lease is not live on the current thread' $null
+    }
+    return $context
+}
+
+function Exit-CcodLifecycleProductCleanupLease {
+    param([Parameter(Mandatory)]$Context)
+    $current = Assert-CcodLifecycleProductCleanupLease
+    if (-not [object]::ReferenceEquals($current,$Context)) {
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Outer product cleanup lease context changed' $null
+    }
+    try {
+        $released = Exit-CcodMutex -Lease $Context.Lease
+        if ($released -isnot [bool] -or -not $released -or -not $Context.Lease.Released) { throw 'outer lease release was not proven' }
+        [void]$script:CcodProductCleanupLeaseContexts.Remove($Context.ThreadKey)
+        return $true
+    } catch {
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Outer product cleanup lease could not be released exactly' $null
+    }
+}
+
+function Assert-CcodLifecycleProductCleanupReadyAuthority {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$ReadyTransaction)
+    [void](Assert-CcodLifecycleProductCleanupLease)
+    try {
+        [void](Assert-CcodInstallTransactionRecord -Record $ReadyTransaction)
+        if ($ReadyTransaction.phase -cne 'Ready') { throw 'terminal Ready transaction required' }
+        $fileModule = Get-CcodLifecycleInstallFileTransactionModule
+        return &$fileModule {param($Root,$Record)Get-CcodInstallProductReadyAuthority -InstallRoot $Root -ReadyTransaction $Record} $InstallRoot $ReadyTransaction
+    } catch {
+        if ((Get-CcodLifecycleErrorId $_) -ceq 'CCOD_PRODUCT_REGISTRATION_FAILED') { throw }
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Exact selected Ready authority could not be proven for product cleanup' $ReadyTransaction
+    }
+}
+
+function Assert-CcodLifecycleProductCleanupRecord {
+    param([Parameter(Mandatory)]$Record,[Parameter(Mandatory)]$ReadyTransaction,[Parameter(Mandatory)][ValidateSet('Pending','Completed')][string]$ExpectedState)
+    $validInteger = Test-CcodLifecycleProductCleanupInteger $Record.runtimeGeneration
+    if (-not (Test-CcodLifecycleOrderedProperties $Record $script:CcodProductCleanupFenceFields) -or
+        $Record.schemaVersion -isnot [int] -or $Record.schemaVersion -ne 1 -or
+        -not (Test-CcodLifecycleCanonicalGuid $Record.transactionId) -or
+        $Record.runtimeId -isnot [string] -or $Record.runtimeId -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$' -or
+        -not $validInteger -or [uint64]$Record.runtimeGeneration -eq 0 -or
+        $Record.manifestSha256 -isnot [string] -or $Record.manifestSha256 -cnotmatch '^[0-9a-f]{64}$' -or
+        $Record.packageSha256 -isnot [string] -or $Record.packageSha256 -cnotmatch '^[0-9a-f]{64}$' -or
+        $Record.ownerPid -isnot [int] -or $Record.ownerPid -le 0 -or
+        $Record.ownerCreationTimeUtc -isnot [string] -or
+        $Record.ownerSid -isnot [string] -or
+        $Record.state -isnot [string] -or $Record.state -cne $ExpectedState) {
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Durable product cleanup record is invalid' $Record
+    }
+    [void](Assert-CcodLifecycleProductCleanupIdentity ([pscustomobject][ordered]@{pid=[int]$Record.ownerPid;creationTimeUtc=[string]$Record.ownerCreationTimeUtc;userSid=[string]$Record.ownerSid}))
+    [void](Assert-CcodInstallTransactionRecord -Record $ReadyTransaction)
+    if ($ReadyTransaction.phase -cne 'Ready' -or
+        $Record.transactionId -cne $ReadyTransaction.transactionId -or
+        $Record.runtimeId -cne $ReadyTransaction.newRuntimeId -or
+        [uint64]$Record.runtimeGeneration -ne [uint64]$ReadyTransaction.newGeneration -or
+        $Record.manifestSha256 -cne $ReadyTransaction.newManifestSha256 -or
+        $Record.packageSha256 -cne $ReadyTransaction.sealedPackageSha256) {
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Durable product cleanup record does not match the exact Ready transaction' $Record
+    }
+    return $true
+}
+
+function Get-CcodLifecycleProductCleanupFenceLeaf {
+    param([Parameter(Mandatory)][uint64]$Attempt,[Parameter(Mandatory)][ValidateSet('Pending','Completed')][string]$State,[Parameter(Mandatory)][string]$TransactionId)
+    return ('{0:D20}.{1}.{2}.json' -f $Attempt,$State,$TransactionId)
+}
+
+function Read-CcodLifecycleProductCleanupFenceHistory {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$ReadyTransaction)
+    $root = Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
+    $directory = Join-Path $root 'state\product-cleanup-fences'
+    if (-not [IO.Directory]::Exists($directory)) {
+        if (Test-Path -LiteralPath $directory) { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence plane is not a directory' $directory }
+        return @()
+    }
+    try { [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $directory) }
+    catch { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence plane is unsafe' $directory }
+    $entries = [Collections.Generic.List[object]]::new()
+    $files = @(Get-ChildItem -LiteralPath $directory -Force -ErrorAction Stop)
+    if ($files.Count -gt 4096) { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence plane exceeds its bounded history' $directory }
+    foreach ($file in $files) {
+        if ($file.PSIsContainer -or $file.Name -cnotmatch '^(?<attempt>\d{20})\.(?<state>Pending|Completed)\.(?<transaction>[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.json$') {
+            Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence plane contains an unknown object' $file.FullName
+        }
+        $attemptText = [string]$Matches.attempt
+        $state = [string]$Matches.state
+        $transactionId = [string]$Matches.transaction
+        [uint64]$attempt = 0
+        if (-not [uint64]::TryParse($attemptText,[ref]$attempt) -or $attempt -eq 0 -or ('{0:D20}' -f $attempt) -cne $attemptText) {
+            Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence attempt is invalid' $file.FullName
+        }
+        try { $record = Read-CcodStrictJson -Path $file.FullName -ExpectedSchema 1 -Kind 'product cleanup fence' -MaxBytes 16384 }
+        catch { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence is malformed' $file.FullName }
+        [void](Assert-CcodLifecycleProductCleanupRecord -Record $record -ReadyTransaction $ReadyTransaction -ExpectedState $state)
+        if ($transactionId -cne $record.transactionId -or $file.Name -cne (Get-CcodLifecycleProductCleanupFenceLeaf -Attempt $attempt -State $state -TransactionId $record.transactionId)) {
+            Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence name is noncanonical' $file.FullName
+        }
+        $entries.Add([pscustomobject]@{Attempt=$attempt;State=$state;Record=$record;Leaf=$file.Name})
+    }
+    $groups = @($entries | Group-Object Attempt | Sort-Object {[uint64]$_.Name})
+    [uint64]$expectedAttempt = 1
+    for ($index=0; $index -lt $groups.Count; $index++) {
+        $group = $groups[$index]
+        if ([uint64]$group.Name -ne $expectedAttempt) { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence history has a sequence gap' $directory }
+        $pending = @($group.Group | Where-Object {$_.State -ceq 'Pending'})
+        $completed = @($group.Group | Where-Object {$_.State -ceq 'Completed'})
+        if ($pending.Count -ne 1 -or $completed.Count -gt 1 -or ($index -lt $groups.Count-1 -and $completed.Count -ne 1)) {
+            Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence history has an invalid state transition' $directory
+        }
+        if ($completed.Count -eq 1) {
+            foreach ($field in @('transactionId','runtimeId','runtimeGeneration','manifestSha256','packageSha256','ownerPid','ownerCreationTimeUtc','ownerSid')) {
+                if ([string]$pending[0].Record.$field -cne [string]$completed[0].Record.$field) {
+                    Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup completion changed immutable fence identity' $completed[0].Leaf
+                }
+            }
+        }
+        $expectedAttempt++
+    }
+    return @($entries | Sort-Object @{Expression={[uint64]$_.Attempt}},@{Expression={if($_.State-ceq'Pending'){0}else{1}}})
+}
+
+function Write-CcodLifecycleProductCleanupRecord {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)]$Record)
+    $fileModule = Get-CcodLifecycleInstallFileTransactionModule
+    try {
+        &$fileModule {
+            param($Root,$RecordLeaf,$Value)
+            $transaction = $null
+            try {
+                $transaction = Open-CcodInstallStateTransaction -InstallRoot $Root
+                $state = New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'state' -CreateIfMissing
+                $fences = New-CcodInstallDirectory -Transaction $transaction -Parent $state -Leaf 'product-cleanup-fences' -CreateIfMissing
+                Write-CcodInstallRecord -Transaction $transaction -Parent $fences -Leaf $RecordLeaf -Record $Value | Out-Null
+            } finally {
+                if ($null -ne $transaction) { Close-CcodInstallFileTransaction -Transaction $transaction -Disposition Ready }
+            }
+        } $InstallRoot $Leaf $Record
+    } catch {
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Durable product cleanup record could not be appended create-only' $Leaf
+    }
+}
+
+function Complete-CcodLifecycleProductCleanupFence {
+    param([Parameter(Mandatory)]$Fence,[Parameter(Mandatory)][ValidateSet('Completed','Pending')][string]$Outcome)
+    [void](Assert-CcodLifecycleProductCleanupLease)
+    if ($null -eq $Fence -or -not (Test-CcodLifecycleOrderedProperties $Fence @('InstallRoot','ReadyTransaction','OwnerIdentity','Attempt')) -or
+        $Fence.InstallRoot -isnot [string] -or -not (Test-CcodLifecycleProductCleanupInteger $Fence.Attempt) -or [uint64]$Fence.Attempt -eq 0) {
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence capability is invalid' $Fence
+    }
+    $root = Get-CcodLifecycleCanonicalRoot -Path $Fence.InstallRoot -Kind 'Install root'
+    [void](Assert-CcodLifecycleProductCleanupIdentity $Fence.OwnerIdentity)
+    [void](Assert-CcodLifecycleProductCleanupReadyAuthority -InstallRoot $root -ReadyTransaction $Fence.ReadyTransaction)
+    $record = [pscustomobject][ordered]@{
+        schemaVersion = 1
+        transactionId = $Fence.ReadyTransaction.transactionId
+        runtimeId = $Fence.ReadyTransaction.newRuntimeId
+        runtimeGeneration = [uint64]$Fence.ReadyTransaction.newGeneration
+        manifestSha256 = $Fence.ReadyTransaction.newManifestSha256
+        packageSha256 = $Fence.ReadyTransaction.sealedPackageSha256
+        ownerPid = [int]$Fence.OwnerIdentity.pid
+        ownerCreationTimeUtc = [string]$Fence.OwnerIdentity.creationTimeUtc
+        ownerSid = [string]$Fence.OwnerIdentity.userSid
+        state = $Outcome
+    }
+    [void](Assert-CcodLifecycleProductCleanupRecord -Record $record -ReadyTransaction $Fence.ReadyTransaction -ExpectedState $Outcome)
+    $history = @(Read-CcodLifecycleProductCleanupFenceHistory -InstallRoot $root -ReadyTransaction $Fence.ReadyTransaction)
+    $existing = @($history | Where-Object {[uint64]$_.Attempt -eq [uint64]$Fence.Attempt -and $_.State -ceq $Outcome})
+    if ($existing.Count -eq 1) { return $existing[0].Record }
+    if ($existing.Count -ne 0) { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence outcome is ambiguous' $Fence.Attempt }
+    if ($Outcome -ceq 'Pending') {
+        [uint64]$expected = if ($history.Count -eq 0) { 1 } else { [uint64]$history[-1].Attempt + 1 }
+        if ([uint64]$Fence.Attempt -ne $expected -or ($history.Count -gt 0 -and $history[-1].State -cne 'Completed')) {
+            Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup Pending append is out of sequence' $Fence.Attempt
+        }
+    } else {
+        $pending = @($history | Where-Object {[uint64]$_.Attempt -eq [uint64]$Fence.Attempt -and $_.State -ceq 'Pending'})
+        if ($pending.Count -ne 1 -or $history[-1].State -cne 'Pending' -or [uint64]$history[-1].Attempt -ne [uint64]$Fence.Attempt) {
+            Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup Completed append lacks the latest exact Pending record' $Fence.Attempt
+        }
+    }
+    $leaf = Get-CcodLifecycleProductCleanupFenceLeaf -Attempt ([uint64]$Fence.Attempt) -State $Outcome -TransactionId $record.transactionId
+    Write-CcodLifecycleProductCleanupRecord -InstallRoot $root -Leaf $leaf -Record $record
+    $observed = @(Read-CcodLifecycleProductCleanupFenceHistory -InstallRoot $root -ReadyTransaction $Fence.ReadyTransaction | Where-Object {[uint64]$_.Attempt -eq [uint64]$Fence.Attempt -and $_.State -ceq $Outcome})
+    if ($observed.Count -ne 1) { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Durable product cleanup append is not exactly visible' $leaf }
+    return $observed[0].Record
+}
+
+function New-CcodLifecycleProductCleanupFence {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$ReadyTransaction,[Parameter(Mandatory)]$OwnerIdentity)
+    [void](Assert-CcodLifecycleProductCleanupLease)
+    $root = Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
+    [void](Assert-CcodLifecycleProductCleanupIdentity $OwnerIdentity)
+    [void](Assert-CcodLifecycleProductCleanupReadyAuthority -InstallRoot $root -ReadyTransaction $ReadyTransaction)
+    $history = @(Read-CcodLifecycleProductCleanupFenceHistory -InstallRoot $root -ReadyTransaction $ReadyTransaction)
+    if ($history.Count -gt 0 -and $history[-1].State -cne 'Completed') {
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'A prior product cleanup fence remains Pending' $history[-1].Leaf
+    }
+    if ($history.Count -gt 0 -and [uint64]$history[-1].Attempt -eq [uint64]::MaxValue) {
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence sequence is exhausted' $root
+    }
+    [uint64]$attempt = if ($history.Count -eq 0) { 1 } else { [uint64]$history[-1].Attempt + 1 }
+    $fence = [pscustomobject][ordered]@{
+        InstallRoot = $root
+        ReadyTransaction = $ReadyTransaction
+        OwnerIdentity = [pscustomobject][ordered]@{pid=[int]$OwnerIdentity.pid;creationTimeUtc=[string]$OwnerIdentity.creationTimeUtc;userSid=[string]$OwnerIdentity.userSid}
+        Attempt = $attempt
+    }
+    [void](Complete-CcodLifecycleProductCleanupFence -Fence $fence -Outcome Pending)
+    return $fence
+}
+
 function Invoke-CcodLifecycleProductTransactionClose {
     param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][scriptblock]$CloseProductTransaction,[Parameter(Mandatory)][scriptblock]$DefaultClose)
     & $CloseProductTransaction $Transaction $defaultClose
 }
 
-function Resolve-CcodLifecyclePendingProductTransactionCleanup {
-    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][scriptblock]$CloseProductTransaction)
-    $key=Get-CcodLifecycleProductCleanupKey -InstallRoot $InstallRoot
-    if(-not$script:CcodPendingProductTransactionCleanups.ContainsKey($key)){return}
-    $pending=$script:CcodPendingProductTransactionCleanups[$key]
-    if($pending.OwnerManagedThreadId-ne[Threading.Thread]::CurrentThread.ManagedThreadId){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Pending product transaction cleanup belongs to a different thread' $InstallRoot}
-    try{Invoke-CcodLifecycleProductTransactionClose -Transaction $pending.Transaction -CloseProductTransaction $CloseProductTransaction -DefaultClose $pending.DefaultClose}catch{Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Pending product transaction cleanup remains retryable' $InstallRoot}
-    [void]$script:CcodPendingProductTransactionCleanups.Remove($key)
+function Test-CcodLifecycleProductCleanupOwnerAlive {
+    param([Parameter(Mandatory)]$OwnerIdentity)
+    $process = $null
+    try {
+        $process = Get-Process -Id ([int]$OwnerIdentity.pid) -ErrorAction SilentlyContinue
+        if ($null -eq $process) { return $false }
+        return $process.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture) -ceq [string]$OwnerIdentity.creationTimeUtc
+    } catch {
+        return $true
+    } finally {
+        if ($null -ne $process) { $process.Dispose() }
+    }
+}
+
+function Resolve-CcodLifecycleProductCleanupFence {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$ReadyTransaction,[Parameter(Mandatory)]$CurrentIdentity,[Parameter(Mandatory)][scriptblock]$CloseProductTransaction)
+    [void](Assert-CcodLifecycleProductCleanupLease)
+    [void](Assert-CcodLifecycleProductCleanupIdentity $CurrentIdentity)
+    $root = Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
+    [void](Assert-CcodLifecycleProductCleanupReadyAuthority -InstallRoot $root -ReadyTransaction $ReadyTransaction)
+    $history = @(Read-CcodLifecycleProductCleanupFenceHistory -InstallRoot $root -ReadyTransaction $ReadyTransaction)
+    $key = Get-CcodLifecycleProductCleanupKey -InstallRoot $root
+    if ($history.Count -eq 0 -or $history[-1].State -ceq 'Completed') {
+        if ($script:CcodPendingProductTransactionCleanups.ContainsKey($key)) { [void]$script:CcodPendingProductTransactionCleanups.Remove($key) }
+        return [pscustomobject]@{Outcome='None'}
+    }
+    $pendingRecord = $history[-1].Record
+    if ($pendingRecord.ownerSid -cne $CurrentIdentity.userSid) {
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Pending product cleanup belongs to a different account' $pendingRecord.ownerSid
+    }
+    $sameOwner = [int]$pendingRecord.ownerPid -eq [int]$CurrentIdentity.pid -and
+        $pendingRecord.ownerCreationTimeUtc -ceq $CurrentIdentity.creationTimeUtc -and
+        $pendingRecord.ownerSid -ceq $CurrentIdentity.userSid
+    $entry = if ($script:CcodPendingProductTransactionCleanups.ContainsKey($key)) { $script:CcodPendingProductTransactionCleanups[$key] } else { $null }
+    if ($sameOwner) {
+        if ($null -eq $entry -or $entry.OwnerManagedThreadId -ne [Threading.Thread]::CurrentThread.ManagedThreadId -or
+            $null -eq $entry.Fence -or [uint64]$entry.Fence.Attempt -ne [uint64]$history[-1].Attempt) {
+            Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Pending product cleanup is live but its thread-bound capability is unavailable here' $root
+        }
+        if (-not $entry.CloseCompleted) {
+            if ($null -eq $entry.Transaction -or $entry.CloseProductTransaction -isnot [scriptblock] -or $entry.DefaultClose -isnot [scriptblock]) {
+                Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Pending product cleanup capability is invalid' $root
+            }
+            try { Invoke-CcodLifecycleProductTransactionClose -Transaction $entry.Transaction -CloseProductTransaction $entry.CloseProductTransaction -DefaultClose $entry.DefaultClose }
+            catch { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Pending product transaction cleanup remains retryable' $root }
+            $entry.CloseCompleted = $true
+        }
+        try { [void](Complete-CcodLifecycleProductCleanupFence -Fence $entry.Fence -Outcome Completed) }
+        catch { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product transaction closed but durable completion remains pending' $root }
+        [void]$script:CcodPendingProductTransactionCleanups.Remove($key)
+        return [pscustomobject]@{Outcome='SameThreadCompleted'}
+    }
+    if (Test-CcodLifecycleProductCleanupOwnerAlive ([pscustomobject][ordered]@{pid=[int]$pendingRecord.ownerPid;creationTimeUtc=[string]$pendingRecord.ownerCreationTimeUtc;userSid=[string]$pendingRecord.ownerSid})) {
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Pending product cleanup owner is still alive' $root
+    }
+    $fence = [pscustomobject][ordered]@{
+        InstallRoot = $root
+        ReadyTransaction = $ReadyTransaction
+        OwnerIdentity = [pscustomobject][ordered]@{pid=[int]$pendingRecord.ownerPid;creationTimeUtc=[string]$pendingRecord.ownerCreationTimeUtc;userSid=[string]$pendingRecord.ownerSid}
+        Attempt = [uint64]$history[-1].Attempt
+    }
+    $fileModule = Get-CcodLifecycleInstallFileTransactionModule
+    $recoveryTransaction = $null
+    try {
+        $recoveryTransaction = &$fileModule {param($Root,$Record)Open-CcodInstallProductRegistrationTransaction -InstallRoot $Root -ReadyTransaction $Record} $root $ReadyTransaction
+        [void](&$fileModule {param($Transaction,$Fence)Set-CcodInstallProductCleanupFence -Transaction $Transaction -Fence $Fence} $recoveryTransaction $fence)
+        $defaultClose = {param($Value)&$fileModule {param($Transaction)Close-CcodInstallFileTransaction -Transaction $Transaction -Disposition Ready} $Value}.GetNewClosure()
+        Invoke-CcodLifecycleProductTransactionClose -Transaction $recoveryTransaction -CloseProductTransaction $CloseProductTransaction -DefaultClose $defaultClose
+        $recoveryTransaction = $null
+    } catch {
+        if ($null -ne $recoveryTransaction) { try { &$fileModule {param($Transaction)Close-CcodInstallFileTransaction -Transaction $Transaction -Disposition Failed} $recoveryTransaction } catch { } }
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Dead-owner product cleanup could not be reconciled through fresh strict authority' $root
+    }
+    [void](Complete-CcodLifecycleProductCleanupFence -Fence $fence -Outcome Completed)
+    if ($script:CcodPendingProductTransactionCleanups.ContainsKey($key)) { [void]$script:CcodPendingProductTransactionCleanups.Remove($key) }
+    return [pscustomobject]@{Outcome='DeadOwnerCompleted'}
 }
 
 function Test-CcodActivationExactProperties {
@@ -1991,33 +2365,54 @@ function Get-CcodLifecycleAdapters {
         RegisterProduct = {
             param($InstallRoot,$RuntimeId,$Version,$PackageSha256,$FileTransaction,$TransactionRecord,$ProductAdapters,$CloseProductTransaction)
             if($CloseProductTransaction-isnot[scriptblock]){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product transaction close adapter is invalid' $InstallRoot}
-            Resolve-CcodLifecyclePendingProductTransactionCleanup -InstallRoot $InstallRoot -CloseProductTransaction $CloseProductTransaction
-            $module=Import-Module (Join-Path $PSScriptRoot 'ProductRegistration.psm1') -Force -PassThru -ErrorAction Stop
-            $fileModule=$null;$ownedTransaction=$null;$sourceCapability=$null;$receiptResult=$null;$firstCloseFailure=$null;$defaultClose=$null
+            $outerLease=$null
             try{
-                $fileModule=Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -PassThru -ErrorAction Stop
+                $outerLease=Enter-CcodLifecycleProductCleanupLease
+                $currentIdentity=$outerLease.OwnerIdentity
+                [void](Resolve-CcodLifecycleProductCleanupFence -InstallRoot $InstallRoot -ReadyTransaction $TransactionRecord -CurrentIdentity $currentIdentity -CloseProductTransaction $CloseProductTransaction)
+                $module=Import-Module (Join-Path $PSScriptRoot 'ProductRegistration.psm1') -Force -PassThru -ErrorAction Stop
+                $fileModule=Get-CcodLifecycleInstallFileTransactionModule
                 $defaultClose={param($Value)&$fileModule {param($Transaction)Close-CcodInstallFileTransaction -Transaction $Transaction -Disposition Ready} $Value}.GetNewClosure()
-                $ownedTransaction=&$fileModule {param($Root,$Record)Open-CcodInstallProductRegistrationTransaction -InstallRoot $Root -ReadyTransaction $Record} $InstallRoot $TransactionRecord
-                $sourceCapability=&$fileModule {param($Root,$Id,$Manifest,$Transaction)Open-CcodInstallRetainedGeneration -InstallRoot $Root -RuntimeId $Id -ExpectedManifestSha256 $Manifest -FileTransaction $Transaction} $InstallRoot $RuntimeId ([string]$TransactionRecord.newManifestSha256) $ownedTransaction
-                $registration=New-CcodProductRegistration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -Version $Version -PackageSha256 $PackageSha256 -FileTransaction $sourceCapability
-                $system=[Environment]::GetFolderPath([Environment+SpecialFolder]::System);$proof=[pscustomobject][ordered]@{phase=[string]$TransactionRecord.phase;runtimeId=$RuntimeId;version=$Version;packageSha256=$PackageSha256;runtimeGeneration=[uint64]$TransactionRecord.newGeneration;manifestSha256=[string]$TransactionRecord.newManifestSha256;startMenuSha256=(Get-CcodLifecycleFileSha256 $registration.startMenuShortcut.candidatePath);desktopSha256=(Get-CcodLifecycleFileSha256 $registration.desktopShortcut.candidatePath);targetPath=[IO.Path]::GetFullPath((Join-Path $system 'schtasks.exe'));arguments='/Run /TN "Codex Control Other Devices Supervisor"';transactionRecord=$TransactionRecord;bootstrapPath=$registration.bootstrapPath;uninstallerPath=$registration.uninstallerPath}
-                $commitAdapters=@{};if($null-ne$ProductAdapters){if($ProductAdapters-isnot[hashtable]){throw 'product side-effect adapters invalid'};foreach($key in $ProductAdapters.Keys){$commitAdapters[$key]=$ProductAdapters[$key]}};$commitAdapters.GetReadyProof={param($Ignored)$proof}.GetNewClosure()
-                $receipt=Commit-CcodProductRegistration -Registration $registration -FileTransaction $sourceCapability -Adapters $commitAdapters
-                Remove-CcodLegacyProductRegistration -ExpectedAppId '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}' -Adapters $ProductAdapters
-                $receiptResult=[pscustomobject]@{verified=[bool]$receipt.verified;legacyRemoved=$true}
-            }finally{
-                if($null-ne$ownedTransaction){
-                    try{Invoke-CcodLifecycleProductTransactionClose -Transaction $ownedTransaction -CloseProductTransaction $CloseProductTransaction -DefaultClose $defaultClose}catch{
-                        $firstCloseFailure=$_
-                        try{Invoke-CcodLifecycleProductTransactionClose -Transaction $ownedTransaction -CloseProductTransaction $CloseProductTransaction -DefaultClose $defaultClose}catch{
-                            $key=Get-CcodLifecycleProductCleanupKey -InstallRoot $InstallRoot
-                            $script:CcodPendingProductTransactionCleanups[$key]=[pscustomobject]@{Transaction=$ownedTransaction;DefaultClose=$defaultClose;OwnerManagedThreadId=[Threading.Thread]::CurrentThread.ManagedThreadId}
-                        }
+                $fence=New-CcodLifecycleProductCleanupFence -InstallRoot $InstallRoot -ReadyTransaction $TransactionRecord -OwnerIdentity $currentIdentity
+                $cleanupKey=Get-CcodLifecycleProductCleanupKey -InstallRoot $InstallRoot
+                $cleanupEntry=[pscustomobject]@{
+                    Fence=$fence
+                    Transaction=$null
+                    DefaultClose=$defaultClose
+                    CloseProductTransaction=$CloseProductTransaction
+                    OwnerManagedThreadId=[Threading.Thread]::CurrentThread.ManagedThreadId
+                    CloseCompleted=$true
+                }
+                $script:CcodPendingProductTransactionCleanups[$cleanupKey]=$cleanupEntry
+                $operationFailure=$null;$closeFailure=$null;$completionFailure=$null;$receiptResult=$null
+                try{
+                    $ownedTransaction=&$fileModule {param($Root,$Record)Open-CcodInstallProductRegistrationTransaction -InstallRoot $Root -ReadyTransaction $Record} $InstallRoot $TransactionRecord
+                    $cleanupEntry.Transaction=$ownedTransaction;$cleanupEntry.CloseCompleted=$false
+                    [void](&$fileModule {param($Transaction,$Fence)Set-CcodInstallProductCleanupFence -Transaction $Transaction -Fence $Fence} $ownedTransaction $fence)
+                    $sourceCapability=&$fileModule {param($Root,$Id,$Manifest,$Transaction)Open-CcodInstallRetainedGeneration -InstallRoot $Root -RuntimeId $Id -ExpectedManifestSha256 $Manifest -FileTransaction $Transaction} $InstallRoot $RuntimeId ([string]$TransactionRecord.newManifestSha256) $ownedTransaction
+                    $registration=New-CcodProductRegistration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -Version $Version -PackageSha256 $PackageSha256 -FileTransaction $sourceCapability
+                    $system=[Environment]::GetFolderPath([Environment+SpecialFolder]::System);$proof=[pscustomobject][ordered]@{phase=[string]$TransactionRecord.phase;runtimeId=$RuntimeId;version=$Version;packageSha256=$PackageSha256;runtimeGeneration=[uint64]$TransactionRecord.newGeneration;manifestSha256=[string]$TransactionRecord.newManifestSha256;startMenuSha256=(Get-CcodLifecycleFileSha256 $registration.startMenuShortcut.candidatePath);desktopSha256=(Get-CcodLifecycleFileSha256 $registration.desktopShortcut.candidatePath);targetPath=[IO.Path]::GetFullPath((Join-Path $system 'schtasks.exe'));arguments='/Run /TN "Codex Control Other Devices Supervisor"';transactionRecord=$TransactionRecord;bootstrapPath=$registration.bootstrapPath;uninstallerPath=$registration.uninstallerPath}
+                    $commitAdapters=@{};if($null-ne$ProductAdapters){if($ProductAdapters-isnot[hashtable]){throw 'product side-effect adapters invalid'};foreach($key in $ProductAdapters.Keys){$commitAdapters[$key]=$ProductAdapters[$key]}};$commitAdapters.GetReadyProof={param($Ignored)$proof}.GetNewClosure()
+                    $receipt=Commit-CcodProductRegistration -Registration $registration -FileTransaction $sourceCapability -Adapters $commitAdapters
+                    Remove-CcodLegacyProductRegistration -ExpectedAppId '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}' -Adapters $ProductAdapters
+                    $receiptResult=[pscustomobject]@{verified=[bool]$receipt.verified;legacyRemoved=$true}
+                }catch{$operationFailure=$_}
+                finally{
+                    if(-not$cleanupEntry.CloseCompleted-and$null-ne$cleanupEntry.Transaction){
+                        try{Invoke-CcodLifecycleProductTransactionClose -Transaction $cleanupEntry.Transaction -CloseProductTransaction $cleanupEntry.CloseProductTransaction -DefaultClose $cleanupEntry.DefaultClose;$cleanupEntry.CloseCompleted=$true}catch{$closeFailure=$_}
+                    }
+                    if($cleanupEntry.CloseCompleted){
+                        try{[void](Complete-CcodLifecycleProductCleanupFence -Fence $cleanupEntry.Fence -Outcome Completed);[void]$script:CcodPendingProductTransactionCleanups.Remove($cleanupKey)}catch{$completionFailure=$_}
                     }
                 }
+                if($null-ne$closeFailure){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product transaction cleanup failed after registration and requires same-thread reconciliation' $InstallRoot}
+                if($null-ne$completionFailure){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product transaction closed but durable completion could not be appended' $InstallRoot}
+                if($null-ne$operationFailure){throw $operationFailure}
+                if($null-eq$receiptResult-or$receiptResult.verified-isnot[bool]-or-not$receiptResult.verified){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product registration receipt is invalid after exact cleanup completion' $InstallRoot}
+                return $receiptResult
+            }finally{
+                if($null-ne$outerLease){[void](Exit-CcodLifecycleProductCleanupLease -Context $outerLease)}
             }
-            if($null-ne$firstCloseFailure){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product transaction cleanup failed after registration and requires reconciliation' $InstallRoot}
-            return $receiptResult
         }
         NewRuntimeManifest = {
             param($RuntimeDirectory, $ProjectVersion)
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index 809bfcb..66e33c0 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -271,7 +271,7 @@ finally{if($null-ne$ownership){try{&$epochModule {param($Owner)Exit-CcodLifecycl
         $commitBlocked=$true;$watch=[Diagnostics.Stopwatch]::StartNew();while($watch.ElapsedMilliseconds-lt5000){if([IO.File]::Exists($resultPath)-or$commitProcess.HasExited){$commitBlocked=$false;break};Start-Sleep -Milliseconds 20};$watch.Stop()
         Assert-CcodTrue $commitBlocked 'N+1 commit is blocked after its atomic real AccountTransition wait signal'
         if($commitBlocked){$opened=Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyTransaction $authority.Ready;Assert-CcodTrue ($null-ne$opened) 'N retained shortcut opens while its authority lease excludes N+1'}
-        Close-CcodInstallFileTransaction -Transaction $product -Disposition Ready
+        Close-CcodInstallFileTransaction -Transaction $product -Disposition Failed
         if(-not$commitProcess.WaitForExit(20000)){Stop-Process -Id $commitProcess.Id -Force;throw 'real N+1 commit child timed out'}
         $commitProcess.Refresh();if(-not[IO.File]::Exists($resultPath)){throw "real N+1 commit child produced no committed pointer exit=$($commitProcess.ExitCode) stdout=$([IO.File]::ReadAllText($stdout)) stderr=$([IO.File]::ReadAllText($stderr))"}
         $pointer=[IO.File]::ReadAllText($resultPath)|ConvertFrom-Json;Assert-CcodEqual 2 ([uint64]$pointer.generation) 'real commit advances to N+1 only after N authority closes'
@@ -538,6 +538,43 @@ Invoke-CcodTest 'close retries a failing disposal and releases every other regis
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
 
+# Production mutation caught: a Ready product close without a durably bound Pending fence can release its account lease into an unguarded cross-process window.
+Invoke-CcodTest 'Ready product close rejects release before a durable cleanup fence is bound' {
+    $authority=New-CcodProductAuthorityFixture;$fixture=$authority.Fixture
+    try {
+        $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $authority.Ready;$fixture.Transactions.Add($product)
+        Assert-CcodThrows {Close-CcodInstallFileTransaction -Transaction $product -Disposition Ready|Out-Null} 'CCOD_INSTALL_CLOSE_FAILED'
+        $currentModule=Get-Module InstallFileTransaction -ErrorAction Stop
+        $leaseLive=&$currentModule {param($Transaction)$state=$null;if(-not$script:CcodTransactions.TryGetValue($Transaction,[ref]$state)){return $false};return $null-ne$state.AuthorityLease-and-not$state.AuthorityLease.Released-and-not$state.Closed} $product
+        Assert-CcodTrue $leaseLive 'rejected unbound Ready close retains the same-thread product authority lease'
+        Close-CcodInstallFileTransaction -Transaction $product -Disposition Failed|Out-Null
+    } finally {Remove-CcodInstallFileFixture $fixture}
+}
+
+# Production mutation caught: bypassing the private lower-close seam prevents lifecycle tests from exercising native-close failure while the real lease-release path still runs.
+Invoke-CcodTest 'private lower close seam preserves the real transaction cleanup retry path' {
+    $fixture=New-CcodInstallFileFixture
+    $currentModule=Get-Module InstallFileTransaction -ErrorAction Stop
+    $lowerState=@{Attempts=0;FailuresRemaining=1}
+    $lowerClose={
+        param($TransactionState,$DefaultClose)
+        $lowerState.Attempts++
+        if($lowerState.FailuresRemaining-gt0){$lowerState.FailuresRemaining--;throw [IO.IOException]::new('injected lower native close failure')}
+        &$DefaultClose $TransactionState
+    }.GetNewClosure()
+    & $currentModule {param($Close)$script:CcodInstallFileTransactionLowerCloseForTest=$Close} $lowerClose
+    try {
+        $generation=Open-CcodFixtureGeneration $fixture 'runtime-lower-close-seam'
+        Assert-CcodThrows {Close-CcodInstallFileTransaction -Transaction $generation -Disposition Failed|Out-Null} 'CCOD_INSTALL_CLOSE_FAILED'
+        Assert-CcodEqual 1 $lowerState.Attempts 'first close reaches the injected lower native failure'
+        Close-CcodInstallFileTransaction -Transaction $generation -Disposition Failed|Out-Null
+        Assert-CcodEqual 2 $lowerState.Attempts 'same-thread retry reaches the lower close again and succeeds'
+    } finally {
+        & $currentModule {$script:CcodInstallFileTransactionLowerCloseForTest=$null}
+        Remove-CcodInstallFileFixture $fixture
+    }
+}
+
 Invoke-CcodTest 'pointer generation records are monotonic create-only and collision safe' {
     $fixture=New-CcodInstallFileFixture
     try {
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index bc93b98..d495a67 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -366,6 +366,177 @@ function Set-CcodLifecycleProductCloseFailureFixture {
     }.GetNewClosure()
 }
 
+function Set-CcodLifecycleLowerProductCloseFixture {
+    param([Parameter(Mandatory)][hashtable]$State)
+    $modulePath=Join-Path $repositoryRoot 'src\persistence\modules\InstallFileTransaction.psm1'
+    $fileModule=(Get-Command Close-CcodInstallFileTransaction -ErrorAction SilentlyContinue).Module
+    if($null-ne$fileModule-and($null-eq$fileModule.Path-or[IO.Path]::GetFullPath($fileModule.Path)-cne[IO.Path]::GetFullPath($modulePath))){$fileModule=$null}
+    if($null-eq$fileModule){$fileModule=Import-Module $modulePath -PassThru -DisableNameChecking -ErrorAction Stop}
+    $State.Attempts=0
+    $lowerClose={
+        param($TransactionState,$DefaultClose)
+        if(-not[bool]$TransactionState.ProductOnly){&$DefaultClose $TransactionState;return}
+        $State.Attempts++
+        if([int]$State.FailuresRemaining-gt0){$State.FailuresRemaining=[int]$State.FailuresRemaining-1;throw [IO.IOException]::new('injected lower native close failure')}
+        &$DefaultClose $TransactionState
+    }.GetNewClosure()
+    &$fileModule {param($Close)$script:CcodInstallFileTransactionLowerCloseForTest=$Close} $lowerClose
+    return $fileModule
+}
+
+function Clear-CcodLifecycleLowerProductCloseFixture {
+    param($FileModule)
+    if($null-ne$FileModule){&$FileModule {$script:CcodInstallFileTransactionLowerCloseForTest=$null}}
+}
+
+function Get-CcodLifecycleProductCleanupTestRecords {
+    param([Parameter(Mandatory)][string]$InstallRoot)
+    $directory=Join-Path $InstallRoot 'state\product-cleanup-fences'
+    if(-not[IO.Directory]::Exists($directory)){return @()}
+    $records=[Collections.Generic.List[object]]::new()
+    foreach($file in @(Get-ChildItem -LiteralPath $directory -File -Force|Sort-Object Name)){
+        if($file.Name-cnotmatch'^(?<attempt>\d{20})\.(?<state>Pending|Completed)\.(?<transaction>[0-9a-f-]{36})\.json$'){throw "unexpected cleanup fence leaf $($file.Name)"}
+        $records.Add([pscustomobject]@{Attempt=[uint64]$Matches.attempt;State=[string]$Matches.state;Leaf=$file.Name;Record=((Get-Content -LiteralPath $file.FullName -Raw)|ConvertFrom-Json)})
+    }
+    return @($records|Sort-Object Attempt,@{Expression={if($_.State-ceq'Pending'){0}else{1}}})
+}
+
+function Get-CcodLifecycleCurrentProductCleanupTestIdentity {
+    $process=[Diagnostics.Process]::GetCurrentProcess();$identity=[Security.Principal.WindowsIdentity]::GetCurrent()
+    try{return [pscustomobject][ordered]@{pid=[int]$process.Id;creationTimeUtc=$process.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture);userSid=[string]$identity.User.Value}}
+    finally{$process.Dispose();$identity.Dispose()}
+}
+
+function Assert-CcodLifecycleProductCleanupTestRecord {
+    param([Parameter(Mandatory)]$Actual,[Parameter(Mandatory)]$Ready,[Parameter(Mandatory)]$Owner,[Parameter(Mandatory)][ValidateSet('Pending','Completed')][string]$State)
+    $fields=@('schemaVersion','transactionId','runtimeId','runtimeGeneration','manifestSha256','packageSha256','ownerPid','ownerCreationTimeUtc','ownerSid','state')
+    Assert-CcodEqual ($fields-join '|') (@($Actual.PSObject.Properties.Name)-join '|') 'cleanup fence contains only the ordered contract fields'
+    Assert-CcodEqual 1 $Actual.schemaVersion 'cleanup fence schema is exact'
+    Assert-CcodEqual $Ready.transactionId $Actual.transactionId 'cleanup fence binds the Ready transaction id'
+    Assert-CcodEqual $Ready.newRuntimeId $Actual.runtimeId 'cleanup fence binds the selected runtime id'
+    Assert-CcodEqual ([uint64]$Ready.newGeneration) ([uint64]$Actual.runtimeGeneration) 'cleanup fence binds the selected generation'
+    Assert-CcodEqual $Ready.newManifestSha256 $Actual.manifestSha256 'cleanup fence binds the manifest hash'
+    Assert-CcodEqual $Ready.sealedPackageSha256 $Actual.packageSha256 'cleanup fence binds the package hash'
+    Assert-CcodEqual ([int]$Owner.pid) ([int]$Actual.ownerPid) 'cleanup fence binds the owner pid'
+    Assert-CcodEqual $Owner.creationTimeUtc $Actual.ownerCreationTimeUtc 'cleanup fence binds the owner creation time'
+    Assert-CcodEqual $Owner.userSid $Actual.ownerSid 'cleanup fence binds the owner SID'
+    Assert-CcodEqual $State $Actual.state 'cleanup fence state is exact'
+}
+
+function Invoke-CcodLifecycleOtherProcessProductReconciliation {
+    param(
+        [Parameter(Mandatory)][string]$SourceRoot,
+        [Parameter(Mandatory)][string]$InstallRoot,
+        [Parameter(Mandatory)][string]$NodePath,
+        [Parameter(Mandatory)][string]$PackageSha256,
+        [Parameter(Mandatory)][string]$MarkerRoot
+    )
+    [IO.Directory]::CreateDirectory($MarkerRoot)|Out-Null
+    $payload=[ordered]@{
+        lifecycleModule=$installLifecycleModule
+        kernelModule=(Join-Path $repositoryRoot 'src\persistence\modules\KernelObjects.psm1')
+        sourceRoot=$SourceRoot
+        installRoot=$InstallRoot
+        nodePath=$NodePath
+        packageSha256=$PackageSha256
+        markerRoot=$MarkerRoot
+    }
+    $payloadBase64=[Convert]::ToBase64String([Text.UTF8Encoding]::new($false).GetBytes(($payload|ConvertTo-Json -Compress)))
+    $childScript=@'
+$ErrorActionPreference='Stop'
+$payloadJson=[Text.UTF8Encoding]::new($false,$true).GetString([Convert]::FromBase64String('__PAYLOAD__'))
+$payload=$payloadJson|ConvertFrom-Json -ErrorAction Stop
+Import-Module $payload.lifecycleModule -Force -DisableNameChecking -ErrorAction Stop
+$kernelModule=Import-Module $payload.kernelModule -PassThru -DisableNameChecking -ErrorAction Stop
+$childState=@{Registration=$null;Shortcuts=@{}}
+$productAdapters=@{
+    WriteProductRegistration={param($Registration,$ReadyEvidence)$childState.Registration=$Registration;[IO.File]::WriteAllText((Join-Path $payload.markerRoot 'product-write.txt'),'registration')}.GetNewClosure()
+    ReadProductRegistration={param($Registration)$childState.Registration}.GetNewClosure()
+    WriteShortcut={param($Kind,$Shortcut,$FileTransaction,$ReadyEvidence)$childState.Shortcuts[$Kind]=$Shortcut;[IO.File]::WriteAllText((Join-Path $payload.markerRoot 'shortcut-write.txt'),[string]$Kind)}.GetNewClosure()
+    ReadShortcut={param($Kind,$Shortcut)$childState.Shortcuts[$Kind]}.GetNewClosure()
+    ReadVerifiedRegistration={[pscustomobject]@{verified=$true}}
+    ReadLegacyRegistration={param($ExpectedAppId)$null}
+}
+$process=[Diagnostics.Process]::GetCurrentProcess();$windowsIdentity=[Security.Principal.WindowsIdentity]::GetCurrent()
+try{$childIdentity=[pscustomobject][ordered]@{UserSid=[string]$windowsIdentity.User.Value;SessionId=[int]$process.SessionId;Pid=[int]$process.Id;CreationTimeUtc=$process.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)}}finally{$process.Dispose();$windowsIdentity.Dispose()}
+$adapters=@{
+    ValidateSource={param($Root)$true}
+    GetProjectVersion={param($Root)'2.5.22'}
+    DiscoverNodeCandidates={@([string]$payload.nodePath)}.GetNewClosure()
+    ValidateNodeCandidate={param($Path)$true}
+    GetCurrentIdentity={$childIdentity}.GetNewClosure()
+    AddProductShortcutCandidates={param($Files)[pscustomobject]@{Files=@($Files);TemporaryRoot=$null}}
+    GetProductRegistrationAdapters={$productAdapters}.GetNewClosure()
+    CloseProductTransaction={param($Transaction,$DefaultClose)[IO.File]::WriteAllText((Join-Path $payload.markerRoot 'authority-opened.txt'),'close reached');&$DefaultClose $Transaction}.GetNewClosure()
+}
+$lease=$null;$exitCode=24
+try{
+    $lease=&$kernelModule {param($Sid)Enter-CcodMutex -Kind AccountTransition -UserSid $Sid -TimeoutMilliseconds 15000} $childIdentity.UserSid
+    if($null-eq$lease-or$lease.Outcome-cne'Acquired'){throw 'child account mutex was not acquired'}
+    [IO.File]::WriteAllText((Join-Path $payload.markerRoot 'mutex-acquired.txt'),'acquired')
+    try{
+        $result=Invoke-CcodInstall -SourceRoot ([string]$payload.sourceRoot) -InstallRoot ([string]$payload.installRoot) -SealedPackageSha256 ([string]$payload.packageSha256) -Adapters $adapters
+        if($null-ne$result-and$result.ProductRegistrationVerified){[IO.File]::WriteAllText((Join-Path $payload.markerRoot 'verified.txt'),'verified')}
+        $exitCode=0
+    }catch{
+        $errorId=([string]$_.FullyQualifiedErrorId-split',')[0]
+        [IO.File]::WriteAllText((Join-Path $payload.markerRoot 'error-id.txt'),$errorId)
+        $exitCode=if($errorId-ceq'CCOD_PRODUCT_REGISTRATION_FAILED'){23}else{24}
+    }
+}catch{
+    [IO.File]::WriteAllText((Join-Path $payload.markerRoot 'child-failure.txt'),[string]$_)
+    $exitCode=25
+}finally{
+    if($null-ne$lease-and$lease.Outcome-ceq'Acquired'-and-not$lease.Released){try{&$kernelModule {param($Value)Exit-CcodMutex -Lease $Value} $lease|Out-Null}catch{$exitCode=26}}
+}
+exit $exitCode
+'@.Replace('__PAYLOAD__',$payloadBase64)
+    $encoded=[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($childScript))
+    $process=Start-Process -FilePath powershell.exe -ArgumentList @('-NoProfile','-ExecutionPolicy','Bypass','-EncodedCommand',$encoded) -PassThru -WindowStyle Hidden
+    try{
+        if(-not$process.WaitForExit(45000)){try{$process.Kill()}catch{};$process.WaitForExit();throw 'other-process product reconciliation timed out'}
+        $exitCode=$process.ExitCode
+    }finally{$process.Dispose()}
+    $errorPath=Join-Path $MarkerRoot 'error-id.txt'
+    return [pscustomobject]@{
+        ExitCode=[int]$exitCode
+        ErrorId=$(if([IO.File]::Exists($errorPath)){[IO.File]::ReadAllText($errorPath)}else{$null})
+        MutexAcquired=[IO.File]::Exists((Join-Path $MarkerRoot 'mutex-acquired.txt'))
+        AuthorityOpened=[IO.File]::Exists((Join-Path $MarkerRoot 'authority-opened.txt'))
+        ProductWritten=[IO.File]::Exists((Join-Path $MarkerRoot 'product-write.txt'))-or[IO.File]::Exists((Join-Path $MarkerRoot 'shortcut-write.txt'))
+        Verified=[IO.File]::Exists((Join-Path $MarkerRoot 'verified.txt'))
+        ChildFailure=$(if([IO.File]::Exists((Join-Path $MarkerRoot 'child-failure.txt'))){[IO.File]::ReadAllText((Join-Path $MarkerRoot 'child-failure.txt'))}else{$null})
+    }
+}
+
+function Invoke-CcodLifecycleDeadOwnerCleanupTest {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    $fileModule=$null;$fake=$null
+    try{
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null;$node=New-CcodLifecycleFakeNode -Root $nodeRoot;$fake=New-CcodLifecycleFake -NodePath $node
+        $productState=@{FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{}};Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $fake -ProductState $productState
+        $fake.Adapters.RegisterProduct={param($InstallRoot,$RuntimeId,$Version,$PackageSha256,$FileTransaction,$TransactionRecord)[pscustomobject]@{verified=$true;legacyRemoved=$true}}
+        $null=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('b'*64) -Adapters $fake.Adapters
+        $module=Get-Module InstallLifecycle -ErrorAction Stop;$ready=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install;$current=Get-CcodLifecycleCurrentProductCleanupTestIdentity
+        $deadOwner=[pscustomobject][ordered]@{pid=[int]2147483647;creationTimeUtc='2000-01-01T00:00:00.0000000Z';userSid=$current.userSid}
+        $outer=&$module {Enter-CcodLifecycleProductCleanupLease}
+        try{&$module {param($Root,$Record,$Owner)[void](New-CcodLifecycleProductCleanupFence -InstallRoot $Root -ReadyTransaction $Record -OwnerIdentity $Owner)} $install $ready $deadOwner}
+        finally{&$module {param($Context)[void](Exit-CcodLifecycleProductCleanupLease -Context $Context)} $outer}
+        [void]$fake.Adapters.Remove('RegisterProduct')
+        $lowerState=@{FailuresRemaining=0};$fileModule=Set-CcodLifecycleLowerProductCloseFixture -State $lowerState
+        $result=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('b'*64) -Adapters $fake.Adapters
+        Assert-CcodEqual 'AlreadyInstalled' $result.Outcome 'dead-owner reconciliation resumes only the exact same-package Ready install'
+        Assert-CcodTrue $result.ProductRegistrationVerified 'dead-owner reconciliation permits verified success only after cleanup'
+        Assert-CcodEqual 2 $lowerState.Attempts 'dead owner requires a fresh strict cleanup close before the new verification close'
+        $records=@(Get-CcodLifecycleProductCleanupTestRecords -InstallRoot $install)
+        Assert-CcodEqual '1:Pending|1:Completed|2:Pending|2:Completed' (($records|ForEach-Object{"$($_.Attempt):$($_.State)"})-join '|') 'dead-owner recovery completes the old fence before a new verification fence'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Failed.*.json' -File).Count 'dead-owner cleanup appends no lifecycle Failed snapshot'
+    }finally{
+        Clear-CcodLifecycleLowerProductCloseFixture -FileModule $fileModule
+        foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}
+    }
+}
+
 function New-CcodReadyFinalizationGapFixture {
     $source=New-CcodLifecycleTempRoot
     $install=New-CcodLifecycleTempRoot
@@ -3351,26 +3522,90 @@ $results += Invoke-CcodTest 'post-Ready writable close failure preserves Ready a
     }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}}
 }
 
-# Production mutation caught: a strict owned product transaction close failure must not be discarded after a verified registration body.
-$results += Invoke-CcodTest 'default product close failure is retryable and never returns a successful post-Ready receipt' {
-    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+# Production mutation caught: marking a dead owner's Pending fence Completed without opening and closing fresh strict authority skips the required cleanup proof.
+$results += Invoke-CcodTest 'dead-owner Pending fence requires fresh strict cleanup before registration' {
+    Invoke-CcodLifecycleDeadOwnerCleanupTest
+}
+
+# Production mutation caught: releasing strict product authority after a lower close failure without a durable fence lets another process report verified registration.
+$results += Invoke-CcodTest 'live-owner durable product cleanup blocks another real process after mutex acquisition' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot;$markerRoot=New-CcodLifecycleTempRoot
+    $fileModule=$null;$first=$null
     try{
         New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null;$node=New-CcodLifecycleFakeNode -Root $nodeRoot;$first=New-CcodLifecycleFake -NodePath $node
-        $failedState=@{FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{};CloseFailuresRemaining=2};Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $first -ProductState $failedState;Set-CcodLifecycleProductCloseFailureFixture -Fake $first -State $failedState
+        $productState=@{FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{}};Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $first -ProductState $productState
+        $lowerState=@{FailuresRemaining=1};$fileModule=Set-CcodLifecycleLowerProductCloseFixture -State $lowerState
         $unexpectedReceipt=$null;$failure=$null
-        try{$unexpectedReceipt=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('9'*64) -Adapters $first.Adapters}catch{$failure=$_}
-        Assert-CcodEqual $null $unexpectedReceipt 'owned product close failure emits no successful install or registration receipt'
-        Assert-CcodEqual 'CCOD_PRODUCT_REGISTRATION_FAILED' (([string]$failure.FullyQualifiedErrorId-split',')[0]) 'owned product close failure surfaces as stable product registration failure'
-        $module=Get-Module InstallLifecycle -ErrorAction Stop;$head=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install
-        Assert-CcodEqual 'Ready' $head.phase 'owned product close failure retains the durable lifecycle Ready record'
-        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Failed.*.json' -File).Count 'owned product close failure appends no lifecycle Failed snapshot'
-        Assert-CcodEqual 2 $failedState.CloseAttempts 'real default registration performs one bounded same-thread close retry before deferring cleanup'
-        $retry=New-CcodLifecycleFake -NodePath $node;$retryState=@{FailWrites=$false;Registration=$failedState.Registration;ReadyEvidence=$failedState.ReadyEvidence;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=$failedState.Shortcuts};Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $retry -ProductState $retryState
-        $result=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('9'*64) -Adapters $retry.Adapters
-        Assert-CcodEqual 'AlreadyInstalled' $result.Outcome 'later exact same-package invocation retries after owned product cleanup recovers'
-        Assert-CcodTrue $result.ProductRegistrationVerified 'later reconciliation reports success only after its owned transaction closes'
-        Assert-CcodTrue $retryState.ProductOnlyObserved 'cleanup recovery retry reacquires real strict product authority'
-    }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}}
+        try{$unexpectedReceipt=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('a'*64) -Adapters $first.Adapters}catch{$failure=$_}
+        Assert-CcodEqual $null $unexpectedReceipt 'lower native close failure returns no verified receipt to the first process'
+        Assert-CcodEqual 'CCOD_PRODUCT_REGISTRATION_FAILED' (([string]$failure.FullyQualifiedErrorId-split',')[0]) 'lower native close failure surfaces as product registration failure'
+        $module=Get-Module InstallLifecycle -ErrorAction Stop;$ready=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install
+        Assert-CcodEqual 'Ready' $ready.phase 'first process lower close failure leaves lifecycle Ready'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Failed.*.json' -File).Count 'first process lower close failure appends no Failed lifecycle snapshot'
+
+        $child=Invoke-CcodLifecycleOtherProcessProductReconciliation -SourceRoot $source -InstallRoot $install -NodePath $node -PackageSha256 ('a'*64) -MarkerRoot $markerRoot
+        [Console]::Error.WriteLine(('CCOD_CROSS_PROCESS_OBSERVED exit={0} mutex={1} authority={2} product={3} verified={4} error={5}'-f$child.ExitCode,$child.MutexAcquired,$child.AuthorityOpened,$child.ProductWritten,$child.Verified,$child.ErrorId))
+        Assert-CcodTrue $child.MutexAcquired 'fresh process acquires the real AccountTransition mutex after the first failure'
+        Assert-CcodEqual 23 $child.ExitCode 'fresh process fails closed on the durable pending fence'
+        Assert-CcodEqual 'CCOD_PRODUCT_REGISTRATION_FAILED' $child.ErrorId 'fresh process reports the stable product registration failure'
+        Assert-CcodEqual $false $child.AuthorityOpened 'fresh process opens no strict product authority while the live owner is pending'
+        Assert-CcodEqual $false $child.ProductWritten 'fresh process writes no product registration or shortcut'
+        Assert-CcodEqual $false $child.Verified 'fresh process emits no verified success'
+        Assert-CcodEqual $null $child.ChildFailure 'fresh process has no setup or adapter failure'
+        $records=@(Get-CcodLifecycleProductCleanupTestRecords -InstallRoot $install);$owner=Get-CcodLifecycleCurrentProductCleanupTestIdentity
+        Assert-CcodEqual 1 $records.Count 'other process observes one on-disk Pending fence rather than parent memory'
+        Assert-CcodLifecycleProductCleanupTestRecord -Actual $records[0].Record -Ready $ready -Owner $owner -State Pending
+        Assert-CcodEqual 1 $lowerState.Attempts 'first process performs exactly one lower product close attempt'
+    }finally{
+        Clear-CcodLifecycleLowerProductCloseFixture -FileModule $fileModule
+        if($null-ne$first-and(Test-Path -LiteralPath $install)){try{Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('a'*64) -Adapters $first.Adapters|Out-Null}catch{}}
+        foreach($path in @($source,$install,$nodeRoot,$markerRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}
+    }
+}
+
+# Production mutation caught: dropping the retained same-thread capability or completing its fence before exact close permits false verified success after Ready.
+$results += Invoke-CcodTest 'same-thread AlreadyInstalled drains durable product cleanup before verified success' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    $fileModule=$null;$cleanupNeeded=$true
+    try{
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null;$node=New-CcodLifecycleFakeNode -Root $nodeRoot;$first=New-CcodLifecycleFake -NodePath $node
+        $productState=@{FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{}};Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $first -ProductState $productState
+        $lowerState=@{FailuresRemaining=2};$fileModule=Set-CcodLifecycleLowerProductCloseFixture -State $lowerState
+        $firstReceipt=$null;$firstFailure=$null
+        try{$firstReceipt=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('9'*64) -Adapters $first.Adapters}catch{$firstFailure=$_}
+        Assert-CcodEqual $null $firstReceipt 'first lower close failure emits no successful install or registration receipt'
+        Assert-CcodEqual 'CCOD_PRODUCT_REGISTRATION_FAILED' (([string]$firstFailure.FullyQualifiedErrorId-split',')[0]) 'first lower close failure is a stable product registration failure'
+        $module=Get-Module InstallLifecycle -ErrorAction Stop;$ready=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install;$owner=Get-CcodLifecycleCurrentProductCleanupTestIdentity
+        Assert-CcodEqual 'Ready' $ready.phase 'first lower close failure retains lifecycle Ready'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Failed.*.json' -File).Count 'first lower close failure appends no lifecycle Failed snapshot'
+        $records=@(Get-CcodLifecycleProductCleanupTestRecords -InstallRoot $install)
+        Assert-CcodEqual 1 $records.Count 'first lower close failure leaves exactly one durable Pending record'
+        Assert-CcodLifecycleProductCleanupTestRecord -Actual $records[0].Record -Ready $ready -Owner $owner -State Pending
+        Assert-CcodEqual 1 $lowerState.Attempts 'one Invoke call performs one lower close attempt'
+
+        $secondReceipt=$null;$secondFailure=$null
+        try{$secondReceipt=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('9'*64) -Adapters $first.Adapters}catch{$secondFailure=$_}
+        Assert-CcodEqual $null $secondReceipt 'second retained-capability close failure emits no verified receipt'
+        Assert-CcodEqual 'CCOD_PRODUCT_REGISTRATION_FAILED' (([string]$secondFailure.FullyQualifiedErrorId-split',')[0]) 'second retained-capability close failure remains retryable'
+        Assert-CcodEqual 2 $lowerState.Attempts 'second same-thread invocation retries the original lower close exactly once'
+        Assert-CcodEqual 'Ready' (&$module {param($Root)(Read-CcodInstallTransactionRecord -InstallRoot $Root).phase} $install) 'two close failures leave lifecycle Ready'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Failed.*.json' -File).Count 'two close failures append no lifecycle Failed snapshot'
+        Assert-CcodEqual 1 @(Get-CcodLifecycleProductCleanupTestRecords -InstallRoot $install).Count 'failed retained retry appends no false Completed record'
+
+        $result=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('9'*64) -Adapters $first.Adapters
+        Assert-CcodEqual 'AlreadyInstalled' $result.Outcome 'exact same-package invocation returns only after original cleanup drains'
+        Assert-CcodTrue $result.ProductRegistrationVerified 'exact same-package invocation verifies only after durable completion'
+        Assert-CcodEqual 4 $lowerState.Attempts 'successful retry closes the retained original and the new strict verification transaction'
+        $records=@(Get-CcodLifecycleProductCleanupTestRecords -InstallRoot $install)
+        Assert-CcodEqual 4 $records.Count 'successful retry appends original completion and a complete verification pair'
+        Assert-CcodEqual '1:Pending|1:Completed|2:Pending|2:Completed' (($records|ForEach-Object{"$($_.Attempt):$($_.State)"})-join '|') 'cleanup history is append-only and ordered'
+        Assert-CcodLifecycleProductCleanupTestRecord -Actual $records[1].Record -Ready $ready -Owner $owner -State Completed
+        $cleanupNeeded=$false
+    }finally{
+        Clear-CcodLifecycleLowerProductCloseFixture -FileModule $fileModule
+        if($cleanupNeeded-and(Test-Path -LiteralPath $install)){try{Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('9'*64) -Adapters $first.Adapters|Out-Null}catch{}}
+        foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}
+    }
 }
 
 Write-Output "Install lifecycle self-tests passed: $($results.Count)"

From ffb5dd05f9de30c29666f910765f0d35168a299a Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 13:07:31 +0800
Subject: [PATCH 113/187] docs: record durable product cleanup evidence

---
 .../task-1-report.md                          | 149 ++++++++++++++++++
 1 file changed, 149 insertions(+)
 create mode 100644 .superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/task-1-report.md

diff --git a/.superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/task-1-report.md b/.superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/task-1-report.md
new file mode 100644
index 0000000..a36699a
--- /dev/null
+++ b/.superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/task-1-report.md
@@ -0,0 +1,149 @@
+# Task 1 report: durable cross-process product-cleanup fence
+
+## Review status
+
+Task 1 implementation and focused evidence are recorded for independent task
+review. This report does not claim Task 1 or Task 4 complete and makes no
+release-readiness claim.
+
+## Scope and commit
+
+- Base: `25eedda46a7963e8951a44d472b902015d38697d`
+- Implementation: `271a6e57ccfcc0568151f620c5cef0e3d43e1416`
+  (`fix: fence durable product cleanup`)
+- Production/tests commit contains only:
+  - `src/persistence/modules/InstallLifecycle.psm1`
+  - `src/persistence/modules/InstallFileTransaction.psm1`
+  - `tests/persistence/InstallLifecycle.SelfTest.ps1`
+  - `tests/persistence/InstallFileTransaction.SelfTest.ps1`
+
+## RED evidence
+
+### Private lower native-close seam
+
+- Command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Exit: `1`
+- Exact failure:
+  `private-lower-close-seam-preserves-the-real-transaction-cleanup-retry-path`
+  reached `ASSERT_THROWS: expected CCOD_INSTALL_CLOSE_FAILED`.
+- Meaning: the old close path did not traverse the injected lower native-close
+  boundary. The later seam is module-private and leaves the real authority
+  lease-release code in effect.
+
+### Same-process durable Pending
+
+- Command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1`
+- Exit: `1`
+- Exact failure:
+  `first lower close failure leaves exactly one durable Pending record
+  expected=[1] actual=[0]`.
+- This was the valid rerun after narrowing the seam to `ProductOnly`; an
+  earlier cleanup/setup failure was explicitly rejected as RED evidence.
+
+### Fresh-process release-before-fence window
+
+- Command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1`
+- Exit: `1`
+- Exact observation before the fix:
+  `CCOD_CROSS_PROCESS_OBSERVED exit=0 mutex=True authority=True product=True verified=True error=`
+- Exact assertion:
+  `fresh process fails closed on the durable pending fence expected=[23]
+  actual=[0]`.
+- The child was a fresh Windows PowerShell process. It received paths and the
+  package hash only, acquired the real `AccountTransition` mutex, and read the
+  install state itself; it received no parent in-memory cleanup signal.
+
+### IFT release guard
+
+- Command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Exit: `1`
+- Exact failure:
+  `Ready product close rejects release before a durable cleanup fence is bound`
+  reached `ASSERT_THROWS: expected CCOD_INSTALL_CLOSE_FAILED`.
+
+### Proven-dead owner recovery
+
+- Targeted Windows PowerShell helper execution invoked the checked-in
+  `Invoke-CcodLifecycleDeadOwnerCleanupTest` fixture after loading the helper
+  prefix of `InstallLifecycle.SelfTest.ps1` in a fresh process.
+- Exit: `1`
+- Exact failure:
+  `dead owner requires a fresh strict cleanup close before the new verification
+  close expected=[2] actual=[1]`.
+- The fixture persisted a Pending record with PID `2147483647`, a canonical old
+  creation time, and the current SID under a real outer account lease. The old
+  implementation appended Completed without a fresh strict open/close.
+
+## GREEN evidence
+
+### Lifecycle focused suite
+
+- Command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1`
+- Exit: `0`
+- Result: `Install lifecycle self-tests passed: 122`
+- Exact fresh-process observation:
+  `CCOD_CROSS_PROCESS_OBSERVED exit=23 mutex=True authority=False product=False verified=False error=CCOD_PRODUCT_REGISTRATION_FAILED`
+- Covered behavior includes one-attempt lower close failure, durable Pending,
+  two same-thread retained-capability failures with no receipt, exact retry and
+  Completed append, live-owner cross-process blocking, and proven-dead owner
+  fresh strict cleanup before a new verification transaction.
+
+### Install file transaction focused suite
+
+- Command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Exit: `0`
+- Result: `34/34` declared named cases passed and the suite printed
+  `Install file transaction self-test passed.`
+- New cases prove an unbound Ready product close retains its same-thread lease
+  and that the private lower-close seam preserves retry behavior.
+
+### Parser and diff
+
+- Parser command: parse the two changed modules and two changed self-tests with
+  `[System.Management.Automation.Language.Parser]::ParseFile`.
+- Parser exit: `0`, output `PowerShell parser passed: 4/4`.
+- Command: `git diff --check`
+- Exit: `0`; output contained only Git LF-to-CRLF checkout warnings.
+
+## Durable ordering and recovery behavior
+
+- The state plane is
+  `state\product-cleanup-fences\<attempt>.Pending|Completed.<transactionId>.json`.
+  Records are written through an IFT state-only transaction and
+  `Write-CcodInstallRecord` create-only publication.
+- Each payload has exactly the ordered ten fields required by the brief. The
+  containing path binds the canonical install root; every read also reproves
+  the complete ordered 12-field Ready transaction and selected generation.
+- A real outer `AccountTransition` lease covers resolve, Pending publication,
+  strict product open/use, lower close, and Completed publication. IFT refuses
+  a Ready product close unless the exact Pending record is same-handle read and
+  bound first.
+- A live matching owner blocks before product authority opens. The same owner
+  on the same managed thread retries only the retained original capability.
+- A proven-dead owner is reconciled without old-process memory: under the fresh
+  outer lease, code opens a new strict product transaction, binds the existing
+  Pending record, performs real close, and appends Completed only after success.
+  Failure leaves Pending and fails closed.
+
+## No-real-action statement
+
+No real registry, Start-menu/Desktop shortcut, installer, uninstaller,
+installed product, product process, network, release, push, tag, signing,
+installation, restart, or reboot action was performed. Product effects in all
+tests were in-memory or temporary marker-file adapters. Named mutexes and
+temporary fixture state were the only real OS primitives exercised.
+
+## Compatibility and remaining review boundary
+
+- Existing `CCOD_INSTALL_CLOSE_FAILED` same-thread retry semantics remain.
+- Test-only authority used solely for mutex exclusion now closes with
+  disposition `Failed`; real product registration uses Ready only after a
+  durable Pending bind.
+- Full aggregate/release validation and Task 4 completion are outside this
+  Task 1 report and remain for the plan's later independent verification.

From 79b4825244fe53b9af8d10bf2b7e4efae347c909 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 14:17:15 +0800
Subject: [PATCH 114/187] fix: partition durable cleanup history

---
 src/persistence/modules/InstallLifecycle.psm1 | 102 +++++++++----
 .../persistence/InstallLifecycle.SelfTest.ps1 | 144 ++++++++++++++++++
 2 files changed, 220 insertions(+), 26 deletions(-)

diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index 6316775..5f88774 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -173,8 +173,8 @@ function Assert-CcodLifecycleProductCleanupReadyAuthority {
     }
 }
 
-function Assert-CcodLifecycleProductCleanupRecord {
-    param([Parameter(Mandatory)]$Record,[Parameter(Mandatory)]$ReadyTransaction,[Parameter(Mandatory)][ValidateSet('Pending','Completed')][string]$ExpectedState)
+function Assert-CcodLifecycleProductCleanupRecordShape {
+    param([Parameter(Mandatory)]$Record,[Parameter(Mandatory)][ValidateSet('Pending','Completed')][string]$ExpectedState)
     $validInteger = Test-CcodLifecycleProductCleanupInteger $Record.runtimeGeneration
     if (-not (Test-CcodLifecycleOrderedProperties $Record $script:CcodProductCleanupFenceFields) -or
         $Record.schemaVersion -isnot [int] -or $Record.schemaVersion -ne 1 -or
@@ -190,6 +190,12 @@ function Assert-CcodLifecycleProductCleanupRecord {
         Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Durable product cleanup record is invalid' $Record
     }
     [void](Assert-CcodLifecycleProductCleanupIdentity ([pscustomobject][ordered]@{pid=[int]$Record.ownerPid;creationTimeUtc=[string]$Record.ownerCreationTimeUtc;userSid=[string]$Record.ownerSid}))
+    return $true
+}
+
+function Assert-CcodLifecycleProductCleanupRecord {
+    param([Parameter(Mandatory)]$Record,[Parameter(Mandatory)]$ReadyTransaction,[Parameter(Mandatory)][ValidateSet('Pending','Completed')][string]$ExpectedState)
+    [void](Assert-CcodLifecycleProductCleanupRecordShape -Record $Record -ExpectedState $ExpectedState)
     [void](Assert-CcodInstallTransactionRecord -Record $ReadyTransaction)
     if ($ReadyTransaction.phase -cne 'Ready' -or
         $Record.transactionId -cne $ReadyTransaction.transactionId -or
@@ -233,32 +239,57 @@ function Read-CcodLifecycleProductCleanupFenceHistory {
         }
         try { $record = Read-CcodStrictJson -Path $file.FullName -ExpectedSchema 1 -Kind 'product cleanup fence' -MaxBytes 16384 }
         catch { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence is malformed' $file.FullName }
-        [void](Assert-CcodLifecycleProductCleanupRecord -Record $record -ReadyTransaction $ReadyTransaction -ExpectedState $state)
+        [void](Assert-CcodLifecycleProductCleanupRecordShape -Record $record -ExpectedState $state)
         if ($transactionId -cne $record.transactionId -or $file.Name -cne (Get-CcodLifecycleProductCleanupFenceLeaf -Attempt $attempt -State $state -TransactionId $record.transactionId)) {
             Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence name is noncanonical' $file.FullName
         }
         $entries.Add([pscustomobject]@{Attempt=$attempt;State=$state;Record=$record;Leaf=$file.Name})
     }
-    $groups = @($entries | Group-Object Attempt | Sort-Object {[uint64]$_.Name})
-    [uint64]$expectedAttempt = 1
-    for ($index=0; $index -lt $groups.Count; $index++) {
-        $group = $groups[$index]
-        if ([uint64]$group.Name -ne $expectedAttempt) { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence history has a sequence gap' $directory }
-        $pending = @($group.Group | Where-Object {$_.State -ceq 'Pending'})
-        $completed = @($group.Group | Where-Object {$_.State -ceq 'Completed'})
-        if ($pending.Count -ne 1 -or $completed.Count -gt 1 -or ($index -lt $groups.Count-1 -and $completed.Count -ne 1)) {
-            Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence history has an invalid state transition' $directory
-        }
-        if ($completed.Count -eq 1) {
-            foreach ($field in @('transactionId','runtimeId','runtimeGeneration','manifestSha256','packageSha256','ownerPid','ownerCreationTimeUtc','ownerSid')) {
-                if ([string]$pending[0].Record.$field -cne [string]$completed[0].Record.$field) {
-                    Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup completion changed immutable fence identity' $completed[0].Leaf
+    foreach ($transactionGroup in @($entries | Group-Object {$_.Record.transactionId})) {
+        $transactionEntries = @($transactionGroup.Group)
+        $identity = $transactionEntries[0].Record
+        foreach ($entry in $transactionEntries) {
+            foreach ($field in @('transactionId','runtimeId','runtimeGeneration','manifestSha256','packageSha256')) {
+                if ([string]$entry.Record.$field -cne [string]$identity.$field) {
+                    Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup transaction history changed immutable Ready identity' $entry.Leaf
+                }
+            }
+        }
+        $attemptGroups = @($transactionEntries | Group-Object Attempt | Sort-Object {[uint64]$_.Name})
+        [uint64]$expectedAttempt = 1
+        for ($index=0; $index -lt $attemptGroups.Count; $index++) {
+            $group = $attemptGroups[$index]
+            if ([uint64]$group.Name -ne $expectedAttempt) { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup transaction history has a sequence gap' $directory }
+            $pending = @($group.Group | Where-Object {$_.State -ceq 'Pending'})
+            $completed = @($group.Group | Where-Object {$_.State -ceq 'Completed'})
+            if ($pending.Count -ne 1 -or $completed.Count -gt 1 -or ($index -lt $attemptGroups.Count-1 -and $completed.Count -ne 1)) {
+                Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup transaction history has an invalid state transition' $directory
+            }
+            if ($completed.Count -eq 1) {
+                foreach ($field in @('transactionId','runtimeId','runtimeGeneration','manifestSha256','packageSha256','ownerPid','ownerCreationTimeUtc','ownerSid')) {
+                    if ([string]$pending[0].Record.$field -cne [string]$completed[0].Record.$field) {
+                        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup completion changed immutable fence identity' $completed[0].Leaf
+                    }
                 }
             }
+            $expectedAttempt++
         }
-        $expectedAttempt++
     }
-    return @($entries | Sort-Object @{Expression={[uint64]$_.Attempt}},@{Expression={if($_.State-ceq'Pending'){0}else{1}}})
+    foreach ($entry in @($entries | Where-Object {$_.Record.transactionId -ceq $ReadyTransaction.transactionId})) {
+        [void](Assert-CcodLifecycleProductCleanupRecord -Record $entry.Record -ReadyTransaction $ReadyTransaction -ExpectedState $entry.State)
+    }
+    return @($entries | Sort-Object @{Expression={$_.Record.transactionId}},@{Expression={[uint64]$_.Attempt}},@{Expression={if($_.State-ceq'Pending'){0}else{1}}})
+}
+
+function Assert-CcodLifecycleNoForeignProductCleanupPending {
+    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$History,[Parameter(Mandatory)][string]$TransactionId)
+    foreach ($group in @($History | Where-Object {$_.Record.transactionId -cne $TransactionId} | Group-Object {$_.Record.transactionId})) {
+        $ordered = @($group.Group | Sort-Object @{Expression={[uint64]$_.Attempt}},@{Expression={if($_.State-ceq'Pending'){0}else{1}}})
+        if ($ordered.Count -gt 0 -and $ordered[-1].State -ceq 'Pending') {
+            Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'A different product cleanup transaction remains Pending' $ordered[-1].Leaf
+        }
+    }
+    return $true
 }
 
 function Write-CcodLifecycleProductCleanupRecord {
@@ -305,7 +336,9 @@ function Complete-CcodLifecycleProductCleanupFence {
         state = $Outcome
     }
     [void](Assert-CcodLifecycleProductCleanupRecord -Record $record -ReadyTransaction $Fence.ReadyTransaction -ExpectedState $Outcome)
-    $history = @(Read-CcodLifecycleProductCleanupFenceHistory -InstallRoot $root -ReadyTransaction $Fence.ReadyTransaction)
+    $allHistory = @(Read-CcodLifecycleProductCleanupFenceHistory -InstallRoot $root -ReadyTransaction $Fence.ReadyTransaction)
+    [void](Assert-CcodLifecycleNoForeignProductCleanupPending -History $allHistory -TransactionId $record.transactionId)
+    $history = @($allHistory | Where-Object {$_.Record.transactionId -ceq $record.transactionId})
     $existing = @($history | Where-Object {[uint64]$_.Attempt -eq [uint64]$Fence.Attempt -and $_.State -ceq $Outcome})
     if ($existing.Count -eq 1) { return $existing[0].Record }
     if ($existing.Count -ne 0) { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence outcome is ambiguous' $Fence.Attempt }
@@ -322,7 +355,7 @@ function Complete-CcodLifecycleProductCleanupFence {
     }
     $leaf = Get-CcodLifecycleProductCleanupFenceLeaf -Attempt ([uint64]$Fence.Attempt) -State $Outcome -TransactionId $record.transactionId
     Write-CcodLifecycleProductCleanupRecord -InstallRoot $root -Leaf $leaf -Record $record
-    $observed = @(Read-CcodLifecycleProductCleanupFenceHistory -InstallRoot $root -ReadyTransaction $Fence.ReadyTransaction | Where-Object {[uint64]$_.Attempt -eq [uint64]$Fence.Attempt -and $_.State -ceq $Outcome})
+    $observed = @(Read-CcodLifecycleProductCleanupFenceHistory -InstallRoot $root -ReadyTransaction $Fence.ReadyTransaction | Where-Object {$_.Record.transactionId -ceq $record.transactionId -and [uint64]$_.Attempt -eq [uint64]$Fence.Attempt -and $_.State -ceq $Outcome})
     if ($observed.Count -ne 1) { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Durable product cleanup append is not exactly visible' $leaf }
     return $observed[0].Record
 }
@@ -333,7 +366,9 @@ function New-CcodLifecycleProductCleanupFence {
     $root = Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
     [void](Assert-CcodLifecycleProductCleanupIdentity $OwnerIdentity)
     [void](Assert-CcodLifecycleProductCleanupReadyAuthority -InstallRoot $root -ReadyTransaction $ReadyTransaction)
-    $history = @(Read-CcodLifecycleProductCleanupFenceHistory -InstallRoot $root -ReadyTransaction $ReadyTransaction)
+    $allHistory = @(Read-CcodLifecycleProductCleanupFenceHistory -InstallRoot $root -ReadyTransaction $ReadyTransaction)
+    [void](Assert-CcodLifecycleNoForeignProductCleanupPending -History $allHistory -TransactionId $ReadyTransaction.transactionId)
+    $history = @($allHistory | Where-Object {$_.Record.transactionId -ceq $ReadyTransaction.transactionId})
     if ($history.Count -gt 0 -and $history[-1].State -cne 'Completed') {
         Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'A prior product cleanup fence remains Pending' $history[-1].Leaf
     }
@@ -376,7 +411,9 @@ function Resolve-CcodLifecycleProductCleanupFence {
     [void](Assert-CcodLifecycleProductCleanupIdentity $CurrentIdentity)
     $root = Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
     [void](Assert-CcodLifecycleProductCleanupReadyAuthority -InstallRoot $root -ReadyTransaction $ReadyTransaction)
-    $history = @(Read-CcodLifecycleProductCleanupFenceHistory -InstallRoot $root -ReadyTransaction $ReadyTransaction)
+    $allHistory = @(Read-CcodLifecycleProductCleanupFenceHistory -InstallRoot $root -ReadyTransaction $ReadyTransaction)
+    [void](Assert-CcodLifecycleNoForeignProductCleanupPending -History $allHistory -TransactionId $ReadyTransaction.transactionId)
+    $history = @($allHistory | Where-Object {$_.Record.transactionId -ceq $ReadyTransaction.transactionId})
     $key = Get-CcodLifecycleProductCleanupKey -InstallRoot $root
     if ($history.Count -eq 0 -or $history[-1].State -ceq 'Completed') {
         if ($script:CcodPendingProductTransactionCleanups.ContainsKey($key)) { [void]$script:CcodPendingProductTransactionCleanups.Remove($key) }
@@ -396,9 +433,22 @@ function Resolve-CcodLifecycleProductCleanupFence {
             Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Pending product cleanup is live but its thread-bound capability is unavailable here' $root
         }
         if (-not $entry.CloseCompleted) {
-            if ($null -eq $entry.Transaction -or $entry.CloseProductTransaction -isnot [scriptblock] -or $entry.DefaultClose -isnot [scriptblock]) {
+            if ($entry.CloseProductTransaction -isnot [scriptblock] -or $entry.DefaultClose -isnot [scriptblock]) {
                 Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Pending product cleanup capability is invalid' $root
             }
+            if ($null -eq $entry.Transaction) {
+                $fileModule = Get-CcodLifecycleInstallFileTransactionModule
+                try {
+                    $entry.Transaction = &$fileModule {param($Root,$Record)Open-CcodInstallProductRegistrationTransaction -InstallRoot $Root -ReadyTransaction $Record} $root $ReadyTransaction
+                    [void](&$fileModule {param($Transaction,$Fence)Set-CcodInstallProductCleanupFence -Transaction $Transaction -Fence $Fence} $entry.Transaction $entry.Fence)
+                } catch {
+                    if ($null -ne $entry.Transaction) {
+                        try { &$fileModule {param($Transaction)Close-CcodInstallFileTransaction -Transaction $Transaction -Disposition Failed} $entry.Transaction } catch { }
+                        $entry.Transaction = $null
+                    }
+                    Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Pending product cleanup could not open fresh strict authority' $root
+                }
+            }
             try { Invoke-CcodLifecycleProductTransactionClose -Transaction $entry.Transaction -CloseProductTransaction $entry.CloseProductTransaction -DefaultClose $entry.DefaultClose }
             catch { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Pending product transaction cleanup remains retryable' $root }
             $entry.CloseCompleted = $true
@@ -2381,7 +2431,7 @@ function Get-CcodLifecycleAdapters {
                     DefaultClose=$defaultClose
                     CloseProductTransaction=$CloseProductTransaction
                     OwnerManagedThreadId=[Threading.Thread]::CurrentThread.ManagedThreadId
-                    CloseCompleted=$true
+                    CloseCompleted=$false
                 }
                 $script:CcodPendingProductTransactionCleanups[$cleanupKey]=$cleanupEntry
                 $operationFailure=$null;$closeFailure=$null;$completionFailure=$null;$receiptResult=$null
@@ -2407,7 +2457,7 @@ function Get-CcodLifecycleAdapters {
                 }
                 if($null-ne$closeFailure){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product transaction cleanup failed after registration and requires same-thread reconciliation' $InstallRoot}
                 if($null-ne$completionFailure){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product transaction closed but durable completion could not be appended' $InstallRoot}
-                if($null-ne$operationFailure){throw $operationFailure}
+                if($null-ne$operationFailure){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product registration failed while durable cleanup remained fail closed' $InstallRoot}
                 if($null-eq$receiptResult-or$receiptResult.verified-isnot[bool]-or-not$receiptResult.verified){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product registration receipt is invalid after exact cleanup completion' $InstallRoot}
                 return $receiptResult
             }finally{
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index d495a67..cc7f78f 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -389,6 +389,31 @@ function Clear-CcodLifecycleLowerProductCloseFixture {
     if($null-ne$FileModule){&$FileModule {$script:CcodInstallFileTransactionLowerCloseForTest=$null}}
 }
 
+function Set-CcodLifecycleProductOpenFailureFixture {
+    param([Parameter(Mandatory)][hashtable]$State)
+    $modulePath=Join-Path $repositoryRoot 'src\persistence\modules\InstallFileTransaction.psm1'
+    $fileModule=(Get-Command Close-CcodInstallFileTransaction -ErrorAction SilentlyContinue).Module
+    if($null-ne$fileModule-and($null-eq$fileModule.Path-or[IO.Path]::GetFullPath($fileModule.Path)-cne[IO.Path]::GetFullPath($modulePath))){$fileModule=$null}
+    if($null-eq$fileModule){$fileModule=Import-Module $modulePath -PassThru -DisableNameChecking -ErrorAction Stop}
+    $State.Attempts=0
+    $original=&$fileModule {(Get-Command Invoke-CcodRuntimeStatic -CommandType Function -ErrorAction Stop).ScriptBlock}
+    $replacement={
+        param([string]$Name,[object[]]$Arguments)
+        if($Name-ceq'OpenProduct'){
+            $State.Attempts++
+            if([int]$State.FailuresRemaining-gt0){$State.FailuresRemaining=[int]$State.FailuresRemaining-1;throw [IO.IOException]::new('injected strict product open failure')}
+        }
+        &$original $Name $Arguments
+    }.GetNewClosure()
+    &$fileModule {param($Invoke)Set-Item -LiteralPath Function:\script:Invoke-CcodRuntimeStatic -Value $Invoke} $replacement
+    return [pscustomobject]@{Module=$fileModule;Original=$original}
+}
+
+function Clear-CcodLifecycleProductOpenFailureFixture {
+    param($Fixture)
+    if($null-ne$Fixture){&$Fixture.Module {param($Invoke)Set-Item -LiteralPath Function:\script:Invoke-CcodRuntimeStatic -Value $Invoke} $Fixture.Original}
+}
+
 function Get-CcodLifecycleProductCleanupTestRecords {
     param([Parameter(Mandatory)][string]$InstallRoot)
     $directory=Join-Path $InstallRoot 'state\product-cleanup-fences'
@@ -3527,6 +3552,125 @@ $results += Invoke-CcodTest 'dead-owner Pending fence requires fresh strict clea
     Invoke-CcodLifecycleDeadOwnerCleanupTest
 }
 
+# Production mutation caught: initializing cleanup as complete before strict OpenProduct lets an open failure append a false Completed fence.
+$results += Invoke-CcodTest 'strict product open failure retains Pending and later reconciles before verified success' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    $openFixture=$null
+    try{
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null;$node=New-CcodLifecycleFakeNode -Root $nodeRoot;$fake=New-CcodLifecycleFake -NodePath $node
+        $productState=@{FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{}};Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $fake -ProductState $productState
+        $fake.Adapters.RegisterProduct={param($InstallRoot,$RuntimeId,$Version,$PackageSha256,$FileTransaction,$TransactionRecord)[pscustomobject]@{verified=$true;legacyRemoved=$true}}
+        $null=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('c'*64) -Adapters $fake.Adapters
+        [void]$fake.Adapters.Remove('RegisterProduct')
+        $openState=@{FailuresRemaining=1};$openFixture=Set-CcodLifecycleProductOpenFailureFixture -State $openState
+        $unexpectedReceipt=$null;$failure=$null
+        try{$unexpectedReceipt=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('c'*64) -Adapters $fake.Adapters}catch{$failure=$_}
+        Assert-CcodEqual $null $unexpectedReceipt 'strict product open failure emits no verified registration receipt'
+        $records=@(Get-CcodLifecycleProductCleanupTestRecords -InstallRoot $install)
+        Assert-CcodEqual 1 $records.Count 'strict product open failure leaves only its durable Pending record'
+        Assert-CcodEqual 'Pending' $records[0].State 'strict product open failure never appends Completed without an opened transaction'
+        Assert-CcodEqual 'CCOD_PRODUCT_REGISTRATION_FAILED' (([string]$failure.FullyQualifiedErrorId-split',')[0]) 'strict product open failure is normalized to the stable product registration error'
+        Assert-CcodEqual 1 $openState.Attempts 'failed registration makes exactly one strict product open attempt'
+        Assert-CcodEqual 0 $productState.Writes 'strict product open failure performs no product write'
+        Assert-CcodEqual 0 $productState.ShortcutWrites 'strict product open failure performs no shortcut write'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Failed.*.json' -File).Count 'strict product open failure appends no lifecycle Failed snapshot'
+
+        $retry=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('c'*64) -Adapters $fake.Adapters
+        Assert-CcodEqual 'AlreadyInstalled' $retry.Outcome 'same-package retry reconciles the open-failure Pending fence'
+        Assert-CcodTrue $retry.ProductRegistrationVerified 'same-package retry verifies only after exact strict cleanup and new registration close'
+        Assert-CcodEqual 3 $openState.Attempts 'retry opens once to reconcile the old Pending fence and once for new verification'
+        $records=@(Get-CcodLifecycleProductCleanupTestRecords -InstallRoot $install)
+        Assert-CcodEqual '1:Pending|1:Completed|2:Pending|2:Completed' (($records|ForEach-Object{"$($_.Attempt):$($_.State)"})-join '|') 'open-failure recovery preserves append-only exact cleanup history'
+    }finally{
+        Clear-CcodLifecycleProductOpenFailureFixture -Fixture $openFixture
+        foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}
+    }
+}
+
+# Production mutation caught: validating every historical record against the latest Ready transaction makes any completed prior version poison an upgrade.
+$results += Invoke-CcodTest 'completed cleanup history from an older Ready transaction permits new upgrade registration' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    try{
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null;$node=New-CcodLifecycleFakeNode -Root $nodeRoot;$firstFake=New-CcodLifecycleFake -NodePath $node
+        $firstProduct=@{FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{}};Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $firstFake -ProductState $firstProduct
+        $first=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $firstFake.Adapters
+        $module=Get-Module InstallLifecycle -ErrorAction Stop;$oldReady=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install
+        Assert-CcodEqual 'Installed' $first.Outcome 'first product version reaches Ready registration'
+        Assert-CcodEqual '1:Pending|1:Completed' ((@(Get-CcodLifecycleProductCleanupTestRecords -InstallRoot $install)|ForEach-Object{"$($_.Attempt):$($_.State)"})-join '|') 'first Ready transaction owns one complete cleanup attempt'
+        Set-CcodLifecycleTestStatus -InstallRoot $install -RuntimeId $first.RuntimeId
+        [IO.File]::WriteAllText((Join-Path $source 'src\runtime\main-payload.js'),"module.exports = 'fixture-upgrade-cleanup-history';`n",[Text.UTF8Encoding]::new($false))
+        $upgradeFake=New-CcodLifecycleFake -NodePath $node;$upgradeProduct=@{FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{}};Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $upgradeFake -ProductState $upgradeProduct
+        $upgrade=$null;$upgradeFailure=$null
+        try{$upgrade=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $upgradeFake.Adapters}catch{$upgradeFailure=$_}
+        $upgradeErrorId=if($null-eq$upgradeFailure){$null}else{([string]$upgradeFailure.FullyQualifiedErrorId-split',')[0]}
+        Assert-CcodEqual $null $upgradeErrorId 'older completed cleanup history is ignored for the new Ready attempt sequence'
+        Assert-CcodEqual 'Upgraded' $upgrade.Outcome 'new Ready transaction completes upgrade registration'
+        Assert-CcodTrue $upgrade.ProductRegistrationVerified 'new upgrade reports verified only after its own cleanup completion'
+        $newReady=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install
+        Assert-CcodTrue ($newReady.transactionId-cne$oldReady.transactionId) 'upgrade commits a distinct Ready transaction identity'
+        $records=@(Get-CcodLifecycleProductCleanupTestRecords -InstallRoot $install)
+        Assert-CcodEqual 4 $records.Count 'append-only history retains both transaction cleanup pairs'
+        $oldRecords=@($records|Where-Object{$_.Record.transactionId-ceq$oldReady.transactionId});$newRecords=@($records|Where-Object{$_.Record.transactionId-ceq$newReady.transactionId})
+        Assert-CcodEqual '1:Pending|1:Completed' (($oldRecords|ForEach-Object{"$($_.Attempt):$($_.State)"})-join '|') 'older transaction retains its independent attempt sequence'
+        Assert-CcodEqual '1:Pending|1:Completed' (($newRecords|ForEach-Object{"$($_.Attempt):$($_.State)"})-join '|') 'new transaction starts and completes its own attempt sequence'
+        Assert-CcodEqual 1 $upgradeProduct.Writes 'upgrade reaches the product write boundary once'
+        Assert-CcodEqual 2 $upgradeProduct.ShortcutWrites 'upgrade reaches both shortcut write boundaries'
+    }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}}
+}
+
+# Production mutation caught: filtering history solely to the new Ready identity would silently ignore an unresolved cleanup from the prior transaction.
+$results += Invoke-CcodTest 'unresolved Pending from an older transaction blocks new Ready registration fail closed' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    try{
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null;$node=New-CcodLifecycleFakeNode -Root $nodeRoot;$firstFake=New-CcodLifecycleFake -NodePath $node
+        $first=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $firstFake.Adapters
+        $module=Get-Module InstallLifecycle -ErrorAction Stop;$oldReady=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install;$owner=Get-CcodLifecycleCurrentProductCleanupTestIdentity
+        $outer=&$module {Enter-CcodLifecycleProductCleanupLease}
+        try{&$module {param($Root,$Ready,$Identity)[void](New-CcodLifecycleProductCleanupFence -InstallRoot $Root -ReadyTransaction $Ready -OwnerIdentity $Identity)} $install $oldReady $owner}
+        finally{&$module {param($Context)[void](Exit-CcodLifecycleProductCleanupLease -Context $Context)} $outer}
+        Set-CcodLifecycleTestStatus -InstallRoot $install -RuntimeId $first.RuntimeId
+        [IO.File]::WriteAllText((Join-Path $source 'src\runtime\main-payload.js'),"module.exports = 'fixture-upgrade-prior-pending';`n",[Text.UTF8Encoding]::new($false))
+        $upgradeFake=New-CcodLifecycleFake -NodePath $node;$upgradeProduct=@{FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{}};Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $upgradeFake -ProductState $upgradeProduct
+        $unexpectedReceipt=$null;$failure=$null
+        try{$unexpectedReceipt=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $upgradeFake.Adapters}catch{$failure=$_}
+        Assert-CcodEqual $null $unexpectedReceipt 'prior-transaction Pending emits no verified upgrade receipt'
+        Assert-CcodEqual 'CCOD_PRODUCT_REGISTRATION_FAILED' (([string]$failure.FullyQualifiedErrorId-split',')[0]) 'prior-transaction Pending blocks with the stable product registration error'
+        Assert-CcodEqual 0 $upgradeProduct.Writes 'prior-transaction Pending blocks before product writes'
+        Assert-CcodEqual 0 $upgradeProduct.ShortcutWrites 'prior-transaction Pending blocks before shortcut writes'
+        $newReady=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install
+        Assert-CcodTrue ($newReady.transactionId-cne$oldReady.transactionId) 'upgrade lifecycle remains durably Ready under a distinct transaction'
+        $records=@(Get-CcodLifecycleProductCleanupTestRecords -InstallRoot $install)
+        Assert-CcodEqual 1 $records.Count 'unresolved older Pending remains intact and no new fence is appended'
+        Assert-CcodEqual $oldReady.transactionId $records[0].Record.transactionId 'blocking Pending retains its original transaction identity'
+        Assert-CcodEqual 'Pending' $records[0].State 'blocking prior fence remains unresolved'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Failed.*.json' -File).Count 'prior Pending does not fabricate a lifecycle Failed snapshot'
+    }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}}
+}
+
+# Production mutation caught: accepting an extra cleanup member weakens the exact ten-field durable authority contract.
+$results += Invoke-CcodTest 'cleanup history rejects an unknown record field before product authority opens' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    try{
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null;$node=New-CcodLifecycleFakeNode -Root $nodeRoot;$fake=New-CcodLifecycleFake -NodePath $node
+        $productState=@{FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{}};Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $fake -ProductState $productState
+        $null=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('2'*64) -Adapters $fake.Adapters
+        $completed=@(Get-ChildItem -LiteralPath (Join-Path $install 'state\product-cleanup-fences') -Filter '*.Completed.*.json' -File)
+        Assert-CcodEqual 1 $completed.Count 'fixture starts from one valid completed cleanup record'
+        $record=(Get-Content -LiteralPath $completed[0].FullName -Raw)|ConvertFrom-Json
+        $mutated=[ordered]@{};foreach($property in $record.PSObject.Properties){$mutated[$property.Name]=$property.Value};$mutated['unknownFenceField']='rejected'
+        $completed[0].IsReadOnly=$false
+        [IO.File]::WriteAllText($completed[0].FullName,(($mutated|ConvertTo-Json -Depth 8 -Compress)+"`n"),[Text.UTF8Encoding]::new($false))
+        $completed[0].Refresh();$completed[0].IsReadOnly=$true
+        $productState.Writes=0;$productState.ShortcutWrites=0
+        $unexpectedReceipt=$null;$failure=$null
+        try{$unexpectedReceipt=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('2'*64) -Adapters $fake.Adapters}catch{$failure=$_}
+        Assert-CcodEqual $null $unexpectedReceipt 'unknown cleanup field emits no verified receipt'
+        Assert-CcodEqual 'CCOD_PRODUCT_REGISTRATION_FAILED' (([string]$failure.FullyQualifiedErrorId-split',')[0]) 'unknown cleanup field fails closed with the stable error'
+        Assert-CcodEqual 0 $productState.Writes 'unknown cleanup field blocks before product writes'
+        Assert-CcodEqual 0 $productState.ShortcutWrites 'unknown cleanup field blocks before shortcut writes'
+    }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}}
+}
+
 # Production mutation caught: releasing strict product authority after a lower close failure without a durable fence lets another process report verified registration.
 $results += Invoke-CcodTest 'live-owner durable product cleanup blocks another real process after mutex acquisition' {
     $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot;$markerRoot=New-CcodLifecycleTempRoot

From a4c632c23f06edd056f069cbd73d9d051b274ca3 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 14:20:09 +0800
Subject: [PATCH 115/187] docs: record cleanup fence fix evidence

---
 .../task-1-report.md                          | 113 ++++++++++++++++++
 1 file changed, 113 insertions(+)

diff --git a/.superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/task-1-report.md b/.superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/task-1-report.md
index a36699a..89eda37 100644
--- a/.superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/task-1-report.md
+++ b/.superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/task-1-report.md
@@ -147,3 +147,116 @@ temporary fixture state were the only real OS primitives exercised.
   durable Pending bind.
 - Full aggregate/release validation and Task 4 completion are outside this
   Task 1 report and remain for the plan's later independent verification.
+
+## Fix round 1: fail-closed strict open and transaction-partitioned history
+
+### Scope and implementation commit
+
+- Review base: `ffb5dd0` (`docs: record durable product cleanup evidence`).
+- Fix implementation: `79b4825244fe53b9af8d10bf2b7e4efae347c909`
+  (`fix: partition durable cleanup history`).
+- The implementation commit contains only:
+  - `src/persistence/modules/InstallLifecycle.psm1`
+  - `tests/persistence/InstallLifecycle.SelfTest.ps1`
+- The fix keeps every record under the exact ten-field validator and canonical
+  filename validator, validates Pending/Completed sequencing independently per
+  `transactionId`, binds current records to the exact current Ready identity,
+  ignores only fully completed foreign history, and blocks every unresolved
+  foreign Pending record.
+- A new Pending entry starts with `CloseCompleted = false`. A strict open
+  failure therefore retains Pending and cannot append Completed. A later
+  same-owner/same-thread call first opens, binds, and closes fresh strict
+  authority for that Pending fence before starting a new verification attempt.
+
+### RED evidence
+
+#### Strict product open failure
+
+- Command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1`
+- Exit: `1`.
+- Exact first failure:
+  `CCOD_SELFTEST_FAILED case=strict-product-open-failure-retains-Pending-and-later-reconciles-before-verified-success error=ASSERT_EQUAL`
+- Exact assertion:
+  `ASSERT_EQUAL: strict product open failure leaves only its durable Pending record expected=[1] actual=[2]`.
+- The test first created a production-shaped temporary Ready generation with
+  both sealed registration shortcut candidates, then used the existing
+  module-private native dispatcher boundary to fail only `OpenProduct` after
+  Pending publication. It observed no returned receipt or real product action.
+
+#### Completed older transaction poisoning a new Ready upgrade
+
+- Targeted Windows PowerShell execution loaded lines 1-681 (imports and helper
+  definitions) from the checked-in lifecycle self-test, parsed the same file
+  with the PowerShell AST, selected the exact test named
+  `completed cleanup history from an older Ready transaction permits new upgrade registration`,
+  and invoked its checked-in scriptblock. The runner was passed through
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand` using
+  UTF-16LE solely to preserve shell quoting.
+- Exit: `1`.
+- Exact valid failure:
+  `ASSERT_EQUAL: older completed cleanup history is ignored for the new Ready attempt sequence expected=[] actual=[CCOD_PRODUCT_REGISTRATION_FAILED]`.
+- The valid fixture kept project version `2.5.22` and the same computed package
+  hash, changed a sealed payload byte to create a distinct runtime and Ready
+  transaction, and started with the prior Ready transaction's complete
+  Pending/Completed history. Thus failure occurred at fence-history validation,
+  not package identity or adapter setup.
+- An earlier same-version/different-explicit-hash attempt stopped at
+  `CCOD_INSTALL_PACKAGE_CONFLICT`, and an interim `2.5.23` attempt skipped the
+  version-gated product-registration path. Neither was counted as RED evidence.
+
+#### Prior Pending preservation
+
+- The same targeted runner selected
+  `unresolved Pending from an older transaction blocks new Ready registration fail closed`.
+- Before the production fix it exited `0` and printed
+  `TARGETED_PRIOR_PENDING_PASS`: the pre-existing behavior blocked, performed
+  zero product and shortcut writes, emitted no receipt, retained the foreign
+  Pending record, and appended no lifecycle Failed snapshot. This was retained
+  as a must-stay-green regression while completed history was partitioned.
+
+### GREEN evidence
+
+- Targeted strict-open runner: exit `0`,
+  `TARGETED_STRICT_OPEN_GREEN`.
+- Targeted completed-history upgrade runner: exit `0`,
+  `TARGETED_UPGRADE_HISTORY_GREEN`.
+- Targeted prior-Pending runner: exit `0`,
+  `TARGETED_PRIOR_PENDING_GREEN`.
+- The direct unknown-field negative is included in the full lifecycle suite. It
+  temporarily clears and restores the read-only bit only on its temporary test
+  fence, adds `unknownFenceField`, and proves default registration fails closed
+  before product writes. A first attempt to overwrite the still-read-only file
+  was rejected as fixture setup failure and was not counted as behavior evidence.
+
+#### Full focused suites
+
+- Command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1`
+- Exit: `0`.
+- Result: `Install lifecycle self-tests passed: 126`.
+- Exact cross-process observation remained:
+  `CCOD_CROSS_PROCESS_OBSERVED exit=23 mutex=True authority=False product=False verified=False error=CCOD_PRODUCT_REGISTRATION_FAILED`.
+- Command:
+  `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Exit: `0`.
+- Result: all `34/34` named cases printed `True`, followed by
+  `Install file transaction self-test passed.`
+
+#### Parser and diff
+
+- Parsed the two production modules and two focused self-tests with
+  `[System.Management.Automation.Language.Parser]::ParseFile`.
+- Exit: `0`; output: `PowerShell parser passed: 4/4`.
+- Command: `git diff --check`.
+- Exit: `0`; output: `git diff --check passed`, plus only Git checkout
+  LF-to-CRLF warnings.
+
+### No-real-action and remaining boundary
+
+No real registry, Start-menu/Desktop shortcut, installer, uninstaller,
+installed product, product process, network, release, push, tag, signing,
+installation, restart, or reboot action was performed. All product effects were
+temporary in-memory or marker-file adapters. This fix round is ready for scoped
+re-review; it does not claim Task 1, Task 4, aggregate validation, or release
+readiness complete.

From da72b912a17f415ba1f7c6dbb52212a2d54c170d Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 15:04:42 +0800
Subject: [PATCH 116/187] docs: record durable cleanup fence evidence

---
 .../task-2-report.md                          | 84 +++++++++++++++++++
 .../InstallFileTransaction.SelfTest.ps1       | 16 +++-
 2 files changed, 97 insertions(+), 3 deletions(-)
 create mode 100644 .superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/task-2-report.md

diff --git a/.superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/task-2-report.md b/.superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/task-2-report.md
new file mode 100644
index 0000000..27179d7
--- /dev/null
+++ b/.superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/task-2-report.md
@@ -0,0 +1,84 @@
+# Task 2 report: atomic real-mutex proof and final verification
+
+## Scope and review status
+
+Task 2 consumes Task 1's durable Pending/Completed cleanup fence without
+changing Task 1 production behavior.  The only final source change is the
+atomic-proof test in `tests/persistence/InstallFileTransaction.SelfTest.ps1`.
+`KernelObjects.psm1` is unchanged.  This report records evidence for fresh
+independent review; it makes no release-readiness claim.
+
+## Atomic protocol
+
+The parent opens N under the Task 1 real outer `AccountTransition` lease,
+creates the exact durable Pending fence, and binds it to the strict product
+transaction.  The MTA child receives only paths and event name.  Its
+`EnterMutex` adapter calls the real `Enter-CcodMutex -Kind
+AccountTransition`; its only wait override is:
+
+```powershell
+[Threading.WaitHandle]::SignalAndWait($enteredActualWaitEvent,$mutexHandle,15000,$false)
+```
+
+After the parent observes that signal it proves that N+1 has neither written
+its result nor exited, opens N's retained shortcut, closes N's strict product
+authority, and completes N's durable fence.  It then proves N+1 remains
+blocked while N's outer lease is still live, releases that outer lease, and
+requires N+1 to commit generation 2.  The test also asserts that the closed N
+capability cannot be reused.
+
+## Temporary-mutation RED
+
+The only temporary mutation replaced the real `Enter-CcodMutex` call in
+`Enter-CcodLifecycleProductCleanupLease` with a shape-valid test lease having
+no mutex handle.  This removed only N's real *outer* lease.  It was restored
+immediately after the run; it is not present in the final diff.
+
+- Command: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File
+  tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Exit: `1`
+- Exact failure: `ASSERT_TRUE: N+1 commit remains blocked after N strict
+  authority closes while its durable outer AccountTransition lease is live`.
+
+This is the intended post-close blocked assertion.  Earlier test shaping
+attempts were rejected because removing the inner lease failed before the
+blocked assertion during retained/fence validation; the final test opens the
+retained generation only after the first blocked proof and tests the outer
+lease only after the inner strict authority is closed.  The accepted RED was
+not caused by STA, adapter loading, marker timing, or a mocked mutex.
+
+## Final GREEN and verification
+
+All commands below were fresh direct runs after production restoration.
+
+| Command | Exit | Result |
+|---|---:|---|
+| `tests\persistence\InstallFileTransaction.SelfTest.ps1` | 0 | `Install file transaction self-test passed.` |
+| `tests\persistence\KernelObjects.SelfTest.ps1` | 0 | 16 named cases passed; real cross-process mutex, ACL, timeout, abandoned, and same-thread-release cases included. |
+| `tests\persistence\ProductRegistration.SelfTest.ps1` | 0 | `Product registration self-tests passed: 13` |
+| `tests\persistence\UninstallBootstrap.SelfTest.ps1` | 0 | `Uninstall bootstrap self-tests passed: 23` |
+| `tests\persistence\InstallLifecycle.SelfTest.ps1` | 0 | `Install lifecycle self-tests passed: 126` |
+| `git diff --check` | 0 | no whitespace errors (only Git LF-to-CRLF checkout warnings) |
+| `tests\PersistenceSelfTest.ps1` | 0 | fresh tracked direct aggregate exit; no failure output |
+
+The lifecycle run retained Task 1's fail-closed cross-process observation:
+`exit=23 mutex=True authority=False product=False verified=False
+error=CCOD_PRODUCT_REGISTRATION_FAILED`.
+
+`[System.Management.Automation.Language.Parser]::ParseFile` parsed the one
+final changed PowerShell file successfully: `PowerShell parser passed: 1/1`.
+
+## No-real-action statement
+
+No real registry, Start-menu/Desktop shortcut, installer, uninstaller,
+installed product, product process, network, release, tag, signing, push,
+publication, installation, restart, or reboot action was performed.  Tests
+used temporary fixtures, marker adapters, named mutexes, and temporary event
+handles only.
+
+## Review request and remaining boundary
+
+Please perform fresh independent review of the final test diff and this
+evidence, with particular attention to the two post-signal blocked assertions
+and exact Task 1 fence ordering.  A green focused suite and aggregate are not
+release or installed-product acceptance evidence.
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index 66e33c0..59ad9b3 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -226,7 +226,7 @@ Invoke-CcodTest 'product authority rejects the canonical Ready to Failed post-te
 
 # Production mutation caught: selector proof without the committing install's AccountTransition lease permits N+1 to commit across N proof/use.
 Invoke-CcodTest 'product authority holds the real commit coordination lease across proof and retained-file use' {
-    $authority=New-CcodProductAuthorityFixture;$fixture=$authority.Fixture;$product=$null;$commitProcess=$null;$attemptEvent=$null
+    $authority=New-CcodProductAuthorityFixture;$fixture=$authority.Fixture;$product=$null;$outer=$null;$fence=$null;$lifecycleModule=$null;$commitProcess=$null;$attemptEvent=$null
     $attemptEventName='Local\CcodInstallProductAuthorityAttempt.'+[guid]::NewGuid().ToString('N');$eventCreated=$false;$attemptEvent=[Threading.EventWaitHandle]::new($false,[Threading.EventResetMode]::ManualReset,$attemptEventName,[ref]$eventCreated)
     Assert-CcodTrue $eventCreated 'atomic attempt event is create-only for this test'
     $resultPath=Join-Path $fixture.Base 'commit-result.json';$stdout=Join-Path $fixture.Base 'commit.stdout.txt';$stderr=Join-Path $fixture.Base 'commit.stderr.txt';$childScript=Join-Path $fixture.Base 'commit-next-generation.ps1'
@@ -263,21 +263,31 @@ finally{if($null-ne$ownership){try{&$epochModule {param($Owner)Exit-CcodLifecycl
 '@
     [IO.File]::WriteAllText($childScript,$child,[Text.UTF8Encoding]::new($false))
     try{
+        $lifecycleModule=Import-Module (Join-Path $projectRoot 'src\persistence\modules\InstallLifecycle.psm1') -Force -PassThru -DisableNameChecking
+        $outer=&$lifecycleModule {Enter-CcodLifecycleProductCleanupLease}
+        $owner=&$lifecycleModule {Get-CcodLifecycleCurrentProductCleanupIdentity}
+        $fence=&$lifecycleModule {param($Root,$Ready,$Owner)New-CcodLifecycleProductCleanupFence -InstallRoot $Root -ReadyTransaction $Ready -OwnerIdentity $Owner} $fixture.Install $authority.Ready $owner
         $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $authority.Ready;$fixture.Transactions.Add($product)
-        $retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $authority.RuntimeId -ExpectedManifestSha256 $authority.Manifest.Sha256 -FileTransaction $product
+        &$module {param($Transaction,$Fence)Set-CcodInstallProductCleanupFence -Transaction $Transaction -Fence $Fence|Out-Null} $product $fence
         $powershell=(Get-Process -Id $PID).Path
         $commitProcess=Start-Process -FilePath $powershell -ArgumentList @('-Mta','-NoProfile','-ExecutionPolicy','Bypass','-File',$childScript,'-ModuleRoot',$moduleRoot,'-InstallRoot',$fixture.Install,'-CurrentRuntime',$authority.RuntimeId,'-NextRuntime',$nextRuntime,'-AttemptEventName',$attemptEventName,'-ResultPath',$resultPath) -WindowStyle Hidden -RedirectStandardOutput $stdout -RedirectStandardError $stderr -PassThru
         if(-not$attemptEvent.WaitOne(20000)){if(-not$commitProcess.HasExited){Stop-Process -Id $commitProcess.Id -Force};$commitProcess.WaitForExit();throw "real N+1 commit child did not atomically enter the AccountTransition wait: $($(if([IO.File]::Exists($stderr)){[IO.File]::ReadAllText($stderr)}else{'no stderr'}))"}
         $commitBlocked=$true;$watch=[Diagnostics.Stopwatch]::StartNew();while($watch.ElapsedMilliseconds-lt5000){if([IO.File]::Exists($resultPath)-or$commitProcess.HasExited){$commitBlocked=$false;break};Start-Sleep -Milliseconds 20};$watch.Stop()
         Assert-CcodTrue $commitBlocked 'N+1 commit is blocked after its atomic real AccountTransition wait signal'
+        $retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $authority.RuntimeId -ExpectedManifestSha256 $authority.Manifest.Sha256 -FileTransaction $product
         if($commitBlocked){$opened=Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyTransaction $authority.Ready;Assert-CcodTrue ($null-ne$opened) 'N retained shortcut opens while its authority lease excludes N+1'}
-        Close-CcodInstallFileTransaction -Transaction $product -Disposition Failed
+        Close-CcodInstallFileTransaction -Transaction $product -Disposition Ready
+        &$lifecycleModule {param($Fence)Complete-CcodLifecycleProductCleanupFence -Fence $Fence -Outcome Completed|Out-Null} $fence
+        $commitBlockedAfterNClose=$true;$watch=[Diagnostics.Stopwatch]::StartNew();while($watch.ElapsedMilliseconds-lt5000){if([IO.File]::Exists($resultPath)-or$commitProcess.HasExited){$commitBlockedAfterNClose=$false;break};Start-Sleep -Milliseconds 20};$watch.Stop()
+        Assert-CcodTrue $commitBlockedAfterNClose 'N+1 commit remains blocked after N strict authority closes while its durable outer AccountTransition lease is live'
+        &$lifecycleModule {param($Context)Exit-CcodLifecycleProductCleanupLease -Context $Context|Out-Null} $outer;$outer=$null
         if(-not$commitProcess.WaitForExit(20000)){Stop-Process -Id $commitProcess.Id -Force;throw 'real N+1 commit child timed out'}
         $commitProcess.Refresh();if(-not[IO.File]::Exists($resultPath)){throw "real N+1 commit child produced no committed pointer exit=$($commitProcess.ExitCode) stdout=$([IO.File]::ReadAllText($stdout)) stderr=$([IO.File]::ReadAllText($stderr))"}
         $pointer=[IO.File]::ReadAllText($resultPath)|ConvertFrom-Json;Assert-CcodEqual 2 ([uint64]$pointer.generation) 'real commit advances to N+1 only after N authority closes'
         Assert-CcodThrows {Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyTransaction $authority.Ready|Out-Null} 'CCOD_INSTALL_TRANSACTION_CLOSED'
     }finally{
         if($null-ne$commitProcess-and-not$commitProcess.HasExited){try{Stop-Process -Id $commitProcess.Id -Force}catch{}};if($null-ne$commitProcess){$commitProcess.Dispose()}
+        if($null-ne$outer){try{&$lifecycleModule {param($Context)Exit-CcodLifecycleProductCleanupLease -Context $Context|Out-Null} $outer}catch{}}
         if($null-ne$attemptEvent){$attemptEvent.Dispose()}
         Remove-CcodInstallFileFixture $fixture
     }

From b1aec464b255661596d19c6a5d2bdb6ead4a7003 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 15:17:58 +0800
Subject: [PATCH 117/187] test: reject stale Ready product authority

---
 .../task-2-report.md                          | 34 +++++++++++++++++++
 .../InstallFileTransaction.SelfTest.ps1       |  1 +
 2 files changed, 35 insertions(+)

diff --git a/.superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/task-2-report.md b/.superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/task-2-report.md
index 27179d7..2c8f4c8 100644
--- a/.superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/task-2-report.md
+++ b/.superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/task-2-report.md
@@ -27,6 +27,35 @@ blocked while N's outer lease is still live, releases that outer lease, and
 requires N+1 to commit generation 2.  The test also asserts that the closed N
 capability cannot be reused.
 
+## Fix round 1: fresh stale-N Ready authority
+
+After N+1 commits, the test now separately invokes a **fresh**
+`Open-CcodInstallProductRegistrationTransaction` with N's exact old Ready
+record and requires `CCOD_INSTALL_PRODUCT_SCOPE`.  If a transaction were
+returned, the test closes that temporary transaction with `Failed` before the
+assertion reports failure, so the negative probe cannot strand an authority
+lease.  This validates latest-pointer/canonical-head authority selection; the
+existing `CCOD_INSTALL_TRANSACTION_CLOSED` assertion remains separately tied
+to reusing the already-closed N capability.
+
+### Fix-round temporary-mutation RED
+
+The temporary IFT-only mutation omitted the selected-pointer stale rejection
+and, only when the latest pointer generation was newer than the supplied Ready
+generation, skipped the matching canonical-head rejection.  Same-generation
+Prepared/Failed rejection remained active.  It was restored fully before
+GREEN.
+
+- Command: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File
+  tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- Exit: `1`
+- Exact failure: `ASSERT_THROWS: expected CCOD_INSTALL_PRODUCT_SCOPE` in
+  `product-authority-holds-the-real-commit-coordination-lease-across-proof-and-retained-file-use`.
+
+Thus the new assertion demonstrably detects a stale-N selector/head removal;
+the first failure was its own fresh-open boundary, not a pre-existing
+same-generation lifecycle-head test.
+
 ## Temporary-mutation RED
 
 The only temporary mutation replaced the real `Enter-CcodMutex` call in
@@ -51,6 +80,11 @@ not caused by STA, adapter loading, marker timing, or a mocked mutex.
 
 All commands below were fresh direct runs after production restoration.
 
+Fix-round focused command:
+`powershell.exe -NoProfile -ExecutionPolicy Bypass -File
+tests\persistence\InstallFileTransaction.SelfTest.ps1` exited `0` and printed
+`Install file transaction self-test passed.`
+
 | Command | Exit | Result |
 |---|---:|---|
 | `tests\persistence\InstallFileTransaction.SelfTest.ps1` | 0 | `Install file transaction self-test passed.` |
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index 59ad9b3..0b1c66a 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -284,6 +284,7 @@ finally{if($null-ne$ownership){try{&$epochModule {param($Owner)Exit-CcodLifecycl
         if(-not$commitProcess.WaitForExit(20000)){Stop-Process -Id $commitProcess.Id -Force;throw 'real N+1 commit child timed out'}
         $commitProcess.Refresh();if(-not[IO.File]::Exists($resultPath)){throw "real N+1 commit child produced no committed pointer exit=$($commitProcess.ExitCode) stdout=$([IO.File]::ReadAllText($stdout)) stderr=$([IO.File]::ReadAllText($stderr))"}
         $pointer=[IO.File]::ReadAllText($resultPath)|ConvertFrom-Json;Assert-CcodEqual 2 ([uint64]$pointer.generation) 'real commit advances to N+1 only after N authority closes'
+        Assert-CcodThrows {$stale=$null;try{$stale=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $authority.Ready}finally{if($null-ne$stale){Close-CcodInstallFileTransaction -Transaction $stale -Disposition Failed|Out-Null}}} 'CCOD_INSTALL_PRODUCT_SCOPE'
         Assert-CcodThrows {Open-CcodInstallRetainedFile -Generation $retained -RelativePath 'registration/StartMenu.CodexRemote-fix.lnk' -ReadyTransaction $authority.Ready|Out-Null} 'CCOD_INSTALL_TRANSACTION_CLOSED'
     }finally{
         if($null-ne$commitProcess-and-not$commitProcess.HasExited){try{Stop-Process -Id $commitProcess.Id -Force}catch{}};if($null-ne$commitProcess){$commitProcess.Dispose()}

From 9e00ccf3ce4fb1f5e2f1e80c415c8fd787b71509 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 17:12:32 +0800
Subject: [PATCH 118/187] fix: close durable cleanup recovery gaps

---
 src/persistence/modules/InstallLifecycle.psm1 | 201 +++++++++++++++++-
 .../InstallFileTransaction.SelfTest.ps1       |  50 +++++
 .../persistence/InstallLifecycle.SelfTest.ps1 | 130 +++++++++--
 3 files changed, 360 insertions(+), 21 deletions(-)

diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index 5f88774..9e9eb67 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -213,8 +213,151 @@ function Get-CcodLifecycleProductCleanupFenceLeaf {
     return ('{0:D20}.{1}.{2}.json' -f $Attempt,$State,$TransactionId)
 }
 
+function Initialize-CcodLifecycleProductCleanupOrphanRuntime {
+    $marker = 'CcodProductCleanupOrphanCapabilityMarkerV1' -as [type]
+    if ($null -eq $marker) {
+        Add-Type -TypeDefinition @'
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+
+public sealed class CcodProductCleanupOrphanCapabilityMarkerV1
+{
+    private CcodProductCleanupOrphanCapabilityMarkerV1() { }
+    public static int CapabilityAbi { get { return 1; } }
+}
+
+internal static class CcodProductCleanupOrphanRuntimeV1
+{
+    private const uint DELETE = 0x00010000, SYNCHRONIZE = 0x00100000;
+    private const uint READ_ATTRIBUTES = 0x80, WRITE_ATTRIBUTES = 0x100, LIST_DIRECTORY = 0x1;
+    private const uint SHARE_READ = 1, SHARE_WRITE = 2;
+    private const uint OPEN = 1, DIRECTORY = 1, SYNC_IO = 0x20, NON_DIRECTORY = 0x40, BACKUP_INTENT = 0x4000, OPEN_REPARSE = 0x200000;
+    private const uint OPEN_EXISTING = 3, FLAG_BACKUP = 0x02000000, FLAG_REPARSE = 0x00200000;
+    private const uint OBJ_CASE_INSENSITIVE = 0x40, ATTR_READONLY = 0x1, ATTR_DIRECTORY = 0x10, ATTR_REPARSE = 0x400, ATTR_NORMAL = 0x80;
+    private const int FileBasicInformation = 4, FileStreamInfo = 7, FileDirectoryInformation = 1, FileDispositionInformation = 13;
+    private const int STATUS_NO_MORE_FILES = unchecked((int)0x80000006);
+
+    [StructLayout(LayoutKind.Sequential)] private struct UNICODE_STRING { public ushort Length, MaximumLength; public IntPtr Buffer; }
+    [StructLayout(LayoutKind.Sequential)] private struct OBJECT_ATTRIBUTES { public int Length; public IntPtr RootDirectory, ObjectName; public uint Attributes; public IntPtr SecurityDescriptor, SecurityQualityOfService; }
+    [StructLayout(LayoutKind.Sequential)] private struct IO_STATUS_BLOCK { public IntPtr Status; public UIntPtr Information; }
+    [StructLayout(LayoutKind.Sequential)] private struct FILETIME_NATIVE { public uint Low, High; }
+    [StructLayout(LayoutKind.Sequential)] private struct FILE_INFO
+    {
+        public uint FileAttributes; public FILETIME_NATIVE CreationTime, LastAccessTime, LastWriteTime;
+        public uint VolumeSerialNumber, FileSizeHigh, FileSizeLow, NumberOfLinks, FileIndexHigh, FileIndexLow;
+    }
+
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] private static extern SafeFileHandle CreateFileW(string path,uint access,uint share,IntPtr security,uint creation,uint flags,IntPtr template);
+    [DllImport("kernel32.dll", SetLastError=true)] private static extern bool GetFileInformationByHandle(SafeFileHandle handle,out FILE_INFO info);
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] private static extern uint GetFinalPathNameByHandleW(SafeFileHandle handle,StringBuilder buffer,uint length,uint flags);
+    [DllImport("kernel32.dll", SetLastError=true)] private static extern bool GetFileInformationByHandleEx(SafeFileHandle handle,int infoClass,IntPtr info,uint size);
+    [DllImport("ntdll.dll")] private static extern int NtCreateFile(out IntPtr handle,uint access,ref OBJECT_ATTRIBUTES attributes,out IO_STATUS_BLOCK io,IntPtr allocationSize,uint fileAttributes,uint share,uint disposition,uint options,IntPtr ea,uint eaLength);
+    [DllImport("ntdll.dll")] private static extern int NtQueryDirectoryFile(SafeFileHandle handle,IntPtr evt,IntPtr apc,IntPtr context,out IO_STATUS_BLOCK io,IntPtr info,uint length,int infoClass,bool single,IntPtr name,bool restart);
+    [DllImport("ntdll.dll")] private static extern int NtSetInformationFile(SafeFileHandle handle,out IO_STATUS_BLOCK io,IntPtr info,uint length,int infoClass);
+    [DllImport("ntdll.dll")] private static extern uint RtlNtStatusToDosError(int status);
+
+    internal static bool Remove(string installRoot,string leaf)
+    {
+        if(!IsExactTemporaryLeaf(leaf))throw new InvalidDataException("temporary leaf name");
+        string rootPath=Path.GetFullPath(installRoot).TrimEnd('\\');
+        SafeFileHandle root=null,state=null,fences=null,file=null;
+        try
+        {
+            root=OpenAbsoluteDirectory(rootPath);ValidateDirectory(root,rootPath);
+            state=OpenRelative(root,"state",LIST_DIRECTORY|READ_ATTRIBUTES|SYNCHRONIZE,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);
+            string statePath=Path.Combine(rootPath,"state");ValidateDirectory(state,statePath);
+            fences=OpenRelative(state,"product-cleanup-fences",LIST_DIRECTORY|READ_ATTRIBUTES|SYNCHRONIZE,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);
+            string fencesPath=Path.Combine(statePath,"product-cleanup-fences");ValidateDirectory(fences,fencesPath);
+            file=OpenRelative(fences,leaf,DELETE|READ_ATTRIBUTES|WRITE_ATTRIBUTES|SYNCHRONIZE,0,OPEN,NON_DIRECTORY);
+            string filePath=Path.Combine(fencesPath,leaf);FILE_INFO before=Info(file);ValidatePlain(before,file);if(!SamePath(FinalPath(file),filePath))throw new InvalidDataException("temporary path changed");
+            if((before.FileAttributes&ATTR_READONLY)!=0)
+            {
+                uint attributes=before.FileAttributes&~ATTR_READONLY;if(attributes==0)attributes=ATTR_NORMAL;
+                SetAttributes(file,attributes);
+            }
+            FILE_INFO prepared=Info(file);ValidatePlain(prepared,file);if(!SameIdentity(before,prepared)||!SamePath(FinalPath(file),filePath))throw new InvalidDataException("temporary identity changed");
+            SetDelete(file);FILE_INFO armed=Info(file);ValidateDeleteArmed(armed,file);if(!SameIdentity(before,armed)||!SamePath(FinalPath(file),filePath))throw new InvalidDataException("temporary identity changed after delete disposition");
+            file.Dispose();file=null;
+            foreach(string entry in Enumerate(fences))if(String.Equals(entry,leaf,StringComparison.OrdinalIgnoreCase))throw new IOException("temporary leaf remained after native delete");
+            return true;
+        }
+        finally
+        {
+            if(file!=null)file.Dispose();if(fences!=null)fences.Dispose();if(state!=null)state.Dispose();if(root!=null)root.Dispose();
+        }
+    }
+
+    private static bool IsExactTemporaryLeaf(string leaf)
+    {
+        if(leaf==null||leaf.Length!=42||!leaf.StartsWith(".ccod.",StringComparison.Ordinal)||!leaf.EndsWith(".tmp",StringComparison.Ordinal))return false;
+        for(int index=6;index<38;index++){char value=leaf[index];if(!((value>='0'&&value<='9')||(value>='a'&&value<='f')))return false;}return true;
+    }
+    private static SafeFileHandle OpenAbsoluteDirectory(string path){SafeFileHandle handle=CreateFileW(path,LIST_DIRECTORY|READ_ATTRIBUTES|SYNCHRONIZE,SHARE_READ|SHARE_WRITE,IntPtr.Zero,OPEN_EXISTING,FLAG_BACKUP|FLAG_REPARSE,IntPtr.Zero);if(handle.IsInvalid){int error=Marshal.GetLastWin32Error();handle.Dispose();throw new Win32Exception(error);}return handle;}
+    private static SafeFileHandle OpenRelative(SafeFileHandle parent,string name,uint access,uint share,uint disposition,uint options)
+    {
+        IntPtr nameBuffer=IntPtr.Zero,unicodePointer=IntPtr.Zero;bool added=false;
+        try
+        {
+            parent.DangerousAddRef(ref added);nameBuffer=Marshal.StringToHGlobalUni(name);
+            UNICODE_STRING unicode=new UNICODE_STRING{Length=(ushort)(name.Length*2),MaximumLength=(ushort)((name.Length+1)*2),Buffer=nameBuffer};
+            unicodePointer=Marshal.AllocHGlobal(Marshal.SizeOf(typeof(UNICODE_STRING)));Marshal.StructureToPtr(unicode,unicodePointer,false);
+            OBJECT_ATTRIBUTES attributes=new OBJECT_ATTRIBUTES{Length=Marshal.SizeOf(typeof(OBJECT_ATTRIBUTES)),RootDirectory=parent.DangerousGetHandle(),ObjectName=unicodePointer,Attributes=OBJ_CASE_INSENSITIVE};
+            IO_STATUS_BLOCK io;IntPtr raw;int status=NtCreateFile(out raw,access,ref attributes,out io,IntPtr.Zero,0,share,disposition,options|SYNC_IO|OPEN_REPARSE,IntPtr.Zero,0);
+            if(status<0)throw new Win32Exception((int)RtlNtStatusToDosError(status));return new SafeFileHandle(raw,true);
+        }
+        finally{if(unicodePointer!=IntPtr.Zero)Marshal.FreeHGlobal(unicodePointer);if(nameBuffer!=IntPtr.Zero)Marshal.FreeHGlobal(nameBuffer);if(added)parent.DangerousRelease();}
+    }
+    private static void ValidateDirectory(SafeFileHandle handle,string path){FILE_INFO info=Info(handle);if(!IsDirectory(info)||(info.FileAttributes&ATTR_REPARSE)!=0||!OnlyDefaultStream(handle)||!SamePath(FinalPath(handle),path))throw new InvalidDataException("directory identity");}
+    private static void ValidatePlain(FILE_INFO info,SafeFileHandle handle){bool streams=OnlyDefaultStream(handle);if(IsDirectory(info)||(info.FileAttributes&ATTR_REPARSE)!=0||info.NumberOfLinks!=1||!streams)throw new InvalidDataException("temporary leaf identity attributes="+info.FileAttributes+" links="+info.NumberOfLinks+" streams="+streams);}
+    private static void ValidateDeleteArmed(FILE_INFO info,SafeFileHandle handle){if(IsDirectory(info)||(info.FileAttributes&ATTR_REPARSE)!=0||info.NumberOfLinks>1||!OnlyDefaultStream(handle))throw new InvalidDataException("delete-armed temporary leaf identity");}
+    private static bool SameIdentity(FILE_INFO first,FILE_INFO second){return first.VolumeSerialNumber==second.VolumeSerialNumber&&first.FileIndexHigh==second.FileIndexHigh&&first.FileIndexLow==second.FileIndexLow;}
+    private static bool IsDirectory(FILE_INFO info){return(info.FileAttributes&ATTR_DIRECTORY)!=0;}
+    private static FILE_INFO Info(SafeFileHandle handle){FILE_INFO info;if(handle==null||handle.IsClosed||!GetFileInformationByHandle(handle,out info))throw new Win32Exception(Marshal.GetLastWin32Error());return info;}
+    private static void SetAttributes(SafeFileHandle handle,uint attributes){IntPtr buffer=Marshal.AllocHGlobal(40);try{for(int index=0;index<40;index++)Marshal.WriteByte(buffer,index,0);Marshal.WriteInt32(buffer,32,unchecked((int)attributes));IO_STATUS_BLOCK io;int status=NtSetInformationFile(handle,out io,buffer,40,FileBasicInformation);if(status<0)throw new Win32Exception((int)RtlNtStatusToDosError(status));}finally{Marshal.FreeHGlobal(buffer);}}
+    private static void SetDelete(SafeFileHandle handle){IntPtr buffer=Marshal.AllocHGlobal(1);try{Marshal.WriteByte(buffer,0,1);IO_STATUS_BLOCK io;int status=NtSetInformationFile(handle,out io,buffer,1,FileDispositionInformation);if(status<0)throw new Win32Exception((int)RtlNtStatusToDosError(status));}finally{Marshal.FreeHGlobal(buffer);}}
+    private static string FinalPath(SafeFileHandle handle){StringBuilder buffer=new StringBuilder(512);uint length=GetFinalPathNameByHandleW(handle,buffer,(uint)buffer.Capacity,0);if(length==0)throw new Win32Exception(Marshal.GetLastWin32Error());if(length>=buffer.Capacity){buffer.Capacity=(int)length+1;length=GetFinalPathNameByHandleW(handle,buffer,(uint)buffer.Capacity,0);if(length==0||length>=buffer.Capacity)throw new Win32Exception(Marshal.GetLastWin32Error());}string path=buffer.ToString();if(path.StartsWith(@"\\?\UNC\",StringComparison.OrdinalIgnoreCase))return@"\\"+path.Substring(8);if(path.StartsWith(@"\\?\",StringComparison.OrdinalIgnoreCase))return path.Substring(4);return path;}
+    private static bool SamePath(string first,string second){return String.Equals(Path.GetFullPath(first).TrimEnd('\\'),Path.GetFullPath(second).TrimEnd('\\'),StringComparison.OrdinalIgnoreCase);}
+    private static bool OnlyDefaultStream(SafeFileHandle handle){IntPtr buffer=Marshal.AllocHGlobal(65536);try{if(!GetFileInformationByHandleEx(handle,FileStreamInfo,buffer,65536)){int error=Marshal.GetLastWin32Error();if(error==38)return true;throw new Win32Exception(error);}int offset=0;while(true){uint next=(uint)Marshal.ReadInt32(buffer,offset),nameLength=(uint)Marshal.ReadInt32(buffer,offset+4);string name=Marshal.PtrToStringUni(IntPtr.Add(buffer,offset+24),(int)nameLength/2);if(!String.Equals(name,"::$DATA",StringComparison.OrdinalIgnoreCase)&&!String.Equals(name,"::$INDEX_ALLOCATION",StringComparison.OrdinalIgnoreCase))return false;if(next==0)break;offset+=(int)next;}return true;}finally{Marshal.FreeHGlobal(buffer);}}
+    private static string[] Enumerate(SafeFileHandle handle){List<string> result=new List<string>();IntPtr buffer=Marshal.AllocHGlobal(65536);bool restart=true;try{while(true){IO_STATUS_BLOCK io;int status=NtQueryDirectoryFile(handle,IntPtr.Zero,IntPtr.Zero,IntPtr.Zero,out io,buffer,65536,FileDirectoryInformation,false,IntPtr.Zero,restart);restart=false;if(status==STATUS_NO_MORE_FILES)break;if(status<0)throw new Win32Exception((int)RtlNtStatusToDosError(status));int offset=0;while(true){uint next=(uint)Marshal.ReadInt32(buffer,offset),nameLength=(uint)Marshal.ReadInt32(buffer,offset+60);string name=Marshal.PtrToStringUni(IntPtr.Add(buffer,offset+64),(int)nameLength/2);if(name!="."&&name!="..")result.Add(name);if(next==0)break;offset+=(int)next;}}return result.ToArray();}finally{Marshal.FreeHGlobal(buffer);}}
+}
+'@
+        $marker = 'CcodProductCleanupOrphanCapabilityMarkerV1' -as [type]
+    }
+    if ($null -eq $marker -or [int]$marker.GetProperty('CapabilityAbi').GetValue($null,$null) -ne 1) {
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup orphan runtime ABI is unavailable' $null
+    }
+    $script:CcodProductCleanupOrphanRuntimeType = $marker.Assembly.GetType('CcodProductCleanupOrphanRuntimeV1',$true)
+}
+
+function Remove-CcodLifecycleProductCleanupOrphanTemporary {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$Leaf)
+    [void](Assert-CcodLifecycleProductCleanupLease)
+    $root = Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
+    if ($Leaf -cnotmatch '^\.ccod\.[0-9a-f]{32}\.tmp$') {
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup orphan temporary name is not exact' $Leaf
+    }
+    try {
+        Initialize-CcodLifecycleProductCleanupOrphanRuntime
+        $method = $script:CcodProductCleanupOrphanRuntimeType.GetMethod('Remove',[Reflection.BindingFlags]'NonPublic,Static')
+        $arguments = [object[]]@([string]$root,[string]$Leaf)
+        if ($null -eq $method -or -not [bool]$method.Invoke($null,$arguments)) { throw 'native orphan cleanup did not prove deletion' }
+        [void](Assert-CcodLifecycleProductCleanupLease)
+    } catch {
+        $exception = $_.Exception
+        while ($exception -is [Reflection.TargetInvocationException] -and $null -ne $exception.InnerException) { $exception = $exception.InnerException }
+        Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Exact product cleanup orphan temporary could not be removed safely' $Leaf
+    }
+    return $true
+}
+
 function Read-CcodLifecycleProductCleanupFenceHistory {
     param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$ReadyTransaction)
+    [void](Assert-CcodLifecycleProductCleanupLease)
     $root = Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
     $directory = Join-Path $root 'state\product-cleanup-fences'
     if (-not [IO.Directory]::Exists($directory)) {
@@ -223,9 +366,21 @@ function Read-CcodLifecycleProductCleanupFenceHistory {
     }
     try { [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $directory) }
     catch { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence plane is unsafe' $directory }
-    $entries = [Collections.Generic.List[object]]::new()
     $files = @(Get-ChildItem -LiteralPath $directory -Force -ErrorAction Stop)
     if ($files.Count -gt 4096) { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence plane exceeds its bounded history' $directory }
+    $orphanLeaves = [Collections.Generic.List[string]]::new()
+    foreach ($file in $files) {
+        if (-not $file.PSIsContainer -and $file.Name -cmatch '^\.ccod\.[0-9a-f]{32}\.tmp$') { $orphanLeaves.Add($file.Name); continue }
+        if ($file.PSIsContainer -or $file.Name -cnotmatch '^\d{20}\.(?:Pending|Completed)\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.json$') {
+            Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence plane contains an unknown object' $file.FullName
+        }
+    }
+    foreach ($leaf in $orphanLeaves) { [void](Remove-CcodLifecycleProductCleanupOrphanTemporary -InstallRoot $root -Leaf $leaf) }
+    if ($orphanLeaves.Count -gt 0) {
+        $files = @(Get-ChildItem -LiteralPath $directory -Force -ErrorAction Stop)
+        if ($files.Count -gt 4096) { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence plane exceeds its bounded history' $directory }
+    }
+    $entries = [Collections.Generic.List[object]]::new()
     foreach ($file in $files) {
         if ($file.PSIsContainer -or $file.Name -cnotmatch '^(?<attempt>\d{20})\.(?<state>Pending|Completed)\.(?<transaction>[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.json$') {
             Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product cleanup fence plane contains an unknown object' $file.FullName
@@ -391,6 +546,12 @@ function Invoke-CcodLifecycleProductTransactionClose {
     & $CloseProductTransaction $Transaction $defaultClose
 }
 
+function Invoke-CcodLifecycleUnboundProductTransactionAbort {
+    param([Parameter(Mandatory)]$Transaction)
+    $fileModule = Get-CcodLifecycleInstallFileTransactionModule
+    &$fileModule {param($Value)Close-CcodInstallFileTransaction -Transaction $Value -Disposition Failed} $Transaction
+}
+
 function Test-CcodLifecycleProductCleanupOwnerAlive {
     param([Parameter(Mandatory)]$OwnerIdentity)
     $process = $null
@@ -436,15 +597,22 @@ function Resolve-CcodLifecycleProductCleanupFence {
             if ($entry.CloseProductTransaction -isnot [scriptblock] -or $entry.DefaultClose -isnot [scriptblock]) {
                 Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Pending product cleanup capability is invalid' $root
             }
+            $fenceBound = $null -ne $entry.PSObject.Properties['FenceBound'] -and $entry.FenceBound -is [bool] -and [bool]$entry.FenceBound
+            if ($null -ne $entry.Transaction -and -not $fenceBound) {
+                try { Invoke-CcodLifecycleUnboundProductTransactionAbort -Transaction $entry.Transaction; $entry.Transaction=$null }
+                catch { Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Unbound product transaction abort remains retryable' $root }
+            }
             if ($null -eq $entry.Transaction) {
                 $fileModule = Get-CcodLifecycleInstallFileTransactionModule
                 try {
                     $entry.Transaction = &$fileModule {param($Root,$Record)Open-CcodInstallProductRegistrationTransaction -InstallRoot $Root -ReadyTransaction $Record} $root $ReadyTransaction
+                    if ($null -eq $entry.PSObject.Properties['FenceBound']) { $entry | Add-Member -NotePropertyName FenceBound -NotePropertyValue $false }
+                    else { $entry.FenceBound = $false }
                     [void](&$fileModule {param($Transaction,$Fence)Set-CcodInstallProductCleanupFence -Transaction $Transaction -Fence $Fence} $entry.Transaction $entry.Fence)
+                    $entry.FenceBound = $true
                 } catch {
                     if ($null -ne $entry.Transaction) {
-                        try { &$fileModule {param($Transaction)Close-CcodInstallFileTransaction -Transaction $Transaction -Disposition Failed} $entry.Transaction } catch { }
-                        $entry.Transaction = $null
+                        try { Invoke-CcodLifecycleUnboundProductTransactionAbort -Transaction $entry.Transaction; $entry.Transaction = $null } catch { }
                     }
                     Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Pending product cleanup could not open fresh strict authority' $root
                 }
@@ -2431,14 +2599,16 @@ function Get-CcodLifecycleAdapters {
                     DefaultClose=$defaultClose
                     CloseProductTransaction=$CloseProductTransaction
                     OwnerManagedThreadId=[Threading.Thread]::CurrentThread.ManagedThreadId
+                    FenceBound=$false
                     CloseCompleted=$false
                 }
                 $script:CcodPendingProductTransactionCleanups[$cleanupKey]=$cleanupEntry
                 $operationFailure=$null;$closeFailure=$null;$completionFailure=$null;$receiptResult=$null
                 try{
                     $ownedTransaction=&$fileModule {param($Root,$Record)Open-CcodInstallProductRegistrationTransaction -InstallRoot $Root -ReadyTransaction $Record} $InstallRoot $TransactionRecord
-                    $cleanupEntry.Transaction=$ownedTransaction;$cleanupEntry.CloseCompleted=$false
+                    $cleanupEntry.Transaction=$ownedTransaction;$cleanupEntry.FenceBound=$false;$cleanupEntry.CloseCompleted=$false
                     [void](&$fileModule {param($Transaction,$Fence)Set-CcodInstallProductCleanupFence -Transaction $Transaction -Fence $Fence} $ownedTransaction $fence)
+                    $cleanupEntry.FenceBound=$true
                     $sourceCapability=&$fileModule {param($Root,$Id,$Manifest,$Transaction)Open-CcodInstallRetainedGeneration -InstallRoot $Root -RuntimeId $Id -ExpectedManifestSha256 $Manifest -FileTransaction $Transaction} $InstallRoot $RuntimeId ([string]$TransactionRecord.newManifestSha256) $ownedTransaction
                     $registration=New-CcodProductRegistration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -Version $Version -PackageSha256 $PackageSha256 -FileTransaction $sourceCapability
                     $system=[Environment]::GetFolderPath([Environment+SpecialFolder]::System);$proof=[pscustomobject][ordered]@{phase=[string]$TransactionRecord.phase;runtimeId=$RuntimeId;version=$Version;packageSha256=$PackageSha256;runtimeGeneration=[uint64]$TransactionRecord.newGeneration;manifestSha256=[string]$TransactionRecord.newManifestSha256;startMenuSha256=(Get-CcodLifecycleFileSha256 $registration.startMenuShortcut.candidatePath);desktopSha256=(Get-CcodLifecycleFileSha256 $registration.desktopShortcut.candidatePath);targetPath=[IO.Path]::GetFullPath((Join-Path $system 'schtasks.exe'));arguments='/Run /TN "Codex Control Other Devices Supervisor"';transactionRecord=$TransactionRecord;bootstrapPath=$registration.bootstrapPath;uninstallerPath=$registration.uninstallerPath}
@@ -2449,7 +2619,11 @@ function Get-CcodLifecycleAdapters {
                 }catch{$operationFailure=$_}
                 finally{
                     if(-not$cleanupEntry.CloseCompleted-and$null-ne$cleanupEntry.Transaction){
-                        try{Invoke-CcodLifecycleProductTransactionClose -Transaction $cleanupEntry.Transaction -CloseProductTransaction $cleanupEntry.CloseProductTransaction -DefaultClose $cleanupEntry.DefaultClose;$cleanupEntry.CloseCompleted=$true}catch{$closeFailure=$_}
+                        if($cleanupEntry.FenceBound){
+                            try{Invoke-CcodLifecycleProductTransactionClose -Transaction $cleanupEntry.Transaction -CloseProductTransaction $cleanupEntry.CloseProductTransaction -DefaultClose $cleanupEntry.DefaultClose;$cleanupEntry.CloseCompleted=$true}catch{$closeFailure=$_}
+                        }else{
+                            try{Invoke-CcodLifecycleUnboundProductTransactionAbort -Transaction $cleanupEntry.Transaction;$cleanupEntry.Transaction=$null}catch{$closeFailure=$_}
+                        }
                     }
                     if($cleanupEntry.CloseCompleted){
                         try{[void](Complete-CcodLifecycleProductCleanupFence -Fence $cleanupEntry.Fence -Outcome Completed);[void]$script:CcodPendingProductTransactionCleanups.Remove($cleanupKey)}catch{$completionFailure=$_}
@@ -2905,9 +3079,15 @@ function Invoke-CcodInstall {
     $installLease = $null
     $shutdownGate = $null
     $lifecycleOwnership = $null
+    $upgradeProductCleanupLease = $null
     $previousProtectionStopped = $false
     $fileTransaction=$null;$generationCapability=$null;$installRecord=$null;$readyReceiptCommitted=$false;$productRegistrationVerified=$false;$productRegistrationFailure=$null
     try {
+        if($upgrade){
+            if($adapters.CloseProductTransaction-isnot[scriptblock]){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product transaction close adapter is invalid before upgrade' $root}
+            $upgradeProductCleanupLease=Enter-CcodLifecycleProductCleanupLease
+            [void](Resolve-CcodLifecycleProductCleanupFence -InstallRoot $root -ReadyTransaction $globalTransaction -CurrentIdentity $upgradeProductCleanupLease.OwnerIdentity -CloseProductTransaction $adapters.CloseProductTransaction)
+        }
         $runtimeId=New-CcodUniqueRuntimeId -ProjectVersion $projectVersion -Files $files;$generation=New-CcodLifecycleImmutableGeneration -InstallRoot $root -RuntimeId $runtimeId -ProjectVersion $projectVersion -Files $files;$fileTransaction=$generation.FileTransaction;$generationCapability=$generation.Generation;$runtimeRoot=$generation.RuntimeRoot;$runtimeCreated=$true
         $newGeneration=if($null-eq$existingPointer){[uint64]1}else{[uint64]$existingPointer.generation+1};$installRecord=New-CcodInstallTransactionRecord -TransactionId ([guid]::NewGuid().ToString('D')) -OldRuntimeId $(if($upgrade){$existingPointer.activeRuntime}else{$null}) -OldGeneration $(if($upgrade){$existingPointer.generation}else{$null}) -OldManifestSha256 $oldManifestSha256 -NewRuntimeId $runtimeId -NewGeneration $newGeneration -NewManifestSha256 $generation.ManifestSha256 -SealedPackageSha256 $SealedPackageSha256 -OwnedObjectNames @($runtimeId)
         Write-CcodInstallTransactionRecord -InstallRoot $root -TransactionRecord $installRecord -FileTransaction $fileTransaction|Out-Null
@@ -2982,6 +3162,10 @@ function Invoke-CcodInstall {
             }
             $installLease = $null
         }
+        if($null-ne$upgradeProductCleanupLease){
+            [void](Exit-CcodLifecycleProductCleanupLease -Context $upgradeProductCleanupLease)
+            $upgradeProductCleanupLease=$null
+        }
         $taskStartedAt = & $adapters.UtcNow
         try { & $adapters.StartSupervisorTask }
         catch { Throw-CcodLifecycleError 'CCOD_INSTALL_SUPERVISOR_START_FAILED' 'The existing scheduled task could not start the new runtime' $null }
@@ -3085,11 +3269,14 @@ function Invoke-CcodInstall {
         if ($null -ne $shutdownGate) {
             try { & $adapters.CloseSupervisorShutdownGate $shutdownGate } catch { }
         }
+        if ($null -ne $lifecycleOwnership -and -not $lifecycleOwnership.released) {
+            try { & $adapters.ExitLifecycleOwnership $lifecycleOwnership | Out-Null } catch { }
+        }
         if ($null -ne $installLease -and $installLease.Outcome -ceq 'Acquired') {
             try { [void](& $adapters.ExitInstallLease $installLease) } catch { }
         }
-        if ($null -ne $lifecycleOwnership -and -not $lifecycleOwnership.released) {
-            try { & $adapters.ExitLifecycleOwnership $lifecycleOwnership | Out-Null } catch { }
+        if($null-ne$upgradeProductCleanupLease){
+            try{[void](Exit-CcodLifecycleProductCleanupLease -Context $upgradeProductCleanupLease)}catch{}
         }
         if($null-ne$fileTransaction){try{Close-CcodInstallFileTransaction -Transaction $fileTransaction -Disposition $(if($null-ne$installRecord-and$installRecord.phase-ceq'Ready'){'Ready'}else{'Failed'})}catch{}}
         if(-not[string]::IsNullOrWhiteSpace($productShortcutTemporaryRoot)-and(Test-Path -LiteralPath $productShortcutTemporaryRoot)){try{Remove-Item -LiteralPath $productShortcutTemporaryRoot -Recurse -Force -ErrorAction Stop}catch{}}
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index 0b1c66a..3259a8d 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -371,6 +371,56 @@ Invoke-CcodTest 'creates nested scoped directories and publishes sanitized recor
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
 
+Invoke-CcodTest 'abrupt writer exit cannot strand an exact internal create-only temporary leaf' {
+    $authority=New-CcodProductAuthorityFixture;$fixture=$authority.Fixture
+    $process=$null;$outer=$null;$lifecycleModule=$null
+    try {
+        $lifecycleModule=Import-Module (Join-Path $projectRoot 'src\persistence\modules\InstallLifecycle.psm1') -Force -PassThru -DisableNameChecking
+        $outer=&$lifecycleModule {Enter-CcodLifecycleProductCleanupLease}
+        $owner=$outer.OwnerIdentity
+        $fence=&$lifecycleModule {param($Root,$Ready,$Identity)New-CcodLifecycleProductCleanupFence -InstallRoot $Root -ReadyTransaction $Ready -OwnerIdentity $Identity} $fixture.Install $authority.Ready $owner
+        &$lifecycleModule {param($Context)Exit-CcodLifecycleProductCleanupLease -Context $Context|Out-Null} $outer;$outer=$null
+        $leaf=('00000000000000000001.Pending.'+$authority.Ready.transactionId+'.json')
+        $finalPath=Join-Path $fixture.Install ('state\product-cleanup-fences\'+$leaf);$finalSha=Get-CcodTestFileSha256 $finalPath
+        $marker=Join-Path $fixture.Base 'collision-reached.txt'
+        $payload=[ordered]@{module=$modulePath;install=$fixture.Install;leaf=$leaf;marker=$marker}
+        $payloadBase64=[Convert]::ToBase64String([Text.UTF8Encoding]::new($false).GetBytes(($payload|ConvertTo-Json -Compress)))
+        $child=@'
+$ErrorActionPreference='Stop'
+$payload=[Text.UTF8Encoding]::new($false,$true).GetString([Convert]::FromBase64String('__PAYLOAD__'))|ConvertFrom-Json -ErrorAction Stop
+Import-Module $payload.module -Force -DisableNameChecking -ErrorAction Stop
+$transaction=$null
+try{
+    $transaction=Open-CcodInstallStateTransaction -InstallRoot ([string]$payload.install)
+    $state=New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'state'
+    $fences=New-CcodInstallDirectory -Transaction $transaction -Parent $state -Leaf 'product-cleanup-fences'
+    try{Write-CcodInstallRecord -Transaction $transaction -Parent $fences -Leaf ([string]$payload.leaf) -Record ([ordered]@{schemaVersion=1;state='replacement'})|Out-Null;throw 'collision unexpectedly published'}
+    catch{if((([string]$_.FullyQualifiedErrorId-split',')[0])-cne'CCOD_INSTALL_RECORD_EXISTS'){throw}}
+    [IO.File]::WriteAllText([string]$payload.marker,'collision',[Text.UTF8Encoding]::new($false))
+    Start-Sleep -Seconds 30
+}finally{if($null-ne$transaction){try{Close-CcodInstallFileTransaction -Transaction $transaction -Disposition Failed|Out-Null}catch{}}}
+'@.Replace('__PAYLOAD__',$payloadBase64)
+        $encoded=[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($child))
+        $process=Start-Process -FilePath powershell.exe -ArgumentList @('-NoProfile','-ExecutionPolicy','Bypass','-EncodedCommand',$encoded) -PassThru -WindowStyle Hidden
+        $deadline=[DateTime]::UtcNow.AddSeconds(15);while(-not[IO.File]::Exists($marker)-and-not$process.HasExited-and[DateTime]::UtcNow-lt$deadline){Start-Sleep -Milliseconds 10}
+        Assert-CcodTrue ([IO.File]::Exists($marker)) 'child reaches a real create-only collision while its transaction remains live'
+        $process.Kill();$process.WaitForExit()
+        $temporaries=@(Get-ChildItem -LiteralPath (Split-Path $finalPath -Parent) -File -Force|Where-Object{$_.Name-cmatch'^\.ccod\.[0-9a-f]{32}\.tmp$'})
+        Assert-CcodEqual 1 $temporaries.Count 'abrupt pre-fix writer exit leaves one exact internal crash artifact for recovery'
+        $outer=&$lifecycleModule {Enter-CcodLifecycleProductCleanupLease}
+        try{$history=@(&$lifecycleModule {param($Root,$Ready)Read-CcodLifecycleProductCleanupFenceHistory -InstallRoot $Root -ReadyTransaction $Ready} $fixture.Install $authority.Ready)}
+        finally{&$lifecycleModule {param($Context)Exit-CcodLifecycleProductCleanupLease -Context $Context|Out-Null} $outer;$outer=$null}
+        Assert-CcodEqual 1 $history.Count 'fence history remains readable after exact orphan recovery'
+        Assert-CcodEqual 'Pending' $history[0].State 'orphan recovery preserves the canonical Pending record'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Split-Path $finalPath -Parent) -File -Force|Where-Object{$_.Name-cmatch'^\.ccod\.[0-9a-f]{32}\.tmp$'}).Count 'outer-lease native recovery removes only the exact orphan temporary'
+        Assert-CcodEqual $finalSha (Get-CcodTestFileSha256 $finalPath) 'crash cleanup leaves the original create-only record byte-for-byte intact'
+    } finally {
+        if($null-ne$process){if(-not$process.HasExited){try{$process.Kill();$process.WaitForExit()}catch{}};$process.Dispose()}
+        if($null-ne$outer){try{&$lifecycleModule {param($Context)Exit-CcodLifecycleProductCleanupLease -Context $Context|Out-Null} $outer}catch{}}
+        Remove-CcodInstallFileFixture $fixture
+    }
+}
+
 Invoke-CcodTest 'generation and capabilities are unique create-only opaque references' {
     $fixture=New-CcodInstallFileFixture
     try {
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index cc7f78f..13c0719 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -414,6 +414,29 @@ function Clear-CcodLifecycleProductOpenFailureFixture {
     if($null-ne$Fixture){&$Fixture.Module {param($Invoke)Set-Item -LiteralPath Function:\script:Invoke-CcodRuntimeStatic -Value $Invoke} $Fixture.Original}
 }
 
+function Set-CcodLifecycleProductFenceBindFailureFixture {
+    param([Parameter(Mandatory)][hashtable]$State)
+    $modulePath=Join-Path $repositoryRoot 'src\persistence\modules\InstallFileTransaction.psm1'
+    $fileModule=(Get-Command Close-CcodInstallFileTransaction -ErrorAction SilentlyContinue).Module
+    if($null-ne$fileModule-and($null-eq$fileModule.Path-or[IO.Path]::GetFullPath($fileModule.Path)-cne[IO.Path]::GetFullPath($modulePath))){$fileModule=$null}
+    if($null-eq$fileModule){$fileModule=Import-Module $modulePath -PassThru -DisableNameChecking -ErrorAction Stop}
+    $State.Attempts=0
+    $original=&$fileModule {(Get-Command Get-CcodInstallProductCleanupFenceProof -CommandType Function -ErrorAction Stop).ScriptBlock}
+    $replacement={
+        param($TransactionState,$Fence)
+        $State.Attempts++
+        if([int]$State.FailuresRemaining-gt0){$State.FailuresRemaining=[int]$State.FailuresRemaining-1;throw [IO.InvalidDataException]::new('injected durable fence bind failure')}
+        &$original $TransactionState $Fence
+    }.GetNewClosure()
+    &$fileModule {param($GetProof)Set-Item -LiteralPath Function:\script:Get-CcodInstallProductCleanupFenceProof -Value $GetProof} $replacement
+    return [pscustomobject]@{Module=$fileModule;Original=$original}
+}
+
+function Clear-CcodLifecycleProductFenceBindFailureFixture {
+    param($Fixture)
+    if($null-ne$Fixture){&$Fixture.Module {param($GetProof)Set-Item -LiteralPath Function:\script:Get-CcodInstallProductCleanupFenceProof -Value $GetProof} $Fixture.Original}
+}
+
 function Get-CcodLifecycleProductCleanupTestRecords {
     param([Parameter(Mandatory)][string]$InstallRoot)
     $directory=Join-Path $InstallRoot 'state\product-cleanup-fences'
@@ -3587,6 +3610,52 @@ $results += Invoke-CcodTest 'strict product open failure retains Pending and lat
     }
 }
 
+# Production mutation caught: a Ready-close fence assertion must not skip native abort cleanup after strict OpenProduct succeeds but binding fails.
+$results += Invoke-CcodTest 'fence bind failure aborts the real strict transaction before exact retry recovery' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot;$markerRoot=New-CcodLifecycleTempRoot
+    $bindFixture=$null;$fileModule=$null
+    try{
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null;$node=New-CcodLifecycleFakeNode -Root $nodeRoot;$fake=New-CcodLifecycleFake -NodePath $node
+        $productState=@{FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{}};Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $fake -ProductState $productState
+        $fake.Adapters.RegisterProduct={param($InstallRoot,$RuntimeId,$Version,$PackageSha256,$FileTransaction,$TransactionRecord)[pscustomobject]@{verified=$true;legacyRemoved=$true}}
+        $null=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('d'*64) -Adapters $fake.Adapters
+        [void]$fake.Adapters.Remove('RegisterProduct')
+        $lowerState=@{FailuresRemaining=0};$fileModule=Set-CcodLifecycleLowerProductCloseFixture -State $lowerState
+        $bindState=@{FailuresRemaining=1};$bindFixture=Set-CcodLifecycleProductFenceBindFailureFixture -State $bindState
+
+        $unexpectedReceipt=$null;$failure=$null
+        try{$unexpectedReceipt=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('d'*64) -Adapters $fake.Adapters}catch{$failure=$_}
+        Assert-CcodEqual $null $unexpectedReceipt 'bind failure emits no verified registration receipt'
+        Assert-CcodEqual 'CCOD_PRODUCT_REGISTRATION_FAILED' (([string]$failure.FullyQualifiedErrorId-split',')[0]) 'bind failure is normalized to the stable product registration error'
+        $records=@(Get-CcodLifecycleProductCleanupTestRecords -InstallRoot $install)
+        Assert-CcodEqual '1:Pending' (($records|ForEach-Object{"$($_.Attempt):$($_.State)"})-join '|') 'bind failure retains Pending without false completion'
+        Assert-CcodEqual 0 $productState.Writes 'bind failure performs no product write'
+        Assert-CcodEqual 0 $productState.ShortcutWrites 'bind failure performs no shortcut write'
+
+        $child=Invoke-CcodLifecycleOtherProcessProductReconciliation -SourceRoot $source -InstallRoot $install -NodePath $node -PackageSha256 ('d'*64) -MarkerRoot $markerRoot
+        Assert-CcodTrue $child.MutexAcquired 'Failed abort releases the inner real AccountTransition mutex for another process'
+        Assert-CcodEqual 23 $child.ExitCode 'another process observes live Pending after acquiring the released mutex'
+        Assert-CcodEqual $false $child.AuthorityOpened 'live Pending blocks the other process before strict product authority'
+        Assert-CcodEqual 1 $lowerState.Attempts 'unbound strict transaction executes one real lower Failed close'
+
+        $bindState.FailuresRemaining=0
+        $retry=$null;$retryFailure=$null
+        try{$retry=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('d'*64) -Adapters $fake.Adapters}catch{$retryFailure=$_}
+        Assert-CcodEqual $null $retryFailure "same-package retry reaches fresh recovery bind=$($bindState.Attempts) close=$($lowerState.Attempts) writes=$($productState.Writes) shortcuts=$($productState.ShortcutWrites) retained=$($productState.RetainedError)"
+        Assert-CcodEqual 'AlreadyInstalled' $retry.Outcome 'same-package retry recovers the exact Pending only through fresh bound authority'
+        Assert-CcodTrue $retry.ProductRegistrationVerified 'retry verifies only after fresh bound Ready close succeeds'
+        Assert-CcodEqual 3 $bindState.Attempts 'retry binds one fresh recovery transaction and one new verification transaction'
+        Assert-CcodEqual 3 $lowerState.Attempts 'Failed abort and two bound Ready closes all reach real lower cleanup'
+        $records=@(Get-CcodLifecycleProductCleanupTestRecords -InstallRoot $install)
+        Assert-CcodEqual '1:Pending|1:Completed|2:Pending|2:Completed' (($records|ForEach-Object{"$($_.Attempt):$($_.State)"})-join '|') 'bind failure recovery preserves exact append-only cleanup history'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Failed.*.json' -File).Count 'post-Ready bind failure appends no lifecycle Failed snapshot'
+    }finally{
+        Clear-CcodLifecycleProductFenceBindFailureFixture -Fixture $bindFixture
+        Clear-CcodLifecycleLowerProductCloseFixture -FileModule $fileModule
+        foreach($path in @($source,$install,$nodeRoot,$markerRoot)){if(Test-Path $path){try{Remove-Item $path -Recurse -Force}catch{}}}
+    }
+}
+
 # Production mutation caught: validating every historical record against the latest Ready transaction makes any completed prior version poison an upgrade.
 $results += Invoke-CcodTest 'completed cleanup history from an older Ready transaction permits new upgrade registration' {
     $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
@@ -3618,32 +3687,34 @@ $results += Invoke-CcodTest 'completed cleanup history from an older Ready trans
     }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}}
 }
 
-# Production mutation caught: filtering history solely to the new Ready identity would silently ignore an unresolved cleanup from the prior transaction.
-$results += Invoke-CcodTest 'unresolved Pending from an older transaction blocks new Ready registration fail closed' {
+# Production mutation caught: resolving old cleanup only after the selector advances makes the old Ready authority permanently stale.
+$results += Invoke-CcodTest 'upgrade resolves a dead-owner old Pending while the old Ready is still selected' {
     $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
     try{
         New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null;$node=New-CcodLifecycleFakeNode -Root $nodeRoot;$firstFake=New-CcodLifecycleFake -NodePath $node
         $first=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $firstFake.Adapters
-        $module=Get-Module InstallLifecycle -ErrorAction Stop;$oldReady=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install;$owner=Get-CcodLifecycleCurrentProductCleanupTestIdentity
+        $module=Get-Module InstallLifecycle -ErrorAction Stop;$oldReady=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install;$currentOwner=Get-CcodLifecycleCurrentProductCleanupTestIdentity
+        $owner=[pscustomobject][ordered]@{pid=[int]2147483647;creationTimeUtc='2000-01-01T00:00:00.0000000Z';userSid=$currentOwner.userSid}
         $outer=&$module {Enter-CcodLifecycleProductCleanupLease}
         try{&$module {param($Root,$Ready,$Identity)[void](New-CcodLifecycleProductCleanupFence -InstallRoot $Root -ReadyTransaction $Ready -OwnerIdentity $Identity)} $install $oldReady $owner}
         finally{&$module {param($Context)[void](Exit-CcodLifecycleProductCleanupLease -Context $Context)} $outer}
         Set-CcodLifecycleTestStatus -InstallRoot $install -RuntimeId $first.RuntimeId
         [IO.File]::WriteAllText((Join-Path $source 'src\runtime\main-payload.js'),"module.exports = 'fixture-upgrade-prior-pending';`n",[Text.UTF8Encoding]::new($false))
         $upgradeFake=New-CcodLifecycleFake -NodePath $node;$upgradeProduct=@{FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{}};Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $upgradeFake -ProductState $upgradeProduct
-        $unexpectedReceipt=$null;$failure=$null
-        try{$unexpectedReceipt=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $upgradeFake.Adapters}catch{$failure=$_}
-        Assert-CcodEqual $null $unexpectedReceipt 'prior-transaction Pending emits no verified upgrade receipt'
-        Assert-CcodEqual 'CCOD_PRODUCT_REGISTRATION_FAILED' (([string]$failure.FullyQualifiedErrorId-split',')[0]) 'prior-transaction Pending blocks with the stable product registration error'
-        Assert-CcodEqual 0 $upgradeProduct.Writes 'prior-transaction Pending blocks before product writes'
-        Assert-CcodEqual 0 $upgradeProduct.ShortcutWrites 'prior-transaction Pending blocks before shortcut writes'
+        $upgrade=$null;$failure=$null
+        try{$upgrade=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $upgradeFake.Adapters}catch{$failure=$_}
+        Assert-CcodEqual $null $failure 'dead-owner old Pending is reconciled before selector advance'
+        Assert-CcodEqual 'Upgraded' $upgrade.Outcome 'upgrade proceeds only after old cleanup completion'
+        Assert-CcodTrue $upgrade.ProductRegistrationVerified 'upgrade verifies only after old and new strict cleanup complete'
         $newReady=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install
-        Assert-CcodTrue ($newReady.transactionId-cne$oldReady.transactionId) 'upgrade lifecycle remains durably Ready under a distinct transaction'
+        Assert-CcodTrue ($newReady.transactionId-cne$oldReady.transactionId) 'upgrade commits a distinct Ready only after old cleanup completion'
         $records=@(Get-CcodLifecycleProductCleanupTestRecords -InstallRoot $install)
-        Assert-CcodEqual 1 $records.Count 'unresolved older Pending remains intact and no new fence is appended'
-        Assert-CcodEqual $oldReady.transactionId $records[0].Record.transactionId 'blocking Pending retains its original transaction identity'
-        Assert-CcodEqual 'Pending' $records[0].State 'blocking prior fence remains unresolved'
-        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Failed.*.json' -File).Count 'prior Pending does not fabricate a lifecycle Failed snapshot'
+        $oldRecords=@($records|Where-Object{$_.Record.transactionId-ceq$oldReady.transactionId});$newRecords=@($records|Where-Object{$_.Record.transactionId-ceq$newReady.transactionId})
+        Assert-CcodEqual '1:Pending|1:Completed' (($oldRecords|ForEach-Object{"$($_.Attempt):$($_.State)"})-join '|') 'old Pending completes against the still-selected old Ready'
+        Assert-CcodEqual '1:Pending|1:Completed' (($newRecords|ForEach-Object{"$($_.Attempt):$($_.State)"})-join '|') 'new Ready owns an independent completed cleanup attempt'
+        Assert-CcodEqual 1 $upgradeProduct.Writes 'upgrade reaches the product write boundary once after old cleanup'
+        Assert-CcodEqual 2 $upgradeProduct.ShortcutWrites 'upgrade reaches both shortcut writes after old cleanup'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Failed.*.json' -File).Count 'old cleanup recovery fabricates no lifecycle Failed snapshot'
     }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}}
 }
 
@@ -3671,6 +3742,37 @@ $results += Invoke-CcodTest 'cleanup history rejects an unknown record field bef
     }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}}
 }
 
+# Production mutation caught: broad temp-name deletion could remove attacker-controlled reparse, ADS, hardlink, or live objects from the authority plane.
+$results += Invoke-CcodTest 'cleanup fence orphan recovery rejects every hostile temporary lookalike' {
+    foreach($case in @('unexpected-name','reparse','ads','hardlink','open')){
+        $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot;$outside=New-CcodLifecycleTempRoot;$held=$null
+        try{
+            New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null;$node=New-CcodLifecycleFakeNode -Root $nodeRoot;$fake=New-CcodLifecycleFake -NodePath $node
+            $null=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('e'*64) -Adapters $fake.Adapters
+            $plane=Join-Path $install 'state\product-cleanup-fences';[IO.Directory]::CreateDirectory($plane)|Out-Null
+            $exactName='.ccod.'+('a'*32)+'.tmp';$name=if($case-ceq'unexpected-name'){'.ccod.not-a-canonical-guid.tmp'}else{$exactName};$artifact=Join-Path $plane $name
+            switch($case){
+                'unexpected-name'{[IO.File]::WriteAllText($artifact,'hostile unexpected name',[Text.UTF8Encoding]::new($false))}
+                'reparse'{[IO.Directory]::CreateDirectory($outside)|Out-Null;New-Item -ItemType Junction -Path $artifact -Target $outside|Out-Null}
+                'ads'{[IO.File]::WriteAllText($artifact,'hostile alternate stream',[Text.UTF8Encoding]::new($false));$previous=$ErrorActionPreference;try{$ErrorActionPreference='Continue';$output=&cmd.exe /d /c "echo ads>`"$($artifact):metadata`"" 2>&1;$exitCode=$LASTEXITCODE}finally{$ErrorActionPreference=$previous};if($exitCode-ne0){throw "ADS fixture failed: $($output-join' ')"}}
+                'hardlink'{[IO.Directory]::CreateDirectory($outside)|Out-Null;$outsideFile=Join-Path $outside 'hostile.tmp';[IO.File]::WriteAllText($outsideFile,'hostile hardlink',[Text.UTF8Encoding]::new($false));New-Item -ItemType HardLink -Path $artifact -Target $outsideFile|Out-Null}
+                'open'{[IO.File]::WriteAllText($artifact,'hostile live handle',[Text.UTF8Encoding]::new($false));$held=[IO.File]::Open($artifact,[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::ReadWrite -bor [IO.FileShare]::Delete)}
+            }
+            [void]$fake.Adapters.Remove('RegisterProduct');$productState=@{FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{}};Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $fake -ProductState $productState
+            $unexpectedReceipt=$null;$failure=$null
+            try{$unexpectedReceipt=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('e'*64) -Adapters $fake.Adapters}catch{$failure=$_}
+            Assert-CcodEqual $null $unexpectedReceipt "$case hostile temporary emits no verified receipt"
+            Assert-CcodEqual 'CCOD_PRODUCT_REGISTRATION_FAILED' (([string]$failure.FullyQualifiedErrorId-split',')[0]) "$case hostile temporary fails closed"
+            Assert-CcodTrue (Test-Path -LiteralPath $artifact) "$case hostile object is never deleted or ignored"
+            Assert-CcodEqual 0 $productState.Writes "$case blocks before product writes"
+            Assert-CcodEqual 0 $productState.ShortcutWrites "$case blocks before shortcut writes"
+        }finally{
+            if($null-ne$held){$held.Dispose()}
+            foreach($path in @($source,$install,$nodeRoot,$outside)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}
+        }
+    }
+}
+
 # Production mutation caught: releasing strict product authority after a lower close failure without a durable fence lets another process report verified registration.
 $results += Invoke-CcodTest 'live-owner durable product cleanup blocks another real process after mutex acquisition' {
     $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot;$markerRoot=New-CcodLifecycleTempRoot

From f895ebb2731d44488ed3f656e28a90ed9739f175 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 17:15:21 +0800
Subject: [PATCH 119/187] docs: record final durable cleanup fix evidence

---
 .../final-fix-report.md                       | 186 ++++++++++++++++++
 1 file changed, 186 insertions(+)
 create mode 100644 .superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/final-fix-report.md

diff --git a/.superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/final-fix-report.md b/.superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/final-fix-report.md
new file mode 100644
index 0000000..d685a7a
--- /dev/null
+++ b/.superpowers/sdd/2026-09-02-v2522-durable-product-cleanup/final-fix-report.md
@@ -0,0 +1,186 @@
+# Final fix report: durable product cleanup recovery gaps
+
+## Scope and review status
+
+- Final-review base: `b1aec464b255661596d19c6a5d2bdb6ead4a7003`.
+- Implementation: `9e00ccf3ce4fb1f5e2f1e80c415c8fd787b71509`
+  (`fix: close durable cleanup recovery gaps`).
+- The implementation commit contains only:
+  - `src/persistence/modules/InstallLifecycle.psm1`
+  - `tests/persistence/InstallFileTransaction.SelfTest.ps1`
+  - `tests/persistence/InstallLifecycle.SelfTest.ps1`
+- This is the plan's single final-fix wave. It fixes the three final-review
+  Important findings together. It does not claim release readiness or
+  installed-product acceptance; one scoped independent re-review remains.
+
+## Root causes and fixes
+
+### Old Pending before selector advance
+
+The previous flow first committed the new selector and terminal Ready record,
+then called registration for the new Ready transaction. That registration saw
+the old Pending record only as foreign history, while strict old authority had
+already become stale and could no longer be opened for recovery.
+
+An upgrade now acquires the real outer `AccountTransition` product-cleanup
+lease before creating the new generation or any new nonterminal transaction
+record. It resolves cleanup against the exact currently selected old ordered
+12-field Ready transaction, then retains that lease across the selector commit.
+The later same-thread `InstallLease` and lifecycle ownership acquisitions are
+recursive acquisitions of the same mutex. Normal release is LIFO: lifecycle
+ownership, install lease, then the pre-upgrade product-cleanup lease. Every
+exception path attempts the same order, and a resolve failure exits before a
+new selector or Ready record is written.
+
+The existing resolver behavior remains exact: a live foreign owner blocks, a
+same-thread retained capability may retry, and a proven-dead owner must open,
+bind, and close fresh strict old authority before appending Completed.
+
+### Fence binding failure cleanup
+
+After strict `OpenProduct` succeeded, a binding failure previously reached a
+Ready close. Its missing-fence assertion ran before native close and authority
+lease release, permanently retaining the inner recursive mutex.
+
+The process-local cleanup entry now records whether the exact durable fence was
+successfully bound. An unbound strict transaction is closed directly with
+`Disposition Failed`; that path always attempts native runtime cleanup and the
+inner authority lease release and never appends Completed. On successful abort
+the stale transaction capability is discarded while durable Pending remains.
+If the abort itself fails, the exact capability remains retryable; a later
+same-thread call first retries the Failed abort, then opens and binds fresh
+strict authority. Only a successful bound Ready close permits Completed.
+
+### Exact crash temporary recovery
+
+The create-only writer can leave a read-only `.ccod.<32-lowercase-hex>.tmp`
+after abrupt process termination. The fence reader previously classified that
+internal crash artifact as an unknown object forever.
+
+The final design deliberately does not alter the independently reviewed IFT
+seal/rename ABI. Delete-on-close was rejected for this wave because the current
+write-close, strict-reopen, read-only, and no-replace rename sequence did not
+provide a sufficiently narrow proof that delete-pending could be cleared on
+every rename/collision/exception path without reopening a crash window.
+
+Instead, the fence reader performs the brief's narrow recovery while the real
+outer product-cleanup lease is live. A private inert-marker CLR bridge:
+
+- accepts only the exact lowercase internal temporary name;
+- pins install root, `state`, and `product-cleanup-fences` through relative
+  non-reparse native directory handles;
+- opens one leaf with `DELETE`, read/write-attribute access, and zero sharing;
+- proves non-directory, non-reparse, default-stream-only, single-link identity,
+  exact final path, and stable volume/file index;
+- clears only that pinned orphan's read-only attribute, arms native delete
+  disposition, revalidates the same identity, closes the handle, and requires
+  the pinned parent enumeration to show the leaf absent;
+- re-enumerates the whole fence plane before any history is accepted.
+
+Unknown names, reparse objects, ADS, hardlinks, and any open/nonexclusive exact
+temporary still fail closed and are not removed or ignored. There is no broad,
+recursive, wildcard, or path-only deletion.
+
+## RED evidence
+
+### Upgrade with old Pending
+
+- Runner: Windows PowerShell 5.1 targeted execution of the checked-in lifecycle
+  case `upgrade resolves a dead-owner old Pending while the old Ready is still
+  selected`.
+- Exit: `1`.
+- Harness result:
+  `CCOD_SELFTEST_FAILED case=upgrade-resolves-a-dead-owner-old-Pending-while-the-old-Ready-is-still-selected error=ASSERT_EQUAL`.
+- Exact failure:
+  `dead-owner old Pending is reconciled before selector advance expected=[] actual=[A different product cleanup transaction remains Pending]`.
+- Meaning: the old code made the new Ready visible before trying to reconcile
+  old cleanup and could then only reject it as foreign Pending.
+
+### Bind failure leaks inner authority
+
+- Runner: Windows PowerShell 5.1 targeted execution of the checked-in lifecycle
+  case `fence bind failure aborts the real strict transaction before exact retry
+  recovery`.
+- Exit: `1`.
+- Harness result:
+  `CCOD_SELFTEST_FAILED case=fence-bind-failure-aborts-the-real-strict-transaction-before-exact-retry-recovery error=ASSERT_TRUE`.
+- Exact failure:
+  `Failed abort releases the inner real AccountTransition mutex for another process`.
+- The fixture used real strict `OpenProduct` and the real inner
+  `AccountTransition` mutex. Only the private fence-proof call was injected to
+  fail. The second Windows PowerShell process exhausted its real 15-second mutex
+  wait. Pending/no-receipt/no-product-write assertions had already passed.
+
+### Abrupt writer crash artifact
+
+- Command: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File
+  tests\persistence\InstallFileTransaction.SelfTest.ps1`.
+- Exit: `1`.
+- Harness result:
+  `CCOD_SELFTEST_FAILED case=abrupt-writer-exit-cannot-strand-an-exact-internal-create-only-temporary-leaf error=ASSERT_EQUAL`.
+- Exact failure:
+  `process termination deletes every exact internal temporary through its native handle disposition expected=[0] actual=[1]`.
+- The child used a real state transaction and real create-only collision, wrote
+  its collision marker, remained alive, and was then terminated. Exactly one
+  `.ccod.<32-lowercase-hex>.tmp` remained.
+- After selecting narrow recovery, the final checked-in form also failed before
+  production support with stable `CCOD_PRODUCT_REGISTRATION_FAILED` and
+  `Product cleanup fence plane contains an unknown object`.
+
+An attempted ADS fixture using a .NET path API was rejected by that API and was
+not counted as RED evidence; it was replaced with the repository's existing
+Windows ADS fixture pattern. A first bind retry fixture omitted staged shortcut
+candidates and was likewise rejected as behavior evidence before the final
+green run.
+
+## Focused GREEN evidence
+
+- Old-Pending upgrade targeted runner: exit `0`; the old transaction retained
+  `1:Pending|1:Completed`, then the distinct new Ready transaction recorded its
+  own `1:Pending|1:Completed`.
+- Bind-failure targeted runner: exit `0`; the other process acquired the real
+  mutex and exited `23` on live Pending before strict authority. The later exact
+  retry succeeded with three bind attempts and three lower closes: one unbound
+  Failed abort, one fresh bound recovery Ready close, and one new verification
+  Ready close.
+- Hostile-temporary targeted runner: exit `0`; unexpected name, reparse, ADS,
+  hardlink, and live/open exact-name cases all remained present and failed
+  closed before product or shortcut writes.
+- Crash-artifact case is included in the final IFT suite and passed after the
+  real child crash left one exact orphan, narrow recovery removed it, canonical
+  Pending remained readable, and the original final record hash stayed exact.
+
+## Fresh final matrix after source freeze
+
+| Command | Exit | Result |
+|---|---:|---|
+| `tests\persistence\InstallFileTransaction.SelfTest.ps1` | 0 | 35 named cases; `Install file transaction self-test passed.` |
+| `tests\persistence\KernelObjects.SelfTest.ps1` | 0 | 16 named cases passed. |
+| `tests\persistence\ProductRegistration.SelfTest.ps1` | 0 | `Product registration self-tests passed: 13`. |
+| `tests\persistence\UninstallBootstrap.SelfTest.ps1` | 0 | `Uninstall bootstrap self-tests passed: 23`. |
+| `tests\persistence\InstallLifecycle.SelfTest.ps1` | 0 | `Install lifecycle self-tests passed: 128`. |
+| PowerShell parser over all three changed PowerShell files | 0 | `PARSER_TOTAL=3 FAIL=0`. |
+| `git diff --check` | 0 | No whitespace errors; only checkout LF-to-CRLF warnings. |
+| `tests\PersistenceSelfTest.ps1` | 0 | Fresh tracked aggregate; no failure output. |
+
+The final lifecycle run retained the required fresh-process observation:
+`CCOD_CROSS_PROCESS_OBSERVED exit=23 mutex=True authority=False product=False verified=False error=CCOD_PRODUCT_REGISTRATION_FAILED`.
+
+The full focused and aggregate suites also retain the prior exact ten-field
+fence and ordered twelve-field Ready proof, create-only history, real MTA
+`SignalAndWait`, stale-N and closed-N rejection, live-owner blocking, dead-owner
+strict recovery, and the absence of post-Ready lifecycle Failed or false
+verified receipts.
+
+## No-real-action statement and remaining boundary
+
+No real registry, Start-menu/Desktop shortcut, installer, uninstaller,
+installed product, product process, network, release, push, tag, signing,
+publication, installation, restart, or reboot action was performed. Tests used
+only temporary fixtures, marker-file product adapters, test child processes,
+and private named mutex/event objects.
+
+Please perform one fresh scoped independent review of the implementation and
+evidence commits, especially the pre-upgrade recursive mutex lifetime, unbound
+Failed-abort retry state, and native orphan identity/delete sequence. A green
+matrix and aggregate are not release-readiness or installed-product evidence.

From 3ec2a3d13f67995018b104840d121a6fadd2dcbd Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 17:31:50 +0800
Subject: [PATCH 120/187] docs: plan rollback lease ordering

---
 ...026-09-02-v2522-rollback-lease-ordering.md | 99 +++++++++++++++++++
 1 file changed, 99 insertions(+)
 create mode 100644 docs/superpowers/plans/2026-09-02-v2522-rollback-lease-ordering.md

diff --git a/docs/superpowers/plans/2026-09-02-v2522-rollback-lease-ordering.md b/docs/superpowers/plans/2026-09-02-v2522-rollback-lease-ordering.md
new file mode 100644
index 0000000..d4bd0e3
--- /dev/null
+++ b/docs/superpowers/plans/2026-09-02-v2522-rollback-lease-ordering.md
@@ -0,0 +1,99 @@
+# Rollback Lease Ordering Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Ensure every pre-selector upgrade rollback releases the outer product-cleanup AccountTransition acquisition before scheduled-task bootstrap restarts and proves the old Supervisor.
+
+**Architecture:** Treat `upgradeProductCleanupLease` as the outermost reentrant AccountTransition acquisition. On failure after old protection stops but before the new selector commits, release inner lifecycle/install acquisitions and then the outer product-cleanup acquisition in strict LIFO order before `StartSupervisorTask`. Clear the variable only after exact release so the finalizer is idempotent and cannot double-release.
+
+**Tech Stack:** Windows PowerShell, existing KernelObjects AccountTransition mutex, InstallLifecycle adapters and self-tests.
+
+**Spec:** `docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md`
+
+## Global Constraints
+
+- Work only in the existing isolated branch/worktree.
+- No real product, registry, shortcut, scheduled task, installer, network, publication, installation, restart, or reboot action.
+- Do not change fence schemas, selector formats, Ready identity, or IFT native file behavior.
+- A pre-selector failure must leave the old selector/runtime authoritative; rollback restart must run only after all AccountTransition acquisitions owned by the installer are released.
+- Release order is LIFO, release result must be proved, and final cleanup must not double-release.
+- Use RED -> GREEN, focused lifecycle/Kernel tests, parser/diff, full aggregate, and independent review.
+
+---
+
+### Task 1: Release outer product-cleanup lease before rollback restart
+
+**Files:**
+
+- Modify: `src/persistence/modules/InstallLifecycle.psm1`
+- Test: `tests/persistence/InstallLifecycle.SelfTest.ps1`
+- Report: `.superpowers/sdd/2026-09-02-v2522-rollback-lease-ordering/task-1-report.md`
+
+**Interfaces:**
+
+- Consumes: `upgradeProductCleanupLease`, `Exit-CcodLifecycleProductCleanupLease`, lifecycle ownership/install lease release, `StartSupervisorTask`, `WaitNewRuntimeReady`.
+- Produces: helper `Exit-CcodUpgradeProductCleanupLeaseForRollback` or equivalent single call site that validates exact release, sets the caller variable to null only after success, and runs before old Supervisor restart.
+
+- [ ] **Step 1: Write the failing real-mutex rollback test**
+
+Create a temporary old Ready installation and begin a real upgrade. Inject failure at `SetActiveRuntime` before selector commit after old protection has stopped. The rollback path must use a real `AccountTransition` mutex for the outer product-cleanup lease. Its fake scheduled-task bootstrap child must attempt the same real mutex atomically and write a marker only after acquisition. Current code should time out/fail because the installer still holds the outer lease.
+
+Assertions:
+
+```powershell
+Assert-CcodEqual $false $world.PointerCommitted 'failure occurs before selector commit'
+Assert-CcodTrue $world.PreviousProtectionStopped 'old protection was stopped'
+Assert-CcodTrue $world.BootstrapAttempted 'rollback attempted old Supervisor bootstrap'
+Assert-CcodTrue $world.BootstrapMutexAcquired 'old bootstrap acquires AccountTransition before readiness'
+Assert-CcodEqual 'Ready' $world.OldRuntimeOutcome 'old runtime is restored and proven ready'
+```
+
+- [ ] **Step 2: Run RED**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+```
+
+Expected: nonzero exit at the bootstrap mutex-acquired/rollback-ready assertion. An adapter setup error, fake mutex, or pre-call marker is not valid RED evidence.
+
+- [ ] **Step 3: Implement exact LIFO release**
+
+After lifecycle ownership and install lease are released, but before `StartSupervisorTask`, release the live `upgradeProductCleanupLease` with `Exit-CcodLifecycleProductCleanupLease`. Require a true result and `Lease.Released=true`; then set `upgradeProductCleanupLease=$null`. If release fails, throw stable rollback failure without starting the task. The enclosing finally checks null/live state and must not release twice.
+
+Do not release this outer lease early on successful forward installation; it must continue protecting old-Pending resolution through selector commit.
+
+- [ ] **Step 4: Run GREEN and regression matrix**
+
+Run:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\KernelObjects.SelfTest.ps1
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1
+git diff --check
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\PersistenceSelfTest.ps1
+```
+
+Parse both changed PowerShell files. Also retain cross-process fence, bind-abort, crash-temp, atomic SignalAndWait, stale-N, and closed-N tests through the aggregate.
+
+- [ ] **Step 5: Commit and report**
+
+```powershell
+git add src/persistence/modules/InstallLifecycle.psm1 tests/persistence/InstallLifecycle.SelfTest.ps1
+git commit -m "fix: release rollback cleanup lease"
+```
+
+Write the report with exact RED/GREEN output, release ordering, no-real-action statement, implementation SHA, and full aggregate result. Commit evidence separately and request a fresh task plus whole-branch review.
+
+## Self-Review
+
+- Spec coverage: one task covers the single load-bearing residual and all regression gates.
+- Placeholder scan: no TODO/TBD; exact failure injection, assertions, implementation boundary, and commands are present.
+- Type consistency: the same `upgradeProductCleanupLease` created by durable cleanup is released with the existing exact function before bootstrap.
+
+## Execution Handoff
+
+The user requested continued execution. Use subagent-driven development with a fresh implementer and independent reviewer.
+

From a178f01a69a622ac9bd20091d6fdb326132dd9b3 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 18:17:01 +0800
Subject: [PATCH 121/187] fix: release rollback cleanup lease

---
 src/persistence/modules/InstallLifecycle.psm1 |   9 +-
 .../persistence/InstallLifecycle.SelfTest.ps1 | 115 ++++++++++++++++++
 2 files changed, 123 insertions(+), 1 deletion(-)

diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index 9e9eb67..41a15a4 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -3240,6 +3240,13 @@ function Invoke-CcodInstall {
                     }
                     $installLease = $null
                 }
+                if ($null -ne $upgradeProductCleanupLease) {
+                    $cleanupReleased = Exit-CcodLifecycleProductCleanupLease -Context $upgradeProductCleanupLease
+                    if ($cleanupReleased -isnot [bool] -or -not $cleanupReleased -or -not $upgradeProductCleanupLease.Lease.Released) {
+                        throw 'Previous runtime product cleanup lease release was not proven'
+                    }
+                    $upgradeProductCleanupLease = $null
+                }
                 $rollbackStartedAt = & $adapters.UtcNow
                 if ($rollbackStartedAt -isnot [DateTime]) { throw 'Previous runtime restart clock is invalid' }
                 & $adapters.StartSupervisorTask
@@ -3275,7 +3282,7 @@ function Invoke-CcodInstall {
         if ($null -ne $installLease -and $installLease.Outcome -ceq 'Acquired') {
             try { [void](& $adapters.ExitInstallLease $installLease) } catch { }
         }
-        if($null-ne$upgradeProductCleanupLease){
+        if($null-ne$upgradeProductCleanupLease-and$null-ne$upgradeProductCleanupLease.Lease-and-not$upgradeProductCleanupLease.Lease.Released){
             try{[void](Exit-CcodLifecycleProductCleanupLease -Context $upgradeProductCleanupLease)}catch{}
         }
         if($null-ne$fileTransaction){try{Close-CcodInstallFileTransaction -Transaction $fileTransaction -Disposition $(if($null-ne$installRecord-and$installRecord.phase-ceq'Ready'){'Ready'}else{'Failed'})}catch{}}
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index 13c0719..e5a7f71 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -557,6 +557,66 @@ exit $exitCode
     }
 }
 
+function Invoke-CcodLifecycleRollbackBootstrapMutexProbe {
+    param(
+        [Parameter(Mandatory)][string]$MarkerRoot,
+        [int]$MutexTimeoutMilliseconds = 1500,
+        [int]$ProcessTimeoutMilliseconds = 10000
+    )
+
+    [IO.Directory]::CreateDirectory($MarkerRoot) | Out-Null
+    $payload = [ordered]@{
+        kernelModule = (Join-Path $repositoryRoot 'src\persistence\modules\KernelObjects.psm1')
+        markerRoot = $MarkerRoot
+        mutexTimeoutMilliseconds = $MutexTimeoutMilliseconds
+    }
+    $payloadBase64 = [Convert]::ToBase64String([Text.UTF8Encoding]::new($false).GetBytes(($payload | ConvertTo-Json -Compress)))
+    $childScript = @'
+$ErrorActionPreference='Stop'
+$payloadJson=[Text.UTF8Encoding]::new($false,$true).GetString([Convert]::FromBase64String('__PAYLOAD__'))
+$payload=$payloadJson|ConvertFrom-Json -ErrorAction Stop
+$kernelModule=Import-Module $payload.kernelModule -PassThru -DisableNameChecking -ErrorAction Stop
+$lease=$null;$exitCode=42
+try{
+    [IO.File]::WriteAllText((Join-Path $payload.markerRoot 'attempted.txt'),'attempted',[Text.UTF8Encoding]::new($false))
+    $identity=[Security.Principal.WindowsIdentity]::GetCurrent()
+    try{$sid=[string]$identity.User.Value}finally{$identity.Dispose()}
+    $lease=&$kernelModule {param($UserSid,$Timeout)Enter-CcodMutex -Kind AccountTransition -UserSid $UserSid -TimeoutMilliseconds $Timeout} $sid ([int]$payload.mutexTimeoutMilliseconds)
+    [IO.File]::WriteAllText((Join-Path $payload.markerRoot 'outcome.txt'),[string]$lease.Outcome,[Text.UTF8Encoding]::new($false))
+    if($null-eq$lease-or$lease.Outcome-cne'Acquired'){exit $exitCode}
+    [IO.File]::WriteAllText((Join-Path $payload.markerRoot 'acquired.txt'),'acquired',[Text.UTF8Encoding]::new($false))
+    $exitCode=0
+}catch{
+    [IO.File]::WriteAllText((Join-Path $payload.markerRoot 'child-failure.txt'),[string]$_,[Text.UTF8Encoding]::new($false))
+    $exitCode=43
+}finally{
+    if($null-ne$lease-and$lease.Outcome-ceq'Acquired'-and-not$lease.Released){try{&$kernelModule {param($Value)Exit-CcodMutex -Lease $Value} $lease|Out-Null}catch{$exitCode=44}}
+}
+exit $exitCode
+'@.Replace('__PAYLOAD__',$payloadBase64)
+    $encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($childScript))
+    $process = Start-Process -FilePath powershell.exe -ArgumentList @('-NoProfile','-ExecutionPolicy','Bypass','-EncodedCommand',$encoded) -PassThru -WindowStyle Hidden
+    try {
+        if (-not $process.WaitForExit($ProcessTimeoutMilliseconds)) {
+            try { $process.Kill() } catch { }
+            $process.WaitForExit()
+            throw 'rollback bootstrap mutex probe exceeded its bounded process timeout'
+        }
+        $exitCode = $process.ExitCode
+    } finally {
+        $process.Dispose()
+    }
+    $outcomePath = Join-Path $MarkerRoot 'outcome.txt'
+    $failurePath = Join-Path $MarkerRoot 'child-failure.txt'
+    return [pscustomobject][ordered]@{
+        ExitCode = [int]$exitCode
+        Attempted = [IO.File]::Exists((Join-Path $MarkerRoot 'attempted.txt'))
+        MutexAcquired = [IO.File]::Exists((Join-Path $MarkerRoot 'acquired.txt'))
+        Outcome = $(if ([IO.File]::Exists($outcomePath)) { [IO.File]::ReadAllText($outcomePath) } else { $null })
+        ChildFailure = $(if ([IO.File]::Exists($failurePath)) { [IO.File]::ReadAllText($failurePath) } else { $null })
+    }
+}
+
 function Invoke-CcodLifecycleDeadOwnerCleanupTest {
     $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
     $fileModule=$null;$fake=$null
@@ -1810,6 +1870,61 @@ $results += Invoke-CcodTest 'upgrade boundaries fail closed with phase receipts
     }
 }
 
+# Production mutation caught: retaining the outer AccountTransition cleanup lease while starting the old Supervisor makes its bootstrap deadlock before readiness.
+$results += Invoke-CcodTest 'pre-pointer rollback releases the outer cleanup lease before old Supervisor bootstrap' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot;$markerRoot=New-CcodLifecycleTempRoot
+    try {
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.0-rollback-cleanup-lease-a' | Out-Null
+        $nodePath=New-CcodLifecycleFakeNode -Root $nodeRoot
+        $first=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
+        Set-CcodLifecycleTestStatus -InstallRoot $install -RuntimeId $first.RuntimeId
+        [IO.File]::WriteAllText((Join-Path $source 'src\runtime\main-payload.js'),"module.exports='rollback-cleanup-lease-b';`n",[Text.UTF8Encoding]::new($false))
+
+        $fake=New-CcodLifecycleFake -NodePath $nodePath
+        $world=[pscustomobject][ordered]@{
+            PointerCommitted=$false
+            PreviousProtectionStopped=$false
+            BootstrapAttempted=$false
+            BootstrapMutexAcquired=$false
+            OldRuntimeOutcome='NotReady'
+            ChildExitCode=$null
+            ChildMutexOutcome=$null
+            ChildFailure=$null
+        }
+        $fake.World.SetActiveFailure={throw 'INJECTED_PRE_POINTER_COMMIT_FAILURE'}
+        $fake.Adapters.StartSupervisorTask={
+            $probe=Invoke-CcodLifecycleRollbackBootstrapMutexProbe -MarkerRoot $markerRoot
+            $world.BootstrapAttempted=[bool]$probe.Attempted
+            $world.BootstrapMutexAcquired=[bool]$probe.MutexAcquired
+            $world.ChildExitCode=[int]$probe.ExitCode
+            $world.ChildMutexOutcome=$probe.Outcome
+            $world.ChildFailure=$probe.ChildFailure
+        }.GetNewClosure()
+        $fake.Adapters.WaitNewRuntimeReady={
+            param($Root,$Runtime,$Generation,$Identity,$Started,$Timeout)
+            $ready=[string]$Runtime-ceq[string]$first.RuntimeId-and[UInt64]$Generation-eq[UInt64]1-and$world.BootstrapMutexAcquired
+            if($ready){$world.OldRuntimeOutcome='Ready'}
+            [pscustomobject][ordered]@{SupervisorReady=[bool]$ready;TrayReady=[bool]$ready}
+        }.GetNewClosure()
+
+        $failure=$null
+        try { Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters | Out-Null } catch { $failure=$_ }
+        $pointer=Read-CcodLifecycleActivePointer -Root $install
+        $world.PointerCommitted=([string]$pointer.activeRuntime-cne[string]$first.RuntimeId-or[UInt64]$pointer.generation-ne[UInt64]1)
+        $world.PreviousProtectionStopped=[bool]$fake.World.OldSupervisorExitProven
+
+        Assert-CcodTrue ($null-ne$failure) 'injected SetActiveRuntime failure remains fail closed after rollback'
+        Assert-CcodEqual $false $world.PointerCommitted 'failure occurs before selector commit'
+        Assert-CcodTrue $world.PreviousProtectionStopped 'old protection was stopped'
+        Assert-CcodTrue $world.BootstrapAttempted 'rollback attempted old Supervisor bootstrap'
+        Assert-CcodTrue $world.BootstrapMutexAcquired "old bootstrap acquires AccountTransition before readiness (childExit=$($world.ChildExitCode); outcome=$($world.ChildMutexOutcome); childFailure=$($world.ChildFailure))"
+        Assert-CcodEqual 'Ready' $world.OldRuntimeOutcome 'old runtime is restored and proven ready'
+        Assert-CcodTrue ($failure.FullyQualifiedErrorId-like'CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN*') 'successful rollback preserves the original pre-pointer failure code'
+    } finally {
+        foreach($path in @($source,$install,$nodeRoot,$markerRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}
+    }
+}
+
 $results += Invoke-CcodTest 'compensation refuses a replaced old manifest using the transaction-recorded hash' {
     $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
     try{New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22-old-manifest'|Out-Null;$node=New-CcodLifecycleFakeNode -Root $nodeRoot;$first=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $node).Adapters;Set-CcodLifecycleTestStatus -InstallRoot $install -RuntimeId $first.RuntimeId;[IO.File]::WriteAllText((Join-Path $source 'src\runtime\main-payload.js'),"module.exports='upgrade';`n",[Text.UTF8Encoding]::new($false));$oldManifest=Join-Path $install "runtime\$($first.RuntimeId)\manifest.json";$fake=New-CcodLifecycleFake -NodePath $node;$changed=[pscustomobject]@{Done=$false};$fake.Adapters.WaitNewRuntimeReady={param($Root,$Runtime,$Generation,$Identity,$Started,$Timeout)if(-not$changed.Done){$changed.Done=$true;[IO.File]::SetAttributes($oldManifest,[IO.FileAttributes]::Normal);[IO.File]::AppendAllText($oldManifest,' ',[Text.UTF8Encoding]::new($false))};[pscustomobject]@{SupervisorReady=$false;TrayReady=$false}}.GetNewClosure();Assert-CcodThrows {Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters $fake.Adapters|Out-Null} 'CCOD_INSTALL_ROLLBACK_FAILED';$pointer=Read-CcodActiveRuntime -InstallRoot $install;Assert-CcodTrue ($pointer.activeRuntime-cne$first.RuntimeId) 'replaced old manifest cannot receive a compensating pointer';Assert-CcodEqual 2 $pointer.generation 'failed old-manifest proof leaves the committed new pointer generation';Assert-CcodEqual 2 @(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory).Count 'both generations remain retained'}finally{foreach($p in @($source,$install,$nodeRoot)){if(Test-Path $p){Remove-Item $p -Recurse -Force}}}

From 80392add5e0c2283eefc4026da3ba7b451822104 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 18:20:53 +0800
Subject: [PATCH 122/187] docs: record rollback lease ordering evidence

---
 .../task-1-report.md                          | 177 ++++++++++++++++++
 1 file changed, 177 insertions(+)
 create mode 100644 .superpowers/sdd/2026-09-02-v2522-rollback-lease-ordering/task-1-report.md

diff --git a/.superpowers/sdd/2026-09-02-v2522-rollback-lease-ordering/task-1-report.md b/.superpowers/sdd/2026-09-02-v2522-rollback-lease-ordering/task-1-report.md
new file mode 100644
index 0000000..7450204
--- /dev/null
+++ b/.superpowers/sdd/2026-09-02-v2522-rollback-lease-ordering/task-1-report.md
@@ -0,0 +1,177 @@
+# Task 1 report: release rollback cleanup lease before bootstrap
+
+## Scope and commit
+
+- Plan base: `3ec2a3d13f67995018b104840d121a6fadd2dcbd`.
+- Implementation: `a178f01a69a622ac9bd20091d6fdb326132dd9b3`
+  (`fix: release rollback cleanup lease`).
+- The implementation commit contains only:
+  - `src/persistence/modules/InstallLifecycle.psm1`
+  - `tests/persistence/InstallLifecycle.SelfTest.ps1`
+- Evidence is recorded in this report and committed separately after the
+  implementation source freeze.
+
+This is the minimal follow-up for the rollback lease-ordering residual. It does
+not claim release readiness, installed-product acceptance, or whole-branch
+review completion.
+
+## Root cause
+
+An upgrade acquires `upgradeProductCleanupLease` as the outer real
+`AccountTransition` mutex acquisition before resolving old durable product
+cleanup. On a failure before selector commit, rollback released lifecycle
+ownership and the inner install lease, but then called `StartSupervisorTask`
+while the outer acquisition was still live. The scheduled-task bootstrap needs
+the same real account mutex. It therefore timed out before it could restore and
+prove the retained old runtime Ready. The recoverable original activation
+failure was incorrectly escalated to `CCOD_INSTALL_ROLLBACK_FAILED`.
+
+## Test-first cross-process proof
+
+The new regression creates a temporary old Ready installation, mutates the
+source payload to begin a real upgrade, and injects failure in the
+`SetActiveRuntime` adapter before the production pointer write. It then proves:
+
+- the real selector still names the old runtime at generation 1;
+- exact old Supervisor exit occurred before rollback;
+- rollback invoked the fake scheduled-task start boundary;
+- that boundary launched a hidden, bounded independent `powershell.exe` child;
+- the child obtained its SID from `WindowsIdentity.GetCurrent()` and imported
+  the production `KernelObjects.psm1`;
+- the child called production `Enter-CcodMutex -Kind AccountTransition` with a
+  1500 ms mutex timeout;
+- `attempted.txt` was written immediately before that real acquisition, while
+  `acquired.txt` was written only after the returned lease had exact
+  `Outcome='Acquired'`;
+- the parent process wait was independently bounded at 10000 ms;
+- rollback readiness could become `Ready` only for the retained old runtime,
+  generation 1, after the real acquired marker existed.
+
+No fake mutex or pre-call acquisition marker is used. The process helper is
+test-only and does not create or start a Windows Scheduled Task.
+
+## RED evidence
+
+### Clean baseline before the test
+
+Command:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+```
+
+- Exit: `0`.
+- Result: `Install lifecycle self-tests passed: 128`.
+
+### Test-only change against the old production module
+
+The same complete command was run after adding only the cross-process helper
+and rollback regression, before modifying production code.
+
+- Exit: `1`.
+- Harness result:
+
+```text
+CCOD_SELFTEST_FAILED case=pre-pointer-rollback-releases-the-outer-cleanup-lease-before-old-Supervisor-bootstrap error=ASSERT_TRUE
+```
+
+- Exact failing assertion:
+
+```text
+ASSERT_TRUE: old bootstrap acquires AccountTransition before readiness (childExit=42; outcome=TimedOut; childFailure=)
+```
+
+The preceding pointer, previous-protection-stopped, and bootstrap-attempted
+assertions passed. The child completed normally enough to return the production
+mutex outcome `TimedOut`; there was no adapter, parser, process-launch, or child
+setup failure. This is the intended behavioral RED.
+
+## Implementation and exact ordering
+
+The pre-selector rollback branch now performs the following order:
+
+1. Close the shutdown gate if it is still live.
+2. Release live lifecycle ownership and require exact release proof.
+3. Release the acquired install lease and require a literal Boolean `true`.
+4. Release `upgradeProductCleanupLease` with
+   `Exit-CcodLifecycleProductCleanupLease`.
+5. Require a literal Boolean `true` and
+   `upgradeProductCleanupLease.Lease.Released=true`.
+6. Only after that proof, set `upgradeProductCleanupLease=$null`.
+7. Read the rollback clock, invoke `StartSupervisorTask`, and wait for the old
+   runtime readiness proof.
+
+This is strict LIFO for the nested lifecycle, install, and outer product
+cleanup acquisitions. If outer release throws or its exact result is not
+proven, control leaves the rollback body before task start; the existing
+rollback boundary normalizes the outcome to stable
+`CCOD_INSTALL_ROLLBACK_FAILED`.
+
+The successful forward-install path is unchanged. It still retains the outer
+product-cleanup lease across old-Pending resolution and the new selector
+commit, then releases lifecycle ownership, the install lease, and the outer
+lease before starting the new runtime. The fix therefore does not reopen the
+old-Pending/new-selector race.
+
+The enclosing `finally` now retries outer cleanup only when the context, its
+lease, and a still-unreleased lease are all present. A successful rollback
+release nulls the caller variable, and an already-released non-null context is
+also excluded, so final cleanup cannot release the mutex twice.
+
+## GREEN evidence
+
+Command:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+```
+
+- Exit: `0`.
+- Result: `Install lifecycle self-tests passed: 129`.
+- The new case proved `PointerCommitted=false`,
+  `PreviousProtectionStopped=true`, `BootstrapAttempted=true`,
+  `BootstrapMutexAcquired=true`, and `OldRuntimeOutcome='Ready'`.
+- After successful rollback, the original injected pre-pointer failure remained
+  `CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN`; it was not replaced by a false
+  rollback-fatal code.
+- The run retained the existing fresh-process observation:
+  `CCOD_CROSS_PROCESS_OBSERVED exit=23 mutex=True authority=False product=False verified=False error=CCOD_PRODUCT_REGISTRATION_FAILED`.
+
+## Fresh final matrix after source freeze
+
+| Command | Exit | Result |
+|---|---:|---|
+| `tests\persistence\InstallLifecycle.SelfTest.ps1` | 0 | `Install lifecycle self-tests passed: 129`. |
+| `tests\persistence\KernelObjects.SelfTest.ps1` | 0 | 16 named cases, all `True`. |
+| `tests\persistence\InstallFileTransaction.SelfTest.ps1` | 0 | `Install file transaction self-test passed.` |
+| PowerShell parser over both changed PowerShell files | 0 | `PARSE_OK`; token counts 31424 and 40901. |
+| `git diff --check` | 0 | No whitespace errors; only checkout LF-to-CRLF warnings. |
+| `tests\PersistenceSelfTest.ps1` | 0 | Fresh tracked aggregate over 39 discovered `*.SelfTest.ps1` files; no failure output. |
+
+The aggregate intentionally captures child self-test output and emits only a
+stable failure line when a child exits nonzero, so empty aggregate stdout with
+exit `0` is its normal passing result.
+
+The focused and aggregate runs retain the prior real cross-process product
+fence, bind-failure abort, abrupt-writer crash temporary recovery, atomic
+`SignalAndWait`, stale-N and closed-N rejection, exact create-only histories,
+and wrong-thread/double-cleanup mutex tests. No test was removed, skipped, or
+target-filtered for the final matrix.
+
+## No-real-action statement
+
+No real scheduled task, installed product, registry, Start-menu/Desktop
+shortcut, installer, uninstaller, Codex/product process, network, push, tag,
+release, signing, publication, installation, restart, or reboot action was
+performed. Tests used temporary fixture directories, fake task/product
+adapters, hidden bounded test child processes, and private named mutex/event
+objects only.
+
+## Remaining review boundary
+
+Request a fresh task and whole-branch independent review of the implementation
+and evidence commits. In particular, re-check the pre-selector rollback order,
+the unchanged post-selector success protection, release-failure normalization,
+and final live-lease guard. The green focused matrix and aggregate are not
+installed Windows acceptance, Defender evidence, reboot acceptance, or release
+proof.

From 2aef5ff2a74219a82e98fe26c2f8170a5232a280 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 18:53:34 +0800
Subject: [PATCH 123/187] docs: plan legacy upgrade and reclamation

---
 ...2-v2522-legacy-upgrade-safe-reclamation.md | 159 ++++++++++++++++++
 1 file changed, 159 insertions(+)
 create mode 100644 docs/superpowers/plans/2026-09-02-v2522-legacy-upgrade-safe-reclamation.md

diff --git a/docs/superpowers/plans/2026-09-02-v2522-legacy-upgrade-safe-reclamation.md b/docs/superpowers/plans/2026-09-02-v2522-legacy-upgrade-safe-reclamation.md
new file mode 100644
index 0000000..cd39b3b
--- /dev/null
+++ b/docs/superpowers/plans/2026-09-02-v2522-legacy-upgrade-safe-reclamation.md
@@ -0,0 +1,159 @@
+# Legacy Upgrade and Safe Reclamation Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Make real v2.5.21 and supported older installations converge to v2.5.22, migrate their exact product records, and reclaim an installed generation without pathname TOCTOU.
+
+**Architecture:** First classify legacy `active.json` state as an explicit pre-append-only upgrade source instead of demanding a nonexistent Ready transaction. Then migrate legacy registration by matching one complete known installer profile rather than the impossible union of all historical shortcut names. Finally replace recursive pathname deletion with a bounded native handle-pinned reclamation operation that re-proves the sealed tree and deletes only held identities.
+
+**Tech Stack:** Windows PowerShell 5.1, Inno Setup source history, V4 immutable file layer, Windows native file handles, existing lifecycle/product/uninstall self-tests.
+
+**Spec:** `docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md`
+
+## Global Constraints
+
+- Work only in the existing isolated worktree; preserve current dirty/user state outside it.
+- No real registry, shortcut, scheduled task, installed product, installer, network, release, push, installation, reboot, or external action.
+- True legacy acceptance is limited to exact, proven known layouts. Mixed append-only/legacy state, malformed pointers, unexpected registration objects, or changed paths fail closed.
+- Device-key/DPAPI state is never removed or modified.
+- Every physical delete uses pinned native identities and never follows reparse points; no broad or recursive pathname deletion.
+- Use RED -> GREEN, independent review per task, fresh full aggregate, and final whole-plan review.
+
+---
+
+### Task 1: Accept a proven v2.5.21 legacy lifecycle source
+
+**Files:**
+
+- Modify: `src/persistence/modules/InstallLifecycle.psm1`
+- Test: `tests/persistence/InstallLifecycle.SelfTest.ps1`
+- Test: `tests/persistence/InstalledLifecycleHarness.SelfTest.ps1`
+- Report: `.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-1-report.md`
+
+**Interfaces:**
+
+- Produces: `Get-CcodLegacyUpgradeCompatibilityContext -InstallRoot -ExistingPointer -ActiveValidation -GlobalTransaction`
+- Returns only `CurrentReady` or `ProvenLegacyWithoutReady`, with exact active runtime/generation/version/manifest identity.
+
+- [ ] **Step 1: Write a real legacy RED fixture**
+
+Build a fixture from merge-base `19803a79af3302c49f129e6a6b3ff7ffaf1b930b`: schema-2 `active.json`, v2.5.21 runtime/manifest and mutable legacy activation receipt, but no `state\active-generation`, `state\install-transactions`, or product cleanup fence plane. Invoke the actual v2.5.22 install path with lower OS effects adapted. Current code must fail before generation staging because it passes null Ready to the cleanup resolver.
+
+Also add mixed-state negatives: append-only selector without transaction chain, fence plane without Ready, malformed legacy active pointer, wrong manifest version, and legacy path reparse.
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+```
+
+Expected: nonzero at the true legacy fixture before the compatibility function exists; no adapter/setup failure.
+
+- [ ] **Step 3: Implement exact compatibility classification**
+
+For a current append-only installation, retain the full Ready/fence pre-upgrade resolution. For a proven legacy installation only, require all append-only/fence planes absent, exact schema-2 `active.json`, manifest-bound active runtime, project version `2.5.21` or another explicitly supported historical profile, and current-user safe paths. Skip durable-fence resolution because that version could not create such a fence. Any mixed or ambiguous state fails before staging.
+
+- [ ] **Step 4: Run GREEN**
+
+Run Lifecycle and InstalledLifecycleHarness suites; assert a new append-only selector/Ready transaction is produced, old active state remains only as legacy evidence, and failure before new Ready still restarts the old runtime.
+
+- [ ] **Step 5: Commit/report**
+
+Commit message: `fix: bridge legacy lifecycle upgrade`. Record RED/GREEN and no-real-action evidence.
+
+### Task 2: Migrate exact historical registration profiles
+
+**Files:**
+
+- Modify: `src/persistence/modules/ProductRegistration.psm1`
+- Test: `tests/persistence/ProductRegistration.SelfTest.ps1`
+- Test: `tests/persistence/InstallLifecycle.SelfTest.ps1`
+- Report: `.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-2-report.md`
+
+**Interfaces:**
+
+- Produces: `Get-CcodLegacyRegistrationProfiles` and `Resolve-CcodLegacyRegistrationProfile -LegacyRegistration`.
+- Each profile has canonical AppId, exact Start-menu/Desktop relative names, expected uninstall-command shape, and version range.
+
+- [ ] **Step 1: Write profile REDs**
+
+Use the exact v2.5.21 Inno shape:
+
+```text
+Programs\CodexRemote-fix\CodexRemote-fix.lnk
+Programs\CodexRemote-fix\CodexRemote-fix compatibility check.lnk
+Programs\CodexRemote-fix\Uninstall CodexRemote-fix.lnk
+Desktop\CodexRemote-fix.lnk
+```
+
+Add exact older profile(s) supported by checked-in installer history. Prove current union-of-eight logic rejects the real v2.5.21 set. Reject missing/extra/cross-profile/case-varied/reparse entries and a registry version/uninstall command that does not match the selected profile.
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ProductRegistration.SelfTest.ps1
+```
+
+Expected: real v2.5.21 shape fails before profile implementation.
+
+- [ ] **Step 3: Implement profile resolution and dynamic snapshot count**
+
+Select exactly one complete profile; never require the union of historical names. Snapshot count is one registry entry plus the selected profile's shortcut count. Preserve reverse-order compensation, replacement no-overwrite, unresolved create-only records, and exact current registration proof.
+
+- [ ] **Step 4: Run GREEN**
+
+Run ProductRegistration and Lifecycle suites. The true legacy lifecycle fixture must complete new product registration and remove exactly the matching old profile; a second same-package invocation is idempotent.
+
+- [ ] **Step 5: Commit/report**
+
+Commit message: `fix: migrate exact legacy registration profiles`.
+
+### Task 3: Reclaim a selected generation through pinned handles
+
+**Files:**
+
+- Create: `src/persistence/modules/GenerationReclamation.psm1`
+- Modify: `src/persistence/InstalledUninstallFinalizer.ps1`
+- Modify: `src/persistence/UninstallBootstrap.ps1`
+- Test: `tests/persistence/UninstallBootstrap.SelfTest.ps1`
+- Test: `tests/persistence/InstallFileTransaction.SelfTest.ps1`
+- Report: `.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-3-report.md`
+
+**Interfaces:**
+
+```powershell
+Remove-CcodVerifiedGenerationTree -InstallRoot <absolute> -RuntimeRoot <exact selected leaf> -RuntimeId <id> -ExpectedManifestSha256 <64hex>
+```
+
+- [ ] **Step 1: Write deletion REDs**
+
+Use a disposable generation with nested directories and manifest files. Insert a reparse child, hardlink, ADS, unexpected file, identity replacement, and an open child between initial validation and reclaim. Current pathname `Remove-Item -Recurse` must be shown to lack a pinned proof; hostile cases must delete neither the selected root nor outside target.
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\UninstallBootstrap.SelfTest.ps1
+```
+
+- [ ] **Step 3: Implement bounded native reclamation**
+
+Open the exact selected root and every expected manifest file/directory through relative native handles with DELETE/read-attributes/list rights and no delete/write sharing. Revalidate final paths, root ancestry, volume/file IDs, non-reparse, default stream, and single-link regular files. Compare the complete enumerated tree against the sealed manifest. Hold every handle, mark leaves and directories for deletion bottom-up through native handle disposition, then close. Any mismatch/open handle/change fails before deletion; never follow a path or use recursive `Remove-Item`. Preserve install root, sibling generations, state, and device-key store.
+
+- [ ] **Step 4: Run GREEN**
+
+Run UninstallBootstrap, IFT, Lifecycle, parser/diff and the full aggregate. The exact selected generation is absent only after handle-pinned deletion; sibling/root/state remain.
+
+- [ ] **Step 5: Commit/report**
+
+Commit message: `fix: reclaim generation through pinned handles`.
+
+## Final verification
+
+Run all focused persistence suites, `tests\PersistenceSelfTest.ps1`, parser/diff, and a fresh whole-plan review. Tasks 5–8 of the original release plan remain blocked until this plan is clean.
+
+## Self-Review
+
+- Spec coverage: Task 1 handles true lifecycle state; Task 2 handles actual installer registration; Task 3 handles physical reclamation.
+- Placeholder scan: each task has concrete fixtures, APIs, commands and failure boundaries.
+- Type consistency: Task 2 consumes Task 1's real legacy fixture; Task 3 is independent and preserves all lifecycle state.
+

From 5114a09953e2566b1127788ffbad115c11ae072f Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 20:21:55 +0800
Subject: [PATCH 124/187] fix: bridge legacy lifecycle upgrade

---
 src/persistence/modules/InstallLifecycle.psm1 | 171 ++++++++++-
 .../persistence/InstallLifecycle.SelfTest.ps1 | 284 ++++++++++++++++++
 .../InstalledLifecycleHarness.SelfTest.ps1    |  27 +-
 3 files changed, 477 insertions(+), 5 deletions(-)

diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index 41a15a4..eae97d0 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -21,6 +21,8 @@ $script:CcodInstallTransactionRoots = [Runtime.CompilerServices.ConditionalWeakT
 $script:CcodProductCleanupFenceFields = @('schemaVersion','transactionId','runtimeId','runtimeGeneration','manifestSha256','packageSha256','ownerPid','ownerCreationTimeUtc','ownerSid','state')
 $script:CcodPendingProductTransactionCleanups = [Collections.Hashtable]::Synchronized(@{})
 $script:CcodProductCleanupLeaseContexts = [Collections.Hashtable]::Synchronized(@{})
+# Exact pre-append-only profile from merge-base 19803a79af3302c49f129e6a6b3ff7ffaf1b930b.
+$script:CcodLegacyUpgradeProjectVersions = @('2.5.21')
 
 function Throw-CcodLifecycleError {
     param(
@@ -1096,6 +1098,161 @@ function Test-CcodInstallPackageIdentity {
     return ([string]$TransactionRecord.phase -ceq 'Ready' -and [string]$TransactionRecord.newRuntimeId -ceq $ActiveRuntimeId -and [uint64]$TransactionRecord.newGeneration -eq $ActiveGeneration)
 }
 
+function Test-CcodLegacyUpgradePlaneMissing {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RelativePath)
+    $path = [IO.Path]::GetFullPath((Join-Path $InstallRoot $RelativePath))
+    [void](Assert-CcodLifecycleInstallPathSafe -InstallRoot $InstallRoot -Path $path)
+    try {
+        $item = Get-Item -LiteralPath $path -Force -ErrorAction Stop
+        if ($null -eq $item) { throw [IO.InvalidDataException]::new('path lookup returned no object') }
+        return $false
+    } catch [Management.Automation.ItemNotFoundException] {
+        return $true
+    } catch {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Upgrade compatibility plane presence could not be proven' $path
+    }
+}
+
+function Get-CcodLegacyRuntimeValidation {
+    param(
+        [Parameter(Mandatory)][string]$InstallRoot,
+        [Parameter(Mandatory)]$ExistingPointer,
+        [Parameter(Mandatory)]$ActiveValidation
+    )
+
+    $runtimeRoot = [IO.Path]::GetFullPath((Join-Path (Join-Path $InstallRoot 'runtime') ([string]$ExistingPointer.activeRuntime)))
+    [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $InstallRoot -Path $runtimeRoot)
+    $manifestPath = Join-Path $runtimeRoot 'manifest.json'
+    [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $InstallRoot -Path $manifestPath)
+    $manifest = Read-CcodStrictJson -Path $manifestPath -ExpectedSchema 1 -Kind 'legacy runtime manifest'
+    if (-not (Test-CcodLifecycleOrderedProperties $manifest @('schemaVersion','projectVersion','runtimeId','files')) -or
+        $manifest.schemaVersion -isnot [int] -or $manifest.schemaVersion -ne 1 -or
+        $manifest.projectVersion -isnot [string] -or $script:CcodLegacyUpgradeProjectVersions -cnotcontains [string]$manifest.projectVersion -or
+        $manifest.runtimeId -isnot [string] -or [string]$manifest.runtimeId -cne [string]$ExistingPointer.activeRuntime -or
+        $manifest.files -isnot [Array]) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Legacy runtime manifest profile is not supported' $manifestPath
+    }
+    if ($null -eq $ActiveValidation -or $ActiveValidation.Valid -isnot [bool] -or $ActiveValidation.Valid -or
+        $ActiveValidation.Code -isnot [string] -or $ActiveValidation.Code -cne 'CCOD_RUNTIME_ID_MISMATCH' -or
+        $ActiveValidation.RuntimeId -isnot [string] -or $ActiveValidation.RuntimeId -cne [string]$manifest.runtimeId -or
+        $null -eq $ActiveValidation.Manifest -or
+        ($ActiveValidation.Manifest | ConvertTo-Json -Depth 16 -Compress) -cne ($manifest | ConvertTo-Json -Depth 16 -Compress)) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Only the exact historical runtime-ID validation mismatch may enter legacy compatibility' $runtimeRoot
+    }
+
+    # v2.5.21 Get-CcodRuntimeId used version + the first 16 hex characters of
+    # the sorted manifest-record digest and did not yet include a nonce.
+    $canonicalLines = [Collections.Generic.List[string]]::new()
+    $previousPath = $null
+    foreach ($file in @($manifest.files)) {
+        if (-not (Test-CcodLifecycleOrderedProperties $file @('path','length','sha256')) -or
+            $file.path -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$file.path) -or
+            [IO.Path]::IsPathRooted([string]$file.path) -or [string]$file.path -match '\\' -or
+            [string]$file.path -match '(^|/)(\.|\.\.)(/|$)' -or [string]$file.path -match '//' -or
+            [string]$file.path -ceq 'manifest.json' -or
+            -not (Test-CcodLifecycleProductCleanupInteger $file.length) -or [int64]$file.length -lt 0 -or
+            $file.sha256 -isnot [string] -or [string]$file.sha256 -cnotmatch '^[0-9a-f]{64}$' -or
+            ($null -ne $previousPath -and [StringComparer]::Ordinal.Compare($previousPath,[string]$file.path) -ge 0)) {
+            Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Legacy runtime manifest file records are not canonical' $manifestPath
+        }
+        $previousPath = [string]$file.path
+        $canonicalLines.Add(('{0}`t{1}`t{2}' -f [string]$file.path,[int64]$file.length,[string]$file.sha256))
+    }
+    $sha = [Security.Cryptography.SHA256]::Create()
+    try {
+        $digest = [BitConverter]::ToString($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes(($canonicalLines -join "`n")))).Replace('-','').ToLowerInvariant()
+    } finally { $sha.Dispose() }
+    $historicalRuntimeId = '{0}-{1}' -f [string]$manifest.projectVersion,$digest.Substring(0,16)
+    if ($historicalRuntimeId -cne [string]$manifest.runtimeId) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Legacy runtime ID is not bound by the historical manifest algorithm' $manifestPath
+    }
+    return [pscustomobject]@{Valid=$true;Code='CCOD_RUNTIME_VALID';RuntimeId=[string]$manifest.runtimeId;Manifest=$manifest}
+}
+
+function Get-CcodLegacyUpgradeCompatibilityContext {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string]$InstallRoot,
+        [Parameter(Mandatory)]$ExistingPointer,
+        [Parameter(Mandatory)]$ActiveValidation,
+        [AllowNull()]$GlobalTransaction
+    )
+
+    $root = Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
+    try {
+        if (-not (Test-CcodLifecycleOrderedProperties $ExistingPointer @('schemaVersion','activeRuntime','previousRuntime','generation','updatedAtUtc')) -or
+            $ExistingPointer.schemaVersion -isnot [int] -or $ExistingPointer.schemaVersion -ne 2 -or
+            $ExistingPointer.activeRuntime -isnot [string] -or $ExistingPointer.activeRuntime -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$' -or
+            -not (Test-CcodLifecycleProductCleanupInteger $ExistingPointer.generation) -or [uint64]$ExistingPointer.generation -eq 0) {
+            throw 'active pointer contract'
+        }
+        $runtimeRoot = [IO.Path]::GetFullPath((Join-Path (Join-Path $root 'runtime') ([string]$ExistingPointer.activeRuntime)))
+        $manifestPath = Join-Path $runtimeRoot 'manifest.json'
+        [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $runtimeRoot)
+        [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $root -Path $manifestPath)
+        $manifestSha256 = Get-CcodLifecycleFileSha256 -Path $manifestPath
+        $selectorMissing = Test-CcodLegacyUpgradePlaneMissing -InstallRoot $root -RelativePath 'state\active-generation'
+        $transactionPlaneMissing = Test-CcodLegacyUpgradePlaneMissing -InstallRoot $root -RelativePath 'state\install-transactions'
+
+        if (-not $selectorMissing -and -not $transactionPlaneMissing) {
+            [void](Assert-CcodInstallTransactionRecord -Record $GlobalTransaction)
+            if ($GlobalTransaction.phase -cne 'Ready' -or
+                $ActiveValidation.Valid -isnot [bool] -or -not $ActiveValidation.Valid -or
+                $ActiveValidation.RuntimeId -cne [string]$ExistingPointer.activeRuntime -or
+                $GlobalTransaction.newRuntimeId -cne [string]$ExistingPointer.activeRuntime -or
+                [uint64]$GlobalTransaction.newGeneration -ne [uint64]$ExistingPointer.generation -or
+                $GlobalTransaction.newManifestSha256 -cne $manifestSha256 -or
+                $ActiveValidation.Manifest.runtimeId -cne [string]$ExistingPointer.activeRuntime) {
+                throw 'current Ready identity'
+            }
+            return [pscustomobject][ordered]@{
+                Kind='CurrentReady';ActiveRuntimeId=[string]$ExistingPointer.activeRuntime;ActiveGeneration=[uint64]$ExistingPointer.generation
+                ProjectVersion=[string]$ActiveValidation.Manifest.projectVersion;ManifestSha256=$manifestSha256;Manifest=$ActiveValidation.Manifest;ActiveValidation=$ActiveValidation
+            }
+        }
+        if ($selectorMissing -ne $transactionPlaneMissing -or $null -ne $GlobalTransaction -or
+            -not (Test-CcodLegacyUpgradePlaneMissing -InstallRoot $root -RelativePath 'state\product-cleanup-fences')) {
+            throw 'mixed legacy and append-only state'
+        }
+
+        $activePath = Join-Path $root 'active.json'
+        [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $root -Path $activePath)
+        $legacyActive = Read-CcodStrictJson -Path $activePath -ExpectedSchema 2 -Kind 'legacy active runtime'
+        if (-not (Test-CcodLifecycleOrderedProperties $legacyActive @('schemaVersion','activeRuntime','previousRuntime','generation','updatedAtUtc')) -or
+            $legacyActive.schemaVersion -isnot [int] -or $legacyActive.schemaVersion -ne 2 -or
+            $legacyActive.activeRuntime -isnot [string] -or $legacyActive.activeRuntime -cne [string]$ExistingPointer.activeRuntime -or
+            $null -ne $legacyActive.previousRuntime -or $null -ne $ExistingPointer.previousRuntime -or
+            -not (Test-CcodLifecycleProductCleanupInteger $legacyActive.generation) -or [uint64]$legacyActive.generation -ne 1 -or [uint64]$legacyActive.generation -ne [uint64]$ExistingPointer.generation -or
+            -not (Test-CcodLifecycleCanonicalUtc $legacyActive.updatedAtUtc) -or $legacyActive.updatedAtUtc -cne [string]$ExistingPointer.updatedAtUtc) {
+            throw 'legacy active pointer identity'
+        }
+        $legacyValidation = Get-CcodLegacyRuntimeValidation -InstallRoot $root -ExistingPointer $ExistingPointer -ActiveValidation $ActiveValidation
+        return [pscustomobject][ordered]@{
+            Kind='ProvenLegacyWithoutReady';ActiveRuntimeId=[string]$ExistingPointer.activeRuntime;ActiveGeneration=[uint64]$ExistingPointer.generation
+            ProjectVersion=[string]$legacyValidation.Manifest.projectVersion;ManifestSha256=$manifestSha256;Manifest=$legacyValidation.Manifest;ActiveValidation=$legacyValidation
+        }
+    } catch {
+        if ((Get-CcodLifecycleErrorId $_) -ceq 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID') { throw }
+        Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Existing installation is not an exact supported upgrade source' $root
+    }
+}
+
+function Initialize-CcodLegacyUpgradeSelector {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$CompatibilityContext,[Parameter(Mandatory)]$FileTransaction)
+    if ($CompatibilityContext.Kind -cne 'ProvenLegacyWithoutReady' -or [uint64]$CompatibilityContext.ActiveGeneration -ne 1) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Supported legacy selector migration requires exact generation one' $CompatibilityContext
+    }
+    # Publish a generation-one selector for the retained legacy runtime before
+    # the ordinary generation-two pointer commit. active.json remains evidence.
+    $retained = Open-CcodInstallRetainedGeneration -InstallRoot $InstallRoot -RuntimeId $CompatibilityContext.ActiveRuntimeId -ExpectedManifestSha256 $CompatibilityContext.ManifestSha256 -FileTransaction $FileTransaction
+    [void](Commit-CcodInstallActivePointer -InstallRoot $InstallRoot -TargetGeneration $retained -ExpectedPreviousGeneration ([uint64]0) -FileTransaction $FileTransaction)
+    $pointer = Read-CcodActiveRuntime -InstallRoot $InstallRoot
+    if ($pointer.activeRuntime -cne $CompatibilityContext.ActiveRuntimeId -or [uint64]$pointer.generation -ne 1) {
+        Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Legacy selector migration could not be proven' $CompatibilityContext.ActiveRuntimeId
+    }
+    return $pointer
+}
+
 function Assert-CcodLifecycleInstallPathSafe {
     param(
         [Parameter(Mandatory)][string]$InstallRoot,
@@ -3038,14 +3195,17 @@ function Invoke-CcodInstall {
         $files=@($preparedProductFiles.Files);$productShortcutTemporaryRoot=[string]$preparedProductFiles.TemporaryRoot
     }
 
-    $oldManifestSha256=$null;$activeValidation=$null
+    $oldManifestSha256=$null;$activeValidation=$null;$upgradeCompatibility=$null
     if($null-ne$existingPointer){
         $activeRuntimeRoot=[IO.Path]::GetFullPath((Join-Path (Join-Path $root 'runtime') ([string]$existingPointer.activeRuntime)))
         $activeManifestPath=Join-Path $activeRuntimeRoot 'manifest.json'
         if(-not[IO.File]::Exists($activeManifestPath)){Throw-CcodLifecycleError 'CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN' 'The active runtime manifest is missing before upgrade' $activeManifestPath}
+        [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $root -Path $activeRuntimeRoot)
+        [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $root -Path $activeManifestPath)
         $oldManifestSha256=Get-CcodLifecycleFileSha256 -Path $activeManifestPath
         $activeValidation=Test-CcodRuntimeManifest -RuntimeDirectory $activeRuntimeRoot -ExpectedRuntimeId ([string]$existingPointer.activeRuntime) -ExpectedManifestSha256 $oldManifestSha256
-        if(-not$activeValidation.Valid){Throw-CcodLifecycleError 'CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN' 'The active runtime manifest is invalid before upgrade' $activeRuntimeRoot}
+        $upgradeCompatibility=Get-CcodLegacyUpgradeCompatibilityContext -InstallRoot $root -ExistingPointer $existingPointer -ActiveValidation $activeValidation -GlobalTransaction $globalTransaction
+        $activeValidation=$upgradeCompatibility.ActiveValidation
     }
     if($null-ne$existingPointer-and$sealedPackageIdentitySupplied){
         if($activeValidation.Valid){
@@ -3086,7 +3246,11 @@ function Invoke-CcodInstall {
         if($upgrade){
             if($adapters.CloseProductTransaction-isnot[scriptblock]){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product transaction close adapter is invalid before upgrade' $root}
             $upgradeProductCleanupLease=Enter-CcodLifecycleProductCleanupLease
-            [void](Resolve-CcodLifecycleProductCleanupFence -InstallRoot $root -ReadyTransaction $globalTransaction -CurrentIdentity $upgradeProductCleanupLease.OwnerIdentity -CloseProductTransaction $adapters.CloseProductTransaction)
+            if($upgradeCompatibility.Kind-ceq'CurrentReady'){
+                [void](Resolve-CcodLifecycleProductCleanupFence -InstallRoot $root -ReadyTransaction $globalTransaction -CurrentIdentity $upgradeProductCleanupLease.OwnerIdentity -CloseProductTransaction $adapters.CloseProductTransaction)
+            }elseif($upgradeCompatibility.Kind-cne'ProvenLegacyWithoutReady'){
+                Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Upgrade compatibility classification changed before staging' $upgradeCompatibility
+            }
         }
         $runtimeId=New-CcodUniqueRuntimeId -ProjectVersion $projectVersion -Files $files;$generation=New-CcodLifecycleImmutableGeneration -InstallRoot $root -RuntimeId $runtimeId -ProjectVersion $projectVersion -Files $files;$fileTransaction=$generation.FileTransaction;$generationCapability=$generation.Generation;$runtimeRoot=$generation.RuntimeRoot;$runtimeCreated=$true
         $newGeneration=if($null-eq$existingPointer){[uint64]1}else{[uint64]$existingPointer.generation+1};$installRecord=New-CcodInstallTransactionRecord -TransactionId ([guid]::NewGuid().ToString('D')) -OldRuntimeId $(if($upgrade){$existingPointer.activeRuntime}else{$null}) -OldGeneration $(if($upgrade){$existingPointer.generation}else{$null}) -OldManifestSha256 $oldManifestSha256 -NewRuntimeId $runtimeId -NewGeneration $newGeneration -NewManifestSha256 $generation.ManifestSha256 -SealedPackageSha256 $SealedPackageSha256 -OwnedObjectNames @($runtimeId)
@@ -3127,6 +3291,7 @@ function Invoke-CcodInstall {
         $installRecord=Set-CcodInstallTransactionPhase -InstallRoot $root -TransactionId $installRecord.transactionId -ExpectedPhase 'PreviousProtectionStopped' -NewPhase 'RuntimePromoted' -FileTransaction $fileTransaction
         Initialize-CcodInstallStatePlanes -InstallRoot $root -RuntimeId $runtimeId -FileTransaction $fileTransaction -NodeCandidates $nodeCandidates -CandidateCompatibleOptIn ([bool]$EnableCandidateCompatibleUpdates)
         Write-CcodInstallActivationPhase -Activation $activation -Phase 'ActivatingRuntime' -RuntimeId $runtimeId -PreviousRuntimeId $(if ($upgrade) { [string]$existingPointer.activeRuntime } else { $null }) -ErrorCode $null -Adapters $adapters -InstallRoot $root -FileTransaction $fileTransaction | Out-Null
+        if($upgrade-and$upgradeCompatibility.Kind-ceq'ProvenLegacyWithoutReady'){$existingPointer=Initialize-CcodLegacyUpgradeSelector -InstallRoot $root -CompatibilityContext $upgradeCompatibility -FileTransaction $fileTransaction;$pointer=$existingPointer}
         $process = [Diagnostics.Process]::GetCurrentProcess()
         try {
             $ownerIdentity = [pscustomobject][ordered]@{ pid=[int]$process.Id; creationTimeUtc=$process.StartTime.ToUniversalTime().ToString('o') }
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index e5a7f71..3e3930a 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -61,6 +61,105 @@ function New-CcodLifecycleSourceFixture {
     return $Root
 }
 
+function New-CcodLifecycleV2521LegacyInstallFixture {
+    param(
+        [Parameter(Mandatory)][string]$InstallRoot,
+        [Parameter(Mandatory)][string]$SourceRoot
+    )
+
+    # Source of truth: merge-base 19803a79af3302c49f129e6a6b3ff7ffaf1b930b.
+    # That release copied this pre-append-only inventory, derived a two-part
+    # version-digest runtime ID, wrote schema-2 active.json, and kept one
+    # mutable post-install activation receipt.
+    $relativeFiles = [Collections.Generic.List[string]]::new()
+    foreach ($relative in @(
+        'src\check-package.mjs',
+        'src\persistence\Supervisor.ps1',
+        'src\persistence\SessionController.ps1',
+        'src\persistence\StaticProbeWorker.ps1',
+        'src\persistence\LifecycleWorker.ps1',
+        'src\persistence\bootstrap.ps1',
+        'src\persistence\UninstallBootstrap.ps1',
+        'src\persistence\PortableUninstallFinalizer.ps1',
+        'Test-CodexControlOtherDevices.ps1',
+        'Start-CodexControlOtherDevices.ps1',
+        'Reset-CodexControlOtherDevices.ps1'
+    )) { $relativeFiles.Add($relative) }
+    foreach ($file in @(Get-ChildItem -LiteralPath (Join-Path $SourceRoot 'bin') -File -Force)) {
+        $relativeFiles.Add('bin\' + $file.Name)
+    }
+    foreach ($file in @(Get-ChildItem -LiteralPath (Join-Path $SourceRoot 'src\runtime') -File -Force -Recurse)) {
+        $relativeFiles.Add('src\runtime\' + $file.FullName.Substring((Join-Path $SourceRoot 'src\runtime').TrimEnd('\').Length + 1))
+    }
+    foreach ($file in @(Get-ChildItem -LiteralPath (Join-Path $SourceRoot 'src\persistence\modules') -Filter '*.psm1' -File -Force)) {
+        $relativeFiles.Add('src\persistence\modules\' + $file.Name)
+    }
+    foreach ($file in @(Get-ChildItem -LiteralPath (Join-Path $SourceRoot 'src\persistence\resources') -File -Force)) {
+        $relativeFiles.Add('src\persistence\resources\' + $file.Name)
+    }
+
+    $runtimeParent = Join-Path $InstallRoot 'runtime'
+    $stagingRoot = Join-Path $runtimeParent '.v2521-fixture'
+    [IO.Directory]::CreateDirectory($stagingRoot) | Out-Null
+    foreach ($relative in $relativeFiles) {
+        $source = Join-Path $SourceRoot $relative
+        $destination = Join-Path $stagingRoot $relative
+        [IO.Directory]::CreateDirectory((Split-Path $destination -Parent)) | Out-Null
+        Copy-Item -LiteralPath $source -Destination $destination -Force
+    }
+
+    $records = [Collections.Generic.List[object]]::new()
+    foreach ($file in @(Get-ChildItem -LiteralPath $stagingRoot -File -Force -Recurse)) {
+        $records.Add([pscustomobject][ordered]@{
+            path = $file.FullName.Substring($stagingRoot.TrimEnd('\').Length + 1).Replace('\','/')
+            length = [int64]$file.Length
+            sha256 = (Get-FileHash -LiteralPath $file.FullName -Algorithm SHA256).Hash.ToLowerInvariant()
+        })
+    }
+    $comparison = [Comparison[object]]{ param($left,$right) [StringComparer]::Ordinal.Compare([string]$left.path,[string]$right.path) }
+    $records.Sort($comparison)
+    $canonical = (@($records) | ForEach-Object { '{0}`t{1}`t{2}' -f $_.path,$_.length,$_.sha256 }) -join "`n"
+    $sha256 = [Security.Cryptography.SHA256]::Create()
+    try {
+        $digest = [BitConverter]::ToString($sha256.ComputeHash([Text.Encoding]::UTF8.GetBytes($canonical))).Replace('-','').ToLowerInvariant()
+    } finally { $sha256.Dispose() }
+    $runtimeId = '2.5.21-' + $digest.Substring(0,16)
+    $runtimeRoot = Join-Path $runtimeParent $runtimeId
+    [IO.Directory]::Move($stagingRoot,$runtimeRoot)
+    $manifest = [pscustomobject][ordered]@{
+        schemaVersion = 1
+        projectVersion = '2.5.21'
+        runtimeId = $runtimeId
+        files = @($records)
+    }
+    [IO.File]::WriteAllText((Join-Path $runtimeRoot 'manifest.json'),($manifest | ConvertTo-Json -Depth 16),[Text.UTF8Encoding]::new($false))
+
+    $timestamp = '2030-02-03T03:04:05.0000000Z'
+    $active = [pscustomobject][ordered]@{
+        schemaVersion = 2
+        activeRuntime = $runtimeId
+        previousRuntime = $null
+        generation = [uint64]1
+        updatedAtUtc = $timestamp
+    }
+    [IO.File]::WriteAllText((Join-Path $InstallRoot 'active.json'),($active | ConvertTo-Json -Depth 4),[Text.UTF8Encoding]::new($false))
+    $stateRoot = Join-Path $InstallRoot 'state'
+    [IO.Directory]::CreateDirectory($stateRoot) | Out-Null
+    $receipt = [pscustomobject][ordered]@{
+        schemaVersion = 1
+        activationId = '11111111-2222-4333-8444-555555555555'
+        phase = 'Ready'
+        runtimeId = $runtimeId
+        previousRuntimeId = $null
+        startedAtUtc = $timestamp
+        updatedAtUtc = $timestamp
+        ready = $true
+        errorCode = $null
+    }
+    [IO.File]::WriteAllText((Join-Path $stateRoot 'post-install-activation.json'),($receipt | ConvertTo-Json -Depth 4),[Text.UTF8Encoding]::new($false))
+    return [pscustomobject][ordered]@{ RuntimeId=$runtimeId;RuntimeRoot=$runtimeRoot;Manifest=$manifest;Active=$active;Receipt=$receipt }
+}
+
 function New-CcodLifecyclePayloadManifest {
     param(
         [Parameter(Mandatory)][string]$Root,
@@ -807,6 +906,191 @@ $results += Invoke-CcodTest 'same-version immutable install identity is idempote
     Assert-CcodEqual $false $legacy 'legacy install without transaction record is treated as non-idempotent Idle'
 }
 
+$results += Invoke-CcodTest 'real v2.5.21 legacy lifecycle state upgrades through the v2.5.22 install entrypoint' {
+    $legacySource=New-CcodLifecycleTempRoot;$source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    try {
+        New-CcodLifecycleSourceFixture -Root $legacySource -Version '2.5.21' | Out-Null
+        $legacy=New-CcodLifecycleV2521LegacyInstallFixture -InstallRoot $install -SourceRoot $legacySource
+        Assert-CcodTrue ($legacy.RuntimeId -cmatch '^2\.5\.21-[0-9a-f]{16}$') 'fixture uses the merge-base two-part runtime identity'
+        Assert-CcodEqual 'schemaVersion,activeRuntime,previousRuntime,generation,updatedAtUtc' (@($legacy.Active.PSObject.Properties.Name)-join ',') 'fixture uses the merge-base schema-two active pointer'
+        Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $install 'state\active-generation')) 'legacy fixture has no append-only selector plane'
+        Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $install 'state\install-transactions')) 'legacy fixture has no append-only transaction plane'
+        Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $install 'state\product-cleanup-fences')) 'legacy fixture has no durable cleanup fence plane'
+        $legacyActiveHash=Get-CcodTestFileSha256 -Path (Join-Path $install 'active.json')
+        $legacyManifestHash=Get-CcodTestFileSha256 -Path (Join-Path $legacy.RuntimeRoot 'manifest.json')
+        $legacyPointer=Read-CcodActiveRuntime -InstallRoot $install
+        $legacyValidation=Test-CcodRuntimeManifest -RuntimeDirectory $legacy.RuntimeRoot -ExpectedRuntimeId $legacy.RuntimeId -ExpectedManifestSha256 $legacyManifestHash
+        $module=Get-Module InstallLifecycle -ErrorAction Stop
+        $compatibility=&$module {param($Root,$Pointer,$Validation)Get-CcodLegacyUpgradeCompatibilityContext -InstallRoot $Root -ExistingPointer $Pointer -ActiveValidation $Validation -GlobalTransaction $null} $install $legacyPointer $legacyValidation
+        Assert-CcodEqual 'ProvenLegacyWithoutReady' $compatibility.Kind 'compatibility function returns only the proven legacy classification'
+        Assert-CcodEqual $legacy.RuntimeId $compatibility.ActiveRuntimeId 'compatibility context retains the exact active runtime identity'
+        Assert-CcodEqual ([uint64]1) $compatibility.ActiveGeneration 'compatibility context retains the exact legacy generation'
+        Assert-CcodEqual '2.5.21' $compatibility.ProjectVersion 'compatibility context retains the exact supported project version'
+        Assert-CcodEqual $legacyManifestHash $compatibility.ManifestSha256 'compatibility context retains the exact manifest identity'
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22' | Out-Null
+        $node=New-CcodLifecycleFakeNode -Root $nodeRoot
+        $fake=New-CcodLifecycleFake -NodePath $node
+        $beforeRuntimeCount=@(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory -Force).Count
+
+        $upgrade=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('a'*64) -Adapters $fake.Adapters
+
+        Assert-CcodEqual 'Upgraded' $upgrade.Outcome 'proven legacy state converges through the real install entrypoint'
+        Assert-CcodEqual ($beforeRuntimeCount+1) @(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory -Force).Count 'upgrade stages exactly one immutable generation'
+        Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $install 'state\active-generation') -PathType Container) 'upgrade creates the append-only selector plane'
+        Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $install 'state\install-transactions') -PathType Container) 'upgrade creates the append-only transaction plane'
+        Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $install 'active.json') -PathType Leaf) 'legacy active pointer remains only as migration evidence'
+        Assert-CcodEqual $legacyActiveHash (Get-CcodTestFileSha256 -Path (Join-Path $install 'active.json')) 'upgrade never rewrites the legacy active pointer evidence'
+        $pointer=Read-CcodActiveRuntime -InstallRoot $install
+        Assert-CcodEqual $upgrade.RuntimeId $pointer.activeRuntime 'append-only selector chooses the new runtime instead of stale active.json'
+        Assert-CcodEqual ([uint64]2) $pointer.generation 'legacy genesis and new activation form a contiguous two-record selector chain'
+        Assert-CcodEqual 2 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\active-generation') -File -Force).Count 'upgrade publishes legacy genesis and the new active selector exactly once each'
+        $ready=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install
+        Assert-CcodEqual 'Ready' $ready.phase 'upgrade publishes a terminal append-only Ready transaction'
+        Assert-CcodEqual $legacy.RuntimeId $ready.oldRuntimeId 'Ready transaction is bound to the exact legacy source runtime'
+        Assert-CcodEqual ([uint64]1) $ready.oldGeneration 'Ready transaction is bound to the exact legacy source generation'
+        Assert-CcodEqual $upgrade.RuntimeId $ready.newRuntimeId 'Ready transaction is bound to the selected new runtime'
+        Assert-CcodEqual ([uint64]2) $ready.newGeneration 'Ready transaction is bound to the selected new generation'
+        $currentRuntimeRoot=Join-Path (Join-Path $install 'runtime') $upgrade.RuntimeId
+        $currentManifestHash=Get-CcodTestFileSha256 -Path (Join-Path $currentRuntimeRoot 'manifest.json')
+        $currentValidation=Test-CcodRuntimeManifest -RuntimeDirectory $currentRuntimeRoot -ExpectedRuntimeId $upgrade.RuntimeId -ExpectedManifestSha256 $currentManifestHash
+        $currentCompatibility=&$module {param($Root,$Pointer,$Validation,$Transaction)Get-CcodLegacyUpgradeCompatibilityContext -InstallRoot $Root -ExistingPointer $Pointer -ActiveValidation $Validation -GlobalTransaction $Transaction} $install $pointer $currentValidation $ready
+        Assert-CcodEqual 'CurrentReady' $currentCompatibility.Kind 'compatibility function returns only the current Ready classification after migration'
+        Assert-CcodEqual $upgrade.RuntimeId $currentCompatibility.ActiveRuntimeId 'current compatibility remains bound to the selected runtime'
+        Assert-CcodEqual ([uint64]2) $currentCompatibility.ActiveGeneration 'current compatibility remains bound to the selected generation'
+        Assert-CcodEqual $currentManifestHash $currentCompatibility.ManifestSha256 'current compatibility remains bound to the selected manifest'
+    } finally {
+        foreach($path in @($legacySource,$source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}
+    }
+}
+
+foreach($legacyCase in @(
+    [pscustomobject]@{Name='append-only selector without a transaction chain';Kind='selector';Expected='CCOD_INSTALL_UPGRADE_SOURCE_INVALID'},
+    [pscustomobject]@{Name='cleanup fence plane without Ready authority';Kind='fence';Expected='CCOD_INSTALL_UPGRADE_SOURCE_INVALID'},
+    [pscustomobject]@{Name='schema-one active pointer normalized by the general reader';Kind='active';Expected='CCOD_INSTALL_UPGRADE_SOURCE_INVALID'},
+    [pscustomobject]@{Name='generation-one active pointer with a previous runtime';Kind='previous';Expected='CCOD_INSTALL_UPGRADE_SOURCE_INVALID'},
+    [pscustomobject]@{Name='legacy generation without reconstructable append-only history';Kind='generation';Expected='CCOD_INSTALL_UPGRADE_SOURCE_INVALID'},
+    [pscustomobject]@{Name='current nonce runtime format disguised as v2.5.21';Kind='current-format';Expected='CCOD_INSTALL_UPGRADE_SOURCE_INVALID'},
+    [pscustomobject]@{Name='runtime manifest from an unsupported historical version';Kind='version';Expected='CCOD_INSTALL_UPGRADE_SOURCE_INVALID'},
+    [pscustomobject]@{Name='legacy runtime path reparse';Kind='reparse';Expected='CCOD_INSTALL_REPARSE_PATH'}
+)) {
+    $case=$legacyCase
+    $results += Invoke-CcodTest ("legacy upgrade classification rejects {0} before generation staging" -f $case.Name) {
+        $legacySource=New-CcodLifecycleTempRoot;$source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot;$outside=$null;$junction=$null
+        try {
+            New-CcodLifecycleSourceFixture -Root $legacySource -Version '2.5.21' | Out-Null
+            $legacy=New-CcodLifecycleV2521LegacyInstallFixture -InstallRoot $install -SourceRoot $legacySource
+            switch($case.Kind) {
+                'selector' {
+                    $selector=Join-Path $install 'state\active-generation';[IO.Directory]::CreateDirectory($selector)|Out-Null
+                    [IO.File]::WriteAllText((Join-Path $selector '00000000000000000001.json'),([ordered]@{schemaVersion=1;generation=[uint64]1;activeRuntime=$legacy.RuntimeId;previousGeneration=[uint64]0}|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
+                }
+                'fence' { [IO.Directory]::CreateDirectory((Join-Path $install 'state\product-cleanup-fences'))|Out-Null }
+                'active' {
+                    [IO.File]::WriteAllText((Join-Path $install 'active.json'),([ordered]@{schemaVersion=1;activeRuntime=$legacy.RuntimeId;previousRuntime=$null;updatedAtUtc=$legacy.Active.updatedAtUtc}|ConvertTo-Json),[Text.UTF8Encoding]::new($false))
+                }
+                'previous' {
+                    [IO.File]::WriteAllText((Join-Path $install 'active.json'),([ordered]@{schemaVersion=2;activeRuntime=$legacy.RuntimeId;previousRuntime='2.5.20-0000000000000000';generation=[uint64]1;updatedAtUtc=$legacy.Active.updatedAtUtc}|ConvertTo-Json),[Text.UTF8Encoding]::new($false))
+                }
+                'generation' {
+                    [IO.File]::WriteAllText((Join-Path $install 'active.json'),([ordered]@{schemaVersion=2;activeRuntime=$legacy.RuntimeId;previousRuntime='2.5.20-0000000000000000';generation=[uint64]2;updatedAtUtc=$legacy.Active.updatedAtUtc}|ConvertTo-Json),[Text.UTF8Encoding]::new($false))
+                }
+                'current-format' {
+                    $currentId=Get-CcodRuntimeId -ProjectVersion '2.5.21' -Files @($legacy.Manifest.files) -Nonce ('f'*32)
+                    $currentRoot=Join-Path (Split-Path $legacy.RuntimeRoot -Parent) $currentId
+                    $legacy.Manifest.runtimeId=$currentId
+                    [IO.File]::WriteAllText((Join-Path $legacy.RuntimeRoot 'manifest.json'),($legacy.Manifest|ConvertTo-Json -Depth 16),[Text.UTF8Encoding]::new($false))
+                    [IO.Directory]::Move($legacy.RuntimeRoot,$currentRoot)
+                    [IO.File]::WriteAllText((Join-Path $install 'active.json'),([ordered]@{schemaVersion=2;activeRuntime=$currentId;previousRuntime=$null;generation=[uint64]1;updatedAtUtc=$legacy.Active.updatedAtUtc}|ConvertTo-Json),[Text.UTF8Encoding]::new($false))
+                    $legacy.RuntimeId=$currentId;$legacy.RuntimeRoot=$currentRoot
+                }
+                'version' {
+                    $manifestPath=Join-Path $legacy.RuntimeRoot 'manifest.json';$manifest=[IO.File]::ReadAllText($manifestPath)|ConvertFrom-Json;$manifest.projectVersion='2.5.20'
+                    [IO.File]::WriteAllText($manifestPath,($manifest|ConvertTo-Json -Depth 16),[Text.UTF8Encoding]::new($false))
+                }
+                'reparse' {
+                    $outside=New-CcodLifecycleTempRoot
+                    Move-Item -LiteralPath $legacy.RuntimeRoot -Destination $outside
+                    $junction=New-Item -ItemType Junction -Path $legacy.RuntimeRoot -Target $outside
+                }
+            }
+            New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22' | Out-Null
+            $node=New-CcodLifecycleFakeNode -Root $nodeRoot;$fake=New-CcodLifecycleFake -NodePath $node
+            $runtimeBefore=@(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Force).Count
+            $selectorPath=Join-Path $install 'state\active-generation';$selectorBefore=if(Test-Path -LiteralPath $selectorPath -PathType Container){@(Get-ChildItem -LiteralPath $selectorPath -File -Force).Count}else{0}
+            $failure=$null
+            try{Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('b'*64) -Adapters $fake.Adapters|Out-Null}catch{$failure=$_}
+            $errorId=if($null-eq$failure){$null}else{([string]$failure.FullyQualifiedErrorId-split',')[0]}
+            Assert-CcodEqual $case.Expected $errorId "$($case.Name) uses the expected fail-closed boundary"
+            Assert-CcodEqual $runtimeBefore @(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Force).Count "$($case.Name) creates no immutable generation"
+            $selectorAfter=if(Test-Path -LiteralPath $selectorPath -PathType Container){@(Get-ChildItem -LiteralPath $selectorPath -File -Force).Count}else{0}
+            Assert-CcodEqual $selectorBefore $selectorAfter "$($case.Name) appends no selector record"
+            Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $install 'state\install-transactions') -PathType Container) "$($case.Name) creates no transaction plane"
+            Assert-CcodEqual 0 $fake.World.TaskInstalled "$($case.Name) performs no scheduled-task mutation"
+        } finally {
+            if($null-ne$junction-and(Test-Path -LiteralPath $legacy.RuntimeRoot)){[IO.Directory]::Delete([IO.Path]::GetFullPath($legacy.RuntimeRoot))}
+            foreach($path in @($legacySource,$source,$install,$nodeRoot,$outside)){if($null-ne$path-and(Test-Path -LiteralPath $path)){Remove-Item -LiteralPath $path -Recurse -Force}}
+        }
+    }
+}
+
+$results += Invoke-CcodTest 'real v2.5.21 upgrade failure before new Ready restarts the retained legacy runtime' {
+    $legacySource=New-CcodLifecycleTempRoot;$source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    try {
+        New-CcodLifecycleSourceFixture -Root $legacySource -Version '2.5.21' | Out-Null
+        $legacy=New-CcodLifecycleV2521LegacyInstallFixture -InstallRoot $install -SourceRoot $legacySource
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22' | Out-Null
+        $node=New-CcodLifecycleFakeNode -Root $nodeRoot;$fake=New-CcodLifecycleFake -NodePath $node
+        $fake.Adapters.WaitNewRuntimeReady={
+            param($InstallRoot,$RuntimeId,$RuntimeGeneration,$Identity,$TaskStartedAtUtc,$TimeoutMilliseconds)
+            $ready=$RuntimeId-ceq$legacy.RuntimeId
+            [pscustomobject][ordered]@{SupervisorReady=$ready;TrayReady=$ready}
+        }.GetNewClosure()
+        $failure=$null
+        try{Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('c'*64) -Adapters $fake.Adapters|Out-Null}catch{$failure=$_}
+        $errorId=if($null-eq$failure){$null}else{([string]$failure.FullyQualifiedErrorId-split',')[0]}
+        Assert-CcodEqual 'CCOD_INSTALL_NEW_RUNTIME_NOT_READY' $errorId 'new-runtime readiness failure remains the reported cause after successful compensation'
+        $pointer=Read-CcodActiveRuntime -InstallRoot $install
+        Assert-CcodEqual $legacy.RuntimeId $pointer.activeRuntime 'compensating append-only pointer reselects the retained legacy runtime'
+        Assert-CcodEqual ([uint64]3) $pointer.generation 'legacy genesis new activation and compensation form one monotonic selector chain'
+        Assert-CcodEqual 2 $fake.World.TaskStarted 'failed new runtime and retained legacy runtime are each started once'
+        Assert-CcodTrue (Test-Path -LiteralPath $legacy.RuntimeRoot -PathType Container) 'retained legacy runtime remains present after compensation'
+        $module=Get-Module InstallLifecycle -ErrorAction Stop;$head=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install
+        Assert-CcodEqual 'Failed' $head.phase 'failed new generation has a terminal diagnostic transaction'
+        Assert-CcodEqual 'CCOD_INSTALL_NEW_RUNTIME_NOT_READY' $head.errorCode 'failed transaction retains the original pre-Ready error'
+        Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $install 'active.json') -PathType Leaf) 'legacy active pointer remains untouched as evidence after compensation'
+    } finally {
+        foreach($path in @($legacySource,$source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}
+    }
+}
+
+$results += Invoke-CcodTest 'real v2.5.21 upgrade failure before new pointer commit keeps the legacy selector active and restarts it' {
+    $legacySource=New-CcodLifecycleTempRoot;$source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    try {
+        New-CcodLifecycleSourceFixture -Root $legacySource -Version '2.5.21' | Out-Null
+        $legacy=New-CcodLifecycleV2521LegacyInstallFixture -InstallRoot $install -SourceRoot $legacySource
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22' | Out-Null
+        $node=New-CcodLifecycleFakeNode -Root $nodeRoot;$fake=New-CcodLifecycleFake -NodePath $node
+        $fake.World.SetActiveFailure={
+            param($InstallRoot,$RuntimeId,$Ownership,$TargetGeneration,$FileTransaction)
+            throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new('adapted pointer failure'),'CCOD_RUNTIME_POINTER_COMMIT_FAILED',[Management.Automation.ErrorCategory]::InvalidData,$RuntimeId)
+        }
+        $failure=$null
+        try{Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('d'*64) -Adapters $fake.Adapters|Out-Null}catch{$failure=$_}
+        $errorId=if($null-eq$failure){$null}else{([string]$failure.FullyQualifiedErrorId-split',')[0]}
+        Assert-CcodEqual 'CCOD_RUNTIME_POINTER_COMMIT_FAILED' $errorId 'adapted pre-pointer failure remains the reported cause after old-runtime restart'
+        $pointer=Read-CcodActiveRuntime -InstallRoot $install
+        Assert-CcodEqual $legacy.RuntimeId $pointer.activeRuntime 'selector genesis keeps the legacy runtime active when the new pointer never commits'
+        Assert-CcodEqual ([uint64]1) $pointer.generation 'pre-pointer failure appends no false new or compensating selector'
+        Assert-CcodEqual 1 $fake.World.TaskStarted 'pre-pointer failure restarts only the retained legacy runtime'
+        $module=Get-Module InstallLifecycle -ErrorAction Stop;$head=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install
+        Assert-CcodEqual 'Failed' $head.phase 'pre-pointer failure has a terminal diagnostic transaction'
+        Assert-CcodEqual 'CCOD_RUNTIME_POINTER_COMMIT_FAILED' $head.errorCode 'diagnostic transaction retains the adapted pointer failure'
+        Assert-CcodTrue (Test-Path -LiteralPath $legacy.RuntimeRoot -PathType Container) 'pre-pointer failure retains the old runtime tree'
+    } finally {
+        foreach($path in @($legacySource,$source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}
+    }
+}
+
 $results += Invoke-CcodTest 'Invoke-CcodInstall is idempotent only for the active Ready runtime and exact sealed package identity' {
     $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
     try{
diff --git a/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1 b/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1
index ef0e4ed..4d840f4 100644
--- a/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1
+++ b/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1
@@ -21,9 +21,13 @@ function New-CcodHarnessFixture {
 }
 
 function New-CcodHarnessCandidate {
-    param([Parameter(Mandatory)]$Fixture, [Parameter(Mandatory)][string]$Version)
+    param(
+        [Parameter(Mandatory)]$Fixture,
+        [Parameter(Mandatory)][string]$Version,
+        [byte[]]$Bytes = [byte[]](8,7,6,5,4,3,2,1)
+    )
     $installer = Join-Path $Fixture.Root ("CodexRemote-fix-$Version-setup.exe")
-    [IO.File]::WriteAllBytes($installer, [byte[]](8,7,6,5,4,3,2,1))
+    [IO.File]::WriteAllBytes($installer, $Bytes)
     $hash = Get-CcodTestFileSha256 -Path $installer
     [IO.File]::WriteAllText("$installer.sha256.txt", ("{0} *{1}`r`n" -f $hash, [IO.Path]::GetFileName($installer)), [Text.UTF8Encoding]::new($false))
     return $installer
@@ -716,6 +720,25 @@ Invoke-CcodTest 'rolls back, records a redacted failure receipt, and raises a st
     }
 }
 
+Invoke-CcodTest 'accepts an exact checksum-bound v2.5.21 installer as the source of a v2.5.22 upgrade run' {
+    . $harnessPath -Library
+    $fixture = New-CcodHarnessFixture
+    try {
+        $current = New-CcodHarnessCandidate -Fixture $fixture -Version '2.5.22' -Bytes ([byte[]](9,8,7,6,5,4,3,2))
+        $legacy = New-CcodHarnessCandidate -Fixture $fixture -Version '2.5.21' -Bytes ([byte[]](2,3,5,7,11,13,17,19))
+        $calls = [Collections.Generic.List[string]]::new()
+        $captured = $null
+        $adapters = New-CcodHarnessAdapters -Fixture $fixture -Calls $calls -CapturedReceipt ([ref]$captured)
+        $receipt = Invoke-CcodInstalledLifecycleIntegration -InstallerPath $current -PreviousInstallerPath $legacy -ExpectedVersion '2.5.22' -EvidenceRoot $fixture.EvidenceRoot -Scenario Upgrade -AllowMachineMutation -AllowCodexRestart -Adapters $adapters
+        Assert-CcodEqual 'Completed' ([string]$receipt.outcome) 'v2.5.21 to v2.5.22 reaches the fake installed verification boundary'
+        Assert-CcodEqual (Get-CcodTestFileSha256 -Path $legacy) ([string]$receipt.previousInstallerSha256) 'upgrade evidence binds the exact v2.5.21 installer bytes'
+        Assert-CcodTrue ($calls -contains 'CreateRollbackSnapshot') 'legacy upgrade captures rollback state before the adapted scenario'
+        Assert-CcodTrue ($calls -contains 'VerifyScenario') 'legacy upgrade still requires independent installed verification'
+    } finally {
+        if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+    }
+}
+
 Invoke-CcodTest 'accepts only a distinct checksum-bound prior installer for an upgrade rollback path' {
     . $harnessPath -Library
     $fixture = New-CcodHarnessFixture

From 812b34e5413fa7025f48d5b654537128d6ddde61 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Wed, 2 Sep 2026 20:24:07 +0800
Subject: [PATCH 125/187] docs: record legacy lifecycle upgrade evidence

---
 .../task-1-report.md                          | 141 ++++++++++++++++++
 1 file changed, 141 insertions(+)
 create mode 100644 .superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-1-report.md

diff --git a/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-1-report.md b/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-1-report.md
new file mode 100644
index 0000000..cc9e123
--- /dev/null
+++ b/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-1-report.md
@@ -0,0 +1,141 @@
+# Task 1 报告：v2.5.21 legacy lifecycle upgrade bridge
+
+## 结论
+
+Task 1 已在隔离 worktree
+`C:\Users\33384\Documents\Codex-Control-other-devices-Windows\.worktrees\codex-v2522-install-runtime-reliability`
+实现并通过要求的 focused tests。实现提交为
+`5114a09953e2566b1127788ffbad115c11ae072f`（`fix: bridge legacy lifecycle upgrade`），
+基线为 `2aef5ff2a74219a82e98fe26c2f8170a5232a280`。
+
+本报告不声称 Task 2/Task 3、整分支验收或 release readiness 已完成。
+
+## 历史来源与 fixture
+
+fixture 直接以 merge-base
+`19803a79af3302c49f129e6a6b3ff7ffaf1b930b` 为格式来源：
+
+- `active.json` 是严格 schema 2，字段顺序为
+  `schemaVersion,activeRuntime,previousRuntime,generation,updatedAtUtc`；
+- runtime manifest 是 schema 1，字段为
+  `schemaVersion,projectVersion,runtimeId,files`；
+- v2.5.21 runtime ID 使用旧的 `version-digest16` 两段式算法，digest 来自按
+  ordinal path 排序后的 `path/length/sha256` manifest records，不含 v2.5.22 nonce；
+- mutable activation receipt 位于 `state\post-install-activation.json`；
+- fixture 不创建 `state\active-generation`、`state\install-transactions` 或
+  `state\product-cleanup-fences`。
+
+测试没有用“projectVersion 写成 2.5.21、但 runtime ID/Ready 仍是当前格式”的伪 legacy
+fixture。另有显式负例拒绝带 v2.5.22 nonce 的 current-format v2.5.21 lookalike。
+
+## 实现
+
+新增私有分类接口：
+
+```text
+Get-CcodLegacyUpgradeCompatibilityContext
+  -InstallRoot
+  -ExistingPointer
+  -ActiveValidation
+  -GlobalTransaction
+```
+
+它只返回两种 `Kind`：
+
+- `CurrentReady`：append-only selector 与 transaction plane 均存在；selected pointer、
+  valid current manifest、manifest SHA-256 和 canonical terminal Ready transaction 的
+  runtime/generation 完全一致。此分支仍执行原 durable product-cleanup resolver。
+- `ProvenLegacyWithoutReady`：三个新 plane 均有精确 ItemNotFound 证明；raw
+  `active.json` 是上述严格 schema-2 generation-one 形状；active runtime tree/manifest
+  通过 contained path、non-reparse、no-ADS、single-link 和 hash/file-set 校验；current
+  validator 的唯一失败是 `CCOD_RUNTIME_ID_MISMATCH`；随后使用历史算法复算并精确得到
+  v2.5.21 两段式 runtime ID。只有此分支跳过不存在的旧 Ready cleanup resolver。
+
+在真实 legacy upgrade 中，同一个 opaque file transaction 先打开 manifest-bound retained
+legacy generation，并发布 generation-one selector genesis；普通新 runtime pointer 随后以
+generation two 提交。旧 `active.json` 保持 byte-for-byte 不变，只作为迁移证据。成功路径会
+写出 canonical Ready transaction；新 runtime 在 Ready 前失败时，旧 runtime 会被重新选择并
+启动。
+
+## TDD 证据
+
+### 基线
+
+- `InstallLifecycle.SelfTest.ps1`：129/129，exit 0。
+- `InstalledLifecycleHarness.SelfTest.ps1`：20/20，exit 0。
+
+### RED 1：真实旧 runtime ID
+
+命令：
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+```
+
+结果：exit 1。
+
+```text
+CCOD_SELFTEST_FAILED case=real-v2.5.21-legacy-lifecycle-state-upgrades-through-the-v2.5.22-install-entrypoint error=CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN
+The active runtime manifest is invalid before upgrade
+```
+
+这比计划中预期的 null Ready resolver 更早：当前 validator 先拒绝旧两段式 runtime ID。
+实现因此只接管 exact `CCOD_RUNTIME_ID_MISMATCH`，其他 validator failure 保持拒绝。
+
+### RED 2：不可重建的 legacy generation
+
+加入 generation two、但没有 append-only history 的 legacy pointer 后，命令 exit 1：
+
+```text
+ASSERT_EQUAL: legacy generation without reconstructable append-only history creates no immutable generation expected=[1] actual=[2]
+```
+
+分类随后收紧为 generation one，并在 staging 前拒绝无法安全重建历史的输入。
+
+### RED 3：generation-one previousRuntime 不一致
+
+加入 generation one 但 `previousRuntime` 非 null 的 lookalike 后，命令 exit 1：
+
+```text
+ASSERT_EQUAL: generation-one active pointer with a previous runtime uses the expected fail-closed boundary expected=[CCOD_INSTALL_UPGRADE_SOURCE_INVALID] actual=[]
+```
+
+raw legacy pointer 随后收紧为 generation one 且 `previousRuntime = null`。
+
+### 最终 GREEN
+
+- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1`
+  -> `Install lifecycle self-tests passed: 140`，exit 0。
+- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstalledLifecycleHarness.SelfTest.ps1`
+  -> 21/21（含 exact checksum-bound v2.5.21 -> v2.5.22 adapted Upgrade），exit 0。
+- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\RuntimeManifest.SelfTest.ps1`
+  -> 21/21，exit 0。
+- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+  -> 30/30，exit 0。
+- PowerShell parser：3 个修改文件均 0 errors。
+- `git diff --check`：exit 0。
+
+Lifecycle 覆盖还包括：孤立 selector、无 Ready fence plane、schema-one active、
+generation/history ambiguity、current-format lookalike、wrong manifest version、runtime junction，
+均在 staging/task mutation 前失败；以及 pre-pointer 与 post-pointer 两类 Ready 前失败均恢复
+旧 runtime。
+
+## 无真实操作证明
+
+- 所有 install roots、source roots、installer bytes 和证据目录均位于 GUID 临时目录；
+- scheduled task、Supervisor/TrayHost、product registration、shortcut 和 installed scenario 均由
+  现有 fake/adapters 驱动；
+- 没有运行真实 Setup/installer，没有修改真实 registry/shortcut/scheduled task/device key，
+  没有安装、重启、重启系统、网络、push、tag 或 release 操作；
+- 测试创建的 junction 只位于临时目录，使用 `.NET Directory.Delete(link)` 删除链接并验证
+  外部临时 target 未被跟随。
+
+## 边界与后续
+
+- 本 Task 只支持有完整历史证据可安全映射为 selector genesis 的 v2.5.21
+  generation-one profile。generation greater than one 无法从单个 mutable active pointer 重建
+  完整 append-only 历史，因此在 staging 前 fail closed；如要支持该形状，需要单独设计并提供
+  可验证历史来源，不能伪造 selector records。
+- Task 2 的 exact historical product-registration profile 迁移尚未实现；Task 1 测试只用适配器
+  证明 lifecycle/Ready/rollback 边界。
+- 尚待独立 reviewer 对本提交做 Task 1 scoped review；本报告不替代该门禁。

From 52d3962b9bc91c91350317a148a145efdc9aa0c9 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 00:48:08 +0800
Subject: [PATCH 126/187] fix: resume failed legacy migration

---
 .../modules/InstallFileTransaction.psm1       |  63 ++++----
 src/persistence/modules/InstallLifecycle.psm1 | 146 +++++++++++++++++-
 .../InstallFileTransaction.SelfTest.ps1       |  54 +++++--
 .../persistence/InstallLifecycle.SelfTest.ps1 | 106 +++++++++++++
 4 files changed, 323 insertions(+), 46 deletions(-)

diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index 1f4a24d..b48be49 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -10,7 +10,7 @@ function Throw-CcodInstallFileError {
 }
 
 function Initialize-CcodInstallRuntime {
-    $marker = 'CcodInstallGenerationCapabilityMarkerV4' -as [type]
+    $marker = 'CcodInstallGenerationCapabilityMarkerV5' -as [type]
     if ($null -eq $marker) {
         Add-Type -TypeDefinition @'
 using System;
@@ -23,13 +23,13 @@ using System.Security.Cryptography;
 using System.Text;
 using Microsoft.Win32.SafeHandles;
 
-public sealed class CcodInstallGenerationCapabilityMarkerV4
+public sealed class CcodInstallGenerationCapabilityMarkerV5
 {
-    private CcodInstallGenerationCapabilityMarkerV4() { }
-    public static int CapabilityAbi { get { return 4; } }
+    private CcodInstallGenerationCapabilityMarkerV5() { }
+    public static int CapabilityAbi { get { return 5; } }
 }
 
-internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
+internal sealed class CcodInstallGenerationRuntimeV5 : IDisposable
 {
     private const uint READ = 0x80000000, WRITE = 0x40000000, DELETE = 0x00010000, SYNC = 0x00100000;
     private const uint READ_ATTRIBUTES = 0x80, WRITE_ATTRIBUTES = 0x100, LIST_DIRECTORY = 0x1, ADD_FILE = 0x2, ADD_SUBDIRECTORY = 0x4;
@@ -85,11 +85,11 @@ internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
     private readonly List<FileStream> externalStreams = new List<FileStream>();
     private bool disposed; private string cleanupError;
 
-    private readonly bool stateOnly,productOnly;
-    private CcodInstallGenerationRuntimeV4(string installRoot,Pin root,Pin runtimeParent,bool stateOnly,bool productOnly)
-    { this.installRoot=installRoot;this.root=root;this.runtimeParent=runtimeParent;this.stateOnly=stateOnly;this.productOnly=productOnly;AddPin(root);if(runtimeParent!=null)AddPin(runtimeParent); }
+    private readonly bool stateOnly,productOnly,retryOnly;
+    private CcodInstallGenerationRuntimeV5(string installRoot,Pin root,Pin runtimeParent,bool stateOnly,bool productOnly,bool retryOnly)
+    { this.installRoot=installRoot;this.root=root;this.runtimeParent=runtimeParent;this.stateOnly=stateOnly;this.productOnly=productOnly;this.retryOnly=retryOnly;AddPin(root);if(runtimeParent!=null)AddPin(runtimeParent); }
 
-    internal static object Open(string path,string runtimeId,out CcodInstallGenerationRuntimeV4 runtime)
+    internal static object Open(string path,string runtimeId,out CcodInstallGenerationRuntimeV5 runtime)
     {
         runtime=null;string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle rootHandle=OpenAbsoluteDirectory(full,true);Pin rootPin=null,runtimePin=null;
         try
@@ -104,28 +104,34 @@ internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
             try
             {
                 Pin generation=ValidateDirectoryPin(runtimePin,runtimeId,Path.Combine(runtimePin.Path,runtimeId),true,generationResult.Handle);generationResult.Handle=null;
-                runtime=new CcodInstallGenerationRuntimeV4(full,rootPin,runtimePin,false,false);rootPin=null;runtimePin=null;runtime.AddPin(generation);return generation.Token;
+                runtime=new CcodInstallGenerationRuntimeV5(full,rootPin,runtimePin,false,false,false);rootPin=null;runtimePin=null;runtime.AddPin(generation);return generation.Token;
             }
             finally { if(generationResult.Handle!=null)generationResult.Handle.Dispose(); }
         }
         catch { if(runtimePin!=null)runtimePin.Dispose();if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw; }
     }
 
-    internal static object OpenState(string path,out CcodInstallGenerationRuntimeV4 runtime)
+    internal static object OpenState(string path,out CcodInstallGenerationRuntimeV5 runtime)
     {
         runtime=null;string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle rootHandle=OpenAbsoluteDirectory(full,true);Pin rootPin=null;
-        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;runtime=new CcodInstallGenerationRuntimeV4(full,rootPin,null,true,false);rootPin=null;return runtime.root.Token;}
+        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;runtime=new CcodInstallGenerationRuntimeV5(full,rootPin,null,true,false,false);rootPin=null;return runtime.root.Token;}
         catch{if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw;}
     }
 
-    internal static object OpenProduct(string path,out CcodInstallGenerationRuntimeV4 runtime)
+    internal static object OpenRetry(string path,out CcodInstallGenerationRuntimeV5 runtime)
+    {
+        runtime=null;string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle rootHandle=OpenAbsoluteDirectory(full,true);Pin rootPin=null,runtimePin=null;
+        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;OpenResult result=OpenRelative(rootPin.Native,"runtime",LIST_DIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);try{runtimePin=ValidateDirectoryPin(rootPin,"runtime",Path.Combine(full,"runtime"),false,result.Handle);result.Handle=null;}finally{if(result.Handle!=null)result.Handle.Dispose();};runtime=new CcodInstallGenerationRuntimeV5(full,rootPin,runtimePin,false,false,true);rootPin=null;runtimePin=null;return runtime.root.Token;}catch{if(runtimePin!=null)runtimePin.Dispose();if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw;}
+    }
+
+    internal static object OpenProduct(string path,out CcodInstallGenerationRuntimeV5 runtime)
     {
         runtime=null;string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle rootHandle=OpenAbsoluteDirectory(full,false);Pin rootPin=null,runtimePin=null;
-        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;OpenResult result=OpenRelative(rootPin.Native,"runtime",LIST_DIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);try{runtimePin=ValidateDirectoryPin(rootPin,"runtime",Path.Combine(full,"runtime"),false,result.Handle);result.Handle=null;}finally{if(result.Handle!=null)result.Handle.Dispose();};runtime=new CcodInstallGenerationRuntimeV4(full,rootPin,runtimePin,false,true);rootPin=null;runtimePin=null;return runtime.root.Token;}catch{if(runtimePin!=null)runtimePin.Dispose();if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw;}
+        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;OpenResult result=OpenRelative(rootPin.Native,"runtime",LIST_DIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);try{runtimePin=ValidateDirectoryPin(rootPin,"runtime",Path.Combine(full,"runtime"),false,result.Handle);result.Handle=null;}finally{if(result.Handle!=null)result.Handle.Dispose();};runtime=new CcodInstallGenerationRuntimeV5(full,rootPin,runtimePin,false,true,false);rootPin=null;runtimePin=null;return runtime.root.Token;}catch{if(runtimePin!=null)runtimePin.Dispose();if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw;}
     }
 
     private bool IsStateScope(Pin pin){for(Pin cursor=pin;cursor!=null;cursor=cursor.Parent)if(Object.ReferenceEquals(cursor.Parent,root)&&String.Equals(cursor.Leaf,"state",StringComparison.Ordinal))return true;return false;}
-    private void RequireStateDirectory(Pin parent,string leaf){if(productOnly)throw new InvalidOperationException("product-only scope");if(!stateOnly)return;if(Object.ReferenceEquals(parent,root)){if(!String.Equals(leaf,"state",StringComparison.Ordinal))throw new InvalidOperationException("state-only scope");return;}if(!IsStateScope(parent))throw new InvalidOperationException("state-only scope");}
+    private void RequireStateDirectory(Pin parent,string leaf){if(productOnly)throw new InvalidOperationException("product-only scope");if(!stateOnly&&!retryOnly)return;string error=retryOnly?"migration-retry scope":"state-only scope";if(Object.ReferenceEquals(parent,root)){if(!String.Equals(leaf,"state",StringComparison.Ordinal))throw new InvalidOperationException(error);return;}if(!IsStateScope(parent))throw new InvalidOperationException(error);}
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object CreateDirectory(object parentToken,string leaf)
     {
@@ -159,7 +165,7 @@ internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object Copy(object parentToken,string leaf,string source,long expectedLength,string expectedSha)
     {
-        if(stateOnly)throw new InvalidOperationException("state-only scope");if(productOnly)throw new InvalidOperationException("product-only scope");Pin parent=Require(parentToken,true);ValidateCurrent(parent);string full=Path.GetFullPath(source);
+        if(stateOnly)throw new InvalidOperationException("state-only scope");if(retryOnly)throw new InvalidOperationException("migration-retry scope");if(productOnly)throw new InvalidOperationException("product-only scope");Pin parent=Require(parentToken,true);ValidateCurrent(parent);string full=Path.GetFullPath(source);
         SafeFileHandle sourceHandle=CreateFileW(full,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,IntPtr.Zero,OPEN_EXISTING,FLAG_REPARSE,IntPtr.Zero);
         if(sourceHandle.IsInvalid)throw new Win32Exception(Marshal.GetLastWin32Error());FileStream sourceStream=null;
         try
@@ -176,7 +182,7 @@ internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object Write(object parentToken,string leaf,byte[] bytes,bool manifest)
     {
-        if(productOnly)throw new InvalidOperationException("product-only scope");Pin parent=Require(parentToken,true);ValidateCurrent(parent);if(stateOnly&&(manifest||!IsStateScope(parent)))throw new InvalidOperationException("state-only scope");Pin pin=CreateTemporaryFile(parent);pin.Stream.Write(bytes,0,bytes.Length);pin.Stream.Flush(true);string sha=Sha(pin.Stream);if(pin.Stream.Length!=bytes.LongLength)throw new InvalidDataException("destination mismatch");SealAndPublish(pin,leaf,bytes.LongLength,sha,manifest);return pin.Token;
+        if(productOnly)throw new InvalidOperationException("product-only scope");Pin parent=Require(parentToken,true);ValidateCurrent(parent);if(stateOnly&&(manifest||!IsStateScope(parent)))throw new InvalidOperationException("state-only scope");if(retryOnly&&(manifest||!IsStateScope(parent)))throw new InvalidOperationException("migration-retry scope");Pin pin=CreateTemporaryFile(parent);pin.Stream.Write(bytes,0,bytes.Length);pin.Stream.Flush(true);string sha=Sha(pin.Stream);if(pin.Stream.Length!=bytes.LongLength)throw new InvalidDataException("destination mismatch");SealAndPublish(pin,leaf,bytes.LongLength,sha,manifest);return pin.Token;
     }
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object CommitPointer(object generationToken,ulong previousGeneration,string runtimeId,byte[] bytes)
@@ -188,13 +194,13 @@ internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object Retire(object generationToken,string runtimeId,string recordLeaf,byte[] record)
     {
-        if(stateOnly)throw new InvalidOperationException("state-only scope");if(productOnly)throw new InvalidOperationException("product-only scope");Pin generation=Require(generationToken,true);ValidateCurrent(generation);if(!Object.ReferenceEquals(generation.Parent,runtimeParent)||!String.Equals(generation.Leaf,runtimeId,StringComparison.Ordinal)||!generation.Owned)throw new InvalidDataException("generation not owned");
+        if(stateOnly)throw new InvalidOperationException("state-only scope");if(retryOnly)throw new InvalidOperationException("migration-retry scope");if(productOnly)throw new InvalidOperationException("product-only scope");Pin generation=Require(generationToken,true);ValidateCurrent(generation);if(!Object.ReferenceEquals(generation.Parent,runtimeParent)||!String.Equals(generation.Leaf,runtimeId,StringComparison.Ordinal)||!generation.Owned)throw new InvalidDataException("generation not owned");
         ValidateOwnedTree(generation);Pin state=OpenOrCreateDirectory(root,"state"),retirements=OpenOrCreateDirectory(state,"retired-generations");Write(retirements.Token,recordLeaf,record,false);return generation.Token;
     }
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object OpenProductFolder(string kind,string path)
     {
-        if(stateOnly)throw new InvalidOperationException("state-only scope");if(disposed)throw new ObjectDisposedException("transaction");
+        if(stateOnly)throw new InvalidOperationException("state-only scope");if(retryOnly)throw new InvalidOperationException("migration-retry scope");if(disposed)throw new ObjectDisposedException("transaction");
         string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle handle=OpenAbsoluteDirectory(full,true);Pin basePin=null;
         try
         {
@@ -209,12 +215,12 @@ internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object OpenRetainedFile(object generationToken,string relative)
     {
-        if(stateOnly)throw new InvalidOperationException("state-only scope");if(relative!="registration/StartMenu.CodexRemote-fix.lnk"&&relative!="registration/Desktop.CodexRemote-fix.lnk")throw new InvalidDataException("product shortcut source");Pin cursor=Require(generationToken,true);ValidateCurrent(cursor);string[] segments=relative.Split('/');for(int i=0;i<segments.Length;i++){Pin next;if(!names.TryGetValue(Key(cursor,segments[i]),out next))throw new InvalidDataException("product shortcut source");if(i<segments.Length-1){if(!next.Directory)throw new InvalidDataException("product shortcut source");ValidateCurrent(next);cursor=next;}else{if(next.Directory||!next.Sealed||!next.Published)throw new InvalidDataException("product shortcut source");ValidateCurrent(next);return new object[]{next.Token,next.SealedLength,next.SealedSha};}}throw new InvalidDataException("product shortcut source");
+        if(stateOnly)throw new InvalidOperationException("state-only scope");if(retryOnly)throw new InvalidOperationException("migration-retry scope");if(relative!="registration/StartMenu.CodexRemote-fix.lnk"&&relative!="registration/Desktop.CodexRemote-fix.lnk")throw new InvalidDataException("product shortcut source");Pin cursor=Require(generationToken,true);ValidateCurrent(cursor);string[] segments=relative.Split('/');for(int i=0;i<segments.Length;i++){Pin next;if(!names.TryGetValue(Key(cursor,segments[i]),out next))throw new InvalidDataException("product shortcut source");if(i<segments.Length-1){if(!next.Directory)throw new InvalidDataException("product shortcut source");ValidateCurrent(next);cursor=next;}else{if(next.Directory||!next.Sealed||!next.Published)throw new InvalidDataException("product shortcut source");ValidateCurrent(next);return new object[]{next.Token,next.SealedLength,next.SealedSha};}}throw new InvalidDataException("product shortcut source");
     }
 
     [MethodImpl(MethodImplOptions.Synchronized)] internal object CopyProductShortcut(object folderToken,string kind,object sourceToken,string leaf)
     {
-        if(stateOnly)throw new InvalidOperationException("state-only scope");Pin parent=Require(folderToken,true);ValidateCurrent(parent);Pin source=Require(sourceToken,false);ValidateCurrent(source);
+        if(stateOnly)throw new InvalidOperationException("state-only scope");if(retryOnly)throw new InvalidOperationException("migration-retry scope");Pin parent=Require(folderToken,true);ValidateCurrent(parent);Pin source=Require(sourceToken,false);ValidateCurrent(source);
         if(!productFolders.Contains(folderToken)||!String.Equals(leaf,"CodexRemote-fix.lnk",StringComparison.Ordinal)||
            (!String.Equals(kind,"StartMenu",StringComparison.Ordinal)&&!String.Equals(kind,"Desktop",StringComparison.Ordinal)))throw new InvalidDataException("product shortcut scope");
         long expectedLength=source.SealedLength;string expectedSha=source.SealedSha;if(source.Stream.Length!=expectedLength||Sha(source.Stream)!=expectedSha)throw new InvalidDataException("source mismatch");source.Stream.Position=0;
@@ -313,10 +319,10 @@ internal sealed class CcodInstallGenerationRuntimeV4 : IDisposable
     private static int RenameReplacing(SafeFileHandle source,SafeFileHandle parent,string destination){byte[] name=Encoding.Unicode.GetBytes(destination);int rootOffset=IntPtr.Size,lengthOffset=rootOffset+IntPtr.Size,nameOffset=lengthOffset+4,size=nameOffset+name.Length+2;IntPtr buffer=Marshal.AllocHGlobal(size);bool parentAdded=false,sourceAdded=false;try{source.DangerousAddRef(ref sourceAdded);parent.DangerousAddRef(ref parentAdded);for(int i=0;i<size;i++)Marshal.WriteByte(buffer,i,0);Marshal.WriteByte(buffer,0,1);Marshal.WriteIntPtr(buffer,rootOffset,parent.DangerousGetHandle());Marshal.WriteInt32(buffer,lengthOffset,name.Length);Marshal.Copy(name,0,IntPtr.Add(buffer,nameOffset),name.Length);IO_STATUS_BLOCK io;int status=NtSetInformationFile(source,out io,buffer,(uint)size,FileRenameInformation);return status>=0?0:(int)RtlNtStatusToDosError(status);}finally{if(parentAdded)parent.DangerousRelease();if(sourceAdded)source.DangerousRelease();Marshal.FreeHGlobal(buffer);}}
 }
 '@
-        $marker = 'CcodInstallGenerationCapabilityMarkerV4' -as [type]
+        $marker = 'CcodInstallGenerationCapabilityMarkerV5' -as [type]
     }
-    if ($null -eq $marker -or [int]$marker.GetProperty('CapabilityAbi').GetValue($null,$null) -ne 4) { Throw-CcodInstallFileError 'CCOD_INSTALL_RUNTIME_ABI_INVALID' 'Install generation runtime ABI is unavailable' $null }
-    $script:CcodRuntimeType = $marker.Assembly.GetType('CcodInstallGenerationRuntimeV4',$true)
+    if ($null -eq $marker -or [int]$marker.GetProperty('CapabilityAbi').GetValue($null,$null) -ne 5) { Throw-CcodInstallFileError 'CCOD_INSTALL_RUNTIME_ABI_INVALID' 'Install generation runtime ABI is unavailable' $null }
+    $script:CcodRuntimeType = $marker.Assembly.GetType('CcodInstallGenerationRuntimeV5',$true)
 }
 
 function Assert-CcodInstallLeaf([string]$Leaf,[string]$ErrorId='CCOD_INSTALL_LEAF_INVALID') {
@@ -329,7 +335,7 @@ function Get-CcodInstallTransaction($Capability,[string]$InvalidId='CCOD_INSTALL
 function Add-CcodInstallScope($Transaction,$Token,[string]$Kind='Directory',[bool]$ReadOnly=$false,[AllowNull()][string]$RuntimeId=$null){$capability=New-CcodInstallCapability;$script:CcodScopes.Add($capability,[pscustomobject]@{Transaction=$Transaction;Token=$Token;Kind=$Kind;ReadOnly=$ReadOnly;RuntimeId=$RuntimeId});$capability}
 function Get-CcodInstallScopedDirectory($Transaction,$Parent){$parentScope=Get-CcodInstallTransaction $Parent 'CCOD_INSTALL_DIRECTORY_INVALID';if(-not[object]::ReferenceEquals($parentScope.Record.Transaction,$Transaction)-or$parentScope.Record.Kind-cnotin@('Directory','Generation')){Throw-CcodInstallFileError 'CCOD_INSTALL_DIRECTORY_INVALID' 'Directory capability is outside the transaction scope' $null};return $parentScope}
 function Assert-CcodInstallWritableScope($Scope){if($Scope.Record.ReadOnly){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_READ_ONLY' 'Retained generation capability is read-only' $null}}
-function Convert-CcodInstallRuntimeError($Action,[string]$DefaultId){try{return&$Action}catch{$exception=$_.Exception;while($null-ne$exception.InnerException-and$exception-is[Management.Automation.RuntimeException]){$exception=$exception.InnerException};$message=[string]$exception.Message;if($exception-is[ObjectDisposedException]){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' $message $null};if($message-match'state-only scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_STATE_SCOPE' $message $null};if($message-match'product-only scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' $message $null};if($exception-is[ComponentModel.Win32Exception]-and$exception.NativeErrorCode-in@(80,183)){Throw-CcodInstallFileError 'CCOD_INSTALL_LEAF_EXISTS' 'Install object already exists' $null};if($message-match'pointer generation exists'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' $message $null};if($message-match'pointer generation overflow'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW' $message $null};if($message-match'retained manifest mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_MANIFEST_MISMATCH' $message $null};if($message-match'retained runtime id mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH' $message $null};if($message-match'product shortcut source'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' $message $null};if($message-match'seal mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_SEAL_MISMATCH' $message $null};if($message-match'alternate stream'){Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' $message $null};if($message-match'multi-link'){Throw-CcodInstallFileError 'CCOD_INSTALL_MULTILINK_LEAF' $message $null};if($message-match'reparse'){Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' $message $null};if($message-match'transaction scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_SCOPE' $message $null};if($message-match'generation not owned'){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' $message $null};if($message-match'unknown|unsealed'){Throw-CcodInstallFileError 'CCOD_INSTALL_UNKNOWN_LEAF' $message $null};if($message-match'pin changed|path changed'){Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' $message $null};Throw-CcodInstallFileError $DefaultId $message $null}}
+function Convert-CcodInstallRuntimeError($Action,[string]$DefaultId){try{return&$Action}catch{$exception=$_.Exception;while($null-ne$exception.InnerException-and$exception-is[Management.Automation.RuntimeException]){$exception=$exception.InnerException};$message=[string]$exception.Message;if($exception-is[ObjectDisposedException]){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_CLOSED' $message $null};if($message-match'state-only scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_STATE_SCOPE' $message $null};if($message-match'migration-retry scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_MIGRATION_RETRY_SCOPE' $message $null};if($message-match'product-only scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' $message $null};if($exception-is[ComponentModel.Win32Exception]-and$exception.NativeErrorCode-in@(80,183)){Throw-CcodInstallFileError 'CCOD_INSTALL_LEAF_EXISTS' 'Install object already exists' $null};if($message-match'pointer generation exists'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_EXISTS' $message $null};if($message-match'pointer generation overflow'){Throw-CcodInstallFileError 'CCOD_INSTALL_POINTER_GENERATION_OVERFLOW' $message $null};if($message-match'retained manifest mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_MANIFEST_MISMATCH' $message $null};if($message-match'retained runtime id mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH' $message $null};if($message-match'product shortcut source'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' $message $null};if($message-match'seal mismatch'){Throw-CcodInstallFileError 'CCOD_INSTALL_SEAL_MISMATCH' $message $null};if($message-match'alternate stream'){Throw-CcodInstallFileError 'CCOD_INSTALL_ADS_LEAF' $message $null};if($message-match'multi-link'){Throw-CcodInstallFileError 'CCOD_INSTALL_MULTILINK_LEAF' $message $null};if($message-match'reparse'){Throw-CcodInstallFileError 'CCOD_INSTALL_REPARSE_LEAF' $message $null};if($message-match'transaction scope'){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_SCOPE' $message $null};if($message-match'generation not owned'){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_NOT_OWNED' $message $null};if($message-match'unknown|unsealed'){Throw-CcodInstallFileError 'CCOD_INSTALL_UNKNOWN_LEAF' $message $null};if($message-match'pin changed|path changed'){Throw-CcodInstallFileError 'CCOD_INSTALL_PIN_CHANGED' $message $null};Throw-CcodInstallFileError $DefaultId $message $null}}
 function Test-CcodInstallValue($Value,[int]$Depth=0) {
     if ($Depth -gt 12) { return $false }
     if ($null -eq $Value) { return $true }
@@ -364,9 +370,10 @@ function Open-CcodInstallGeneration {
     Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID'
     $arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$RuntimeId,$null)
     try{$token=Invoke-CcodRuntimeStatic Open $arguments}catch [ComponentModel.Win32Exception]{if($_.Exception.NativeErrorCode-in@(32,80,183)){Throw-CcodInstallFileError 'CCOD_INSTALL_GENERATION_EXISTS' 'Install generation already exists' $RuntimeId};throw}
-    $runtime=$arguments[2];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$RuntimeId;RootToken=$token;StateOnly=$false;ProductOnly=$false;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='Generation';ReadOnly=$false;RuntimeId=$RuntimeId});$transaction
+    $runtime=$arguments[2];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$RuntimeId;RootToken=$token;StateOnly=$false;ProductOnly=$false;RetryOnly=$false;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='Generation';ReadOnly=$false;RuntimeId=$RuntimeId});$transaction
 }
-function Open-CcodInstallStateTransaction { param([Parameter(Mandatory)][string]$InstallRoot) Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenState $arguments} 'CCOD_INSTALL_STATE_TRANSACTION_INVALID';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$null;RootToken=$token;StateOnly=$true;ProductOnly=$false;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='StateTransaction';ReadOnly=$false;RuntimeId=$null});$transaction }
+function Open-CcodInstallStateTransaction { param([Parameter(Mandatory)][string]$InstallRoot) Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenState $arguments} 'CCOD_INSTALL_STATE_TRANSACTION_INVALID';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$null;RootToken=$token;StateOnly=$true;ProductOnly=$false;RetryOnly=$false;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='StateTransaction';ReadOnly=$false;RuntimeId=$null});$transaction }
+function Open-CcodInstallMigrationRetryTransaction { param([Parameter(Mandatory)][string]$InstallRoot) Initialize-CcodInstallRuntime;if(-not[IO.Path]::IsPathRooted($InstallRoot)){Throw-CcodInstallFileError 'CCOD_INSTALL_ROOT_INVALID' 'Install root must be absolute' $InstallRoot};$arguments=[object[]]@([IO.Path]::GetFullPath($InstallRoot),$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenRetry $arguments} 'CCOD_INSTALL_MIGRATION_RETRY_SCOPE';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');RuntimeId=$null;RootToken=$token;StateOnly=$false;ProductOnly=$false;RetryOnly=$true;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='MigrationRetryTransaction';ReadOnly=$false;RuntimeId=$null});$transaction }
 function Open-CcodInstallRetainedGeneration { param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)][string]$ExpectedManifestSha256,[Parameter(Mandatory)]$FileTransaction) if(-not[IO.Path]::IsPathRooted($InstallRoot)-or$ExpectedManifestSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_GENERATION_INVALID' 'Invalid retained generation contract' $RuntimeId};Assert-CcodInstallLeaf $RuntimeId 'CCOD_INSTALL_RUNTIME_ID_INVALID';$scope=Get-CcodInstallTransaction $FileTransaction 'CCOD_INSTALL_TRANSACTION_INVALID';if(-not[object]::ReferenceEquals($scope.Record.Transaction,$FileTransaction)){Throw-CcodInstallFileError 'CCOD_INSTALL_TRANSACTION_INVALID' 'FileTransaction must be the transaction root capability' $null};Assert-CcodInstallRootScope $scope.State $InstallRoot 'CCOD_INSTALL_TRANSACTION_SCOPE';$nativeResult=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetained @($RuntimeId,$ExpectedManifestSha256)} 'CCOD_INSTALL_RETAINED_GENERATION_INVALID';if(@($nativeResult).Count-ne 2-or-not(Test-CcodRetainedManifestIdentity ([string]$nativeResult[1]) $RuntimeId)){Throw-CcodInstallFileError 'CCOD_INSTALL_RETAINED_RUNTIME_ID_MISMATCH' 'Retained manifest must contain exactly one matching top-level runtimeId string' $RuntimeId};Add-CcodInstallScope $scope.Record.Transaction $nativeResult[0] Generation $true $RuntimeId }
 
 $script:CcodProductReadyFields=@('schemaVersion','transactionId','oldRuntimeId','oldGeneration','oldManifestSha256','newRuntimeId','newGeneration','newManifestSha256','sealedPackageSha256','ownedObjectNames','phase','errorCode')
@@ -443,7 +450,7 @@ function Open-CcodInstallProductRegistrationTransaction {
     try{
         $lease=Enter-CcodInstallProductAuthorityLease
         $authority=Get-CcodInstallProductReadyAuthority $root $ReadyTransaction
-        $arguments=[object[]]@($root,$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenProduct $arguments} 'CCOD_INSTALL_PRODUCT_SCOPE';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=$root.TrimEnd('\');RuntimeId=$authority.RuntimeId;RootToken=$token;StateOnly=$false;ProductOnly=$true;ReadyAuthority=$authority;AuthorityLease=$lease;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='ProductTransaction';ReadOnly=$true;RuntimeId=$authority.RuntimeId});$lease=$null;return $transaction
+        $arguments=[object[]]@($root,$null);$token=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeStatic OpenProduct $arguments} 'CCOD_INSTALL_PRODUCT_SCOPE';$runtime=$arguments[1];$transaction=New-CcodInstallCapability;$script:CcodTransactions.Add($transaction,[pscustomobject]@{Runtime=$runtime;InstallRoot=$root.TrimEnd('\');RuntimeId=$authority.RuntimeId;RootToken=$token;StateOnly=$false;ProductOnly=$true;RetryOnly=$false;ReadyAuthority=$authority;AuthorityLease=$lease;Closed=$false;CleanupFailed=$false;Retired=$false;RetirementResult=$null;Disposition=$null});$script:CcodScopes.Add($transaction,[pscustomobject]@{Transaction=$transaction;Token=$token;Kind='ProductTransaction';ReadOnly=$true;RuntimeId=$authority.RuntimeId});$lease=$null;return $transaction
     }finally{if($null-ne$lease){try{Exit-CcodInstallProductAuthorityLease $lease}catch{}}}
 }
 function Get-CcodInstallProductCleanupFenceProof($State,$Fence){
diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index eae97d0..ff691e2 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -825,6 +825,15 @@ function Open-CcodLifecycleInstallStateTransaction {
     return $transaction
 }
 
+function Open-CcodLifecycleInstallMigrationRetryTransaction {
+    param([Parameter(Mandatory)][string]$InstallRoot)
+    $canonical=Get-CcodLifecycleCanonicalRoot -Path $InstallRoot -Kind 'Install root'
+    $fileModule=Get-CcodLifecycleInstallFileTransactionModule
+    $transaction=&$fileModule {param($Root)Open-CcodInstallMigrationRetryTransaction -InstallRoot $Root} $canonical
+    $script:CcodInstallTransactionRoots.Add($transaction,[pscustomobject]@{InstallRoot=$canonical;RuntimeId=$null})
+    return $transaction
+}
+
 function Assert-CcodInstallTransactionRoot {
     param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$FileTransaction)
     $binding = $null
@@ -1169,6 +1178,118 @@ function Get-CcodLegacyRuntimeValidation {
     return [pscustomobject]@{Valid=$true;Code='CCOD_RUNTIME_VALID';RuntimeId=[string]$manifest.runtimeId;Manifest=$manifest}
 }
 
+function Get-CcodLegacyActiveEvidence {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$ExpectedRuntimeId,[Parameter(Mandatory)]$ActiveValidation)
+    $activePath=Join-Path $InstallRoot 'active.json'
+    [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $InstallRoot -Path $activePath)
+    $active=Read-CcodStrictJson -Path $activePath -ExpectedSchema 2 -Kind 'legacy active runtime'
+    if(-not(Test-CcodLifecycleOrderedProperties $active @('schemaVersion','activeRuntime','previousRuntime','generation','updatedAtUtc'))-or
+       $active.schemaVersion-isnot[int]-or$active.schemaVersion-ne2-or$active.activeRuntime-isnot[string]-or$active.activeRuntime-cne$ExpectedRuntimeId-or
+       $null-ne$active.previousRuntime-or-not(Test-CcodLifecycleProductCleanupInteger $active.generation)-or[uint64]$active.generation-ne1-or
+       -not(Test-CcodLifecycleCanonicalUtc $active.updatedAtUtc)){
+        Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Legacy active runtime evidence is not the exact supported profile' $activePath
+    }
+    $validation=Get-CcodLegacyRuntimeValidation -InstallRoot $InstallRoot -ExistingPointer $active -ActiveValidation $ActiveValidation
+    $manifestPath=Join-Path (Join-Path (Join-Path $InstallRoot 'runtime') $ExpectedRuntimeId) 'manifest.json'
+    return [pscustomobject][ordered]@{Active=$active;Validation=$validation;ManifestSha256=(Get-CcodLifecycleFileSha256 -Path $manifestPath)}
+}
+
+function Get-CcodLegacyMigrationRetrySelectorProfile {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$ExistingPointer,[Parameter(Mandatory)][string]$LegacyRuntimeId,[Parameter(Mandatory)][string]$RetryRuntimeId)
+    $selectorRoot=Join-Path $InstallRoot 'state\active-generation'
+    [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $InstallRoot -Path $selectorRoot)
+    $items=@(Get-ChildItem -LiteralPath $selectorRoot -Force -ErrorAction Stop|Sort-Object Name)
+    if($items.Count-notin@(1,3)){Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Legacy migration retry selector count is unsupported' $selectorRoot}
+    for($index=0;$index-lt$items.Count;$index++){
+        $item=$items[$index];$generation=[uint64]($index+1);$leaf='{0:D20}.json'-f$generation
+        $expectedRuntimeId=if($index-eq1){$RetryRuntimeId}else{$LegacyRuntimeId}
+        if($item.PSIsContainer-or$item.Name-cne$leaf){Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Legacy migration retry selector contains an unknown object' $item.FullName}
+        [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $InstallRoot -Path $item.FullName)
+        $record=Read-CcodStrictJson -Path $item.FullName -ExpectedSchema 1 -Kind 'legacy migration retry selector'
+        if(-not(Test-CcodLifecycleOrderedProperties $record @('schemaVersion','generation','activeRuntime','previousGeneration'))-or
+           $record.schemaVersion-isnot[int]-or$record.schemaVersion-ne1-or-not(Test-CcodLifecycleProductCleanupInteger $record.generation)-or[uint64]$record.generation-ne$generation-or
+           $record.activeRuntime-isnot[string]-or$record.activeRuntime-cne$expectedRuntimeId-or
+           -not(Test-CcodLifecycleProductCleanupInteger $record.previousGeneration)-or[uint64]$record.previousGeneration-ne[uint64]$index){
+            Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Legacy migration retry selector identity is invalid' $item.FullName
+        }
+    }
+    $profile=if($items.Count-eq1){'PrePointer'}else{'PostPointerCompensated'}
+    $expectedPrevious=if($items.Count-eq1){$null}else{$RetryRuntimeId}
+    if($ExistingPointer.activeRuntime-cne$LegacyRuntimeId-or[uint64]$ExistingPointer.generation-ne[uint64]$items.Count-or[string]$ExistingPointer.previousRuntime-cne[string]$expectedPrevious){
+        Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Selected legacy migration retry pointer does not match its canonical chain' $ExistingPointer
+    }
+    return [pscustomobject][ordered]@{Profile=$profile;CurrentGeneration=[uint64]$items.Count;RetryGeneration=[uint64]($items.Count+1)}
+}
+
+function Get-CcodLegacyMigrationRetryContext {
+    param(
+        [Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$ExistingPointer,[Parameter(Mandatory)]$ActiveValidation,
+        [Parameter(Mandatory)]$FailedTransaction,[Parameter(Mandatory)][string]$LegacyManifestSha256
+    )
+    [void](Assert-CcodInstallTransactionRecord -Record $FailedTransaction)
+    if($FailedTransaction.phase-cne'Failed'-or$FailedTransaction.oldRuntimeId-cne[string]$ExistingPointer.activeRuntime-or
+       [uint64]$FailedTransaction.oldGeneration-ne1-or$FailedTransaction.oldManifestSha256-cne$LegacyManifestSha256-or
+       [uint64]$FailedTransaction.newGeneration-ne2-or$FailedTransaction.newRuntimeId-isnot[string]-or$FailedTransaction.newRuntimeId-ceq$FailedTransaction.oldRuntimeId-or
+       @($FailedTransaction.ownedObjectNames).Count-ne1-or[string]$FailedTransaction.ownedObjectNames[0]-cne[string]$FailedTransaction.newRuntimeId){
+        Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Failed legacy migration transaction identity is invalid' $FailedTransaction
+    }
+    $legacy=Get-CcodLegacyActiveEvidence -InstallRoot $InstallRoot -ExpectedRuntimeId ([string]$FailedTransaction.oldRuntimeId) -ActiveValidation $ActiveValidation
+    if($legacy.ManifestSha256-cne$LegacyManifestSha256){Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Legacy migration source manifest changed after failure' $FailedTransaction.oldRuntimeId}
+
+    $transactionRoot=Join-Path $InstallRoot 'state\install-transactions'
+    [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $InstallRoot -Path $transactionRoot)
+    $snapshots=@(Get-ChildItem -LiteralPath $transactionRoot -Force -ErrorAction Stop)
+    if($snapshots.Count-eq0){Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Failed legacy migration transaction chain is empty' $transactionRoot}
+    $observedPhases=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    foreach($snapshot in $snapshots){
+        if($snapshot.PSIsContainer){Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Failed legacy migration transaction store contains a foreign object' $snapshot.FullName}
+        [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $InstallRoot -Path $snapshot.FullName)
+        $record=Read-CcodStrictJson -Path $snapshot.FullName -ExpectedSchema 1 -Kind 'failed legacy migration transaction'
+        [void](Assert-CcodInstallTransactionRecord -Record $record)
+        if($record.transactionId-cne$FailedTransaction.transactionId-or(Get-CcodInstallTransactionRecordLeaf -Record $record)-cne$snapshot.Name){
+            Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Failed legacy migration transaction store contains a foreign chain' $snapshot.FullName
+        }
+        [void]$observedPhases.Add([string]$record.phase)
+    }
+    if(-not$observedPhases.Contains('RuntimePromoted')){Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Failed legacy migration never proved the reusable runtime promoted' $FailedTransaction.transactionId}
+
+    $retryRuntimeRoot=Join-Path (Join-Path $InstallRoot 'runtime') ([string]$FailedTransaction.newRuntimeId)
+    [void](Assert-CcodLifecycleInstallTreeSafe -InstallRoot $InstallRoot -Path $retryRuntimeRoot)
+    $retryManifestPath=Join-Path $retryRuntimeRoot 'manifest.json'
+    [void](Assert-CcodLifecycleInstallLeafSafe -InstallRoot $InstallRoot -Path $retryManifestPath)
+    if((Get-CcodLifecycleFileSha256 -Path $retryManifestPath)-cne[string]$FailedTransaction.newManifestSha256){Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Failed legacy migration runtime manifest identity changed' $retryManifestPath}
+    $retryValidation=Test-CcodRuntimeManifest -RuntimeDirectory $retryRuntimeRoot -ExpectedRuntimeId ([string]$FailedTransaction.newRuntimeId) -ExpectedManifestSha256 ([string]$FailedTransaction.newManifestSha256)
+    if(-not$retryValidation.Valid-or-not(Test-CcodLifecycleOrderedProperties $retryValidation.Manifest @('schemaVersion','projectVersion','runtimeId','files'))-or
+       $retryValidation.Manifest.projectVersion-cne$script:CcodProductVersion-or$retryValidation.Manifest.runtimeId-cne[string]$FailedTransaction.newRuntimeId){
+        Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Failed legacy migration runtime is not an exact current sealed generation' $retryRuntimeRoot
+    }
+    $selector=Get-CcodLegacyMigrationRetrySelectorProfile -InstallRoot $InstallRoot -ExistingPointer $ExistingPointer -LegacyRuntimeId ([string]$FailedTransaction.oldRuntimeId) -RetryRuntimeId ([string]$FailedTransaction.newRuntimeId)
+    if(($selector.Profile-ceq'PrePointer'-and$observedPhases.Contains('PointerCommitted'))-or($selector.Profile-ceq'PostPointerCompensated'-and-not$observedPhases.Contains('PointerCommitted'))){
+        Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Failed migration phases do not match the exact selector profile' $FailedTransaction.transactionId
+    }
+    return [pscustomobject][ordered]@{
+        Kind='LegacyMigrationRetry';Profile=$selector.Profile;ActiveRuntimeId=[string]$FailedTransaction.oldRuntimeId;ActiveGeneration=[uint64]$selector.CurrentGeneration
+        ProjectVersion=[string]$legacy.Validation.Manifest.projectVersion;ManifestSha256=$legacy.ManifestSha256;Manifest=$legacy.Validation.Manifest;ActiveValidation=$legacy.Validation
+        FailedTransaction=$FailedTransaction;RetryRuntimeId=[string]$FailedTransaction.newRuntimeId;RetryGeneration=[uint64]$selector.RetryGeneration
+        RetryManifestSha256=[string]$FailedTransaction.newManifestSha256;RetryValidation=$retryValidation
+    }
+}
+
+function Assert-CcodLegacyMigrationRetryPackage {
+    param([Parameter(Mandatory)]$CompatibilityContext,[Parameter(Mandatory)][string]$ProjectVersion,[Parameter(Mandatory)][string]$SealedPackageSha256,[Parameter(Mandatory)][object[]]$Files)
+    if($CompatibilityContext.Kind-cne'LegacyMigrationRetry'-or$ProjectVersion-cne$script:CcodProductVersion-or
+       $SealedPackageSha256-cne[string]$CompatibilityContext.FailedTransaction.sealedPackageSha256){
+        Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Retry input does not match the failed legacy migration package identity' $CompatibilityContext
+    }
+    $records=[Collections.Generic.List[object]]::new()
+    foreach($file in $Files){$records.Add([pscustomobject][ordered]@{path=([string]$file.Relative).Replace('\','/');length=$(if($null-ne$file.PSObject.Properties['ExpectedLength']){[int64]$file.ExpectedLength}else{[int64](Get-Item -LiteralPath $file.Source -Force).Length});sha256=$(if($null-ne$file.PSObject.Properties['ExpectedSha256']){[string]$file.ExpectedSha256}else{Get-CcodLifecycleFileSha256 -Path $file.Source})})}
+    $comparison=[Comparison[object]]{param($left,$right)[StringComparer]::Ordinal.Compare([string]$left.path,[string]$right.path)};$records.Sort($comparison)
+    $expected=@($CompatibilityContext.RetryValidation.Manifest.files);$actual=@($records)
+    if($actual.Count-ne$expected.Count){Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Retry source file set differs from the failed sealed runtime' $CompatibilityContext.RetryRuntimeId}
+    for($index=0;$index-lt$actual.Count;$index++){if($actual[$index].path-cne$expected[$index].path-or[int64]$actual[$index].length-ne[int64]$expected[$index].length-or$actual[$index].sha256-cne$expected[$index].sha256){Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Retry source bytes differ from the failed sealed runtime' $actual[$index].path}}
+    return $true
+}
+
 function Get-CcodLegacyUpgradeCompatibilityContext {
     [CmdletBinding()]
     param(
@@ -1196,6 +1317,10 @@ function Get-CcodLegacyUpgradeCompatibilityContext {
 
         if (-not $selectorMissing -and -not $transactionPlaneMissing) {
             [void](Assert-CcodInstallTransactionRecord -Record $GlobalTransaction)
+            if($GlobalTransaction.phase-ceq'Failed'){
+                if(-not(Test-CcodLegacyUpgradePlaneMissing -InstallRoot $root -RelativePath 'state\product-cleanup-fences')){throw 'failed migration has a cleanup fence'}
+                return Get-CcodLegacyMigrationRetryContext -InstallRoot $root -ExistingPointer $ExistingPointer -ActiveValidation $ActiveValidation -FailedTransaction $GlobalTransaction -LegacyManifestSha256 $manifestSha256
+            }
             if ($GlobalTransaction.phase -cne 'Ready' -or
                 $ActiveValidation.Valid -isnot [bool] -or -not $ActiveValidation.Valid -or
                 $ActiveValidation.RuntimeId -cne [string]$ExistingPointer.activeRuntime -or
@@ -3217,6 +3342,9 @@ function Invoke-CcodInstall {
             }
         }
     }
+    if($null-ne$upgradeCompatibility-and$upgradeCompatibility.Kind-ceq'LegacyMigrationRetry'){
+        [void](Assert-CcodLegacyMigrationRetryPackage -CompatibilityContext $upgradeCompatibility -ProjectVersion ([string]$projectVersion) -SealedPackageSha256 $SealedPackageSha256 -Files $files)
+    }
 
     if ([string]::IsNullOrWhiteSpace($ActivationId)) { $ActivationId = & $adapters.NewActivationId }
     if (-not (Test-CcodLifecycleCanonicalGuid $ActivationId)) {
@@ -3248,12 +3376,22 @@ function Invoke-CcodInstall {
             $upgradeProductCleanupLease=Enter-CcodLifecycleProductCleanupLease
             if($upgradeCompatibility.Kind-ceq'CurrentReady'){
                 [void](Resolve-CcodLifecycleProductCleanupFence -InstallRoot $root -ReadyTransaction $globalTransaction -CurrentIdentity $upgradeProductCleanupLease.OwnerIdentity -CloseProductTransaction $adapters.CloseProductTransaction)
-            }elseif($upgradeCompatibility.Kind-cne'ProvenLegacyWithoutReady'){
+            }elseif($upgradeCompatibility.Kind-notin@('ProvenLegacyWithoutReady','LegacyMigrationRetry')){
                 Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Upgrade compatibility classification changed before staging' $upgradeCompatibility
             }
         }
-        $runtimeId=New-CcodUniqueRuntimeId -ProjectVersion $projectVersion -Files $files;$generation=New-CcodLifecycleImmutableGeneration -InstallRoot $root -RuntimeId $runtimeId -ProjectVersion $projectVersion -Files $files;$fileTransaction=$generation.FileTransaction;$generationCapability=$generation.Generation;$runtimeRoot=$generation.RuntimeRoot;$runtimeCreated=$true
-        $newGeneration=if($null-eq$existingPointer){[uint64]1}else{[uint64]$existingPointer.generation+1};$installRecord=New-CcodInstallTransactionRecord -TransactionId ([guid]::NewGuid().ToString('D')) -OldRuntimeId $(if($upgrade){$existingPointer.activeRuntime}else{$null}) -OldGeneration $(if($upgrade){$existingPointer.generation}else{$null}) -OldManifestSha256 $oldManifestSha256 -NewRuntimeId $runtimeId -NewGeneration $newGeneration -NewManifestSha256 $generation.ManifestSha256 -SealedPackageSha256 $SealedPackageSha256 -OwnedObjectNames @($runtimeId)
+        $migrationRetry=$upgrade-and$upgradeCompatibility.Kind-ceq'LegacyMigrationRetry'
+        if($migrationRetry){
+            $runtimeId=[string]$upgradeCompatibility.RetryRuntimeId;$runtimeRoot=Join-Path (Join-Path $root 'runtime') $runtimeId
+            $fileTransaction=Open-CcodLifecycleInstallMigrationRetryTransaction -InstallRoot $root
+            $generationCapability=Open-CcodInstallRetainedGeneration -InstallRoot $root -RuntimeId $runtimeId -ExpectedManifestSha256 ([string]$upgradeCompatibility.RetryManifestSha256) -FileTransaction $fileTransaction
+            $newGeneration=[uint64]$upgradeCompatibility.RetryGeneration;$newManifestSha256=[string]$upgradeCompatibility.RetryManifestSha256;$ownedObjectNames=@()
+        }else{
+            $runtimeId=New-CcodUniqueRuntimeId -ProjectVersion $projectVersion -Files $files;$generation=New-CcodLifecycleImmutableGeneration -InstallRoot $root -RuntimeId $runtimeId -ProjectVersion $projectVersion -Files $files;$fileTransaction=$generation.FileTransaction;$generationCapability=$generation.Generation;$runtimeRoot=$generation.RuntimeRoot;$runtimeCreated=$true
+            $newGeneration=if($null-eq$existingPointer){[uint64]1}else{[uint64]$existingPointer.generation+1};$newManifestSha256=[string]$generation.ManifestSha256;$ownedObjectNames=@($runtimeId)
+        }
+        if($migrationRetry-and$newGeneration-ne[uint64]($existingPointer.generation+1)){Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Retry generation no longer follows the selected pointer' $upgradeCompatibility}
+        $installRecord=New-CcodInstallTransactionRecord -TransactionId ([guid]::NewGuid().ToString('D')) -OldRuntimeId $(if($upgrade){$existingPointer.activeRuntime}else{$null}) -OldGeneration $(if($upgrade){$existingPointer.generation}else{$null}) -OldManifestSha256 $oldManifestSha256 -NewRuntimeId $runtimeId -NewGeneration $newGeneration -NewManifestSha256 $newManifestSha256 -SealedPackageSha256 $SealedPackageSha256 -OwnedObjectNames $ownedObjectNames
         Write-CcodInstallTransactionRecord -InstallRoot $root -TransactionRecord $installRecord -FileTransaction $fileTransaction|Out-Null
         foreach($phase in @('PackageVerified','RuntimeStaged')){$installRecord=Set-CcodInstallTransactionPhase -InstallRoot $root -TransactionId $installRecord.transactionId -ExpectedPhase $installRecord.phase -NewPhase $phase -FileTransaction $fileTransaction}
         if ($upgrade) {
@@ -3289,7 +3427,7 @@ function Invoke-CcodInstall {
 
         Write-CcodInstallActivationPhase -Activation $activation -Phase 'InstallingRuntime' -RuntimeId $runtimeId -PreviousRuntimeId $(if ($upgrade) { [string]$existingPointer.activeRuntime } else { $null }) -ErrorCode $null -Adapters $adapters -InstallRoot $root -FileTransaction $fileTransaction | Out-Null
         $installRecord=Set-CcodInstallTransactionPhase -InstallRoot $root -TransactionId $installRecord.transactionId -ExpectedPhase 'PreviousProtectionStopped' -NewPhase 'RuntimePromoted' -FileTransaction $fileTransaction
-        Initialize-CcodInstallStatePlanes -InstallRoot $root -RuntimeId $runtimeId -FileTransaction $fileTransaction -NodeCandidates $nodeCandidates -CandidateCompatibleOptIn ([bool]$EnableCandidateCompatibleUpdates)
+        if(-not$migrationRetry){Initialize-CcodInstallStatePlanes -InstallRoot $root -RuntimeId $runtimeId -FileTransaction $fileTransaction -NodeCandidates $nodeCandidates -CandidateCompatibleOptIn ([bool]$EnableCandidateCompatibleUpdates)}
         Write-CcodInstallActivationPhase -Activation $activation -Phase 'ActivatingRuntime' -RuntimeId $runtimeId -PreviousRuntimeId $(if ($upgrade) { [string]$existingPointer.activeRuntime } else { $null }) -ErrorCode $null -Adapters $adapters -InstallRoot $root -FileTransaction $fileTransaction | Out-Null
         if($upgrade-and$upgradeCompatibility.Kind-ceq'ProvenLegacyWithoutReady'){$existingPointer=Initialize-CcodLegacyUpgradeSelector -InstallRoot $root -CompatibilityContext $upgradeCompatibility -FileTransaction $fileTransaction;$pointer=$existingPointer}
         $process = [Diagnostics.Process]::GetCurrentProcess()
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index 3259a8d..92dbd8f 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -150,9 +150,9 @@ function Assert-CcodProductTransactionRejected {
 Invoke-CcodTest 'exports only immutable generation operations and an inert CLR marker' {
     $expected=@('Close-CcodInstallFileTransaction','Commit-CcodInstallActivePointer','Copy-CcodInstallProductShortcut','Copy-CcodInstallSealedSource','New-CcodInstallDirectory','New-CcodInstallGenerationLeaf','Open-CcodInstallGeneration','Open-CcodInstallProductRegistrationTransaction','Open-CcodInstallProductSpecialFolder','Open-CcodInstallRetainedFile','Open-CcodInstallRetainedGeneration','Open-CcodInstallStateTransaction','Retire-CcodInstallGeneration','Write-CcodInstallGenerationManifest','Write-CcodInstallRecord')
     Assert-CcodEqual ($expected -join '|') ((@($module.ExportedCommands.Keys)|Sort-Object)-join '|') 'module export surface is capability-only'
-    Assert-CcodEqual 4 ([CcodInstallGenerationCapabilityMarkerV4]::CapabilityAbi) 'marker exposes the current non-mutating ABI value'
-    Assert-CcodEqual 'CcodInstallGenerationCapabilityMarkerV4' ((@([CcodInstallGenerationCapabilityMarkerV4].Assembly.GetExportedTypes()|ForEach-Object FullName)) -join '|') 'current CLR bridge exports only the inert marker'
-    $dangerous=@([CcodInstallGenerationCapabilityMarkerV4].GetMethods([Reflection.BindingFlags]'Public,Static,DeclaredOnly')|Where-Object{@($_.GetParameters()|Where-Object{$_.ParameterType-in@([string],[IntPtr],[IO.Stream])-or[Microsoft.Win32.SafeHandles.SafeHandle].IsAssignableFrom($_.ParameterType)}).Count-ne 0})
+    Assert-CcodEqual 5 ([CcodInstallGenerationCapabilityMarkerV5]::CapabilityAbi) 'marker exposes the current non-mutating ABI value'
+    Assert-CcodEqual 'CcodInstallGenerationCapabilityMarkerV5' ((@([CcodInstallGenerationCapabilityMarkerV5].Assembly.GetExportedTypes()|ForEach-Object FullName)) -join '|') 'current CLR bridge exports only the inert marker'
+    $dangerous=@([CcodInstallGenerationCapabilityMarkerV5].GetMethods([Reflection.BindingFlags]'Public,Static,DeclaredOnly')|Where-Object{@($_.GetParameters()|Where-Object{$_.ParameterType-in@([string],[IntPtr],[IO.Stream])-or[Microsoft.Win32.SafeHandles.SafeHandle].IsAssignableFrom($_.ParameterType)}).Count-ne 0})
     Assert-CcodEqual 0 $dangerous.Count 'marker accepts no path stream or bare handle'
     Assert-CcodTrue (-not $module.ExportedCommands['Copy-CcodInstallProductShortcut'].Parameters.ContainsKey('SourcePath')) 'product shortcut copy accepts no arbitrary absolute source path'
 }
@@ -336,11 +336,37 @@ Invoke-CcodTest 'product authority rejects incomplete pointer stores and changed
     }
 }
 
-Invoke-CcodTest 'V4 state-only transaction writes records but cannot reach generation or pointer operations' {
+Invoke-CcodTest 'V5 state-only transaction writes records but cannot reach generation or pointer operations' {
     $fixture=New-CcodInstallFileFixture;$transaction=$null
     try{$transaction=Open-CcodInstallStateTransaction -InstallRoot $fixture.Install;$fixture.Transactions.Add($transaction);$state=New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'state' -CreateIfMissing;$records=New-CcodInstallDirectory -Transaction $transaction -Parent $state -Leaf 'install-transactions' -CreateIfMissing;Write-CcodInstallRecord -Transaction $transaction -Parent $records -Leaf 'ready.json' -Record ([ordered]@{schemaVersion=1;phase='Ready'})|Out-Null;Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $fixture.Install 'state\install-transactions\ready.json')) 'state-only transaction writes a create-only state record';Assert-CcodThrows {Write-CcodInstallRecord -Transaction $transaction -Parent $records -Leaf 'ready.json' -Record ([ordered]@{schemaVersion=1;phase='Ready'})|Out-Null} 'CCOD_INSTALL_RECORD_EXISTS';Assert-CcodThrows {New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'runtime' -CreateIfMissing|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {New-CcodInstallGenerationLeaf -Generation $transaction -Leaf 'payload'|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';$source=New-CcodSourceFile $fixture 'state-source.txt' 'x';Assert-CcodThrows {Copy-CcodInstallSealedSource -Generation $transaction -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {Write-CcodInstallGenerationManifest -Generation $transaction -Manifest (New-CcodGenerationManifest 'state-runtime')|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId 'state-runtime' -ExpectedManifestSha256 ('0'*64) -FileTransaction $transaction|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $transaction -ExpectedPreviousGeneration 0 -FileTransaction $transaction|Out-Null} 'CCOD_INSTALL_POINTER_TARGET_INVALID';Assert-CcodThrows {Retire-CcodInstallGeneration -InstallRoot $fixture.Install -RuntimeId 'state-runtime' -FileTransaction $transaction|Out-Null} 'CCOD_INSTALL_GENERATION_NOT_OWNED';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $fixture.Install 'runtime')) 'state-only transaction creates no runtime tree';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $fixture.Install 'state\active-generation')) 'state-only transaction creates no active pointer';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $fixture.Install 'state\retired-generations')) 'state-only transaction creates no retirement record'}finally{Remove-CcodInstallFileFixture $fixture}
 }
 
+Invoke-CcodTest 'migration retry transaction writes only state and targets one retained generation without creating a runtime' {
+    $fixture=New-CcodInstallFileFixture
+    try {
+        $runtimeId='runtime-migration-retry';$source=New-CcodSourceFile $fixture 'migration-retry.bin' 'sealed migration retry bytes'
+        $original=Open-CcodFixtureGeneration $fixture $runtimeId
+        Copy-CcodInstallSealedSource -Generation $original -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null
+        $manifest=Write-CcodInstallGenerationManifest -Generation $original -Manifest (New-CcodGenerationManifest $runtimeId @([ordered]@{path='payload.bin';length=$source.Length;sha256=$source.Sha256}))
+        Close-CcodInstallFileTransaction -Transaction $original -Disposition Failed
+        $runtimeCount=@(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'runtime') -Directory -Force).Count
+
+        $retry=&$module {param($Root)Open-CcodInstallMigrationRetryTransaction -InstallRoot $Root} $fixture.Install;$fixture.Transactions.Add($retry)
+        $state=New-CcodInstallDirectory -Transaction $retry -Parent $retry -Leaf 'state' -CreateIfMissing
+        $records=New-CcodInstallDirectory -Transaction $retry -Parent $state -Leaf 'install-transactions' -CreateIfMissing
+        Write-CcodInstallRecord -Transaction $retry -Parent $records -Leaf 'retry.json' -Record ([ordered]@{schemaVersion=1;phase='Prepared'})|Out-Null
+        $retained=Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256 -FileTransaction $retry
+        Assert-CcodThrows {New-CcodInstallGenerationLeaf -Generation $retry -Leaf 'blocked'|Out-Null} 'CCOD_INSTALL_MIGRATION_RETRY_SCOPE'
+        Assert-CcodThrows {Copy-CcodInstallSealedSource -Generation $retry -SourcePath $source.Path -Leaf 'blocked.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null} 'CCOD_INSTALL_MIGRATION_RETRY_SCOPE'
+        Assert-CcodThrows {Write-CcodInstallGenerationManifest -Generation $retry -Manifest (New-CcodGenerationManifest 'blocked')|Out-Null} 'CCOD_INSTALL_MIGRATION_RETRY_SCOPE'
+        Assert-CcodThrows {Open-CcodInstallProductSpecialFolder -Generation $retained -Kind Desktop|Out-Null} 'CCOD_INSTALL_MIGRATION_RETRY_SCOPE'
+        $pointer=Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $retained -ExpectedPreviousGeneration 0 -FileTransaction $retry
+        Assert-CcodEqual ([uint64]1) ([uint64]$pointer.Generation) 'retry capability may append only through the retained target'
+        Assert-CcodEqual $runtimeCount @(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'runtime') -Directory -Force).Count 'retry capability creates no runtime directory'
+        Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $fixture.Install 'state\install-transactions\retry.json') -PathType Leaf) 'retry capability publishes bounded state evidence'
+    } finally {Remove-CcodInstallFileFixture $fixture}
+}
+
 Invoke-CcodTest 'force re-import rebinds the current runtime ABI before real use' {
     $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
     $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
@@ -810,24 +836,24 @@ Invoke-CcodExtensionRedTest 'child-transaction' 'rejects a child directory capab
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
 
-Invoke-CcodExtensionRedTest 'v3-reimport' 'a child process loads V3 first then proves the V4 state-only export boundary' {
+Invoke-CcodExtensionRedTest 'v4-reimport' 'a child process loads V4 first then proves the V5 state-only export boundary' {
     $fixture=New-CcodInstallFileFixture
     try {
-        $source=New-CcodSourceFile $fixture 'v4-state-source.txt' 'state-only-after-v3'
+        $source=New-CcodSourceFile $fixture 'v5-state-source.txt' 'state-only-after-v4'
         $escapedModule=$modulePath.Replace("'","''");$escapedInstall=$fixture.Install.Replace("'","''");$escapedSource=$source.Path.Replace("'","''")
         $child=@"
 `$ErrorActionPreference='Stop';`$ProgressPreference='SilentlyContinue'
-Add-Type -TypeDefinition 'public sealed class CcodInstallGenerationCapabilityMarkerV3 { private CcodInstallGenerationCapabilityMarkerV3() {} public static int CapabilityAbi { get { return 3; } } }'
-if([CcodInstallGenerationCapabilityMarkerV3]::CapabilityAbi-ne3-or`$null-ne('CcodInstallGenerationCapabilityMarkerV4'-as[type])){throw 'V3 was not loaded first'}
+Add-Type -TypeDefinition 'public sealed class CcodInstallGenerationCapabilityMarkerV4 { private CcodInstallGenerationCapabilityMarkerV4() {} public static int CapabilityAbi { get { return 4; } } }'
+if([CcodInstallGenerationCapabilityMarkerV4]::CapabilityAbi-ne4-or`$null-ne('CcodInstallGenerationCapabilityMarkerV5'-as[type])){throw 'V4 was not loaded first'}
 Import-Module '$escapedModule' -Force -DisableNameChecking -ErrorAction Stop
-if([CcodInstallGenerationCapabilityMarkerV4]::CapabilityAbi-ne4){throw 'V4 ABI missing'}
+if([CcodInstallGenerationCapabilityMarkerV5]::CapabilityAbi-ne5){throw 'V5 ABI missing'}
 function Assert-ChildThrows([scriptblock]`$Action,[string]`$ErrorId){try{&`$Action;throw "EXPECTED_`$ErrorId"}catch{if(`$_.FullyQualifiedErrorId-notlike"`$ErrorId*"){throw}}}
 `$transaction=Open-CcodInstallStateTransaction -InstallRoot '$escapedInstall'
 try{
   `$state=New-CcodInstallDirectory -Transaction `$transaction -Parent `$transaction -Leaf 'state' -CreateIfMissing
-  `$records=New-CcodInstallDirectory -Transaction `$transaction -Parent `$state -Leaf 'v3-first-recovery' -CreateIfMissing
+  `$records=New-CcodInstallDirectory -Transaction `$transaction -Parent `$state -Leaf 'v4-first-recovery' -CreateIfMissing
   Write-CcodInstallRecord -Transaction `$transaction -Parent `$records -Leaf 'ready.json' -Record ([ordered]@{schemaVersion=1;phase='Ready'})|Out-Null
-  if(-not[IO.File]::Exists((Join-Path '$escapedInstall' 'state\v3-first-recovery\ready.json'))){throw 'state record missing'}
+  if(-not[IO.File]::Exists((Join-Path '$escapedInstall' 'state\v4-first-recovery\ready.json'))){throw 'state record missing'}
   Assert-ChildThrows {New-CcodInstallDirectory -Transaction `$transaction -Parent `$transaction -Leaf 'runtime' -CreateIfMissing|Out-Null} 'CCOD_INSTALL_STATE_SCOPE'
   Assert-ChildThrows {New-CcodInstallGenerationLeaf -Generation `$transaction -Leaf 'payload'|Out-Null} 'CCOD_INSTALL_STATE_SCOPE'
   Assert-ChildThrows {Copy-CcodInstallSealedSource -Generation `$transaction -SourcePath '$escapedSource' -Leaf 'payload.bin' -ExpectedLength $($source.Length) -ExpectedSha256 '$($source.Sha256)'|Out-Null} 'CCOD_INSTALL_STATE_SCOPE'
@@ -837,11 +863,11 @@ try{
   Assert-ChildThrows {Retire-CcodInstallGeneration -InstallRoot '$escapedInstall' -RuntimeId 'runtime-v3-old' -FileTransaction `$transaction|Out-Null} 'CCOD_INSTALL_GENERATION_NOT_OWNED'
   if([IO.Directory]::Exists((Join-Path '$escapedInstall' 'runtime'))-or[IO.Directory]::Exists((Join-Path '$escapedInstall' 'state\active-generation'))-or[IO.Directory]::Exists((Join-Path '$escapedInstall' 'state\retired-generations'))){throw 'state-only escape observed'}
 }finally{Close-CcodInstallFileTransaction -Transaction `$transaction -Disposition Ready}
-[Console]::Out.WriteLine('V3_FIRST_V4_STATE_ONLY_OK')
+[Console]::Out.WriteLine('V4_FIRST_V5_STATE_ONLY_OK')
 "@
         $encoded=[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($child));$output=@(& powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand $encoded 2>&1);$exitCode=$LASTEXITCODE
-        Assert-CcodEqual 0 $exitCode 'fresh child process accepts V4 after loading only V3 first'
-        Assert-CcodEqual 'V3_FIRST_V4_STATE_ONLY_OK' ($output -join '') 'child proves only the exported V4 state-only boundary'
+        Assert-CcodEqual 0 $exitCode 'fresh child process accepts V5 after loading only V4 first'
+        Assert-CcodEqual 'V4_FIRST_V5_STATE_ONLY_OK' ($output -join '') 'child proves only the exported V5 state-only boundary'
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
 
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index 3e3930a..2a2bdcd 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -160,6 +160,30 @@ function New-CcodLifecycleV2521LegacyInstallFixture {
     return [pscustomobject][ordered]@{ RuntimeId=$runtimeId;RuntimeRoot=$runtimeRoot;Manifest=$manifest;Active=$active;Receipt=$receipt }
 }
 
+function New-CcodLifecycleLegacyMigrationRetryFixture {
+    $legacySource=New-CcodLifecycleTempRoot;$source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    try {
+        New-CcodLifecycleSourceFixture -Root $legacySource -Version '2.5.21'|Out-Null
+        $legacy=New-CcodLifecycleV2521LegacyInstallFixture -InstallRoot $install -SourceRoot $legacySource
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null
+        $node=New-CcodLifecycleFakeNode -Root $nodeRoot;$fake=New-CcodLifecycleFake -NodePath $node
+        $fake.World.SetActiveFailure={param($InstallRoot,$RuntimeId,$Ownership,$TargetGeneration,$FileTransaction)throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new('adapted pointer failure'),'CCOD_RUNTIME_POINTER_COMMIT_FAILED',[Management.Automation.ErrorCategory]::InvalidData,$RuntimeId)}
+        $failure=$null;try{Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('d'*64) -Adapters $fake.Adapters|Out-Null}catch{$failure=$_}
+        if($null-eq$failure-or([string]$failure.FullyQualifiedErrorId-split',')[0]-cne'CCOD_RUNTIME_POINTER_COMMIT_FAILED'){throw 'legacy migration retry fixture did not reach the expected first failure'}
+        $fake.World.SetActiveFailure=$null
+        $module=Get-Module InstallLifecycle -ErrorAction Stop;$head=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install
+        return [pscustomobject]@{LegacySource=$legacySource;Source=$source;Install=$install;NodeRoot=$nodeRoot;Node=$node;Legacy=$legacy;Fake=$fake;Head=$head}
+    } catch {
+        foreach($path in @($legacySource,$source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}
+        throw
+    }
+}
+
+function Remove-CcodLifecycleLegacyMigrationRetryFixture {
+    param([Parameter(Mandatory)]$Fixture)
+    foreach($path in @($Fixture.LegacySource,$Fixture.Source,$Fixture.Install,$Fixture.NodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}
+}
+
 function New-CcodLifecyclePayloadManifest {
     param(
         [Parameter(Mandatory)][string]$Root,
@@ -1058,6 +1082,24 @@ $results += Invoke-CcodTest 'real v2.5.21 upgrade failure before new Ready resta
         Assert-CcodEqual 'Failed' $head.phase 'failed new generation has a terminal diagnostic transaction'
         Assert-CcodEqual 'CCOD_INSTALL_NEW_RUNTIME_NOT_READY' $head.errorCode 'failed transaction retains the original pre-Ready error'
         Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $install 'active.json') -PathType Leaf) 'legacy active pointer remains untouched as evidence after compensation'
+        $failedRuntimeId=[string]$head.newRuntimeId
+        $runtimeCount=@(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory -Force).Count
+        $fake.Adapters.WaitNewRuntimeReady={param($InstallRoot,$RuntimeId,$RuntimeGeneration,$Identity,$TaskStartedAtUtc,$TimeoutMilliseconds)[pscustomobject][ordered]@{SupervisorReady=$true;TrayReady=$true}}
+
+        $retry=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('c'*64) -Adapters $fake.Adapters
+
+        Assert-CcodEqual 'Upgraded' $retry.Outcome 'second exact attempt resumes the compensated legacy migration'
+        Assert-CcodEqual $failedRuntimeId $retry.RuntimeId 'compensated retry reuses the exact sealed generation-two runtime'
+        Assert-CcodEqual $runtimeCount @(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory -Force).Count 'compensated retry invents no additional runtime generation'
+        $retryPointer=Read-CcodActiveRuntime -InstallRoot $install
+        Assert-CcodEqual $failedRuntimeId $retryPointer.activeRuntime 'compensated retry selects the previously failed sealed runtime'
+        Assert-CcodEqual ([uint64]4) $retryPointer.generation 'compensated retry appends after the canonical three-record rollback chain'
+        Assert-CcodEqual 4 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\active-generation') -File -Force).Count 'compensated retry preserves and extends the complete selector chain'
+        $readyHeads=@(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Ready.*.json' -File -Force)
+        Assert-CcodEqual 1 $readyHeads.Count 'compensated retry produces exactly one terminal Ready transaction'
+        $ready=[IO.File]::ReadAllText($readyHeads[0].FullName)|ConvertFrom-Json
+        Assert-CcodEqual ([uint64]4) ([uint64]$ready.newGeneration) 'compensated retry Ready is bound to selector generation four'
+        Assert-CcodEqual $failedRuntimeId $ready.newRuntimeId 'compensated retry Ready remains bound to the original failed runtime'
     } finally {
         foreach($path in @($legacySource,$source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}
     }
@@ -1086,11 +1128,75 @@ $results += Invoke-CcodTest 'real v2.5.21 upgrade failure before new pointer com
         Assert-CcodEqual 'Failed' $head.phase 'pre-pointer failure has a terminal diagnostic transaction'
         Assert-CcodEqual 'CCOD_RUNTIME_POINTER_COMMIT_FAILED' $head.errorCode 'diagnostic transaction retains the adapted pointer failure'
         Assert-CcodTrue (Test-Path -LiteralPath $legacy.RuntimeRoot -PathType Container) 'pre-pointer failure retains the old runtime tree'
+        $failedRuntimeId=[string]$head.newRuntimeId
+        $runtimeCount=@(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory -Force).Count
+        $fake.World.SetActiveFailure=$null
+
+        $retry=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('d'*64) -Adapters $fake.Adapters
+
+        Assert-CcodEqual 'Upgraded' $retry.Outcome 'second exact attempt resumes the failed legacy migration'
+        Assert-CcodEqual $failedRuntimeId $retry.RuntimeId 'retry reuses the exact sealed generation-two runtime'
+        Assert-CcodEqual $runtimeCount @(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory -Force).Count 'retry invents no additional runtime generation'
+        $retryPointer=Read-CcodActiveRuntime -InstallRoot $install
+        Assert-CcodEqual $failedRuntimeId $retryPointer.activeRuntime 'retry selects the previously failed sealed runtime'
+        Assert-CcodEqual ([uint64]2) $retryPointer.generation 'pre-pointer retry completes the missing generation-two selector'
+        $readyHeads=@(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Ready.*.json' -File -Force)
+        Assert-CcodEqual 1 $readyHeads.Count 'retry produces exactly one terminal Ready transaction'
     } finally {
         foreach($path in @($legacySource,$source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}
     }
 }
 
+foreach($retryCase in @(
+    [pscustomobject]@{Name='legacy manifest identity drift in the Failed chain';Kind='old-manifest'},
+    [pscustomobject]@{Name='Failed transaction generation drift';Kind='generation'},
+    [pscustomobject]@{Name='foreign terminal transaction chain';Kind='foreign'},
+    [pscustomobject]@{Name='Failed chain without RuntimePromoted evidence';Kind='premature'},
+    [pscustomobject]@{Name='cleanup fence plane';Kind='fence'},
+    [pscustomobject]@{Name='unexpected selector generation';Kind='selector'},
+    [pscustomobject]@{Name='failed runtime manifest byte drift';Kind='new-manifest'},
+    [pscustomobject]@{Name='different sealed package identity';Kind='package'}
+)) {
+    $case=$retryCase
+    $results += Invoke-CcodTest ("legacy migration retry rejects {0} before any new mutation" -f $case.Name) {
+        $fixture=New-CcodLifecycleLegacyMigrationRetryFixture
+        try {
+            $module=Get-Module InstallLifecycle -ErrorAction Stop
+            $store=Join-Path $fixture.Install 'state\install-transactions'
+            switch($case.Kind){
+                'old-manifest' {
+                    foreach($file in @(Get-ChildItem -LiteralPath $store -File -Force)){$record=[IO.File]::ReadAllText($file.FullName)|ConvertFrom-Json;$record.oldManifestSha256=('0'*64);[IO.File]::SetAttributes($file.FullName,[IO.FileAttributes]::Normal);[IO.File]::WriteAllText($file.FullName,($record|ConvertTo-Json -Depth 8 -Compress),[Text.UTF8Encoding]::new($false))}
+                }
+                'generation' {
+                    foreach($file in @(Get-ChildItem -LiteralPath $store -File -Force)){$record=[IO.File]::ReadAllText($file.FullName)|ConvertFrom-Json;$record.newGeneration=[uint64]3;$newLeaf=&$module {param($Value)Get-CcodInstallTransactionRecordLeaf -Record $Value} $record;[IO.File]::SetAttributes($file.FullName,[IO.FileAttributes]::Normal);[IO.File]::WriteAllText($file.FullName,($record|ConvertTo-Json -Depth 8 -Compress),[Text.UTF8Encoding]::new($false));[IO.File]::Move($file.FullName,(Join-Path $store $newLeaf))}
+                }
+                'foreign' {
+                    $foreign=&$module {New-CcodInstallTransactionRecord -TransactionId 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee' -OldRuntimeId $null -OldGeneration $null -OldManifestSha256 $null -NewRuntimeId 'foreign-runtime' -NewGeneration ([uint64]1) -NewManifestSha256 ('1'*64) -SealedPackageSha256 ('2'*64) -OwnedObjectNames @('foreign-runtime')}
+                    foreach($phase in @('Prepared','Failed')){$record=$foreign.PSObject.Copy();$record.phase=$phase;$record.errorCode=if($phase-ceq'Failed'){'CCOD_INSTALL_FAILED'}else{$null};$leaf=&$module {param($Value)Get-CcodInstallTransactionRecordLeaf -Record $Value} $record;[IO.File]::WriteAllText((Join-Path $store $leaf),($record|ConvertTo-Json -Depth 8 -Compress),[Text.UTF8Encoding]::new($false))}
+                }
+                'premature' {
+                    foreach($file in @(Get-ChildItem -LiteralPath $store -File -Force)){$record=[IO.File]::ReadAllText($file.FullName)|ConvertFrom-Json;if($record.phase-notin@('Prepared','PackageVerified','Failed')){[IO.File]::SetAttributes($file.FullName,[IO.FileAttributes]::Normal);[IO.File]::Delete($file.FullName)}}
+                }
+                'fence' {[IO.Directory]::CreateDirectory((Join-Path $fixture.Install 'state\product-cleanup-fences'))|Out-Null}
+                'selector' {[IO.File]::WriteAllText((Join-Path $fixture.Install 'state\active-generation\00000000000000000002.json'),([ordered]@{schemaVersion=1;generation=[uint64]2;activeRuntime=$fixture.Legacy.RuntimeId;previousGeneration=[uint64]1}|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))}
+                'new-manifest' {$manifestPath=Join-Path $fixture.Install "runtime\$($fixture.Head.newRuntimeId)\manifest.json";[IO.File]::SetAttributes($manifestPath,[IO.FileAttributes]::Normal);[IO.File]::AppendAllText($manifestPath,"`n",[Text.UTF8Encoding]::new($false))}
+            }
+            $runtimeCount=@(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'runtime') -Directory -Force).Count
+            $selectorCount=@(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\active-generation') -File -Force).Count
+            $transactionCount=@(Get-ChildItem -LiteralPath $store -File -Force).Count
+            $taskInstalled=$fixture.Fake.World.TaskInstalled;$taskStarted=$fixture.Fake.World.TaskStarted
+            $packageHash=if($case.Kind-ceq'package'){('e'*64)}else{('d'*64)}
+            $failure=$null;try{Invoke-CcodInstall -SourceRoot $fixture.Source -InstallRoot $fixture.Install -SealedPackageSha256 $packageHash -Adapters $fixture.Fake.Adapters|Out-Null}catch{$failure=$_}
+            Assert-CcodEqual 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' (([string]$failure.FullyQualifiedErrorId-split',')[0]) "$($case.Name) fails through the retry compatibility boundary"
+            Assert-CcodEqual $runtimeCount @(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'runtime') -Directory -Force).Count "$($case.Name) creates no runtime"
+            Assert-CcodEqual $selectorCount @(Get-ChildItem -LiteralPath (Join-Path $fixture.Install 'state\active-generation') -File -Force).Count "$($case.Name) appends no selector"
+            Assert-CcodEqual $transactionCount @(Get-ChildItem -LiteralPath $store -File -Force).Count "$($case.Name) appends no transaction snapshot"
+            Assert-CcodEqual $taskInstalled $fixture.Fake.World.TaskInstalled "$($case.Name) performs no task install"
+            Assert-CcodEqual $taskStarted $fixture.Fake.World.TaskStarted "$($case.Name) performs no process start"
+        } finally {Remove-CcodLifecycleLegacyMigrationRetryFixture $fixture}
+    }
+}
+
 $results += Invoke-CcodTest 'Invoke-CcodInstall is idempotent only for the active Ready runtime and exact sealed package identity' {
     $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
     try{

From 4504c1afa665bccd3cc9f9e1ffd748c795bf936d Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 00:49:26 +0800
Subject: [PATCH 127/187] docs: record legacy migration retry evidence

---
 .../task-1-report.md                          | 78 ++++++++++++++++++-
 1 file changed, 77 insertions(+), 1 deletion(-)

diff --git a/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-1-report.md b/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-1-report.md
index cc9e123..5bf1b89 100644
--- a/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-1-report.md
+++ b/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-1-report.md
@@ -7,6 +7,8 @@ Task 1 已在隔离 worktree
 实现并通过要求的 focused tests。实现提交为
 `5114a09953e2566b1127788ffbad115c11ae072f`（`fix: bridge legacy lifecycle upgrade`），
 基线为 `2aef5ff2a74219a82e98fe26c2f8170a5232a280`。
+review fix round 1 实现提交为
+`52d3962b9bc91c91350317a148a145efdc9aa0c9`（`fix: resume failed legacy migration`）。
 
 本报告不声称 Task 2/Task 3、整分支验收或 release readiness 已完成。
 
@@ -40,7 +42,7 @@ Get-CcodLegacyUpgradeCompatibilityContext
   -GlobalTransaction
 ```
 
-它只返回两种 `Kind`：
+初始实现返回两种 `Kind`；fix round 1 增加第三种严格恢复分类：
 
 - `CurrentReady`：append-only selector 与 transaction plane 均存在；selected pointer、
   valid current manifest、manifest SHA-256 和 canonical terminal Ready transaction 的
@@ -50,6 +52,9 @@ Get-CcodLegacyUpgradeCompatibilityContext
   通过 contained path、non-reparse、no-ADS、single-link 和 hash/file-set 校验；current
   validator 的唯一失败是 `CCOD_RUNTIME_ID_MISMATCH`；随后使用历史算法复算并精确得到
   v2.5.21 两段式 runtime ID。只有此分支跳过不存在的旧 Ready cleanup resolver。
+- `LegacyMigrationRetry`：只接受一个已到 `RuntimePromoted` 的严格 v2.5.22 Failed
+  transaction、仍完整有效的 failed runtime/manifest/package、无 cleanup fence，以及下列一个
+  canonical selector profile。此分支复用 retained failed runtime，不创建另一个 runtime tree。
 
 在真实 legacy upgrade 中，同一个 opaque file transaction 先打开 manifest-bound retained
 legacy generation，并发布 generation-one selector genesis；普通新 runtime pointer 随后以
@@ -139,3 +144,74 @@ generation/history ambiguity、current-format lookalike、wrong manifest version
 - Task 2 的 exact historical product-registration profile 迁移尚未实现；Task 1 测试只用适配器
   证明 lifecycle/Ready/rollback 边界。
 - 尚待独立 reviewer 对本提交做 Task 1 scoped review；本报告不替代该门禁。
+
+## Fix round 1：Failed legacy migration 可精确重试
+
+### Review finding 与裁定
+
+第一次 true-legacy migration 在 Ready 前失败后，原分类器只接受 `CurrentReady` 或三个新 plane
+全缺失的 `ProvenLegacyWithoutReady`。因此第二次完全相同的升级会在 staging 前返回
+`CCOD_INSTALL_UPGRADE_SOURCE_INVALID`，即使失败 runtime 已经完整 sealed 且旧 runtime 已恢复。
+
+本轮接受两个、且仅两个 selector profile：
+
+- pre-pointer：latest selector 是 generation 1 legacy；重试复用原 Failed transaction 的
+  `newRuntimeId`，提交 selector/Ready generation 2；
+- post-pointer compensated：完整 selector chain 必须是
+  `1 legacy -> 2 failed-new -> 3 legacy`；重试追加 generation 4 指向同一 failed-new runtime，
+  Ready transaction 使用 generation 4。旧 selector records 不删除、不改写。
+
+### RED
+
+在现有 pre-pointer 与 post-pointer failure tests 中移除 transient failure 后立即执行第二次真实
+`Invoke-CcodInstall`。两者最初均 exit 1：
+
+```text
+CCOD_SELFTEST_FAILED case=real-v2.5.21-upgrade-failure-before-new-pointer-commit-keeps-the-legacy-selector-active-and-restarts-it error=CCOD_INSTALL_UPGRADE_SOURCE_INVALID
+CCOD_SELFTEST_FAILED case=real-v2.5.21-upgrade-failure-before-new-Ready-restarts-the-retained-legacy-runtime error=CCOD_INSTALL_UPGRADE_SOURCE_INVALID
+```
+
+自审另加入 premature-Failed RED：把 transaction chain 缩短为
+`Prepared -> PackageVerified -> Failed`，但保留 selector/runtime。旧实现错误接受并成功重试：
+
+```text
+ASSERT_EQUAL: Failed chain without RuntimePromoted evidence fails through the retry compatibility boundary expected=[CCOD_INSTALL_UPGRADE_SOURCE_INVALID] actual=[]
+```
+
+根因是原 retry 分类只绑定 Failed head、selector 和 manifest，没有证明第一次尝试已经完成
+runtime promotion 与 immutable initialization。修复要求 chain 包含 `RuntimePromoted`，并交叉要求
+pre-pointer profile 不得包含 `PointerCommitted`、post-pointer compensated profile 必须包含
+`PointerCommitted`。
+
+### 实现边界
+
+- `LegacyMigrationRetry` 重新验证 raw legacy `active.json`、v2.5.21 historical manifest/hash、
+  transaction store 中唯一 transaction ID、Failed immutable identity、current v2.5.22 failed
+  runtime manifest/hash、exact source file records、sealed package SHA-256 和 selector chain。
+- IFT ABI 从 V4 升为 V5，增加私有 migration-retry transaction capability。它只能在 `state`
+  子树写 create-only records、打开一个 manifest-bound retained generation、并通过该 retained
+  capability append pointer；不能创建 generation、copy payload、写 manifest、retire generation
+  或进入 product special-folder surface。公共 export surface 未扩大。
+- Failed 是 terminal，因此 retry 使用新的 transaction ID，但复用原 sealed runtime。新 Ready
+  transaction 的 generation 与新 append pointer 精确一致。
+- 负例覆盖：legacy manifest identity drift、Failed `newGeneration` drift、foreign terminal chain、
+  缺少 `RuntimePromoted`、cleanup fence plane、unexpected selector generation、failed runtime
+  manifest bytes drift、different sealed package identity。全部在 runtime/pointer/transaction/task
+  新 mutation 前失败。
+
+### 最终 GREEN（fix round 1）
+
+- `InstallLifecycle.SelfTest.ps1`：148/148，exit 0。
+- `InstalledLifecycleHarness.SelfTest.ps1`：21/21，exit 0。
+- `RuntimeManifest.SelfTest.ps1`：21/21，exit 0。
+- `InstallFileTransaction.SelfTest.ps1`：36/36，exit 0。
+- 四个修改 PowerShell 文件 parser：0 errors。
+- `git diff --check`：exit 0。
+
+一次候选 final run 曾返回 `CCOD_INSTALL_TRANSACTION_INVALID`：私有 opener 用强制 re-import
+创建了另一个 IFT module instance，而后续 exported commands 仍绑定旧 instance 的 capability
+table。最终实现从同一个 canonical module instance 调用私有 opener；修复后的 Lifecycle
+148/148 与 IFT 36/36 均重新运行通过。
+
+本轮仍只使用 GUID 临时目录、fake/adapters 和子进程测试；没有执行真实 installer、registry、
+shortcut、scheduled task、产品进程、网络、安装、重启、push、tag 或 release 操作。

From 6be1025c0d082268adfadd5f36fd61f44fc767b7 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 01:45:35 +0800
Subject: [PATCH 128/187] fix: migrate exact legacy registration profiles

---
 .../modules/ProductRegistration.psm1          | 260 +++++++++++++++---
 .../persistence/InstallLifecycle.SelfTest.ps1 |  69 ++++-
 .../ProductRegistration.SelfTest.ps1          | 241 +++++++++++++---
 3 files changed, 499 insertions(+), 71 deletions(-)

diff --git a/src/persistence/modules/ProductRegistration.psm1 b/src/persistence/modules/ProductRegistration.psm1
index 09a36a9..fd24595 100644
--- a/src/persistence/modules/ProductRegistration.psm1
+++ b/src/persistence/modules/ProductRegistration.psm1
@@ -9,16 +9,10 @@ $script:CcodProductFields = @(
 )
 $script:CcodShortcutFields = @('kind','leaf','relativePath','candidatePath','bootstrapPath','installRoot')
 $script:CcodReadyFields = @('phase','runtimeId','version','packageSha256','runtimeGeneration','manifestSha256','startMenuSha256','desktopSha256','targetPath','arguments','transactionRecord','bootstrapPath','uninstallerPath')
-$script:CcodLegacyShortcutNames = @(
-    'Programs\Codex Control other devices\Codex Control other devices for Windows.lnk',
-    'Programs\Codex Control other devices\Open the tray supervisor.lnk',
-    'Programs\Codex Control other devices\Compatibility check.lnk',
-    'Programs\Codex Control other devices\Uninstall Codex Control other devices.lnk',
-    'Programs\Codex Control other devices\CodexRemote-fix.lnk',
-    'Programs\Codex Control other devices\CodexRemote-fix compatibility check.lnk',
-    'Programs\Codex Control other devices\Uninstall CodexRemote-fix.lnk',
-    ('Desktop\Codex ' + [char]0x8BBE + [char]0x5907 + [char]0x8FDE + [char]0x63A5 + ' (Device Connection).lnk')
-)
+$script:CcodLegacyRegistrationFields = @('appId','displayVersion','installLocation','uninstallString','shortcutNames','unsafeShortcutNames')
+$script:CcodLegacyProfileFields = @('profileId','appId','minimumVersion','maximumVersion','uninstallCommandShape','shortcutNames')
+$script:CcodVerifiedRegistrationFields = @('verified','runtimeId','version','packageSha256','shortcutNames','startMenuSha256','desktopSha256')
+$script:CcodCurrentShortcutNames = @('Programs\CodexRemote-fix\CodexRemote-fix.lnk','Desktop\CodexRemote-fix.lnk')
 $script:CcodLegacyRegistryValueNames=@('DisplayName','DisplayVersion','UninstallString','QuietUninstallString','DisplayIcon','InstallLocation','Publisher','URLInfoAbout','HelpLink','URLUpdateInfo','NoModify','NoRepair','InstallDate','MajorVersion','MinorVersion','VersionMajor','VersionMinor','EstimatedSize','Language','Inno Setup: App Path','Inno Setup: Icon Group','Inno Setup: Setup Version','Inno Setup: User')
 
 function Throw-CcodProductRegistrationError {
@@ -38,6 +32,90 @@ function Test-CcodProductExactProperties {
     return $true
 }
 
+function Test-CcodProductExactStringSet {
+    param($Values,$ExpectedValues)
+    $actual=@($Values);$expected=@($ExpectedValues)
+    if($actual.Count-ne$expected.Count){return $false}
+    $set=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    foreach($value in $actual){if($value-isnot[string]-or[string]::IsNullOrWhiteSpace([string]$value)-or-not$set.Add([string]$value)){return $false}}
+    foreach($value in $expected){if($value-isnot[string]-or-not$set.Contains([string]$value)){return $false}}
+    return $true
+}
+
+function Get-CcodLegacyRegistrationProfiles {
+    [CmdletBinding()]
+    param()
+    $oldStartMenu=@(
+        'Programs\Codex Control other devices\Codex Control other devices for Windows.lnk',
+        'Programs\Codex Control other devices\Open the tray supervisor.lnk',
+        'Programs\Codex Control other devices\Compatibility check.lnk',
+        'Programs\Codex Control other devices\Uninstall Codex Control other devices.lnk'
+    )
+    $oldDesktop='Desktop\Codex '+[char]0x8BBE+[char]0x5907+[char]0x8FDE+[char]0x63A5+' (Device Connection).lnk'
+    $rebranded=@(
+        'Programs\CodexRemote-fix\CodexRemote-fix.lnk',
+        'Programs\CodexRemote-fix\CodexRemote-fix compatibility check.lnk',
+        'Programs\CodexRemote-fix\Uninstall CodexRemote-fix.lnk',
+        'Desktop\CodexRemote-fix.lnk'
+    )
+    return @(
+        [pscustomobject][ordered]@{profileId='CodexControlOtherDevicesInitial';appId=$script:CcodProductAppId;minimumVersion='2.1.0';maximumVersion='2.1.0';uninstallCommandShape='"{installLocation}\unins000.exe"';shortcutNames=@($oldStartMenu)},
+        [pscustomobject][ordered]@{profileId='CodexControlOtherDevicesDesktop';appId=$script:CcodProductAppId;minimumVersion='2.1.1';maximumVersion='2.1.6';uninstallCommandShape='"{installLocation}\unins000.exe"';shortcutNames=@($oldStartMenu)+@($oldDesktop)},
+        [pscustomobject][ordered]@{profileId='CodexRemoteFix';appId=$script:CcodProductAppId;minimumVersion='2.2.0';maximumVersion='2.5.21';uninstallCommandShape='"{installLocation}\unins000.exe"';shortcutNames=@($rebranded)}
+    )
+}
+
+function Resolve-CcodLegacyRegistrationProfile {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)]$LegacyRegistration)
+    if(-not(Test-CcodProductExactProperties $LegacyRegistration $script:CcodLegacyRegistrationFields)-or
+       $LegacyRegistration.appId-isnot[string]-or[string]$LegacyRegistration.appId-cne$script:CcodProductAppId-or
+       $LegacyRegistration.displayVersion-isnot[string]-or[string]$LegacyRegistration.displayVersion-cnotmatch'^(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)$'-or
+       $LegacyRegistration.installLocation-isnot[string]-or-not[IO.Path]::IsPathRooted([string]$LegacyRegistration.installLocation)-or
+       $LegacyRegistration.uninstallString-isnot[string]-or$null-eq$LegacyRegistration.shortcutNames-or$null-eq$LegacyRegistration.unsafeShortcutNames-or
+       @($LegacyRegistration.unsafeShortcutNames).Count-ne0){
+        Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product registration evidence is incomplete or unsafe.' $LegacyRegistration
+    }
+    try{$installLocation=[IO.Path]::GetFullPath([string]$LegacyRegistration.installLocation).TrimEnd('\');$version=[version]::Parse([string]$LegacyRegistration.displayVersion)}catch{
+        Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product registration paths or version are invalid.' $LegacyRegistration
+    }
+    if([string]::IsNullOrWhiteSpace($installLocation)-or[string]$LegacyRegistration.installLocation.TrimEnd('\')-cne$installLocation){
+        Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy installer location is not canonical.' $LegacyRegistration.installLocation
+    }
+    $matches=[Collections.Generic.List[object]]::new()
+    foreach($profile in @(Get-CcodLegacyRegistrationProfiles)){
+        if(-not(Test-CcodProductExactProperties $profile $script:CcodLegacyProfileFields)){continue}
+        $minimum=[version]::Parse([string]$profile.minimumVersion);$maximum=[version]::Parse([string]$profile.maximumVersion)
+        $expectedUninstall=[string]$profile.uninstallCommandShape.Replace('{installLocation}',$installLocation)
+        if([string]$profile.appId-ceq[string]$LegacyRegistration.appId-and$version-ge$minimum-and$version-le$maximum-and
+           [string]$LegacyRegistration.uninstallString-ceq$expectedUninstall-and
+           (Test-CcodProductExactStringSet $LegacyRegistration.shortcutNames $profile.shortcutNames)){$matches.Add($profile)}
+    }
+    if($matches.Count-ne1){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product entry does not match one complete historical installer profile.' $LegacyRegistration}
+    return $matches[0]
+}
+
+function Test-CcodCurrentVerifiedRegistration {
+    param($Proof)
+    return (Test-CcodProductExactProperties $Proof $script:CcodVerifiedRegistrationFields) -and
+        $Proof.verified-is[bool] -and [bool]$Proof.verified -and
+        $Proof.runtimeId-is[string] -and [string]$Proof.runtimeId-cmatch'^2\.5\.22-[0-9a-f]{16}-[0-9a-f]{32}$' -and
+        $Proof.version-is[string] -and [string]$Proof.version-ceq$script:CcodProductVersion -and
+        $Proof.packageSha256-is[string] -and [string]$Proof.packageSha256-cmatch'^[0-9a-f]{64}$' -and
+        $Proof.startMenuSha256-is[string] -and [string]$Proof.startMenuSha256-cmatch'^[0-9a-f]{64}$' -and
+        $Proof.desktopSha256-is[string] -and [string]$Proof.desktopSha256-cmatch'^[0-9a-f]{64}$' -and
+        (Test-CcodProductExactStringSet $Proof.shortcutNames $script:CcodCurrentShortcutNames)
+}
+
+function Test-CcodCurrentVerifiedRegistrationUnchanged {
+    param($Before,$After)
+    return (Test-CcodCurrentVerifiedRegistration $Before) -and (Test-CcodCurrentVerifiedRegistration $After) -and
+        [string]$Before.runtimeId-ceq[string]$After.runtimeId -and [string]$Before.version-ceq[string]$After.version -and
+        [string]$Before.packageSha256-ceq[string]$After.packageSha256 -and
+        [string]$Before.startMenuSha256-ceq[string]$After.startMenuSha256 -and [string]$Before.desktopSha256-ceq[string]$After.desktopSha256 -and
+        (Test-CcodProductExactStringSet $Before.shortcutNames $After.shortcutNames)
+}
+
 function Get-CcodProductFullPath {
     param([Parameter(Mandatory)][string]$Path)
     if ([string]::IsNullOrWhiteSpace($Path) -or -not [IO.Path]::IsPathRooted($Path)) {
@@ -143,7 +221,7 @@ function Get-CcodProductRegistrationAdapters {
         RemoveLegacyRegistration = { param($ExpectedAppId,$ExpectedShortcutNames) Remove-CcodCurrentUserLegacyRegistration -ExpectedAppId $ExpectedAppId -ExpectedShortcutNames $ExpectedShortcutNames }
         ReadCurrentProductState = { param($ExpectedRuntimeId) Read-CcodCurrentProductState -ExpectedRuntimeId $ExpectedRuntimeId }
         RemoveCurrentProductEntry = { param($Entry) Remove-CcodCurrentProductEntry -Entry $Entry }
-        ReadLegacySnapshot = { param($ExpectedAppId) Read-CcodLegacySnapshot -ExpectedAppId $ExpectedAppId }
+        ReadLegacySnapshot = { param($ExpectedAppId,$ExpectedProfile) Read-CcodLegacySnapshot -ExpectedAppId $ExpectedAppId -ExpectedProfile $ExpectedProfile }
         RemoveLegacyEntry = { param($Entry) Remove-CcodLegacySnapshotEntry -Entry $Entry }
         ReadLegacyEntry = { param($Entry) Read-CcodLegacySnapshotEntry -Entry $Entry }
         RestoreLegacyEntry = { param($Entry) Restore-CcodLegacySnapshotEntry -Entry $Entry }
@@ -219,20 +297,67 @@ function Read-CcodCurrentUserProductShortcut {
     $item=Get-Item -LiteralPath $destination -Force -ErrorAction Stop;if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0-or(Get-CcodProductFileSha256 $destination)-cne(Get-CcodProductFileSha256 $source)){return $null}
     $Shortcut
 }
+function Get-CcodLegacyShortcutPath {
+    param([Parameter(Mandatory)][string]$RelativeName)
+    if($RelativeName.StartsWith('Programs\',[StringComparison]::Ordinal)){$base=[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs);$relative=$RelativeName.Substring(9)}
+    elseif($RelativeName.StartsWith('Desktop\',[StringComparison]::Ordinal)){$base=[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop);$relative=$RelativeName.Substring(8)}
+    else{Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy shortcut name is outside the supported special folders.' $RelativeName}
+    if([string]::IsNullOrWhiteSpace($base)-or-not[IO.Path]::IsPathRooted($base)-or[string]::IsNullOrWhiteSpace($relative)){
+        Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy shortcut special-folder path is invalid.' $RelativeName
+    }
+    return [IO.Path]::GetFullPath((Join-Path $base $relative))
+}
+
 function Read-CcodCurrentUserLegacyRegistration {
     param([string]$ExpectedAppId)
     $path=Get-CcodLegacyRegistryPath $ExpectedAppId;if(-not(Test-Path -LiteralPath $path -PathType Container)){return $null}
-    $value=Get-ItemProperty -LiteralPath $path -ErrorAction Stop;$present=[Collections.Generic.List[string]]::new()
+    $value=Get-ItemProperty -LiteralPath $path -ErrorAction Stop
     $programs=[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs);$desktop=[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop)
-    foreach($name in $script:CcodLegacyShortcutNames){$relative=$name.Substring($name.IndexOf('\')+1);$candidate=if($name.StartsWith('Programs\',[StringComparison]::Ordinal)){Join-Path $programs $relative}else{Join-Path $desktop $relative};if(Test-Path -LiteralPath $candidate -PathType Leaf){$present.Add($name)}}
-    [pscustomobject]@{appId=$ExpectedAppId;uninstallString=[string]$value.UninstallString;shortcutNames=@($present)}
+    if([string]::IsNullOrWhiteSpace($programs)-or-not[IO.Path]::IsPathRooted($programs)-or[string]::IsNullOrWhiteSpace($desktop)-or-not[IO.Path]::IsPathRooted($desktop)){
+        Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy shortcut special folders are unavailable.' $ExpectedAppId
+    }
+    $groups=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal);$desktopNames=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    foreach($profile in @(Get-CcodLegacyRegistrationProfiles)){
+        foreach($name in @($profile.shortcutNames)){
+            if($name.StartsWith('Programs\',[StringComparison]::Ordinal)){$tail=$name.Substring(9);$separator=$tail.IndexOf('\');if($separator-lt1){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Historical Start-menu profile is invalid.' $name};[void]$groups.Add($tail.Substring(0,$separator))}
+            elseif($name.StartsWith('Desktop\',[StringComparison]::Ordinal)){[void]$desktopNames.Add($name.Substring(8))}
+            else{Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Historical shortcut profile is invalid.' $name}
+        }
+    }
+    $present=[Collections.Generic.List[string]]::new();$unsafe=[Collections.Generic.List[string]]::new()
+    foreach($group in @($groups|Sort-Object)){
+        $groupPath=Join-Path $programs $group;$groupItem=Get-Item -LiteralPath $groupPath -Force -ErrorAction SilentlyContinue
+        if($null-eq$groupItem){continue}
+        $groupName='Programs\'+[string]$groupItem.Name
+        if(-not$groupItem.PSIsContainer-or($groupItem.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){$present.Add($groupName);$unsafe.Add($groupName);continue}
+        foreach($item in @(Get-ChildItem -LiteralPath $groupItem.FullName -Force -ErrorAction Stop)){
+            $name=$groupName+'\'+[string]$item.Name;$present.Add($name)
+            if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){$unsafe.Add($name)}
+        }
+    }
+    foreach($desktopName in @($desktopNames|Sort-Object)){
+        $item=Get-Item -LiteralPath (Join-Path $desktop $desktopName) -Force -ErrorAction SilentlyContinue
+        if($null-eq$item){continue};$name='Desktop\'+[string]$item.Name;$present.Add($name)
+        if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){$unsafe.Add($name)}
+    }
+    return [pscustomobject][ordered]@{
+        appId=$ExpectedAppId;displayVersion=[string]$value.DisplayVersion;installLocation=[string]$value.InstallLocation
+        uninstallString=[string]$value.UninstallString;shortcutNames=@($present);unsafeShortcutNames=@($unsafe)
+    }
 }
 function Read-CcodCurrentUserVerifiedRegistration {
-    $path=Get-CcodProductRegistryPath;if(-not(Test-Path -LiteralPath $path -PathType Container)){return $null}
-    $value=Get-ItemProperty -LiteralPath $path -ErrorAction Stop
-    if($value.CcodRuntimeId-isnot[string]-or$value.CcodRuntimeId-cnotmatch'^2\.5\.22-[0-9a-f]{16}-[0-9a-f]{32}$'-or$value.DisplayVersion-cne'2.5.22'-or$value.CcodPackageSha256-isnot[string]-or$value.CcodPackageSha256-cnotmatch'^[0-9a-f]{64}$'){return $null}
-    foreach($kind in @('StartMenu','Desktop')){if(-not[IO.File]::Exists((Get-CcodProductShortcutDestination $kind))){return $null}}
-    [pscustomobject]@{verified=$true;runtimeId=[string]$value.CcodRuntimeId;version=[string]$value.DisplayVersion;packageSha256=[string]$value.CcodPackageSha256}
+    try{
+        $path=Get-CcodProductRegistryPath;if(-not(Test-Path -LiteralPath $path -PathType Container)){return $null}
+        $value=Get-ItemProperty -LiteralPath $path -ErrorAction Stop;$runtimeId=[string]$value.CcodRuntimeId
+        $state=Read-CcodCurrentProductState -ExpectedRuntimeId $runtimeId
+        if($null-eq$state-or$state.valid-isnot[bool]-or-not$state.valid-or@($state.entries).Count-ne3-or$null-eq$state.readyEvidence){return $null}
+        $proof=[pscustomobject][ordered]@{
+            verified=$true;runtimeId=[string]$state.readyEvidence.runtimeId;version=$script:CcodProductVersion;packageSha256=[string]$state.readyEvidence.packageSha256
+            shortcutNames=@($script:CcodCurrentShortcutNames);startMenuSha256=[string]$state.readyEvidence.startMenuSha256;desktopSha256=[string]$state.readyEvidence.desktopSha256
+        }
+        if(Test-CcodCurrentVerifiedRegistration $proof){return $proof}
+        return $null
+    }catch{return $null}
 }
 function Remove-CcodCurrentUserLegacyRegistration {
     param([string]$ExpectedAppId,[string[]]$ExpectedShortcutNames)
@@ -267,9 +392,58 @@ function Remove-CcodProductRegistration {
     [CmdletBinding()]param([Parameter(Mandatory)]$ReadyEvidence,[hashtable]$Adapters)
     $fields=@('phase','installRoot','runtimeId','runtimeGeneration','packageSha256','manifestSha256','startMenuSha256','desktopSha256','targetPath','arguments');$canonicalTarget=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'schtasks.exe'));if(-not(Test-CcodProductExactProperties $ReadyEvidence $fields)-or$ReadyEvidence.phase-cne'Ready'-or$ReadyEvidence.installRoot-isnot[string]-or-not[IO.Path]::IsPathRooted($ReadyEvidence.installRoot)-or$ReadyEvidence.runtimeId-cnotmatch'^2\.5\.22-[0-9a-f]{16}-[0-9a-f]{32}$'-or[uint64]$ReadyEvidence.runtimeGeneration-lt1-or$ReadyEvidence.packageSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.manifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.startMenuSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.desktopSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.targetPath-isnot[string]-or[IO.Path]::GetFullPath([string]$ReadyEvidence.targetPath)-cne$canonicalTarget-or$ReadyEvidence.arguments-cne'/Run /TN "Codex Control Other Devices Supervisor"'){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Exact Ready cleanup evidence is invalid' $ReadyEvidence};$adapter=Get-CcodProductRegistrationAdapters $Adapters;$state=&$adapter.ReadCurrentProductState $ReadyEvidence.runtimeId;if($null-eq$state-or$state.valid-isnot[bool]-or-not$state.valid-or$null-eq$state.readyEvidence-or($state.readyEvidence|ConvertTo-Json -Compress)-cne($ReadyEvidence|ConvertTo-Json -Compress)-or$null-eq$state.entries){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Current product state is not bound to exact Ready evidence' $ReadyEvidence.runtimeId};$entries=@($state.entries);if($entries.Count-notin@(0,3)){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Current product state is ambiguous' $ReadyEvidence.runtimeId};foreach($entry in $entries){&$adapter.RemoveCurrentProductEntry $entry}
 }
+function Get-CcodLegacySnapshotEntryName {
+    param($Entry,[Parameter(Mandatory)][string]$ExpectedAppId)
+    if($Entry-is[string]){return [string]$Entry}
+    if($null-eq$Entry-or$null-eq$Entry.PSObject.Properties['kind']){return $null}
+    if($Entry.kind-ceq'Registry'){
+        if($Entry.path-isnot[string]-or[string]$Entry.path-cne(Get-CcodLegacyRegistryPath $ExpectedAppId)){return $null}
+        return 'Registry'
+    }
+    if($Entry.kind-ceq'Shortcut'-and$Entry.name-is[string]){
+        try{$expectedPath=Get-CcodLegacyShortcutPath -RelativeName ([string]$Entry.name);$actualPath=[IO.Path]::GetFullPath([string]$Entry.path)}catch{return $null}
+        if($actualPath-cne$expectedPath){return $null}
+        return [string]$Entry.name
+    }
+    return $null
+}
+
+function Test-CcodLegacySnapshotForProfile {
+    param($Snapshot,[Parameter(Mandatory)]$Profile,[Parameter(Mandatory)][string]$ExpectedAppId)
+    if($null-eq$Snapshot-or-not(Test-CcodProductExactProperties $Snapshot @('appId','entries'))-or
+       $Snapshot.appId-isnot[string]-or[string]$Snapshot.appId-cne$ExpectedAppId-or$null-eq$Snapshot.entries){return $false}
+    $actual=[Collections.Generic.List[string]]::new()
+    foreach($entry in @($Snapshot.entries)){$name=Get-CcodLegacySnapshotEntryName -Entry $entry -ExpectedAppId $ExpectedAppId;if($null-eq$name){return $false};$actual.Add($name)}
+    return Test-CcodProductExactStringSet $actual (@('Registry')+@($Profile.shortcutNames))
+}
+
+function Test-CcodLegacySnapshotCurrentReplacement {
+    param($Entry,[Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)]$CurrentProof)
+    if($Entry-is[string]-or$null-eq$Entry-or$Entry.kind-cne'Shortcut'-or$Entry.name-isnot[string]-or[string]$Entry.name-cne$Name-or
+       $Entry.path-isnot[string]-or$Entry.sha256-isnot[string]){return $false}
+    try{$expectedPath=Get-CcodLegacyShortcutPath -RelativeName $Name;$actualPath=[IO.Path]::GetFullPath([string]$Entry.path)}catch{return $false}
+    if($actualPath-cne$expectedPath){return $false}
+    $expectedSha256=if($Name-ceq$script:CcodCurrentShortcutNames[0]){[string]$CurrentProof.startMenuSha256}elseif($Name-ceq$script:CcodCurrentShortcutNames[1]){[string]$CurrentProof.desktopSha256}else{return $false}
+    return [string]$Entry.sha256-ceq$expectedSha256
+}
+
 function Read-CcodLegacySnapshot {
-    param([string]$ExpectedAppId)
-    $legacy=Read-CcodCurrentUserLegacyRegistration $ExpectedAppId;if($null-eq$legacy){return $null};$entries=[Collections.Generic.List[object]]::new();$keyPath=Get-CcodLegacyRegistryPath $ExpectedAppId;$key=Get-Item -LiteralPath $keyPath -ErrorAction Stop;$names=@($key.GetValueNames());if($key.GetSubKeyNames().Count-ne0-or@($names|Where-Object{$script:CcodLegacyRegistryValueNames-cnotcontains$_}).Count-ne0){throw 'legacy registry contains unknown state'};$values=[ordered]@{};foreach($name in $names){$values[$name]=[pscustomobject]@{value=$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);kind=[string]$key.GetValueKind($name)}};$entries.Add([pscustomobject]@{kind='Registry';path=$keyPath;values=$values});$programs=[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs);$desktop=[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop);foreach($name in $legacy.shortcutNames){$relative=$name.Substring($name.IndexOf('\')+1);$path=[IO.Path]::GetFullPath($(if($name.StartsWith('Programs\',[StringComparison]::Ordinal)){Join-Path $programs $relative}else{Join-Path $desktop $relative}));$item=Get-Item -LiteralPath $path -Force -ErrorAction Stop;if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){throw 'legacy shortcut unsafe'};$bytes=[IO.File]::ReadAllBytes($path);$entries.Add([pscustomobject]@{kind='Shortcut';name=$name;path=$path;sha256=Get-CcodProductFileSha256 $path;bytesBase64=[Convert]::ToBase64String($bytes)})};[pscustomobject]@{appId=$ExpectedAppId;entries=@($entries)}
+    param([string]$ExpectedAppId,[Parameter(Mandatory)]$ExpectedProfile)
+    $legacy=Read-CcodCurrentUserLegacyRegistration $ExpectedAppId;if($null-eq$legacy){return $null}
+    $observedProfile=Resolve-CcodLegacyRegistrationProfile -LegacyRegistration $legacy
+    if($observedProfile.profileId-cne$ExpectedProfile.profileId){throw 'legacy profile changed before snapshot'}
+    $entries=[Collections.Generic.List[object]]::new();$keyPath=Get-CcodLegacyRegistryPath $ExpectedAppId;$key=Get-Item -LiteralPath $keyPath -ErrorAction Stop
+    try{
+        $names=@($key.GetValueNames());if($key.GetSubKeyNames().Count-ne0-or@($names|Where-Object{$script:CcodLegacyRegistryValueNames-cnotcontains$_}).Count-ne0){throw 'legacy registry contains unknown state'}
+        $values=[ordered]@{};foreach($name in $names){$values[$name]=[pscustomobject]@{value=$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);kind=[string]$key.GetValueKind($name)}}
+    }finally{$key.Dispose()}
+    $entries.Add([pscustomobject]@{kind='Registry';path=$keyPath;values=$values})
+    foreach($name in @($ExpectedProfile.shortcutNames)){
+        $path=Get-CcodLegacyShortcutPath -RelativeName $name;$item=Get-Item -LiteralPath $path -Force -ErrorAction Stop
+        if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0-or[string]$item.Name-cne[IO.Path]::GetFileName($name)){throw 'legacy shortcut unsafe'}
+        $bytes=[IO.File]::ReadAllBytes($path);$entries.Add([pscustomobject]@{kind='Shortcut';name=$name;path=$path;sha256=Get-CcodProductFileSha256 $path;bytesBase64=[Convert]::ToBase64String($bytes)})
+    }
+    return [pscustomobject][ordered]@{appId=$ExpectedAppId;entries=@($entries)}
 }
 function Remove-CcodLegacySnapshotEntry {param($Entry);if($Entry-is[string]){return};if($Entry.kind-ceq'Registry'){$key=$null;try{$key=Get-Item -LiteralPath $Entry.path -ErrorAction Stop;if((@($key.GetValueNames()|Sort-Object)-join'|')-cne((@($Entry.values.Keys)|Sort-Object)-join'|')-or$key.GetSubKeyNames().Count-ne0){throw 'legacy registry changed'};foreach($name in @($Entry.values.Keys)){$current=$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);if([string]$current-cne[string]$Entry.values[$name].value-or[string]$key.GetValueKind($name)-cne[string]$Entry.values[$name].kind){throw 'legacy registry value changed'}};foreach($name in @($Entry.values.Keys)){$key.DeleteValue($name,$true)};$key.Dispose();$key=$null;Remove-Item -LiteralPath $Entry.path -Force -ErrorAction Stop;return}catch{if($null-ne$key){$key.Dispose()};if(-not(Test-Path -LiteralPath $Entry.path)){New-Item -Path $Entry.path -Force|Out-Null};foreach($name in $Entry.values.Keys){if($null-eq(Get-ItemProperty -LiteralPath $Entry.path -Name $name -ErrorAction SilentlyContinue)){$kind=[Enum]::Parse([Microsoft.Win32.RegistryValueKind],[string]$Entry.values[$name].kind);New-ItemProperty -LiteralPath $Entry.path -Name $name -Value $Entry.values[$name].value -PropertyType $kind -Force|Out-Null}};throw}};if(-not[IO.File]::Exists($Entry.path)-or(Get-CcodProductFileSha256 $Entry.path)-cne$Entry.sha256){throw 'legacy shortcut changed'};Remove-Item -LiteralPath $Entry.path -Force -ErrorAction Stop}
 function Compare-CcodLegacySnapshotEntry {
@@ -339,24 +513,40 @@ function Remove-CcodLegacyProductRegistration {
     }
     $adapter = Get-CcodProductRegistrationAdapters $Adapters
     $verified=&$adapter.ReadVerifiedRegistration
-    if($null-eq$verified-or$verified.verified-isnot[bool]-or-not$verified.verified){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration requires a current three-record read-back proof.' $ExpectedAppId}
+    if(-not(Test-CcodCurrentVerifiedRegistration $verified)){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration requires an exact current three-record read-back proof.' $ExpectedAppId}
     $legacy = & $adapter.ReadLegacyRegistration $ExpectedAppId
     if($null-eq$legacy){return}
-    if ($legacy.appId -isnot [string] -or [string]$legacy.appId -cne $ExpectedAppId -or
-        $legacy.uninstallString -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$legacy.uninstallString) -or
-        $null -eq $legacy.shortcutNames -or (@($legacy.shortcutNames) -join '|') -cne ($script:CcodLegacyShortcutNames -join '|')) {
-        Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product entry or shortcut names do not match the exact migration allowlist.' $ExpectedAppId
-    }
-    $snapshot=&$adapter.ReadLegacySnapshot $ExpectedAppId
-    if($null-eq$snapshot-or$snapshot.appId-cne$ExpectedAppId-or@($snapshot.entries).Count-ne9){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy snapshot is incomplete or ambiguous' $ExpectedAppId}
-    $removed=[Collections.Generic.List[object]]::new()
-    try{foreach($entry in @($snapshot.entries)){&$adapter.RemoveLegacyEntry $entry;$removed.Add($entry)}}catch{
-        $unresolved=[Collections.Generic.List[string]]::new();$failedEntry=$entry;$failedName=if($failedEntry-is[string]){[string]$failedEntry}elseif($failedEntry.kind-ceq'Registry'){'Registry'}else{[string]$failedEntry.name}
-        try{$state=&$adapter.ReadLegacyEntry $failedEntry;if($null-eq$state){&$adapter.RestoreLegacyEntry $failedEntry;$state=&$adapter.ReadLegacyEntry $failedEntry};if($state-cne'Exact'){$unresolved.Add($failedName)}}catch{$unresolved.Add($failedName)}
-        for($index=$removed.Count-1;$index-ge0;$index--){$entry=$removed[$index];$name=if($entry-is[string]){[string]$entry}elseif($entry.kind-ceq'Registry'){'Registry'}else{[string]$entry.name};try{$state=&$adapter.ReadLegacyEntry $entry;if($null-eq$state){&$adapter.RestoreLegacyEntry $entry;$state=&$adapter.ReadLegacyEntry $entry};if($state-cne'Exact'){$unresolved.Add($name)}}catch{$unresolved.Add($name)}}
+    $profile=Resolve-CcodLegacyRegistrationProfile -LegacyRegistration $legacy
+    $snapshot=&$adapter.ReadLegacySnapshot $ExpectedAppId $profile
+    if(-not(Test-CcodLegacySnapshotForProfile -Snapshot $snapshot -Profile $profile -ExpectedAppId $ExpectedAppId)){
+        Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy snapshot is incomplete or does not match the selected historical profile.' $ExpectedAppId
+    }
+    $removalEntries=[Collections.Generic.List[object]]::new()
+    foreach($entry in @($snapshot.entries)){
+        $name=Get-CcodLegacySnapshotEntryName -Entry $entry -ExpectedAppId $ExpectedAppId
+        if($script:CcodCurrentShortcutNames-ccontains$name){
+            if(-not(Test-CcodLegacySnapshotCurrentReplacement -Entry $entry -Name $name -CurrentProof $verified)){
+                Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'An overlapping legacy shortcut is not the exact verified current replacement.' $name
+            }
+            continue
+        }
+        $removalEntries.Add($entry)
+    }
+    $removed=[Collections.Generic.List[object]]::new();$failedEntry=$null
+    try{
+        foreach($entry in @($removalEntries)){$failedEntry=$entry;&$adapter.RemoveLegacyEntry $entry;$removed.Add($entry);$failedEntry=$null}
+        $verifiedAfter=&$adapter.ReadVerifiedRegistration
+        if(-not(Test-CcodCurrentVerifiedRegistrationUnchanged -Before $verified -After $verifiedAfter)){throw 'current product registration changed during legacy cleanup'}
+    }catch{
+        $unresolved=[Collections.Generic.List[string]]::new()
+        if($null-ne$failedEntry){
+            $failedName=Get-CcodLegacySnapshotEntryName -Entry $failedEntry -ExpectedAppId $ExpectedAppId
+            try{$state=&$adapter.ReadLegacyEntry $failedEntry;if($null-eq$state){&$adapter.RestoreLegacyEntry $failedEntry;$state=&$adapter.ReadLegacyEntry $failedEntry};if($state-cne'Exact'){$unresolved.Add($failedName)}}catch{$unresolved.Add($failedName)}
+        }
+        for($index=$removed.Count-1;$index-ge0;$index--){$entry=$removed[$index];$name=Get-CcodLegacySnapshotEntryName -Entry $entry -ExpectedAppId $ExpectedAppId;try{$state=&$adapter.ReadLegacyEntry $entry;if($null-eq$state){&$adapter.RestoreLegacyEntry $entry;$state=&$adapter.ReadLegacyEntry $entry};if($state-cne'Exact'){$unresolved.Add($name)}}catch{$unresolved.Add($name)}}
         if($unresolved.Count-gt0){$record=[pscustomobject][ordered]@{schemaVersion=1;appId=$ExpectedAppId;state='CompensationFailed';entries=@($unresolved);createdAtUtc=[DateTime]::UtcNow.ToString('o',[Globalization.CultureInfo]::InvariantCulture)};try{&$adapter.WriteLegacyCompensationFailure $record}catch{Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED' 'Legacy compensation failure record could not be persisted.' $record};Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED' 'Legacy migration compensation remains unresolved; exact entries were recorded.' $record}
         Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration failed and the exact prior set was restored.' $ExpectedAppId
     }
 }
 
-Export-ModuleMember -Function New-CcodProductRegistration,Test-CcodProductRegistration,Commit-CcodProductRegistration,Remove-CcodProductRegistration,Remove-CcodLegacyProductRegistration
+Export-ModuleMember -Function New-CcodProductRegistration,Test-CcodProductRegistration,Commit-CcodProductRegistration,Remove-CcodProductRegistration,Remove-CcodLegacyProductRegistration,Get-CcodLegacyRegistrationProfiles,Resolve-CcodLegacyRegistrationProfile
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index 2a2bdcd..18be604 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -12,6 +12,13 @@ Import-Module (Join-Path $repositoryRoot 'src\persistence\modules\UiPreferences.
 Import-Module (Join-Path $repositoryRoot 'src\persistence\modules\RuntimeManifest.psm1') -Force
 Import-Module (Join-Path $repositoryRoot 'src\persistence\modules\LifecycleEpoch.psm1') -Force
 
+$v2521LifecycleShortcutNames=@(
+    'Programs\CodexRemote-fix\CodexRemote-fix.lnk',
+    'Programs\CodexRemote-fix\CodexRemote-fix compatibility check.lnk',
+    'Programs\CodexRemote-fix\Uninstall CodexRemote-fix.lnk',
+    'Desktop\CodexRemote-fix.lnk'
+)
+
 function New-CcodLifecycleTempRoot {
     return (Join-Path ([IO.Path]::GetTempPath()) ("ccod-lifecycle-" + [guid]::NewGuid().ToString('N')))
 }
@@ -458,8 +465,29 @@ function New-CcodLifecycleProductSideEffectAdapters {
             $State.ProductOnlyObserved=$true;$State.Shortcuts[$Kind]=$Shortcut;$State.ShortcutWrites++
         }.GetNewClosure()
         ReadShortcut={param($Kind,$Shortcut)$State.Shortcuts[$Kind]}.GetNewClosure()
-        ReadVerifiedRegistration={ [pscustomobject]@{verified=$true} }
-        ReadLegacyRegistration={param($ExpectedAppId)$null}
+        ReadVerifiedRegistration={
+            [pscustomobject][ordered]@{
+                verified=($null-ne$State.Registration-and$State.Shortcuts.Count-eq2);runtimeId=[string]$State.Registration.runtimeId;version=[string]$State.Registration.version;packageSha256=[string]$State.Registration.packageSha256
+                shortcutNames=@($v2521LifecycleShortcutNames[0],$v2521LifecycleShortcutNames[3]);startMenuSha256=[string]$State.ReadyEvidence.startMenuSha256;desktopSha256=[string]$State.ReadyEvidence.desktopSha256
+            }
+        }.GetNewClosure()
+        ReadLegacyRegistration={param($ExpectedAppId);if($State.ContainsKey('LegacyEntries')-and$State.LegacyEntries.Contains('Registry')){$State.LegacyRegistration}else{$null}}.GetNewClosure()
+        ReadLegacySnapshot={
+            param($ExpectedAppId,$ExpectedProfile)
+            $entries=[Collections.Generic.List[object]]::new()
+            foreach($entry in @($State.LegacyEntries)){
+                if(@($v2521LifecycleShortcutNames[0],$v2521LifecycleShortcutNames[3])-ccontains[string]$entry){
+                    $base=if(([string]$entry).StartsWith('Programs\',[StringComparison]::Ordinal)){[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs)}else{[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop)}
+                    $relative=([string]$entry).Substring(([string]$entry).IndexOf('\')+1);$sha=if([string]$entry-ceq$v2521LifecycleShortcutNames[0]){[string]$State.ReadyEvidence.startMenuSha256}else{[string]$State.ReadyEvidence.desktopSha256}
+                    $entries.Add([pscustomobject]@{kind='Shortcut';name=[string]$entry;path=[IO.Path]::GetFullPath((Join-Path $base $relative));sha256=$sha;bytesBase64=''})
+                }else{$entries.Add([string]$entry)}
+            }
+            [pscustomobject][ordered]@{appId=$State.LegacyRegistration.appId;entries=@($entries)}
+        }.GetNewClosure()
+        RemoveLegacyEntry={param($Entry);$State.LegacyRemovalAttempts++;[void]$State.LegacyEntries.Remove([string]$Entry)}.GetNewClosure()
+        ReadLegacyEntry={param($Entry);if($State.LegacyEntries.Contains([string]$Entry)){'Exact'}else{$null}}.GetNewClosure()
+        RestoreLegacyEntry={param($Entry);if(-not$State.LegacyEntries.Contains([string]$Entry)){$State.LegacyEntries.Add([string]$Entry)}}.GetNewClosure()
+        WriteLegacyCompensationFailure={param($Record);$State.LegacyCompensationFailures.Add($Record)}.GetNewClosure()
     }
 }
 
@@ -619,13 +647,18 @@ $payloadJson=[Text.UTF8Encoding]::new($false,$true).GetString([Convert]::FromBas
 $payload=$payloadJson|ConvertFrom-Json -ErrorAction Stop
 Import-Module $payload.lifecycleModule -Force -DisableNameChecking -ErrorAction Stop
 $kernelModule=Import-Module $payload.kernelModule -PassThru -DisableNameChecking -ErrorAction Stop
-$childState=@{Registration=$null;Shortcuts=@{}}
+$childState=@{Registration=$null;ReadyEvidence=$null;Shortcuts=@{}}
 $productAdapters=@{
-    WriteProductRegistration={param($Registration,$ReadyEvidence)$childState.Registration=$Registration;[IO.File]::WriteAllText((Join-Path $payload.markerRoot 'product-write.txt'),'registration')}.GetNewClosure()
+    WriteProductRegistration={param($Registration,$ReadyEvidence)$childState.Registration=$Registration;$childState.ReadyEvidence=$ReadyEvidence;[IO.File]::WriteAllText((Join-Path $payload.markerRoot 'product-write.txt'),'registration')}.GetNewClosure()
     ReadProductRegistration={param($Registration)$childState.Registration}.GetNewClosure()
     WriteShortcut={param($Kind,$Shortcut,$FileTransaction,$ReadyEvidence)$childState.Shortcuts[$Kind]=$Shortcut;[IO.File]::WriteAllText((Join-Path $payload.markerRoot 'shortcut-write.txt'),[string]$Kind)}.GetNewClosure()
     ReadShortcut={param($Kind,$Shortcut)$childState.Shortcuts[$Kind]}.GetNewClosure()
-    ReadVerifiedRegistration={[pscustomobject]@{verified=$true}}
+    ReadVerifiedRegistration={
+        [pscustomobject][ordered]@{
+            verified=($null-ne$childState.Registration-and$childState.Shortcuts.Count-eq2);runtimeId=[string]$childState.Registration.runtimeId;version=[string]$childState.Registration.version;packageSha256=[string]$childState.Registration.packageSha256
+            shortcutNames=@('Programs\CodexRemote-fix\CodexRemote-fix.lnk','Desktop\CodexRemote-fix.lnk');startMenuSha256=[string]$childState.ReadyEvidence.startMenuSha256;desktopSha256=[string]$childState.ReadyEvidence.desktopSha256
+        }
+    }.GetNewClosure()
     ReadLegacyRegistration={param($ExpectedAppId)$null}
 }
 $process=[Diagnostics.Process]::GetCurrentProcess();$windowsIdentity=[Security.Principal.WindowsIdentity]::GetCurrent()
@@ -954,6 +987,16 @@ $results += Invoke-CcodTest 'real v2.5.21 legacy lifecycle state upgrades throug
         New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22' | Out-Null
         $node=New-CcodLifecycleFakeNode -Root $nodeRoot
         $fake=New-CcodLifecycleFake -NodePath $node
+        $legacyEntries=[Collections.Generic.List[string]]::new();foreach($entry in @('Registry')+$v2521LifecycleShortcutNames){$legacyEntries.Add($entry)}
+        $productState=@{
+            FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{}
+            LegacyRegistration=[pscustomobject][ordered]@{
+                appId='{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}';displayVersion='2.5.21';installLocation='C:\legacy\CodexControlOtherDevices-installer'
+                uninstallString='"C:\legacy\CodexControlOtherDevices-installer\unins000.exe"';shortcutNames=@($v2521LifecycleShortcutNames);unsafeShortcutNames=@()
+            }
+            LegacyEntries=$legacyEntries;LegacyRemovalAttempts=0;LegacyCompensationFailures=[Collections.Generic.List[object]]::new()
+        }
+        Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $fake -ProductState $productState
         $beforeRuntimeCount=@(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory -Force).Count
 
         $upgrade=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('a'*64) -Adapters $fake.Adapters
@@ -982,6 +1025,22 @@ $results += Invoke-CcodTest 'real v2.5.21 legacy lifecycle state upgrades throug
         Assert-CcodEqual $upgrade.RuntimeId $currentCompatibility.ActiveRuntimeId 'current compatibility remains bound to the selected runtime'
         Assert-CcodEqual ([uint64]2) $currentCompatibility.ActiveGeneration 'current compatibility remains bound to the selected generation'
         Assert-CcodEqual $currentManifestHash $currentCompatibility.ManifestSha256 'current compatibility remains bound to the selected manifest'
+        Assert-CcodTrue $upgrade.ProductRegistrationVerified 'true legacy migration completes the real product-registration boundary'
+        Assert-CcodEqual 3 $productState.LegacyRemovalAttempts 'true v2.5.21 migration removes the registry compatibility link and uninstall link'
+        Assert-CcodEqual ((@($v2521LifecycleShortcutNames[0],$v2521LifecycleShortcutNames[3])|Sort-Object)-join'|') ((@($productState.LegacyEntries)|Sort-Object)-join'|') 'true v2.5.21 migration preserves both exact current shortcut replacements'
+        Assert-CcodEqual 0 $productState.LegacyCompensationFailures.Count 'successful true legacy cleanup needs no unresolved compensation record'
+
+        $runtimeCount=@(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory -Force).Count
+        $selectorCount=@(Get-ChildItem -LiteralPath (Join-Path $install 'state\active-generation') -File -Force).Count
+        $sameFake=New-CcodLifecycleFake -NodePath $node;Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $sameFake -ProductState $productState
+        $same=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('a'*64) -Adapters $sameFake.Adapters
+        Assert-CcodEqual 'AlreadyInstalled' $same.Outcome 'second same-package invocation is idempotent after true legacy registration cleanup'
+        Assert-CcodTrue $same.ProductRegistrationVerified 'idempotent invocation re-verifies the exact current registration'
+        Assert-CcodEqual $runtimeCount @(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory -Force).Count 'idempotent true-legacy retry creates no runtime'
+        Assert-CcodEqual $selectorCount @(Get-ChildItem -LiteralPath (Join-Path $install 'state\active-generation') -File -Force).Count 'idempotent true-legacy retry appends no selector'
+        Assert-CcodEqual 3 $productState.LegacyRemovalAttempts 'idempotent true-legacy retry performs no second legacy deletion'
+        Assert-CcodEqual 0 $sameFake.World.TaskInstalled 'idempotent true-legacy retry performs no scheduled-task install'
+        Assert-CcodEqual 0 $sameFake.World.TaskStarted 'idempotent true-legacy retry starts no process'
     } finally {
         foreach($path in @($legacySource,$source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}
     }
diff --git a/tests/persistence/ProductRegistration.SelfTest.ps1 b/tests/persistence/ProductRegistration.SelfTest.ps1
index 9460b85..f152abb 100644
--- a/tests/persistence/ProductRegistration.SelfTest.ps1
+++ b/tests/persistence/ProductRegistration.SelfTest.ps1
@@ -14,12 +14,48 @@ $appId = '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}'
 $canonicalTaskTarget=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'schtasks.exe'))
 $cleanupReady=[pscustomobject][ordered]@{phase='Ready';installRoot='C:\fixture\CodexControlOtherDevices';runtimeId=$runtimeId;runtimeGeneration=[uint64]7;packageSha256=$packageSha256;manifestSha256=('a'*64);startMenuSha256=('b'*64);desktopSha256=('c'*64);targetPath=$canonicalTaskTarget;arguments='/Run /TN "Codex Control Other Devices Supervisor"'}
 $fullReadyRecord=[pscustomobject][ordered]@{schemaVersion=1;transactionId='11111111-2222-3333-4444-555555555555';oldRuntimeId=$null;oldGeneration=$null;oldManifestSha256=$null;newRuntimeId=$runtimeId;newGeneration=[uint64]7;newManifestSha256=('a'*64);sealedPackageSha256=$packageSha256;ownedObjectNames=@($runtimeId);phase='Ready';errorCode=$null}
+$v210ShortcutNames = @(
+    'Programs\Codex Control other devices\Codex Control other devices for Windows.lnk',
+    'Programs\Codex Control other devices\Open the tray supervisor.lnk',
+    'Programs\Codex Control other devices\Compatibility check.lnk',
+    'Programs\Codex Control other devices\Uninstall Codex Control other devices.lnk'
+)
+$v211ShortcutNames = @($v210ShortcutNames) + @(
+    ('Desktop\Codex ' + [char]0x8BBE + [char]0x5907 + [char]0x8FDE + [char]0x63A5 + ' (Device Connection).lnk')
+)
+$v2521ShortcutNames = @(
+    'Programs\CodexRemote-fix\CodexRemote-fix.lnk',
+    'Programs\CodexRemote-fix\CodexRemote-fix compatibility check.lnk',
+    'Programs\CodexRemote-fix\Uninstall CodexRemote-fix.lnk',
+    'Desktop\CodexRemote-fix.lnk'
+)
+$currentShortcutNames=@($v2521ShortcutNames[0],$v2521ShortcutNames[3])
+$legacyInstallLocation = 'C:\legacy\CodexControlOtherDevices-installer'
+
+function New-CcodLegacyRegistrationFixture {
+    param(
+        [Parameter(Mandatory)][string]$Version,
+        [Parameter(Mandatory)][string[]]$ShortcutNames,
+        [string]$AppId = $appId,
+        [string]$InstallLocation = $legacyInstallLocation,
+        [string]$UninstallString = ('"{0}\unins000.exe"' -f $legacyInstallLocation),
+        [string[]]$UnsafeShortcutNames = @()
+    )
+    [pscustomobject][ordered]@{
+        appId = $AppId
+        displayVersion = $Version
+        installLocation = $InstallLocation
+        uninstallString = $UninstallString
+        shortcutNames = @($ShortcutNames)
+        unsafeShortcutNames = @($UnsafeShortcutNames)
+    }
+}
 
 function New-CcodRegistrationWorld {
     param([string]$InstallRoot = 'C:\fixture\CodexControlOtherDevices')
 
     $registration = New-CcodProductRegistration -InstallRoot $InstallRoot -RuntimeId $runtimeId -Version '2.5.22' -PackageSha256 $packageSha256 -FileTransaction ([pscustomobject]@{})
-    $legacyEntries=[Collections.Generic.List[string]]::new();foreach($entry in @('Registry','StartMenu1','StartMenu2','StartMenu3','StartMenu4','StartMenu5','StartMenu6','StartMenu7','Desktop')){$legacyEntries.Add($entry)}
+    $legacyEntries=[Collections.Generic.List[string]]::new();foreach($entry in @('Registry')+$v2521ShortcutNames){$legacyEntries.Add($entry)}
     $world = [pscustomobject]@{
         Registration = $registration
         Ready = [pscustomobject][ordered]@{
@@ -43,20 +79,7 @@ function New-CcodRegistrationWorld {
         WriteShortcutFailure = $null
         ReadProductFailure = $false
         ReadShortcutFailure = $null
-        Legacy = [pscustomobject]@{
-            appId = $appId
-            uninstallString = '"C:\legacy\unins000.exe"'
-            shortcutNames = @(
-                'Programs\Codex Control other devices\Codex Control other devices for Windows.lnk',
-                'Programs\Codex Control other devices\Open the tray supervisor.lnk',
-                'Programs\Codex Control other devices\Compatibility check.lnk',
-                'Programs\Codex Control other devices\Uninstall Codex Control other devices.lnk',
-                'Programs\Codex Control other devices\CodexRemote-fix.lnk',
-                'Programs\Codex Control other devices\CodexRemote-fix compatibility check.lnk',
-                'Programs\Codex Control other devices\Uninstall CodexRemote-fix.lnk',
-                ('Desktop\Codex ' + [char]0x8BBE + [char]0x5907 + [char]0x8FDE + [char]0x63A5 + ' (Device Connection).lnk')
-            )
-        }
+        Legacy = New-CcodLegacyRegistrationFixture -Version '2.5.21' -ShortcutNames $v2521ShortcutNames
         LegacyRemoved = $false
         LegacyRemovalCalls = 0
         CurrentProductRemovals = 0
@@ -68,6 +91,10 @@ function New-CcodRegistrationWorld {
         LegacyReplacementEntry = $null
         LegacyRestoreFailureEntry = $null
         LegacyUnresolvedRecords = [Collections.Generic.List[object]]::new()
+        LegacyRestoreOrder = [Collections.Generic.List[string]]::new()
+        VerifiedRegistrationReads = 0
+        VerifiedRegistrationMutationAt = 0
+        LegacySnapshotHashOverrides = @{}
         Calls = [Collections.Generic.List[string]]::new()
     }
     $world | Add-Member -NotePropertyName Adapters -NotePropertyValue @{
@@ -96,20 +123,54 @@ function New-CcodRegistrationWorld {
             if ($world.ReadShortcutFailure -ceq $Kind) { throw 'fixture shortcut read failed' }
             $world.Shortcuts[$Kind]
         }.GetNewClosure()
-        ReadLegacyRegistration = { param($ExpectedAppId) $world.Calls.Add('ReadLegacy'); $world.Legacy }.GetNewClosure()
-        ReadVerifiedRegistration = { [pscustomobject]@{verified=($null-ne$world.Product-and$world.Shortcuts.Count-eq2)} }.GetNewClosure()
+        ReadLegacyRegistration = { param($ExpectedAppId) $world.Calls.Add('ReadLegacy');if($world.LegacyEntries.Contains('Registry')){$world.Legacy}else{$null} }.GetNewClosure()
+        ReadVerifiedRegistration = {
+            $world.VerifiedRegistrationReads++
+            $startMenuSha256=if($world.VerifiedRegistrationMutationAt-eq$world.VerifiedRegistrationReads){'d'*64}else{'b'*64}
+            [pscustomobject][ordered]@{
+                verified=($null-ne$world.Product-and$world.Shortcuts.Count-eq2);runtimeId=$runtimeId;version='2.5.22';packageSha256=$packageSha256
+                shortcutNames=@($currentShortcutNames);startMenuSha256=$startMenuSha256;desktopSha256=('c'*64)
+            }
+        }.GetNewClosure()
         RemoveLegacyRegistration = { param($ExpectedAppId,$ExpectedShortcutNames) $world.Calls.Add('RemoveLegacy'); $world.LegacyRemovalCalls++; $world.LegacyRemoved = $true }.GetNewClosure()
         ReadCurrentProductState = { param($ExpectedRuntimeId) $world.CurrentProductState }.GetNewClosure()
         RemoveCurrentProductEntry = { param($Entry) $world.CurrentProductRemovals++ }.GetNewClosure()
-        ReadLegacySnapshot = { param($ExpectedAppId);if($world.Legacy.appId-cne$ExpectedAppId){return [pscustomobject]@{appId=$world.Legacy.appId;entries=@($world.LegacyEntries)}};if(@($world.Legacy.shortcutNames).Count-ne8){return [pscustomobject]@{appId=$ExpectedAppId;entries=@('Unexpected')}};[pscustomobject]@{appId=$ExpectedAppId;entries=@($world.LegacyEntries)} }.GetNewClosure()
+        ReadLegacySnapshot = {
+            param($ExpectedAppId,$ExpectedProfile)
+            $entries=[Collections.Generic.List[object]]::new()
+            foreach($entry in @($world.LegacyEntries)){
+                if($currentShortcutNames-ccontains[string]$entry){
+                    $base=if(([string]$entry).StartsWith('Programs\',[StringComparison]::Ordinal)){[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs)}else{[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop)}
+                    $relative=([string]$entry).Substring(([string]$entry).IndexOf('\')+1);$sha=if([string]$entry-ceq$currentShortcutNames[0]){'b'*64}else{'c'*64}
+                    if($world.LegacySnapshotHashOverrides.ContainsKey([string]$entry)){$sha=[string]$world.LegacySnapshotHashOverrides[[string]$entry]}
+                    $entries.Add([pscustomobject]@{kind='Shortcut';name=[string]$entry;path=[IO.Path]::GetFullPath((Join-Path $base $relative));sha256=$sha;bytesBase64=''})
+                }else{$entries.Add([string]$entry)}
+            }
+            [pscustomobject][ordered]@{appId=$world.Legacy.appId;entries=@($entries)}
+        }.GetNewClosure()
         RemoveLegacyEntry = { param($Entry);$world.LegacyRemoveAttempts++;if($world.LegacyRemoveFailureAt-eq$world.LegacyRemoveAttempts){throw 'fixture legacy delete failure'};[void]$world.LegacyEntries.Remove([string]$Entry) }.GetNewClosure()
         ReadLegacyEntry = { param($Entry);if($world.LegacyReplacementEntry-ceq[string]$Entry){return 'Mismatch'};if($world.LegacyEntries.Contains([string]$Entry)){'Exact'}else{$null} }.GetNewClosure()
-        RestoreLegacyEntry = { param($Entry);if($world.LegacyRestoreFailureEntry-ceq[string]$Entry){throw 'fixture restore failed'};if(-not$world.LegacyEntries.Contains([string]$Entry)){$world.LegacyEntries.Add([string]$Entry)};$world.LegacyRestores++ }.GetNewClosure()
+        RestoreLegacyEntry = { param($Entry);if($world.LegacyRestoreFailureEntry-ceq[string]$Entry){throw 'fixture restore failed'};if(-not$world.LegacyEntries.Contains([string]$Entry)){$world.LegacyEntries.Add([string]$Entry)};$world.LegacyRestoreOrder.Add([string]$Entry);$world.LegacyRestores++ }.GetNewClosure()
         WriteLegacyCompensationFailure = {param($Record)$world.LegacyUnresolvedRecords.Add($Record)}.GetNewClosure()
     }
     return $world
 }
 
+function Set-CcodRegistrationLegacyFixture {
+    param(
+        [Parameter(Mandatory)]$World,
+        [Parameter(Mandatory)][string]$Version,
+        [Parameter(Mandatory)][string[]]$ShortcutNames,
+        [string]$AppId = $appId,
+        [string]$InstallLocation = $legacyInstallLocation,
+        [string]$UninstallString = ('"{0}\unins000.exe"' -f $legacyInstallLocation),
+        [string[]]$UnsafeShortcutNames = @()
+    )
+    $World.Legacy = New-CcodLegacyRegistrationFixture -Version $Version -ShortcutNames $ShortcutNames -AppId $AppId -InstallLocation $InstallLocation -UninstallString $UninstallString -UnsafeShortcutNames $UnsafeShortcutNames
+    $World.LegacyEntries.Clear()
+    foreach ($entry in @('Registry') + $ShortcutNames) { $World.LegacyEntries.Add($entry) }
+}
+
 $results = @()
 
 # Production mutation caught: accepting a caller-crafted path/runtime tuple as a registration contract.
@@ -186,21 +247,138 @@ $results += Invoke-CcodTest 'valid Ready registration reads all three new record
     Assert-CcodTrue $receipt.verified 'registration returns a verified three-record receipt'
     Assert-CcodEqual 'Ready,WriteProduct,WriteShortcut:StartMenu,WriteShortcut:Desktop,ReadProduct,ReadShortcut:StartMenu,ReadShortcut:Desktop' ($world.Calls -join ',') 'all new writes and read-backs precede legacy migration'
     Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters
-    Assert-CcodEqual 9 $world.LegacyRemoveAttempts 'exact legacy migration removes each approved entry once'
-    Assert-CcodEqual 0 $world.LegacyEntries.Count 'exact legacy registration and shortcut set is removed'
+    Assert-CcodEqual 3 $world.LegacyRemoveAttempts 'exact migration removes only the three non-current legacy entries'
+    Assert-CcodEqual (($currentShortcutNames|Sort-Object)-join'|') ((@($world.LegacyEntries)|Sort-Object)-join'|') 'exact migration retains both verified current shortcut replacements'
+}
+
+# Production mutation caught: requiring the union of every historical shortcut name instead of
+# selecting the one complete installer profile that produced the legacy registration.
+$results += Invoke-CcodTest 'real v2.5.21 registration removes its exact four-shortcut profile' {
+    $world = New-CcodRegistrationWorld
+    $null = Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
+
+    Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters
+
+    Assert-CcodEqual 3 $world.LegacyRemoveAttempts 'v2.5.21 cleanup removes the registry compatibility link and uninstall link'
+    Assert-CcodEqual (($currentShortcutNames|Sort-Object)-join'|') ((@($world.LegacyEntries)|Sort-Object)-join'|') 'v2.5.21 cleanup retains the two verified current shortcut replacements'
+    Assert-CcodEqual 2 $world.VerifiedRegistrationReads 'v2.5.21 cleanup re-verifies the exact current three-record registration after deletion'
+}
+
+# Production mutation caught: widening, narrowing, or crossing a checked-in installer profile's
+# version/name boundary can select the wrong legacy objects for deletion.
+$results += Invoke-CcodTest 'historical installer profiles resolve at their exact version boundaries' {
+    $cases = @(
+        [pscustomobject]@{Version='2.1.0';Names=$v210ShortcutNames;ProfileId='CodexControlOtherDevicesInitial';Minimum='2.1.0';Maximum='2.1.0'},
+        [pscustomobject]@{Version='2.1.1';Names=$v211ShortcutNames;ProfileId='CodexControlOtherDevicesDesktop';Minimum='2.1.1';Maximum='2.1.6'},
+        [pscustomobject]@{Version='2.1.6';Names=$v211ShortcutNames;ProfileId='CodexControlOtherDevicesDesktop';Minimum='2.1.1';Maximum='2.1.6'},
+        [pscustomobject]@{Version='2.2.0';Names=$v2521ShortcutNames;ProfileId='CodexRemoteFix';Minimum='2.2.0';Maximum='2.5.21'},
+        [pscustomobject]@{Version='2.5.21';Names=@($v2521ShortcutNames[3..0]);ProfileId='CodexRemoteFix';Minimum='2.2.0';Maximum='2.5.21'}
+    )
+    foreach ($case in $cases) {
+        $legacy = New-CcodLegacyRegistrationFixture -Version $case.Version -ShortcutNames $case.Names
+        $profile = Resolve-CcodLegacyRegistrationProfile -LegacyRegistration $legacy
+        Assert-CcodEqual $case.ProfileId $profile.profileId "$($case.Version) selects the installer profile that emitted its exact shortcut set"
+        Assert-CcodEqual $appId $profile.appId "$($case.Version) remains bound to the canonical Inno AppId"
+        Assert-CcodEqual $case.Minimum $profile.minimumVersion "$($case.Version) reports the checked-in lower version boundary"
+        Assert-CcodEqual $case.Maximum $profile.maximumVersion "$($case.Version) reports the checked-in upper version boundary"
+        Assert-CcodEqual '"{installLocation}\unins000.exe"' $profile.uninstallCommandShape "$($case.Version) requires the quoted Inno uninstaller under InstallLocation"
+    }
+    Assert-CcodEqual 3 @(Get-CcodLegacyRegistrationProfiles).Count 'only the three checked-in historical layouts are supported'
+}
+
+# Production mutation caught: validating only a shortcut count, a case-insensitive set, or an
+# unbound registry command permits a foreign/replaced entry to be deleted as legacy state.
+$results += Invoke-CcodTest 'profile resolution rejects ambiguous registry and shortcut evidence before deletion' {
+    foreach ($kind in @('AppId','Missing','Extra','CrossProfile','Case','Reparse','VersionBinding','VersionGap','VersionTooNew','UninstallOutside','UninstallArguments','UninstallUnquoted','InstallLocationRelative')) {
+        $world = New-CcodRegistrationWorld
+        $legacy = New-CcodLegacyRegistrationFixture -Version '2.5.21' -ShortcutNames $v2521ShortcutNames
+        switch ($kind) {
+            'AppId' { $legacy.appId = '{AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE}' }
+            'Missing' { $legacy.shortcutNames = @($v2521ShortcutNames[0..2]) }
+            'Extra' { $legacy.shortcutNames = @($v2521ShortcutNames) + 'Programs\CodexRemote-fix\unexpected.lnk' }
+            'CrossProfile' { $legacy.shortcutNames = @($v2521ShortcutNames[0..2]) + $v211ShortcutNames[4] }
+            'Case' { $legacy.shortcutNames = @($v2521ShortcutNames[0..2]) + 'desktop\CodexRemote-fix.lnk' }
+            'Reparse' { $legacy.unsafeShortcutNames = @($v2521ShortcutNames[0]) }
+            'VersionBinding' { $legacy.displayVersion = '2.1.6' }
+            'VersionGap' { $legacy.displayVersion = '2.1.7' }
+            'VersionTooNew' { $legacy.displayVersion = '2.5.22' }
+            'UninstallOutside' { $legacy.uninstallString = '"C:\outside\unins000.exe"' }
+            'UninstallArguments' { $legacy.uninstallString += ' /SILENT' }
+            'UninstallUnquoted' { $legacy.uninstallString = 'C:\legacy\CodexControlOtherDevices-installer\unins000.exe' }
+            'InstallLocationRelative' { $legacy.installLocation = 'relative\installer' }
+        }
+        $world.Legacy = $legacy
+        $null = Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
+        Assert-CcodThrows { Resolve-CcodLegacyRegistrationProfile -LegacyRegistration $world.Legacy | Out-Null } 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+        Assert-CcodThrows { Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters } 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+        Assert-CcodEqual 0 $world.LegacyRemoveAttempts "$kind mismatch is rejected before any legacy deletion"
+        Assert-CcodEqual 5 $world.LegacyEntries.Count "$kind mismatch preserves the complete exact legacy state"
+    }
+}
+
+# Production mutation caught: keeping the historical fixed count of nine records either rejects a
+# complete older profile or authorizes a same-count snapshot containing an unrelated entry.
+$results += Invoke-CcodTest 'legacy snapshot count and names are derived from the selected historical profile' {
+    foreach ($case in @(
+        [pscustomobject]@{Version='2.1.0';Names=$v210ShortcutNames;RemovalCount=5;Remaining=@()},
+        [pscustomobject]@{Version='2.1.6';Names=$v211ShortcutNames;RemovalCount=6;Remaining=@()},
+        [pscustomobject]@{Version='2.5.21';Names=$v2521ShortcutNames;RemovalCount=3;Remaining=$currentShortcutNames}
+    )) {
+        $world = New-CcodRegistrationWorld
+        Set-CcodRegistrationLegacyFixture -World $world -Version $case.Version -ShortcutNames $case.Names
+        $null = Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
+        Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters
+        Assert-CcodEqual $case.RemovalCount $world.LegacyRemoveAttempts "$($case.Version) removes only legacy entries not replaced by exact current shortcuts"
+        Assert-CcodEqual ((@($case.Remaining)|Sort-Object)-join'|') ((@($world.LegacyEntries)|Sort-Object)-join'|') "$($case.Version) leaves exactly its verified current replacement set"
+    }
+
+    $world = New-CcodRegistrationWorld
+    $null = Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
+    [void]$world.LegacyEntries.Remove($v2521ShortcutNames[3])
+    $world.LegacyEntries.Add('Programs\CodexRemote-fix\unexpected.lnk')
+    Assert-CcodThrows { Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters } 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+    Assert-CcodEqual 0 $world.LegacyRemoveAttempts 'same-count foreign snapshot is rejected before the first deletion'
+}
+
+$results += Invoke-CcodTest 'overlapping legacy names require exact current shortcut hashes before deletion' {
+    $world=New-CcodRegistrationWorld
+    $world.LegacySnapshotHashOverrides[$currentShortcutNames[0]]='d'*64
+    $null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
+    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+    Assert-CcodEqual 0 $world.LegacyRemoveAttempts 'mismatched replacement hash is rejected before any legacy deletion'
+    Assert-CcodEqual 5 $world.LegacyEntries.Count 'mismatched replacement hash preserves every observed entry'
+}
+
+$results += Invoke-CcodTest 'current registration drift after cleanup restores every removed legacy-only entry' {
+    $world=New-CcodRegistrationWorld
+    $world.VerifiedRegistrationMutationAt=2
+    $before=@($world.LegacyEntries)|Sort-Object
+    $null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
+    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+    Assert-CcodEqual 3 $world.LegacyRemoveAttempts 'post-cleanup proof drift occurs only after the three legacy-only entries were removed'
+    Assert-CcodEqual ($before-join'|') ((@($world.LegacyEntries)|Sort-Object)-join'|') 'post-cleanup proof drift compensates the complete removed legacy-only set'
+    Assert-CcodEqual (($v2521ShortcutNames[2],$v2521ShortcutNames[1],'Registry')-join'|') (@($world.LegacyRestoreOrder)-join'|') 'post-cleanup proof drift restores legacy-only entries in reverse order'
 }
 
 # Production mutation caught: accepting an unexpected AppId/name set or an unverified registration receipt.
-$results += Invoke-CcodTest 'legacy migration rejects AppId and shortcut-name mismatches without deletion' {
-    foreach ($mismatch in @('AppId','Shortcut','Receipt')) {
+$results += Invoke-CcodTest 'legacy migration rejects AppId shortcut and current-proof mismatches without deletion' {
+    foreach ($mismatch in @('AppId','Shortcut','Receipt','CurrentProofHash','CurrentProofNames')) {
         $world = New-CcodRegistrationWorld
         $receipt = Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
         if ($mismatch -ceq 'AppId') { $world.Legacy.appId = '{AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE}' }
         if ($mismatch -ceq 'Shortcut') { $world.Legacy.shortcutNames = @('Programs\unexpected.lnk') }
         if ($mismatch -ceq 'Receipt') { $world.Product = $null }
+        if ($mismatch -in @('CurrentProofHash','CurrentProofNames')) {
+            $readVerified=$world.Adapters.ReadVerifiedRegistration
+            $world.Adapters.ReadVerifiedRegistration={
+                $proof=&$readVerified
+                if($mismatch-ceq'CurrentProofHash'){$proof.startMenuSha256='d'*64}else{$proof.shortcutNames=@($currentShortcutNames[0])}
+                $proof
+            }.GetNewClosure()
+        }
         Assert-CcodThrows { Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters } 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
         Assert-CcodEqual 0 $world.LegacyRemoveAttempts 'legacy mismatch is rejected before any deletion'
-        Assert-CcodEqual 9 $world.LegacyEntries.Count 'legacy state remains intact on mismatch'
+        Assert-CcodEqual 5 $world.LegacyEntries.Count 'legacy state remains intact on mismatch'
     }
 }
 
@@ -235,25 +413,26 @@ $results += Invoke-CcodTest 'legacy migration restores earlier exact deletions a
     $world=New-CcodRegistrationWorld
     $receipt=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
     $before=@($world.LegacyEntries)|Sort-Object
-    $world.LegacyRemoveFailureAt=4
+    $world.LegacyRemoveFailureAt=3
     Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
     Assert-CcodEqual ($before-join'|') ((@($world.LegacyEntries)|Sort-Object)-join'|') 'failed migration restores the complete exact legacy set'
-    Assert-CcodEqual 3 $world.LegacyRestores 'only successfully removed entries are restored'
+    Assert-CcodEqual 2 $world.LegacyRestores 'only successfully removed legacy-only entries are restored'
+    Assert-CcodEqual (($v2521ShortcutNames[1],'Registry')-join'|') (@($world.LegacyRestoreOrder)-join'|') 'successful legacy-only deletions are compensated in exact reverse order'
 }
 
 $results += Invoke-CcodTest 'legacy compensation never overwrites a replacement that appeared after deletion' {
-    $world=New-CcodRegistrationWorld;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;$world.LegacyRemoveFailureAt=4;$world.LegacyReplacementEntry='StartMenu1'
+    $world=New-CcodRegistrationWorld;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;$world.LegacyRemoveFailureAt=3;$world.LegacyReplacementEntry=$v2521ShortcutNames[1]
     Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED'
-    Assert-CcodEqual 2 $world.LegacyRestores 'compensation restores only entries that remain absent'
-    Assert-CcodTrue (-not$world.LegacyEntries.Contains('StartMenu1')) 'replacement occupies the removed name and is not overwritten with captured bytes'
+    Assert-CcodEqual 1 $world.LegacyRestores 'compensation restores only entries that remain absent'
+    Assert-CcodTrue (-not$world.LegacyEntries.Contains($v2521ShortcutNames[1])) 'replacement occupies the removed name and is not overwritten with captured bytes'
     Assert-CcodEqual 1 $world.LegacyUnresolvedRecords.Count 'replacement-blocked restoration is recorded explicitly'
 }
 
 $results += Invoke-CcodTest 'legacy restore failure is explicit and records the unresolved exact entries' {
-    $world=New-CcodRegistrationWorld;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;$world.LegacyRemoveFailureAt=4;$world.LegacyRestoreFailureEntry='StartMenu2'
+    $world=New-CcodRegistrationWorld;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;$world.LegacyRemoveFailureAt=3;$world.LegacyRestoreFailureEntry=$v2521ShortcutNames[1]
     Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED'
     Assert-CcodEqual 1 $world.LegacyUnresolvedRecords.Count 'failed compensation writes one explicit unresolved record'
-    Assert-CcodTrue (@($world.LegacyUnresolvedRecords[0].entries)-ccontains'StartMenu2') 'unresolved record names the exact entry whose restoration failed'
+    Assert-CcodTrue (@($world.LegacyUnresolvedRecords[0].entries)-ccontains$v2521ShortcutNames[1]) 'unresolved record names the exact entry whose restoration failed'
 }
 
 $results += Invoke-CcodTest 'partially removed current registry entry is included in unresolved compensation' {

From be47fadca01953c9cf85490e8a19e66444fc4d7d Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 01:46:39 +0800
Subject: [PATCH 129/187] docs: record legacy registration profile evidence

---
 .../task-2-report.md                          | 130 ++++++++++++++++++
 1 file changed, 130 insertions(+)
 create mode 100644 .superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-2-report.md

diff --git a/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-2-report.md b/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-2-report.md
new file mode 100644
index 0000000..a9d4bcc
--- /dev/null
+++ b/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-2-report.md
@@ -0,0 +1,130 @@
+# Task 2：精确历史注册 profile 迁移报告
+
+## 结论
+
+Task 2 已在隔离 worktree `codex/v2522-install-runtime-reliability` 中实现并完成要求的 focused verification。
+
+- 基线：`4504c1afa665bccd3cc9f9e1ffd748c795bf936d`
+- implementation commit：`6be1025`（`fix: migrate exact legacy registration profiles`）
+- 未运行真实安装器，未读写真实 registry、Start menu、Desktop shortcut、scheduled task 或产品进程。
+- 未执行 push、tag、release、安装、重启或 reboot。
+- 本报告只声明 Task 2 focused scope；全计划 aggregate、installed acceptance 与 Task 3 不在本次完成声明内。
+
+## 历史来源与版本边界
+
+历史 profile 直接来自 checked-in `build/CodexControlOtherDevices.iss` 与对应 `package.json`：
+
+| Profile | 版本范围 | AppId | 精确 shortcut 集合 |
+|---|---:|---|---|
+| `CodexControlOtherDevicesInitial` | `2.1.0` | `{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}` | 4 个旧品牌 Start-menu shortcut，无 Desktop shortcut |
+| `CodexControlOtherDevicesDesktop` | `2.1.1`–`2.1.6` | 同上 | 相同 4 个 Start-menu shortcut，加 `Desktop\Codex 设备连接 (Device Connection).lnk` |
+| `CodexRemoteFix` | `2.2.0`–`2.5.21` | 同上 | 3 个 `Programs\CodexRemote-fix\...` shortcut，加 `Desktop\CodexRemote-fix.lnk` |
+
+来源核对：
+
+- tag `v2.1.0`：版本 `2.1.0`，4 个 `[Icons]` entry；无 Desktop entry。
+- commit `2d8da0f8e86dd06571f2dd6428143fab9beb5918`：版本变为 `2.1.1`，首次增加旧品牌 Desktop entry。
+- tag `v2.1.6`：保留上述 5-entry 旧品牌布局。
+- commit `fedc840a66f9019de406c5e55dabd403df3b0611` / tag `v2.2.0`：切换为 4-entry `CodexRemote-fix` 布局。
+- Task 1 的真实 merge-base `19803a79af3302c49f129e6a6b3ff7ffaf1b930b` 与 tag `v2.5.21` 均为版本 `2.5.21`、相同 AppId、相同 4-entry `CodexRemote-fix` 布局。
+
+三个 profile 都要求 registry `DisplayVersion` 位于本 profile 的闭区间内，并要求 `UninstallString` 精确等于由 canonical absolute `InstallLocation` 绑定出的 `"{installLocation}\unins000.exe"`，不接受附加参数、未加引号或外部路径。
+
+## 实现
+
+`ProductRegistration.psm1` 新增并导出：
+
+- `Get-CcodLegacyRegistrationProfiles`
+- `Resolve-CcodLegacyRegistrationProfile -LegacyRegistration`
+
+解析采用 Ordinal exact set：只允许一个完整 profile，不要求历史名称并集，也不接受重复、缺失、额外、跨 profile、大小写变化或 reparse/unsafe shortcut evidence。
+
+真实 reader 会：
+
+- 读取 legacy AppId key 的 `DisplayVersion`、`InstallLocation` 与 `UninstallString`；
+- 枚举两个已知 Start-menu group 的全部直接子项，因此 unknown/extra entry 不会被 allowlist scan 隐藏；
+- 读取两个历史 Desktop candidate；
+- 把 directory/reparse object 标记为 unsafe，使 resolver 在任何删除前 fail closed。
+
+Legacy snapshot 数量改为 `1 registry entry + selected profile shortcut count`，并再次校验 snapshot 中 registry/shortcut 名称与所选 profile 完全一致。
+
+### v2.5.21 重叠路径保护
+
+自审发现 v2.2.0–v2.5.21 的 main Start-menu 与 Desktop 路径和 v2.5.22 current shortcut 路径重叠。新注册会先安全替换这两个 leaf；legacy cleanup 不能随后把 current replacement 删除。
+
+因此 cleanup 现在要求 exact current three-record proof：current registry、Start-menu、Desktop 的 runtime/version/package/name/hash 必须一致。只有 snapshot 中 path 和 SHA-256 同时绑定该 proof 的两个重叠 entry 才从 legacy deletion set 排除。实际删除的是 legacy registry、compatibility shortcut、uninstall shortcut。删除后再次读取并逐字段验证同一个 current proof；若漂移，则按反序补偿所有已删除 legacy-only entry。
+
+旧 profile 与 current 路径不重叠，仍完整删除 `5` 或 `6` 个 snapshot entry。
+
+原有安全语义保持：
+
+- 删除失败后只反序恢复已删除或部分删除的 exact entry；
+- replacement 已占用名称时不覆盖；
+- restore 失败或 replacement mismatch 会写 create-only unresolved compensation record；
+- current proof 或 profile 不完整时执行零 legacy deletion。
+
+## TDD 证据
+
+### 干净基线
+
+- `ProductRegistration.SelfTest.ps1`：`13/13`，exit `0`。
+- `InstallLifecycle.SelfTest.ps1`：`148/148`，exit `0`。
+
+### RED 1：真实 v2.5.21 四 shortcut 集合
+
+Production 尚未修改时运行：
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ProductRegistration.SelfTest.ps1
+```
+
+结果：exit `1`；首个真实 case 为 `real-v2.5.21-registration-removes-its-exact-four-shortcut-profile`，错误为 `CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID`，原因是旧实现要求 union-of-eight。
+
+随后加入 table-driven profile 与 negative matrix；旧实现仍在 exact legacy cleanup 前以同一错误失败。
+
+### GREEN 1：profile resolution 与动态 snapshot
+
+- ProductRegistration：`17/17`，exit `0`。
+
+覆盖 profile 边界以及 AppId、missing、extra、cross-profile、case-varied、reparse、version binding/gap/too-new、uninstall outside/arguments/unquoted、relative InstallLocation、same-count foreign snapshot。
+
+### RED 2：current shortcut overlap
+
+自审补充 overlap RED 后，旧 profile implementation 运行 ProductRegistration suite：exit `1`；首失败为：
+
+```text
+ASSERT_EQUAL: exact migration removes only the three non-current legacy entries expected=[3] actual=[5]
+```
+
+该 RED 证明仅按 profile snapshot 全删会删掉刚写入并验证的 current Start-menu/Desktop replacement。
+
+另先写入两个 safety RED：overlap snapshot hash mismatch 必须在零删除前失败；cleanup 后 current proof 漂移必须反序补偿三项 legacy-only 删除。
+
+### 最终 GREEN
+
+- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ProductRegistration.SelfTest.ps1`
+  - `Product registration self-tests passed: 19`
+  - exit `0`
+- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1`
+  - `Install lifecycle self-tests passed: 148`
+  - exit `0`
+
+Lifecycle 的真实 v2.5.21 fixture 现在经过实际 ProductRegistration module，仅把 registry/shortcut 外部副作用替换为内存 adapters。断言：
+
+- 新 current registration 在 terminal Ready 后完成；
+- legacy cleanup 删除恰好 registry、compatibility、uninstall 三项并保留两个 proof-bound current shortcuts；
+- 无 unresolved compensation record；
+- 第二次同 package 调用返回 `AlreadyInstalled`，不增加 runtime/selector，不安装 task、不启动进程、不重复 legacy deletion。
+
+最终静态检查：
+
+- `src\persistence\modules\ProductRegistration.psm1` parser：`0` errors。
+- `tests\persistence\ProductRegistration.SelfTest.ps1` parser：`0` errors。
+- `tests\persistence\InstallLifecycle.SelfTest.ps1` parser：`0` errors。
+- `git diff --check`：exit `0`。
+
+## 审查边界与后续
+
+- Focused self-review 未发现新的 Task 2 blocker。
+- 独立 review 仍由 controller 执行；本报告不把自审当成独立 review。
+- 全 persistence aggregate、installed scenario、Setup/Defender、真实升级与发布仍在后续总体验收 gate 之后。

From 69c762de306752d019de1c4b11429699d5dbfd60 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 02:27:06 +0800
Subject: [PATCH 130/187] fix: make legacy registry compensation create-only

---
 .../modules/ProductRegistration.psm1          | 203 +++++++++++++++++-
 .../ProductRegistration.SelfTest.ps1          | 149 +++++++++++++
 2 files changed, 348 insertions(+), 4 deletions(-)

diff --git a/src/persistence/modules/ProductRegistration.psm1 b/src/persistence/modules/ProductRegistration.psm1
index fd24595..58356ef 100644
--- a/src/persistence/modules/ProductRegistration.psm1
+++ b/src/persistence/modules/ProductRegistration.psm1
@@ -445,7 +445,166 @@ function Read-CcodLegacySnapshot {
     }
     return [pscustomobject][ordered]@{appId=$ExpectedAppId;entries=@($entries)}
 }
-function Remove-CcodLegacySnapshotEntry {param($Entry);if($Entry-is[string]){return};if($Entry.kind-ceq'Registry'){$key=$null;try{$key=Get-Item -LiteralPath $Entry.path -ErrorAction Stop;if((@($key.GetValueNames()|Sort-Object)-join'|')-cne((@($Entry.values.Keys)|Sort-Object)-join'|')-or$key.GetSubKeyNames().Count-ne0){throw 'legacy registry changed'};foreach($name in @($Entry.values.Keys)){$current=$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);if([string]$current-cne[string]$Entry.values[$name].value-or[string]$key.GetValueKind($name)-cne[string]$Entry.values[$name].kind){throw 'legacy registry value changed'}};foreach($name in @($Entry.values.Keys)){$key.DeleteValue($name,$true)};$key.Dispose();$key=$null;Remove-Item -LiteralPath $Entry.path -Force -ErrorAction Stop;return}catch{if($null-ne$key){$key.Dispose()};if(-not(Test-Path -LiteralPath $Entry.path)){New-Item -Path $Entry.path -Force|Out-Null};foreach($name in $Entry.values.Keys){if($null-eq(Get-ItemProperty -LiteralPath $Entry.path -Name $name -ErrorAction SilentlyContinue)){$kind=[Enum]::Parse([Microsoft.Win32.RegistryValueKind],[string]$Entry.values[$name].kind);New-ItemProperty -LiteralPath $Entry.path -Name $name -Value $Entry.values[$name].value -PropertyType $kind -Force|Out-Null}};throw}};if(-not[IO.File]::Exists($Entry.path)-or(Get-CcodProductFileSha256 $Entry.path)-cne$Entry.sha256){throw 'legacy shortcut changed'};Remove-Item -LiteralPath $Entry.path -Force -ErrorAction Stop}
+function Initialize-CcodLegacyRegistryNative {
+    if($null-ne('CcodLegacyRegistryNativeV1'-as[type])){return}
+    Add-Type -TypeDefinition @'
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+using Microsoft.Win32;
+using Microsoft.Win32.SafeHandles;
+
+public sealed class CcodLegacyRegistryCreateResultV1 : IDisposable
+{
+    private SafeRegistryHandle nativeHandle;
+    public RegistryKey Key { get; private set; }
+    public uint Disposition { get; private set; }
+    internal CcodLegacyRegistryCreateResultV1(IntPtr handle, uint disposition)
+    {
+        nativeHandle = new SafeRegistryHandle(handle, true);
+        Key = RegistryKey.FromHandle(nativeHandle);
+        Disposition = disposition;
+    }
+    public void Dispose()
+    {
+        if (Key != null) { Key.Dispose(); Key = null; }
+        if (nativeHandle != null) { nativeHandle.Dispose(); nativeHandle = null; }
+    }
+}
+
+public static class CcodLegacyRegistryNativeV1
+{
+    private const int KEY_QUERY_VALUE = 0x0001;
+    private const int KEY_SET_VALUE = 0x0002;
+    private const int KEY_ENUMERATE_SUB_KEYS = 0x0008;
+    private const int DELETE = 0x00010000;
+    [DllImport("advapi32.dll", CharSet = CharSet.Unicode, ExactSpelling = true)]
+    private static extern int RegCreateKeyExW(IntPtr hKey, string subKey, uint reserved, string keyClass, uint options, int desiredAccess, IntPtr securityAttributes, out IntPtr result, out uint disposition);
+    [DllImport("ntdll.dll", ExactSpelling = true)]
+    private static extern int NtCompareObjects(IntPtr first, IntPtr second);
+    [DllImport("ntdll.dll", ExactSpelling = true)]
+    private static extern int NtDeleteKey(IntPtr keyHandle);
+    [DllImport("ntdll.dll", ExactSpelling = true)]
+    private static extern uint RtlNtStatusToDosError(int status);
+
+    public static CcodLegacyRegistryCreateResultV1 CreateCurrentUserKey(string subKey)
+    {
+        IntPtr handle;
+        uint disposition;
+        int error = RegCreateKeyExW(new IntPtr(unchecked((int)0x80000001)), subKey, 0, null, 0, KEY_QUERY_VALUE | KEY_SET_VALUE | KEY_ENUMERATE_SUB_KEYS | DELETE, IntPtr.Zero, out handle, out disposition);
+        if (error != 0) throw new Win32Exception(error);
+        return new CcodLegacyRegistryCreateResultV1(handle, disposition);
+    }
+    public static bool IsSameKey(RegistryKey first, RegistryKey second)
+    {
+        if (first == null || second == null) return false;
+        return NtCompareObjects(first.Handle.DangerousGetHandle(), second.Handle.DangerousGetHandle()) == 0;
+    }
+    public static void DeleteKey(RegistryKey key)
+    {
+        if (key == null) throw new ArgumentNullException("key");
+        int status = NtDeleteKey(key.Handle.DangerousGetHandle());
+        if (status < 0) throw new Win32Exception((int)RtlNtStatusToDosError(status));
+    }
+}
+'@ -ErrorAction Stop
+}
+
+function Get-CcodLegacyRegistryNativeSubKey {
+    param([Parameter(Mandatory)][string]$Path)
+    if(-not$Path.StartsWith('HKCU:\',[StringComparison]::Ordinal)-or$Path.Length-le6){throw 'legacy registry path is invalid'}
+    return $Path.Substring(6)
+}
+
+function Get-CcodLegacyRegistryMutationAdapters {
+    param([hashtable]$Adapters)
+    $defaults=@{
+        OpenExisting={
+            param($Path)
+            $rights=[Security.AccessControl.RegistryRights]::QueryValues-bor[Security.AccessControl.RegistryRights]::SetValue-bor[Security.AccessControl.RegistryRights]::EnumerateSubKeys-bor[Security.AccessControl.RegistryRights]::Delete
+            $key=[Microsoft.Win32.Registry]::CurrentUser.OpenSubKey((Get-CcodLegacyRegistryNativeSubKey $Path),[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,$rights)
+            if($null-eq$key){return $null}
+            [pscustomobject][ordered]@{key=$key;resource=$key;disposition='OpenedExisting'}
+        }
+        CloseKey={param($Handle)$Handle.resource.Dispose()}
+        GetValueNames={param($Handle)@($Handle.key.GetValueNames())}
+        GetSubKeyNames={param($Handle)@($Handle.key.GetSubKeyNames())}
+        GetValue={param($Handle,$Name)$Handle.key.GetValue([string]$Name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)}
+        GetValueKind={param($Handle,$Name)[string]$Handle.key.GetValueKind([string]$Name)}
+        DeleteValue={param($Handle,$Name)$Handle.key.DeleteValue([string]$Name,$true)}
+        SetValue={param($Handle,$Name,$Value,$Kind)$valueKind=[Enum]::Parse([Microsoft.Win32.RegistryValueKind],[string]$Kind);$Handle.key.SetValue([string]$Name,$Value,$valueKind)}
+        DeleteKey={param($Handle)Initialize-CcodLegacyRegistryNative;[CcodLegacyRegistryNativeV1]::DeleteKey($Handle.key)}
+        TestKeyAtPath={
+            param($Path,$Handle)
+            $current=[Microsoft.Win32.Registry]::CurrentUser.OpenSubKey((Get-CcodLegacyRegistryNativeSubKey $Path),$false)
+            if($null-eq$current){return $false}
+            try{Initialize-CcodLegacyRegistryNative;return [CcodLegacyRegistryNativeV1]::IsSameKey($Handle.key,$current)}finally{$current.Dispose()}
+        }
+        CreateKey={
+            param($Path)
+            Initialize-CcodLegacyRegistryNative;$result=[CcodLegacyRegistryNativeV1]::CreateCurrentUserKey((Get-CcodLegacyRegistryNativeSubKey $Path))
+            $disposition=if($result.Disposition-eq1){'CreatedNew'}elseif($result.Disposition-eq2){'OpenedExisting'}else{$result.Dispose();throw 'legacy registry create disposition is invalid'}
+            [pscustomobject][ordered]@{key=$result.Key;resource=$result;disposition=$disposition}
+        }
+    }
+    if($null-eq$Adapters){return $defaults}
+    if($Adapters-isnot[hashtable]){throw 'legacy registry adapters are invalid'}
+    $resolved=@{};foreach($name in $defaults.Keys){$resolved[$name]=$defaults[$name]}
+    foreach($name in $Adapters.Keys){if($name-isnot[string]-or-not$resolved.ContainsKey($name)-or$Adapters[$name]-isnot[scriptblock]){throw 'legacy registry adapters are invalid'};$resolved[$name]=$Adapters[$name]}
+    return $resolved
+}
+
+function Get-CcodLegacyRegistryMutationState {
+    param([Parameter(Mandatory)]$Entry)
+    if($null-eq$Entry.PSObject.Properties['mutationState']){$Entry|Add-Member -NotePropertyName mutationState -NotePropertyValue ([pscustomobject]@{status='Captured'})}
+    $state=$Entry.mutationState
+    if($null-eq$state-or$state.status-isnot[string]){throw 'legacy registry mutation state is invalid'}
+    return $state
+}
+
+function Test-CcodLegacyRegistryHandleExact {
+    param([Parameter(Mandatory)]$Entry,[Parameter(Mandatory)]$Handle,[Parameter(Mandatory)][hashtable]$Adapters)
+    $names=@(&$Adapters.GetValueNames $Handle);$subkeys=@(&$Adapters.GetSubKeyNames $Handle)
+    if($subkeys.Count-ne0-or-not(Test-CcodProductExactStringSet $names @($Entry.values.Keys))){return $false}
+    foreach($name in @($Entry.values.Keys)){
+        $actualKind=&$Adapters.GetValueKind $Handle $name;$actualValue=$Adapters.GetValue.InvokeReturnAsIs($Handle,$name)
+        if([string]$actualKind-cne[string]$Entry.values[$name].kind-or($actualValue|ConvertTo-Json -Compress)-cne($Entry.values[$name].value|ConvertTo-Json -Compress)){return $false}
+    }
+    return $true
+}
+
+function Remove-CcodLegacySnapshotEntry {
+    param($Entry,[hashtable]$RegistryAdapters)
+    if($Entry-is[string]){return}
+    if($Entry.kind-ceq'Registry'){
+        $state=Get-CcodLegacyRegistryMutationState $Entry;$adapter=Get-CcodLegacyRegistryMutationAdapters $RegistryAdapters;$handle=&$adapter.OpenExisting $Entry.path
+        if($null-eq$handle){throw 'legacy registry disappeared before deletion'}
+        $mutationStarted=$false;$operationFailure=$null;$closeFailure=$null
+        try{
+            if(-not(Test-CcodLegacyRegistryHandleExact -Entry $Entry -Handle $handle -Adapters $adapter)-or-not(&$adapter.TestKeyAtPath $Entry.path $handle)){throw 'legacy registry changed'}
+            foreach($name in @($Entry.values.Keys)){$mutationStarted=$true;&$adapter.DeleteValue $handle $name}
+            if(@(&$adapter.GetValueNames $handle).Count-ne0){throw 'legacy registry values remain after deletion'}
+            &$adapter.DeleteKey $handle
+            $state.status='Deleted'
+        }catch{
+            $operationFailure=$_
+            if($mutationStarted-and$state.status-cne'Deleted'){
+                $restored=$false
+                try{
+                    foreach($name in @($Entry.values.Keys)){&$adapter.SetValue $handle $name $Entry.values[$name].value $Entry.values[$name].kind}
+                    $restored=(Test-CcodLegacyRegistryHandleExact -Entry $Entry -Handle $handle -Adapters $adapter)-and[bool](&$adapter.TestKeyAtPath $Entry.path $handle)
+                }catch{$restored=$false}
+                $state.status=if($restored){'SameHandleRestoredExact'}else{'PartialUnresolved'}
+            }
+        }finally{try{&$adapter.CloseKey $handle}catch{$closeFailure=$_}}
+        if($null-ne$closeFailure){$state.status='PartialUnresolved';throw $closeFailure}
+        if($null-ne$operationFailure){throw $operationFailure}
+        return
+    }
+    if($Entry.kind-cne'Shortcut'){throw 'unknown legacy snapshot entry'}
+    if(-not[IO.File]::Exists($Entry.path)-or(Get-CcodProductFileSha256 $Entry.path)-cne$Entry.sha256){throw 'legacy shortcut changed'}
+    Remove-Item -LiteralPath $Entry.path -Force -ErrorAction Stop
+}
 function Compare-CcodLegacySnapshotEntry {
     param($Expected,$Current)
     if($null-eq$Current){return 'Absent'}
@@ -459,14 +618,50 @@ function Compare-CcodLegacySnapshotEntry {
     return 'Mismatch'
 }
 function Read-CcodLegacySnapshotEntry {
-    param($Entry)
+    param($Entry,[hashtable]$RegistryAdapters)
     if($Entry-is[string]){return $null}
     if($Entry.kind-ceq'Registry'){
-        if(-not(Test-Path -LiteralPath $Entry.path -PathType Container)){return $null};$key=Get-Item -LiteralPath $Entry.path -ErrorAction Stop;try{$values=[ordered]@{};foreach($name in @($key.GetValueNames())){$values[$name]=[pscustomobject]@{value=$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);kind=[string]$key.GetValueKind($name)}};$current=[pscustomobject]@{kind='Registry';path=[string]$Entry.path;subKeyNames=@($key.GetSubKeyNames());values=$values};return Compare-CcodLegacySnapshotEntry -Expected $Entry -Current $current}finally{$key.Dispose()}
+        $state=Get-CcodLegacyRegistryMutationState $Entry
+        if($state.status-in@('SameHandleRestoredExact','CreatedExact')){return 'Exact'}
+        if($state.status-in@('PartialUnresolved','CreateBlocked','CreateUnresolved')){return 'Mismatch'}
+        $adapter=Get-CcodLegacyRegistryMutationAdapters $RegistryAdapters;$handle=&$adapter.OpenExisting $Entry.path
+        if($null-eq$handle){return $null}
+        try{
+            if($state.status-ceq'Deleted'){return 'Mismatch'}
+            if((Test-CcodLegacyRegistryHandleExact -Entry $Entry -Handle $handle -Adapters $adapter)-and[bool](&$adapter.TestKeyAtPath $Entry.path $handle)){return 'Exact'}
+            return 'Mismatch'
+        }finally{&$adapter.CloseKey $handle}
     }
     if([IO.File]::Exists($Entry.path)){$current=[pscustomobject]@{kind='Shortcut';path=[string]$Entry.path;sha256=Get-CcodProductFileSha256 $Entry.path};return Compare-CcodLegacySnapshotEntry -Expected $Entry -Current $current};$null
 }
-function Restore-CcodLegacySnapshotEntry {param($Entry);if($Entry-is[string]){return};if($Entry.kind-ceq'Registry'){if(Test-Path -LiteralPath $Entry.path){throw 'legacy registry replacement present'};New-Item -Path $Entry.path -Force|Out-Null;foreach($name in $Entry.values.Keys){$kind=[Enum]::Parse([Microsoft.Win32.RegistryValueKind],[string]$Entry.values[$name].kind);New-ItemProperty -LiteralPath $Entry.path -Name $name -Value $Entry.values[$name].value -PropertyType $kind -Force|Out-Null};return};if([IO.File]::Exists($Entry.path)-or[IO.Directory]::Exists($Entry.path)){throw 'legacy shortcut replacement present'};[IO.Directory]::CreateDirectory((Split-Path $Entry.path -Parent))|Out-Null;$bytes=[Convert]::FromBase64String([string]$Entry.bytesBase64);$stream=[IO.File]::Open($Entry.path,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::Read);try{$stream.Write($bytes,0,$bytes.Length);$stream.Flush($true)}finally{$stream.Dispose()};if((Get-CcodProductFileSha256 $Entry.path)-cne$Entry.sha256){throw 'legacy shortcut restore mismatch'}}
+function Restore-CcodLegacySnapshotEntry {
+    param($Entry,[hashtable]$RegistryAdapters)
+    if($Entry-is[string]){return}
+    if($Entry.kind-ceq'Registry'){
+        $state=Get-CcodLegacyRegistryMutationState $Entry
+        if($state.status-cne'Deleted'){throw 'legacy registry is not eligible for path-level restoration'}
+        $adapter=Get-CcodLegacyRegistryMutationAdapters $RegistryAdapters;$created=$null;$createdNew=$false;$accepted=$false;$operationFailure=$null;$closeFailure=$null
+        try{
+            $created=&$adapter.CreateKey $Entry.path
+            if($null-eq$created-or$created.disposition-cne'CreatedNew'){$state.status='CreateBlocked';throw 'legacy registry replacement won the create-only race'}
+            $createdNew=$true
+            foreach($name in @($Entry.values.Keys)){&$adapter.SetValue $created $name $Entry.values[$name].value $Entry.values[$name].kind}
+            if(-not(Test-CcodLegacyRegistryHandleExact -Entry $Entry -Handle $created -Adapters $adapter)-or-not(&$adapter.TestKeyAtPath $Entry.path $created)){throw 'created legacy registry did not re-read exactly'}
+            $state.status='CreatedExact';$accepted=$true
+        }catch{
+            $operationFailure=$_
+            if($createdNew-and-not$accepted){try{&$adapter.DeleteKey $created}catch{};$state.status='CreateUnresolved'}
+        }finally{if($null-ne$created){try{&$adapter.CloseKey $created}catch{$closeFailure=$_}}}
+        if($null-ne$closeFailure){$state.status='CreateUnresolved';throw $closeFailure}
+        if($null-ne$operationFailure){throw $operationFailure}
+        return
+    }
+    if($Entry.kind-cne'Shortcut'){throw 'unknown legacy snapshot entry'}
+    if([IO.File]::Exists($Entry.path)-or[IO.Directory]::Exists($Entry.path)){throw 'legacy shortcut replacement present'}
+    [IO.Directory]::CreateDirectory((Split-Path $Entry.path -Parent))|Out-Null;$bytes=[Convert]::FromBase64String([string]$Entry.bytesBase64);$stream=[IO.File]::Open($Entry.path,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::Read)
+    try{$stream.Write($bytes,0,$bytes.Length);$stream.Flush($true)}finally{$stream.Dispose()}
+    if((Get-CcodProductFileSha256 $Entry.path)-cne$Entry.sha256){throw 'legacy shortcut restore mismatch'}
+}
 function Write-CcodLegacyCompensationFailure {param($Record)$local=[Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData);$root=Join-Path $local 'CodexControlOtherDevices\state\legacy-registration-compensation';[IO.Directory]::CreateDirectory($root)|Out-Null;$path=Join-Path $root (([guid]::NewGuid().ToString('D'))+'.json');$bytes=[Text.UTF8Encoding]::new($false).GetBytes(($Record|ConvertTo-Json -Depth 8 -Compress)+"`n");$stream=[IO.File]::Open($path,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::Read);try{$stream.Write($bytes,0,$bytes.Length);$stream.Flush($true)}finally{$stream.Dispose()}}
 
 function Commit-CcodProductRegistration {
diff --git a/tests/persistence/ProductRegistration.SelfTest.ps1 b/tests/persistence/ProductRegistration.SelfTest.ps1
index f152abb..c4b9e47 100644
--- a/tests/persistence/ProductRegistration.SelfTest.ps1
+++ b/tests/persistence/ProductRegistration.SelfTest.ps1
@@ -171,6 +171,111 @@ function Set-CcodRegistrationLegacyFixture {
     foreach ($entry in @('Registry') + $ShortcutNames) { $World.LegacyEntries.Add($entry) }
 }
 
+function New-CcodFix1RegistryKey {
+    param([Parameter(Mandatory)][string]$Id,[Parameter(Mandatory)]$Values,[Parameter(Mandatory)]$Kinds,[Parameter(Mandatory)]$World)
+    $key=[pscustomobject]@{Id=$Id;Values=$Values;Kinds=$Kinds;World=$World;DeleteCalls=0;DisposeCalls=0;Deleted=$false}
+    $key|Add-Member ScriptMethod GetValueNames { @($this.Values.Keys) }
+    $key|Add-Member ScriptMethod GetSubKeyNames { ,([string[]]@()) }
+    $key|Add-Member ScriptMethod GetValue {param($Name,$DefaultValue,$Options)if($this.Values.Contains([string]$Name)){$this.Values[[string]$Name]}else{$DefaultValue}}
+    $key|Add-Member ScriptMethod GetValueKind {param($Name)[Enum]::Parse([Microsoft.Win32.RegistryValueKind],[string]$this.Kinds[[string]$Name])}
+    $key|Add-Member ScriptMethod DeleteValue {
+        param($Name,$ThrowOnMissing)
+        $this.DeleteCalls++
+        if($this.World.Mode-ceq'PartialReplacement'-and$this.Id-ceq'Original'-and$this.DeleteCalls-eq2){$this.World.CurrentKey=$this.World.Replacement;throw 'TEST_PARTIAL_REGISTRY_DELETE_FAILURE'}
+        if(-not$this.Values.Contains([string]$Name)){if($ThrowOnMissing){throw 'TEST_REGISTRY_VALUE_MISSING'};return}
+        $this.Values.Remove([string]$Name)
+    }
+    $key|Add-Member ScriptMethod Dispose {$this.DisposeCalls++}
+    return $key
+}
+
+function New-CcodFix1RegistryWorld {
+    param([Parameter(Mandatory)][ValidateSet('PartialReplacement','CreateOpened','CreateNew')][string]$Mode)
+    $world=[pscustomobject]@{
+        Mode=$Mode;CurrentKey=$null;Original=$null;Replacement=$null;Created=$null;NativeCreateCalls=0;ProviderNewItemCalls=0
+        ReplacementWrites=0;CompensationRecords=[Collections.Generic.List[object]]::new();RegistryAdapters=$null;LowerFailure=$null
+    }
+    $world.Original=New-CcodFix1RegistryKey -Id Original -Values ([ordered]@{DisplayName='captured-product';NoModify=1}) -Kinds ([ordered]@{DisplayName='String';NoModify='DWord'}) -World $world
+    $world.Replacement=New-CcodFix1RegistryKey -Id Replacement -Values ([ordered]@{DisplayName='replacement-product';ReplacementSentinel=[byte[]]@(0xde,0xad,0xbe,0xef)}) -Kinds ([ordered]@{DisplayName='String';ReplacementSentinel='Binary'}) -World $world
+    $world.CurrentKey=$world.Original
+    $world.RegistryAdapters=@{
+        OpenExisting={param($Path)if($null-eq$world.CurrentKey){return $null};[pscustomobject][ordered]@{key=$world.CurrentKey;resource=$world.CurrentKey;disposition='OpenedExisting'}}.GetNewClosure()
+        CloseKey={param($Handle)$Handle.key.Dispose()}.GetNewClosure()
+        GetValueNames={param($Handle)@($Handle.key.Values.Keys)}.GetNewClosure()
+        GetSubKeyNames={param($Handle)@()}.GetNewClosure()
+        GetValue={param($Handle,$Name)if($Handle.key.Values.Contains([string]$Name)){$Handle.key.Values[[string]$Name]}else{$null}}.GetNewClosure()
+        GetValueKind={param($Handle,$Name)[string]$Handle.key.Kinds[[string]$Name]}.GetNewClosure()
+        DeleteValue={param($Handle,$Name)$Handle.key.DeleteValue([string]$Name,$true)}.GetNewClosure()
+        SetValue={param($Handle,$Name,$Value,$Kind)if($Handle.key.Id-ceq'Replacement'){$world.ReplacementWrites++};$Handle.key.Values[[string]$Name]=$Value;$Handle.key.Kinds[[string]$Name]=[string]$Kind}.GetNewClosure()
+        DeleteKey={param($Handle)$Handle.key.Deleted=$true;if([object]::ReferenceEquals($world.CurrentKey,$Handle.key)){$world.CurrentKey=$null}}.GetNewClosure()
+        TestKeyAtPath={param($Path,$Handle)[object]::ReferenceEquals($world.CurrentKey,$Handle.key)}.GetNewClosure()
+        CreateKey={
+            param($Path)
+            $world.NativeCreateCalls++
+            if($world.Mode-ceq'CreateOpened'){$world.CurrentKey=$world.Replacement;return [pscustomobject][ordered]@{key=$world.Replacement;resource=$world.Replacement;disposition='OpenedExisting'}}
+            if($null-ne$world.CurrentKey){return [pscustomobject][ordered]@{key=$world.CurrentKey;resource=$world.CurrentKey;disposition='OpenedExisting'}}
+            $world.Created=New-CcodFix1RegistryKey -Id Created -Values ([ordered]@{}) -Kinds ([ordered]@{}) -World $world;$world.CurrentKey=$world.Created
+            [pscustomobject][ordered]@{key=$world.Created;resource=$world.Created;disposition='CreatedNew'}
+        }.GetNewClosure()
+    }
+    return $world
+}
+
+function New-CcodFix1RegistrySnapshotEntry {
+    [pscustomobject][ordered]@{
+        kind='Registry';path='HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}_is1'
+        values=[ordered]@{DisplayName=[pscustomobject]@{value='captured-product';kind='String'};NoModify=[pscustomobject]@{value=1;kind='DWord'}}
+    }
+}
+
+function Invoke-CcodFix1RegistryCompensationScenario {
+    param([Parameter(Mandatory)][ValidateSet('PartialReplacement','CreateOpened','CreateNew')][string]$Mode)
+    $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-product-fix1-'+[guid]::NewGuid().ToString('N'));[IO.Directory]::CreateDirectory($root)|Out-Null
+    $copy=Join-Path $root 'ProductRegistrationFix1.psm1';Copy-Item -LiteralPath $modulePath -Destination $copy
+    $isolated=Import-Module $copy -Force -PassThru -DisableNameChecking -Prefix Fix1
+    $world=New-CcodFix1RegistryWorld -Mode $Mode;$replacementBefore=($world.Replacement.Values|ConvertTo-Json -Compress);$replacementKindsBefore=($world.Replacement.Kinds|ConvertTo-Json -Compress)
+    try{
+        &$isolated {
+            param($State)
+            $script:CcodFix1RegistryWorld=$State
+            function script:Get-CcodLegacyRegistryMutationAdapters {param($Adapters)$script:CcodFix1RegistryWorld.RegistryAdapters}
+            function script:Get-Item {param($LiteralPath,$ErrorAction)$script:CcodFix1RegistryWorld.CurrentKey}
+            function script:Test-Path {param($LiteralPath,$PathType)[bool]($null-ne$script:CcodFix1RegistryWorld.CurrentKey)}
+            function script:Get-ItemProperty {param($LiteralPath,$Name,$ErrorAction)$key=$script:CcodFix1RegistryWorld.CurrentKey;if($null-ne$key-and$key.Values.Contains([string]$Name)){[pscustomobject]@{value=$key.Values[[string]$Name]}}else{$null}}
+            function script:New-ItemProperty {param($LiteralPath,$Name,$Value,$PropertyType,[switch]$Force)$key=$script:CcodFix1RegistryWorld.CurrentKey;if($key.Id-ceq'Replacement'){$script:CcodFix1RegistryWorld.ReplacementWrites++};$key.Values[[string]$Name]=$Value;$key.Kinds[[string]$Name]=[string]$PropertyType;[pscustomobject]@{value=$Value}}
+            function script:Remove-Item {param($LiteralPath,[switch]$Force,$ErrorAction)$key=$script:CcodFix1RegistryWorld.CurrentKey;if($null-ne$key){$key.Deleted=$true};$script:CcodFix1RegistryWorld.CurrentKey=$null}
+            function script:New-Item {
+                param($Path,[switch]$Force)
+                $script:CcodFix1RegistryWorld.ProviderNewItemCalls++
+                if($script:CcodFix1RegistryWorld.Mode-in@('PartialReplacement','CreateOpened')){$script:CcodFix1RegistryWorld.CurrentKey=$script:CcodFix1RegistryWorld.Replacement;return $script:CcodFix1RegistryWorld.Replacement}
+                $created=New-CcodFix1RegistryKey -Id Created -Values ([ordered]@{}) -Kinds ([ordered]@{}) -World $script:CcodFix1RegistryWorld;$script:CcodFix1RegistryWorld.Created=$created;$script:CcodFix1RegistryWorld.CurrentKey=$created;$created
+            }
+        } $world
+        $registryEntry=New-CcodFix1RegistrySnapshotEntry
+        $programs=[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs);$desktop=[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop)
+        $snapshot=[pscustomobject][ordered]@{appId=$appId;entries=@(
+            $registryEntry,
+            [pscustomobject]@{kind='Shortcut';name=$v2521ShortcutNames[0];path=[IO.Path]::GetFullPath((Join-Path $programs 'CodexRemote-fix\CodexRemote-fix.lnk'));sha256=('b'*64);bytesBase64=''},
+            $v2521ShortcutNames[1],$v2521ShortcutNames[2],
+            [pscustomobject]@{kind='Shortcut';name=$v2521ShortcutNames[3];path=[IO.Path]::GetFullPath((Join-Path $desktop 'CodexRemote-fix.lnk'));sha256=('c'*64);bytesBase64=''}
+        )}
+        $proof=[pscustomobject][ordered]@{verified=$true;runtimeId=$runtimeId;version='2.5.22';packageSha256=$packageSha256;shortcutNames=@($currentShortcutNames);startMenuSha256=('b'*64);desktopSha256=('c'*64)}
+        $legacy=New-CcodLegacyRegistrationFixture -Version '2.5.21' -ShortcutNames $v2521ShortcutNames
+        $removeRegistry={param($Entry)&$isolated {param($Value)Remove-CcodLegacySnapshotEntry -Entry $Value} $Entry}.GetNewClosure()
+        $readRegistry={param($Entry)&$isolated {param($Value)Read-CcodLegacySnapshotEntry -Entry $Value} $Entry}.GetNewClosure()
+        $restoreRegistry={param($Entry)&$isolated {param($Value)Restore-CcodLegacySnapshotEntry -Entry $Value} $Entry}.GetNewClosure()
+        $adapters=@{
+            ReadVerifiedRegistration={$proof}.GetNewClosure();ReadLegacyRegistration={param($ExpectedAppId)$legacy}.GetNewClosure();ReadLegacySnapshot={param($ExpectedAppId,$ExpectedProfile)$snapshot}.GetNewClosure()
+            RemoveLegacyEntry={param($Entry)if($Entry-isnot[string]){try{&$removeRegistry $Entry}catch{$world.LowerFailure=$_;throw};return};if($Mode-cne'PartialReplacement'-and[string]$Entry-ceq$v2521ShortcutNames[1]){throw 'TEST_LATER_SHORTCUT_DELETE_FAILURE'}}.GetNewClosure()
+            ReadLegacyEntry={param($Entry)if($Entry-isnot[string]){&$readRegistry $Entry}else{'Exact'}}.GetNewClosure()
+            RestoreLegacyEntry={param($Entry)if($Entry-isnot[string]){&$restoreRegistry $Entry}}.GetNewClosure()
+            WriteLegacyCompensationFailure={param($Record)$world.CompensationRecords.Add($Record)}.GetNewClosure()
+        }
+        $failure=$null;try{&$isolated {param($ExpectedAppId,$ProductAdapters)Remove-CcodLegacyProductRegistration -ExpectedAppId $ExpectedAppId -Adapters $ProductAdapters} $appId $adapters}catch{$failure=$_}
+        return [pscustomobject]@{World=$world;Failure=$failure;ReplacementBefore=$replacementBefore;ReplacementKindsBefore=$replacementKindsBefore;RegistryEntry=$registryEntry}
+    }finally{Remove-Module $isolated -Force -ErrorAction SilentlyContinue;if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force}}
+}
+
 $results = @()
 
 # Production mutation caught: accepting a caller-crafted path/runtime tuple as a registration contract.
@@ -420,6 +525,50 @@ $results += Invoke-CcodTest 'legacy migration restores earlier exact deletions a
     Assert-CcodEqual (($v2521ShortcutNames[1],'Registry')-join'|') (@($world.LegacyRestoreOrder)-join'|') 'successful legacy-only deletions are compensated in exact reverse order'
 }
 
+$results += Invoke-CcodTest 'native registry create-only boundary loads without opening or changing a key' {
+    $native=&$module {Initialize-CcodLegacyRegistryNative;[pscustomobject]@{Create=$null-ne[CcodLegacyRegistryNativeV1].GetMethod('CreateCurrentUserKey');Compare=$null-ne[CcodLegacyRegistryNativeV1].GetMethod('IsSameKey');Delete=$null-ne[CcodLegacyRegistryNativeV1].GetMethod('DeleteKey')}}
+    Assert-CcodTrue ($native.Create-and$native.Compare-and$native.Delete) 'native boundary exposes only create-with-disposition compare-handle and delete-by-handle operations used by compensation'
+}
+
+$results += Invoke-CcodTest 'create-only registry compensation accepts only a newly created exact key' {
+    $result=Invoke-CcodFix1RegistryCompensationScenario -Mode CreateNew
+    Assert-CcodEqual 1 $result.World.NativeCreateCalls 'fully absent registry compensation performs exactly one native create-only open'
+    Assert-CcodEqual 0 $result.World.ProviderNewItemCalls 'new registry restoration never uses provider New-Item -Force'
+    Assert-CcodEqual '{"DisplayName":"captured-product","NoModify":1}' ($result.World.Created.Values|ConvertTo-Json -Compress) 'newly created key is restored to the exact captured values'
+    Assert-CcodEqual '{"DisplayName":"String","NoModify":"DWord"}' ($result.World.Created.Kinds|ConvertTo-Json -Compress) 'newly created key is restored to the exact captured value kinds'
+    Assert-CcodEqual 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' (([string]$result.Failure.FullyQualifiedErrorId-split',')[0]) 'later failure reports ordinary restored rollback only after exact create-only compensation'
+    Assert-CcodEqual 0 $result.World.CompensationRecords.Count 'exact newly created restoration needs no unresolved record'
+}
+
+$results += Invoke-CcodTest 'create-only registry compensation preserves a replacement that wins the restore race' {
+    $result=Invoke-CcodFix1RegistryCompensationScenario -Mode CreateOpened
+    Assert-CcodEqual $result.ReplacementBefore ($result.World.Replacement.Values|ConvertTo-Json -Compress) 'opened-existing restore disposition leaves replacement values unchanged'
+    Assert-CcodEqual $result.ReplacementKindsBefore ($result.World.Replacement.Kinds|ConvertTo-Json -Compress) 'opened-existing restore disposition leaves replacement kinds unchanged'
+    Assert-CcodEqual 0 $result.World.ReplacementWrites 'opened-existing restore disposition performs zero value writes'
+    Assert-CcodEqual 1 $result.World.NativeCreateCalls 'fully deleted registry compensation attempts exactly one native create-only open'
+    Assert-CcodEqual 0 $result.World.ProviderNewItemCalls 'registry compensation never falls back to provider New-Item -Force'
+    Assert-CcodEqual 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED' (([string]$result.Failure.FullyQualifiedErrorId-split',')[0]) 'opened-existing restore disposition remains explicitly unresolved'
+    Assert-CcodEqual 'Registry' (@($result.World.CompensationRecords[0].entries)-join'|') 'replacement race records only Registry as unresolved'
+}
+
+# Production mutation caught: disposing the partially deleted original registry handle and then
+# filling missing values by path writes captured data into a replacement key at the same name.
+$results += Invoke-CcodTest 'partial registry compensation never writes captured values into a replacement key' {
+    $result=Invoke-CcodFix1RegistryCompensationScenario -Mode PartialReplacement
+    Assert-CcodEqual 2 $result.World.Original.DeleteCalls "production registry remover reaches the injected mid-delete failure after one value deletion; lower=$($result.World.LowerFailure.Exception.Message)"
+    Assert-CcodEqual $result.ReplacementBefore ($result.World.Replacement.Values|ConvertTo-Json -Compress) 'replacement registry values remain byte-for-byte unchanged'
+    Assert-CcodEqual $result.ReplacementKindsBefore ($result.World.Replacement.Kinds|ConvertTo-Json -Compress) 'replacement registry value kinds remain unchanged'
+    Assert-CcodEqual 0 $result.World.ReplacementWrites 'captured values are written only through the original open registry handle'
+    Assert-CcodEqual 2 $result.World.Original.Values.Count 'partial deletion restores the complete captured value set through the still-open original handle'
+    Assert-CcodEqual 'captured-product' $result.World.Original.Values.DisplayName 'same-handle restoration restores the captured string value'
+    Assert-CcodEqual 1 $result.World.Original.Values.NoModify 'same-handle restoration restores the captured DWORD value'
+    Assert-CcodEqual 0 $result.World.NativeCreateCalls 'unproven partial deletion never falls back to path-level create'
+    Assert-CcodEqual 0 $result.World.ProviderNewItemCalls 'unproven partial deletion never uses provider New-Item -Force'
+    Assert-CcodEqual 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED' (([string]$result.Failure.FullyQualifiedErrorId-split',')[0]) 'replacement during partial registry compensation remains explicitly unresolved'
+    Assert-CcodEqual 1 $result.World.CompensationRecords.Count 'one create-only unresolved compensation record is persisted'
+    Assert-CcodEqual 'Registry' (@($result.World.CompensationRecords[0].entries)-join'|') 'the unresolved record names only the displaced Registry entry'
+}
+
 $results += Invoke-CcodTest 'legacy compensation never overwrites a replacement that appeared after deletion' {
     $world=New-CcodRegistrationWorld;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;$world.LegacyRemoveFailureAt=3;$world.LegacyReplacementEntry=$v2521ShortcutNames[1]
     Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED'

From 3682b810138ea43127762c92a860d45d96ca3d3d Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 02:27:59 +0800
Subject: [PATCH 131/187] docs: record registry compensation fix evidence

---
 .../task-2-report.md                          | 72 ++++++++++++++++++-
 1 file changed, 69 insertions(+), 3 deletions(-)

diff --git a/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-2-report.md b/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-2-report.md
index a9d4bcc..08818f9 100644
--- a/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-2-report.md
+++ b/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-2-report.md
@@ -5,7 +5,8 @@
 Task 2 已在隔离 worktree `codex/v2522-install-runtime-reliability` 中实现并完成要求的 focused verification。
 
 - 基线：`4504c1afa665bccd3cc9f9e1ffd748c795bf936d`
-- implementation commit：`6be1025`（`fix: migrate exact legacy registration profiles`）
+- initial implementation commit：`6be1025`（`fix: migrate exact legacy registration profiles`）
+- fix round 1 implementation commit：`69c762d`（`fix: make legacy registry compensation create-only`）
 - 未运行真实安装器，未读写真实 registry、Start menu、Desktop shortcut、scheduled task 或产品进程。
 - 未执行 push、tag、release、安装、重启或 reboot。
 - 本报告只声明 Task 2 focused scope；全计划 aggregate、installed acceptance 与 Task 3 不在本次完成声明内。
@@ -123,8 +124,73 @@ Lifecycle 的真实 v2.5.21 fixture 现在经过实际 ProductRegistration modul
 - `tests\persistence\InstallLifecycle.SelfTest.ps1` parser：`0` errors。
 - `git diff --check`：exit `0`。
 
+## Fix round 1：registry replacement 不可被补偿覆盖
+
+### Review finding
+
+独立 review 指出原 registry 删除/补偿存在 pathname race：
+
+- `Remove-CcodLegacySnapshotEntry` 在部分 value 删除失败后关闭原 key handle；
+- catch 随后通过 `Test-Path`、`New-Item -Force`、`Get-ItemProperty` 与 `New-ItemProperty -Force` 按路径补值；
+- 若原 key 已被重命名/删除且同路径出现 replacement，captured legacy values 会被写入 replacement。
+
+同样，完整删除后的 `Restore-CcodLegacySnapshotEntry` 使用 `Test-Path` 后再 `New-Item -Force`，不能区分本次新建 key 与在竞争窗口内已存在的 replacement。
+
+### Production-shaped RED
+
+测试导入 production module 的隔离副本，调用真实 `Remove-CcodLegacyProductRegistration`、`Remove-CcodLegacySnapshotEntry`、`Read-CcodLegacySnapshotEntry` 与 `Restore-CcodLegacySnapshotEntry`；只在 module 内替换 registry/native OS boundary，没有访问真实 HKCU。
+
+部分删除场景在第一次 `DeleteValue` 后让原 key 脱离路径、在同路径放入 replacement，并在第二次删除抛错。未修复代码的实际结果：
+
+```text
+ProductRegistration.SelfTest.ps1 -> exit 1
+case=partial-registry-compensation-never-writes-captured-values-into-a-replacement-key
+lower=TEST_PARTIAL_REGISTRY_DELETE_FAILURE
+replacement before={"DisplayName":"replacement-product","ReplacementSentinel":"unchanged"}
+replacement after ={"DisplayName":"replacement-product","ReplacementSentinel":"unchanged","NoModify":1}
+ReplacementWrites=1
+```
+
+捕获 RED 后，最终 regression fixture 把 sentinel 加强为 Binary `de ad be ef`；GREEN 同时校验 replacement 的所有 values、Binary bytes 与 value kinds 均不变。
+
+另分别观察两个 create-only RED：
+
+- replacement 在 absent-check 与 restore 之间赢得竞争：exit `1`，旧 `New-Item -Force` 把 `DisplayName` 改成 captured value 并加入 `NoModify`。
+- 路径保持完全 absent：exit `1`，断言 `native create-only open expected=[1] actual=[0]`，证明旧实现仍走 provider `New-Item`。
+
+Native wrapper 编译测试还捕获过一次真实类型错误：`RegistryKey.Handle` 在目标 Windows PowerShell/.NET 中是 `SafeRegistryHandle`，不能直接作为 `IntPtr` 传入。实现改用 `DangerousGetHandle()` 后才进入 GREEN。
+
+### Fix
+
+- 打开原 legacy key 时请求 `QueryValues | SetValue | EnumerateSubKeys | Delete`，删除通过原 open handle 调用 `NtDeleteKey`，不再按路径删除 registry key。
+- mid-delete 失败只通过仍打开的原 handle 写回全部 captured values；随后从同一 handle 重读 exact names/kinds/values，并以 `NtCompareObjects` 对比原 handle 与当前路径重新打开的 handle。
+- 若原 handle 已不再绑定该路径或不能精确验证，状态变为 `PartialUnresolved`；后续禁止降级到 path-level create，replacement 保持不变并记录 `Registry` unresolved。
+- 只有状态明确为 `Deleted` 的完整删除才允许 path-level restore。
+- path-level restore 使用窄 `RegCreateKeyExW(HKEY_CURRENT_USER, ...)` wrapper 并读取 disposition。只有 `REG_CREATED_NEW_KEY` 映射为 `CreatedNew` 后才能写值；`REG_OPENED_EXISTING_KEY` 立即关闭、零写入并标记 unresolved。
+- 新建后通过同一 handle 重读 exact names/kinds/values，并以 `NtCompareObjects` 证明仍绑定目标路径后才接受。写入/验证失败时尝试通过该新建 handle 删除部分 key，绝不删除同路径 replacement。
+- shortcut replacement、profile resolution、overlap retention、current proof revalidation 与 reverse compensation 行为未改变。
+
+### Fix round 1 GREEN
+
+- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ProductRegistration.SelfTest.ps1`
+  - `Product registration self-tests passed: 23`
+  - exit `0`
+- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1`
+  - `Install lifecycle self-tests passed: 148`
+  - exit `0`
+- 三个相关 PowerShell 文件 parser：各 `0` errors。
+- `git diff --check`：exit `0`。
+- 本机只读 symbol check：`NtCompareObjects=True`、`NtDeleteKey=True`、`RegCreateKeyExW=True`。
+- Windows PowerShell registry rights 表达式结果：`0x1000b`，包含 exact-handle delete 所需 `DELETE`。
+
+Fix-round 测试同时证明：
+
+- partial failure 把 captured values 恢复到原 open handle，但路径 identity 已变时仍 fail unresolved；`NativeCreateCalls=0`、provider `New-Item` calls=`0`。
+- `OpenedExisting` disposition 对 replacement values、Binary bytes 与 kinds 均执行零修改，并只记录 `Registry` unresolved。
+- `CreatedNew` disposition 写回完整 captured values/kinds，same-handle 重读通过后才被视为成功补偿。
+
 ## 审查边界与后续
 
-- Focused self-review 未发现新的 Task 2 blocker。
-- 独立 review 仍由 controller 执行；本报告不把自审当成独立 review。
+- Fix round 1 focused self-review 未发现新的 Task 2 blocker。
+- Fix round 1 scoped re-review 仍由 controller 执行；本报告不把自审当成独立 review。
 - 全 persistence aggregate、installed scenario、Setup/Defender、真实升级与发布仍在后续总体验收 gate 之后。

From 1d57736197df0bfcd1c0e54d96be63dfa54602df Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 03:26:39 +0800
Subject: [PATCH 132/187] fix: reclaim generation through pinned handles

---
 .../InstalledUninstallFinalizer.ps1           |   2 +-
 src/persistence/UninstallBootstrap.ps1        |   1 +
 .../modules/GenerationReclamation.psm1        | 493 ++++++++++++++++++
 .../InstallFileTransaction.SelfTest.ps1       |  13 +
 .../UninstallBootstrap.SelfTest.ps1           | 101 +++-
 5 files changed, 605 insertions(+), 5 deletions(-)
 create mode 100644 src/persistence/modules/GenerationReclamation.psm1

diff --git a/src/persistence/InstalledUninstallFinalizer.ps1 b/src/persistence/InstalledUninstallFinalizer.ps1
index 980aca1..621c2b6 100644
--- a/src/persistence/InstalledUninstallFinalizer.ps1
+++ b/src/persistence/InstalledUninstallFinalizer.ps1
@@ -34,7 +34,7 @@ function Get-CcodInstalledFinalizerAdapters {
         ReadPreparedTransaction={param($Id,$ExpectedInstallRoot);. $bootstrap;$identity=Get-CcodUninstallBootstrapCurrentIdentity;$value=Read-CcodUninstallBootstrapStoredTransaction -TransactionRoot $TransactionRoot -ExpectedUserSid $identity.userSid -IncludeCompleted -ExpectedInstallRoot $ExpectedInstallRoot;if($null-eq$value-or$value.transactionId-cne$Id){return $null};$value}.GetNewClosure()
         ValidateSelectedGeneration={param($SelectedRuntime,$Root,$Transaction);. $bootstrap;$context=Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $SelectedRuntime -InstallRoot $Root -InvocationPath (Join-Path $SelectedRuntime 'src\persistence\UninstallBootstrap.ps1');$manifest=Get-CcodUninstallBootstrapFileFingerprint -Path (Join-Path $SelectedRuntime 'manifest.json');$context.runtimeId-ceq$Transaction.runtimeId-and[uint64]$context.runtimeGeneration-eq[uint64]$Transaction.runtimeGeneration-and$manifest.sha256-ceq$Transaction.installedBinding.runtimeManifestSha256}.GetNewClosure()
         ReadCurrentEpoch={param($Root);. $bootstrap;$record=Read-CcodUninstallBootstrapJson -Path (Join-Path $Root 'state\lifecycle-epoch.json') -Kind 'Lifecycle epoch';[uint64]$record.epoch}.GetNewClosure()
-        RemoveSelectedGeneration={param($SelectedRuntime,$Transaction);. $bootstrap;$expected=[IO.Path]::GetFullPath([string]$Transaction.installedBinding.selectedRuntimeRoot);if([IO.Path]::GetFullPath($SelectedRuntime)-cne$expected){throw 'selected root changed'};$item=Get-Item -LiteralPath $expected -Force -ErrorAction Stop;if(-not$item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){throw 'selected root unsafe'};Remove-Item -LiteralPath $expected -Recurse -Force -ErrorAction Stop;$Transaction.phase='ReadyForInno';$Transaction.resumePhase='ReadyForInno';Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory (Join-Path $TransactionRoot $Transaction.transactionId) -Transaction $Transaction;$Transaction}.GetNewClosure()
+        RemoveSelectedGeneration={param($SelectedRuntime,$Transaction);. $bootstrap;$expected=[IO.Path]::GetFullPath([string]$Transaction.installedBinding.selectedRuntimeRoot);if([IO.Path]::GetFullPath($SelectedRuntime)-cne$expected){throw 'selected root changed'};$modulePath=Join-Path $PayloadRoot 'src\persistence\modules\GenerationReclamation.psm1';if(-not[IO.File]::Exists($modulePath)){throw 'generation reclamation module missing'};Import-Module $modulePath -Force -DisableNameChecking -ErrorAction Stop;$reclaimed=Remove-CcodVerifiedGenerationTree -InstallRoot $Transaction.readyEvidence.installRoot -RuntimeRoot $expected -RuntimeId $Transaction.runtimeId -ExpectedManifestSha256 $Transaction.installedBinding.runtimeManifestSha256;if($null-eq$reclaimed-or$reclaimed.phase-cne'Completed'-or$reclaimed.result-cne'Reclaimed'-or$reclaimed.runtimeId-cne$Transaction.runtimeId){throw 'generation reclamation proof invalid'};$Transaction.phase='ReadyForInno';$Transaction.resumePhase='ReadyForInno';Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory (Join-Path $TransactionRoot $Transaction.transactionId) -Transaction $Transaction;$Transaction}.GetNewClosure()
         TestSelectedRootAbsent={param($Root)-not([IO.Directory]::Exists($Root)-or[IO.File]::Exists($Root))}
         RemoveMatchedProductRegistration={param($Transaction);. $bootstrap;Remove-CcodUninstallBootstrapProductRegistration -Context ([pscustomobject][ordered]@{runtimeId=$Transaction.runtimeId;runtimeGeneration=[uint64]$Transaction.runtimeGeneration;leaseEpoch=[uint64]$Transaction.leaseEpoch;userSid=$Transaction.userSid;sessionId=[int]$Transaction.sessionId;readyEvidence=$Transaction.readyEvidence;payloadRecords=New-CcodUninstallBootstrapPayloadRecords -ResumeOnly})}
         FinalizeReceipt={param($Transaction);& $bootstrap -InstallerRoot $RuntimeRoot -InstallRoot $InstallRoot -Mode FinalizeReceipt;Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Finalization bootstrap returned unexpectedly' $Transaction.transactionId}.GetNewClosure()
diff --git a/src/persistence/UninstallBootstrap.ps1 b/src/persistence/UninstallBootstrap.ps1
index fbed4ae..83588d7 100644
--- a/src/persistence/UninstallBootstrap.ps1
+++ b/src/persistence/UninstallBootstrap.ps1
@@ -22,6 +22,7 @@ $script:CcodUninstallPayloadEntries = @(
     'src/persistence/UninstallBootstrap.ps1',
     'src/persistence/PortableUninstallFinalizer.ps1',
     'src/persistence/InstalledUninstallFinalizer.ps1',
+    'src/persistence/modules/GenerationReclamation.psm1',
     'src/persistence/modules/InstallLifecycle.psm1',
     'src/persistence/modules/ProductRegistration.psm1',
     'src/persistence/modules/PortableRelease.psm1',
diff --git a/src/persistence/modules/GenerationReclamation.psm1 b/src/persistence/modules/GenerationReclamation.psm1
new file mode 100644
index 0000000..b62a5e1
--- /dev/null
+++ b/src/persistence/modules/GenerationReclamation.psm1
@@ -0,0 +1,493 @@
+Set-StrictMode -Version Latest
+
+$script:CcodGenerationReclamationBeforeArmForTest = $null
+$script:CcodGenerationReclamationFailFileArmAtForTest = -1
+$script:CcodGenerationReclamationFailCommitAtForTest = -1
+
+function Throw-CcodGenerationReclamationError {
+    param([Parameter(Mandatory)][string]$Id,[Parameter(Mandatory)][string]$Message,$Target)
+    throw [Management.Automation.ErrorRecord]::new(
+        [InvalidOperationException]::new($Message),$Id,[Management.Automation.ErrorCategory]::InvalidData,$Target)
+}
+
+function Initialize-CcodGenerationReclamationRuntime {
+    $marker = 'CcodGenerationReclamationMarkerV1' -as [type]
+    if ($null -eq $marker) {
+        Add-Type -TypeDefinition @'
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+
+public sealed class CcodGenerationReclamationMarkerV1
+{
+    private CcodGenerationReclamationMarkerV1() { }
+    public static int CapabilityAbi { get { return 1; } }
+}
+
+internal sealed class CcodGenerationReclamationRollbackException : Exception
+{
+    internal CcodGenerationReclamationRollbackException(string message,Exception inner) : base(message,inner) { }
+}
+
+internal sealed class CcodGenerationReclamationCommitException : Exception
+{
+    internal CcodGenerationReclamationCommitException(string message,Exception inner) : base(message,inner) { }
+}
+
+internal sealed class CcodGenerationReclamationSnapshotV1
+{
+    internal sealed class FileRecord
+    {
+        public readonly string Path;
+        public readonly long Length;
+        public readonly string Sha256;
+        internal FileRecord(string path,long length,string sha256) { Path=path;Length=length;Sha256=sha256; }
+    }
+
+    public readonly string ManifestText;
+    public readonly FileRecord[] Files;
+    public readonly string[] Directories;
+    internal CcodGenerationReclamationSnapshotV1(string manifestText,FileRecord[] files,string[] directories)
+    { ManifestText=manifestText;Files=files;Directories=directories; }
+}
+
+internal sealed class CcodGenerationReclamationRuntimeV1 : IDisposable
+{
+    private const uint READ_DATA=0x00000001, LIST_DIRECTORY=0x00000001, READ_ATTRIBUTES=0x00000080;
+    private const uint DELETE=0x00010000, SYNCHRONIZE=0x00100000;
+    private const uint SHARE_READ=0x00000001, SHARE_WRITE=0x00000002;
+    private const uint OPEN=1, OPEN_EXISTING=3, OBJ_CASE_INSENSITIVE=0x40;
+    private const uint DIRECTORY=0x00000001, SYNC_IO=0x00000020, BACKUP_INTENT=0x00004000, OPEN_REPARSE=0x00200000;
+    private const uint FLAG_BACKUP=0x02000000, FLAG_REPARSE=0x00200000;
+    private const uint ATTR_DIRECTORY=0x00000010, ATTR_REPARSE=0x00000400;
+    private const uint DISPOSITION_DELETE=0x00000001, DISPOSITION_IGNORE_READONLY=0x00000010;
+    private const int FileStreamInfo=7, FileDirectoryInformation=1, FileDispositionInfoEx=21;
+    private const int STATUS_NO_MORE_FILES=unchecked((int)0x80000006);
+
+    [StructLayout(LayoutKind.Sequential)] private struct UNICODE_STRING { public ushort Length,MaximumLength; public IntPtr Buffer; }
+    [StructLayout(LayoutKind.Sequential)] private struct OBJECT_ATTRIBUTES { public int Length; public IntPtr RootDirectory,ObjectName; public uint Attributes; public IntPtr SecurityDescriptor,SecurityQualityOfService; }
+    [StructLayout(LayoutKind.Sequential)] private struct IO_STATUS_BLOCK { public IntPtr Status; public UIntPtr Information; }
+    [StructLayout(LayoutKind.Sequential)] private struct FILETIME_NATIVE { public uint Low,High; }
+    [StructLayout(LayoutKind.Sequential)] private struct FILE_INFO
+    {
+        public uint FileAttributes; public FILETIME_NATIVE CreationTime,LastAccessTime,LastWriteTime;
+        public uint VolumeSerialNumber,FileSizeHigh,FileSizeLow,NumberOfLinks,FileIndexHigh,FileIndexLow;
+    }
+
+    [DllImport("kernel32.dll",CharSet=CharSet.Unicode,SetLastError=true)] private static extern SafeFileHandle CreateFileW(string path,uint access,uint share,IntPtr security,uint creation,uint flags,IntPtr template);
+    [DllImport("kernel32.dll",SetLastError=true)] private static extern bool GetFileInformationByHandle(SafeFileHandle handle,out FILE_INFO information);
+    [DllImport("kernel32.dll",CharSet=CharSet.Unicode,SetLastError=true)] private static extern uint GetFinalPathNameByHandleW(SafeFileHandle handle,StringBuilder buffer,uint length,uint flags);
+    [DllImport("kernel32.dll",SetLastError=true)] private static extern bool GetFileInformationByHandleEx(SafeFileHandle handle,int informationClass,IntPtr information,uint size);
+    [DllImport("kernel32.dll",SetLastError=true)] private static extern bool SetFileInformationByHandle(SafeFileHandle handle,int informationClass,IntPtr information,uint size);
+    [DllImport("ntdll.dll")] private static extern int NtCreateFile(out IntPtr handle,uint access,ref OBJECT_ATTRIBUTES attributes,out IO_STATUS_BLOCK io,IntPtr allocationSize,uint fileAttributes,uint share,uint disposition,uint options,IntPtr ea,uint eaLength);
+    [DllImport("ntdll.dll")] private static extern int NtQueryDirectoryFile(SafeFileHandle handle,IntPtr evt,IntPtr apc,IntPtr context,out IO_STATUS_BLOCK io,IntPtr information,uint length,int informationClass,bool single,IntPtr name,bool restart);
+    [DllImport("ntdll.dll")] private static extern uint RtlNtStatusToDosError(int status);
+
+    private sealed class Pin : IDisposable
+    {
+        internal readonly Pin Parent;
+        internal readonly string Leaf,Path,RelativePath;
+        internal readonly bool Directory;
+        internal SafeFileHandle Handle;
+        internal FileStream Stream;
+        internal readonly uint Volume;
+        internal readonly ulong FileId;
+        internal readonly long Length;
+        internal readonly string Sha256;
+        internal readonly string[] Children;
+        internal bool Armed,Closed;
+
+        internal Pin(Pin parent,string leaf,string path,string relativePath,SafeFileHandle handle,FILE_INFO information,string[] children)
+        {
+            Parent=parent;Leaf=leaf;Path=path;RelativePath=relativePath;Directory=true;Handle=handle;
+            Volume=information.VolumeSerialNumber;FileId=((ulong)information.FileIndexHigh<<32)|information.FileIndexLow;
+            Length=-1;Sha256=null;Children=children;
+        }
+
+        internal Pin(Pin parent,string leaf,string path,string relativePath,FileStream stream,FILE_INFO information,long length,string sha256)
+        {
+            Parent=parent;Leaf=leaf;Path=path;RelativePath=relativePath;Directory=false;Stream=stream;
+            Volume=information.VolumeSerialNumber;FileId=((ulong)information.FileIndexHigh<<32)|information.FileIndexLow;
+            Length=length;Sha256=sha256;Children=null;
+        }
+
+        internal SafeFileHandle Native { get { return Directory?Handle:Stream.SafeFileHandle; } }
+        public void Dispose()
+        {
+            if(Closed)return;
+            if(Stream!=null)Stream.Dispose();else if(Handle!=null)Handle.Dispose();
+            Closed=true;
+        }
+    }
+
+    private readonly string installPath,runtimeParentPath,selectedPath;
+    private Pin installRoot,runtimeParent,selectedRoot,manifest;
+    private readonly List<Pin> files=new List<Pin>();
+    private readonly List<Pin> directories=new List<Pin>();
+    private bool disposed,completed;
+
+    private CcodGenerationReclamationRuntimeV1(string installPath,string runtimeParentPath,string selectedPath)
+    { this.installPath=installPath;this.runtimeParentPath=runtimeParentPath;this.selectedPath=selectedPath; }
+
+    internal static CcodGenerationReclamationRuntimeV1 Open(string installPath,string selectedPath,string runtimeId)
+    {
+        CcodGenerationReclamationRuntimeV1 runtime=new CcodGenerationReclamationRuntimeV1(installPath,Path.Combine(installPath,"runtime"),selectedPath);
+        try { runtime.OpenTree(runtimeId);return runtime; }
+        catch { runtime.Dispose();throw; }
+    }
+
+    private void OpenTree(string runtimeId)
+    {
+        SafeFileHandle absolute=OpenAbsoluteDirectory(installPath);
+        try { installRoot=CreateDirectoryPin(null,"",installPath,"",absolute,null);absolute=null; }
+        finally { if(absolute!=null)absolute.Dispose(); }
+
+        SafeFileHandle parentHandle=OpenRelative(installRoot.Native,"runtime",LIST_DIRECTORY|READ_ATTRIBUTES|SYNCHRONIZE,SHARE_READ|SHARE_WRITE,DIRECTORY|BACKUP_INTENT);
+        try { runtimeParent=CreateDirectoryPin(installRoot,"runtime",runtimeParentPath,"runtime",parentHandle,null);parentHandle=null; }
+        finally { if(parentHandle!=null)parentHandle.Dispose(); }
+
+        SafeFileHandle selectedHandle=OpenRelative(runtimeParent.Native,runtimeId,DELETE|LIST_DIRECTORY|READ_ATTRIBUTES|SYNCHRONIZE,SHARE_READ,DIRECTORY|BACKUP_INTENT);
+        try { selectedRoot=CreateDirectoryPin(runtimeParent,runtimeId,selectedPath,"",selectedHandle,null);selectedHandle=null;directories.Add(selectedRoot);OpenChildren(selectedRoot); }
+        finally { if(selectedHandle!=null)selectedHandle.Dispose(); }
+
+        if(installRoot.Volume!=runtimeParent.Volume||runtimeParent.Volume!=selectedRoot.Volume)throw new InvalidDataException("selected root volume ancestry changed");
+        foreach(Pin file in files)if(String.Equals(file.RelativePath,"manifest.json",StringComparison.Ordinal)){if(manifest!=null)throw new InvalidDataException("duplicate manifest");manifest=file;}
+        if(manifest==null)throw new InvalidDataException("manifest missing");
+        Revalidate();
+    }
+
+    private void OpenChildren(Pin directory)
+    {
+        string[] leaves=Enumerate(directory.Native);
+        for(int index=0;index<leaves.Length;index++)
+        {
+            string leaf=leaves[index];
+            if(String.IsNullOrEmpty(leaf)||leaf=="."||leaf==".."||leaf.IndexOfAny(new[]{'\\','/',':'})>=0||leaf.EndsWith(".",StringComparison.Ordinal)||leaf.EndsWith(" ",StringComparison.Ordinal))throw new InvalidDataException("unsafe enumerated leaf");
+            string path=Path.Combine(directory.Path,leaf),relative=String.IsNullOrEmpty(directory.RelativePath)?leaf:directory.RelativePath+"/"+leaf;
+            SafeFileHandle handle=OpenRelative(directory.Native,leaf,DELETE|READ_DATA|READ_ATTRIBUTES|SYNCHRONIZE,SHARE_READ,BACKUP_INTENT);
+            try
+            {
+                FILE_INFO information=Info(handle);
+                if((information.FileAttributes&ATTR_REPARSE)!=0)throw new InvalidDataException("reparse child");
+                if(information.VolumeSerialNumber!=selectedRoot.Volume)throw new InvalidDataException("child volume changed");
+                if(IsDirectory(information))
+                {
+                    Pin child=CreateDirectoryPin(directory,leaf,path,relative,handle,null);handle=null;directories.Add(child);OpenChildren(child);
+                }
+                else
+                {
+                    FileStream stream=null;
+                    try
+                    {
+                        stream=new FileStream(handle,FileAccess.Read,65536,false);handle=null;
+                        FILE_INFO current=Info(stream.SafeFileHandle);ValidateFileIdentity(current,stream.SafeFileHandle,path,selectedRoot.Volume);
+                        long length=stream.Length;string sha=Sha(stream);Pin child=new Pin(directory,leaf,path,relative,stream,current,length,sha);stream=null;files.Add(child);
+                    }
+                    finally { if(stream!=null)stream.Dispose(); }
+                }
+            }
+            finally { if(handle!=null)handle.Dispose(); }
+        }
+    }
+
+    internal CcodGenerationReclamationSnapshotV1 Snapshot()
+    {
+        if(disposed)throw new ObjectDisposedException("generation reclamation");
+        Revalidate();
+        List<CcodGenerationReclamationSnapshotV1.FileRecord> fileRecords=new List<CcodGenerationReclamationSnapshotV1.FileRecord>();
+        foreach(Pin file in files)fileRecords.Add(new CcodGenerationReclamationSnapshotV1.FileRecord(file.RelativePath,file.Length,file.Sha256));
+        fileRecords.Sort(delegate(CcodGenerationReclamationSnapshotV1.FileRecord left,CcodGenerationReclamationSnapshotV1.FileRecord right){return StringComparer.Ordinal.Compare(left.Path,right.Path);});
+        List<string> directoryPaths=new List<string>();foreach(Pin directory in directories)if(!Object.ReferenceEquals(directory,selectedRoot))directoryPaths.Add(directory.RelativePath);
+        directoryPaths.Sort(StringComparer.Ordinal);
+        return new CcodGenerationReclamationSnapshotV1(ReadText(manifest.Stream),fileRecords.ToArray(),directoryPaths.ToArray());
+    }
+
+    internal void Reclaim(int failFileArmAt,int failCommitAt)
+    {
+        if(disposed)throw new ObjectDisposedException("generation reclamation");
+        if(completed)throw new InvalidOperationException("generation already reclaimed");
+        Revalidate();
+        List<Pin> armed=new List<Pin>();
+        try
+        {
+            int armIndex=0;
+            foreach(Pin file in files)
+            {
+                armIndex++;
+                if(failFileArmAt>0&&armIndex==failFileArmAt)throw new IOException("injected file-arm failure");
+                SetDisposition(file.Native,true);file.Armed=true;armed.Add(file);
+            }
+        }
+        catch(Exception armFailure)
+        {
+            Exception rollbackFailure=null;
+            for(int index=armed.Count-1;index>=0;index--)
+            {
+                Pin file=armed[index];
+                try { SetDisposition(file.Native,false);file.Armed=false; }
+                catch(Exception exception) { if(rollbackFailure==null)rollbackFailure=exception; }
+            }
+            try { Revalidate(); } catch(Exception exception) { if(rollbackFailure==null)rollbackFailure=exception; }
+            if(rollbackFailure!=null)throw new CcodGenerationReclamationRollbackException("PinnedValidated rollback failed after FilesArmed rejection",rollbackFailure);
+            throw new InvalidDataException("FilesArmed rejected and the complete tree was disarmed: "+armFailure.Message,armFailure);
+        }
+
+        Exception commitFailure=null;int commitIndex=0;
+        foreach(Pin file in SortedFilesForCommit())
+        {
+            commitIndex++;
+            try { if(failCommitAt>0&&commitIndex==failCommitAt)throw new IOException("injected CommitStarted file-close failure");file.Dispose(); }
+            catch(Exception exception) { if(commitFailure==null)commitFailure=exception; }
+        }
+        foreach(Pin directory in SortedDirectoriesForCommit())
+        {
+            commitIndex++;
+            try { if(failCommitAt>0&&commitIndex==failCommitAt)throw new IOException("injected CommitStarted directory-mark failure");SetDisposition(directory.Native,true);directory.Armed=true;directory.Dispose(); }
+            catch(Exception exception) { if(commitFailure==null)commitFailure=exception; }
+        }
+        if(commitFailure==null&&(Directory.Exists(selectedPath)||File.Exists(selectedPath)))commitFailure=new IOException("selected root remains after handle commit");
+        if(commitFailure!=null)throw new CcodGenerationReclamationCommitException("CommitStarted generation reclamation failed",commitFailure);
+        completed=true;
+    }
+
+    private List<Pin> SortedFilesForCommit()
+    {
+        List<Pin> ordered=new List<Pin>(files);ordered.Sort(delegate(Pin left,Pin right){int depth=Depth(right.RelativePath).CompareTo(Depth(left.RelativePath));return depth!=0?depth:StringComparer.Ordinal.Compare(left.RelativePath,right.RelativePath);});return ordered;
+    }
+
+    private List<Pin> SortedDirectoriesForCommit()
+    {
+        List<Pin> ordered=new List<Pin>(directories);ordered.Sort(delegate(Pin left,Pin right){int depth=Depth(right.RelativePath).CompareTo(Depth(left.RelativePath));return depth!=0?depth:StringComparer.Ordinal.Compare(left.RelativePath,right.RelativePath);});return ordered;
+    }
+
+    private static int Depth(string relative){if(String.IsNullOrEmpty(relative))return 0;int depth=1;for(int index=0;index<relative.Length;index++)if(relative[index]=='/')depth++;return depth;}
+
+    private void Revalidate()
+    {
+        ValidateDirectoryIdentity(installRoot,installPath);
+        ValidateDirectoryIdentity(runtimeParent,runtimeParentPath);
+        ValidateDirectoryIdentity(selectedRoot,selectedPath);
+        if(installRoot.Volume!=runtimeParent.Volume||runtimeParent.Volume!=selectedRoot.Volume)throw new InvalidDataException("selected root volume ancestry changed");
+        foreach(Pin directory in directories)
+        {
+            ValidateDirectoryIdentity(directory,directory.Path);
+            string[] current=Enumerate(directory.Native),expected=directory.Children;
+            if(current.Length!=expected.Length)throw new InvalidDataException("directory membership changed");
+            for(int index=0;index<current.Length;index++)if(!String.Equals(current[index],expected[index],StringComparison.Ordinal))throw new InvalidDataException("directory membership changed");
+        }
+        foreach(Pin file in files)
+        {
+            FILE_INFO information=Info(file.Native);ValidateFileIdentity(information,file.Native,file.Path,selectedRoot.Volume);
+            ulong id=((ulong)information.FileIndexHigh<<32)|information.FileIndexLow;
+            if(information.VolumeSerialNumber!=file.Volume||id!=file.FileId||file.Stream.Length!=file.Length||!String.Equals(Sha(file.Stream),file.Sha256,StringComparison.Ordinal))throw new InvalidDataException("file identity or bytes changed");
+        }
+    }
+
+    private static Pin CreateDirectoryPin(Pin parent,string leaf,string path,string relative,SafeFileHandle handle,string[] knownChildren)
+    {
+        FILE_INFO information=Info(handle);ValidateDirectoryIdentity(information,handle,path);
+        string[] children=knownChildren??Enumerate(handle);
+        return new Pin(parent,leaf,path,relative,handle,information,children);
+    }
+
+    private static void ValidateDirectoryIdentity(Pin pin,string path)
+    {
+        if(pin==null||pin.Closed)throw new InvalidDataException("directory pin closed");
+        FILE_INFO information=Info(pin.Native);ValidateDirectoryIdentity(information,pin.Native,path);
+        ulong id=((ulong)information.FileIndexHigh<<32)|information.FileIndexLow;
+        if(information.VolumeSerialNumber!=pin.Volume||id!=pin.FileId)throw new InvalidDataException("directory identity changed");
+    }
+
+    private static void ValidateDirectoryIdentity(FILE_INFO information,SafeFileHandle handle,string path)
+    {
+        if(!IsDirectory(information)||(information.FileAttributes&ATTR_REPARSE)!=0||!OnlyDefaultStream(handle)||!SamePath(FinalPath(handle),path))throw new InvalidDataException("directory identity invalid");
+    }
+
+    private static void ValidateFileIdentity(FILE_INFO information,SafeFileHandle handle,string path,uint expectedVolume)
+    {
+        if(IsDirectory(information)||(information.FileAttributes&ATTR_REPARSE)!=0||information.NumberOfLinks!=1||information.VolumeSerialNumber!=expectedVolume||!OnlyDefaultStream(handle)||!SamePath(FinalPath(handle),path))throw new InvalidDataException("file identity invalid");
+    }
+
+    private static SafeFileHandle OpenAbsoluteDirectory(string path)
+    {
+        SafeFileHandle handle=CreateFileW(path,LIST_DIRECTORY|READ_ATTRIBUTES|SYNCHRONIZE,SHARE_READ|SHARE_WRITE,IntPtr.Zero,OPEN_EXISTING,FLAG_BACKUP|FLAG_REPARSE,IntPtr.Zero);
+        if(handle.IsInvalid){int error=Marshal.GetLastWin32Error();handle.Dispose();throw new Win32Exception(error);}return handle;
+    }
+
+    private static SafeFileHandle OpenRelative(SafeFileHandle parent,string name,uint access,uint share,uint options)
+    {
+        IntPtr nameBuffer=IntPtr.Zero,unicodePointer=IntPtr.Zero;bool added=false;
+        try
+        {
+            parent.DangerousAddRef(ref added);nameBuffer=Marshal.StringToHGlobalUni(name);
+            UNICODE_STRING unicode=new UNICODE_STRING{Length=(ushort)(name.Length*2),MaximumLength=(ushort)((name.Length+1)*2),Buffer=nameBuffer};
+            unicodePointer=Marshal.AllocHGlobal(Marshal.SizeOf(typeof(UNICODE_STRING)));Marshal.StructureToPtr(unicode,unicodePointer,false);
+            OBJECT_ATTRIBUTES attributes=new OBJECT_ATTRIBUTES{Length=Marshal.SizeOf(typeof(OBJECT_ATTRIBUTES)),RootDirectory=parent.DangerousGetHandle(),ObjectName=unicodePointer,Attributes=OBJ_CASE_INSENSITIVE};
+            IO_STATUS_BLOCK io;IntPtr raw;int status=NtCreateFile(out raw,access,ref attributes,out io,IntPtr.Zero,0,share,OPEN,options|SYNC_IO|OPEN_REPARSE,IntPtr.Zero,0);
+            if(status<0)throw new Win32Exception((int)RtlNtStatusToDosError(status));return new SafeFileHandle(raw,true);
+        }
+        finally { if(unicodePointer!=IntPtr.Zero)Marshal.FreeHGlobal(unicodePointer);if(nameBuffer!=IntPtr.Zero)Marshal.FreeHGlobal(nameBuffer);if(added)parent.DangerousRelease(); }
+    }
+
+    private static FILE_INFO Info(SafeFileHandle handle){FILE_INFO information;if(handle==null||handle.IsClosed||!GetFileInformationByHandle(handle,out information))throw new Win32Exception(Marshal.GetLastWin32Error());return information;}
+    private static bool IsDirectory(FILE_INFO information){return(information.FileAttributes&ATTR_DIRECTORY)!=0;}
+
+    private static string Sha(FileStream stream)
+    {
+        long position=stream.Position;try{stream.Position=0;using(SHA256 sha=SHA256.Create()){return BitConverter.ToString(sha.ComputeHash(stream)).Replace("-","").ToLowerInvariant();}}finally{stream.Position=position;}
+    }
+
+    private static string ReadText(FileStream stream)
+    {
+        if(stream.Length<1||stream.Length>4194304)throw new InvalidDataException("manifest size invalid");long position=stream.Position;
+        try{stream.Position=0;byte[] bytes=new byte[(int)stream.Length];int offset=0;while(offset<bytes.Length){int read=stream.Read(bytes,offset,bytes.Length-offset);if(read==0)throw new EndOfStreamException();offset+=read;}return new UTF8Encoding(false,true).GetString(bytes);}
+        finally{stream.Position=position;}
+    }
+
+    private static string FinalPath(SafeFileHandle handle)
+    {
+        StringBuilder buffer=new StringBuilder(512);uint length=GetFinalPathNameByHandleW(handle,buffer,(uint)buffer.Capacity,0);
+        if(length==0)throw new Win32Exception(Marshal.GetLastWin32Error());if(length>=buffer.Capacity){buffer.Capacity=(int)length+1;length=GetFinalPathNameByHandleW(handle,buffer,(uint)buffer.Capacity,0);if(length==0||length>=buffer.Capacity)throw new Win32Exception(Marshal.GetLastWin32Error());}
+        string path=buffer.ToString();if(path.StartsWith(@"\\?\UNC\",StringComparison.OrdinalIgnoreCase))return @"\\"+path.Substring(8);if(path.StartsWith(@"\\?\",StringComparison.OrdinalIgnoreCase))return path.Substring(4);return path;
+    }
+
+    private static bool SamePath(string first,string second){return String.Equals(Path.GetFullPath(first).TrimEnd('\\'),Path.GetFullPath(second).TrimEnd('\\'),StringComparison.OrdinalIgnoreCase);}
+
+    private static bool OnlyDefaultStream(SafeFileHandle handle)
+    {
+        IntPtr buffer=Marshal.AllocHGlobal(65536);
+        try
+        {
+            if(!GetFileInformationByHandleEx(handle,FileStreamInfo,buffer,65536)){int error=Marshal.GetLastWin32Error();if(error==38)return true;throw new Win32Exception(error);}
+            int offset=0;while(true){uint next=(uint)Marshal.ReadInt32(buffer,offset),nameLength=(uint)Marshal.ReadInt32(buffer,offset+4);string name=Marshal.PtrToStringUni(IntPtr.Add(buffer,offset+24),(int)nameLength/2);if(!String.Equals(name,"::$DATA",StringComparison.OrdinalIgnoreCase)&&!String.Equals(name,"::$INDEX_ALLOCATION",StringComparison.OrdinalIgnoreCase))return false;if(next==0)break;offset+=(int)next;}return true;
+        }
+        finally{Marshal.FreeHGlobal(buffer);}
+    }
+
+    private static string[] Enumerate(SafeFileHandle handle)
+    {
+        List<string> result=new List<string>();HashSet<string> seen=new HashSet<string>(StringComparer.OrdinalIgnoreCase);IntPtr buffer=Marshal.AllocHGlobal(65536);bool restart=true;
+        try
+        {
+            while(true)
+            {
+                IO_STATUS_BLOCK io;int status=NtQueryDirectoryFile(handle,IntPtr.Zero,IntPtr.Zero,IntPtr.Zero,out io,buffer,65536,FileDirectoryInformation,false,IntPtr.Zero,restart);restart=false;
+                if(status==STATUS_NO_MORE_FILES)break;if(status<0)throw new Win32Exception((int)RtlNtStatusToDosError(status));int offset=0;
+                while(true){uint next=(uint)Marshal.ReadInt32(buffer,offset),nameLength=(uint)Marshal.ReadInt32(buffer,offset+60);string name=Marshal.PtrToStringUni(IntPtr.Add(buffer,offset+64),(int)nameLength/2);if(name!="."&&name!=".."){if(!seen.Add(name))throw new InvalidDataException("duplicate directory entry");result.Add(name);}if(next==0)break;offset+=(int)next;}
+            }
+            result.Sort(StringComparer.Ordinal);return result.ToArray();
+        }
+        finally{Marshal.FreeHGlobal(buffer);}
+    }
+
+    private static void SetDisposition(SafeFileHandle handle,bool delete)
+    {
+        IntPtr buffer=Marshal.AllocHGlobal(4);
+        try{Marshal.WriteInt32(buffer,delete?unchecked((int)(DISPOSITION_DELETE|DISPOSITION_IGNORE_READONLY)):0);if(!SetFileInformationByHandle(handle,FileDispositionInfoEx,buffer,4))throw new Win32Exception(Marshal.GetLastWin32Error());}
+        finally{Marshal.FreeHGlobal(buffer);}
+    }
+
+    public void Dispose()
+    {
+        if(disposed)return;disposed=true;
+        for(int index=files.Count-1;index>=0;index--){try{files[index].Dispose();}catch{}}
+        for(int index=directories.Count-1;index>=0;index--){try{directories[index].Dispose();}catch{}}
+        try{if(runtimeParent!=null)runtimeParent.Dispose();}catch{}
+        try{if(installRoot!=null)installRoot.Dispose();}catch{}
+    }
+}
+'@
+        $marker = 'CcodGenerationReclamationMarkerV1' -as [type]
+    }
+    if($null-eq$marker-or[int]$marker.GetProperty('CapabilityAbi').GetValue($null,$null)-ne1){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_ABI_INVALID' 'Generation reclamation native ABI is unavailable' $null}
+    $script:CcodGenerationReclamationRuntimeType=$marker.Assembly.GetType('CcodGenerationReclamationRuntimeV1',$true)
+}
+
+function Invoke-CcodGenerationReclamationStatic {
+    param([Parameter(Mandatory)][string]$Name,[object[]]$Arguments)
+    $method=$script:CcodGenerationReclamationRuntimeType.GetMethod($Name,[Reflection.BindingFlags]'NonPublic,Static')
+    try{return $method.Invoke($null,$Arguments)}catch [Reflection.TargetInvocationException]{throw $_.Exception.InnerException}
+}
+
+function Invoke-CcodGenerationReclamationMethod {
+    param([Parameter(Mandatory)]$Runtime,[Parameter(Mandatory)][string]$Name,[object[]]$Arguments)
+    $method=$Runtime.GetType().GetMethod($Name,[Reflection.BindingFlags]'NonPublic,Instance')
+    try{return $method.Invoke($Runtime,$Arguments)}catch [Reflection.TargetInvocationException]{throw $_.Exception.InnerException}
+}
+
+function Test-CcodGenerationReclamationJsonHasNoDuplicateProperties {
+    param([AllowNull()][string]$Json)
+    if($null-eq$Json){return $false};$objects=[Collections.Generic.Stack[object]]::new()
+    for($index=0;$index-lt$Json.Length;$index++){
+        $character=$Json[$index]
+        if($character-eq'{'){$objects.Push([Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal));continue}
+        if($character-eq'}'){if($objects.Count-eq0){return $false};[void]$objects.Pop();continue}
+        if($character-ne'"'){continue};$name=[Text.StringBuilder]::new();$index++
+        while($index-lt$Json.Length){$character=$Json[$index];if($character-eq'"'){break};if($character-ne[char]92){[void]$name.Append($character);$index++;continue};$index++;if($index-ge$Json.Length){return $false};$escape=$Json[$index];if($escape-eq'u'){if($index+4-ge$Json.Length){return $false};try{[void]$name.Append([char][Convert]::ToInt32($Json.Substring($index+1,4),16))}catch{return $false};$index+=5;continue};switch([string]$escape){'"'{$decoded='"'}'\'{$decoded=[char]92}'/'{$decoded='/'}'b'{$decoded=[char]8}'f'{$decoded=[char]12}'n'{$decoded=[char]10}'r'{$decoded=[char]13}'t'{$decoded=[char]9}default{return $false}};[void]$name.Append($decoded);$index++}
+        if($index-ge$Json.Length){return $false};$next=$index+1;while($next-lt$Json.Length-and[char]::IsWhiteSpace($Json[$next])){$next++};if($next-lt$Json.Length-and$Json[$next]-eq':'){if($objects.Count-eq0-or-not$objects.Peek().Add($name.ToString())){return $false}}
+    }
+    return $objects.Count-eq0
+}
+
+function Test-CcodGenerationReclamationExactProperties {
+    param($Value,[string[]]$Expected)
+    if($null-eq$Value-or$Value-isnot[pscustomobject]){return $false};$actual=@($Value.PSObject.Properties.Name);if($actual.Count-ne$Expected.Count){return $false};for($index=0;$index-lt$actual.Count;$index++){if($actual[$index]-cne$Expected[$index]){return $false}};return $true
+}
+
+function ConvertTo-CcodGenerationReclamationRecord {
+    param([Parameter(Mandatory)]$Record)
+    if(-not(Test-CcodGenerationReclamationExactProperties $Record @('path','length','sha256'))-or$Record.path-isnot[string]-or$Record.path-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$'-or$Record.path.Contains('//')-or$Record.path-match'(^|/)(?:\.|\.\.)(?:/|$)'-or$Record.path.Equals('manifest.json',[StringComparison]::OrdinalIgnoreCase)-or$Record.sha256-isnot[string]-or$Record.sha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'A pinned manifest record is invalid' $Record}
+    $integerTypes=@([byte],[uint16],[uint32],[uint64],[int16],[int32],[int64]);$integer=$false;foreach($type in $integerTypes){if($Record.length-is$type){$integer=$true;break}};if(-not$integer){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'A pinned manifest length is not an integer' $Record};try{$length=[int64]$Record.length}catch{Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'A pinned manifest length is outside Int64' $Record};if($length-lt0){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'A pinned manifest length is negative' $Record}
+    [pscustomobject][ordered]@{path=[string]$Record.path;length=$length;sha256=[string]$Record.sha256}
+}
+
+function Get-CcodGenerationReclamationRuntimeId {
+    param([Parameter(Mandatory)][string]$ProjectVersion,[Parameter(Mandatory)][object[]]$Records,[Parameter(Mandatory)][string]$Nonce)
+    if($ProjectVersion-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,45}$'-or$Nonce-cnotmatch'^[0-9a-f]{32}$'){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned manifest identity components are invalid' $ProjectVersion};$lines=[Collections.Generic.List[string]]::new();foreach($record in $Records){$lines.Add(('{0}`t{1}`t{2}'-f$record.path,[int64]$record.length,$record.sha256))};$sha=[Security.Cryptography.SHA256]::Create();try{$digest=[BitConverter]::ToString($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes(($lines-join"`n")))).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()};'{0}-{1}-{2}'-f$ProjectVersion,$digest.Substring(0,16),$Nonce
+}
+
+function Assert-CcodGenerationReclamationSnapshot {
+    param([Parameter(Mandatory)]$Snapshot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)][string]$ExpectedManifestSha256)
+    $files=@($Snapshot.Files);$manifestFile=@($files|Where-Object{$_.Path-ceq'manifest.json'});if($manifestFile.Count-ne1-or[string]$manifestFile[0].Sha256-cne$ExpectedManifestSha256){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned manifest hash does not match the durable binding' $RuntimeId}
+    try{$json=[string]$Snapshot.ManifestText;if(-not(Test-CcodGenerationReclamationJsonHasNoDuplicateProperties $json)){throw 'duplicate properties'};$manifest=$json|ConvertFrom-Json -ErrorAction Stop}catch{Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned manifest JSON is malformed or ambiguous' $RuntimeId}
+    if(-not(Test-CcodGenerationReclamationExactProperties $manifest @('schemaVersion','projectVersion','runtimeId','files'))-or$manifest.schemaVersion-isnot[int]-or$manifest.schemaVersion-ne1-or$manifest.projectVersion-isnot[string]-or$manifest.runtimeId-isnot[string]-or$manifest.runtimeId-cne$RuntimeId-or$null-eq$manifest.files){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned manifest header is invalid' $RuntimeId}
+    $records=[Collections.Generic.List[object]]::new();$previous=$null;foreach($record in @($manifest.files)){$validated=ConvertTo-CcodGenerationReclamationRecord $record;if($null-ne$previous-and[StringComparer]::Ordinal.Compare($previous,$validated.path)-ge0){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned manifest records are not strictly ordered' $RuntimeId};$previous=$validated.path;$records.Add($validated)}
+    $match=[regex]::Match($RuntimeId,'^(?<version>[A-Za-z0-9][A-Za-z0-9._-]{0,45})-(?<digest>[0-9a-f]{16})-(?<nonce>[0-9a-f]{32})$');if(-not$match.Success-or$match.Groups['version'].Value-cne$manifest.projectVersion-or(Get-CcodGenerationReclamationRuntimeId -ProjectVersion $manifest.projectVersion -Records $records.ToArray() -Nonce $match.Groups['nonce'].Value)-cne$RuntimeId){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned manifest is not bound to the selected runtime ID' $RuntimeId}
+    $expectedFiles=[Collections.Generic.List[object]]::new();foreach($record in $records){$expectedFiles.Add($record)};$expectedFiles.Add([pscustomobject]@{path='manifest.json';length=[int64]$manifestFile[0].Length;sha256=[string]$manifestFile[0].Sha256});$expectedFiles.Sort([Comparison[object]]{param($left,$right)[StringComparer]::Ordinal.Compare([string]$left.path,[string]$right.path)})
+    if($files.Count-ne$expectedFiles.Count){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned tree contains an unexpected or missing file' $RuntimeId};for($index=0;$index-lt$files.Count;$index++){$actual=$files[$index];$expected=$expectedFiles[$index];if([string]$actual.Path-cne[string]$expected.path-or[int64]$actual.Length-ne[int64]$expected.length-or[string]$actual.Sha256-cne[string]$expected.sha256){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned tree differs from its sealed manifest' $actual.Path}}
+    $expectedDirectories=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal);foreach($record in $records){$segments=[string]$record.path-split'/';for($count=1;$count-lt$segments.Count;$count++){[void]$expectedDirectories.Add(($segments[0..($count-1)]-join'/'))}};$expectedDirectoryList=@($expectedDirectories);[Array]::Sort($expectedDirectoryList,[StringComparer]::Ordinal);$actualDirectories=@($Snapshot.Directories);if($actualDirectories.Count-ne$expectedDirectoryList.Count){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned tree contains an unexpected or missing directory' $RuntimeId};for($index=0;$index-lt$actualDirectories.Count;$index++){if([string]$actualDirectories[$index]-cne[string]$expectedDirectoryList[$index]){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned directory set differs from the sealed manifest' $actualDirectories[$index]}}
+    [pscustomobject]@{FileCount=$files.Count;DirectoryCount=$actualDirectories.Count+1}
+}
+
+function Remove-CcodVerifiedGenerationTree {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string]$InstallRoot,
+        [Parameter(Mandatory)][string]$RuntimeRoot,
+        [Parameter(Mandatory)][string]$RuntimeId,
+        [Parameter(Mandatory)][string]$ExpectedManifestSha256
+    )
+    try{$install=[IO.Path]::GetFullPath($InstallRoot).TrimEnd('\');$runtime=[IO.Path]::GetFullPath($RuntimeRoot).TrimEnd('\')}catch{Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Generation reclamation paths are invalid' $RuntimeRoot}
+    if(-not[IO.Path]::IsPathRooted($InstallRoot)-or-not[IO.Path]::IsPathRooted($RuntimeRoot)-or$RuntimeId-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$'-or$RuntimeId-in@('.','..')-or$RuntimeId.EndsWith('.')-or$ExpectedManifestSha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Generation reclamation inputs are invalid' $RuntimeRoot}
+    $expected=[IO.Path]::GetFullPath((Join-Path (Join-Path $install 'runtime') $RuntimeId)).TrimEnd('\');if($runtime-cne$expected){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Runtime root is not the exact selected install generation leaf' $RuntimeRoot}
+    Initialize-CcodGenerationReclamationRuntime;$native=$null
+    try{
+        $native=Invoke-CcodGenerationReclamationStatic -Name Open -Arguments @($install,$runtime,$RuntimeId);$snapshot=Invoke-CcodGenerationReclamationMethod -Runtime $native -Name Snapshot -Arguments @();$proof=Assert-CcodGenerationReclamationSnapshot -Snapshot $snapshot -RuntimeId $RuntimeId -ExpectedManifestSha256 $ExpectedManifestSha256
+        if($script:CcodGenerationReclamationBeforeArmForTest-is[scriptblock]){&$script:CcodGenerationReclamationBeforeArmForTest}
+        [void](Invoke-CcodGenerationReclamationMethod -Runtime $native -Name Reclaim -Arguments @([int]$script:CcodGenerationReclamationFailFileArmAtForTest,[int]$script:CcodGenerationReclamationFailCommitAtForTest))
+        [pscustomobject][ordered]@{phase='Completed';result='Reclaimed';runtimeId=$RuntimeId;fileCount=[int]$proof.FileCount;directoryCount=[int]$proof.DirectoryCount}
+    }catch{
+        $exception=$_.Exception;while($null-ne$exception.InnerException-and$exception-is[Management.Automation.RuntimeException]){$exception=$exception.InnerException};$type=[string]$exception.GetType().Name
+        if($type-ceq'CcodGenerationReclamationRollbackException'){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_ROLLBACK_FAILED' $exception.Message $RuntimeRoot}
+        if($type-ceq'CcodGenerationReclamationCommitException'){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_COMMIT_FAILED' $exception.Message $RuntimeRoot}
+        if(([string]$_.FullyQualifiedErrorId-split',')[0]-match'^CCOD_GENERATION_RECLAMATION_'){throw}
+        Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' ('PinnedValidated generation reclamation rejected: '+$exception.Message) $RuntimeRoot
+    }finally{if($null-ne$native){try{$native.Dispose()}catch{}}}
+}
+
+Export-ModuleMember -Function Remove-CcodVerifiedGenerationTree
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index 92dbd8f..6bdb120 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -913,4 +913,17 @@ Invoke-CcodTest 'retirement collision and record I/O failure leave generation el
     }
 }
 
+Invoke-CcodTest 'handle-pinned reclamation deletes an exact readonly immutable generation and nothing outside it' {
+    $reclamationPath=Join-Path $projectRoot 'src\persistence\modules\GenerationReclamation.psm1'
+    if(-not(Test-Path -LiteralPath $reclamationPath -PathType Leaf)){throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new('generation reclamation module is missing'),'CCOD_RECLAMATION_RED_MODULE_MISSING',[Management.Automation.ErrorCategory]::ObjectNotFound,$reclamationPath)}
+    Import-Module (Join-Path $projectRoot 'src\persistence\modules\RuntimeManifest.psm1') -Force -DisableNameChecking
+    Import-Module $reclamationPath -Force -DisableNameChecking
+    $fixture=New-CcodInstallFileFixture
+    try{
+        $source=New-CcodSourceFile $fixture 'reclaim-source.bin' 'immutable-generation-reclamation';$record=[ordered]@{path='nested/payload.bin';length=$source.Length;sha256=$source.Sha256};$runtimeId=Get-CcodRuntimeId -ProjectVersion '2.5.22' -Files @($record) -Nonce '0123456789abcdef0123456789abcdef';$generation=Open-CcodFixtureGeneration $fixture $runtimeId;$nested=New-CcodInstallGenerationLeaf -Generation $generation -Leaf 'nested';Copy-CcodInstallSealedSource -Generation $nested -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null;$manifest=Write-CcodInstallGenerationManifest -Generation $generation -Manifest ([ordered]@{schemaVersion=1;projectVersion='2.5.22';runtimeId=$runtimeId;files=@($record)});Close-CcodInstallFileTransaction -Transaction $generation -Disposition Ready|Out-Null
+        $runtimeRoot=Join-Path $fixture.Install "runtime\$runtimeId";Assert-CcodTrue (([IO.File]::GetAttributes((Join-Path $runtimeRoot 'nested\payload.bin'))-band[IO.FileAttributes]::ReadOnly)-ne0) 'fixture consumes the real immutable readonly leaf shape';$result=Remove-CcodVerifiedGenerationTree -InstallRoot $fixture.Install -RuntimeRoot $runtimeRoot -RuntimeId $runtimeId -ExpectedManifestSha256 $manifest.Sha256
+        Assert-CcodEqual 'Completed' $result.phase 'immutable reclamation reaches terminal phase';Assert-CcodEqual 'Reclaimed' $result.result 'immutable reclamation reports exact result';Assert-CcodEqual 2 $result.fileCount 'manifest plus one sealed file were reclaimed';Assert-CcodTrue (-not(Test-Path -LiteralPath $runtimeRoot)) 'exact immutable generation is absent';Assert-CcodTrue (Test-Path -LiteralPath $fixture.Install -PathType Container) 'install root remains';Assert-CcodOutsideUnchanged $fixture 'immutable reclamation'
+    }finally{Remove-CcodInstallFileFixture $fixture}
+}
+
 Write-Host 'Install file transaction self-test passed.' -ForegroundColor Green
diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index 00ec5b2..90fa73e 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -176,6 +176,7 @@ function New-CcodVerifiedUninstallRuntimeFixture {
         'src/persistence/UninstallBootstrap.ps1',
         'src/persistence/PortableUninstallFinalizer.ps1',
         'src/persistence/InstalledUninstallFinalizer.ps1',
+        'src/persistence/modules/GenerationReclamation.psm1',
         'src/persistence/modules/InstallLifecycle.psm1',
         'src/persistence/modules/ProductRegistration.psm1',
         'src/persistence/modules/PortableRelease.psm1',
@@ -227,7 +228,7 @@ $results += Invoke-CcodTest 'Prepare stages only the manifest-bound cleanup payl
     Assert-CcodEqual 'ReadyForInno' $receipt.phase 'verified cleanup reaches the Inno boundary'
     Assert-CcodEqual 'Validate,GetRoot,Read,NewId,Create,Write:Requested,Publish,Stage,Cleanup,Write:ReadyForInno,RemoveProduct,Receipt:ReadyForInno' ($world.Calls -join ',') 'Prepare removes only verified product registration after protected application cleanup'
     Assert-CcodEqual 1 $world.ProductRegistrationRemovals 'verified uninstall removes current product registration exactly once'
-    Assert-CcodEqual 'src/persistence/UninstallBootstrap.ps1,src/persistence/PortableUninstallFinalizer.ps1,src/persistence/InstalledUninstallFinalizer.ps1,src/persistence/modules/InstallLifecycle.psm1,src/persistence/modules/ProductRegistration.psm1,src/persistence/modules/PortableRelease.psm1,src/persistence/modules/PersistenceIO.psm1,src/persistence/modules/RuntimeManifest.psm1,src/persistence/modules/LifecycleEpoch.psm1,src/persistence/modules/StateStore.psm1,src/persistence/modules/TrustedLogonIdentity.psm1,src/persistence/modules/ScheduledTask.psm1,src/persistence/modules/KernelObjects.psm1,src/persistence/modules/CompatibilityProbe.psm1,src/persistence/modules/UiPreferences.psm1,src/persistence/modules/LifecycleTransaction.psm1' ($world.StagedEntries -join ',') 'staging has only bounded cleanup code and no device-key material'
+    Assert-CcodEqual 'src/persistence/UninstallBootstrap.ps1,src/persistence/PortableUninstallFinalizer.ps1,src/persistence/InstalledUninstallFinalizer.ps1,src/persistence/modules/GenerationReclamation.psm1,src/persistence/modules/InstallLifecycle.psm1,src/persistence/modules/ProductRegistration.psm1,src/persistence/modules/PortableRelease.psm1,src/persistence/modules/PersistenceIO.psm1,src/persistence/modules/RuntimeManifest.psm1,src/persistence/modules/LifecycleEpoch.psm1,src/persistence/modules/StateStore.psm1,src/persistence/modules/TrustedLogonIdentity.psm1,src/persistence/modules/ScheduledTask.psm1,src/persistence/modules/KernelObjects.psm1,src/persistence/modules/CompatibilityProbe.psm1,src/persistence/modules/UiPreferences.psm1,src/persistence/modules/LifecycleTransaction.psm1' ($world.StagedEntries -join ',') 'staging has only bounded cleanup code and no device-key material'
     Assert-CcodEqual $null $receipt.errorCode 'ReadyForInno carries no failure code'
 }
 
@@ -242,7 +243,7 @@ $results += Invoke-CcodTest 'production runtime verification binds the installed
         Assert-CcodEqual $fixture.RuntimeId $context.runtimeId 'verified context binds the active manifest runtime'
         Assert-CcodEqual ([uint64]7) ([uint64]$context.runtimeGeneration) 'verified context binds active generation'
         Assert-CcodEqual ([uint64]11) ([uint64]$context.leaseEpoch) 'verified context binds lifecycle epoch'
-        Assert-CcodEqual 16 @($context.payloadRecords).Count 'only the cleanup entry, two bounded finalizers, matched registration module, and imported modules are staged'
+        Assert-CcodEqual 17 @($context.payloadRecords).Count 'only the cleanup entry, two bounded finalizers, bounded reclamation, matched registration module, and imported modules are staged'
         [IO.File]::AppendAllText((Join-Path $fixture.RuntimeRoot 'src\persistence\modules\InstallLifecycle.psm1'),'# altered',[Text.UTF8Encoding]::new($false))
         Assert-CcodThrows { Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $installRoot | Out-Null } 'CCOD_UNINSTALL_RUNTIME_INVALID'
     } finally {
@@ -345,7 +346,7 @@ $results += Invoke-CcodTest 'real external staging uses a protected current-user
         $payloadRoot = Join-Path $transactionDirectory 'payload'
         Assert-CcodUninstallBootstrapDirectoryAcl -Path $payloadRoot -UserSid $context.userSid
         $payloadFiles = @(Get-ChildItem -LiteralPath $payloadRoot -Recurse -File -Force)
-        Assert-CcodEqual 16 $payloadFiles.Count 'external payload contains the exact cleanup entry, two bounded finalizers, matched registration module, and required modules'
+        Assert-CcodEqual 17 $payloadFiles.Count 'external payload contains the exact cleanup entry, two bounded finalizers, bounded reclamation, matched registration module, and required modules'
         foreach ($record in @($context.payloadRecords)) {
             $entry = [string]$record.path
             $source = Join-Path $fixture.RuntimeRoot ($entry.Replace('/','\'))
@@ -639,10 +640,102 @@ $results += Invoke-CcodTest 'fresh and stored Ready evidence require one exact c
 $results += Invoke-CcodTest 'default installed finalizer validates and removes only the exact selected generation fixture' {
     $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-installed-finalizer-'+[guid]::NewGuid().ToString('N'));$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
     try{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$install=Join-Path $local 'CodexControlOtherDevices';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$identity=Get-CcodUninstallBootstrapCurrentIdentity;$transactionRoot=Get-CcodUninstallBootstrapDefaultTransactionRoot;$id='11111111-2222-3333-4444-555555555555';$directory=New-CcodUninstallBootstrapTransactionDirectory -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid;$tx=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$tx.runtimeId=$fixture.RuntimeId;$tx.runtimeGeneration=[uint64]7;$tx.userSid=$identity.userSid;$tx.sessionId=$identity.sessionId;$tx.readyEvidence.runtimeId=$fixture.RuntimeId;$tx.readyEvidence.runtimeGeneration=[uint64]7;$tx.readyEvidence.installRoot=$install;$manifest=(Get-FileHash (Join-Path $fixture.RuntimeRoot 'manifest.json') -Algorithm SHA256).Hash.ToLowerInvariant();$tx.readyEvidence.manifestSha256=$manifest;$tx.installedBinding=[pscustomobject][ordered]@{selectedRuntimeRoot=$fixture.RuntimeRoot;runtimeManifestSha256=$manifest;wrapperPid=42;wrapperCreationTimeUtc='2030-02-03T03:04:05.0000000Z';wrapperSessionId=$identity.sessionId;wrapperUserSid=$identity.userSid};Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory $directory -Transaction $tx;Publish-CcodUninstallBootstrapCurrentTransaction -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid
-        $payload=Join-Path $directory 'payload';[IO.Directory]::CreateDirectory((Join-Path $payload 'src\persistence'))|Out-Null;Copy-Item $bootstrapScript (Join-Path $payload 'src\persistence\UninstallBootstrap.ps1');$adapters=Get-CcodInstalledFinalizerAdapters -Adapters @{WaitWrapperExit={param($I,$T)[pscustomobject]@{verifiedAtStart=$true;exited=$true}};RemoveMatchedProductRegistration={param($T)};FinalizeReceipt={param($T)[pscustomobject]@{phase='Completed'}}} -TransactionRoot $transactionRoot -PayloadRoot $payload;$receipt=Invoke-CcodInstalledUninstallFinalizer -TransactionId $id -RuntimeRoot $fixture.RuntimeRoot -InstallRoot $install -WrapperIdentity ([pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=$identity.sessionId;userSid=$identity.userSid}) -Adapters $adapters;Assert-CcodEqual 'Completed' $receipt.phase 'default finalizer reaches completion';Assert-CcodTrue (-not(Test-Path $fixture.RuntimeRoot)) 'default finalizer deletes exact selected runtime';Assert-CcodTrue (Test-Path (Join-Path $install 'state')) 'default finalizer preserves sibling install state'
+        $payload=Join-Path $directory 'payload';foreach($relative in @('src\persistence\UninstallBootstrap.ps1','src\persistence\modules\GenerationReclamation.psm1')){$destination=Join-Path $payload $relative;[IO.Directory]::CreateDirectory((Split-Path $destination -Parent))|Out-Null;[IO.File]::Copy((Join-Path $repositoryRoot $relative),$destination,$true)};$adapters=Get-CcodInstalledFinalizerAdapters -Adapters @{WaitWrapperExit={param($I,$T)[pscustomobject]@{verifiedAtStart=$true;exited=$true}};RemoveMatchedProductRegistration={param($T)};FinalizeReceipt={param($T)[pscustomobject]@{phase='Completed'}}} -TransactionRoot $transactionRoot -PayloadRoot $payload;$receipt=Invoke-CcodInstalledUninstallFinalizer -TransactionId $id -RuntimeRoot $fixture.RuntimeRoot -InstallRoot $install -WrapperIdentity ([pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=$identity.sessionId;userSid=$identity.userSid}) -Adapters $adapters;Assert-CcodEqual 'Completed' $receipt.phase 'default finalizer reaches completion';Assert-CcodTrue (-not(Test-Path $fixture.RuntimeRoot)) 'default finalizer deletes exact selected runtime';Assert-CcodTrue (Test-Path (Join-Path $install 'state')) 'default finalizer preserves sibling install state'
     }finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $local){Remove-Item $local -Recurse -Force}}
 }
 
+function Invoke-CcodInstalledReclamationMutationCase {
+    param([Parameter(Mandatory)][ValidateSet('UnexpectedFile','UnexpectedDirectory','Reparse','Hardlink','Ads','OpenChild')][string]$Mutation)
+    $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-installed-reclamation-red-'+[guid]::NewGuid().ToString('N'));$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process');$attackState=[pscustomobject]@{Path=$null;OpenHandle=$null}
+    try{
+        [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$install=Join-Path $local 'CodexControlOtherDevices';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly
+        $originalFiles=@(Get-ChildItem -LiteralPath $fixture.RuntimeRoot -File -Recurse -Force|ForEach-Object{[pscustomobject]@{Path=$_.FullName;Length=[int64]$_.Length;Sha256=Get-CcodTestFileSha256 $_.FullName}});$originalDirectories=@(Get-ChildItem -LiteralPath $fixture.RuntimeRoot -Directory -Recurse -Force|ForEach-Object FullName)
+        $outside=Join-Path $local 'outside';[IO.Directory]::CreateDirectory($outside)|Out-Null;$outsideSentinel=Join-Path $outside 'sentinel.bin';[IO.File]::WriteAllText($outsideSentinel,'outside-preserved',[Text.UTF8Encoding]::new($false));$outsideHash=Get-CcodTestFileSha256 $outsideSentinel
+        $sibling=Join-Path $install 'runtime\sibling-generation';[IO.Directory]::CreateDirectory($sibling)|Out-Null;$siblingSentinel=Join-Path $sibling 'sentinel.bin';[IO.File]::WriteAllText($siblingSentinel,'sibling-preserved',[Text.UTF8Encoding]::new($false));$siblingHash=Get-CcodTestFileSha256 $siblingSentinel
+        $deviceKey=Join-Path $install 'state\device-key\private.bin';[IO.Directory]::CreateDirectory((Split-Path $deviceKey -Parent))|Out-Null;[IO.File]::WriteAllText($deviceKey,'dpapi-sentinel-preserved',[Text.UTF8Encoding]::new($false));$deviceKeyHash=Get-CcodTestFileSha256 $deviceKey
+        $identity=Get-CcodUninstallBootstrapCurrentIdentity;$transactionRoot=Get-CcodUninstallBootstrapDefaultTransactionRoot;$id=[guid]::NewGuid().ToString('D');$directory=New-CcodUninstallBootstrapTransactionDirectory -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid
+        $tx=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved' -TransactionId $id;$tx.runtimeId=$fixture.RuntimeId;$tx.runtimeGeneration=[uint64]7;$tx.userSid=$identity.userSid;$tx.sessionId=$identity.sessionId;$tx.readyEvidence.runtimeId=$fixture.RuntimeId;$tx.readyEvidence.runtimeGeneration=[uint64]7;$tx.readyEvidence.installRoot=$install;$manifest=(Get-FileHash (Join-Path $fixture.RuntimeRoot 'manifest.json') -Algorithm SHA256).Hash.ToLowerInvariant();$tx.readyEvidence.manifestSha256=$manifest;$tx.installedBinding=[pscustomobject][ordered]@{selectedRuntimeRoot=$fixture.RuntimeRoot;runtimeManifestSha256=$manifest;wrapperPid=42;wrapperCreationTimeUtc='2030-02-03T03:04:05.0000000Z';wrapperSessionId=$identity.sessionId;wrapperUserSid=$identity.userSid};Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory $directory -Transaction $tx
+        $payload=Join-Path $directory 'payload';[IO.Directory]::CreateDirectory((Join-Path $payload 'src\persistence'))|Out-Null;[IO.File]::Copy($bootstrapScript,(Join-Path $payload 'src\persistence\UninstallBootstrap.ps1'),$true);$reclamationSource=Join-Path $repositoryRoot 'src\persistence\modules\GenerationReclamation.psm1';if(Test-Path -LiteralPath $reclamationSource -PathType Leaf){$reclamationDestination=Join-Path $payload 'src\persistence\modules\GenerationReclamation.psm1';[IO.Directory]::CreateDirectory((Split-Path $reclamationDestination -Parent))|Out-Null;[IO.File]::Copy($reclamationSource,$reclamationDestination,$true)}
+        $adapters=Get-CcodInstalledFinalizerAdapters -Adapters $null -TransactionRoot $transactionRoot -PayloadRoot $payload;$validate=$adapters.ValidateSelectedGeneration;$anchor=Join-Path $fixture.RuntimeRoot 'manifest.json'
+        $adapters.WaitWrapperExit={param($I,$T)[pscustomobject]@{verifiedAtStart=$true;exited=$true}};$adapters.ReadPreparedTransaction={param($Id,$Root)$tx}.GetNewClosure();$adapters.ReadCurrentEpoch={param($Root)[uint64]11};$adapters.ValidateSelectedGeneration={param($Root,$Install,$Transaction);$valid=&$validate $Root $Install $Transaction;if(-not$valid){return $false};switch($Mutation){'UnexpectedFile'{$attackState.Path=Join-Path $Root 'unexpected-after-validation.bin';[IO.File]::WriteAllText($attackState.Path,'hostile',[Text.UTF8Encoding]::new($false))}'UnexpectedDirectory'{$attackState.Path=Join-Path $Root 'unexpected-empty-directory';[IO.Directory]::CreateDirectory($attackState.Path)|Out-Null}'Reparse'{$attackState.Path=Join-Path $Root 'unexpected-reparse';New-Item -ItemType Junction -Path $attackState.Path -Target $outside|Out-Null}'Hardlink'{$attackState.Path=Join-Path $Root 'unexpected-hardlink.bin';New-Item -ItemType HardLink -Path $attackState.Path -Target $outsideSentinel|Out-Null}'Ads'{$attackState.Path=$anchor;$attributes=[IO.File]::GetAttributes($anchor);[IO.File]::SetAttributes($anchor,[IO.FileAttributes]::Normal);try{Set-Content -LiteralPath $anchor -Stream 'ccod-evidence' -Value 'hostile' -NoNewline}finally{[IO.File]::SetAttributes($anchor,$attributes)}}'OpenChild'{$attackState.Path=$anchor;$attackState.OpenHandle=[IO.File]::Open($anchor,[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read)}};return $true}.GetNewClosure();$adapters.RemoveMatchedProductRegistration={param($T)};$adapters.FinalizeReceipt={param($T)[pscustomobject]@{phase='Completed'}}
+        $failure=$null;try{Invoke-CcodInstalledUninstallFinalizer -TransactionId $id -RuntimeRoot $fixture.RuntimeRoot -InstallRoot $install -WrapperIdentity ([pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=$identity.sessionId;userSid=$identity.userSid}) -Adapters $adapters|Out-Null}catch{$failure=$_}
+        $treeComplete=(Test-Path -LiteralPath $fixture.RuntimeRoot -PathType Container);if($treeComplete){foreach($directoryPath in $originalDirectories){if(-not(Test-Path -LiteralPath $directoryPath -PathType Container)){$treeComplete=$false;break}}};if($treeComplete){foreach($fileProof in $originalFiles){if(-not(Test-Path -LiteralPath $fileProof.Path -PathType Leaf)-or[int64](Get-Item -LiteralPath $fileProof.Path -Force).Length-ne$fileProof.Length-or(Get-CcodTestFileSha256 $fileProof.Path)-cne$fileProof.Sha256){$treeComplete=$false;break}}}
+        if($null-eq$failure-or-not$treeComplete){throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new("pathname reclamation accepted or partially deleted the $Mutation tree"),'CCOD_RECLAMATION_RED_PATHNAME_DELETE',[Management.Automation.ErrorCategory]::InvalidData,$fixture.RuntimeRoot)}
+        if(([string]$failure.FullyQualifiedErrorId-split',')[0]-cne'CCOD_GENERATION_RECLAMATION_INVALID'){throw $failure}
+        Assert-CcodEqual $outsideHash (Get-CcodTestFileSha256 $outsideSentinel) "$Mutation preserves outside bytes";Assert-CcodEqual $siblingHash (Get-CcodTestFileSha256 $siblingSentinel) "$Mutation preserves sibling generation bytes";Assert-CcodEqual $deviceKeyHash (Get-CcodTestFileSha256 $deviceKey) "$Mutation preserves device-key bytes"
+        if($Mutation-ceq'Ads'){Assert-CcodTrue ($null-ne(Get-Item -LiteralPath $attackState.Path -Stream 'ccod-evidence' -ErrorAction SilentlyContinue)) 'ADS hostile object remains after zero deletion'}else{Assert-CcodTrue (Test-Path -LiteralPath $attackState.Path) "$Mutation hostile object remains after zero deletion"}
+    }finally{if($null-ne$attackState.OpenHandle){$attackState.OpenHandle.Dispose()};[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path -LiteralPath $local){Remove-Item -LiteralPath $local -Recurse -Force}}
+}
+
+# Production mutation caught: validation and deletion must remain bound across every hostile
+# namespace/object change, including an already-open manifest child.
+foreach($reclamationMutation in @('UnexpectedFile','UnexpectedDirectory','Reparse','Hardlink','Ads','OpenChild')){
+    if(-not[string]::IsNullOrWhiteSpace($env:CCOD_RECLAMATION_RED_CASE)-and$env:CCOD_RECLAMATION_RED_CASE-cne$reclamationMutation){continue}
+    $caseName=$reclamationMutation
+    $results += Invoke-CcodTest "installed finalizer rejects post-validation $caseName without deleting any generation state" {Invoke-CcodInstalledReclamationMutationCase -Mutation $caseName}
+}
+
+function Get-CcodGenerationReclamationTreeProof {
+    param([Parameter(Mandatory)][string]$Root)
+    [pscustomobject]@{
+        Root=[IO.Path]::GetFullPath($Root)
+        Directories=@(Get-ChildItem -LiteralPath $Root -Directory -Recurse -Force|ForEach-Object FullName)
+        Files=@(Get-ChildItem -LiteralPath $Root -File -Recurse -Force|ForEach-Object{[pscustomobject]@{Path=$_.FullName;Length=[int64]$_.Length;Sha256=Get-CcodTestFileSha256 $_.FullName}})
+    }
+}
+
+function Assert-CcodGenerationReclamationTreeProof {
+    param([Parameter(Mandatory)]$Proof,[Parameter(Mandatory)][string]$Message)
+    Assert-CcodTrue (Test-Path -LiteralPath $Proof.Root -PathType Container) "$Message root"
+    foreach($path in @($Proof.Directories)){Assert-CcodTrue (Test-Path -LiteralPath $path -PathType Container) "$Message directory $path"}
+    foreach($file in @($Proof.Files)){Assert-CcodTrue (Test-Path -LiteralPath $file.Path -PathType Leaf) "$Message file $($file.Path)";Assert-CcodEqual $file.Length ([int64](Get-Item -LiteralPath $file.Path -Force).Length) "$Message length $($file.Path)";Assert-CcodEqual $file.Sha256 (Get-CcodTestFileSha256 $file.Path) "$Message hash $($file.Path)"}
+}
+
+if([string]::IsNullOrWhiteSpace($env:CCOD_RECLAMATION_RED_CASE)-or$env:CCOD_RECLAMATION_RED_CASE-ceq'IdentityChange'){
+    $results += Invoke-CcodTest 'generation reclamation pins the selected identity before the final pre-delete hook' {
+        $modulePath=Join-Path $repositoryRoot 'src\persistence\modules\GenerationReclamation.psm1';if(-not(Test-Path -LiteralPath $modulePath -PathType Leaf)){throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new('generation reclamation module is missing'),'CCOD_RECLAMATION_RED_MODULE_MISSING',[Management.Automation.ErrorCategory]::ObjectNotFound,$modulePath)};$module=Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-reclamation-identity-'+[guid]::NewGuid().ToString('N'))
+        try{
+            $install=Join-Path $local 'install';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$proof=Get-CcodGenerationReclamationTreeProof $fixture.RuntimeRoot;$manifest=Get-CcodTestFileSha256 (Join-Path $fixture.RuntimeRoot 'manifest.json')
+            $replacement=Join-Path $local 'replacement-generation';Copy-Item -LiteralPath $fixture.RuntimeRoot -Destination $replacement -Recurse -Force;$replacementProof=Get-CcodGenerationReclamationTreeProof $replacement;$parked=Join-Path $local 'original-generation';$attack=[pscustomobject]@{Result=$null}
+            $hook={try{[IO.Directory]::Move($fixture.RuntimeRoot,$parked);[IO.Directory]::Move($replacement,$fixture.RuntimeRoot);$attack.Result='exchanged'}catch [IO.IOException]{$attack.Result='blocked'}catch [UnauthorizedAccessException]{$attack.Result='blocked'};throw [InvalidOperationException]::new('identity replacement probe')}.GetNewClosure()
+            &$module {param($Value)$script:CcodGenerationReclamationBeforeArmForTest=$Value} $hook
+            try{Assert-CcodThrows {Remove-CcodVerifiedGenerationTree -InstallRoot $install -RuntimeRoot $fixture.RuntimeRoot -RuntimeId $fixture.RuntimeId -ExpectedManifestSha256 $manifest|Out-Null} 'CCOD_GENERATION_RECLAMATION_INVALID'}finally{&$module {$script:CcodGenerationReclamationBeforeArmForTest=$null}}
+            Assert-CcodEqual 'blocked' $attack.Result 'pinned selected root rejects identity replacement';Assert-CcodGenerationReclamationTreeProof $proof 'identity replacement failure preserves selected tree';Assert-CcodGenerationReclamationTreeProof $replacementProof 'identity replacement failure preserves outside replacement tree';Assert-CcodTrue (-not(Test-Path -LiteralPath $parked)) 'identity replacement creates no renamed selected alias'
+        }finally{if(Test-Path -LiteralPath $local){Remove-Item -LiteralPath $local -Recurse -Force}}
+    }
+}
+
+if([string]::IsNullOrWhiteSpace($env:CCOD_RECLAMATION_RED_CASE)-or$env:CCOD_RECLAMATION_RED_CASE-ceq'MarkFailure'){
+    $results += Invoke-CcodTest 'file-arm failure disarms every held identity validates the complete tree and permits an exact retry' {
+        $modulePath=Join-Path $repositoryRoot 'src\persistence\modules\GenerationReclamation.psm1';if(-not(Test-Path -LiteralPath $modulePath -PathType Leaf)){throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new('generation reclamation module is missing'),'CCOD_RECLAMATION_RED_MODULE_MISSING',[Management.Automation.ErrorCategory]::ObjectNotFound,$modulePath)};$module=Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-reclamation-disarm-'+[guid]::NewGuid().ToString('N'))
+        try{
+            $install=Join-Path $local 'install';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$proof=Get-CcodGenerationReclamationTreeProof $fixture.RuntimeRoot;$manifest=Get-CcodTestFileSha256 (Join-Path $fixture.RuntimeRoot 'manifest.json');$sibling=Join-Path $install 'runtime\sibling';[IO.Directory]::CreateDirectory($sibling)|Out-Null;$siblingFile=Join-Path $sibling 'sentinel.bin';[IO.File]::WriteAllText($siblingFile,'sibling',[Text.UTF8Encoding]::new($false));$siblingHash=Get-CcodTestFileSha256 $siblingFile;$deviceKey=Join-Path $install 'state\device-key\private.bin';[IO.Directory]::CreateDirectory((Split-Path $deviceKey -Parent))|Out-Null;[IO.File]::WriteAllText($deviceKey,'device-key',[Text.UTF8Encoding]::new($false));$deviceKeyHash=Get-CcodTestFileSha256 $deviceKey
+            &$module {$script:CcodGenerationReclamationFailFileArmAtForTest=2}
+            try{Assert-CcodThrows {Remove-CcodVerifiedGenerationTree -InstallRoot $install -RuntimeRoot $fixture.RuntimeRoot -RuntimeId $fixture.RuntimeId -ExpectedManifestSha256 $manifest|Out-Null} 'CCOD_GENERATION_RECLAMATION_INVALID'}finally{&$module {$script:CcodGenerationReclamationFailFileArmAtForTest=-1}}
+            Assert-CcodGenerationReclamationTreeProof $proof 'file-arm rollback preserves the complete selected tree';Assert-CcodEqual $siblingHash (Get-CcodTestFileSha256 $siblingFile) 'file-arm rollback preserves sibling';Assert-CcodEqual $deviceKeyHash (Get-CcodTestFileSha256 $deviceKey) 'file-arm rollback preserves device-key state'
+            $result=Remove-CcodVerifiedGenerationTree -InstallRoot $install -RuntimeRoot $fixture.RuntimeRoot -RuntimeId $fixture.RuntimeId -ExpectedManifestSha256 $manifest;Assert-CcodEqual 'Completed' $result.phase 'successful retry reaches terminal reclamation phase';Assert-CcodEqual 'Reclaimed' $result.result 'successful retry reports exact reclamation';Assert-CcodTrue (-not(Test-Path -LiteralPath $fixture.RuntimeRoot)) 'successful retry removes only selected generation';Assert-CcodEqual $siblingHash (Get-CcodTestFileSha256 $siblingFile) 'successful retry preserves sibling';Assert-CcodEqual $deviceKeyHash (Get-CcodTestFileSha256 $deviceKey) 'successful retry preserves device-key state';Assert-CcodTrue (Test-Path -LiteralPath $install -PathType Container) 'successful retry preserves install root'
+        }finally{if(Test-Path -LiteralPath $local){Remove-Item -LiteralPath $local -Recurse -Force}}
+    }
+}
+
+if([string]::IsNullOrWhiteSpace($env:CCOD_RECLAMATION_RED_CASE)-or$env:CCOD_RECLAMATION_RED_CASE-ceq'CommitFailure'){
+    $results += Invoke-CcodTest 'irreversible reclamation failure reports CommitStarted and never touches sibling or lifecycle state' {
+        $modulePath=Join-Path $repositoryRoot 'src\persistence\modules\GenerationReclamation.psm1';$module=Import-Module $modulePath -Force -PassThru -DisableNameChecking;$local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-reclamation-commit-failure-'+[guid]::NewGuid().ToString('N'))
+        try{
+            $install=Join-Path $local 'install';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$proof=Get-CcodGenerationReclamationTreeProof $fixture.RuntimeRoot;$manifest=Get-CcodTestFileSha256 (Join-Path $fixture.RuntimeRoot 'manifest.json');$outside=Join-Path $local 'outside';[IO.Directory]::CreateDirectory($outside)|Out-Null;$outsideFile=Join-Path $outside 'sentinel.bin';[IO.File]::WriteAllText($outsideFile,'outside',[Text.UTF8Encoding]::new($false));$outsideHash=Get-CcodTestFileSha256 $outsideFile;$sibling=Join-Path $install 'runtime\sibling';[IO.Directory]::CreateDirectory($sibling)|Out-Null;$siblingFile=Join-Path $sibling 'sentinel.bin';[IO.File]::WriteAllText($siblingFile,'sibling',[Text.UTF8Encoding]::new($false));$siblingHash=Get-CcodTestFileSha256 $siblingFile;$deviceKey=Join-Path $install 'state\device-key\private.bin';[IO.Directory]::CreateDirectory((Split-Path $deviceKey -Parent))|Out-Null;[IO.File]::WriteAllText($deviceKey,'device-key',[Text.UTF8Encoding]::new($false));$deviceKeyHash=Get-CcodTestFileSha256 $deviceKey
+            &$module {param($Index)$script:CcodGenerationReclamationFailCommitAtForTest=$Index} ($proof.Files.Count+1)
+            try{Assert-CcodThrows {Remove-CcodVerifiedGenerationTree -InstallRoot $install -RuntimeRoot $fixture.RuntimeRoot -RuntimeId $fixture.RuntimeId -ExpectedManifestSha256 $manifest|Out-Null} 'CCOD_GENERATION_RECLAMATION_COMMIT_FAILED'}finally{&$module {$script:CcodGenerationReclamationFailCommitAtForTest=-1}}
+            Assert-CcodTrue (Test-Path -LiteralPath $fixture.RuntimeRoot -PathType Container) 'CommitStarted failure retains a selected-root failure boundary';Assert-CcodEqual $outsideHash (Get-CcodTestFileSha256 $outsideFile) 'CommitStarted failure preserves outside';Assert-CcodEqual $siblingHash (Get-CcodTestFileSha256 $siblingFile) 'CommitStarted failure preserves sibling';Assert-CcodEqual $deviceKeyHash (Get-CcodTestFileSha256 $deviceKey) 'CommitStarted failure preserves lifecycle/device-key state';Assert-CcodTrue (Test-Path -LiteralPath $install -PathType Container) 'CommitStarted failure preserves install root'
+        }finally{if(Test-Path -LiteralPath $local){Remove-Item -LiteralPath $local -Recurse -Force}}
+
+        $calls=[Collections.Generic.List[string]]::new();$tx=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$tx.installedBinding=[pscustomobject][ordered]@{selectedRuntimeRoot='C:\install\runtime\2.5.0-uninstall-test';runtimeManifestSha256=('a'*64);wrapperPid=42;wrapperCreationTimeUtc='2030-02-03T03:04:05.0000000Z';wrapperSessionId=1;wrapperUserSid='S-1-5-21-111-222-333-1001'}
+        $adapters=@{WaitWrapperExit={param($I,$T)[pscustomobject]@{verifiedAtStart=$true;exited=$true}};ReadPreparedTransaction={param($Id,$Root)$tx}.GetNewClosure();ValidateSelectedGeneration={param($Runtime,$Install,$Transaction)$true};ReadCurrentEpoch={param($Root)[uint64]11};RemoveSelectedGeneration={param($Runtime,$Transaction)$calls.Add('Remove');throw [Management.Automation.ErrorRecord]::new([IO.IOException]::new('commit failed'),'CCOD_GENERATION_RECLAMATION_COMMIT_FAILED',[Management.Automation.ErrorCategory]::WriteError,$Runtime)}.GetNewClosure();TestSelectedRootAbsent={param($Root)$calls.Add('Absent');$false}.GetNewClosure();RemoveMatchedProductRegistration={param($Transaction)$calls.Add('Product')}.GetNewClosure();FinalizeReceipt={param($Transaction)$calls.Add('Finalize');[pscustomobject]@{phase='Completed'}}.GetNewClosure()}
+        Assert-CcodThrows {Invoke-CcodInstalledUninstallFinalizer -TransactionId $tx.transactionId -RuntimeRoot $tx.installedBinding.selectedRuntimeRoot -InstallRoot 'C:\install' -WrapperIdentity ([pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=1;userSid='S-1-5-21-111-222-333-1001'}) -Adapters $adapters|Out-Null} 'CCOD_GENERATION_RECLAMATION_COMMIT_FAILED';Assert-CcodEqual 'Remove' ($calls-join',') 'CommitStarted failure reaches no absence proof product removal or completion receipt'
+    }
+}
+
 function Invoke-CcodDefaultInstalledFinalizerNegative {
     param([Parameter(Mandatory)][ValidateSet('Sibling','WrongPath','StaleEpoch','WrapperIdentity','WrongReadyRoot','ExtraReadyField')][string]$Mutation)
     $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-finalizer-negative-'+[guid]::NewGuid().ToString('N'));$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process');$wrapper=$null

From 6b9bc7ea7a77620feceace447ef56e4fef694ad6 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 03:28:12 +0800
Subject: [PATCH 133/187] docs: record generation reclamation evidence

---
 .../task-3-report.md                          | 144 ++++++++++++++++++
 1 file changed, 144 insertions(+)
 create mode 100644 .superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-3-report.md

diff --git a/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-3-report.md b/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-3-report.md
new file mode 100644
index 0000000..becdbc8
--- /dev/null
+++ b/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/task-3-report.md
@@ -0,0 +1,144 @@
+# Task 3：manifest-bound native generation reclamation 报告
+
+## 结论与范围
+
+Task 3 已在隔离 worktree `codex/v2522-install-runtime-reliability` 中实现，并完成要求的 focused、shared 与 aggregate 验证。
+
+- 基线：`3682b810138ea43127762c92a860d45d96ca3d3d`
+- implementation commit：`1d57736197df0bfcd1c0e54d96be63dfa54602df`
+- 新接口：`Remove-CcodVerifiedGenerationTree -InstallRoot -RuntimeRoot -RuntimeId -ExpectedManifestSha256`
+- 未运行真实安装器，未读写真实安装目录、registry、Start menu、Desktop shortcut、scheduled task、产品进程或真实 DPAPI/device-key store。
+- 未执行 push、tag、release、安装、重启或 reboot。
+- 本报告只声明 Task 3 implementation/verification scope；controller 的独立 scoped review 与最终 whole-plan review 仍是单独 gate。
+
+## 根因与生产改动
+
+原 `InstalledUninstallFinalizer.ps1` 先用路径验证 selected generation，随后重新把权限降级为 pathname，并执行：
+
+```powershell
+Remove-Item -LiteralPath $expected -Recurse -Force
+```
+
+验证与物理删除之间没有持有任何对象身份。树在验证后增加未知对象、发生 identity replacement，或只有一个 child 被其他 handle 打开时，旧实现会整树删除或先部分删除再失败。
+
+新 `GenerationReclamation.psm1` 只导出 `Remove-CcodVerifiedGenerationTree`。其 CLR assembly 只公开 inert `CcodGenerationReclamationMarkerV1`；实际 native runtime 为 internal type。
+
+生产路径现在：
+
+1. 严格校验 canonical `RuntimeRoot == <InstallRoot>\runtime\<RuntimeId>` 与 64-hex manifest binding。
+2. 绝对打开并验证 install root，然后只通过 parent native handle 相对打开 `runtime`、selected generation 和每个 descendant；所有 selected-tree handle 请求 `DELETE`、read-attributes、list/read-data 与 synchronize 权限，share 只允许 read，不允许 write/delete sharing，并始终使用 open-reparse-point 语义。
+3. 每个 held object 保存 final path、volume serial、file ID、type、parent/name；拒绝 reparse、ADS/non-default stream，regular file 还要求 single link。
+4. 从 pinned manifest handle 读取严格 UTF-8 JSON；拒绝任意层 duplicate property、非精确字段、非 canonical record、乱序/重复 path、错误 runtimeId digest/nonce binding。
+5. exact file set 明确为 `manifest.json + manifest.files`；exact directory set为这些 manifest files 的全部 parent directories。额外空目录也被拒绝。
+6. 全树 second enumeration、final path、volume/file ID、stream/link/length/hash revalidation 通过后才进入 disposition。
+7. `UninstallBootstrap.ps1` 的 durable payload allowlist 增加该 module；default installed finalizer 只调用该 API，生产文件不再包含 `Remove-Item`、`Copy-Item` 或 `Move-Item` 路径删除/替换。
+
+成功结果是显式对象：
+
+```text
+phase=Completed
+result=Reclaimed
+runtimeId=<exact selected id>
+fileCount=<manifest.json + manifest.files>
+directoryCount=<selected root + manifest parent directories>
+```
+
+只有该 proof 返回且 selected root absence 再次成立，transaction 才从 `TaskRemoved` 推进到 `ReadyForInno`；之后才允许 product removal 和 completion receipt。
+
+## Windows disposition ruling
+
+临时 NTFS 树的 native probe 得到：
+
+- classic `FileDispositionInfo` 对 readonly immutable file 返回 Win32 `5`；
+- `FileDispositionInfoEx(Delete | IgnoreReadonly = 0x11)` 可 arm，也可用 flags `0` disarm；
+- 当 child 仅被标记、handle 仍打开且名称仍存在时，对 parent directory 标记删除返回 Win32 `145` (`Directory not empty`)；加入 POSIX flag 仍为 `145`，本机 ON_CLOSE 组合返回 `50`。
+
+因此“files + all parent directories 全部 arm、所有 handle 始终保持打开、最后统一 close”在目标 Windows 语义上不可实现。controller 接受以下必要细化：
+
+- `PinnedValidated`：完整 pin、manifest exact-set 与 second validation；零 disposition。
+- `FilesArmed`：先 arm 全部 files，仍为可逆屏障。任一 file-arm 失败时，对已 arm handles 反向 disarm，并重新验证完整树；成功恢复后报 `CCOD_GENERATION_RECLAMATION_INVALID`。若恢复本身失败，使用独立 `CCOD_GENERATION_RECLAMATION_ROLLBACK_FAILED`。
+- `CommitStarted`：只有全部 file arm 成功后才进入不可逆提交；close files，随后 deepest directories 逐个 mark+close，selected root last。
+- commit 阶段的 directory mark/close/absence failure 使用稳定 `CCOD_GENERATION_RECLAMATION_COMMIT_FAILED`。此时 selected generation 可能只剩部分失败边界，但 install root、siblings、state/device key 与 outside objects 不受影响；finalizer 不执行 absence proof、product removal 或 completion receipt，也不写假成功。
+
+## TDD 证据
+
+### 干净基线
+
+- `UninstallBootstrap.SelfTest.ps1`：`23/23`，exit `0`。
+- `InstallFileTransaction.SelfTest.ps1`：baseline suite pass，exit `0`。
+
+### 有效 RED：当前 pathname deletion
+
+首个 production-path RED 先执行真实 `ValidateSelectedGeneration`，验证成功后插入 `unexpected-after-validation.bin`，再走默认 installed finalizer：
+
+```text
+exit=1
+case=installed-finalizer-rejects-an-unexpected-post-validation-child-without-deleting-any-generation-state
+error=CCOD_RECLAMATION_RED_PATHNAME_DELETE
+recursive pathname deletion accepted and removed the changed selected tree
+```
+
+随后以 `CCOD_RECLAMATION_RED_CASE` 分别运行以下六项；旧生产实现全部 exit `1` 并命中 `CCOD_RECLAMATION_RED_PATHNAME_DELETE`：
+
+- `UnexpectedFile`
+- `UnexpectedDirectory`（额外空目录）
+- `Reparse`
+- `Hardlink`
+- `Ads`
+- `OpenChild`
+
+前五项证明旧实现接受变化后整树删除；`OpenChild` 证明旧递归路径删除可先删除其他 manifest members，再在 open child 处失败。
+
+### 有效 RED：新 native contract
+
+- `IdentityChange`：exit `1` / `CCOD_RECLAMATION_RED_MODULE_MISSING`；wished-for pinned boundary 尚不存在。
+- `MarkFailure`：exit `1` / `CCOD_RECLAMATION_RED_MODULE_MISSING`；wished-for arm/disarm retry boundary 尚不存在。
+- IFT production-shape case：exit `1` / `CCOD_RECLAMATION_RED_MODULE_MISSING`；真实 immutable transaction 创建并 Ready-close 的 readonly generation 尚无 reclamation API。
+- commit-failure injection：exit `1` / `ASSERT_THROWS expected CCOD_GENERATION_RECLAMATION_COMMIT_FAILED`；seam 尚未被 commit phase 消费。
+
+测试构造期间出现过并已排除的非有效 RED：并行启动 suite 争用同一 user mutex、loop closure metadata error，以及长路径上的 PowerShell ADS cmdlet fixture error。它们未被计作功能证据；对应用例改为串行、同步 case capture 和短 `manifest.json` ADS target 后重新得到上述有效 RED。
+
+### 最终 GREEN
+
+- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\UninstallBootstrap.SelfTest.ps1`
+  - `Uninstall bootstrap self-tests passed: 32`
+  - exit `0`
+  - 包含 six hostile mutations、identity exchange blocked、file-arm disarm/full-tree retry、CommitStarted stable failure，以及 default staged finalizer negative matrix。
+- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1`
+  - `37` 个 declared cases 全部 pass
+  - exit `0`
+  - 新 case 使用真实 IFT 生成 nested readonly generation；结果只删除 selected generation，install root/outside sentinel 不变。
+- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1`
+  - `Install lifecycle self-tests passed: 148`
+  - exit `0`
+  - 既有 unapproved-verb warnings 与负向 `CCOD_CROSS_PROCESS_OBSERVED ... CCOD_PRODUCT_REGISTRATION_FAILED` 不改变最终 pass。
+- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\PersistenceSelfTest.ps1`
+  - exit `0`
+  - aggregate 成功时无 stdout 汇总；只读进程观察确认其依次推进 Lifecycle、ProductRegistration、StateStore、TrayUi 等 child suites 后正常退出。
+
+### Parser、surface 与 diff
+
+- 以下 5 个文件 PowerShell parser 各 `0` errors：
+  - `src\persistence\modules\GenerationReclamation.psm1`
+  - `src\persistence\InstalledUninstallFinalizer.ps1`
+  - `src\persistence\UninstallBootstrap.ps1`
+  - `tests\persistence\UninstallBootstrap.SelfTest.ps1`
+  - `tests\persistence\InstallFileTransaction.SelfTest.ps1`
+- module exports：仅 `Remove-CcodVerifiedGenerationTree`。
+- marker ABI：`1`；assembly exported CLR types：仅 `CcodGenerationReclamationMarkerV1`。
+- production static scan：`InstalledUninstallFinalizer.ps1` 与 `GenerationReclamation.psm1` 中 `Remove-Item|Copy-Item|Move-Item` 零命中。
+- `git diff --check`：exit `0`；只有 checkout line-ending conversion warning，无 whitespace error。
+
+## 自审与审查边界
+
+自审逐项确认：
+
+- 所有 selected-tree 对象从已持有 parent handle 相对打开；reparse 不会被 follow。
+- 每个 regular file 在任何 disposition 前已绑定 path、volume/file ID、default stream、single link、length 与 SHA-256。
+- manifest 本身属于 exact file set，不由 manifest 自引用；其 hash 绑定 durable transaction。
+- unexpected file、unexpected empty directory、reparse、hardlink、ADS、open child、root identity exchange 均在零删除前失败。
+- file-arm failure 可逆恢复后，完整同一 tree 可由第二次调用成功 reclaim。
+- success 只删除 selected generation；sibling generation、install root、state 和 device-key sentinel 均保留。
+- CommitStarted failure 不声称 tree rollback；它明确 fail closed，不进入 product/final receipt。
+
+独立 scoped review 与 fresh whole-plan review 由 controller 使用 implementation commit `1d57736197df0bfcd1c0e54d96be63dfa54602df` 执行；本报告不把 implementer 自审当成独立 review。Tasks 5–8 的原 release plan 仍保持 blocked，直到本计划完成独立 review 和最终总 gate。

From 58db6fdb4f86cd9d941cf74ca2b8262aada86397 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 05:47:41 +0800
Subject: [PATCH 134/187] fix: close legacy upgrade recovery gaps

---
 Uninstall-CodexControlOtherDevices.ps1        |   3 +-
 .../InstalledUninstallFinalizer.ps1           | 165 ++++++++--
 src/persistence/UninstallBootstrap.ps1        | 115 +++++--
 src/persistence/modules/InstallLifecycle.psm1 |   6 +-
 .../modules/ProductRegistration.psm1          | 296 +++++++++++++++++-
 .../persistence/InstallLifecycle.SelfTest.ps1 | 140 ++++++++-
 .../ProductRegistration.SelfTest.ps1          | 150 ++++++---
 .../UninstallBootstrap.SelfTest.ps1           | 209 ++++++++++---
 8 files changed, 933 insertions(+), 151 deletions(-)

diff --git a/Uninstall-CodexControlOtherDevices.ps1 b/Uninstall-CodexControlOtherDevices.ps1
index c536c69..b47a356 100644
--- a/Uninstall-CodexControlOtherDevices.ps1
+++ b/Uninstall-CodexControlOtherDevices.ps1
@@ -49,7 +49,8 @@ if ($null -ne $installedRuntimeId -and $installedRuntimeId -cmatch '^2\.5\.22-[0
     $powershellPath=Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'WindowsPowerShell\v1.0\powershell.exe'
     if(-not[IO.File]::Exists($powershellPath)){Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_FINALIZER_MISSING' 'The Windows PowerShell host is unavailable.' $powershellPath}
     function ConvertTo-CcodInstalledUninstallLiteral([string]$Value){"'"+$Value.Replace("'","''")+"'"}
-    $arguments='-NoProfile -NonInteractive -ExecutionPolicy Bypass -File {0} -TransactionId {1} -RuntimeRoot {2} -InstallRoot {3} -WrapperProcessId {4} -WrapperCreationTimeUtc {5}'-f(ConvertTo-CcodInstalledUninstallLiteral $finalizer),(ConvertTo-CcodInstalledUninstallLiteral $prepared.transactionId),(ConvertTo-CcodInstalledUninstallLiteral $installerRoot),(ConvertTo-CcodInstalledUninstallLiteral $expectedInstallRoot),$wrapperId,(ConvertTo-CcodInstalledUninstallLiteral $wrapperCreated)
+    $historical=$prepared.installedBinding;$resumeExisting=$null-ne$historical-and([int]$historical.wrapperPid-ne$wrapperId-or[string]$historical.wrapperCreationTimeUtc-cne$wrapperCreated-or[int]$historical.wrapperSessionId-ne[int]$wrapperIdentity.sessionId-or[string]$historical.wrapperUserSid-cne[string]$wrapperIdentity.userSid)
+    $arguments=if($resumeExisting){'-NoProfile -NonInteractive -ExecutionPolicy Bypass -File {0} -WrapperResume -TransactionId {1} -RuntimeRoot {2} -InstallRoot {3} -WrapperProcessId {4} -WrapperCreationTimeUtc {5}'-f(ConvertTo-CcodInstalledUninstallLiteral $finalizer),(ConvertTo-CcodInstalledUninstallLiteral $prepared.transactionId),(ConvertTo-CcodInstalledUninstallLiteral $installerRoot),(ConvertTo-CcodInstalledUninstallLiteral $expectedInstallRoot),$wrapperId,(ConvertTo-CcodInstalledUninstallLiteral $wrapperCreated)}else{'-NoProfile -NonInteractive -ExecutionPolicy Bypass -File {0} -TransactionId {1} -RuntimeRoot {2} -InstallRoot {3} -WrapperProcessId {4} -WrapperCreationTimeUtc {5}'-f(ConvertTo-CcodInstalledUninstallLiteral $finalizer),(ConvertTo-CcodInstalledUninstallLiteral $prepared.transactionId),(ConvertTo-CcodInstalledUninstallLiteral $installerRoot),(ConvertTo-CcodInstalledUninstallLiteral $expectedInstallRoot),$wrapperId,(ConvertTo-CcodInstalledUninstallLiteral $wrapperCreated)}
     try{$process=Start-Process -FilePath $powershellPath -ArgumentList $arguments -WindowStyle Hidden -RedirectStandardOutput (Join-Path $transactionDirectory 'installed-finalizer.stdout.log') -RedirectStandardError (Join-Path $transactionDirectory 'installed-finalizer.stderr.log') -PassThru -ErrorAction Stop}catch{Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_FINALIZER_START_FAILED' 'The external installed finalizer could not be started; application state was retained.' $_}
     return [pscustomobject][ordered]@{Outcome='InstalledFinalizationStarted';TransactionId=[string]$prepared.transactionId;FinalizerProcessId=[int]$process.Id;KeptDeviceKeyStore=$true}
 }
diff --git a/src/persistence/InstalledUninstallFinalizer.ps1 b/src/persistence/InstalledUninstallFinalizer.ps1
index 621c2b6..f73aefc 100644
--- a/src/persistence/InstalledUninstallFinalizer.ps1
+++ b/src/persistence/InstalledUninstallFinalizer.ps1
@@ -1,14 +1,17 @@
-[CmdletBinding()]
+[CmdletBinding(DefaultParameterSetName='Initial')]
 param(
     [ValidatePattern('^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$')][string]$TransactionId,
     [string]$RuntimeRoot,
     [string]$InstallRoot,
-    [int]$WrapperProcessId,
-    [string]$WrapperCreationTimeUtc
+    [Parameter(ParameterSetName='Initial')][Parameter(ParameterSetName='WrapperResume')][int]$WrapperProcessId,
+    [Parameter(ParameterSetName='Initial')][Parameter(ParameterSetName='WrapperResume')][string]$WrapperCreationTimeUtc,
+    [Parameter(ParameterSetName='WrapperResume')][switch]$WrapperResume,
+    [Parameter(ParameterSetName='Resume')][switch]$Resume
 )
 
 Set-StrictMode -Version Latest
 $ErrorActionPreference='Stop'
+$script:CcodInstalledFinalizerPayloadEntries=@('src/persistence/UninstallBootstrap.ps1','src/persistence/PortableUninstallFinalizer.ps1','src/persistence/InstalledUninstallFinalizer.ps1','src/persistence/modules/GenerationReclamation.psm1','src/persistence/modules/InstallLifecycle.psm1','src/persistence/modules/ProductRegistration.psm1','src/persistence/modules/PortableRelease.psm1','src/persistence/modules/PersistenceIO.psm1','src/persistence/modules/RuntimeManifest.psm1','src/persistence/modules/LifecycleEpoch.psm1','src/persistence/modules/StateStore.psm1','src/persistence/modules/TrustedLogonIdentity.psm1','src/persistence/modules/ScheduledTask.psm1','src/persistence/modules/KernelObjects.psm1','src/persistence/modules/CompatibilityProbe.psm1','src/persistence/modules/UiPreferences.psm1','src/persistence/modules/LifecycleTransaction.psm1')
 
 function Throw-CcodInstalledFinalizerError {
     param([string]$Id,[string]$Message,$Target)
@@ -25,40 +28,150 @@ function Get-CcodInstalledFinalizerLocalAppData {
     if([string]::IsNullOrWhiteSpace($value)-or-not[IO.Path]::IsPathRooted($value)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Current-user local application data is unavailable' $value}
     [IO.Path]::GetFullPath($value).TrimEnd('\')
 }
+function Test-CcodInstalledFinalizerStagedPayload {
+    param($Transaction,[string]$PayloadRoot)
+    try{
+        $root=[IO.Path]::GetFullPath($PayloadRoot).TrimEnd('\');$rootItem=Get-Item -LiteralPath $root -Force -ErrorAction Stop;if(-not$rootItem.PSIsContainer-or($rootItem.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){return $false}
+        $records=@($Transaction.installedBinding.payloadRecords);if($records.Count-ne$script:CcodInstalledFinalizerPayloadEntries.Count){return $false}
+        for($index=0;$index-lt$records.Count;$index++){
+            $record=$records[$index];$relative=$script:CcodInstalledFinalizerPayloadEntries[$index];$integerTypes=@([byte],[uint16],[uint32],[uint64],[int16],[int32],[int64]);if($record.path-cne$relative-or$integerTypes-cnotcontains$record.length.GetType()-or[decimal]$record.length-lt0-or$record.sha256-isnot[string]-or$record.sha256-cnotmatch'^[0-9a-f]{64}$'){return $false}
+            $path=[IO.Path]::GetFullPath((Join-Path $root $relative.Replace('/','\')));if(-not$path.StartsWith($root+'\',[StringComparison]::OrdinalIgnoreCase)){return $false}
+            $cursor=$root;foreach($segment in $relative.Replace('/','\').Split('\')){$cursor=Join-Path $cursor $segment;$item=Get-Item -LiteralPath $cursor -Force -ErrorAction Stop;if(($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){return $false}}
+            $file=Get-Item -LiteralPath $path -Force -ErrorAction Stop;if($file.PSIsContainer-or$file-isnot[IO.FileInfo]-or[int64]$file.Length-ne[int64]$record.length){return $false};$streams=@(Get-Item -LiteralPath $path -Stream * -ErrorAction Stop);if($streams.Count-ne1-or[string]$streams[0].Stream-cne':$DATA'){return $false}
+            $hash=(Get-FileHash -LiteralPath $path -Algorithm SHA256 -ErrorAction Stop).Hash.ToLowerInvariant();if($hash-cne[string]$record.sha256){return $false}
+        }
+        $self=@($records|Where-Object{$_.path-ceq'src/persistence/InstalledUninstallFinalizer.ps1'});return $self.Count-eq1-and[uint64]$self[0].length-eq[uint64]$Transaction.installedBinding.resumeScriptLength-and$self[0].sha256-ceq$Transaction.installedBinding.resumeScriptSha256
+    }catch{return $false}
+}
+function Test-CcodInstalledFinalizerJsonHasNoDuplicateProperties {
+    param([string]$Json)
+    if($null-eq$Json){return $false};$objects=[Collections.Generic.Stack[object]]::new()
+    for($index=0;$index-lt$Json.Length;$index++){$character=$Json[$index];if($character-eq'{'){$objects.Push([Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal));continue};if($character-eq'}'){if($objects.Count-eq0){return $false};[void]$objects.Pop();continue};if($character-ne'"'){continue};$name=[Text.StringBuilder]::new();$index++;while($index-lt$Json.Length){$character=$Json[$index];if($character-eq'"'){break};if($character-ne[char]92){[void]$name.Append($character);$index++;continue};$index++;if($index-ge$Json.Length){return $false};$escape=$Json[$index];if($escape-eq'u'){if($index+4-ge$Json.Length){return $false};try{[void]$name.Append([char][Convert]::ToInt32($Json.Substring($index+1,4),16))}catch{return $false};$index+=5;continue};switch([string]$escape){'"'{$decoded='"'};'\'{$decoded=[char]92};'/'{$decoded='/'};'b'{$decoded=[char]8};'f'{$decoded=[char]12};'n'{$decoded=[char]10};'r'{$decoded=[char]13};'t'{$decoded=[char]9};default{return $false}};[void]$name.Append($decoded);$index++};if($index-ge$Json.Length){return $false};$next=$index+1;while($next-lt$Json.Length-and[char]::IsWhiteSpace($Json[$next])){$next++};if($next-lt$Json.Length-and$Json[$next]-eq':'){if($objects.Count-eq0-or-not$objects.Peek().Add($name.ToString())){return $false}}};return $objects.Count-eq0
+}
+function Read-CcodInstalledFinalizerJson {
+    param([string]$Path)
+    try{$item=Get-Item -LiteralPath $Path -Force -ErrorAction Stop;if($item.PSIsContainer-or$item-isnot[IO.FileInfo]-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0-or$item.Length-lt1-or$item.Length-gt1048576){throw 'unsafe json'};$streams=@(Get-Item -LiteralPath $Path -Stream * -ErrorAction Stop);if($streams.Count-ne1-or[string]$streams[0].Stream-cne':$DATA'){throw 'json stream'};$json=[IO.File]::ReadAllText($Path,[Text.UTF8Encoding]::new($false,$true));if(-not(Test-CcodInstalledFinalizerJsonHasNoDuplicateProperties $json)){throw 'duplicate json'};$value=$json|ConvertFrom-Json -ErrorAction Stop;if($value-isnot[pscustomobject]){throw 'json object'};$value}catch{Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer envelope is malformed or unsafe' $Path}
+}
+function Assert-CcodInstalledFinalizerDirectoryAcl {
+    param([string]$Path,[string]$UserSid,[switch]$RequireProtected)
+    try{$item=Get-Item -LiteralPath $Path -Force -ErrorAction Stop;$security=$item.GetAccessControl();$owner=$security.GetOwner([Security.Principal.SecurityIdentifier]);if($null-eq$owner-or$owner.Value-cne$UserSid-or($RequireProtected-and-not$security.AreAccessRulesProtected)){throw 'owner/protection'};$allowed=@($UserSid,'S-1-5-18');$seen=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal);foreach($rule in @($security.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier]))){if($rule.AccessControlType-ne[Security.AccessControl.AccessControlType]::Allow-or$allowed-cnotcontains$rule.IdentityReference.Value-or(($rule.FileSystemRights-band[Security.AccessControl.FileSystemRights]::FullControl)-ne[Security.AccessControl.FileSystemRights]::FullControl)){throw 'rule'};[void]$seen.Add($rule.IdentityReference.Value)};if($seen.Count-ne2){throw 'principals'}}catch{Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer directory ACL is invalid' $Path}
+}
+function Read-CcodInstalledFinalizerEnvelope {
+    param([string]$TransactionRoot,[string]$TransactionId,[string]$PayloadRoot,[string]$RuntimeRoot,[string]$InstallRoot)
+    $identity=[Security.Principal.WindowsIdentity]::GetCurrent();try{$sid=[string]$identity.User.Value}finally{$identity.Dispose()}
+    foreach($directory in @($TransactionRoot,(Join-Path $TransactionRoot $TransactionId),$PayloadRoot)){$item=Get-Item -LiteralPath $directory -Force -ErrorAction Stop;if(-not$item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer directory is unsafe' $directory}}
+    Assert-CcodInstalledFinalizerDirectoryAcl -Path $TransactionRoot -UserSid $sid -RequireProtected;Assert-CcodInstalledFinalizerDirectoryAcl -Path (Join-Path $TransactionRoot $TransactionId) -UserSid $sid -RequireProtected;Assert-CcodInstalledFinalizerDirectoryAcl -Path $PayloadRoot -UserSid $sid
+    $current=Read-CcodInstalledFinalizerJson (Join-Path $TransactionRoot 'current.json');if((@($current.PSObject.Properties.Name)-join'|')-cne'schemaVersion|transactionId'-or$current.schemaVersion-ne1-or$current.transactionId-cne$TransactionId){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer locator is invalid' $current}
+    $transaction=Read-CcodInstalledFinalizerJson (Join-Path (Join-Path $TransactionRoot $TransactionId) 'transaction.json');$transactionFields=@('schemaVersion','transactionId','runtimeId','runtimeGeneration','leaseEpoch','userSid','sessionId','readyEvidence','installedBinding','phase','resumePhase','startedAtUtc','updatedAtUtc','errorCode');$bindingFields=@('selectedRuntimeRoot','runtimeManifestSha256','wrapperPid','wrapperCreationTimeUtc','wrapperSessionId','wrapperUserSid','resumeWrapperPid','resumeWrapperCreationTimeUtc','resumeWrapperSessionId','resumeWrapperUserSid','resumeScriptPath','resumeScriptLength','resumeScriptSha256','resumeCommand','payloadRecords');$readyFields=@('phase','installRoot','runtimeId','runtimeGeneration','packageSha256','manifestSha256','startMenuSha256','desktopSha256','targetPath','arguments')
+    try{$install=[IO.Path]::GetFullPath($InstallRoot);$runtime=[IO.Path]::GetFullPath($RuntimeRoot);$resumeScript=[IO.Path]::GetFullPath((Join-Path $PayloadRoot 'src\persistence\InstalledUninstallFinalizer.ps1'));$system=[Environment]::GetFolderPath([Environment+SpecialFolder]::System);$powershell=[IO.Path]::GetFullPath((Join-Path $system 'WindowsPowerShell\v1.0\powershell.exe'));$command='"{0}" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "{1}" -Resume -TransactionId "{2}" -RuntimeRoot "{3}" -InstallRoot "{4}"'-f$powershell,$resumeScript,$TransactionId,$runtime,$install}catch{Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer envelope paths are invalid' $transaction}
+    if((@($transaction.PSObject.Properties.Name)-join'|')-cne($transactionFields-join'|')-or$transaction.schemaVersion-ne1-or$transaction.transactionId-cne$TransactionId-or$transaction.userSid-cne$sid-or
+       (@($transaction.readyEvidence.PSObject.Properties.Name)-join'|')-cne($readyFields-join'|')-or$transaction.readyEvidence.installRoot-cne$install-or$transaction.readyEvidence.runtimeId-cne$transaction.runtimeId-or
+       (@($transaction.installedBinding.PSObject.Properties.Name)-join'|')-cne($bindingFields-join'|')-or$transaction.installedBinding.selectedRuntimeRoot-cne$runtime-or$transaction.installedBinding.resumeScriptPath-cne$resumeScript-or
+       $transaction.installedBinding.resumeCommand-cne$command-or$transaction.installedBinding.wrapperUserSid-cne$transaction.userSid-or$transaction.installedBinding.wrapperSessionId-ne$transaction.sessionId-or
+       $transaction.installedBinding.runtimeManifestSha256-cne$transaction.readyEvidence.manifestSha256-or-not(Test-CcodInstalledFinalizerStagedPayload -Transaction $transaction -PayloadRoot $PayloadRoot)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer envelope is not bound to the staged payload' $transaction}
+    return $transaction
+}
 function Get-CcodInstalledFinalizerAdapters {
-    param([hashtable]$Adapters,[string]$TransactionRoot,[string]$PayloadRoot)
+    param([hashtable]$Adapters,[string]$TransactionRoot,[string]$PayloadRoot,[string]$RuntimeRoot,[string]$InstallRoot)
     $bootstrap=Join-Path $PayloadRoot 'src\persistence\UninstallBootstrap.ps1'
-    $lifecycle=Join-Path $PayloadRoot 'src\persistence\modules\InstallLifecycle.psm1'
+    $productModule=Join-Path $PayloadRoot 'src\persistence\modules\ProductRegistration.psm1'
+    $kernelModule=Join-Path $PayloadRoot 'src\persistence\modules\KernelObjects.psm1'
+    $finalizerRuntimeRoot=$RuntimeRoot;$finalizerInstallRoot=$InstallRoot;$stagedBootstrapPath=$bootstrap
     $defaults=@{
-        WaitWrapperExit={param($Identity,$Timeout);$process=Get-Process -Id $Identity.pid -ErrorAction SilentlyContinue;if($null-eq$process){return [pscustomobject]@{verifiedAtStart=$false;exited=$false}};try{if($process.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)-cne$Identity.creationTimeUtc-or[int]$process.SessionId-ne[int]$Identity.sessionId){return [pscustomobject]@{verifiedAtStart=$false;exited=$false}}}finally{$process.Dispose()};$owner=$null;try{$owner=(Get-CimInstance Win32_Process -Filter ('ProcessId='+$Identity.pid)-ErrorAction Stop|Invoke-CimMethod -MethodName GetOwnerSid -ErrorAction Stop)}catch{};if($null-eq$owner-or[int]$owner.ReturnValue-ne0-or[string]$owner.Sid-cne[string]$Identity.userSid){return [pscustomobject]@{verifiedAtStart=$false;exited=$false}};$stopwatch=[Diagnostics.Stopwatch]::StartNew();while($stopwatch.ElapsedMilliseconds-lt$Timeout){$current=Get-Process -Id $Identity.pid -ErrorAction SilentlyContinue;if($null-eq$current){return [pscustomobject]@{verifiedAtStart=$true;exited=$true}};try{if($current.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)-cne$Identity.creationTimeUtc){return [pscustomobject]@{verifiedAtStart=$true;exited=$true}}}finally{$current.Dispose()};Start-Sleep -Milliseconds 100};[pscustomobject]@{verifiedAtStart=$true;exited=$false}}
+        GetCurrentIdentity={. $bootstrap;Get-CcodUninstallBootstrapCurrentIdentity}.GetNewClosure()
+        EnterAccountTransition={param($UserSid)Import-Module $kernelModule -Force -DisableNameChecking -ErrorAction Stop;$lease=Enter-CcodMutex -Kind AccountTransition -UserSid $UserSid -TimeoutMilliseconds 30000;if($null-eq$lease-or$lease.Outcome-cne'Acquired'-or$lease.Kind-cne'AccountTransition'){throw 'account transition unavailable'};$lease}.GetNewClosure()
+        ExitAccountTransition={param($Lease)Import-Module $kernelModule -Force -DisableNameChecking -ErrorAction Stop;[void](Exit-CcodMutex -Lease $Lease)}.GetNewClosure()
+        EnterTransactionLock={param($UserSid);. $bootstrap;Enter-CcodUninstallBootstrapTransactionLock -UserSid $UserSid}.GetNewClosure()
+        ExitTransactionLock={param($Lock);. $bootstrap;Exit-CcodUninstallBootstrapTransactionLock -Lock $Lock}.GetNewClosure()
+        WaitWrapperExit={param($Identity,$Timeout);$process=Get-Process -Id $Identity.pid -ErrorAction SilentlyContinue;if($null-eq$process){return [pscustomobject]@{verifiedAtStart=$true;exited=$true}};try{if($process.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)-cne$Identity.creationTimeUtc-or[int]$process.SessionId-ne[int]$Identity.sessionId){return [pscustomobject]@{verifiedAtStart=$true;exited=$true}}}finally{$process.Dispose()};$owner=$null;try{$owner=(Get-CimInstance Win32_Process -Filter ('ProcessId='+$Identity.pid)-ErrorAction Stop|Invoke-CimMethod -MethodName GetOwnerSid -ErrorAction Stop)}catch{};if($null-eq$owner-or[int]$owner.ReturnValue-ne0-or[string]$owner.Sid-cne[string]$Identity.userSid){return [pscustomobject]@{verifiedAtStart=$false;exited=$false}};$stopwatch=[Diagnostics.Stopwatch]::StartNew();while($stopwatch.ElapsedMilliseconds-lt$Timeout){$current=Get-Process -Id $Identity.pid -ErrorAction SilentlyContinue;if($null-eq$current){return [pscustomobject]@{verifiedAtStart=$true;exited=$true}};try{if($current.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)-cne$Identity.creationTimeUtc){return [pscustomobject]@{verifiedAtStart=$true;exited=$true}}}finally{$current.Dispose()};Start-Sleep -Milliseconds 100};[pscustomobject]@{verifiedAtStart=$true;exited=$false}}
         ReadPreparedTransaction={param($Id,$ExpectedInstallRoot);. $bootstrap;$identity=Get-CcodUninstallBootstrapCurrentIdentity;$value=Read-CcodUninstallBootstrapStoredTransaction -TransactionRoot $TransactionRoot -ExpectedUserSid $identity.userSid -IncludeCompleted -ExpectedInstallRoot $ExpectedInstallRoot;if($null-eq$value-or$value.transactionId-cne$Id){return $null};$value}.GetNewClosure()
+        ValidateStagedPayload={param($Transaction,$Root)Test-CcodInstalledFinalizerStagedPayload -Transaction $Transaction -PayloadRoot $Root}
         ValidateSelectedGeneration={param($SelectedRuntime,$Root,$Transaction);. $bootstrap;$context=Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $SelectedRuntime -InstallRoot $Root -InvocationPath (Join-Path $SelectedRuntime 'src\persistence\UninstallBootstrap.ps1');$manifest=Get-CcodUninstallBootstrapFileFingerprint -Path (Join-Path $SelectedRuntime 'manifest.json');$context.runtimeId-ceq$Transaction.runtimeId-and[uint64]$context.runtimeGeneration-eq[uint64]$Transaction.runtimeGeneration-and$manifest.sha256-ceq$Transaction.installedBinding.runtimeManifestSha256}.GetNewClosure()
         ReadCurrentEpoch={param($Root);. $bootstrap;$record=Read-CcodUninstallBootstrapJson -Path (Join-Path $Root 'state\lifecycle-epoch.json') -Kind 'Lifecycle epoch';[uint64]$record.epoch}.GetNewClosure()
-        RemoveSelectedGeneration={param($SelectedRuntime,$Transaction);. $bootstrap;$expected=[IO.Path]::GetFullPath([string]$Transaction.installedBinding.selectedRuntimeRoot);if([IO.Path]::GetFullPath($SelectedRuntime)-cne$expected){throw 'selected root changed'};$modulePath=Join-Path $PayloadRoot 'src\persistence\modules\GenerationReclamation.psm1';if(-not[IO.File]::Exists($modulePath)){throw 'generation reclamation module missing'};Import-Module $modulePath -Force -DisableNameChecking -ErrorAction Stop;$reclaimed=Remove-CcodVerifiedGenerationTree -InstallRoot $Transaction.readyEvidence.installRoot -RuntimeRoot $expected -RuntimeId $Transaction.runtimeId -ExpectedManifestSha256 $Transaction.installedBinding.runtimeManifestSha256;if($null-eq$reclaimed-or$reclaimed.phase-cne'Completed'-or$reclaimed.result-cne'Reclaimed'-or$reclaimed.runtimeId-cne$Transaction.runtimeId){throw 'generation reclamation proof invalid'};$Transaction.phase='ReadyForInno';$Transaction.resumePhase='ReadyForInno';Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory (Join-Path $TransactionRoot $Transaction.transactionId) -Transaction $Transaction;$Transaction}.GetNewClosure()
-        TestSelectedRootAbsent={param($Root)-not([IO.Directory]::Exists($Root)-or[IO.File]::Exists($Root))}
-        RemoveMatchedProductRegistration={param($Transaction);. $bootstrap;Remove-CcodUninstallBootstrapProductRegistration -Context ([pscustomobject][ordered]@{runtimeId=$Transaction.runtimeId;runtimeGeneration=[uint64]$Transaction.runtimeGeneration;leaseEpoch=[uint64]$Transaction.leaseEpoch;userSid=$Transaction.userSid;sessionId=[int]$Transaction.sessionId;readyEvidence=$Transaction.readyEvidence;payloadRecords=New-CcodUninstallBootstrapPayloadRecords -ResumeOnly})}
-        FinalizeReceipt={param($Transaction);& $bootstrap -InstallerRoot $RuntimeRoot -InstallRoot $InstallRoot -Mode FinalizeReceipt;Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Finalization bootstrap returned unexpectedly' $Transaction.transactionId}.GetNewClosure()
+        GetSelectedRootState={param($Root)try{$item=Get-Item -LiteralPath $Root -Force -ErrorAction Stop;if($item.PSIsContainer-and($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-eq0){'Present'}else{'Invalid'}}catch [Management.Automation.ItemNotFoundException]{'Absent'}catch{throw}}
+        InstallResumeProductRegistration={param($Transaction)Import-Module $productModule -Force -DisableNameChecking -ErrorAction Stop;Set-CcodInstalledUninstallResumeRegistration -Transaction $Transaction|Out-Null}.GetNewClosure()
+        GetResumeProductRegistrationState={param($Transaction)Import-Module $productModule -Force -DisableNameChecking -ErrorAction Stop;Get-CcodInstalledUninstallResumeRegistrationState -Transaction $Transaction}.GetNewClosure()
+        ReclaimSelectedGeneration={param($SelectedRuntime,$Transaction);$expected=[IO.Path]::GetFullPath([string]$Transaction.installedBinding.selectedRuntimeRoot);if([IO.Path]::GetFullPath($SelectedRuntime)-cne$expected){throw 'selected root changed'};$modulePath=Join-Path $PayloadRoot 'src\persistence\modules\GenerationReclamation.psm1';if(-not[IO.File]::Exists($modulePath)){throw 'generation reclamation module missing'};Import-Module $modulePath -Force -DisableNameChecking -ErrorAction Stop;$reclaimed=Remove-CcodVerifiedGenerationTree -InstallRoot $Transaction.readyEvidence.installRoot -RuntimeRoot $expected -RuntimeId $Transaction.runtimeId -ExpectedManifestSha256 $Transaction.installedBinding.runtimeManifestSha256;if($null-eq$reclaimed-or$reclaimed.phase-cne'Completed'-or$reclaimed.result-cne'Reclaimed'-or$reclaimed.runtimeId-cne$Transaction.runtimeId){throw 'generation reclamation proof invalid'};$reclaimed}.GetNewClosure()
+        WriteReadyForInno={param($Transaction);. $bootstrap;$Transaction.phase='ReadyForInno';$Transaction.resumePhase='ReadyForInno';$Transaction.updatedAtUtc=[DateTime]::UtcNow.ToString('o',[Globalization.CultureInfo]::InvariantCulture);$Transaction.errorCode=$null;Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory (Join-Path $TransactionRoot $Transaction.transactionId) -Transaction $Transaction;$Transaction}.GetNewClosure()
+        RemoveMatchedProductShortcuts={param($Transaction)Import-Module $productModule -Force -DisableNameChecking -ErrorAction Stop;Remove-CcodInstalledUninstallProductShortcuts -Transaction $Transaction|Out-Null}.GetNewClosure()
+        FinalizeReceipt={param($Transaction);$runtimeForReceipt=$finalizerRuntimeRoot;$installForReceipt=$finalizerInstallRoot;$bootstrapForReceipt=$stagedBootstrapPath;. $bootstrapForReceipt;$validation={param($Root,$Value,$Identity)Assert-CcodUninstallBootstrapFinalizationInvocation -TransactionRoot $Root -Transaction $Value -Identity $Identity -InvocationPath $bootstrapForReceipt};$absence={param($Root)try{$item=Get-Item -LiteralPath $Root -Force -ErrorAction Stop;return $false}catch [Management.Automation.ItemNotFoundException]{return $true}catch{throw}};Invoke-CcodUninstallBootstrap -InstallerRoot $runtimeForReceipt -InstallRoot $installForReceipt -Mode FinalizeReceipt -Adapters @{ValidateFinalizationInvocation=$validation;TestInstallRootAbsent=$absence}}.GetNewClosure()
+        TestCompletedReceipt={param($Transaction);. $bootstrap;$identity=Get-CcodUninstallBootstrapCurrentIdentity;Test-CcodUninstallBootstrapStoredCompletedReceipt -TransactionRoot $TransactionRoot -Transaction $Transaction -ExpectedUserSid $identity.userSid}.GetNewClosure()
+        RemoveResumeProductRegistration={param($Transaction)Import-Module $productModule -Force -DisableNameChecking -ErrorAction Stop;Remove-CcodInstalledUninstallResumeRegistration -Transaction $Transaction -CompletedReceiptProven}.GetNewClosure()
     }
     if($null-eq$Adapters){return $defaults};$resolved=@{};foreach($name in $defaults.Keys){$resolved[$name]=$defaults[$name]};foreach($name in $Adapters.Keys){if(-not$resolved.ContainsKey($name)-or$Adapters[$name]-isnot[scriptblock]){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Finalizer adapter contract is invalid' $name};$resolved[$name]=$Adapters[$name]};$resolved
 }
+function Assert-CcodInstalledFinalizerTransactionBinding {
+    param($Transaction,[string]$TransactionId,[string]$RuntimeRoot,[string]$InstallRoot,$CallerIdentity,$WrapperIdentity,[bool]$IsResume,[bool]$IsWrapperResume,[string]$PayloadRoot)
+    $binding=if($null-ne$Transaction){$Transaction.installedBinding}else{$null};$effectivePhase=if($null-ne$Transaction-and$Transaction.phase-ceq'Failed'){$Transaction.resumePhase}elseif($null-ne$Transaction){$Transaction.phase}else{$null}
+    try{$expectedRuntime=[IO.Path]::GetFullPath((Join-Path (Join-Path $InstallRoot 'runtime') ([string]$Transaction.runtimeId)));$expectedScript=[IO.Path]::GetFullPath((Join-Path $PayloadRoot 'src\persistence\InstalledUninstallFinalizer.ps1'));$system=[Environment]::GetFolderPath([Environment+SpecialFolder]::System);$powershell=[IO.Path]::GetFullPath((Join-Path $system 'WindowsPowerShell\v1.0\powershell.exe'));$expectedCommand='"{0}" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "{1}" -Resume -TransactionId "{2}" -RuntimeRoot "{3}" -InstallRoot "{4}"'-f$powershell,$expectedScript,$TransactionId,$expectedRuntime,$InstallRoot}catch{Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Durable installed uninstall paths are invalid' $Transaction}
+    if($null-eq$Transaction-or$Transaction.transactionId-cne$TransactionId-or$Transaction.userSid-isnot[string]-or$Transaction.userSid-cne$CallerIdentity.userSid-or
+       $effectivePhase-notin@('TaskRemoved','ReadyForInno','Completed')-or$null-eq$binding-or$binding.wrapperUserSid-cne$Transaction.userSid-or[int]$binding.wrapperSessionId-ne[int]$Transaction.sessionId-or
+       [IO.Path]::GetFullPath([string]$binding.selectedRuntimeRoot)-cne$expectedRuntime-or$RuntimeRoot-cne$expectedRuntime-or[IO.Path]::GetFullPath([string]$binding.resumeScriptPath)-cne$expectedScript-or$binding.resumeCommand-cne$expectedCommand-or
+       $binding.runtimeManifestSha256-isnot[string]-or$binding.runtimeManifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$Transaction.readyEvidence.runtimeId-cne$Transaction.runtimeId-or
+       [uint64]$Transaction.readyEvidence.runtimeGeneration-ne[uint64]$Transaction.runtimeGeneration-or$Transaction.readyEvidence.manifestSha256-cne$binding.runtimeManifestSha256-or
+       $binding.resumeScriptSha256-isnot[string]-or$binding.resumeScriptSha256-cnotmatch'^[0-9a-f]{64}$'-or[uint64]$binding.resumeScriptLength-lt1-or$null-eq$binding.payloadRecords){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Durable installed uninstall transaction identity is invalid' $Transaction}
+    $resumeRecords=@($binding.payloadRecords|Where-Object{$_.path-ceq'src/persistence/InstalledUninstallFinalizer.ps1'});if($resumeRecords.Count-ne1-or[uint64]$resumeRecords[0].length-ne[uint64]$binding.resumeScriptLength-or$resumeRecords[0].sha256-cne$binding.resumeScriptSha256){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Durable resume script is not bound to the staged payload set' $binding}
+    if(-not$IsResume){
+        if($null-eq$WrapperIdentity-or-not(Test-CcodInstalledFinalizerIdentity $WrapperIdentity)-or$effectivePhase-cne'TaskRemoved'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer wrapper binding is invalid' $WrapperIdentity}
+        if($IsWrapperResume){if([int]$binding.resumeWrapperPid-ne$WrapperIdentity.pid-or[string]$binding.resumeWrapperCreationTimeUtc-cne$WrapperIdentity.creationTimeUtc-or[int]$binding.resumeWrapperSessionId-ne$WrapperIdentity.sessionId-or[string]$binding.resumeWrapperUserSid-cne$WrapperIdentity.userSid){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Replacement wrapper launch binding is invalid' $WrapperIdentity}}
+        elseif($null-ne$binding.resumeWrapperPid-or[int]$binding.wrapperPid-ne$WrapperIdentity.pid-or[string]$binding.wrapperCreationTimeUtc-cne$WrapperIdentity.creationTimeUtc-or[int]$binding.wrapperSessionId-ne$WrapperIdentity.sessionId-or[string]$binding.wrapperUserSid-cne$WrapperIdentity.userSid){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Initial historical wrapper binding is invalid or was superseded' $WrapperIdentity}
+    }
+    return $effectivePhase
+}
+
 function Invoke-CcodInstalledUninstallFinalizer {
-    param([Parameter(Mandatory)][string]$TransactionId,[Parameter(Mandatory)][string]$RuntimeRoot,[Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)]$WrapperIdentity,[hashtable]$Adapters)
-    if($TransactionId-cnotmatch'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'-or-not[IO.Path]::IsPathRooted($RuntimeRoot)-or-not[IO.Path]::IsPathRooted($InstallRoot)-or-not(Test-CcodInstalledFinalizerIdentity $WrapperIdentity)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer inputs are invalid' $TransactionId}
-    $runtime=[IO.Path]::GetFullPath($RuntimeRoot);$install=[IO.Path]::GetFullPath($InstallRoot);$expected=[IO.Path]::GetFullPath((Join-Path (Join-Path $install 'runtime') ([IO.Path]::GetFileName($runtime))));if($runtime-cne$expected){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Runtime root is outside the fixed install runtime parent' $runtime}
-    $local=Get-CcodInstalledFinalizerLocalAppData;$transactionRoot=[IO.Path]::GetFullPath((Join-Path $local 'CodexRemote-fix-uninstall'));$payloadRoot=[IO.Path]::GetFullPath((Join-Path (Join-Path $transactionRoot $TransactionId) 'payload'));if($null-eq$Adapters){$expectedSelf=[IO.Path]::GetFullPath((Join-Path $payloadRoot 'src\persistence\InstalledUninstallFinalizer.ps1'));if([string]::IsNullOrWhiteSpace($PSCommandPath)-or[IO.Path]::GetFullPath($PSCommandPath)-cne$expectedSelf){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer is outside the durable staged payload' $PSCommandPath};$self=Get-Item -LiteralPath $expectedSelf -Force -ErrorAction Stop;if($self.PSIsContainer-or($self.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer path is unsafe' $expectedSelf}};$adapter=Get-CcodInstalledFinalizerAdapters -Adapters $Adapters -TransactionRoot $transactionRoot -PayloadRoot $payloadRoot
-    $wrapperExit=&$adapter.WaitWrapperExit $WrapperIdentity 15000;if($null-eq$wrapperExit-or$wrapperExit.verifiedAtStart-isnot[bool]-or-not$wrapperExit.verifiedAtStart-or$wrapperExit.exited-isnot[bool]-or-not$wrapperExit.exited){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed wrapper was not verified before its exact exit' $WrapperIdentity}
-    $transaction=&$adapter.ReadPreparedTransaction $TransactionId $install
-    $binding=if($null-ne$transaction){$transaction.installedBinding}else{$null};if($null-eq$transaction-or$transaction.transactionId-cne$TransactionId-or$transaction.phase-cne'TaskRemoved'-or$transaction.resumePhase-cne'TaskRemoved'-or$transaction.runtimeId-isnot[string]-or[IO.Path]::GetFileName($runtime)-cne[string]$transaction.runtimeId-or$null-eq$binding-or[IO.Path]::GetFullPath([string]$binding.selectedRuntimeRoot)-cne$runtime-or$binding.runtimeManifestSha256-isnot[string]-or$binding.runtimeManifestSha256-cnotmatch'^[0-9a-f]{64}$'-or[int]$binding.wrapperPid-ne$WrapperIdentity.pid-or[string]$binding.wrapperCreationTimeUtc-cne$WrapperIdentity.creationTimeUtc-or[int]$binding.wrapperSessionId-ne$WrapperIdentity.sessionId-or[string]$binding.wrapperUserSid-cne$WrapperIdentity.userSid){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Durable installed uninstall transaction identity is invalid' $transaction}
-    if([uint64](&$adapter.ReadCurrentEpoch $install)-ne[uint64]$transaction.leaseEpoch-or-not(&$adapter.ValidateSelectedGeneration $runtime $install $transaction)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Selected generation manifest or epoch does not match the transaction' $runtime}
-    $ready=&$adapter.RemoveSelectedGeneration $runtime $transaction
-    if($null-eq$ready-or$ready.phase-cne'ReadyForInno'-or-not(&$adapter.TestSelectedRootAbsent $runtime)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Selected generation removal was not proven' $runtime}
-    &$adapter.RemoveMatchedProductRegistration $ready
-    $receipt=&$adapter.FinalizeReceipt $ready
-    if($null-eq$receipt-or$receipt.phase-cne'Completed'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Completion receipt was not proven' $TransactionId}
-    $receipt
+    param([Parameter(Mandatory)][string]$TransactionId,[Parameter(Mandatory)][string]$RuntimeRoot,[Parameter(Mandatory)][string]$InstallRoot,[AllowNull()]$WrapperIdentity,[switch]$Resume,[switch]$WrapperResume,[hashtable]$Adapters)
+    if(($Resume-and$WrapperResume)-or$TransactionId-cnotmatch'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'-or-not[IO.Path]::IsPathRooted($RuntimeRoot)-or-not[IO.Path]::IsPathRooted($InstallRoot)-or(-not$Resume-and-not(Test-CcodInstalledFinalizerIdentity $WrapperIdentity))){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer inputs are invalid' $TransactionId}
+    $runtime=[IO.Path]::GetFullPath($RuntimeRoot);$install=[IO.Path]::GetFullPath($InstallRoot);$local=Get-CcodInstalledFinalizerLocalAppData;$transactionRoot=[IO.Path]::GetFullPath((Join-Path $local 'CodexRemote-fix-uninstall'));$payloadRoot=[IO.Path]::GetFullPath((Join-Path (Join-Path $transactionRoot $TransactionId) 'payload'))
+    if($null-eq$Adapters){$expectedSelf=[IO.Path]::GetFullPath((Join-Path $payloadRoot 'src\persistence\InstalledUninstallFinalizer.ps1'));if([string]::IsNullOrWhiteSpace($PSCommandPath)-or[IO.Path]::GetFullPath($PSCommandPath)-cne$expectedSelf){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer is outside the durable staged payload' $PSCommandPath};[void](Read-CcodInstalledFinalizerEnvelope -TransactionRoot $transactionRoot -TransactionId $TransactionId -PayloadRoot $payloadRoot -RuntimeRoot $runtime -InstallRoot $install)}
+    $adapter=Get-CcodInstalledFinalizerAdapters -Adapters $Adapters -TransactionRoot $transactionRoot -PayloadRoot $payloadRoot -RuntimeRoot $runtime -InstallRoot $install;$caller=&$adapter.GetCurrentIdentity
+    if($null-eq$caller-or$caller.userSid-isnot[string]-or$caller.userSid-cnotmatch'^S-1-'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Current resume caller identity is invalid' $caller}
+    $accountLease=$null;$lock=$null
+    try{
+        $lock=&$adapter.EnterTransactionLock $caller.userSid
+        if($null-eq$lock){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer transaction lock was not acquired' $caller.userSid}
+        $accountLease=&$adapter.EnterAccountTransition $caller.userSid
+        if($null-eq$accountLease){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Shared account transition authority was not acquired' $caller.userSid}
+        $transaction=&$adapter.ReadPreparedTransaction $TransactionId $install
+        $phase=Assert-CcodInstalledFinalizerTransactionBinding -Transaction $transaction -TransactionId $TransactionId -RuntimeRoot $runtime -InstallRoot $install -CallerIdentity $caller -WrapperIdentity $WrapperIdentity -IsResume ([bool]$Resume) -IsWrapperResume ([bool]$WrapperResume) -PayloadRoot $payloadRoot
+        if(-not(&$adapter.ValidateStagedPayload $transaction $payloadRoot)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Durable staged uninstall payload is invalid' $payloadRoot}
+        if([uint64](&$adapter.ReadCurrentEpoch $install)-ne[uint64]$transaction.leaseEpoch){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Lifecycle epoch no longer matches the uninstall transaction' $install}
+
+        if(-not$Resume){$wrapperExit=&$adapter.WaitWrapperExit $WrapperIdentity 15000;if($null-eq$wrapperExit-or$wrapperExit.verifiedAtStart-isnot[bool]-or-not$wrapperExit.verifiedAtStart-or$wrapperExit.exited-isnot[bool]-or-not$wrapperExit.exited){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed wrapper was not verified before its exact exit' $WrapperIdentity}}
+        $resumeAnchorState=if($Resume){[string](&$adapter.GetResumeProductRegistrationState $transaction)}else{'Invalid'}
+
+        if($phase-ceq'TaskRemoved'){
+            $rootState=&$adapter.GetSelectedRootState $runtime
+            if($rootState-ceq'Present'){
+                if($Resume){$latestWrapper=if($null-ne$transaction.installedBinding.resumeWrapperPid){[pscustomobject]@{pid=[int]$transaction.installedBinding.resumeWrapperPid;creationTimeUtc=[string]$transaction.installedBinding.resumeWrapperCreationTimeUtc;sessionId=[int]$transaction.installedBinding.resumeWrapperSessionId;userSid=[string]$transaction.installedBinding.resumeWrapperUserSid}}else{[pscustomobject]@{pid=[int]$transaction.installedBinding.wrapperPid;creationTimeUtc=[string]$transaction.installedBinding.wrapperCreationTimeUtc;sessionId=[int]$transaction.installedBinding.wrapperSessionId;userSid=[string]$transaction.installedBinding.wrapperUserSid}};$resumeWrapperExit=&$adapter.WaitWrapperExit $latestWrapper 15000;if($null-eq$resumeWrapperExit-or-not$resumeWrapperExit.verifiedAtStart-or-not$resumeWrapperExit.exited){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Public resume could not prove the latest runtime wrapper exited' $latestWrapper}}
+                if([uint64](&$adapter.ReadCurrentEpoch $install)-ne[uint64]$transaction.leaseEpoch){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Lifecycle epoch changed before generation reclamation' $install}
+                if(-not(&$adapter.ValidateSelectedGeneration $runtime $install $transaction)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Selected generation manifest does not match the transaction' $runtime}
+                if($resumeAnchorState-cne'Exact'){&$adapter.InstallResumeProductRegistration $transaction;$resumeAnchorState=[string](&$adapter.GetResumeProductRegistrationState $transaction);if($resumeAnchorState-cne'Exact'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Durable public resume entry was not committed before reclamation' $TransactionId}}
+                &$adapter.ReclaimSelectedGeneration $runtime $transaction|Out-Null
+                if((&$adapter.GetSelectedRootState $runtime)-cne'Absent'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Selected generation removal was not proven' $runtime}
+            }elseif($rootState-cne'Absent'-or-not$Resume-or$resumeAnchorState-cne'Exact'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Selected generation state is not resumable' $runtime}
+            if($resumeAnchorState-cne'Exact'-or[string](&$adapter.GetResumeProductRegistrationState $transaction)-cne'Exact'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Generation absence lacks its write-ahead resume authority' $TransactionId}
+            $transaction=&$adapter.WriteReadyForInno $transaction
+            if($null-eq$transaction-or$transaction.phase-cne'ReadyForInno'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'ReadyForInno phase was not durable' $TransactionId}
+            $phase='ReadyForInno'
+        }
+        if($phase-ceq'ReadyForInno'){
+            if([string](&$adapter.GetResumeProductRegistrationState $transaction)-cne'Exact'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Product tail lacks its durable public resume entry' $TransactionId}
+            &$adapter.RemoveMatchedProductShortcuts $transaction
+            if([string](&$adapter.GetResumeProductRegistrationState $transaction)-cne'Exact'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Public resume entry disappeared before completion receipt' $TransactionId}
+            [void](&$adapter.FinalizeReceipt $transaction)
+            $transaction=&$adapter.ReadPreparedTransaction $TransactionId $install
+            $phase=Assert-CcodInstalledFinalizerTransactionBinding -Transaction $transaction -TransactionId $TransactionId -RuntimeRoot $runtime -InstallRoot $install -CallerIdentity $caller -WrapperIdentity $WrapperIdentity -IsResume $true -IsWrapperResume $false -PayloadRoot $payloadRoot
+        }
+        if($phase-cne'Completed'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed uninstall tail did not reach Completed' $TransactionId}
+        if(-not(&$adapter.TestCompletedReceipt $transaction)){[void](&$adapter.FinalizeReceipt $transaction);$transaction=&$adapter.ReadPreparedTransaction $TransactionId $install;if(-not(&$adapter.TestCompletedReceipt $transaction)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Completed receipt is not durable' $TransactionId}}
+        $completedAnchor=[string](&$adapter.GetResumeProductRegistrationState $transaction);if($completedAnchor-ceq'Exact'){[void](&$adapter.RemoveResumeProductRegistration $transaction)}elseif($completedAnchor-cne'Absent'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Completed uninstall has an invalid final public anchor' $TransactionId}
+        return $transaction
+    }finally{if($null-ne$accountLease){&$adapter.ExitAccountTransition $accountLease};if($null-ne$lock){&$adapter.ExitTransactionLock $lock}}
 }
 
 if($MyInvocation.InvocationName-ne'.'){
-    $currentIdentity=[Security.Principal.WindowsIdentity]::GetCurrent();$process=[Diagnostics.Process]::GetCurrentProcess();try{$identity=[pscustomobject]@{pid=[int]$WrapperProcessId;creationTimeUtc=$WrapperCreationTimeUtc;sessionId=[int]$process.SessionId;userSid=[string]$currentIdentity.User.Value}}finally{$process.Dispose();$currentIdentity.Dispose()}
-    try{Invoke-CcodInstalledUninstallFinalizer -TransactionId $TransactionId -RuntimeRoot $RuntimeRoot -InstallRoot $InstallRoot -WrapperIdentity $identity|Out-Null;exit 0}catch{[Console]::Error.WriteLine([string]$_.FullyQualifiedErrorId);exit 3}
+    $identity=$null
+    if(-not$Resume){$currentIdentity=[Security.Principal.WindowsIdentity]::GetCurrent();$process=[Diagnostics.Process]::GetCurrentProcess();try{$identity=[pscustomobject]@{pid=[int]$WrapperProcessId;creationTimeUtc=$WrapperCreationTimeUtc;sessionId=[int]$process.SessionId;userSid=[string]$currentIdentity.User.Value}}finally{$process.Dispose();$currentIdentity.Dispose()}}
+    try{Invoke-CcodInstalledUninstallFinalizer -TransactionId $TransactionId -RuntimeRoot $RuntimeRoot -InstallRoot $InstallRoot -WrapperIdentity $identity -Resume:$Resume -WrapperResume:$WrapperResume|Out-Null;exit 0}catch{[Console]::Error.WriteLine([string]$_.FullyQualifiedErrorId);exit 3}
 }
diff --git a/src/persistence/UninstallBootstrap.ps1 b/src/persistence/UninstallBootstrap.ps1
index 83588d7..28cb142 100644
--- a/src/persistence/UninstallBootstrap.ps1
+++ b/src/persistence/UninstallBootstrap.ps1
@@ -327,8 +327,8 @@ function New-CcodUninstallBootstrapResumeContext {
         [Parameter(Mandatory)]$Identity
     )
     Assert-CcodUninstallBootstrapTransaction $Transaction -ExpectedInstallRoot $InstallRoot
-    if ($Transaction.userSid -cne $Identity.userSid -or $Transaction.sessionId -ne $Identity.sessionId) {
-        Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISMATCH' 'The interrupted uninstall transaction does not match the current user and session' $Transaction
+    if ($Transaction.userSid -cne $Identity.userSid) {
+        Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISMATCH' 'The interrupted uninstall transaction does not match the current user' $Transaction
     }
     $resumePhase = if ($Transaction.phase -ceq 'Failed') { $Transaction.resumePhase } else { $Transaction.phase }
     if (@('TaskRemoved','ApplicationStateRemoved','ReadyForInno') -cnotcontains $resumePhase) {
@@ -682,11 +682,12 @@ function Assert-CcodUninstallBootstrapFinalizationInvocation {
     param(
         [Parameter(Mandatory)][string]$TransactionRoot,
         [Parameter(Mandatory)]$Transaction,
-        [Parameter(Mandatory)]$Identity
+        [Parameter(Mandatory)]$Identity,
+        [string]$InvocationPath=$PSCommandPath
     )
     Assert-CcodUninstallBootstrapTransaction $Transaction
-    if ($Transaction.userSid -cne $Identity.userSid -or $Transaction.sessionId -ne $Identity.sessionId) {
-        Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISMATCH' 'The finalizing uninstall transaction does not match the current user and session' $Transaction
+    if ($Transaction.userSid -cne $Identity.userSid) {
+        Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISMATCH' 'The finalizing uninstall transaction does not match the current user' $Transaction
     }
     $root = Get-CcodUninstallBootstrapComparablePath -Path $TransactionRoot -Kind 'External uninstall transaction root'
     Assert-CcodUninstallBootstrapDirectoryAcl -Path $root -UserSid $Identity.userSid
@@ -694,9 +695,9 @@ function Assert-CcodUninstallBootstrapFinalizationInvocation {
     Assert-CcodUninstallBootstrapSafePath -Root $root -Path $directory | Out-Null
     Assert-CcodUninstallBootstrapDirectoryAcl -Path $directory -UserSid $Identity.userSid
     $expectedScript = Resolve-CcodUninstallBootstrapChildPath -Root $directory -RelativePath 'payload\src\persistence\UninstallBootstrap.ps1' -RequireLeafFile
-    if ([string]::IsNullOrWhiteSpace($PSCommandPath) -or
-        (Get-CcodUninstallBootstrapFullPath -Path $PSCommandPath -Kind 'Staged bootstrap script') -cne $expectedScript) {
-        Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'The finalization bootstrap was not launched from the staged transaction payload' $PSCommandPath
+    if ([string]::IsNullOrWhiteSpace($InvocationPath) -or
+        (Get-CcodUninstallBootstrapFullPath -Path $InvocationPath -Kind 'Staged bootstrap script') -cne $expectedScript) {
+        Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'The finalization bootstrap was not launched from the staged transaction payload' $InvocationPath
     }
 }
 
@@ -823,6 +824,32 @@ function Assert-CcodUninstallBootstrapReadyEvidence {
     return $ReadyEvidence
 }
 
+function Test-CcodUninstallBootstrapStoredCompletedReceipt {
+    param([Parameter(Mandatory)][string]$TransactionRoot,[Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][string]$ExpectedUserSid)
+    try{
+        Assert-CcodUninstallBootstrapTransaction $Transaction
+        if($Transaction.phase-cne'Completed'-or$Transaction.resumePhase-cne'Completed'-or$Transaction.userSid-cne$ExpectedUserSid){return $false}
+        $root=Get-CcodUninstallBootstrapComparablePath -Path $TransactionRoot -Kind 'External uninstall transaction root';Assert-CcodUninstallBootstrapDirectoryAcl -Path $root -UserSid $ExpectedUserSid
+        $directory=Get-CcodUninstallBootstrapTransactionPath -TransactionRoot $root -TransactionId $Transaction.transactionId;Assert-CcodUninstallBootstrapSafePath -Root $root -Path $directory|Out-Null;Assert-CcodUninstallBootstrapDirectoryAcl -Path $directory -UserSid $ExpectedUserSid
+        $path=Resolve-CcodUninstallBootstrapChildPath -Root $directory -RelativePath 'receipt.json' -RequireLeafFile;$receipt=Read-CcodUninstallBootstrapJson -Path $path -Kind 'Uninstall receipt'
+        if(-not(Test-CcodUninstallBootstrapExactProperties $receipt @('schemaVersion','transactionId','runtimeId','runtimeGeneration','leaseEpoch','phase','updatedAtUtc','errorCode'))){return $false}
+        return $receipt.schemaVersion-is[int]-and$receipt.schemaVersion-eq1-and$receipt.transactionId-cne$null-and$receipt.transactionId-ceq$Transaction.transactionId-and$receipt.runtimeId-ceq$Transaction.runtimeId-and[uint64]$receipt.runtimeGeneration-eq[uint64]$Transaction.runtimeGeneration-and[uint64]$receipt.leaseEpoch-eq[uint64]$Transaction.leaseEpoch-and$receipt.phase-ceq'Completed'-and$receipt.updatedAtUtc-ceq$Transaction.updatedAtUtc-and$null-eq$receipt.errorCode
+    }catch{return $false}
+}
+
+function Get-CcodUninstallBootstrapInstalledResumeCommand {
+    param(
+        [Parameter(Mandatory)][string]$ResumeScriptPath,
+        [Parameter(Mandatory)][string]$TransactionId,
+        [Parameter(Mandatory)][string]$RuntimeRoot,
+        [Parameter(Mandatory)][string]$InstallRoot
+    )
+    foreach($value in @($ResumeScriptPath,$RuntimeRoot,$InstallRoot)){if($value.Contains('"')){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'Installed resume command path contains a quote.' $value}}
+    $system=[Environment]::GetFolderPath([Environment+SpecialFolder]::System);if([string]::IsNullOrWhiteSpace($system)){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'Windows system folder is unavailable.' $null}
+    $powershell=[IO.Path]::GetFullPath((Join-Path $system 'WindowsPowerShell\v1.0\powershell.exe'))
+    return '"{0}" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "{1}" -Resume -TransactionId "{2}" -RuntimeRoot "{3}" -InstallRoot "{4}"'-f$powershell,[IO.Path]::GetFullPath($ResumeScriptPath),$TransactionId,[IO.Path]::GetFullPath($RuntimeRoot),[IO.Path]::GetFullPath($InstallRoot)
+}
+
 function Assert-CcodUninstallBootstrapContext {
     param([Parameter(Mandatory)]$Context,[string]$ExpectedInstallRoot)
     if (-not (Test-CcodUninstallBootstrapExactProperties $Context $script:CcodUninstallContextFields) -or
@@ -870,7 +897,23 @@ function Assert-CcodUninstallBootstrapTransaction {
     [void](ConvertTo-CcodUninstallBootstrapUInt64 $Transaction.leaseEpoch 'leaseEpoch')
     $readyRoot=if([string]::IsNullOrWhiteSpace($ExpectedInstallRoot)){[string]$Transaction.readyEvidence.installRoot}else{$ExpectedInstallRoot}
     [void](Assert-CcodUninstallBootstrapReadyEvidence -ReadyEvidence $Transaction.readyEvidence -ExpectedInstallRoot $readyRoot -ExpectedRuntimeId $Transaction.runtimeId -ExpectedRuntimeGeneration $Transaction.runtimeGeneration -ErrorId 'CCOD_UNINSTALL_TRANSACTION_INVALID')
-    if($null-ne$Transaction.installedBinding){$binding=$Transaction.installedBinding;if(-not(Test-CcodUninstallBootstrapExactProperties $binding @('selectedRuntimeRoot','runtimeManifestSha256','wrapperPid','wrapperCreationTimeUtc','wrapperSessionId','wrapperUserSid'))-or$binding.selectedRuntimeRoot-isnot[string]-or-not[IO.Path]::IsPathRooted($binding.selectedRuntimeRoot)-or$binding.runtimeManifestSha256-isnot[string]-or$binding.runtimeManifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$binding.wrapperPid-isnot[int]-or$binding.wrapperPid-lt1-or-not(Test-CcodUninstallBootstrapCanonicalUtc $binding.wrapperCreationTimeUtc)-or$binding.wrapperSessionId-isnot[int]-or$binding.wrapperSessionId-lt0-or$binding.wrapperUserSid-isnot[string]-or$binding.wrapperUserSid-cnotmatch'^S-'){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_INVALID' 'Installed finalization binding is invalid' $binding}}
+    if($null-ne$Transaction.installedBinding){
+        $binding=$Transaction.installedBinding
+        try{$resumeLength=ConvertTo-CcodUninstallBootstrapUInt64 $binding.resumeScriptLength 'resumeScriptLength'}catch{Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_INVALID' 'Installed finalization binding is invalid' $binding}
+        $resumeWrapperEmpty=$null-eq$binding.resumeWrapperPid-and$null-eq$binding.resumeWrapperCreationTimeUtc-and$null-eq$binding.resumeWrapperSessionId-and$null-eq$binding.resumeWrapperUserSid
+        $resumeWrapperValid=$binding.resumeWrapperPid-is[int]-and$binding.resumeWrapperPid-gt0-and(Test-CcodUninstallBootstrapCanonicalUtc $binding.resumeWrapperCreationTimeUtc)-and$binding.resumeWrapperSessionId-is[int]-and$binding.resumeWrapperSessionId-ge0-and$binding.resumeWrapperUserSid-is[string]-and$binding.resumeWrapperUserSid-ceq$Transaction.userSid
+        if(-not(Test-CcodUninstallBootstrapExactProperties $binding @('selectedRuntimeRoot','runtimeManifestSha256','wrapperPid','wrapperCreationTimeUtc','wrapperSessionId','wrapperUserSid','resumeWrapperPid','resumeWrapperCreationTimeUtc','resumeWrapperSessionId','resumeWrapperUserSid','resumeScriptPath','resumeScriptLength','resumeScriptSha256','resumeCommand','payloadRecords'))-or
+           $binding.selectedRuntimeRoot-isnot[string]-or-not[IO.Path]::IsPathRooted($binding.selectedRuntimeRoot)-or$binding.runtimeManifestSha256-isnot[string]-or$binding.runtimeManifestSha256-cnotmatch'^[0-9a-f]{64}$'-or
+           $binding.wrapperPid-isnot[int]-or$binding.wrapperPid-lt1-or-not(Test-CcodUninstallBootstrapCanonicalUtc $binding.wrapperCreationTimeUtc)-or$binding.wrapperSessionId-isnot[int]-or$binding.wrapperSessionId-lt0-or
+           $binding.wrapperUserSid-isnot[string]-or$binding.wrapperUserSid-cnotmatch'^S-'-or$binding.resumeScriptPath-isnot[string]-or-not[IO.Path]::IsPathRooted($binding.resumeScriptPath)-or
+           [char[]]$binding.resumeScriptPath-ccontains[char]'"'-or[char[]]$binding.selectedRuntimeRoot-ccontains[char]'"'-or$binding.resumeScriptSha256-isnot[string]-or$binding.resumeScriptSha256-cnotmatch'^[0-9a-f]{64}$'-or
+           (-not$resumeWrapperEmpty-and-not$resumeWrapperValid)-or$binding.resumeCommand-isnot[string]-or$binding.resumeCommand-cne(Get-CcodUninstallBootstrapInstalledResumeCommand -ResumeScriptPath $binding.resumeScriptPath -TransactionId $Transaction.transactionId -RuntimeRoot $binding.selectedRuntimeRoot -InstallRoot $Transaction.readyEvidence.installRoot)){
+            Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_INVALID' 'Installed finalization binding is invalid' $binding
+        }
+        $records=@($binding.payloadRecords);if($records.Count-ne$script:CcodUninstallPayloadEntries.Count){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_INVALID' 'Installed finalization payload binding is incomplete' $binding}
+        for($index=0;$index-lt$records.Count;$index++){$record=$records[$index];if(-not(Test-CcodUninstallBootstrapExactProperties $record @('path','length','sha256'))-or$record.path-isnot[string]-or$record.path-cne$script:CcodUninstallPayloadEntries[$index]-or$record.sha256-isnot[string]-or$record.sha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_INVALID' 'Installed finalization payload binding is invalid' $record};[void](ConvertTo-CcodUninstallBootstrapUInt64 $record.length 'payload length')}
+        $resumeRecord=@($records|Where-Object{$_.path-ceq'src/persistence/InstalledUninstallFinalizer.ps1'});if($resumeRecord.Count-ne1-or[uint64]$resumeRecord[0].length-ne$resumeLength-or$resumeRecord[0].sha256-cne$binding.resumeScriptSha256){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_INVALID' 'Installed resume script is not bound to the complete payload' $binding}
+    }
     $started = [DateTime]::ParseExact($Transaction.startedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
     $updated = [DateTime]::ParseExact($Transaction.updatedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
     $resumable = @('Requested','Recovering','RecoveryProven','StoppingProtection','ProtectionStopped','TaskRemoved','ApplicationStateRemoved','ReadyForInno')
@@ -925,6 +968,14 @@ function Get-CcodUninstallBootstrapAdapters {
         GetTransactionRoot = {
             Get-CcodUninstallBootstrapDefaultTransactionRoot
         }
+        EnterAccountTransition = {
+            param($UserSid)
+            Import-Module (Join-Path $PSScriptRoot 'modules\KernelObjects.psm1') -Force -DisableNameChecking -ErrorAction Stop
+            $lease=Enter-CcodMutex -Kind AccountTransition -UserSid $UserSid -TimeoutMilliseconds 30000
+            if($null-eq$lease-or$lease.Outcome-cne'Acquired'-or$lease.Kind-cne'AccountTransition'){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_BUSY' 'The shared account transition authority is busy' $UserSid}
+            $lease
+        }
+        ExitAccountTransition = {param($Lease)Import-Module (Join-Path $PSScriptRoot 'modules\KernelObjects.psm1') -Force -DisableNameChecking -ErrorAction Stop;[void](Exit-CcodMutex -Lease $Lease)}
         ReadTransaction = {
             param($TransactionRoot,$ExpectedUserSid,$IncludeCompleted,$ExpectedInstallRoot)
             Read-CcodUninstallBootstrapStoredTransaction -TransactionRoot $TransactionRoot -ExpectedUserSid $ExpectedUserSid -IncludeCompleted:([bool]$IncludeCompleted) -ExpectedInstallRoot $ExpectedInstallRoot
@@ -977,10 +1028,13 @@ function Get-CcodUninstallBootstrapAdapters {
             Remove-CcodUninstallBootstrapProductRegistration -Context $Context
         }
         GetInstalledBinding = {
-            param($InstallerRoot,$InstallRoot,$Context,$WrapperIdentity)
+            param($InstallerRoot,$InstallRoot,$Context,$WrapperIdentity,$TransactionDirectory,$TransactionId)
             $identity=Get-CcodUninstallBootstrapCurrentIdentity;$process=[Diagnostics.Process]::GetCurrentProcess();try{$created=$process.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture);if($WrapperIdentity.pid-ne[int]$process.Id-or$WrapperIdentity.creationTimeUtc-cne$created-or$WrapperIdentity.sessionId-ne[int]$process.SessionId-or$WrapperIdentity.userSid-cne$identity.userSid){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'Installed wrapper identity does not match the current verified process' $WrapperIdentity}}finally{$process.Dispose()}
             $selected=[IO.Path]::GetFullPath((Join-Path (Join-Path $InstallRoot 'runtime') ([string]$Context.runtimeId)));if([IO.Path]::GetFullPath($InstallerRoot)-cne$selected){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'Installed wrapper is outside the selected runtime' $InstallerRoot};$manifest=Get-CcodUninstallBootstrapFileFingerprint -Path (Join-Path $selected 'manifest.json')
-            [pscustomobject][ordered]@{selectedRuntimeRoot=$selected;runtimeManifestSha256=[string]$manifest.sha256;wrapperPid=[int]$WrapperIdentity.pid;wrapperCreationTimeUtc=[string]$WrapperIdentity.creationTimeUtc;wrapperSessionId=[int]$WrapperIdentity.sessionId;wrapperUserSid=[string]$WrapperIdentity.userSid}
+            $resumeRecord=@($Context.payloadRecords|Where-Object{[string]$_.path-ceq'src/persistence/InstalledUninstallFinalizer.ps1'});if($resumeRecord.Count-ne1){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_BOOTSTRAP_INVALID' 'Installed resume payload record is missing.' $Context.runtimeId}
+            $resumeScript=[IO.Path]::GetFullPath((Join-Path $TransactionDirectory 'payload\src\persistence\InstalledUninstallFinalizer.ps1'))
+            $resumeCommand=Get-CcodUninstallBootstrapInstalledResumeCommand -ResumeScriptPath $resumeScript -TransactionId $TransactionId -RuntimeRoot $selected -InstallRoot $InstallRoot
+            [pscustomobject][ordered]@{selectedRuntimeRoot=$selected;runtimeManifestSha256=[string]$manifest.sha256;wrapperPid=[int]$WrapperIdentity.pid;wrapperCreationTimeUtc=[string]$WrapperIdentity.creationTimeUtc;wrapperSessionId=[int]$WrapperIdentity.sessionId;wrapperUserSid=[string]$WrapperIdentity.userSid;resumeWrapperPid=$null;resumeWrapperCreationTimeUtc=$null;resumeWrapperSessionId=$null;resumeWrapperUserSid=$null;resumeScriptPath=$resumeScript;resumeScriptLength=[int64]$resumeRecord[0].length;resumeScriptSha256=[string]$resumeRecord[0].sha256;resumeCommand=$resumeCommand;payloadRecords=@($Context.payloadRecords)}
         }
         TestInstallRootAbsent = { param($InstallerRoot) -not ([IO.Directory]::Exists($InstallerRoot) -or [IO.File]::Exists($InstallerRoot)) }
         GetUtcNow = { [DateTime]::UtcNow }
@@ -998,6 +1052,13 @@ function Get-CcodUninstallBootstrapAdapters {
     return $resolved
 }
 
+function Test-CcodUninstallBootstrapInstalledBindingResume {
+    param($Existing,$Observed)
+    if($null-eq$Existing-or$null-eq$Observed){return $false}
+    foreach($name in @('selectedRuntimeRoot','runtimeManifestSha256','resumeScriptPath','resumeScriptLength','resumeScriptSha256','resumeCommand')){if(($Existing.$name|ConvertTo-Json -Compress)-cne($Observed.$name|ConvertTo-Json -Compress)){return $false}}
+    return ($Existing.payloadRecords|ConvertTo-Json -Depth 6 -Compress)-ceq($Observed.payloadRecords|ConvertTo-Json -Depth 6 -Compress)
+}
+
 function Remove-CcodUninstallBootstrapProductRegistration {
     param([Parameter(Mandatory)]$Context)
     Assert-CcodUninstallBootstrapContext $Context
@@ -1037,19 +1098,21 @@ function Invoke-CcodUninstallBootstrap {
             $transaction = & $adapter.ReadTransaction $transactionRoot $identity.userSid $true $InstallRoot
             if ($null -eq $transaction) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISSING' 'No resumable uninstall transaction exists' $transactionRoot }
             Assert-CcodUninstallBootstrapTransaction $transaction -ExpectedInstallRoot $InstallRoot
-            if ($transaction.phase -ne 'ReadyForInno') { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_FINALIZATION_INVALID' 'The uninstall transaction is not ready for Inno finalization' $transaction }
+            if ($transaction.phase -notin @('ReadyForInno','Completed')) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_FINALIZATION_INVALID' 'The uninstall transaction is not ready for Inno finalization' $transaction }
             & $adapter.ValidateFinalizationInvocation $transactionRoot $transaction $identity
             if (-not (& $adapter.TestInstallRootAbsent $InstallerRoot)) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_FINALIZATION_INCOMPLETE' 'Inno did not remove the application root' $InstallerRoot }
             $transactionDirectory = & $adapter.GetTransactionDirectory $transactionRoot $transaction.transactionId
             if ($transactionDirectory -isnot [string] -or [string]::IsNullOrWhiteSpace($transactionDirectory)) {
                 Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_ROOT_INVALID' 'The external uninstall transaction root is invalid' $transactionDirectory
             }
-            $transaction.phase = 'Completed'
-            $transaction.resumePhase = 'Completed'
-            $transaction.updatedAtUtc = (& $adapter.GetUtcNow).ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)
-            $transaction.errorCode = $null
-            Assert-CcodUninstallBootstrapTransaction $transaction
-            & $adapter.WriteTransaction $transactionDirectory $transaction
+            if($transaction.phase-ceq'ReadyForInno'){
+                $transaction.phase = 'Completed'
+                $transaction.resumePhase = 'Completed'
+                $transaction.updatedAtUtc = (& $adapter.GetUtcNow).ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)
+                $transaction.errorCode = $null
+                Assert-CcodUninstallBootstrapTransaction $transaction
+                & $adapter.WriteTransaction $transactionDirectory $transaction
+            }
             & $adapter.WriteReceipt $transactionDirectory $transaction
             return $transaction
         } finally {
@@ -1062,7 +1125,9 @@ function Invoke-CcodUninstallBootstrap {
     $transaction = $null
     $stageRoot = $null
     $stagePayload = $false
+    $returnExistingInstalledTaskRemoved = $false
     $transactionLock = $null
+    $accountTransition = $null
     try {
         $validationFailure = $null
         try {
@@ -1079,6 +1144,7 @@ function Invoke-CcodUninstallBootstrap {
             Get-CcodUninstallBootstrapCurrentIdentity
         }
         $transactionLock = Enter-CcodUninstallBootstrapTransactionLock -UserSid $identity.userSid
+        if($Mode-ceq'PrepareInstalled'){$accountTransition=&$adapter.EnterAccountTransition $identity.userSid}
         $existing = & $adapter.ReadTransaction $transactionRoot $identity.userSid $true $InstallRoot
         if ($null -eq $context) {
             if ($null -eq $existing) { throw $validationFailure }
@@ -1094,19 +1160,27 @@ function Invoke-CcodUninstallBootstrap {
             if ($stageRoot -isnot [string] -or [string]::IsNullOrWhiteSpace($stageRoot)) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_ROOT_INVALID' 'The external uninstall transaction root is invalid' $stageRoot }
             $now = & $adapter.GetUtcNow
             if ($now -isnot [DateTime]) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_CLOCK_INVALID' 'The uninstall clock is invalid' $now }
-            $installedBinding=if($Mode-ceq'PrepareInstalled'){&$adapter.GetInstalledBinding $InstallerRoot $InstallRoot $context $WrapperIdentity}else{$null}
+            $installedBinding=if($Mode-ceq'PrepareInstalled'){&$adapter.GetInstalledBinding $InstallerRoot $InstallRoot $context $WrapperIdentity $stageRoot $transactionId}else{$null}
             $transaction = New-CcodUninstallBootstrapTransaction -Context $context -TransactionId $transactionId -NowUtc $now -InstalledBinding $installedBinding
             & $adapter.WriteTransaction $stageRoot $transaction
             & $adapter.PublishTransaction $transactionRoot $transactionId $context.userSid ([bool]$replaceCompletedLocator)
             $stagePayload = $true
         } else {
             Assert-CcodUninstallBootstrapTransactionMatchesContext $transaction $context $InstallRoot
-            if($Mode-ceq'PrepareInstalled'){$binding=&$adapter.GetInstalledBinding $InstallerRoot $InstallRoot $context $WrapperIdentity;if($null-eq$transaction.installedBinding-or($binding|ConvertTo-Json -Compress)-cne($transaction.installedBinding|ConvertTo-Json -Compress)){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISMATCH' 'Installed wrapper binding changed during resume' $binding}}
             $stageRoot = & $adapter.GetTransactionDirectory $transactionRoot $transaction.transactionId
             if ($stageRoot -isnot [string] -or [string]::IsNullOrWhiteSpace($stageRoot)) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_ROOT_INVALID' 'The external uninstall transaction root is invalid' $stageRoot }
+            if($Mode-ceq'PrepareInstalled'){
+                $binding=&$adapter.GetInstalledBinding $InstallerRoot $InstallRoot $context $WrapperIdentity $stageRoot $transaction.transactionId
+                if(-not(Test-CcodUninstallBootstrapInstalledBindingResume -Existing $transaction.installedBinding -Observed $binding)){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISMATCH' 'Installed wrapper binding changed during resume' $binding}
+                if(($transaction.phase-ceq'TaskRemoved'-and$transaction.resumePhase-ceq'TaskRemoved')-or($transaction.phase-ceq'Failed'-and$transaction.resumePhase-ceq'TaskRemoved')){
+                    $transaction.installedBinding.resumeWrapperPid=[int]$WrapperIdentity.pid;$transaction.installedBinding.resumeWrapperCreationTimeUtc=[string]$WrapperIdentity.creationTimeUtc;$transaction.installedBinding.resumeWrapperSessionId=[int]$WrapperIdentity.sessionId;$transaction.installedBinding.resumeWrapperUserSid=[string]$WrapperIdentity.userSid
+                    $transaction.phase='TaskRemoved';$transaction.resumePhase='TaskRemoved';$transaction.errorCode=$null;$transaction.updatedAtUtc=(& $adapter.GetUtcNow).ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture);Assert-CcodUninstallBootstrapTransaction $transaction -ExpectedInstallRoot $InstallRoot;&$adapter.WriteTransaction $stageRoot $transaction;$returnExistingInstalledTaskRemoved=$true
+                }
+            }
             $stagePayload = $transaction.phase -ceq 'Requested' -or ($transaction.phase -ceq 'Failed' -and $transaction.resumePhase -ceq 'Requested')
         }
         if ($stagePayload) { & $adapter.StagePayload $InstallerRoot $InstallRoot $context $stageRoot }
+        if($returnExistingInstalledTaskRemoved){&$adapter.WriteReceipt $stageRoot $transaction;return $transaction}
         $result = & $adapter.RunCleanup $InstallerRoot $InstallRoot $stageRoot $transaction $adapter.WriteTransaction $Mode
         if ($null -eq $result) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PREPARE_FAILED' 'The staged cleanup returned no transaction receipt' $stageRoot }
         Assert-CcodUninstallBootstrapTransactionMatchesContext $result $context $InstallRoot
@@ -1122,6 +1196,7 @@ function Invoke-CcodUninstallBootstrap {
         if ((Get-CcodUninstallBootstrapErrorId $_) -ceq $code) { throw }
         Throw-CcodUninstallBootstrapError $code 'The uninstall bootstrap failed before Inno deletion' $stageRoot
     } finally {
+        if($null-ne$accountTransition){try{&$adapter.ExitAccountTransition $accountTransition}catch{}}
         Exit-CcodUninstallBootstrapTransactionLock -Lock $transactionLock
     }
 }
diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index ff691e2..f33da70 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -1264,7 +1264,7 @@ function Get-CcodLegacyMigrationRetryContext {
         Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Failed legacy migration runtime is not an exact current sealed generation' $retryRuntimeRoot
     }
     $selector=Get-CcodLegacyMigrationRetrySelectorProfile -InstallRoot $InstallRoot -ExistingPointer $ExistingPointer -LegacyRuntimeId ([string]$FailedTransaction.oldRuntimeId) -RetryRuntimeId ([string]$FailedTransaction.newRuntimeId)
-    if(($selector.Profile-ceq'PrePointer'-and$observedPhases.Contains('PointerCommitted'))-or($selector.Profile-ceq'PostPointerCompensated'-and-not$observedPhases.Contains('PointerCommitted'))){
+    if($selector.Profile-ceq'PrePointer'-and$observedPhases.Contains('PointerCommitted')){
         Throw-CcodLifecycleError 'CCOD_INSTALL_UPGRADE_SOURCE_INVALID' 'Failed migration phases do not match the exact selector profile' $FailedTransaction.transactionId
     }
     return [pscustomobject][ordered]@{
@@ -2895,8 +2895,10 @@ function Get-CcodLifecycleAdapters {
                     $registration=New-CcodProductRegistration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -Version $Version -PackageSha256 $PackageSha256 -FileTransaction $sourceCapability
                     $system=[Environment]::GetFolderPath([Environment+SpecialFolder]::System);$proof=[pscustomobject][ordered]@{phase=[string]$TransactionRecord.phase;runtimeId=$RuntimeId;version=$Version;packageSha256=$PackageSha256;runtimeGeneration=[uint64]$TransactionRecord.newGeneration;manifestSha256=[string]$TransactionRecord.newManifestSha256;startMenuSha256=(Get-CcodLifecycleFileSha256 $registration.startMenuShortcut.candidatePath);desktopSha256=(Get-CcodLifecycleFileSha256 $registration.desktopShortcut.candidatePath);targetPath=[IO.Path]::GetFullPath((Join-Path $system 'schtasks.exe'));arguments='/Run /TN "Codex Control Other Devices Supervisor"';transactionRecord=$TransactionRecord;bootstrapPath=$registration.bootstrapPath;uninstallerPath=$registration.uninstallerPath}
                     $commitAdapters=@{};if($null-ne$ProductAdapters){if($ProductAdapters-isnot[hashtable]){throw 'product side-effect adapters invalid'};foreach($key in $ProductAdapters.Keys){$commitAdapters[$key]=$ProductAdapters[$key]}};$commitAdapters.GetReadyProof={param($Ignored)$proof}.GetNewClosure()
+                    $legacyMigrationPlan=Get-CcodLegacyProductRegistrationMigrationPlan -ExpectedAppId '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}' -ExpectedInstallRoot $InstallRoot -Adapters $ProductAdapters
                     $receipt=Commit-CcodProductRegistration -Registration $registration -FileTransaction $sourceCapability -Adapters $commitAdapters
-                    Remove-CcodLegacyProductRegistration -ExpectedAppId '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}' -Adapters $ProductAdapters
+                    $expectedCurrentProof=[pscustomobject][ordered]@{verified=$true;runtimeId=$RuntimeId;version=$Version;packageSha256=$PackageSha256;shortcutNames=@('Programs\CodexRemote-fix\CodexRemote-fix.lnk','Desktop\CodexRemote-fix.lnk');startMenuSha256=[string]$proof.startMenuSha256;desktopSha256=[string]$proof.desktopSha256}
+                    Remove-CcodLegacyProductRegistration -ExpectedAppId '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}' -MigrationPlan $legacyMigrationPlan -ExpectedCurrentProof $expectedCurrentProof -Adapters $ProductAdapters
                     $receiptResult=[pscustomobject]@{verified=[bool]$receipt.verified;legacyRemoved=$true}
                 }catch{$operationFailure=$_}
                 finally{
diff --git a/src/persistence/modules/ProductRegistration.psm1 b/src/persistence/modules/ProductRegistration.psm1
index 58356ef..22bc463 100644
--- a/src/persistence/modules/ProductRegistration.psm1
+++ b/src/persistence/modules/ProductRegistration.psm1
@@ -11,6 +11,8 @@ $script:CcodShortcutFields = @('kind','leaf','relativePath','candidatePath','boo
 $script:CcodReadyFields = @('phase','runtimeId','version','packageSha256','runtimeGeneration','manifestSha256','startMenuSha256','desktopSha256','targetPath','arguments','transactionRecord','bootstrapPath','uninstallerPath')
 $script:CcodLegacyRegistrationFields = @('appId','displayVersion','installLocation','uninstallString','shortcutNames','unsafeShortcutNames')
 $script:CcodLegacyProfileFields = @('profileId','appId','minimumVersion','maximumVersion','uninstallCommandShape','shortcutNames')
+$script:CcodLegacyMigrationPlanFields = @('appId','expectedInstallRoot','legacyPresent','legacyRegistration','profile','snapshot')
+$script:CcodLegacyShortcutSnapshotFields = @('kind','name','path','sha256','bytesBase64','targetPath','arguments','workingDirectory')
 $script:CcodVerifiedRegistrationFields = @('verified','runtimeId','version','packageSha256','shortcutNames','startMenuSha256','desktopSha256')
 $script:CcodCurrentShortcutNames = @('Programs\CodexRemote-fix\CodexRemote-fix.lnk','Desktop\CodexRemote-fix.lnk')
 $script:CcodLegacyRegistryValueNames=@('DisplayName','DisplayVersion','UninstallString','QuietUninstallString','DisplayIcon','InstallLocation','Publisher','URLInfoAbout','HelpLink','URLUpdateInfo','NoModify','NoRepair','InstallDate','MajorVersion','MinorVersion','VersionMajor','VersionMinor','EstimatedSize','Language','Inno Setup: App Path','Inno Setup: Icon Group','Inno Setup: Setup Version','Inno Setup: User')
@@ -245,6 +247,51 @@ function Get-CcodProductPowerShellPath {
     $system=[Environment]::GetFolderPath([Environment+SpecialFolder]::System);if([string]::IsNullOrWhiteSpace($system)){throw 'system folder missing'}
     [IO.Path]::GetFullPath((Join-Path $system 'WindowsPowerShell\v1.0\powershell.exe'))
 }
+
+function Get-CcodLegacyShortcutContract {
+    param(
+        [Parameter(Mandatory)]$LegacyRegistration,
+        [Parameter(Mandatory)]$Profile,
+        [Parameter(Mandatory)][string]$Name,
+        [Parameter(Mandatory)][string]$ExpectedInstallRoot
+    )
+    $installRoot=Get-CcodProductFullPath $ExpectedInstallRoot
+    $installerRoot=Get-CcodProductFullPath ([string]$LegacyRegistration.installLocation)
+    $powershell=Get-CcodProductPowerShellPath
+    $bootstrap=Join-Path $installRoot 'bootstrap.ps1'
+    $version=[version]::Parse([string]$LegacyRegistration.displayVersion)
+    $explicit=if($version-ge[version]'2.5.0'){' -EntryMode Explicit'}else{''}
+    $mainArguments='-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "{0}" -InstallRoot "{1}"{2}'-f$bootstrap,$installRoot,$explicit
+    $oldDesktop='Desktop\Codex '+[char]0x8BBE+[char]0x5907+[char]0x8FDE+[char]0x63A5+' (Device Connection).lnk'
+    if($Name-ceq$oldDesktop){return [pscustomobject][ordered]@{targetPath=$powershell;arguments=$mainArguments;workingDirectory=$installRoot}}
+    switch -CaseSensitive ($Name) {
+        'Programs\Codex Control other devices\Codex Control other devices for Windows.lnk' {
+            return [pscustomobject][ordered]@{targetPath=(Join-Path $installerRoot 'README.md');arguments='';workingDirectory=''}
+        }
+        'Programs\Codex Control other devices\Open the tray supervisor.lnk' {
+            return [pscustomobject][ordered]@{targetPath=$powershell;arguments=('-NoProfile -ExecutionPolicy Bypass -File "{0}"'-f(Join-Path $installerRoot 'Start-CodexControlOtherDevices.ps1'));workingDirectory=$installerRoot}
+        }
+        'Programs\Codex Control other devices\Compatibility check.lnk' {
+            return [pscustomobject][ordered]@{targetPath=$powershell;arguments=('-NoProfile -ExecutionPolicy Bypass -File "{0}"'-f(Join-Path $installerRoot 'Test-CodexControlOtherDevices.ps1'));workingDirectory=$installerRoot}
+        }
+        'Programs\Codex Control other devices\Uninstall Codex Control other devices.lnk' {
+            return [pscustomobject][ordered]@{targetPath=(Join-Path $installerRoot 'unins000.exe');arguments='';workingDirectory=''}
+        }
+        'Programs\CodexRemote-fix\CodexRemote-fix.lnk' {
+            return [pscustomobject][ordered]@{targetPath=$powershell;arguments=$mainArguments;workingDirectory=$installRoot}
+        }
+        'Programs\CodexRemote-fix\CodexRemote-fix compatibility check.lnk' {
+            return [pscustomobject][ordered]@{targetPath=$powershell;arguments=('-NoProfile -ExecutionPolicy Bypass -File "{0}"'-f(Join-Path $installerRoot 'Test-CodexControlOtherDevices.ps1'));workingDirectory=$installerRoot}
+        }
+        'Programs\CodexRemote-fix\Uninstall CodexRemote-fix.lnk' {
+            return [pscustomobject][ordered]@{targetPath=(Join-Path $installerRoot 'unins000.exe');arguments='';workingDirectory=''}
+        }
+        'Desktop\CodexRemote-fix.lnk' {
+            return [pscustomobject][ordered]@{targetPath=$powershell;arguments=$mainArguments;workingDirectory=$installRoot}
+        }
+        default { Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy shortcut has no checked-in historical contract.' $Name }
+    }
+}
 function Get-CcodProductUninstallCommand($Registration) {
     '"{0}" -NoProfile -ExecutionPolicy Bypass -File "{1}"' -f (Get-CcodProductPowerShellPath),([string]$Registration.uninstallerPath).Replace('"','')
 }
@@ -392,6 +439,147 @@ function Remove-CcodProductRegistration {
     [CmdletBinding()]param([Parameter(Mandatory)]$ReadyEvidence,[hashtable]$Adapters)
     $fields=@('phase','installRoot','runtimeId','runtimeGeneration','packageSha256','manifestSha256','startMenuSha256','desktopSha256','targetPath','arguments');$canonicalTarget=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'schtasks.exe'));if(-not(Test-CcodProductExactProperties $ReadyEvidence $fields)-or$ReadyEvidence.phase-cne'Ready'-or$ReadyEvidence.installRoot-isnot[string]-or-not[IO.Path]::IsPathRooted($ReadyEvidence.installRoot)-or$ReadyEvidence.runtimeId-cnotmatch'^2\.5\.22-[0-9a-f]{16}-[0-9a-f]{32}$'-or[uint64]$ReadyEvidence.runtimeGeneration-lt1-or$ReadyEvidence.packageSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.manifestSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.startMenuSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.desktopSha256-cnotmatch'^[0-9a-f]{64}$'-or$ReadyEvidence.targetPath-isnot[string]-or[IO.Path]::GetFullPath([string]$ReadyEvidence.targetPath)-cne$canonicalTarget-or$ReadyEvidence.arguments-cne'/Run /TN "Codex Control Other Devices Supervisor"'){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Exact Ready cleanup evidence is invalid' $ReadyEvidence};$adapter=Get-CcodProductRegistrationAdapters $Adapters;$state=&$adapter.ReadCurrentProductState $ReadyEvidence.runtimeId;if($null-eq$state-or$state.valid-isnot[bool]-or-not$state.valid-or$null-eq$state.readyEvidence-or($state.readyEvidence|ConvertTo-Json -Compress)-cne($ReadyEvidence|ConvertTo-Json -Compress)-or$null-eq$state.entries){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Current product state is not bound to exact Ready evidence' $ReadyEvidence.runtimeId};$entries=@($state.entries);if($entries.Count-notin@(0,3)){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Current product state is ambiguous' $ReadyEvidence.runtimeId};foreach($entry in $entries){&$adapter.RemoveCurrentProductEntry $entry}
 }
+
+function Assert-CcodInstalledResumeTransaction {
+    param([Parameter(Mandatory)]$Transaction)
+    $binding=$Transaction.installedBinding
+    if($Transaction.transactionId-isnot[string]-or$Transaction.transactionId-cnotmatch'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'-or
+       $Transaction.runtimeId-isnot[string]-or$Transaction.runtimeId-cnotmatch'^2\.5\.22-[0-9a-f]{16}-[0-9a-f]{32}$'-or$Transaction.userSid-isnot[string]-or$Transaction.userSid-cnotmatch'^S-1-'-or
+       $Transaction.sessionId-isnot[int]-or$Transaction.sessionId-lt0-or$null-eq$Transaction.readyEvidence-or$null-eq$binding-or
+       $binding.selectedRuntimeRoot-isnot[string]-or-not[IO.Path]::IsPathRooted([string]$binding.selectedRuntimeRoot)-or$binding.runtimeManifestSha256-isnot[string]-or$binding.runtimeManifestSha256-cnotmatch'^[0-9a-f]{64}$'-or
+       $binding.wrapperUserSid-isnot[string]-or$binding.wrapperUserSid-cne$Transaction.userSid-or$binding.wrapperSessionId-isnot[int]-or$binding.wrapperSessionId-ne$Transaction.sessionId-or
+       $binding.resumeScriptPath-isnot[string]-or-not[IO.Path]::IsPathRooted([string]$binding.resumeScriptPath)-or$binding.resumeScriptSha256-isnot[string]-or$binding.resumeScriptSha256-cnotmatch'^[0-9a-f]{64}$'-or
+       $binding.resumeCommand-isnot[string]-or[string]::IsNullOrWhiteSpace([string]$binding.resumeCommand)){
+        Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Installed uninstall resume transaction is invalid.' $Transaction
+    }
+    try{
+        [uint64]$generation=$Transaction.runtimeGeneration;[uint64]$epoch=$Transaction.leaseEpoch;[int64]$scriptLength=$binding.resumeScriptLength
+        $install=Get-CcodProductFullPath ([string]$Transaction.readyEvidence.installRoot);$selected=Get-CcodProductFullPath ([string]$binding.selectedRuntimeRoot);$resumeScript=Get-CcodProductFullPath ([string]$binding.resumeScriptPath)
+        $expectedSelected=[IO.Path]::GetFullPath((Join-Path (Join-Path $install 'runtime') ([string]$Transaction.runtimeId)))
+        $local=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process');if([string]::IsNullOrWhiteSpace($local)){$local=[Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)}
+        $expectedScript=[IO.Path]::GetFullPath((Join-Path (Join-Path (Join-Path $local 'CodexRemote-fix-uninstall') ([string]$Transaction.transactionId)) 'payload\src\persistence\InstalledUninstallFinalizer.ps1'))
+        $system=[Environment]::GetFolderPath([Environment+SpecialFolder]::System);$powershell=[IO.Path]::GetFullPath((Join-Path $system 'WindowsPowerShell\v1.0\powershell.exe'))
+        $expectedCommand='"{0}" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "{1}" -Resume -TransactionId "{2}" -RuntimeRoot "{3}" -InstallRoot "{4}"'-f$powershell,$expectedScript,$Transaction.transactionId,$expectedSelected,$install
+    }catch{Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Installed uninstall resume paths are invalid.' $Transaction}
+    if($generation-eq0-or$scriptLength-lt0-or$selected-cne$expectedSelected-or$resumeScript-cne$expectedScript-or$binding.resumeCommand-cne$expectedCommand-or
+       $Transaction.readyEvidence.runtimeId-cne$Transaction.runtimeId-or[uint64]$Transaction.readyEvidence.runtimeGeneration-ne$generation-or
+       $Transaction.readyEvidence.manifestSha256-cne$binding.runtimeManifestSha256){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Installed uninstall resume binding does not match the selected generation.' $Transaction}
+    return [pscustomobject][ordered]@{installRoot=$install;selectedRuntimeRoot=$selected;resumeScriptPath=$resumeScript;resumeCommand=$expectedCommand;runtimeGeneration=$generation;leaseEpoch=$epoch;resumeScriptLength=$scriptLength}
+}
+
+function Get-CcodInstalledResumeRegistryValues {
+    param([Parameter(Mandatory)]$Transaction)
+    $proof=Assert-CcodInstalledResumeTransaction $Transaction;$ready=$Transaction.readyEvidence
+    [ordered]@{
+        DisplayName='CodexRemote-fix';DisplayVersion='2.5.22';Publisher='naipi11';InstallLocation=$proof.selectedRuntimeRoot;UninstallString=$proof.resumeCommand;QuietUninstallString=$proof.resumeCommand;NoModify=1;NoRepair=1
+        CcodRuntimeId=[string]$Transaction.runtimeId;CcodRuntimeGeneration=[int64]$proof.runtimeGeneration;CcodPackageSha256=[string]$ready.packageSha256;CcodManifestSha256=[string]$ready.manifestSha256
+        CcodStartMenuSha256=[string]$ready.startMenuSha256;CcodDesktopSha256=[string]$ready.desktopSha256;CcodShortcutTarget=[string]$ready.targetPath;CcodShortcutArguments=[string]$ready.arguments
+        CcodUninstallTransactionId=[string]$Transaction.transactionId;CcodUninstallUserSid=[string]$Transaction.userSid;CcodUninstallSessionId=[int]$Transaction.sessionId;CcodUninstallLeaseEpoch=[int64]$proof.leaseEpoch
+        CcodUninstallSelectedRuntimeRoot=$proof.selectedRuntimeRoot;CcodUninstallRuntimeManifestSha256=[string]$Transaction.installedBinding.runtimeManifestSha256
+        CcodUninstallResumeScriptSha256=[string]$Transaction.installedBinding.resumeScriptSha256;CcodUninstallResumeScriptLength=[int64]$proof.resumeScriptLength
+    }
+}
+
+function Get-CcodInstalledResumeRegistryKinds {
+    param([Parameter(Mandatory)][Collections.IDictionary]$Values)
+    $kinds=[ordered]@{};foreach($name in $Values.Keys){$kinds[$name]=if($name-in@('NoModify','NoRepair','CcodUninstallSessionId')){'DWord'}elseif($name-in@('CcodRuntimeGeneration','CcodUninstallLeaseEpoch','CcodUninstallResumeScriptLength')){'QWord'}else{'String'}};$kinds
+}
+
+function Test-CcodProductRegistryEntryValues {
+    param([Parameter(Mandatory)]$Key,[Parameter(Mandatory)][Collections.IDictionary]$Values,[Parameter(Mandatory)][Collections.IDictionary]$Kinds)
+    if($Key.GetSubKeyNames().Count-ne0-or-not(Test-CcodProductExactStringSet @($Key.GetValueNames()) @($Values.Keys))){return $false}
+    foreach($name in $Values.Keys){$actual=$Key.GetValue([string]$name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);if([string]$Key.GetValueKind([string]$name)-cne[string]$Kinds[$name]-or($actual|ConvertTo-Json -Compress)-cne($Values[$name]|ConvertTo-Json -Compress)){return $false}}
+    return $true
+}
+
+function Read-CcodInstalledResumeProductState {
+    param([Parameter(Mandatory)]$Transaction)
+    $proof=Assert-CcodInstalledResumeTransaction $Transaction;$values=Get-CcodInstalledResumeRegistryValues $Transaction;$kinds=Get-CcodInstalledResumeRegistryKinds $values
+    $startPath=Get-CcodProductShortcutDestination 'StartMenu';$desktopPath=Get-CcodProductShortcutDestination 'Desktop';$shortcuts=[Collections.Generic.List[object]]::new()
+    foreach($definition in @([pscustomobject]@{kind='StartMenu';path=$startPath;sha=[string]$Transaction.readyEvidence.startMenuSha256},[pscustomobject]@{kind='Desktop';path=$desktopPath;sha=[string]$Transaction.readyEvidence.desktopSha256})){
+        if([IO.Directory]::Exists($definition.path)){return [pscustomobject]@{valid=$false;reason='ShortcutType';registryPresent=$false;shortcutEntries=@();registryEntry=$null}}
+        if([IO.File]::Exists($definition.path)){$evidence=Get-CcodProductShortcutEvidence $definition.kind;if($null-eq$evidence-or$evidence.sha256-cne$definition.sha-or$evidence.target-cne[string]$Transaction.readyEvidence.targetPath-or$evidence.arguments-cne[string]$Transaction.readyEvidence.arguments){return [pscustomobject]@{valid=$false;reason='ShortcutMismatch';registryPresent=$false;shortcutEntries=@();registryEntry=$null}};$shortcuts.Add([pscustomobject]@{kind=$definition.kind;path=$evidence.path;sha256=$evidence.sha256})}
+    }
+    $subkey='Software\Microsoft\Windows\CurrentVersion\Uninstall\CodexRemote-fix';$key=[Microsoft.Win32.Registry]::CurrentUser.OpenSubKey($subkey,$false)
+    if($null-eq$key){return [pscustomobject]@{valid=($shortcuts.Count-eq0);reason=$(if($shortcuts.Count-eq0){$null}else{'RegistryMissing'});registryPresent=$false;shortcutEntries=@($shortcuts);registryEntry=$null}}
+    try{if(-not(Test-CcodProductRegistryEntryValues -Key $key -Values $values -Kinds $kinds)){return [pscustomobject]@{valid=$false;reason='RegistryMismatch';registryPresent=$true;shortcutEntries=@();registryEntry=$null}};$captured=[ordered]@{};foreach($name in $values.Keys){$captured[$name]=[pscustomobject]@{value=$key.GetValue([string]$name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);kind=[string]$key.GetValueKind([string]$name)}};return [pscustomobject]@{valid=$true;reason=$null;registryPresent=$true;shortcutEntries=@($shortcuts);registryEntry=[pscustomobject]@{kind='Registry';path=$subkey;valueNames=@($values.Keys);values=$captured}}}finally{$key.Dispose()}
+}
+
+function Get-CcodInstalledResumeOriginalRegistryValues {
+    param([Parameter(Mandatory)]$Transaction)
+    $proof=Assert-CcodInstalledResumeTransaction $Transaction;$ready=$Transaction.readyEvidence;$uninstaller=Join-Path $proof.selectedRuntimeRoot 'Uninstall-CodexControlOtherDevices.ps1';$command='"{0}" -NoProfile -ExecutionPolicy Bypass -File "{1}"'-f(Get-CcodProductPowerShellPath),$uninstaller
+    [ordered]@{DisplayName='CodexRemote-fix';DisplayVersion='2.5.22';Publisher='naipi11';InstallLocation=$proof.selectedRuntimeRoot;UninstallString=$command;QuietUninstallString=($command+' -Confirm:$false');NoModify=1;NoRepair=1;CcodRuntimeId=[string]$Transaction.runtimeId;CcodRuntimeGeneration=[int64]$proof.runtimeGeneration;CcodPackageSha256=[string]$ready.packageSha256;CcodManifestSha256=[string]$ready.manifestSha256;CcodStartMenuSha256=[string]$ready.startMenuSha256;CcodDesktopSha256=[string]$ready.desktopSha256;CcodShortcutTarget=[string]$ready.targetPath;CcodShortcutArguments=[string]$ready.arguments}
+}
+
+function Test-CcodInstalledResumeRegistryTransition {
+    param([Parameter(Mandatory)]$Key,[Parameter(Mandatory)][Collections.IDictionary]$Original,[Parameter(Mandatory)][Collections.IDictionary]$Expected,[Parameter(Mandatory)][Collections.IDictionary]$ExpectedKinds)
+    $names=@($Key.GetValueNames());if($Key.GetSubKeyNames().Count-ne0-or@($Original.Keys|Where-Object{$names-cnotcontains$_}).Count-ne0-or@($names|Where-Object{$Expected.Keys-cnotcontains$_}).Count-ne0){return $false}
+    foreach($name in $names){$actual=$Key.GetValue([string]$name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);$kind=[string]$Key.GetValueKind([string]$name);if($kind-cne[string]$ExpectedKinds[$name]){return $false};if($name-in@('UninstallString','QuietUninstallString')){if(($actual|ConvertTo-Json -Compress)-cne($Original[$name]|ConvertTo-Json -Compress)-and($actual|ConvertTo-Json -Compress)-cne($Expected[$name]|ConvertTo-Json -Compress)){return $false}}elseif(($actual|ConvertTo-Json -Compress)-cne($Expected[$name]|ConvertTo-Json -Compress)){return $false}}
+    return $true
+}
+
+function Set-CcodInstalledUninstallResumeRegistration {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)]$Transaction)
+    if($Transaction.phase-cne'TaskRemoved'-or$Transaction.resumePhase-cne'TaskRemoved'){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Resume registration may be installed only at TaskRemoved.' $Transaction.transactionId}
+    $proof=Assert-CcodInstalledResumeTransaction $Transaction
+    try{$scriptItem=Get-Item -LiteralPath $proof.resumeScriptPath -Force -ErrorAction Stop;if($scriptItem.PSIsContainer-or($scriptItem.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0-or[int64]$scriptItem.Length-ne[int64]$proof.resumeScriptLength-or(Get-CcodProductFileSha256 $proof.resumeScriptPath)-cne[string]$Transaction.installedBinding.resumeScriptSha256){throw 'staged resume script mismatch'}}catch{Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Staged installed resume script is not exact.' $proof.resumeScriptPath}
+    foreach($definition in @([pscustomobject]@{kind='StartMenu';sha=[string]$Transaction.readyEvidence.startMenuSha256},[pscustomobject]@{kind='Desktop';sha=[string]$Transaction.readyEvidence.desktopSha256})){$evidence=Get-CcodProductShortcutEvidence $definition.kind;if($null-eq$evidence-or$evidence.sha256-cne$definition.sha-or$evidence.target-cne[string]$Transaction.readyEvidence.targetPath-or$evidence.arguments-cne[string]$Transaction.readyEvidence.arguments){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Current product shortcut is not exact before installing resume entry.' $definition.kind}}
+    $values=Get-CcodInstalledResumeRegistryValues $Transaction;$kinds=Get-CcodInstalledResumeRegistryKinds $values;$original=Get-CcodInstalledResumeOriginalRegistryValues $Transaction;$originalKinds=Get-CcodInstalledResumeRegistryKinds $original;$subkey='Software\Microsoft\Windows\CurrentVersion\Uninstall\CodexRemote-fix';$key=[Microsoft.Win32.Registry]::CurrentUser.OpenSubKey($subkey,$true)
+    if($null-eq$key){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Current product registry disappeared before resume installation.' $Transaction.runtimeId}
+    try{
+        if(-not(Test-CcodInstalledResumeRegistryTransition -Key $key -Original $original -Expected $values -ExpectedKinds $kinds)){throw 'current/resume registry transition set is invalid'}
+        $key.SetValue('UninstallString',[string]$values.UninstallString,[Microsoft.Win32.RegistryValueKind]::String)
+        foreach($name in @($values.Keys|Where-Object{$_-notin@('QuietUninstallString','UninstallString')})){$kind=[Enum]::Parse([Microsoft.Win32.RegistryValueKind],[string]$kinds[$name]);$key.SetValue([string]$name,$values[$name],$kind)}
+        $key.SetValue('QuietUninstallString',[string]$values.QuietUninstallString,[Microsoft.Win32.RegistryValueKind]::String)
+        if(-not(Test-CcodProductRegistryEntryValues -Key $key -Values $values -Kinds $kinds)){throw 'resume registry read-back mismatch'}
+    }catch{Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Installed resume registration could not be committed exactly.' $Transaction.runtimeId}finally{$key.Dispose()}
+    $observed=Read-CcodInstalledResumeProductState $Transaction
+    if($null-eq$observed-or-not$observed.valid-or-not$observed.registryPresent-or@($observed.shortcutEntries).Count-ne2){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Installed resume registration is not durable.' $Transaction.runtimeId}
+    return $observed
+}
+
+function Test-CcodInstalledUninstallResumeRegistration {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)]$Transaction)
+    try{$state=Read-CcodInstalledResumeProductState $Transaction;return $null-ne$state-and$state.valid-and$state.registryPresent}catch{return $false}
+}
+
+function Get-CcodInstalledUninstallResumeRegistrationState {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)]$Transaction)
+    try{$state=Read-CcodInstalledResumeProductState $Transaction;if($null-eq$state-or-not$state.valid){return 'Invalid'};if($state.registryPresent){return 'Exact'};if(@($state.shortcutEntries).Count-eq0){return 'Absent'};return 'Invalid'}catch{return 'Invalid'}
+}
+
+function Remove-CcodInstalledUninstallProductShortcuts {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)]$Transaction)
+    $effectivePhase=if($Transaction.phase-ceq'Failed'){$Transaction.resumePhase}else{$Transaction.phase};if($effectivePhase-cne'ReadyForInno'){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Installed shortcuts may be removed only at ReadyForInno.' $Transaction.transactionId}
+    $state=Read-CcodInstalledResumeProductState $Transaction
+    if($null-eq$state-or-not$state.valid-or-not$state.registryPresent){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Durable installed resume entry is missing before shortcut cleanup.' $Transaction.transactionId}
+    foreach($entry in @($state.shortcutEntries)){Remove-CcodCurrentProductEntry $entry}
+    $after=Read-CcodInstalledResumeProductState $Transaction
+    if($null-eq$after-or-not$after.valid-or-not$after.registryPresent-or@($after.shortcutEntries).Count-ne0){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Installed product shortcuts did not converge while the resume entry remained.' $Transaction.transactionId}
+    return $after
+}
+
+function Remove-CcodInstalledUninstallResumeRegistration {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)]$Transaction,[switch]$CompletedReceiptProven)
+    if($Transaction.phase-cne'Completed'-or$Transaction.resumePhase-cne'Completed'-or-not$CompletedReceiptProven){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Final resume registry removal requires a durable Completed transaction and receipt proof.' $Transaction.transactionId}
+    $state=Read-CcodInstalledResumeProductState $Transaction
+    if($null-eq$state-or-not$state.valid){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Installed resume registration is not exact before final removal.' $Transaction.transactionId}
+    if(-not$state.registryPresent){return $true}
+    if(@($state.shortcutEntries).Count-ne0){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Installed shortcuts remain before final resume registry removal.' $Transaction.transactionId}
+    Initialize-CcodLegacyRegistryNative
+    $rights=[Security.AccessControl.RegistryRights]::QueryValues-bor[Security.AccessControl.RegistryRights]::EnumerateSubKeys-bor[Security.AccessControl.RegistryRights]::Delete
+    $key=[Microsoft.Win32.Registry]::CurrentUser.OpenSubKey([string]$state.registryEntry.path,[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,$rights)
+    if($null-eq$key){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Installed resume registry disappeared before exact handle deletion.' $Transaction.transactionId}
+    try{$values=Get-CcodInstalledResumeRegistryValues $Transaction;$kinds=Get-CcodInstalledResumeRegistryKinds $values;if(-not(Test-CcodProductRegistryEntryValues -Key $key -Values $values -Kinds $kinds)){throw 'resume registry changed'};[CcodLegacyRegistryNativeV1]::DeleteKey($key)}catch{Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Installed resume registry could not be deleted by its exact handle.' $Transaction.transactionId}finally{$key.Dispose()}
+    $after=Read-CcodInstalledResumeProductState $Transaction
+    if($null-eq$after-or-not$after.valid-or$after.registryPresent-or@($after.shortcutEntries).Count-ne0){Throw-CcodProductRegistrationError 'CCOD_PRODUCT_CLEANUP_INVALID' 'Installed resume registry deletion did not converge.' $Transaction.transactionId}
+    return $true
+}
 function Get-CcodLegacySnapshotEntryName {
     param($Entry,[Parameter(Mandatory)][string]$ExpectedAppId)
     if($Entry-is[string]){return [string]$Entry}
@@ -417,6 +605,72 @@ function Test-CcodLegacySnapshotForProfile {
     return Test-CcodProductExactStringSet $actual (@('Registry')+@($Profile.shortcutNames))
 }
 
+function Test-CcodLegacyShortcutSnapshotEntry {
+    param(
+        $Entry,
+        [Parameter(Mandatory)]$LegacyRegistration,
+        [Parameter(Mandatory)]$Profile,
+        [Parameter(Mandatory)][string]$ExpectedInstallRoot
+    )
+    if(-not(Test-CcodProductExactProperties $Entry $script:CcodLegacyShortcutSnapshotFields)-or
+       $Entry.kind-isnot[string]-or$Entry.kind-cne'Shortcut'-or$Entry.name-isnot[string]-or
+       $Entry.path-isnot[string]-or$Entry.sha256-isnot[string]-or$Entry.sha256-cnotmatch'^[0-9a-f]{64}$'-or
+       $Entry.bytesBase64-isnot[string]-or$Entry.targetPath-isnot[string]-or$Entry.arguments-isnot[string]-or$Entry.workingDirectory-isnot[string]){return $false}
+    try{
+        $expectedPath=Get-CcodLegacyShortcutPath -RelativeName ([string]$Entry.name)
+        $actualPath=[IO.Path]::GetFullPath([string]$Entry.path)
+        $contract=Get-CcodLegacyShortcutContract -LegacyRegistration $LegacyRegistration -Profile $Profile -Name ([string]$Entry.name) -ExpectedInstallRoot $ExpectedInstallRoot
+        $target=[IO.Path]::GetFullPath([string]$Entry.targetPath)
+        $expectedTarget=[IO.Path]::GetFullPath([string]$contract.targetPath)
+        $working=if([string]::IsNullOrEmpty([string]$Entry.workingDirectory)){''}else{[IO.Path]::GetFullPath([string]$Entry.workingDirectory).TrimEnd('\')}
+        $expectedWorking=if([string]::IsNullOrEmpty([string]$contract.workingDirectory)){''}else{[IO.Path]::GetFullPath([string]$contract.workingDirectory).TrimEnd('\')}
+        $bytes=[Convert]::FromBase64String([string]$Entry.bytesBase64)
+        $sha=[Security.Cryptography.SHA256]::Create()
+        try{$capturedHash=[BitConverter]::ToString($sha.ComputeHash($bytes)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()}
+    }catch{return $false}
+    return $actualPath-cne$null-and$actualPath-ceq$expectedPath-and$target-ceq$expectedTarget-and
+        [string]$Entry.arguments-ceq[string]$contract.arguments-and$working-ceq$expectedWorking-and$capturedHash-ceq[string]$Entry.sha256
+}
+
+function Assert-CcodLegacyMigrationPlan {
+    param([Parameter(Mandatory)]$Plan,[Parameter(Mandatory)][string]$ExpectedAppId,[Parameter(Mandatory)][string]$ExpectedInstallRoot)
+    $root=Get-CcodProductFullPath $ExpectedInstallRoot
+    if(-not(Test-CcodProductExactProperties $Plan $script:CcodLegacyMigrationPlanFields)-or$Plan.appId-isnot[string]-or$Plan.appId-cne$ExpectedAppId-or
+       $Plan.expectedInstallRoot-isnot[string]-or(Get-CcodProductFullPath ([string]$Plan.expectedInstallRoot))-cne$root-or$Plan.legacyPresent-isnot[bool]){
+        Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy migration plan identity is invalid.' $Plan
+    }
+    if(-not[bool]$Plan.legacyPresent){
+        if($null-ne$Plan.legacyRegistration-or$null-ne$Plan.profile-or$null-ne$Plan.snapshot){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Absent legacy migration plan contains unexpected evidence.' $Plan}
+        return $Plan
+    }
+    $profile=Resolve-CcodLegacyRegistrationProfile -LegacyRegistration $Plan.legacyRegistration
+    if($null-eq$Plan.profile-or$profile.profileId-cne[string]$Plan.profile.profileId-or-not(Test-CcodLegacySnapshotForProfile -Snapshot $Plan.snapshot -Profile $profile -ExpectedAppId $ExpectedAppId)){
+        Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy migration plan no longer matches one exact profile.' $Plan
+    }
+    foreach($entry in @($Plan.snapshot.entries)){
+        if($entry-is[string]){if([string]$entry-cne'Registry'){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy migration plan contains an unbound shortcut.' $entry};continue}
+        if($entry.kind-ceq'Shortcut'-and-not(Test-CcodLegacyShortcutSnapshotEntry -Entry $entry -LegacyRegistration $Plan.legacyRegistration -Profile $profile -ExpectedInstallRoot $root)){
+            Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy shortcut evidence does not match its historical target contract.' $entry
+        }
+    }
+    return $Plan
+}
+
+function Get-CcodLegacyProductRegistrationMigrationPlan {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][string]$ExpectedAppId,[Parameter(Mandatory)][string]$ExpectedInstallRoot,[hashtable]$Adapters)
+    if($ExpectedAppId-cne$script:CcodProductAppId){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration requires the canonical AppId.' $ExpectedAppId}
+    $root=Get-CcodProductFullPath $ExpectedInstallRoot
+    $adapter=Get-CcodProductRegistrationAdapters $Adapters
+    $legacy=&$adapter.ReadLegacyRegistration $ExpectedAppId
+    if($null-eq$legacy){return [pscustomobject][ordered]@{appId=$ExpectedAppId;expectedInstallRoot=$root;legacyPresent=$false;legacyRegistration=$null;profile=$null;snapshot=$null}}
+    $profile=Resolve-CcodLegacyRegistrationProfile -LegacyRegistration $legacy
+    $snapshot=&$adapter.ReadLegacySnapshot $ExpectedAppId $profile
+    $plan=[pscustomobject][ordered]@{appId=$ExpectedAppId;expectedInstallRoot=$root;legacyPresent=$true;legacyRegistration=$legacy;profile=$profile;snapshot=$snapshot}
+    [void](Assert-CcodLegacyMigrationPlan -Plan $plan -ExpectedAppId $ExpectedAppId -ExpectedInstallRoot $root)
+    return $plan
+}
+
 function Test-CcodLegacySnapshotCurrentReplacement {
     param($Entry,[Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)]$CurrentProof)
     if($Entry-is[string]-or$null-eq$Entry-or$Entry.kind-cne'Shortcut'-or$Entry.name-isnot[string]-or[string]$Entry.name-cne$Name-or
@@ -441,7 +695,16 @@ function Read-CcodLegacySnapshot {
     foreach($name in @($ExpectedProfile.shortcutNames)){
         $path=Get-CcodLegacyShortcutPath -RelativeName $name;$item=Get-Item -LiteralPath $path -Force -ErrorAction Stop
         if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0-or[string]$item.Name-cne[IO.Path]::GetFileName($name)){throw 'legacy shortcut unsafe'}
-        $bytes=[IO.File]::ReadAllBytes($path);$entries.Add([pscustomobject]@{kind='Shortcut';name=$name;path=$path;sha256=Get-CcodProductFileSha256 $path;bytesBase64=[Convert]::ToBase64String($bytes)})
+        $shell=$null;$shortcut=$null
+        try{
+            $shell=New-Object -ComObject WScript.Shell;$shortcut=$shell.CreateShortcut($path)
+            $target=[IO.Path]::GetFullPath([string]$shortcut.TargetPath);$arguments=[string]$shortcut.Arguments;$workingDirectory=[string]$shortcut.WorkingDirectory
+            if(-not[string]::IsNullOrEmpty($workingDirectory)){$workingDirectory=[IO.Path]::GetFullPath($workingDirectory).TrimEnd('\')}
+        }finally{
+            if($null-ne$shortcut){[void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($shortcut)}
+            if($null-ne$shell){[void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($shell)}
+        }
+        $bytes=[IO.File]::ReadAllBytes($path);$entries.Add([pscustomobject][ordered]@{kind='Shortcut';name=$name;path=$path;sha256=Get-CcodProductFileSha256 $path;bytesBase64=[Convert]::ToBase64String($bytes);targetPath=$target;arguments=$arguments;workingDirectory=$workingDirectory})
     }
     return [pscustomobject][ordered]@{appId=$ExpectedAppId;entries=@($entries)}
 }
@@ -701,32 +964,39 @@ function Remove-CcodLegacyProductRegistration {
     [CmdletBinding()]
     param(
         [Parameter(Mandatory)][string]$ExpectedAppId,
+        [AllowNull()]$MigrationPlan,
+        [AllowNull()]$ExpectedCurrentProof,
         [hashtable]$Adapters
     )
     if ($ExpectedAppId -cne $script:CcodProductAppId) {
         Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration requires the canonical AppId and a verified new registration.' $ExpectedAppId
     }
+    if($null-eq$MigrationPlan){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration requires a pre-registration capture plan.' $ExpectedAppId}
+    if($null-eq$ExpectedCurrentProof-or-not(Test-CcodCurrentVerifiedRegistration $ExpectedCurrentProof)){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration requires the exact expected current proof.' $ExpectedAppId}
     $adapter = Get-CcodProductRegistrationAdapters $Adapters
+    [void](Assert-CcodLegacyMigrationPlan -Plan $MigrationPlan -ExpectedAppId $ExpectedAppId -ExpectedInstallRoot ([string]$MigrationPlan.expectedInstallRoot))
+    if(-not[bool]$MigrationPlan.legacyPresent){return}
     $verified=&$adapter.ReadVerifiedRegistration
-    if(-not(Test-CcodCurrentVerifiedRegistration $verified)){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration requires an exact current three-record read-back proof.' $ExpectedAppId}
-    $legacy = & $adapter.ReadLegacyRegistration $ExpectedAppId
-    if($null-eq$legacy){return}
-    $profile=Resolve-CcodLegacyRegistrationProfile -LegacyRegistration $legacy
-    $snapshot=&$adapter.ReadLegacySnapshot $ExpectedAppId $profile
-    if(-not(Test-CcodLegacySnapshotForProfile -Snapshot $snapshot -Profile $profile -ExpectedAppId $ExpectedAppId)){
-        Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy snapshot is incomplete or does not match the selected historical profile.' $ExpectedAppId
-    }
+    if(-not(Test-CcodCurrentVerifiedRegistrationUnchanged -Before $ExpectedCurrentProof -After $verified)){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration requires an exact current three-record read-back proof.' $ExpectedAppId}
+    $profile=$MigrationPlan.profile;$snapshot=$MigrationPlan.snapshot
+    $observedLegacy=&$adapter.ReadLegacyRegistration $ExpectedAppId
+    if($null-eq$observedLegacy){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Captured legacy registry disappeared before cleanup.' $ExpectedAppId}
+    $expectedObservedNames=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal);foreach($name in @($profile.shortcutNames)+@($script:CcodCurrentShortcutNames)){[void]$expectedObservedNames.Add([string]$name)}
+    if(-not(Test-CcodProductExactStringSet $observedLegacy.shortcutNames @($expectedObservedNames))-or@($observedLegacy.unsafeShortcutNames).Count-ne0-or
+       $observedLegacy.appId-cne$MigrationPlan.legacyRegistration.appId-or
+       $observedLegacy.displayVersion-cne$MigrationPlan.legacyRegistration.displayVersion-or$observedLegacy.installLocation-cne$MigrationPlan.legacyRegistration.installLocation-or
+       $observedLegacy.uninstallString-cne$MigrationPlan.legacyRegistration.uninstallString){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Captured legacy profile changed before cleanup.' $ExpectedAppId}
     $removalEntries=[Collections.Generic.List[object]]::new()
     foreach($entry in @($snapshot.entries)){
         $name=Get-CcodLegacySnapshotEntryName -Entry $entry -ExpectedAppId $ExpectedAppId
         if($script:CcodCurrentShortcutNames-ccontains$name){
-            if(-not(Test-CcodLegacySnapshotCurrentReplacement -Entry $entry -Name $name -CurrentProof $verified)){
-                Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'An overlapping legacy shortcut is not the exact verified current replacement.' $name
-            }
             continue
         }
         $removalEntries.Add($entry)
     }
+    foreach($entry in @($removalEntries)){
+        if((&$adapter.ReadLegacyEntry $entry)-cne'Exact'){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Captured legacy-only state changed before deletion.' (Get-CcodLegacySnapshotEntryName -Entry $entry -ExpectedAppId $ExpectedAppId)}
+    }
     $removed=[Collections.Generic.List[object]]::new();$failedEntry=$null
     try{
         foreach($entry in @($removalEntries)){$failedEntry=$entry;&$adapter.RemoveLegacyEntry $entry;$removed.Add($entry);$failedEntry=$null}
@@ -744,4 +1014,4 @@ function Remove-CcodLegacyProductRegistration {
     }
 }
 
-Export-ModuleMember -Function New-CcodProductRegistration,Test-CcodProductRegistration,Commit-CcodProductRegistration,Remove-CcodProductRegistration,Remove-CcodLegacyProductRegistration,Get-CcodLegacyRegistrationProfiles,Resolve-CcodLegacyRegistrationProfile
+Export-ModuleMember -Function New-CcodProductRegistration,Test-CcodProductRegistration,Commit-CcodProductRegistration,Remove-CcodProductRegistration,Remove-CcodLegacyProductRegistration,Get-CcodLegacyProductRegistrationMigrationPlan,Get-CcodLegacyRegistrationProfiles,Resolve-CcodLegacyRegistrationProfile,Set-CcodInstalledUninstallResumeRegistration,Test-CcodInstalledUninstallResumeRegistration,Get-CcodInstalledUninstallResumeRegistrationState,Remove-CcodInstalledUninstallProductShortcuts,Remove-CcodInstalledUninstallResumeRegistration
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index 18be604..24b2055 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -463,6 +463,15 @@ function New-CcodLifecycleProductSideEffectAdapters {
             try{$fileModule=Get-Module -All|Where-Object{$null-ne$_.Path-and[IO.Path]::GetFileName($_.Path)-ceq'InstallFileTransaction.psm1'}|Select-Object -First 1;if($null-eq$fileModule){throw 'install file transaction module unavailable'};$source=&$fileModule {param($Generation,$Path,$Record)Open-CcodInstallRetainedFile -Generation $Generation -RelativePath $Path -ReadyTransaction $Record} $FileTransaction $relative $ReadyEvidence.transactionRecord}catch{$State.RetainedError=([string]$_.FullyQualifiedErrorId-split',')[0];throw}
             if($null-eq$source){throw 'retained shortcut capability missing'}
             $State.ProductOnlyObserved=$true;$State.Shortcuts[$Kind]=$Shortcut;$State.ShortcutWrites++
+            if($State.ContainsKey('LegacyEntries')){
+                $legacyName=if($Kind-ceq'StartMenu'){$v2521LifecycleShortcutNames[0]}else{$v2521LifecycleShortcutNames[3]}
+                if(-not$State.LegacyEntries.Contains($legacyName)){$State.LegacyEntries.Add($legacyName)}
+                if($State.ContainsKey('LegacyShortcutProofs')){
+                    $State.LegacyShortcutProofs[$legacyName]=[pscustomobject][ordered]@{
+                        targetPath=[string]$ReadyEvidence.targetPath;arguments=[string]$ReadyEvidence.arguments;workingDirectory='';sha256=$(if($Kind-ceq'StartMenu'){[string]$ReadyEvidence.startMenuSha256}else{[string]$ReadyEvidence.desktopSha256})
+                    }
+                }
+            }
         }.GetNewClosure()
         ReadShortcut={param($Kind,$Shortcut)$State.Shortcuts[$Kind]}.GetNewClosure()
         ReadVerifiedRegistration={
@@ -471,22 +480,29 @@ function New-CcodLifecycleProductSideEffectAdapters {
                 shortcutNames=@($v2521LifecycleShortcutNames[0],$v2521LifecycleShortcutNames[3]);startMenuSha256=[string]$State.ReadyEvidence.startMenuSha256;desktopSha256=[string]$State.ReadyEvidence.desktopSha256
             }
         }.GetNewClosure()
-        ReadLegacyRegistration={param($ExpectedAppId);if($State.ContainsKey('LegacyEntries')-and$State.LegacyEntries.Contains('Registry')){$State.LegacyRegistration}else{$null}}.GetNewClosure()
+        ReadLegacyRegistration={
+            param($ExpectedAppId)
+            if(-not$State.ContainsKey('LegacyEntries')-or-not$State.LegacyEntries.Contains('Registry')){return $null}
+            [pscustomobject][ordered]@{
+                appId=[string]$State.LegacyRegistration.appId;displayVersion=[string]$State.LegacyRegistration.displayVersion;installLocation=[string]$State.LegacyRegistration.installLocation
+                uninstallString=[string]$State.LegacyRegistration.uninstallString;shortcutNames=@($State.LegacyEntries|Where-Object{[string]$_-cne'Registry'});unsafeShortcutNames=@($(if($State.ContainsKey('LegacyUnsafeShortcutNames')){@($State.LegacyUnsafeShortcutNames)}else{@()}))
+            }
+        }.GetNewClosure()
         ReadLegacySnapshot={
             param($ExpectedAppId,$ExpectedProfile)
             $entries=[Collections.Generic.List[object]]::new()
             foreach($entry in @($State.LegacyEntries)){
-                if(@($v2521LifecycleShortcutNames[0],$v2521LifecycleShortcutNames[3])-ccontains[string]$entry){
+                if([string]$entry-cne'Registry'){
                     $base=if(([string]$entry).StartsWith('Programs\',[StringComparison]::Ordinal)){[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs)}else{[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop)}
-                    $relative=([string]$entry).Substring(([string]$entry).IndexOf('\')+1);$sha=if([string]$entry-ceq$v2521LifecycleShortcutNames[0]){[string]$State.ReadyEvidence.startMenuSha256}else{[string]$State.ReadyEvidence.desktopSha256}
-                    $entries.Add([pscustomobject]@{kind='Shortcut';name=[string]$entry;path=[IO.Path]::GetFullPath((Join-Path $base $relative));sha256=$sha;bytesBase64=''})
+                    $relative=([string]$entry).Substring(([string]$entry).IndexOf('\')+1);$proof=if($State.ContainsKey('LegacyShortcutProofs')){$State.LegacyShortcutProofs[[string]$entry]}else{$null}
+                    $entries.Add([pscustomobject][ordered]@{kind='Shortcut';name=[string]$entry;path=[IO.Path]::GetFullPath((Join-Path $base $relative));sha256=[string]$proof.sha256;bytesBase64=[string]$proof.bytesBase64;targetPath=[string]$proof.targetPath;arguments=[string]$proof.arguments;workingDirectory=[string]$proof.workingDirectory})
                 }else{$entries.Add([string]$entry)}
             }
             [pscustomobject][ordered]@{appId=$State.LegacyRegistration.appId;entries=@($entries)}
         }.GetNewClosure()
-        RemoveLegacyEntry={param($Entry);$State.LegacyRemovalAttempts++;[void]$State.LegacyEntries.Remove([string]$Entry)}.GetNewClosure()
-        ReadLegacyEntry={param($Entry);if($State.LegacyEntries.Contains([string]$Entry)){'Exact'}else{$null}}.GetNewClosure()
-        RestoreLegacyEntry={param($Entry);if(-not$State.LegacyEntries.Contains([string]$Entry)){$State.LegacyEntries.Add([string]$Entry)}}.GetNewClosure()
+        RemoveLegacyEntry={param($Entry);$name=if($Entry-is[string]){[string]$Entry}elseif($Entry.kind-ceq'Registry'){'Registry'}else{[string]$Entry.name};$State.LegacyRemovalAttempts++;[void]$State.LegacyEntries.Remove($name)}.GetNewClosure()
+        ReadLegacyEntry={param($Entry);$name=if($Entry-is[string]){[string]$Entry}elseif($Entry.kind-ceq'Registry'){'Registry'}else{[string]$Entry.name};if($State.LegacyEntries.Contains($name)){'Exact'}else{$null}}.GetNewClosure()
+        RestoreLegacyEntry={param($Entry);$name=if($Entry-is[string]){[string]$Entry}elseif($Entry.kind-ceq'Registry'){'Registry'}else{[string]$Entry.name};if(-not$State.LegacyEntries.Contains($name)){$State.LegacyEntries.Add($name)}}.GetNewClosure()
         WriteLegacyCompensationFailure={param($Record);$State.LegacyCompensationFailures.Add($Record)}.GetNewClosure()
     }
 }
@@ -505,6 +521,28 @@ function Set-CcodLifecycleDefaultProductRegistrationFixture {
     }
 }
 
+function New-CcodLifecycleV2521ShortcutProofs {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$InstallerRoot)
+    $powershell=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'WindowsPowerShell\v1.0\powershell.exe'))
+    $bootstrap=[IO.Path]::GetFullPath((Join-Path $InstallRoot 'bootstrap.ps1'))
+    $testScript=[IO.Path]::GetFullPath((Join-Path $InstallerRoot 'Test-CodexControlOtherDevices.ps1'))
+    $uninstaller=[IO.Path]::GetFullPath((Join-Path $InstallerRoot 'unins000.exe'))
+    $mainArguments='-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "{0}" -InstallRoot "{1}" -EntryMode Explicit' -f $bootstrap,[IO.Path]::GetFullPath($InstallRoot)
+    $specifications=@(
+        [pscustomobject]@{name=$v2521LifecycleShortcutNames[0];targetPath=$powershell;arguments=$mainArguments;workingDirectory=[IO.Path]::GetFullPath($InstallRoot)},
+        [pscustomobject]@{name=$v2521LifecycleShortcutNames[1];targetPath=$powershell;arguments=('-NoProfile -ExecutionPolicy Bypass -File "{0}"' -f $testScript);workingDirectory=[IO.Path]::GetFullPath($InstallerRoot)},
+        [pscustomobject]@{name=$v2521LifecycleShortcutNames[2];targetPath=$uninstaller;arguments='';workingDirectory=''},
+        [pscustomobject]@{name=$v2521LifecycleShortcutNames[3];targetPath=$powershell;arguments=$mainArguments;workingDirectory=[IO.Path]::GetFullPath($InstallRoot)}
+    )
+    $proofs=@{}
+    foreach($specification in $specifications){
+        $bytes=[Text.UTF8Encoding]::new($false).GetBytes(('legacy-shortcut:'+([string]$specification.name)))
+        $sha=[Security.Cryptography.SHA256]::Create();try{$hash=[BitConverter]::ToString($sha.ComputeHash($bytes)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()}
+        $proofs[[string]$specification.name]=[pscustomobject][ordered]@{targetPath=[string]$specification.targetPath;arguments=[string]$specification.arguments;workingDirectory=[string]$specification.workingDirectory;sha256=$hash;bytesBase64=[Convert]::ToBase64String($bytes)}
+    }
+    return $proofs
+}
+
 function Set-CcodLifecycleProductCloseFailureFixture {
     param([Parameter(Mandatory)]$Fake,[Parameter(Mandatory)][hashtable]$State)
     $State.CloseAttempts=0
@@ -994,7 +1032,8 @@ $results += Invoke-CcodTest 'real v2.5.21 legacy lifecycle state upgrades throug
                 appId='{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}';displayVersion='2.5.21';installLocation='C:\legacy\CodexControlOtherDevices-installer'
                 uninstallString='"C:\legacy\CodexControlOtherDevices-installer\unins000.exe"';shortcutNames=@($v2521LifecycleShortcutNames);unsafeShortcutNames=@()
             }
-            LegacyEntries=$legacyEntries;LegacyRemovalAttempts=0;LegacyCompensationFailures=[Collections.Generic.List[object]]::new()
+            LegacyEntries=$legacyEntries;LegacyShortcutProofs=(New-CcodLifecycleV2521ShortcutProofs -InstallRoot $install -InstallerRoot 'C:\legacy\CodexControlOtherDevices-installer');LegacyUnsafeShortcutNames=@()
+            LegacyRemovalAttempts=0;LegacyCompensationFailures=[Collections.Generic.List[object]]::new()
         }
         Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $fake -ProductState $productState
         $beforeRuntimeCount=@(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory -Force).Count
@@ -1046,6 +1085,41 @@ $results += Invoke-CcodTest 'real v2.5.21 legacy lifecycle state upgrades throug
     }
 }
 
+# Production mutation caught: current registration writes the two overlapping names before it
+# proves that one complete historical profile existed, washing missing or foreign legacy leaves.
+$results += Invoke-CcodTest 'legacy profile is captured before any current product or shortcut write' {
+    foreach($kind in @('MissingMain','MissingDesktop','ForeignMain')){
+        $legacySource=New-CcodLifecycleTempRoot;$source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+        try {
+            New-CcodLifecycleSourceFixture -Root $legacySource -Version '2.5.21'|Out-Null
+            $legacy=New-CcodLifecycleV2521LegacyInstallFixture -InstallRoot $install -SourceRoot $legacySource
+            New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null
+            $node=New-CcodLifecycleFakeNode -Root $nodeRoot;$fake=New-CcodLifecycleFake -NodePath $node
+            $entries=[Collections.Generic.List[string]]::new();foreach($entry in @('Registry')+$v2521LifecycleShortcutNames){$entries.Add($entry)}
+            $installerRoot='C:\legacy\CodexControlOtherDevices-installer'
+            $productState=@{
+                FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{}
+                LegacyRegistration=[pscustomobject][ordered]@{appId='{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}';displayVersion='2.5.21';installLocation=$installerRoot;uninstallString=('"{0}\unins000.exe"'-f$installerRoot);shortcutNames=@($v2521LifecycleShortcutNames);unsafeShortcutNames=@()}
+                LegacyEntries=$entries;LegacyShortcutProofs=(New-CcodLifecycleV2521ShortcutProofs -InstallRoot $install -InstallerRoot $installerRoot);LegacyUnsafeShortcutNames=@()
+                LegacyRemovalAttempts=0;LegacyCompensationFailures=[Collections.Generic.List[object]]::new()
+            }
+            switch($kind){
+                'MissingMain' {[void]$productState.LegacyEntries.Remove($v2521LifecycleShortcutNames[0]);[void]$productState.LegacyShortcutProofs.Remove($v2521LifecycleShortcutNames[0])}
+                'MissingDesktop' {[void]$productState.LegacyEntries.Remove($v2521LifecycleShortcutNames[3]);[void]$productState.LegacyShortcutProofs.Remove($v2521LifecycleShortcutNames[3])}
+                'ForeignMain' {$foreign=$productState.LegacyShortcutProofs[$v2521LifecycleShortcutNames[0]];$foreign.targetPath='C:\foreign\owned.exe';$foreign.arguments='--foreign';$foreign.workingDirectory='C:\foreign'}
+            }
+            $before=@($productState.LegacyEntries|Sort-Object)-join'|'
+            Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $fake -ProductState $productState
+            $failure=$null;try{Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('9'*64) -Adapters $fake.Adapters|Out-Null}catch{$failure=$_}
+            Assert-CcodEqual 0 $productState.Writes "$kind is rejected before the current registry write"
+            Assert-CcodEqual 0 $productState.ShortcutWrites "$kind is rejected before either current overlap write"
+            Assert-CcodEqual 0 $productState.LegacyRemovalAttempts "$kind removes no legacy-only entry"
+            Assert-CcodEqual $before ((@($productState.LegacyEntries|Sort-Object))-join'|') "$kind preserves the exact observed legacy set"
+            Assert-CcodEqual 'CCOD_PRODUCT_REGISTRATION_FAILED' (([string]$failure.FullyQualifiedErrorId-split',')[0]) "$kind reports the post-Ready product boundary without washing legacy evidence"
+        } finally {foreach($path in @($legacySource,$source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}}
+    }
+}
+
 foreach($legacyCase in @(
     [pscustomobject]@{Name='append-only selector without a transaction chain';Kind='selector';Expected='CCOD_INSTALL_UPGRADE_SOURCE_INVALID'},
     [pscustomobject]@{Name='cleanup fence plane without Ready authority';Kind='fence';Expected='CCOD_INSTALL_UPGRADE_SOURCE_INVALID'},
@@ -1164,6 +1238,56 @@ $results += Invoke-CcodTest 'real v2.5.21 upgrade failure before new Ready resta
     }
 }
 
+# Production mutation caught: requiring a PointerCommitted journal snapshot even when the
+# exact generation-two selector commit and generation-three compensation are both durable.
+$results += Invoke-CcodTest 'real v2.5.21 selector commit with a missing PointerCommitted journal resumes the exact retained runtime' {
+    $legacySource=New-CcodLifecycleTempRoot;$source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+    try {
+        New-CcodLifecycleSourceFixture -Root $legacySource -Version '2.5.21' | Out-Null
+        $legacy=New-CcodLifecycleV2521LegacyInstallFixture -InstallRoot $install -SourceRoot $legacySource
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22' | Out-Null
+        $node=New-CcodLifecycleFakeNode -Root $nodeRoot;$fake=New-CcodLifecycleFake -NodePath $node
+        $gate=[pscustomobject]@{Remaining=1}
+        $fake.World.SetActiveFailure={
+            param($Root,$RuntimeId,$Ownership,$TargetGeneration,$FileTransaction)
+            if($gate.Remaining-gt0){
+                $gate.Remaining--
+                $fence={param($InstallRoot,$Receipt,$ExpectActivePointer)$true}
+                Set-CcodActiveRuntime -InstallRoot $Root -TargetGeneration $TargetGeneration -FileTransaction $FileTransaction -Ownership $Ownership -Adapters @{AssertLifecycleFence=$fence}|Out-Null
+                throw 'PRIVATE_AFTER_SELECTOR_COMMIT_BEFORE_JOURNAL'
+            }
+        }.GetNewClosure()
+
+        $failure=$null
+        try{Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('f'*64) -Adapters $fake.Adapters|Out-Null}catch{$failure=$_}
+        Assert-CcodEqual 'CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN' (([string]$failure.FullyQualifiedErrorId-split',')[0]) 'post-selector journal failure preserves the stable activation boundary'
+        $selectorFiles=@(Get-ChildItem -LiteralPath (Join-Path $install 'state\active-generation') -File -Force|Sort-Object Name)
+        Assert-CcodEqual 3 $selectorFiles.Count 'selector commit and compensation leave the canonical three-record chain'
+        $selectors=@($selectorFiles|ForEach-Object{[IO.File]::ReadAllText($_.FullName)|ConvertFrom-Json})
+        Assert-CcodEqual ($legacy.RuntimeId+','+$selectors[1].activeRuntime+','+$legacy.RuntimeId) (($selectors|ForEach-Object activeRuntime)-join',') 'selector evidence is exactly old new old'
+        $failedRuntimeId=[string]$selectors[1].activeRuntime
+        $module=Get-Module InstallLifecycle -ErrorAction Stop;$head=&$module {param($Root)Read-CcodInstallTransactionRecord -InstallRoot $Root} $install
+        Assert-CcodEqual 'Failed' $head.phase 'journal-gap transaction has a terminal Failed head'
+        Assert-CcodEqual $failedRuntimeId $head.newRuntimeId 'journal-gap transaction remains bound to the committed generation-two runtime'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.PointerCommitted.*.json' -File -Force).Count 'failure happened before the PointerCommitted journal became durable'
+        Assert-CcodEqual 1 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.RuntimePromoted.*.json' -File -Force).Count 'immutable RuntimePromoted identity is durable before the selector commit'
+        $runtimeCount=@(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory -Force).Count
+
+        $retry=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('f'*64) -Adapters $fake.Adapters
+
+        Assert-CcodEqual 'Upgraded' $retry.Outcome 'second exact attempt resumes the selector-journal gap'
+        Assert-CcodEqual $failedRuntimeId $retry.RuntimeId 'selector-journal retry reuses the exact sealed generation-two runtime'
+        Assert-CcodEqual $runtimeCount @(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory -Force).Count 'selector-journal retry creates no additional runtime'
+        $retryPointer=Read-CcodActiveRuntime -InstallRoot $install
+        Assert-CcodEqual $failedRuntimeId $retryPointer.activeRuntime 'selector-journal retry selects the retained failed runtime'
+        Assert-CcodEqual ([uint64]4) ([uint64]$retryPointer.generation) 'selector-journal retry appends generation four after compensation'
+        $readyHeads=@(Get-ChildItem -LiteralPath (Join-Path $install 'state\install-transactions') -Filter '*.Ready.*.json' -File -Force)
+        Assert-CcodEqual 1 $readyHeads.Count 'selector-journal retry writes one terminal Ready transaction'
+    } finally {
+        foreach($path in @($legacySource,$source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}
+    }
+}
+
 $results += Invoke-CcodTest 'real v2.5.21 upgrade failure before new pointer commit keeps the legacy selector active and restarts it' {
     $legacySource=New-CcodLifecycleTempRoot;$source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
     try {
diff --git a/tests/persistence/ProductRegistration.SelfTest.ps1 b/tests/persistence/ProductRegistration.SelfTest.ps1
index c4b9e47..b859bb7 100644
--- a/tests/persistence/ProductRegistration.SelfTest.ps1
+++ b/tests/persistence/ProductRegistration.SelfTest.ps1
@@ -13,6 +13,7 @@ $packageSha256 = '3' * 64
 $appId = '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}'
 $canonicalTaskTarget=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'schtasks.exe'))
 $cleanupReady=[pscustomobject][ordered]@{phase='Ready';installRoot='C:\fixture\CodexControlOtherDevices';runtimeId=$runtimeId;runtimeGeneration=[uint64]7;packageSha256=$packageSha256;manifestSha256=('a'*64);startMenuSha256=('b'*64);desktopSha256=('c'*64);targetPath=$canonicalTaskTarget;arguments='/Run /TN "Codex Control Other Devices Supervisor"'}
+$expectedVerifiedRegistration=[pscustomobject][ordered]@{verified=$true;runtimeId=$runtimeId;version='2.5.22';packageSha256=$packageSha256;shortcutNames=@('Programs\CodexRemote-fix\CodexRemote-fix.lnk','Desktop\CodexRemote-fix.lnk');startMenuSha256=('b'*64);desktopSha256=('c'*64)}
 $fullReadyRecord=[pscustomobject][ordered]@{schemaVersion=1;transactionId='11111111-2222-3333-4444-555555555555';oldRuntimeId=$null;oldGeneration=$null;oldManifestSha256=$null;newRuntimeId=$runtimeId;newGeneration=[uint64]7;newManifestSha256=('a'*64);sealedPackageSha256=$packageSha256;ownedObjectNames=@($runtimeId);phase='Ready';errorCode=$null}
 $v210ShortcutNames = @(
     'Programs\Codex Control other devices\Codex Control other devices for Windows.lnk',
@@ -51,6 +52,35 @@ function New-CcodLegacyRegistrationFixture {
     }
 }
 
+function New-CcodProductLegacyShortcutProofs {
+    param([Parameter(Mandatory)]$Legacy,[Parameter(Mandatory)][string]$ExpectedInstallRoot)
+    $powershell=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'WindowsPowerShell\v1.0\powershell.exe'))
+    $install=[IO.Path]::GetFullPath($ExpectedInstallRoot);$installer=[IO.Path]::GetFullPath([string]$Legacy.installLocation);$version=[version]::Parse([string]$Legacy.displayVersion)
+    $bootstrap=Join-Path $install 'bootstrap.ps1';$explicit=if($version-ge[version]'2.5.0'){' -EntryMode Explicit'}else{''};$main='-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "{0}" -InstallRoot "{1}"{2}'-f$bootstrap,$install,$explicit
+    $proofs=@{}
+    foreach($name in @($Legacy.shortcutNames)){
+        $target=$null;$arguments='';$working=''
+        $oldDesktop='Desktop\Codex '+[char]0x8BBE+[char]0x5907+[char]0x8FDE+[char]0x63A5+' (Device Connection).lnk'
+        if([string]$name-ceq$oldDesktop){$target=$powershell;$arguments=$main;$working=$install}
+        else{
+        switch -CaseSensitive ([string]$name){
+            'Programs\Codex Control other devices\Codex Control other devices for Windows.lnk' {$target=Join-Path $installer 'README.md'}
+            'Programs\Codex Control other devices\Open the tray supervisor.lnk' {$target=$powershell;$arguments='-NoProfile -ExecutionPolicy Bypass -File "{0}"'-f(Join-Path $installer 'Start-CodexControlOtherDevices.ps1');$working=$installer}
+            'Programs\Codex Control other devices\Compatibility check.lnk' {$target=$powershell;$arguments='-NoProfile -ExecutionPolicy Bypass -File "{0}"'-f(Join-Path $installer 'Test-CodexControlOtherDevices.ps1');$working=$installer}
+            'Programs\Codex Control other devices\Uninstall Codex Control other devices.lnk' {$target=Join-Path $installer 'unins000.exe'}
+            'Programs\CodexRemote-fix\CodexRemote-fix.lnk' {$target=$powershell;$arguments=$main;$working=$install}
+            'Programs\CodexRemote-fix\CodexRemote-fix compatibility check.lnk' {$target=$powershell;$arguments='-NoProfile -ExecutionPolicy Bypass -File "{0}"'-f(Join-Path $installer 'Test-CodexControlOtherDevices.ps1');$working=$installer}
+            'Programs\CodexRemote-fix\Uninstall CodexRemote-fix.lnk' {$target=Join-Path $installer 'unins000.exe'}
+            'Desktop\CodexRemote-fix.lnk' {$target=$powershell;$arguments=$main;$working=$install}
+            default {throw "unknown test legacy shortcut $name"}
+        }
+        }
+        $bytes=[Text.UTF8Encoding]::new($false).GetBytes(('legacy-shortcut:'+([string]$name)));$sha=[Security.Cryptography.SHA256]::Create();try{$hash=[BitConverter]::ToString($sha.ComputeHash($bytes)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()}
+        $proofs[[string]$name]=[pscustomobject][ordered]@{targetPath=[IO.Path]::GetFullPath($target);arguments=$arguments;workingDirectory=$(if([string]::IsNullOrEmpty($working)){''}else{[IO.Path]::GetFullPath($working).TrimEnd('\')});sha256=$hash;bytesBase64=[Convert]::ToBase64String($bytes)}
+    }
+    $proofs
+}
+
 function New-CcodRegistrationWorld {
     param([string]$InstallRoot = 'C:\fixture\CodexControlOtherDevices')
 
@@ -95,8 +125,10 @@ function New-CcodRegistrationWorld {
         VerifiedRegistrationReads = 0
         VerifiedRegistrationMutationAt = 0
         LegacySnapshotHashOverrides = @{}
+        LegacyShortcutProofs = $null
         Calls = [Collections.Generic.List[string]]::new()
     }
+    $world.LegacyShortcutProofs=New-CcodProductLegacyShortcutProofs -Legacy $world.Legacy -ExpectedInstallRoot $registration.installRoot
     $world | Add-Member -NotePropertyName Adapters -NotePropertyValue @{
         GetReadyProof = { param($Registration) $world.Calls.Add('Ready'); $world.Ready }.GetNewClosure()
         WriteProductRegistration = {
@@ -116,6 +148,8 @@ function New-CcodRegistrationWorld {
             $world.Calls.Add("WriteShortcut:$Kind")
             if ($world.WriteShortcutFailure -ceq $Kind) { throw 'fixture shortcut write failed' }
             $world.Shortcuts[$Kind] = $Shortcut
+            $legacyName=if($Kind-ceq'StartMenu'){$currentShortcutNames[0]}else{$currentShortcutNames[1]}
+            if(-not$world.LegacyEntries.Contains($legacyName)){$world.LegacyEntries.Add($legacyName)}
         }.GetNewClosure()
         ReadShortcut = {
             param($Kind,$Shortcut)
@@ -123,7 +157,7 @@ function New-CcodRegistrationWorld {
             if ($world.ReadShortcutFailure -ceq $Kind) { throw 'fixture shortcut read failed' }
             $world.Shortcuts[$Kind]
         }.GetNewClosure()
-        ReadLegacyRegistration = { param($ExpectedAppId) $world.Calls.Add('ReadLegacy');if($world.LegacyEntries.Contains('Registry')){$world.Legacy}else{$null} }.GetNewClosure()
+        ReadLegacyRegistration = {param($ExpectedAppId)$world.Calls.Add('ReadLegacy');if(-not$world.LegacyEntries.Contains('Registry')){return $null};[pscustomobject][ordered]@{appId=[string]$world.Legacy.appId;displayVersion=[string]$world.Legacy.displayVersion;installLocation=[string]$world.Legacy.installLocation;uninstallString=[string]$world.Legacy.uninstallString;shortcutNames=@($world.LegacyEntries|Where-Object{[string]$_-cne'Registry'});unsafeShortcutNames=@($world.Legacy.unsafeShortcutNames)}}.GetNewClosure()
         ReadVerifiedRegistration = {
             $world.VerifiedRegistrationReads++
             $startMenuSha256=if($world.VerifiedRegistrationMutationAt-eq$world.VerifiedRegistrationReads){'d'*64}else{'b'*64}
@@ -139,18 +173,18 @@ function New-CcodRegistrationWorld {
             param($ExpectedAppId,$ExpectedProfile)
             $entries=[Collections.Generic.List[object]]::new()
             foreach($entry in @($world.LegacyEntries)){
-                if($currentShortcutNames-ccontains[string]$entry){
+                if([string]$entry-cne'Registry'){
                     $base=if(([string]$entry).StartsWith('Programs\',[StringComparison]::Ordinal)){[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs)}else{[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop)}
-                    $relative=([string]$entry).Substring(([string]$entry).IndexOf('\')+1);$sha=if([string]$entry-ceq$currentShortcutNames[0]){'b'*64}else{'c'*64}
+                    $relative=([string]$entry).Substring(([string]$entry).IndexOf('\')+1);$proof=$world.LegacyShortcutProofs[[string]$entry];$sha=[string]$proof.sha256
                     if($world.LegacySnapshotHashOverrides.ContainsKey([string]$entry)){$sha=[string]$world.LegacySnapshotHashOverrides[[string]$entry]}
-                    $entries.Add([pscustomobject]@{kind='Shortcut';name=[string]$entry;path=[IO.Path]::GetFullPath((Join-Path $base $relative));sha256=$sha;bytesBase64=''})
+                    $entries.Add([pscustomobject][ordered]@{kind='Shortcut';name=[string]$entry;path=[IO.Path]::GetFullPath((Join-Path $base $relative));sha256=$sha;bytesBase64=[string]$proof.bytesBase64;targetPath=[string]$proof.targetPath;arguments=[string]$proof.arguments;workingDirectory=[string]$proof.workingDirectory})
                 }else{$entries.Add([string]$entry)}
             }
             [pscustomobject][ordered]@{appId=$world.Legacy.appId;entries=@($entries)}
         }.GetNewClosure()
-        RemoveLegacyEntry = { param($Entry);$world.LegacyRemoveAttempts++;if($world.LegacyRemoveFailureAt-eq$world.LegacyRemoveAttempts){throw 'fixture legacy delete failure'};[void]$world.LegacyEntries.Remove([string]$Entry) }.GetNewClosure()
-        ReadLegacyEntry = { param($Entry);if($world.LegacyReplacementEntry-ceq[string]$Entry){return 'Mismatch'};if($world.LegacyEntries.Contains([string]$Entry)){'Exact'}else{$null} }.GetNewClosure()
-        RestoreLegacyEntry = { param($Entry);if($world.LegacyRestoreFailureEntry-ceq[string]$Entry){throw 'fixture restore failed'};if(-not$world.LegacyEntries.Contains([string]$Entry)){$world.LegacyEntries.Add([string]$Entry)};$world.LegacyRestoreOrder.Add([string]$Entry);$world.LegacyRestores++ }.GetNewClosure()
+        RemoveLegacyEntry = {param($Entry);$name=if($Entry-is[string]){[string]$Entry}elseif($Entry.kind-ceq'Registry'){'Registry'}else{[string]$Entry.name};$world.LegacyRemoveAttempts++;if($world.LegacyRemoveFailureAt-eq$world.LegacyRemoveAttempts){throw 'fixture legacy delete failure'};[void]$world.LegacyEntries.Remove($name)}.GetNewClosure()
+        ReadLegacyEntry = {param($Entry);$name=if($Entry-is[string]){[string]$Entry}elseif($Entry.kind-ceq'Registry'){'Registry'}else{[string]$Entry.name};if($world.LegacyReplacementEntry-ceq$name-and$world.LegacyRemoveFailureAt-gt0-and$world.LegacyRemoveAttempts-ge$world.LegacyRemoveFailureAt){return 'Mismatch'};if($world.LegacyEntries.Contains($name)){'Exact'}else{$null}}.GetNewClosure()
+        RestoreLegacyEntry = {param($Entry);$name=if($Entry-is[string]){[string]$Entry}elseif($Entry.kind-ceq'Registry'){'Registry'}else{[string]$Entry.name};if($world.LegacyRestoreFailureEntry-ceq$name){throw 'fixture restore failed'};if(-not$world.LegacyEntries.Contains($name)){$world.LegacyEntries.Add($name)};$world.LegacyRestoreOrder.Add($name);$world.LegacyRestores++}.GetNewClosure()
         WriteLegacyCompensationFailure = {param($Record)$world.LegacyUnresolvedRecords.Add($Record)}.GetNewClosure()
     }
     return $world
@@ -167,10 +201,16 @@ function Set-CcodRegistrationLegacyFixture {
         [string[]]$UnsafeShortcutNames = @()
     )
     $World.Legacy = New-CcodLegacyRegistrationFixture -Version $Version -ShortcutNames $ShortcutNames -AppId $AppId -InstallLocation $InstallLocation -UninstallString $UninstallString -UnsafeShortcutNames $UnsafeShortcutNames
+    $World.LegacyShortcutProofs=New-CcodProductLegacyShortcutProofs -Legacy $World.Legacy -ExpectedInstallRoot $World.Registration.installRoot
     $World.LegacyEntries.Clear()
     foreach ($entry in @('Registry') + $ShortcutNames) { $World.LegacyEntries.Add($entry) }
 }
 
+function Get-CcodProductTestLegacyMigrationPlan {
+    param([Parameter(Mandatory)]$World)
+    Get-CcodLegacyProductRegistrationMigrationPlan -ExpectedAppId $appId -ExpectedInstallRoot ([string]$World.Registration.installRoot) -Adapters $World.Adapters
+}
+
 function New-CcodFix1RegistryKey {
     param([Parameter(Mandatory)][string]$Id,[Parameter(Mandatory)]$Values,[Parameter(Mandatory)]$Kinds,[Parameter(Mandatory)]$World)
     $key=[pscustomobject]@{Id=$Id;Values=$Values;Kinds=$Kinds;World=$World;DeleteCalls=0;DisposeCalls=0;Deleted=$false}
@@ -252,26 +292,24 @@ function Invoke-CcodFix1RegistryCompensationScenario {
             }
         } $world
         $registryEntry=New-CcodFix1RegistrySnapshotEntry
+        $legacy=New-CcodLegacyRegistrationFixture -Version '2.5.21' -ShortcutNames $v2521ShortcutNames
+        $proofs=New-CcodProductLegacyShortcutProofs -Legacy $legacy -ExpectedInstallRoot 'C:\fixture\CodexControlOtherDevices'
         $programs=[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs);$desktop=[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop)
-        $snapshot=[pscustomobject][ordered]@{appId=$appId;entries=@(
-            $registryEntry,
-            [pscustomobject]@{kind='Shortcut';name=$v2521ShortcutNames[0];path=[IO.Path]::GetFullPath((Join-Path $programs 'CodexRemote-fix\CodexRemote-fix.lnk'));sha256=('b'*64);bytesBase64=''},
-            $v2521ShortcutNames[1],$v2521ShortcutNames[2],
-            [pscustomobject]@{kind='Shortcut';name=$v2521ShortcutNames[3];path=[IO.Path]::GetFullPath((Join-Path $desktop 'CodexRemote-fix.lnk'));sha256=('c'*64);bytesBase64=''}
-        )}
+        $snapshotEntries=[Collections.Generic.List[object]]::new();$snapshotEntries.Add($registryEntry)
+        foreach($name in $v2521ShortcutNames){$base=if($name.StartsWith('Programs\',[StringComparison]::Ordinal)){$programs}else{$desktop};$relative=$name.Substring($name.IndexOf('\')+1);$shortcut=$proofs[$name];$snapshotEntries.Add([pscustomobject][ordered]@{kind='Shortcut';name=$name;path=[IO.Path]::GetFullPath((Join-Path $base $relative));sha256=[string]$shortcut.sha256;bytesBase64=[string]$shortcut.bytesBase64;targetPath=[string]$shortcut.targetPath;arguments=[string]$shortcut.arguments;workingDirectory=[string]$shortcut.workingDirectory})}
+        $snapshot=[pscustomobject][ordered]@{appId=$appId;entries=@($snapshotEntries)}
         $proof=[pscustomobject][ordered]@{verified=$true;runtimeId=$runtimeId;version='2.5.22';packageSha256=$packageSha256;shortcutNames=@($currentShortcutNames);startMenuSha256=('b'*64);desktopSha256=('c'*64)}
-        $legacy=New-CcodLegacyRegistrationFixture -Version '2.5.21' -ShortcutNames $v2521ShortcutNames
         $removeRegistry={param($Entry)&$isolated {param($Value)Remove-CcodLegacySnapshotEntry -Entry $Value} $Entry}.GetNewClosure()
         $readRegistry={param($Entry)&$isolated {param($Value)Read-CcodLegacySnapshotEntry -Entry $Value} $Entry}.GetNewClosure()
         $restoreRegistry={param($Entry)&$isolated {param($Value)Restore-CcodLegacySnapshotEntry -Entry $Value} $Entry}.GetNewClosure()
         $adapters=@{
             ReadVerifiedRegistration={$proof}.GetNewClosure();ReadLegacyRegistration={param($ExpectedAppId)$legacy}.GetNewClosure();ReadLegacySnapshot={param($ExpectedAppId,$ExpectedProfile)$snapshot}.GetNewClosure()
-            RemoveLegacyEntry={param($Entry)if($Entry-isnot[string]){try{&$removeRegistry $Entry}catch{$world.LowerFailure=$_;throw};return};if($Mode-cne'PartialReplacement'-and[string]$Entry-ceq$v2521ShortcutNames[1]){throw 'TEST_LATER_SHORTCUT_DELETE_FAILURE'}}.GetNewClosure()
-            ReadLegacyEntry={param($Entry)if($Entry-isnot[string]){&$readRegistry $Entry}else{'Exact'}}.GetNewClosure()
-            RestoreLegacyEntry={param($Entry)if($Entry-isnot[string]){&$restoreRegistry $Entry}}.GetNewClosure()
+            RemoveLegacyEntry={param($Entry)if($Entry-isnot[string]-and$Entry.kind-ceq'Registry'){try{&$removeRegistry $Entry}catch{$world.LowerFailure=$_;throw};return};$name=if($Entry-is[string]){[string]$Entry}else{[string]$Entry.name};if($Mode-cne'PartialReplacement'-and$name-ceq$v2521ShortcutNames[1]){throw 'TEST_LATER_SHORTCUT_DELETE_FAILURE'}}.GetNewClosure()
+            ReadLegacyEntry={param($Entry)if($Entry-isnot[string]-and$Entry.kind-ceq'Registry'){&$readRegistry $Entry}else{'Exact'}}.GetNewClosure()
+            RestoreLegacyEntry={param($Entry)if($Entry-isnot[string]-and$Entry.kind-ceq'Registry'){&$restoreRegistry $Entry}}.GetNewClosure()
             WriteLegacyCompensationFailure={param($Record)$world.CompensationRecords.Add($Record)}.GetNewClosure()
         }
-        $failure=$null;try{&$isolated {param($ExpectedAppId,$ProductAdapters)Remove-CcodLegacyProductRegistration -ExpectedAppId $ExpectedAppId -Adapters $ProductAdapters} $appId $adapters}catch{$failure=$_}
+        $failure=$null;try{&$isolated {param($ExpectedAppId,$ProductAdapters,$ExpectedInstallRoot,$ExpectedCurrentProof)$plan=Get-CcodLegacyProductRegistrationMigrationPlan -ExpectedAppId $ExpectedAppId -ExpectedInstallRoot $ExpectedInstallRoot -Adapters $ProductAdapters;Remove-CcodLegacyProductRegistration -ExpectedAppId $ExpectedAppId -MigrationPlan $plan -ExpectedCurrentProof $ExpectedCurrentProof -Adapters $ProductAdapters} $appId $adapters 'C:\fixture\CodexControlOtherDevices' $proof}catch{$failure=$_}
         return [pscustomobject]@{World=$world;Failure=$failure;ReplacementBefore=$replacementBefore;ReplacementKindsBefore=$replacementKindsBefore;RegistryEntry=$registryEntry}
     }finally{Remove-Module $isolated -Force -ErrorAction SilentlyContinue;if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force}}
 }
@@ -348,10 +386,11 @@ $results += Invoke-CcodTest 'shortcut path and target mismatches fail the three-
 # Production mutation caught: considering adapter write success equivalent to durable read-back.
 $results += Invoke-CcodTest 'valid Ready registration reads all three new records before exact legacy removal' {
     $world = New-CcodRegistrationWorld
+    $plan = Get-CcodProductTestLegacyMigrationPlan $world
     $receipt = Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
     Assert-CcodTrue $receipt.verified 'registration returns a verified three-record receipt'
-    Assert-CcodEqual 'Ready,WriteProduct,WriteShortcut:StartMenu,WriteShortcut:Desktop,ReadProduct,ReadShortcut:StartMenu,ReadShortcut:Desktop' ($world.Calls -join ',') 'all new writes and read-backs precede legacy migration'
-    Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters
+    Assert-CcodEqual 'ReadLegacy,Ready,WriteProduct,WriteShortcut:StartMenu,WriteShortcut:Desktop,ReadProduct,ReadShortcut:StartMenu,ReadShortcut:Desktop' ($world.Calls -join ',') 'legacy profile capture precedes all current writes and read-backs'
+    Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -MigrationPlan $plan -ExpectedCurrentProof $expectedVerifiedRegistration -Adapters $world.Adapters
     Assert-CcodEqual 3 $world.LegacyRemoveAttempts 'exact migration removes only the three non-current legacy entries'
     Assert-CcodEqual (($currentShortcutNames|Sort-Object)-join'|') ((@($world.LegacyEntries)|Sort-Object)-join'|') 'exact migration retains both verified current shortcut replacements'
 }
@@ -360,9 +399,10 @@ $results += Invoke-CcodTest 'valid Ready registration reads all three new record
 # selecting the one complete installer profile that produced the legacy registration.
 $results += Invoke-CcodTest 'real v2.5.21 registration removes its exact four-shortcut profile' {
     $world = New-CcodRegistrationWorld
+    $plan = Get-CcodProductTestLegacyMigrationPlan $world
     $null = Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
 
-    Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters
+    Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -MigrationPlan $plan -ExpectedCurrentProof $expectedVerifiedRegistration -Adapters $world.Adapters
 
     Assert-CcodEqual 3 $world.LegacyRemoveAttempts 'v2.5.21 cleanup removes the registry compatibility link and uninstall link'
     Assert-CcodEqual (($currentShortcutNames|Sort-Object)-join'|') ((@($world.LegacyEntries)|Sort-Object)-join'|') 'v2.5.21 cleanup retains the two verified current shortcut replacements'
@@ -413,11 +453,14 @@ $results += Invoke-CcodTest 'profile resolution rejects ambiguous registry and s
             'InstallLocationRelative' { $legacy.installLocation = 'relative\installer' }
         }
         $world.Legacy = $legacy
-        $null = Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
+        $world.LegacyEntries.Clear();$world.LegacyEntries.Add('Registry');foreach($name in @($legacy.shortcutNames)){$world.LegacyEntries.Add([string]$name)}
+        $before=@($world.LegacyEntries|Sort-Object)-join'|'
         Assert-CcodThrows { Resolve-CcodLegacyRegistrationProfile -LegacyRegistration $world.Legacy | Out-Null } 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
-        Assert-CcodThrows { Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters } 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+        Assert-CcodThrows { Get-CcodProductTestLegacyMigrationPlan $world | Out-Null } 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
         Assert-CcodEqual 0 $world.LegacyRemoveAttempts "$kind mismatch is rejected before any legacy deletion"
-        Assert-CcodEqual 5 $world.LegacyEntries.Count "$kind mismatch preserves the complete exact legacy state"
+        Assert-CcodEqual $null $world.Product "$kind mismatch is rejected before the current registry write"
+        Assert-CcodEqual 0 $world.Shortcuts.Count "$kind mismatch is rejected before either current shortcut write"
+        Assert-CcodEqual $before ((@($world.LegacyEntries|Sort-Object))-join'|') "$kind mismatch preserves the complete exact legacy state"
     }
 }
 
@@ -425,32 +468,34 @@ $results += Invoke-CcodTest 'profile resolution rejects ambiguous registry and s
 # complete older profile or authorizes a same-count snapshot containing an unrelated entry.
 $results += Invoke-CcodTest 'legacy snapshot count and names are derived from the selected historical profile' {
     foreach ($case in @(
-        [pscustomobject]@{Version='2.1.0';Names=$v210ShortcutNames;RemovalCount=5;Remaining=@()},
-        [pscustomobject]@{Version='2.1.6';Names=$v211ShortcutNames;RemovalCount=6;Remaining=@()},
+        [pscustomobject]@{Version='2.1.0';Names=$v210ShortcutNames;RemovalCount=5;Remaining=$currentShortcutNames},
+        [pscustomobject]@{Version='2.1.6';Names=$v211ShortcutNames;RemovalCount=6;Remaining=$currentShortcutNames},
         [pscustomobject]@{Version='2.5.21';Names=$v2521ShortcutNames;RemovalCount=3;Remaining=$currentShortcutNames}
     )) {
         $world = New-CcodRegistrationWorld
         Set-CcodRegistrationLegacyFixture -World $world -Version $case.Version -ShortcutNames $case.Names
+        $plan = Get-CcodProductTestLegacyMigrationPlan $world
         $null = Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
-        Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters
+        Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -MigrationPlan $plan -ExpectedCurrentProof $expectedVerifiedRegistration -Adapters $world.Adapters
         Assert-CcodEqual $case.RemovalCount $world.LegacyRemoveAttempts "$($case.Version) removes only legacy entries not replaced by exact current shortcuts"
         Assert-CcodEqual ((@($case.Remaining)|Sort-Object)-join'|') ((@($world.LegacyEntries)|Sort-Object)-join'|') "$($case.Version) leaves exactly its verified current replacement set"
     }
 
     $world = New-CcodRegistrationWorld
+    $plan = Get-CcodProductTestLegacyMigrationPlan $world
     $null = Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
     [void]$world.LegacyEntries.Remove($v2521ShortcutNames[3])
     $world.LegacyEntries.Add('Programs\CodexRemote-fix\unexpected.lnk')
-    Assert-CcodThrows { Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters } 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+    Assert-CcodThrows { Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -MigrationPlan $plan -ExpectedCurrentProof $expectedVerifiedRegistration -Adapters $world.Adapters } 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
     Assert-CcodEqual 0 $world.LegacyRemoveAttempts 'same-count foreign snapshot is rejected before the first deletion'
 }
 
 $results += Invoke-CcodTest 'overlapping legacy names require exact current shortcut hashes before deletion' {
     $world=New-CcodRegistrationWorld
     $world.LegacySnapshotHashOverrides[$currentShortcutNames[0]]='d'*64
-    $null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
-    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+    Assert-CcodThrows {Get-CcodProductTestLegacyMigrationPlan $world|Out-Null} 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
     Assert-CcodEqual 0 $world.LegacyRemoveAttempts 'mismatched replacement hash is rejected before any legacy deletion'
+    Assert-CcodEqual $null $world.Product 'mismatched captured bytes are rejected before current product writes'
     Assert-CcodEqual 5 $world.LegacyEntries.Count 'mismatched replacement hash preserves every observed entry'
 }
 
@@ -458,8 +503,9 @@ $results += Invoke-CcodTest 'current registration drift after cleanup restores e
     $world=New-CcodRegistrationWorld
     $world.VerifiedRegistrationMutationAt=2
     $before=@($world.LegacyEntries)|Sort-Object
+    $plan=Get-CcodProductTestLegacyMigrationPlan $world
     $null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
-    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -MigrationPlan $plan -ExpectedCurrentProof $expectedVerifiedRegistration -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
     Assert-CcodEqual 3 $world.LegacyRemoveAttempts 'post-cleanup proof drift occurs only after the three legacy-only entries were removed'
     Assert-CcodEqual ($before-join'|') ((@($world.LegacyEntries)|Sort-Object)-join'|') 'post-cleanup proof drift compensates the complete removed legacy-only set'
     Assert-CcodEqual (($v2521ShortcutNames[2],$v2521ShortcutNames[1],'Registry')-join'|') (@($world.LegacyRestoreOrder)-join'|') 'post-cleanup proof drift restores legacy-only entries in reverse order'
@@ -469,9 +515,10 @@ $results += Invoke-CcodTest 'current registration drift after cleanup restores e
 $results += Invoke-CcodTest 'legacy migration rejects AppId shortcut and current-proof mismatches without deletion' {
     foreach ($mismatch in @('AppId','Shortcut','Receipt','CurrentProofHash','CurrentProofNames')) {
         $world = New-CcodRegistrationWorld
+        $plan = Get-CcodProductTestLegacyMigrationPlan $world
         $receipt = Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
-        if ($mismatch -ceq 'AppId') { $world.Legacy.appId = '{AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE}' }
-        if ($mismatch -ceq 'Shortcut') { $world.Legacy.shortcutNames = @('Programs\unexpected.lnk') }
+        if ($mismatch -ceq 'AppId') { $plan.legacyRegistration.appId = '{AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE}' }
+        if ($mismatch -ceq 'Shortcut') { $plan.legacyRegistration.shortcutNames = @('Programs\unexpected.lnk') }
         if ($mismatch -ceq 'Receipt') { $world.Product = $null }
         if ($mismatch -in @('CurrentProofHash','CurrentProofNames')) {
             $readVerified=$world.Adapters.ReadVerifiedRegistration
@@ -481,7 +528,7 @@ $results += Invoke-CcodTest 'legacy migration rejects AppId shortcut and current
                 $proof
             }.GetNewClosure()
         }
-        Assert-CcodThrows { Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters } 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+        Assert-CcodThrows { Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -MigrationPlan $plan -ExpectedCurrentProof $expectedVerifiedRegistration -Adapters $world.Adapters } 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
         Assert-CcodEqual 0 $world.LegacyRemoveAttempts 'legacy mismatch is rejected before any deletion'
         Assert-CcodEqual 5 $world.LegacyEntries.Count 'legacy state remains intact on mismatch'
     }
@@ -516,10 +563,11 @@ $results += Invoke-CcodTest 'current product registry preflight rejects a subkey
 # Production mutation caught: a mid-sequence legacy deletion failure leaves earlier exact entries missing.
 $results += Invoke-CcodTest 'legacy migration restores earlier exact deletions after a later deletion failure' {
     $world=New-CcodRegistrationWorld
+    $plan=Get-CcodProductTestLegacyMigrationPlan $world
     $receipt=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
     $before=@($world.LegacyEntries)|Sort-Object
     $world.LegacyRemoveFailureAt=3
-    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -MigrationPlan $plan -ExpectedCurrentProof $expectedVerifiedRegistration -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
     Assert-CcodEqual ($before-join'|') ((@($world.LegacyEntries)|Sort-Object)-join'|') 'failed migration restores the complete exact legacy set'
     Assert-CcodEqual 2 $world.LegacyRestores 'only successfully removed legacy-only entries are restored'
     Assert-CcodEqual (($v2521ShortcutNames[1],'Registry')-join'|') (@($world.LegacyRestoreOrder)-join'|') 'successful legacy-only deletions are compensated in exact reverse order'
@@ -530,6 +578,22 @@ $results += Invoke-CcodTest 'native registry create-only boundary loads without
     Assert-CcodTrue ($native.Create-and$native.Compare-and$native.Delete) 'native boundary exposes only create-with-disposition compare-handle and delete-by-handle operations used by compensation'
 }
 
+$results += Invoke-CcodTest 'installed resume registry publish converges only exact old-new partial transitions' {
+    $original=[ordered]@{DisplayName='CodexRemote-fix';UninstallString='old-command';QuietUninstallString='old-quiet'}
+    $expected=[ordered]@{DisplayName='CodexRemote-fix';UninstallString='resume-command';QuietUninstallString='resume-command';CcodUninstallTransactionId='11111111-2222-3333-4444-555555555555';CcodUninstallResumeScriptSha256=('a'*64)}
+    $kinds=[ordered]@{DisplayName='String';UninstallString='String';QuietUninstallString='String';CcodUninstallTransactionId='String';CcodUninstallResumeScriptSha256='String'}
+    $world=[pscustomobject]@{ReplacementWrites=0}
+    $partial=New-CcodFix1RegistryKey -Id Partial -Values ([ordered]@{DisplayName='CodexRemote-fix';UninstallString='resume-command';QuietUninstallString='old-quiet';CcodUninstallTransactionId='11111111-2222-3333-4444-555555555555'}) -Kinds ([ordered]@{DisplayName='String';UninstallString='String';QuietUninstallString='String';CcodUninstallTransactionId='String'}) -World $world
+    $accepted=&$module {param($Key,$Old,$New,$Kinds)Test-CcodInstalledResumeRegistryTransition -Key $Key -Original $Old -Expected $New -ExpectedKinds $Kinds} $partial $original $expected $kinds
+    Assert-CcodTrue $accepted 'crash after exact metadata and one command write remains safely convergent'
+    $partial.Values.CcodUninstallTransactionId='aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee'
+    $foreign=&$module {param($Key,$Old,$New,$Kinds)Test-CcodInstalledResumeRegistryTransition -Key $Key -Original $Old -Expected $New -ExpectedKinds $Kinds} $partial $original $expected $kinds
+    Assert-CcodEqual $false $foreign 'foreign partial recovery metadata cannot be overwritten or accepted'
+    $partial.Values.CcodUninstallTransactionId='11111111-2222-3333-4444-555555555555';$partial.Values.Unexpected='foreign';$partial.Kinds.Unexpected='String'
+    $unknown=&$module {param($Key,$Old,$New,$Kinds)Test-CcodInstalledResumeRegistryTransition -Key $Key -Original $Old -Expected $New -ExpectedKinds $Kinds} $partial $original $expected $kinds
+    Assert-CcodEqual $false $unknown 'unknown recovery values fail closed instead of being normalized'
+}
+
 $results += Invoke-CcodTest 'create-only registry compensation accepts only a newly created exact key' {
     $result=Invoke-CcodFix1RegistryCompensationScenario -Mode CreateNew
     Assert-CcodEqual 1 $result.World.NativeCreateCalls 'fully absent registry compensation performs exactly one native create-only open'
@@ -570,23 +634,23 @@ $results += Invoke-CcodTest 'partial registry compensation never writes captured
 }
 
 $results += Invoke-CcodTest 'legacy compensation never overwrites a replacement that appeared after deletion' {
-    $world=New-CcodRegistrationWorld;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;$world.LegacyRemoveFailureAt=3;$world.LegacyReplacementEntry=$v2521ShortcutNames[1]
-    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED'
+    $world=New-CcodRegistrationWorld;$plan=Get-CcodProductTestLegacyMigrationPlan $world;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;$world.LegacyRemoveFailureAt=3;$world.LegacyReplacementEntry=$v2521ShortcutNames[1]
+    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -MigrationPlan $plan -ExpectedCurrentProof $expectedVerifiedRegistration -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED'
     Assert-CcodEqual 1 $world.LegacyRestores 'compensation restores only entries that remain absent'
     Assert-CcodTrue (-not$world.LegacyEntries.Contains($v2521ShortcutNames[1])) 'replacement occupies the removed name and is not overwritten with captured bytes'
     Assert-CcodEqual 1 $world.LegacyUnresolvedRecords.Count 'replacement-blocked restoration is recorded explicitly'
 }
 
 $results += Invoke-CcodTest 'legacy restore failure is explicit and records the unresolved exact entries' {
-    $world=New-CcodRegistrationWorld;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;$world.LegacyRemoveFailureAt=3;$world.LegacyRestoreFailureEntry=$v2521ShortcutNames[1]
-    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED'
+    $world=New-CcodRegistrationWorld;$plan=Get-CcodProductTestLegacyMigrationPlan $world;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;$world.LegacyRemoveFailureAt=3;$world.LegacyRestoreFailureEntry=$v2521ShortcutNames[1]
+    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -MigrationPlan $plan -ExpectedCurrentProof $expectedVerifiedRegistration -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED'
     Assert-CcodEqual 1 $world.LegacyUnresolvedRecords.Count 'failed compensation writes one explicit unresolved record'
     Assert-CcodTrue (@($world.LegacyUnresolvedRecords[0].entries)-ccontains$v2521ShortcutNames[1]) 'unresolved record names the exact entry whose restoration failed'
 }
 
 $results += Invoke-CcodTest 'partially removed current registry entry is included in unresolved compensation' {
-    $world=New-CcodRegistrationWorld;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;$world.LegacyRemoveFailureAt=1;$world.LegacyRestoreFailureEntry='Registry';$originalRemove=$world.Adapters.RemoveLegacyEntry;$world.Adapters.RemoveLegacyEntry={param($Entry)if([string]$Entry-ceq'Registry'){[void]$world.LegacyEntries.Remove('Registry');throw 'partial registry failure'};&$originalRemove $Entry}.GetNewClosure()
-    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED'
+    $world=New-CcodRegistrationWorld;$plan=Get-CcodProductTestLegacyMigrationPlan $world;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;$world.LegacyRemoveFailureAt=1;$world.LegacyRestoreFailureEntry='Registry';$originalRemove=$world.Adapters.RemoveLegacyEntry;$world.Adapters.RemoveLegacyEntry={param($Entry)$name=if($Entry-is[string]){[string]$Entry}elseif($Entry.kind-ceq'Registry'){'Registry'}else{[string]$Entry.name};if($name-ceq'Registry'){[void]$world.LegacyEntries.Remove('Registry');throw 'partial registry failure'};&$originalRemove $Entry}.GetNewClosure()
+    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -MigrationPlan $plan -ExpectedCurrentProof $expectedVerifiedRegistration -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED'
     Assert-CcodTrue (@($world.LegacyUnresolvedRecords[0].entries)-ccontains'Registry') 'current partially removed registry entry is recorded unresolved'
 }
 
@@ -595,8 +659,8 @@ $results += Invoke-CcodTest 'legacy registry snapshot comparison treats a presen
     $partial=[pscustomobject]@{kind='Registry';path='HKCU:\fixture';values=[ordered]@{DisplayName=[pscustomobject]@{value='Codex';kind='String'}}}
     $state=&$module {param($Expected,$Current)Compare-CcodLegacySnapshotEntry -Expected $Expected -Current $Current} $captured $partial
     Assert-CcodEqual 'Mismatch' $state 'a still-present key missing one captured value is not restored'
-    $world=New-CcodRegistrationWorld;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;$world.LegacyRemoveFailureAt=1;$world.Adapters.RemoveLegacyEntry={param($Entry)if([string]$Entry-ceq'Registry'){throw 'partial registry removal and internal restore failed'}};$world.Adapters.ReadLegacyEntry={param($Entry)if([string]$Entry-ceq'Registry'){return $state};if($world.LegacyEntries.Contains([string]$Entry)){return 'Exact'};$null}.GetNewClosure()
-    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED'
+    $world=New-CcodRegistrationWorld;$plan=Get-CcodProductTestLegacyMigrationPlan $world;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;$world.LegacyRemoveFailureAt=1;$world.Adapters.RemoveLegacyEntry={param($Entry)$name=if($Entry-is[string]){[string]$Entry}elseif($Entry.kind-ceq'Registry'){'Registry'}else{[string]$Entry.name};if($name-ceq'Registry'){$world.LegacyRemoveAttempts++;throw 'partial registry removal and internal restore failed'}}.GetNewClosure();$world.Adapters.ReadLegacyEntry={param($Entry)$name=if($Entry-is[string]){[string]$Entry}elseif($Entry.kind-ceq'Registry'){'Registry'}else{[string]$Entry.name};if($name-ceq'Registry'-and$world.LegacyRemoveAttempts-gt0){return $state};if($world.LegacyEntries.Contains($name)){return 'Exact'};$null}.GetNewClosure()
+    Assert-CcodThrows {Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -MigrationPlan $plan -ExpectedCurrentProof $expectedVerifiedRegistration -Adapters $world.Adapters} 'CCOD_LEGACY_PRODUCT_COMPENSATION_FAILED'
     Assert-CcodTrue (@($world.LegacyUnresolvedRecords[0].entries)-ccontains'Registry') 'partial registry key is persisted in the unresolved create-only record'
 }
 
diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index 90fa73e..d945ae2 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -76,6 +76,8 @@ function New-CcodUninstallBootstrapAdapters {
             [void]$World.Calls.Add('GetRoot')
             return 'C:\ccod-uninstall-test'
         }.GetNewClosure()
+        EnterAccountTransition = {param($UserSid)[void]$World.Calls.Add('AccountLock');[pscustomobject]@{Held=$true}}.GetNewClosure()
+        ExitAccountTransition = {param($Lease)[void]$World.Calls.Add('AccountUnlock');$Lease.Held=$false}.GetNewClosure()
         ReadTransaction = {
             param($TransactionRoot)
             [void]$World.Calls.Add('Read')
@@ -252,6 +254,56 @@ $results += Invoke-CcodTest 'production runtime verification binds the installed
     }
 }
 
+function New-CcodUninstallBootstrapTestInstalledBinding {
+    param(
+        [string]$TransactionId='11111111-2222-3333-4444-555555555555',
+        [string]$RuntimeRoot='C:\install\runtime\2.5.0-uninstall-test',
+        [string]$InstallRoot='C:\install',
+        [string]$UserSid='S-1-5-21-111-222-333-1001',
+        [int]$SessionId=1,
+        [int]$WrapperPid=42,
+        [string]$WrapperCreationTimeUtc='2030-02-03T03:04:05.0000000Z',
+        [object[]]$PayloadRecords,
+        [string]$TransactionDirectory,
+        [string]$RuntimeManifestSha256=('a'*64)
+    )
+    $local=Get-CcodInstalledFinalizerLocalAppData;if([string]::IsNullOrWhiteSpace($TransactionDirectory)){$TransactionDirectory=Join-Path (Join-Path $local 'CodexRemote-fix-uninstall') $TransactionId};$resumeScript=[IO.Path]::GetFullPath((Join-Path $TransactionDirectory 'payload\src\persistence\InstalledUninstallFinalizer.ps1'))
+    $records=if($null-ne$PayloadRecords){@($PayloadRecords)}else{@(New-CcodUninstallBootstrapPayloadRecords -ResumeOnly)};if($null-eq$PayloadRecords){foreach($record in $records){$record.length=[int64]1;$record.sha256=('d'*64)};$fakeResume=@($records|Where-Object{$_.path-ceq'src/persistence/InstalledUninstallFinalizer.ps1'})[0];$fakeResume.length=[int64]123;$fakeResume.sha256=('e'*64)};$resumeRecord=@($records|Where-Object{$_.path-ceq'src/persistence/InstalledUninstallFinalizer.ps1'})[0]
+    [pscustomobject][ordered]@{selectedRuntimeRoot=[IO.Path]::GetFullPath($RuntimeRoot);runtimeManifestSha256=$RuntimeManifestSha256;wrapperPid=$WrapperPid;wrapperCreationTimeUtc=$WrapperCreationTimeUtc;wrapperSessionId=$SessionId;wrapperUserSid=$UserSid;resumeWrapperPid=$null;resumeWrapperCreationTimeUtc=$null;resumeWrapperSessionId=$null;resumeWrapperUserSid=$null;resumeScriptPath=$resumeScript;resumeScriptLength=[int64]$resumeRecord.length;resumeScriptSha256=[string]$resumeRecord.sha256;resumeCommand=(Get-CcodUninstallBootstrapInstalledResumeCommand -ResumeScriptPath $resumeScript -TransactionId $TransactionId -RuntimeRoot $RuntimeRoot -InstallRoot $InstallRoot);payloadRecords=$records}
+}
+
+function New-CcodInstalledFinalizerMemoryAdapters {
+    param([Parameter(Mandatory)]$World)
+    @{
+        GetCurrentIdentity={ [pscustomobject]@{userSid=[string]$World.Transaction.userSid;sessionId=[int]$World.Transaction.sessionId} }.GetNewClosure()
+        EnterAccountTransition={param($Sid)$World.Calls.Add('AccountLock');[pscustomobject]@{Held=$true}}.GetNewClosure()
+        ExitAccountTransition={param($Lease)$World.Calls.Add('AccountUnlock');$Lease.Held=$false}.GetNewClosure()
+        EnterTransactionLock={param($Sid)$World.Calls.Add('Lock');[pscustomobject]@{Held=$true}}.GetNewClosure()
+        ExitTransactionLock={param($Lock)$World.Calls.Add('Unlock');$Lock.Held=$false}.GetNewClosure()
+        WaitWrapperExit={param($Identity,$Timeout)$World.Calls.Add('WaitWrapper');[pscustomobject]@{verifiedAtStart=$true;exited=$true}}.GetNewClosure()
+        ReadPreparedTransaction={param($Id,$Root)$World.Calls.Add("Read:$($World.Transaction.phase)");$World.Transaction}.GetNewClosure()
+        ValidateStagedPayload={param($Transaction,$Root)$World.Calls.Add('ValidatePayload');$true}.GetNewClosure()
+        ValidateSelectedGeneration={param($Runtime,$Install,$Transaction)$World.Calls.Add('ValidateGeneration');[bool]$World.RootPresent}.GetNewClosure()
+        ReadCurrentEpoch={param($Root)[uint64]$World.Transaction.leaseEpoch}.GetNewClosure()
+        GetSelectedRootState={param($Root)if($World.RootPresent){'Present'}else{'Absent'}}.GetNewClosure()
+        InstallResumeProductRegistration={param($Transaction)$World.Calls.Add('PublishResume');$World.PublicEntry=$true;$World.PublicCommand=[string]$Transaction.installedBinding.resumeCommand}.GetNewClosure()
+        GetResumeProductRegistrationState={param($Transaction)$World.Calls.Add('ValidateResume');if($World.PublicEntry-and[string]$World.PublicCommand-ceq[string]$Transaction.installedBinding.resumeCommand){'Exact'}else{'Absent'}}.GetNewClosure()
+        ReclaimSelectedGeneration={param($Runtime,$Transaction)$World.Calls.Add('Reclaim');$World.EntryPresentAtReclaim=[bool]$World.PublicEntry;$World.RootPresent=$false;[pscustomobject]@{phase='Completed';result='Reclaimed';runtimeId=$Transaction.runtimeId}}.GetNewClosure()
+        WriteReadyForInno={param($Transaction)$World.Calls.Add('Write:ReadyForInno');if($World.Failure-ceq'PhaseWrite'-and-not$World.FailureInjected){$World.FailureInjected=$true;throw [Management.Automation.ErrorRecord]::new([IO.IOException]::new('durable phase write failed after reclaim'),'CCOD_UNINSTALL_TRANSACTION_WRITE_FAILED',[Management.Automation.ErrorCategory]::WriteError,$Transaction.transactionId)};$Transaction.phase='ReadyForInno';$Transaction.resumePhase='ReadyForInno';$World.Transaction=$Transaction;$Transaction}.GetNewClosure()
+        RemoveMatchedProductShortcuts={param($Transaction)$World.Calls.Add('ProductShortcuts');if($World.Failure-ceq'ProductShortcuts'-and-not$World.FailureInjected){$World.FailureInjected=$true;throw [IO.IOException]::new('shortcut cleanup failed')};$World.ShortcutsPresent=$false}.GetNewClosure()
+        FinalizeReceipt={param($Transaction)$World.Calls.Add('FinalizeReceipt');$Transaction.phase='Completed';$Transaction.resumePhase='Completed';$World.Transaction=$Transaction;if($World.Failure-ceq'FinalReceipt'-and-not$World.FailureInjected){$World.FailureInjected=$true;$World.CompletedReceipt=$false;throw [IO.IOException]::new('receipt write failed after Completed transaction')};$World.CompletedReceipt=$true;$Transaction}.GetNewClosure()
+        TestCompletedReceipt={param($Transaction)$World.Calls.Add('TestReceipt');[bool]$World.CompletedReceipt}.GetNewClosure()
+        RemoveResumeProductRegistration={param($Transaction)$World.Calls.Add('RemoveRegistry');if($World.Failure-ceq'FinalRegistry'-and-not$World.FailureInjected){$World.FailureInjected=$true;throw [IO.IOException]::new('final recovery registry delete failed')};$World.PublicEntry=$false;$World.PublicCommand=$null;$true}.GetNewClosure()
+    }
+}
+
+function Invoke-CcodInstalledFinalizerPublicResume {
+    param([Parameter(Mandatory)]$World,[Parameter(Mandatory)][hashtable]$Adapters)
+    if(-not$World.PublicEntry-or[string]::IsNullOrWhiteSpace([string]$World.PublicCommand)-or$World.PublicCommand-cne[string]$World.Transaction.installedBinding.resumeCommand){throw 'public resume command is unavailable or changed'}
+    if($World.PublicCommand-cnotmatch(' -Resume -TransactionId "'+[regex]::Escape([string]$World.Transaction.transactionId)+'" ')){throw 'public resume command does not bind the transaction'}
+    Invoke-CcodInstalledUninstallFinalizer -TransactionId $World.Transaction.transactionId -RuntimeRoot $World.Transaction.installedBinding.selectedRuntimeRoot -InstallRoot $World.Transaction.readyEvidence.installRoot -WrapperIdentity $null -Resume -Adapters $Adapters
+}
+
 $results += Invoke-CcodTest 'production uninstall authorization consumes append-only selector before legacy active json' {
     $localAppData=Join-Path ([IO.Path]::GetTempPath()) ('ccod-uninstall-append-'+[guid]::NewGuid().ToString('N'));$installRoot=Join-Path $localAppData 'CodexControlOtherDevices';$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
     try{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$localAppData,'Process');$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $installRoot -AppendOnly;$context=Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $installRoot;Assert-CcodEqual $fixture.RuntimeId $context.runtimeId 'uninstall context binds append-only active runtime';Assert-CcodEqual 7 ([uint64]$context.runtimeGeneration) 'uninstall context binds latest append-only generation';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $installRoot 'active.json')) 'append-only uninstall authorization needs no legacy pointer'}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $localAppData){Remove-Item $localAppData -Recurse -Force}}
@@ -565,51 +617,128 @@ $results += Invoke-CcodTest 'FinalizeReceipt fails closed when installer files r
     Assert-CcodEqual 'GetRoot,Read,FinalizeInvocation,RootAbsent' ($world.Calls -join ',') 'Inno residue never receives a false completion receipt'
 }
 
+$results += Invoke-CcodTest 'FinalizeReceipt repairs a missing receipt after the Completed transaction is already durable' {
+    $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=(New-CcodUninstallBootstrapTestTransaction -Phase 'Completed');Receipt=$null;ValidationError=$false;StageError=$false;CleanupError=$false;CleanupFailurePhase=$null;InstallRootAbsent=$true;StagedEntries=@()}
+    $receipt=Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\installer' -InstallRoot 'C:\install' -Mode FinalizeReceipt -Adapters (New-CcodUninstallBootstrapAdapters $world)
+    Assert-CcodEqual 'Completed' $receipt.phase 'Completed transaction remains terminal while its exact receipt is repaired'
+    Assert-CcodEqual 'GetRoot,Read,FinalizeInvocation,RootAbsent,Receipt:Completed' ($world.Calls-join',') 'receipt repair performs no second transaction write before the public registry anchor is removed'
+}
+
 # Production mutation caught: deleting the selected generation while its public wrapper is still executing from it.
 $results += Invoke-CcodTest 'installed Prepare stops at TaskRemoved and external finalizer completes only after wrapper exit' {
     $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=$null;Receipt=$null;ValidationError=$false;StageError=$false;CleanupError=$false;CleanupFailurePhase=$null;InstallRootAbsent=$false;StagedEntries=@();ProductRegistrationRemovals=0}
     $adapters=New-CcodUninstallBootstrapAdapters $world
     $originalCleanup=$adapters.RunCleanup
     $adapters.RunCleanup={param($InstallerRoot,$InstallRoot,$TransactionRoot,$Transaction,$WriteTransaction,$Mode);$world.Calls.Add("Cleanup:$Mode");$Transaction.phase='TaskRemoved';$Transaction.resumePhase='TaskRemoved';&$WriteTransaction $TransactionRoot $Transaction;$Transaction}.GetNewClosure()
-    $adapters.GetInstalledBinding={param($InstallerRoot,$InstallRoot,$Context,$WrapperIdentity)[pscustomobject]@{selectedRuntimeRoot='C:\install\runtime\2.5.0-uninstall-test';runtimeManifestSha256=('a'*64);wrapperPid=42;wrapperCreationTimeUtc='2030-02-03T03:04:05.0000000Z';wrapperSessionId=1;wrapperUserSid='S-1-5-21-111-222-333-1001'}}
+    $adapters.GetInstalledBinding={param($InstallerRoot,$InstallRoot,$Context,$WrapperIdentity,$TransactionDirectory,$TransactionId)New-CcodUninstallBootstrapTestInstalledBinding -TransactionId $TransactionId -RuntimeRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -UserSid $WrapperIdentity.userSid -SessionId $WrapperIdentity.sessionId -WrapperPid $WrapperIdentity.pid -WrapperCreationTimeUtc $WrapperIdentity.creationTimeUtc}.GetNewClosure()
     $wrapperIdentity=[pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=1;userSid='S-1-5-21-111-222-333-1001'}
     $prepared=Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\runtime' -InstallRoot 'C:\install' -Mode PrepareInstalled -WrapperIdentity $wrapperIdentity -Adapters $adapters
     Assert-CcodEqual 'TaskRemoved' $prepared.phase 'installed wrapper retains application state until it exits'
     Assert-CcodEqual 0 $world.ProductRegistrationRemovals 'installed Prepare removes no product state before the external finalizer'
 
-    $final=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();WrapperExited=$true;ContextValid=$true;Transaction=$prepared;RootAbsent=$false;Finalized=$false;Deletes=0}
-    $finalAdapters=@{
-        WaitWrapperExit={param($Identity,$Timeout)$final.Calls.Add('WaitWrapper');[pscustomobject]@{verifiedAtStart=$true;exited=$final.WrapperExited}}.GetNewClosure()
-        ReadPreparedTransaction={param($Id)$final.Calls.Add('ReadTransaction');$final.Transaction}.GetNewClosure()
-        ValidateSelectedGeneration={param($RuntimeRoot,$InstallRoot,$Transaction)$final.Calls.Add('ValidateGeneration');$final.ContextValid}.GetNewClosure()
-        ReadCurrentEpoch={param($InstallRoot)[uint64]11}
-        RemoveSelectedGeneration={param($RuntimeRoot,$Transaction)$final.Calls.Add('RemoveSelected');$final.Deletes++;$final.RootAbsent=$true;$Transaction.phase='ReadyForInno';$Transaction.resumePhase='ReadyForInno';$Transaction}.GetNewClosure()
-        TestSelectedRootAbsent={param($Root)$final.Calls.Add('RootAbsent');$final.RootAbsent}.GetNewClosure()
-        RemoveMatchedProductRegistration={param($Transaction)$final.Calls.Add('RemoveProduct')}.GetNewClosure()
-        FinalizeReceipt={param($Transaction)$final.Calls.Add('Finalize');$final.Finalized=$true;[pscustomobject]@{phase='Completed'}}.GetNewClosure()
-    }
-    $receipt=Invoke-CcodInstalledUninstallFinalizer -TransactionId $prepared.transactionId -RuntimeRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -WrapperIdentity $wrapperIdentity -Adapters $finalAdapters
+    $replacementWrapper=[pscustomobject]@{pid=43;creationTimeUtc='2030-02-03T03:04:06.0000000Z';sessionId=99;userSid='S-1-5-21-111-222-333-1001'}
+    $resumedPrepare=Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\runtime' -InstallRoot 'C:\install' -Mode PrepareInstalled -WrapperIdentity $replacementWrapper -Adapters $adapters
+    Assert-CcodEqual 'TaskRemoved' $resumedPrepare.phase 'a later runtime wrapper reuses the staged transaction instead of replacing historical wrapper proof'
+    Assert-CcodEqual 42 $resumedPrepare.installedBinding.wrapperPid 'historical wrapper identity remains immutable during public retry'
+    Assert-CcodEqual 43 $resumedPrepare.installedBinding.resumeWrapperPid 'replacement wrapper launch identity is persisted separately before returning'
+    Assert-CcodEqual 99 $resumedPrepare.installedBinding.resumeWrapperSessionId 'same-SID replacement wrapper may come from a new login session without rewriting historical identity'
+    Assert-CcodEqual 1 @($world.Calls|Where-Object{$_-ceq'Cleanup:PrepareInstalled'}).Count 'existing TaskRemoved replacement PrepareInstalled never re-enters application cleanup'
+
+    $final=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=$resumedPrepare;RootPresent=$true;PublicEntry=$false;PublicCommand=$null;ShortcutsPresent=$true;CompletedReceipt=$false;Failure=$null;FailureInjected=$false;EntryPresentAtReclaim=$false}
+    $finalAdapters=New-CcodInstalledFinalizerMemoryAdapters $final
+    $receipt=Invoke-CcodInstalledUninstallFinalizer -TransactionId $prepared.transactionId -RuntimeRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -WrapperIdentity $replacementWrapper -WrapperResume -Adapters $finalAdapters
     Assert-CcodEqual 'Completed' $receipt.phase 'external finalizer reaches the completion receipt'
-    Assert-CcodEqual 'WaitWrapper,ReadTransaction,ValidateGeneration,RemoveSelected,RootAbsent,RemoveProduct,Finalize' ($final.Calls -join ',') 'wrapper exit and selected generation proof precede selected-root removal and finalization'
+    Assert-CcodTrue (-not$final.PublicEntry) 'public recovery entry is removed only after the Completed receipt'
+    Assert-CcodTrue $final.EntryPresentAtReclaim 'durable public recovery entry exists before generation reclamation'
+    Assert-CcodTrue (@($final.Calls)-ccontains'WaitWrapper') 'replacement wrapper finalizer waits for the exact replacement instance before reclamation'
+    $localLock=[Array]::IndexOf(@($final.Calls),'Lock');$accountLock=[Array]::IndexOf(@($final.Calls),'AccountLock');$reclaim=[Array]::IndexOf(@($final.Calls),'Reclaim');$registry=[Array]::IndexOf(@($final.Calls),'RemoveRegistry');$accountUnlock=[Array]::IndexOf(@($final.Calls),'AccountUnlock');$localUnlock=[Array]::IndexOf(@($final.Calls),'Unlock')
+    Assert-CcodTrue ($localLock-ge0-and$accountLock-gt$localLock-and$reclaim-gt$accountLock-and$registry-gt$reclaim-and$accountUnlock-gt$registry-and$localUnlock-gt$accountUnlock) 'Local uninstall then Global AccountTransition acquisition order spans the complete tail without ABBA'
+}
+
+# Production mutation caught: after the selected generation is irreversibly reclaimed, a failed
+# phase write, shortcut/product cleanup, final receipt, or final registry delete must remain
+# reachable through the durable staged public uninstall entry.
+$results += Invoke-CcodTest 'installed finalizer resumes every post-reclamation tail failure through the durable public entry' {
+    $outcomes=[Collections.Generic.List[string]]::new()
+    foreach($kind in @('PhaseWrite','ProductShortcuts','FinalReceipt','FinalRegistry')){
+        $transaction=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved'
+        $transaction.installedBinding=New-CcodUninstallBootstrapTestInstalledBinding
+        $world=[pscustomobject]@{
+            Calls=[Collections.Generic.List[string]]::new();Transaction=$transaction;RootPresent=$true;PublicEntry=$false;PublicCommand=$null;ShortcutsPresent=$true;CompletedReceipt=$false
+            Failure=$kind;FailureInjected=$false;EntryPresentAtReclaim=$false
+        }
+        $adapters=New-CcodInstalledFinalizerMemoryAdapters $world
+        $identity=[pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=1;userSid='S-1-5-21-111-222-333-1001'}
+        $first=$null;try{Invoke-CcodInstalledUninstallFinalizer -TransactionId $transaction.transactionId -RuntimeRoot $transaction.installedBinding.selectedRuntimeRoot -InstallRoot 'C:\install' -WrapperIdentity $identity -Adapters $adapters|Out-Null}catch{$first=$_}
+        Assert-CcodTrue ($null-ne$first) "$kind first invocation injects a real post-reclamation failure"
+        Assert-CcodTrue $world.EntryPresentAtReclaim "$kind has the durable public entry before reclamation"
+        Assert-CcodTrue $world.PublicEntry "$kind keeps the public recovery entry after the first failure"
+        Assert-CcodEqual ([string]$transaction.installedBinding.resumeCommand) ([string]$world.PublicCommand) "$kind keeps the exact staged resume command discoverable"
+
+        if($kind-ceq'FinalReceipt'){$adapters.GetCurrentIdentity={ [pscustomobject]@{userSid='S-1-5-21-111-222-333-1001';sessionId=99} }}
+        $second=$null;$receipt=$null;try{$receipt=Invoke-CcodInstalledFinalizerPublicResume -World $world -Adapters $adapters}catch{$second=$_}
+        $secondOutcome=if($null-ne$receipt){[string]$receipt.phase}else{([string]$second.FullyQualifiedErrorId-split',')[0]}
+        $outcomes.Add(('{0}:{1}:phase={2}:entry={3}:receipt={4}'-f$kind,$secondOutcome,[string]$world.Transaction.phase,[bool]$world.PublicEntry,[bool]$world.CompletedReceipt))
+        $mutationsBefore=@($world.Calls|Where-Object{$_-in@('Reclaim','Write:ReadyForInno','ProductShortcuts','FinalizeReceipt','RemoveRegistry')}).Count
+        $replay=Invoke-CcodInstalledUninstallFinalizer -TransactionId $transaction.transactionId -RuntimeRoot $transaction.installedBinding.selectedRuntimeRoot -InstallRoot 'C:\install' -WrapperIdentity $null -Resume -Adapters $adapters
+        Assert-CcodEqual 'Completed' $replay.phase "$kind already-dispatched serial replay observes converged Completed"
+        Assert-CcodEqual $mutationsBefore @($world.Calls|Where-Object{$_-in@('Reclaim','Write:ReadyForInno','ProductShortcuts','FinalizeReceipt','RemoveRegistry')}).Count "$kind Completed replay performs no mutation after the anchor is absent"
+    }
+    $expected=@(
+        'PhaseWrite:Completed:phase=Completed:entry=False:receipt=True',
+        'ProductShortcuts:Completed:phase=Completed:entry=False:receipt=True',
+        'FinalReceipt:Completed:phase=Completed:entry=False:receipt=True',
+        'FinalRegistry:Completed:phase=Completed:entry=False:receipt=True'
+    )-join'|'
+    Assert-CcodEqual $expected (@($outcomes)-join'|') 'every post-reclamation failure converges on its second public invocation'
+}
+
+$results += Invoke-CcodTest 'delayed initial finalizer accepts an absent or reused historical wrapper identity' {
+    $adapters=Get-CcodInstalledFinalizerAdapters -Adapters $null -TransactionRoot 'C:\unused' -PayloadRoot 'C:\unused\payload' -RuntimeRoot 'C:\install\runtime\unused' -InstallRoot 'C:\install'
+    $absent=&$adapters.WaitWrapperExit ([pscustomobject]@{pid=2147483646;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=1;userSid='S-1-5-21-111-222-333-1001'}) 1
+    Assert-CcodTrue ($absent.verifiedAtStart-and$absent.exited) 'durably bound historical PID absence proves the original wrapper has exited'
+    $process=[Diagnostics.Process]::GetCurrentProcess();try{$identity=[Security.Principal.WindowsIdentity]::GetCurrent();try{$sid=[string]$identity.User.Value}finally{$identity.Dispose()};$reused=&$adapters.WaitWrapperExit ([pscustomobject]@{pid=[int]$process.Id;creationTimeUtc='2001-02-03T04:05:06.0000000Z';sessionId=[int]$process.SessionId;userSid=$sid}) 1}finally{$process.Dispose()}
+    Assert-CcodTrue ($reused.verifiedAtStart-and$reused.exited) 'same PID with a different creation time is a reused process not the historical wrapper'
+}
+
+$results += Invoke-CcodTest 'resume rejects a missing anchor or changed command payload caller and epoch before deletion' {
+    foreach($kind in @('MissingAnchor','ResumeCommand','ResumeScriptHash','PayloadHash','CallerSid','Epoch')){
+        $transaction=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$transaction.installedBinding=New-CcodUninstallBootstrapTestInstalledBinding
+        $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=$transaction;RootPresent=($kind-cne'MissingAnchor');PublicEntry=($kind-cne'MissingAnchor');PublicCommand=[string]$transaction.installedBinding.resumeCommand;ShortcutsPresent=$true;CompletedReceipt=$false;Failure=$null;FailureInjected=$false;EntryPresentAtReclaim=$false}
+        if($kind-ceq'ResumeCommand'){$transaction.installedBinding.resumeCommand+=' --foreign';$world.PublicCommand=$transaction.installedBinding.resumeCommand}
+        if($kind-ceq'ResumeScriptHash'){$transaction.installedBinding.resumeScriptSha256=('f'*64)}
+        $adapters=New-CcodInstalledFinalizerMemoryAdapters $world
+        if($kind-ceq'PayloadHash'){$adapters.ValidateStagedPayload={param($T,$R)$false}}
+        if($kind-ceq'CallerSid'){$adapters.GetCurrentIdentity={ [pscustomobject]@{userSid='S-1-5-21-999-888-777-1001';sessionId=7} }}
+        if($kind-ceq'Epoch'){$adapters.ReadCurrentEpoch={param($Root)[uint64]12}}
+        Assert-CcodThrows {Invoke-CcodInstalledUninstallFinalizer -TransactionId $transaction.transactionId -RuntimeRoot $transaction.installedBinding.selectedRuntimeRoot -InstallRoot 'C:\install' -WrapperIdentity $null -Resume -Adapters $adapters|Out-Null} 'CCOD_INSTALLED_FINALIZER_INVALID'
+        Assert-CcodEqual 0 @($world.Calls|Where-Object{$_-in@('Reclaim','Write:ReadyForInno','ProductShortcuts','FinalizeReceipt','RemoveRegistry')}).Count "$kind performs no reclamation or product tail mutation"
+    }
+}
+
+$results += Invoke-CcodTest 'epoch is re-read under AccountTransition immediately before reclamation' {
+    $transaction=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$transaction.installedBinding=New-CcodUninstallBootstrapTestInstalledBinding
+    $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=$transaction;RootPresent=$true;PublicEntry=$false;PublicCommand=$null;ShortcutsPresent=$true;CompletedReceipt=$false;Failure=$null;FailureInjected=$false;EntryPresentAtReclaim=$false};$adapters=New-CcodInstalledFinalizerMemoryAdapters $world;$epochReads=[pscustomobject]@{Count=0}
+    $adapters.ReadCurrentEpoch={param($Root)$epochReads.Count++;if($epochReads.Count-eq1){[uint64]11}else{[uint64]12}}.GetNewClosure()
+    Assert-CcodThrows {Invoke-CcodInstalledUninstallFinalizer -TransactionId $transaction.transactionId -RuntimeRoot $transaction.installedBinding.selectedRuntimeRoot -InstallRoot 'C:\install' -WrapperIdentity ([pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=1;userSid='S-1-5-21-111-222-333-1001'}) -Adapters $adapters|Out-Null} 'CCOD_INSTALLED_FINALIZER_INVALID'
+    Assert-CcodEqual 2 $epochReads.Count 'epoch is checked after lock acquisition and again at the reclaim boundary'
+    Assert-CcodEqual 0 @($world.Calls|Where-Object{$_-ceq'Reclaim'}).Count 'epoch drift reaches no irreversible reclamation'
+    Assert-CcodEqual $false $world.PublicEntry 'epoch drift before resume publication leaves the original product entry and generation intact'
 }
 
 # Production mutation caught: treating any durable transaction/path/process as authority to delete application state.
 $results += Invoke-CcodTest 'installed finalizer wrong wrapper generation path or transaction performs no deletion' {
     foreach($kind in @('Wrapper','Generation','Transaction','Epoch','Sibling')){
-        $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Deletes=0}
         $transaction=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved'
-        $transaction.installedBinding=[pscustomobject][ordered]@{selectedRuntimeRoot=$(if($kind-ceq'Sibling'){'C:\install\runtime\sibling'}else{'C:\install\runtime\2.5.0-uninstall-test'});runtimeManifestSha256=('a'*64);wrapperPid=42;wrapperCreationTimeUtc='2030-02-03T03:04:05.0000000Z';wrapperSessionId=1;wrapperUserSid='S-1-5-21-111-222-333-1001'}
+        $boundRoot=if($kind-ceq'Sibling'){'C:\install\runtime\sibling'}else{'C:\install\runtime\2.5.0-uninstall-test'};$transaction.installedBinding=New-CcodUninstallBootstrapTestInstalledBinding -RuntimeRoot $boundRoot
         if($kind-ceq'Transaction'){$transaction.transactionId='aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee'}
-        $adapters=@{
-            WaitWrapperExit={param($Identity,$Timeout)[pscustomobject]@{verifiedAtStart=($kind-cne'Wrapper');exited=$true}}.GetNewClosure()
-            ReadPreparedTransaction={param($Id)$transaction}.GetNewClosure()
-            ValidateSelectedGeneration={param($RuntimeRoot,$InstallRoot,$Transaction)$kind-cne'Generation'}.GetNewClosure()
-            ReadCurrentEpoch={param($InstallRoot)if($kind-ceq'Epoch'){[uint64]12}else{[uint64]11}}.GetNewClosure()
-            RemoveSelectedGeneration={param($RuntimeRoot,$Transaction)$world.Deletes++;$Transaction}.GetNewClosure()
-            TestSelectedRootAbsent={param($Root)$false};RemoveMatchedProductRegistration={param($Transaction)};FinalizeReceipt={param($Transaction)[pscustomobject]@{phase='Completed'}}
-        }
+        $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=$transaction;RootPresent=$true;PublicEntry=$false;PublicCommand=$null;ShortcutsPresent=$true;CompletedReceipt=$false;Failure=$null;FailureInjected=$false;EntryPresentAtReclaim=$false}
+        $adapters=New-CcodInstalledFinalizerMemoryAdapters $world
+        if($kind-ceq'Wrapper'){$adapters.WaitWrapperExit={param($Identity,$Timeout)[pscustomobject]@{verifiedAtStart=$false;exited=$false}}}
+        if($kind-ceq'Generation'){$adapters.ValidateSelectedGeneration={param($RuntimeRoot,$InstallRoot,$Value)$false}}
+        if($kind-ceq'Epoch'){$adapters.ReadCurrentEpoch={param($InstallRoot)[uint64]12}}
         Assert-CcodThrows {Invoke-CcodInstalledUninstallFinalizer -TransactionId '11111111-2222-3333-4444-555555555555' -RuntimeRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -WrapperIdentity ([pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=1;userSid='S-1-5-21-111-222-333-1001'}) -Adapters $adapters|Out-Null} 'CCOD_INSTALLED_FINALIZER_INVALID'
-        Assert-CcodEqual 0 $world.Deletes "$kind mismatch deletes no application state"
+        Assert-CcodEqual 0 @($world.Calls|Where-Object{$_-ceq'Reclaim'}).Count "$kind mismatch deletes no application state"
     }
 }
 
@@ -639,8 +768,12 @@ $results += Invoke-CcodTest 'fresh and stored Ready evidence require one exact c
 
 $results += Invoke-CcodTest 'default installed finalizer validates and removes only the exact selected generation fixture' {
     $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-installed-finalizer-'+[guid]::NewGuid().ToString('N'));$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
-    try{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$install=Join-Path $local 'CodexControlOtherDevices';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$identity=Get-CcodUninstallBootstrapCurrentIdentity;$transactionRoot=Get-CcodUninstallBootstrapDefaultTransactionRoot;$id='11111111-2222-3333-4444-555555555555';$directory=New-CcodUninstallBootstrapTransactionDirectory -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid;$tx=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$tx.runtimeId=$fixture.RuntimeId;$tx.runtimeGeneration=[uint64]7;$tx.userSid=$identity.userSid;$tx.sessionId=$identity.sessionId;$tx.readyEvidence.runtimeId=$fixture.RuntimeId;$tx.readyEvidence.runtimeGeneration=[uint64]7;$tx.readyEvidence.installRoot=$install;$manifest=(Get-FileHash (Join-Path $fixture.RuntimeRoot 'manifest.json') -Algorithm SHA256).Hash.ToLowerInvariant();$tx.readyEvidence.manifestSha256=$manifest;$tx.installedBinding=[pscustomobject][ordered]@{selectedRuntimeRoot=$fixture.RuntimeRoot;runtimeManifestSha256=$manifest;wrapperPid=42;wrapperCreationTimeUtc='2030-02-03T03:04:05.0000000Z';wrapperSessionId=$identity.sessionId;wrapperUserSid=$identity.userSid};Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory $directory -Transaction $tx;Publish-CcodUninstallBootstrapCurrentTransaction -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid
-        $payload=Join-Path $directory 'payload';foreach($relative in @('src\persistence\UninstallBootstrap.ps1','src\persistence\modules\GenerationReclamation.psm1')){$destination=Join-Path $payload $relative;[IO.Directory]::CreateDirectory((Split-Path $destination -Parent))|Out-Null;[IO.File]::Copy((Join-Path $repositoryRoot $relative),$destination,$true)};$adapters=Get-CcodInstalledFinalizerAdapters -Adapters @{WaitWrapperExit={param($I,$T)[pscustomobject]@{verifiedAtStart=$true;exited=$true}};RemoveMatchedProductRegistration={param($T)};FinalizeReceipt={param($T)[pscustomobject]@{phase='Completed'}}} -TransactionRoot $transactionRoot -PayloadRoot $payload;$receipt=Invoke-CcodInstalledUninstallFinalizer -TransactionId $id -RuntimeRoot $fixture.RuntimeRoot -InstallRoot $install -WrapperIdentity ([pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=$identity.sessionId;userSid=$identity.userSid}) -Adapters $adapters;Assert-CcodEqual 'Completed' $receipt.phase 'default finalizer reaches completion';Assert-CcodTrue (-not(Test-Path $fixture.RuntimeRoot)) 'default finalizer deletes exact selected runtime';Assert-CcodTrue (Test-Path (Join-Path $install 'state')) 'default finalizer preserves sibling install state'
+    try{
+        [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$install=Join-Path $local 'CodexControlOtherDevices';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$identity=Get-CcodUninstallBootstrapCurrentIdentity;$transactionRoot=Get-CcodUninstallBootstrapDefaultTransactionRoot;$id='11111111-2222-3333-4444-555555555555';$directory=New-CcodUninstallBootstrapTransactionDirectory -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid
+        $payload=Join-Path $directory 'payload';$recordMap=@{};foreach($relative in $script:CcodUninstallPayloadEntries){$source=Join-Path $fixture.RuntimeRoot $relative.Replace('/','\');$destination=Join-Path $payload $relative.Replace('/','\');[IO.Directory]::CreateDirectory((Split-Path $destination -Parent))|Out-Null;[IO.File]::Copy($source,$destination,$true);$recordMap[$relative]=Get-CcodUninstallBootstrapFileFingerprint $source};$payloadRecords=New-CcodUninstallBootstrapPayloadRecords -RecordMap $recordMap
+        $tx=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$tx.runtimeId=$fixture.RuntimeId;$tx.runtimeGeneration=[uint64]7;$tx.userSid=$identity.userSid;$tx.sessionId=$identity.sessionId;$tx.readyEvidence.runtimeId=$fixture.RuntimeId;$tx.readyEvidence.runtimeGeneration=[uint64]7;$tx.readyEvidence.installRoot=$install;$manifest=(Get-FileHash (Join-Path $fixture.RuntimeRoot 'manifest.json') -Algorithm SHA256).Hash.ToLowerInvariant();$tx.readyEvidence.manifestSha256=$manifest;$tx.installedBinding=New-CcodUninstallBootstrapTestInstalledBinding -TransactionId $id -RuntimeRoot $fixture.RuntimeRoot -InstallRoot $install -UserSid $identity.userSid -SessionId $identity.sessionId -PayloadRecords $payloadRecords -TransactionDirectory $directory -RuntimeManifestSha256 $manifest;$timestamp=[DateTime]::UtcNow.AddMinutes(-1).ToString('o',[Globalization.CultureInfo]::InvariantCulture);$tx.startedAtUtc=$timestamp;$tx.updatedAtUtc=$timestamp;Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory $directory -Transaction $tx;Publish-CcodUninstallBootstrapCurrentTransaction -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid
+        $resume=[pscustomobject]@{Present=$false};$overrides=@{WaitWrapperExit={param($I,$T)[pscustomobject]@{verifiedAtStart=$true;exited=$true}};InstallResumeProductRegistration={param($T)$resume.Present=$true}.GetNewClosure();GetResumeProductRegistrationState={param($T)if($resume.Present){'Exact'}else{'Absent'}}.GetNewClosure();RemoveMatchedProductShortcuts={param($T)};RemoveResumeProductRegistration={param($T)$resume.Present=$false;$true}.GetNewClosure()};$adapters=Get-CcodInstalledFinalizerAdapters -Adapters $overrides -TransactionRoot $transactionRoot -PayloadRoot $payload -RuntimeRoot $fixture.RuntimeRoot -InstallRoot $install
+        $receipt=Invoke-CcodInstalledUninstallFinalizer -TransactionId $id -RuntimeRoot $fixture.RuntimeRoot -InstallRoot $install -WrapperIdentity ([pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=$identity.sessionId;userSid=$identity.userSid}) -Adapters $adapters;Assert-CcodEqual 'Completed' $receipt.phase 'default finalizer reaches completion';Assert-CcodTrue (-not(Test-Path $fixture.RuntimeRoot)) 'default finalizer deletes exact selected runtime';Assert-CcodTrue (Test-Path (Join-Path $install 'state')) 'default finalizer preserves sibling install state';Assert-CcodTrue (-not$resume.Present) 'default finalizer removes the public anchor last'
     }finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $local){Remove-Item $local -Recurse -Force}}
 }
 
@@ -654,10 +787,10 @@ function Invoke-CcodInstalledReclamationMutationCase {
         $sibling=Join-Path $install 'runtime\sibling-generation';[IO.Directory]::CreateDirectory($sibling)|Out-Null;$siblingSentinel=Join-Path $sibling 'sentinel.bin';[IO.File]::WriteAllText($siblingSentinel,'sibling-preserved',[Text.UTF8Encoding]::new($false));$siblingHash=Get-CcodTestFileSha256 $siblingSentinel
         $deviceKey=Join-Path $install 'state\device-key\private.bin';[IO.Directory]::CreateDirectory((Split-Path $deviceKey -Parent))|Out-Null;[IO.File]::WriteAllText($deviceKey,'dpapi-sentinel-preserved',[Text.UTF8Encoding]::new($false));$deviceKeyHash=Get-CcodTestFileSha256 $deviceKey
         $identity=Get-CcodUninstallBootstrapCurrentIdentity;$transactionRoot=Get-CcodUninstallBootstrapDefaultTransactionRoot;$id=[guid]::NewGuid().ToString('D');$directory=New-CcodUninstallBootstrapTransactionDirectory -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid
-        $tx=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved' -TransactionId $id;$tx.runtimeId=$fixture.RuntimeId;$tx.runtimeGeneration=[uint64]7;$tx.userSid=$identity.userSid;$tx.sessionId=$identity.sessionId;$tx.readyEvidence.runtimeId=$fixture.RuntimeId;$tx.readyEvidence.runtimeGeneration=[uint64]7;$tx.readyEvidence.installRoot=$install;$manifest=(Get-FileHash (Join-Path $fixture.RuntimeRoot 'manifest.json') -Algorithm SHA256).Hash.ToLowerInvariant();$tx.readyEvidence.manifestSha256=$manifest;$tx.installedBinding=[pscustomobject][ordered]@{selectedRuntimeRoot=$fixture.RuntimeRoot;runtimeManifestSha256=$manifest;wrapperPid=42;wrapperCreationTimeUtc='2030-02-03T03:04:05.0000000Z';wrapperSessionId=$identity.sessionId;wrapperUserSid=$identity.userSid};Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory $directory -Transaction $tx
+        $tx=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved' -TransactionId $id;$tx.runtimeId=$fixture.RuntimeId;$tx.runtimeGeneration=[uint64]7;$tx.userSid=$identity.userSid;$tx.sessionId=$identity.sessionId;$tx.readyEvidence.runtimeId=$fixture.RuntimeId;$tx.readyEvidence.runtimeGeneration=[uint64]7;$tx.readyEvidence.installRoot=$install;$manifest=(Get-FileHash (Join-Path $fixture.RuntimeRoot 'manifest.json') -Algorithm SHA256).Hash.ToLowerInvariant();$tx.readyEvidence.manifestSha256=$manifest;$tx.installedBinding=New-CcodUninstallBootstrapTestInstalledBinding -TransactionId $id -RuntimeRoot $fixture.RuntimeRoot -InstallRoot $install -UserSid $identity.userSid -SessionId $identity.sessionId -TransactionDirectory $directory -RuntimeManifestSha256 $manifest;Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory $directory -Transaction $tx
         $payload=Join-Path $directory 'payload';[IO.Directory]::CreateDirectory((Join-Path $payload 'src\persistence'))|Out-Null;[IO.File]::Copy($bootstrapScript,(Join-Path $payload 'src\persistence\UninstallBootstrap.ps1'),$true);$reclamationSource=Join-Path $repositoryRoot 'src\persistence\modules\GenerationReclamation.psm1';if(Test-Path -LiteralPath $reclamationSource -PathType Leaf){$reclamationDestination=Join-Path $payload 'src\persistence\modules\GenerationReclamation.psm1';[IO.Directory]::CreateDirectory((Split-Path $reclamationDestination -Parent))|Out-Null;[IO.File]::Copy($reclamationSource,$reclamationDestination,$true)}
-        $adapters=Get-CcodInstalledFinalizerAdapters -Adapters $null -TransactionRoot $transactionRoot -PayloadRoot $payload;$validate=$adapters.ValidateSelectedGeneration;$anchor=Join-Path $fixture.RuntimeRoot 'manifest.json'
-        $adapters.WaitWrapperExit={param($I,$T)[pscustomobject]@{verifiedAtStart=$true;exited=$true}};$adapters.ReadPreparedTransaction={param($Id,$Root)$tx}.GetNewClosure();$adapters.ReadCurrentEpoch={param($Root)[uint64]11};$adapters.ValidateSelectedGeneration={param($Root,$Install,$Transaction);$valid=&$validate $Root $Install $Transaction;if(-not$valid){return $false};switch($Mutation){'UnexpectedFile'{$attackState.Path=Join-Path $Root 'unexpected-after-validation.bin';[IO.File]::WriteAllText($attackState.Path,'hostile',[Text.UTF8Encoding]::new($false))}'UnexpectedDirectory'{$attackState.Path=Join-Path $Root 'unexpected-empty-directory';[IO.Directory]::CreateDirectory($attackState.Path)|Out-Null}'Reparse'{$attackState.Path=Join-Path $Root 'unexpected-reparse';New-Item -ItemType Junction -Path $attackState.Path -Target $outside|Out-Null}'Hardlink'{$attackState.Path=Join-Path $Root 'unexpected-hardlink.bin';New-Item -ItemType HardLink -Path $attackState.Path -Target $outsideSentinel|Out-Null}'Ads'{$attackState.Path=$anchor;$attributes=[IO.File]::GetAttributes($anchor);[IO.File]::SetAttributes($anchor,[IO.FileAttributes]::Normal);try{Set-Content -LiteralPath $anchor -Stream 'ccod-evidence' -Value 'hostile' -NoNewline}finally{[IO.File]::SetAttributes($anchor,$attributes)}}'OpenChild'{$attackState.Path=$anchor;$attackState.OpenHandle=[IO.File]::Open($anchor,[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read)}};return $true}.GetNewClosure();$adapters.RemoveMatchedProductRegistration={param($T)};$adapters.FinalizeReceipt={param($T)[pscustomobject]@{phase='Completed'}}
+        $resume=[pscustomobject]@{Present=$false};$overrides=@{EnterAccountTransition={param($Sid)[pscustomobject]@{Held=$true}};ExitAccountTransition={param($Lease)$Lease.Held=$false};ValidateStagedPayload={param($T,$R)$true};WaitWrapperExit={param($I,$T)[pscustomobject]@{verifiedAtStart=$true;exited=$true}};ReadPreparedTransaction={param($Id,$Root)$tx}.GetNewClosure();ReadCurrentEpoch={param($Root)[uint64]11};InstallResumeProductRegistration={param($T)$resume.Present=$true}.GetNewClosure();GetResumeProductRegistrationState={param($T)if($resume.Present){'Exact'}else{'Absent'}}.GetNewClosure();RemoveMatchedProductShortcuts={param($T)};FinalizeReceipt={param($T)$T.phase='Completed';$T.resumePhase='Completed';$T}.GetNewClosure();TestCompletedReceipt={param($T)$true};RemoveResumeProductRegistration={param($T)$resume.Present=$false;$true}.GetNewClosure()};$adapters=Get-CcodInstalledFinalizerAdapters -Adapters $overrides -TransactionRoot $transactionRoot -PayloadRoot $payload -RuntimeRoot $fixture.RuntimeRoot -InstallRoot $install;$validate=$adapters.ValidateSelectedGeneration;$anchor=Join-Path $fixture.RuntimeRoot 'manifest.json'
+        $adapters.ValidateSelectedGeneration={param($Root,$Install,$Transaction);$valid=&$validate $Root $Install $Transaction;if(-not$valid){return $false};switch($Mutation){'UnexpectedFile'{$attackState.Path=Join-Path $Root 'unexpected-after-validation.bin';[IO.File]::WriteAllText($attackState.Path,'hostile',[Text.UTF8Encoding]::new($false))}'UnexpectedDirectory'{$attackState.Path=Join-Path $Root 'unexpected-empty-directory';[IO.Directory]::CreateDirectory($attackState.Path)|Out-Null}'Reparse'{$attackState.Path=Join-Path $Root 'unexpected-reparse';New-Item -ItemType Junction -Path $attackState.Path -Target $outside|Out-Null}'Hardlink'{$attackState.Path=Join-Path $Root 'unexpected-hardlink.bin';New-Item -ItemType HardLink -Path $attackState.Path -Target $outsideSentinel|Out-Null}'Ads'{$attackState.Path=$anchor;$attributes=[IO.File]::GetAttributes($anchor);[IO.File]::SetAttributes($anchor,[IO.FileAttributes]::Normal);try{Set-Content -LiteralPath $anchor -Stream 'ccod-evidence' -Value 'hostile' -NoNewline}finally{[IO.File]::SetAttributes($anchor,$attributes)}}'OpenChild'{$attackState.Path=$anchor;$attackState.OpenHandle=[IO.File]::Open($anchor,[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read)}};return $true}.GetNewClosure()
         $failure=$null;try{Invoke-CcodInstalledUninstallFinalizer -TransactionId $id -RuntimeRoot $fixture.RuntimeRoot -InstallRoot $install -WrapperIdentity ([pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=$identity.sessionId;userSid=$identity.userSid}) -Adapters $adapters|Out-Null}catch{$failure=$_}
         $treeComplete=(Test-Path -LiteralPath $fixture.RuntimeRoot -PathType Container);if($treeComplete){foreach($directoryPath in $originalDirectories){if(-not(Test-Path -LiteralPath $directoryPath -PathType Container)){$treeComplete=$false;break}}};if($treeComplete){foreach($fileProof in $originalFiles){if(-not(Test-Path -LiteralPath $fileProof.Path -PathType Leaf)-or[int64](Get-Item -LiteralPath $fileProof.Path -Force).Length-ne$fileProof.Length-or(Get-CcodTestFileSha256 $fileProof.Path)-cne$fileProof.Sha256){$treeComplete=$false;break}}}
         if($null-eq$failure-or-not$treeComplete){throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new("pathname reclamation accepted or partially deleted the $Mutation tree"),'CCOD_RECLAMATION_RED_PATHNAME_DELETE',[Management.Automation.ErrorCategory]::InvalidData,$fixture.RuntimeRoot)}
@@ -730,14 +863,13 @@ if([string]::IsNullOrWhiteSpace($env:CCOD_RECLAMATION_RED_CASE)-or$env:CCOD_RECL
             Assert-CcodTrue (Test-Path -LiteralPath $fixture.RuntimeRoot -PathType Container) 'CommitStarted failure retains a selected-root failure boundary';Assert-CcodEqual $outsideHash (Get-CcodTestFileSha256 $outsideFile) 'CommitStarted failure preserves outside';Assert-CcodEqual $siblingHash (Get-CcodTestFileSha256 $siblingFile) 'CommitStarted failure preserves sibling';Assert-CcodEqual $deviceKeyHash (Get-CcodTestFileSha256 $deviceKey) 'CommitStarted failure preserves lifecycle/device-key state';Assert-CcodTrue (Test-Path -LiteralPath $install -PathType Container) 'CommitStarted failure preserves install root'
         }finally{if(Test-Path -LiteralPath $local){Remove-Item -LiteralPath $local -Recurse -Force}}
 
-        $calls=[Collections.Generic.List[string]]::new();$tx=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$tx.installedBinding=[pscustomobject][ordered]@{selectedRuntimeRoot='C:\install\runtime\2.5.0-uninstall-test';runtimeManifestSha256=('a'*64);wrapperPid=42;wrapperCreationTimeUtc='2030-02-03T03:04:05.0000000Z';wrapperSessionId=1;wrapperUserSid='S-1-5-21-111-222-333-1001'}
-        $adapters=@{WaitWrapperExit={param($I,$T)[pscustomobject]@{verifiedAtStart=$true;exited=$true}};ReadPreparedTransaction={param($Id,$Root)$tx}.GetNewClosure();ValidateSelectedGeneration={param($Runtime,$Install,$Transaction)$true};ReadCurrentEpoch={param($Root)[uint64]11};RemoveSelectedGeneration={param($Runtime,$Transaction)$calls.Add('Remove');throw [Management.Automation.ErrorRecord]::new([IO.IOException]::new('commit failed'),'CCOD_GENERATION_RECLAMATION_COMMIT_FAILED',[Management.Automation.ErrorCategory]::WriteError,$Runtime)}.GetNewClosure();TestSelectedRootAbsent={param($Root)$calls.Add('Absent');$false}.GetNewClosure();RemoveMatchedProductRegistration={param($Transaction)$calls.Add('Product')}.GetNewClosure();FinalizeReceipt={param($Transaction)$calls.Add('Finalize');[pscustomobject]@{phase='Completed'}}.GetNewClosure()}
-        Assert-CcodThrows {Invoke-CcodInstalledUninstallFinalizer -TransactionId $tx.transactionId -RuntimeRoot $tx.installedBinding.selectedRuntimeRoot -InstallRoot 'C:\install' -WrapperIdentity ([pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=1;userSid='S-1-5-21-111-222-333-1001'}) -Adapters $adapters|Out-Null} 'CCOD_GENERATION_RECLAMATION_COMMIT_FAILED';Assert-CcodEqual 'Remove' ($calls-join',') 'CommitStarted failure reaches no absence proof product removal or completion receipt'
+        $tx=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$tx.installedBinding=New-CcodUninstallBootstrapTestInstalledBinding;$world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=$tx;RootPresent=$true;PublicEntry=$false;PublicCommand=$null;ShortcutsPresent=$true;CompletedReceipt=$false;Failure=$null;FailureInjected=$false;EntryPresentAtReclaim=$false};$adapters=New-CcodInstalledFinalizerMemoryAdapters $world;$adapters.ReclaimSelectedGeneration={param($Runtime,$Transaction)$world.Calls.Add('Reclaim');throw [Management.Automation.ErrorRecord]::new([IO.IOException]::new('commit failed'),'CCOD_GENERATION_RECLAMATION_COMMIT_FAILED',[Management.Automation.ErrorCategory]::WriteError,$Runtime)}.GetNewClosure()
+        Assert-CcodThrows {Invoke-CcodInstalledUninstallFinalizer -TransactionId $tx.transactionId -RuntimeRoot $tx.installedBinding.selectedRuntimeRoot -InstallRoot 'C:\install' -WrapperIdentity ([pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=1;userSid='S-1-5-21-111-222-333-1001'}) -Adapters $adapters|Out-Null} 'CCOD_GENERATION_RECLAMATION_COMMIT_FAILED';Assert-CcodEqual 0 @($world.Calls|Where-Object{$_-in@('Write:ReadyForInno','ProductShortcuts','FinalizeReceipt','RemoveRegistry')}).Count 'CommitStarted failure reaches no phase write product removal or completion receipt'
     }
 }
 
 function Invoke-CcodDefaultInstalledFinalizerNegative {
-    param([Parameter(Mandatory)][ValidateSet('Sibling','WrongPath','StaleEpoch','WrapperIdentity','WrongReadyRoot','ExtraReadyField')][string]$Mutation)
+    param([Parameter(Mandatory)][ValidateSet('Sibling','WrongPath','StaleEpoch','WrapperIdentity','WrongReadyRoot','ExtraReadyField','PayloadHash')][string]$Mutation)
     $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-finalizer-negative-'+[guid]::NewGuid().ToString('N'));$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process');$wrapper=$null
     try{
         [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$install=Join-Path $local 'CodexControlOtherDevices';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$selected=$fixture.RuntimeRoot;$runtime=$selected
@@ -745,19 +877,20 @@ function Invoke-CcodDefaultInstalledFinalizerNegative {
         elseif($Mutation-ceq'WrongPath'){$runtime=Join-Path $selected 'nested-wrong-runtime'}
         $identity=Get-CcodUninstallBootstrapCurrentIdentity;$id=[guid]::NewGuid().ToString('D');$transactionRoot=Get-CcodUninstallBootstrapDefaultTransactionRoot;$directory=New-CcodUninstallBootstrapTransactionDirectory -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid
         $wrapper=Start-Process -FilePath 'powershell.exe' -ArgumentList @('-NoProfile','-Command','Start-Sleep -Milliseconds 1400') -WindowStyle Hidden -PassThru;$wrapperCreation=$wrapper.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)
-        $tx=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$tx.transactionId=$id;$tx.runtimeId=[IO.Path]::GetFileName($runtime);$tx.runtimeGeneration=[uint64]7;$tx.leaseEpoch=if($Mutation-ceq'StaleEpoch'){[uint64]12}else{[uint64]11};$tx.userSid=$identity.userSid;$tx.sessionId=$identity.sessionId;$tx.readyEvidence.installRoot=$install;$tx.readyEvidence.runtimeId=$tx.runtimeId;$tx.readyEvidence.runtimeGeneration=[uint64]7;$manifest=(Get-FileHash (Join-Path $selected 'manifest.json') -Algorithm SHA256).Hash.ToLowerInvariant();$tx.readyEvidence.manifestSha256=$manifest;$tx.installedBinding=[pscustomobject][ordered]@{selectedRuntimeRoot=$runtime;runtimeManifestSha256=$manifest;wrapperPid=[int]$wrapper.Id;wrapperCreationTimeUtc=$wrapperCreation;wrapperSessionId=$identity.sessionId;wrapperUserSid=$identity.userSid}
+        $payload=Join-Path $directory 'payload';$recordMap=@{};foreach($relative in $script:CcodUninstallPayloadEntries){$source=Join-Path $selected $relative.Replace('/','\');$destination=Join-Path $payload $relative.Replace('/','\');[IO.Directory]::CreateDirectory((Split-Path $destination -Parent))|Out-Null;[IO.File]::Copy($source,$destination,$true);$recordMap[$relative]=Get-CcodUninstallBootstrapFileFingerprint $source};$payloadRecords=New-CcodUninstallBootstrapPayloadRecords -RecordMap $recordMap
+        $tx=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$tx.transactionId=$id;$tx.runtimeId=[IO.Path]::GetFileName($runtime);$tx.runtimeGeneration=[uint64]7;$tx.leaseEpoch=if($Mutation-ceq'StaleEpoch'){[uint64]12}else{[uint64]11};$tx.userSid=$identity.userSid;$tx.sessionId=$identity.sessionId;$tx.readyEvidence.installRoot=$install;$tx.readyEvidence.runtimeId=$tx.runtimeId;$tx.readyEvidence.runtimeGeneration=[uint64]7;$manifest=(Get-FileHash (Join-Path $selected 'manifest.json') -Algorithm SHA256).Hash.ToLowerInvariant();$tx.readyEvidence.manifestSha256=$manifest;$tx.installedBinding=New-CcodUninstallBootstrapTestInstalledBinding -TransactionId $id -RuntimeRoot $runtime -InstallRoot $install -UserSid $identity.userSid -SessionId $identity.sessionId -WrapperPid $wrapper.Id -WrapperCreationTimeUtc $wrapperCreation -PayloadRecords $payloadRecords -TransactionDirectory $directory -RuntimeManifestSha256 $manifest
         Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory $directory -Transaction $tx;Publish-CcodUninstallBootstrapCurrentTransaction -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid
         if($Mutation-ceq'WrongReadyRoot'){$tx.readyEvidence.installRoot=Join-Path $local 'unrelated-root';[IO.File]::WriteAllText((Join-Path $directory 'transaction.json'),($tx|ConvertTo-Json -Depth 12 -Compress),[Text.UTF8Encoding]::new($false))}
         elseif($Mutation-ceq'ExtraReadyField'){$tx.readyEvidence|Add-Member -NotePropertyName unexpectedReadyField -NotePropertyValue 'reject';[IO.File]::WriteAllText((Join-Path $directory 'transaction.json'),($tx|ConvertTo-Json -Depth 12 -Compress),[Text.UTF8Encoding]::new($false))}
-        $payload=Join-Path $directory 'payload';foreach($relative in @('src\persistence\InstalledUninstallFinalizer.ps1','src\persistence\UninstallBootstrap.ps1')){$destination=Join-Path $payload $relative;[IO.Directory]::CreateDirectory((Split-Path $destination -Parent))|Out-Null;[IO.File]::Copy((Join-Path $selected $relative),$destination,$true)}
+        elseif($Mutation-ceq'PayloadHash'){[IO.File]::AppendAllText((Join-Path $payload 'src\persistence\modules\ProductRegistration.psm1'),'# changed after staging',[Text.UTF8Encoding]::new($false))}
         $creationArgument=if($Mutation-ceq'WrapperIdentity'){'2001-02-03T04:05:06.0000000Z'}else{$wrapperCreation};$previousPreference=$ErrorActionPreference;try{$ErrorActionPreference='Continue';$output=& powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $payload 'src\persistence\InstalledUninstallFinalizer.ps1') -TransactionId $id -RuntimeRoot $runtime -InstallRoot $install -WrapperProcessId $wrapper.Id -WrapperCreationTimeUtc $creationArgument 2>&1;$exit=$LASTEXITCODE}finally{$ErrorActionPreference=$previousPreference}
         if($exit-ne3){throw("FINALIZER_DIAGNOSTIC mutation={0} exit={1} output={2}"-f$Mutation,$exit,(@($output)-join' | '))};Assert-CcodEqual 3 $exit "$Mutation default child rejects before finalization";Assert-CcodTrue (Test-Path -LiteralPath $selected -PathType Container) "$Mutation preserves the selected generation";Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $install 'state') -PathType Container) "$Mutation preserves sibling/root state"
-        if($Mutation-notin@('WrongPath','WrapperIdentity')){$wrapper.Refresh();Assert-CcodTrue $wrapper.HasExited "$Mutation reaches the default wrapper wait before its later negative boundary"}
+        if($Mutation-ceq'Sibling'){$wrapper.Refresh();Assert-CcodTrue $wrapper.HasExited 'Sibling reaches the default wrapper wait before its generation mismatch boundary'}
     }finally{if($null-ne$wrapper){try{if(-not$wrapper.HasExited){$wrapper.Kill();$wrapper.WaitForExit()}}catch{};$wrapper.Dispose()};[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path -LiteralPath $local){Remove-Item -LiteralPath $local -Recurse -Force}}
 }
 
 $results += Invoke-CcodTest 'default staged installed finalizer child rejects the full negative authorization matrix without deletion' {
-    foreach($mutation in @('Sibling','WrongPath','StaleEpoch','WrapperIdentity','WrongReadyRoot','ExtraReadyField')){Invoke-CcodDefaultInstalledFinalizerNegative -Mutation $mutation}
+    foreach($mutation in @('Sibling','WrongPath','StaleEpoch','WrapperIdentity','WrongReadyRoot','ExtraReadyField','PayloadHash')){Invoke-CcodDefaultInstalledFinalizerNegative -Mutation $mutation}
 }
 
 $results | ForEach-Object { "PASS $($_.Name)" }

From ea864519a327102aa5407a6d3cb1447095dc4394 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 05:49:03 +0800
Subject: [PATCH 135/187] docs: record legacy final fix evidence

---
 .../final-fix-report.md                       | 153 ++++++++++++++++++
 .../progress.md                               |  44 +++++
 2 files changed, 197 insertions(+)
 create mode 100644 .superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/final-fix-report.md
 create mode 100644 .superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/progress.md

diff --git a/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/final-fix-report.md b/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/final-fix-report.md
new file mode 100644
index 0000000..d56da5e
--- /dev/null
+++ b/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/final-fix-report.md
@@ -0,0 +1,153 @@
+# Final fix wave report — legacy proof ordering and reclamation tail recovery
+
+## 结论与范围
+
+本计划唯一一次 final-review fix wave 已实现，implementation commit 为
+`58db6fd`（`fix: close legacy upgrade recovery gaps`），基线为 `6b9bc7e`。
+本轮只修改 5 个 production PowerShell 文件和 3 个 self-test 文件；没有执行真实
+registry、shortcut、scheduled task、安装、卸载、进程重启、系统重启、网络、push、tag、
+release 或发布操作。
+
+本报告只声明 final-fix implementation 与本地验证结果。独立 scoped re-review 仍是单独
+gate；原 release plan Tasks 5–8 仍保持 blocked，本报告不作 release-readiness 声明。
+
+## Finding 1：selector commit 成功但 PointerCommitted journal 丢失
+
+### RED
+
+新增真实 legacy migration 失败点：generation-two selector 通过真实
+`Set-CcodActiveRuntime` commit/read-back 后、`PointerCommitted` snapshot append 前抛错。
+第一次尝试留下 canonical `1 old -> 2 failed-new -> 3 old` selector，transaction 中有
+`RuntimePromoted`、无 `PointerCommitted`，terminal head 为 `Failed`。第二次同包调用的实际
+RED 为：
+
+```text
+InstallLifecycle.SelfTest.ps1 -> exit 1
+case=real-v2.5.21-selector-commit-with-a-missing-PointerCommitted-journal-resumes-the-exact-retained-runtime
+error=CCOD_INSTALL_UPGRADE_SOURCE_INVALID
+Failed migration phases do not match the exact selector profile
+```
+
+### GREEN
+
+`PostPointerCompensated` 现在可由 exact three-record selector compensation 与同一 immutable
+transaction identity / `RuntimePromoted` proof 分类，不再把 journal snapshot 当作唯一 pointer
+commit proof。普通 pre-pointer 或任意 `RuntimePromoted -> Failed` 链仍不能进入该分支；selector、
+transaction、manifest、package 或 foreign-chain 变异继续在新 mutation 前失败。重试复用同一
+generation-two runtime，并只追加 generation-four Ready。
+
+## Finding 2：current overlap write 洗掉 legacy profile 缺陷
+
+### RED
+
+production-shaped lifecycle fixture 模拟 current shortcut write 会补齐 missing overlap 并替换
+foreign same-name leaf。未修复顺序在 `MissingMain` 首个 zero-write 断言的实际结果为：
+
+```text
+InstallLifecycle.SelfTest.ps1 -> exit 1
+case=legacy-profile-is-captured-before-any-current-product-or-shortcut-write
+ASSERT_EQUAL: MissingMain is rejected before the current registry write expected=[0] actual=[1]
+```
+
+同一 table 同时覆盖 missing Desktop 与 foreign main target/arguments/working-directory。
+
+### GREEN
+
+新增 mandatory pre-registration migration plan。它在任何 current registry/shortcut write 前：
+
+- 解析一个完整 checked-in historical profile；
+- 绑定 AppId、DisplayVersion、InstallLocation 与 quoted Inno uninstall command；
+- 捕获 registry values/kinds 和每个 shortcut 的 canonical path、bytes、SHA-256；
+- 按对应历史版本校验 target、arguments 与 working directory。
+
+current registration read-back 后，cleanup 只消费此前 captured plan；overlap 只在 exact current
+proof 下保留，legacy-only entry 删除前逐项 unchanged re-read，删除后再次验证同一 current proof。
+registry compensation 继续使用 same-handle / create-only、replacement-safe 路径。missing main、
+missing Desktop 和 foreign same-name 三项均在 current writes 为 0 时失败。
+
+## Finding 3：irreversible generation reclamation 后的尾段不可恢复
+
+### RED
+
+四个 post-reclaim failure injection 均先成功使 selected generation absent，再执行第二次调用。
+未修复实现的实际结果为：
+
+```text
+PhaseWrite      -> CCOD_INSTALLED_FINALIZER_INVALID, phase=TaskRemoved
+ProductShortcuts -> CCOD_INSTALLED_FINALIZER_INVALID, phase=ReadyForInno
+FinalReceipt    -> CCOD_INSTALLED_FINALIZER_INVALID, phase=ReadyForInno
+FinalRegistry   -> CCOD_INSTALLED_FINALIZER_INVALID, phase=Completed
+```
+
+### GREEN
+
+`PrepareInstalled` 现在把完整 staged payload record set、transaction/user、selected runtime /
+manifest / epoch、historical wrapper、resume script path/length/SHA-256 和 exact resume command
+写入 external transaction。generation reclaim 前，product `UninstallString` 先切到 staged
+`InstalledUninstallFinalizer.ps1 -Resume`，随后写完整 recovery metadata 并 exact read-back；
+old/new partial registry publish 可收敛，foreign mixed state 拒绝。
+
+finalizer 顺序为：
+
+1. preload 验证 current locator、transaction ACL/no-reparse、duplicate-free JSON 与完整 17-file
+   staged payload length/SHA；
+2. 依既有顺序取得 Local uninstall lock，再取得 Global `AccountTransition`，锁内重读 transaction；
+3. 验证 caller SID、fixed InstallRoot、derived RuntimeRoot、Ready/manifest/epoch 与 exact command；
+4. initial 或 replacement runtime wrapper 必须等待其 exact PID/creation/session/SID 退出；public
+   staged `-Resume` 不复用旧 caller identity，但在 tree 仍存在时会证明 latest bound wrapper 已退出；
+5. `TaskRemoved + present` 重新验证并 reclaim；`TaskRemoved + absent` 只有 exact write-ahead recovery
+   anchor 才可推进；随后 durable `ReadyForInno`；
+6. absent-or-exact 地清理 shortcuts，保持 Apps recovery registry；
+7. 写并重读 `Completed` transaction 和 exact `Completed` receipt；transaction 已 Completed 而
+   receipt 丢失时只补 receipt；
+8. 最后通过 exact open registry handle 删除完整 recovery key，不先逐 value 删除。此后没有必需
+   的 fallible write。已收敛的 serial replay 在 receipt exact 且 anchor absent 时为 no-op。
+
+额外预审修复包括：existing `TaskRemoved` replacement `PrepareInstalled` 直接返回，不再重入
+application cleanup；replacement wrapper identity 单独持久化且不改写 historical identity；同 SID
+新登录 session 可恢复；epoch 在 reclaim 紧邻边界二次读取；Bootstrap 与 finalizer 均保持
+Local -> Global lock acquisition order，避免 ABBA。
+
+## 最终验证
+
+最终源码冻结后运行：
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ProductRegistration.SelfTest.ps1
+  Product registration self-tests passed: 24; exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+  Install lifecycle self-tests passed: 150; exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\UninstallBootstrap.SelfTest.ps1
+  Uninstall bootstrap self-tests passed: 37; exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1
+  37 declared cases passed; exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\RuntimeManifest.SelfTest.ps1
+  21/21; exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstalledLifecycleHarness.SelfTest.ps1
+  21/21; exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ManualWrappers.SelfTest.ps1
+  pass; exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\Bootstrap.SelfTest.ps1
+  26/26; exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\PersistenceSelfTest.ps1
+  exit 0; successful aggregate intentionally emits no stdout summary
+```
+
+此外，8 个修改的 PowerShell 文件经 parser 检查均为 `0 errors`；`git diff --check` exit 0，
+只有 checkout LF/CRLF conversion warning。测试只使用 GUID temp roots、内存 adapters、受控
+child PowerShell 与 disposable registry doubles；未触碰真实 product/shortcut/task/install state。
+
+## Review gate
+
+请求以 `6b9bc7e..58db6fd` 为 implementation review range 做一次 scoped re-review，重点核对三项
+原 Important、replacement-wrapper/AccountTransition 预审修复、完整 staged payload binding，
+以及 Apps registry-last / Completed-receipt repair 顺序。该 review 未通过前不进入下一 wave 或
+release claim。
diff --git a/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/progress.md b/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/progress.md
new file mode 100644
index 0000000..e6c02f2
--- /dev/null
+++ b/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/progress.md
@@ -0,0 +1,44 @@
+# SDD ledger — plan: docs/superpowers/plans/2026-09-02-v2522-legacy-upgrade-safe-reclamation.md
+
+## Preflight interface scan
+
+| Producer task | Consumer task | Shared interface | Finding | Ruling |
+|---|---|---|---|---|
+| Task 1 | Task 2 | True v2.5.21 active.json/no-transaction fixture | Product migration tests must consume the real legacy shape, not a current-format Ready disguised as old. | Ruling: Task 1 fixture is the source of truth for Task 2 integration. Cost if wrong: old installations pass tests but fail before staging or at registration. |
+| Task 1 | Task 1 | Durable cleanup resolver | A real legacy version cannot have a cleanup fence or Ready transaction. | Ruling: skip resolver only after proving every append-only/fence plane absent and exact legacy active runtime valid; mixed state fails closed. Cost if wrong: malformed current installs bypass cleanup. |
+| Task 2 | Task 2 | Historical shortcut profiles | Requiring the union of every historical name is impossible. | Ruling: match one exact checked-in installer profile and dynamic snapshot count. Cost if wrong: legitimate v2.5.21 upgrades never converge or foreign shortcuts are deleted. |
+| Task 3 | Task 3 | Installed finalizer reclamation | Path validation before recursive Remove-Item is not bound to deletion. | Ruling: hold exact native handles for the complete manifest tree and delete bottom-up by handle only. Cost if wrong: concurrent path changes can redirect or invalidate deletion. |
+
+## Status
+
+Task 1: in progress. Broad whole-branch review found one Critical true-legacy upgrade blocker and two independent Important production defects.
+
+Task 1 fix round 1 Ruling: support two exact append-only retry profiles. A pre-pointer failure has latest selector generation 1 on the legacy runtime and may converge by appending generation 2 to the retained new runtime. A post-pointer compensated failure has canonical `1 old -> 2 new -> 3 old` and may converge only by appending generation 4 back to the same retained new runtime. Never delete or rewrite selector history. Cost if wrong: a transient post-pointer failure either becomes unrecoverable or corrupts the monotonic selector chain.
+
+Task 1: fix round 1/5 (1 addressed, 0 open; legacy migration retry after pre/post pointer failure; commits 812b34e..4504c1a).
+
+Task 1: complete (commits 2aef5ff..4504c1a, scoped re-review clean: Spec Compliance PASS, Task Quality PASS).
+
+Task 2: in progress. Consumes Task 1 true v2.5.21 fixture and replaces the impossible union-of-history shortcut requirement with exact installer profiles.
+
+Task 2: fix round 1/5 (1 addressed, 0 open; registry compensation replacement overwrite; commits be47fad..3682b81).
+
+Task 2: complete (commits 4504c1a..3682b81, scoped re-review clean: Spec Compliance PASS, Task Quality PASS).
+
+Task 3: in progress. Replace pathname recursive generation deletion with manifest-complete, handle-pinned native reclamation.
+
+Task 3 Ruling: Windows rejects delete disposition on a nonempty directory even when every child is already pinned/armed. Use a two-phase protocol: fully pin/revalidate the exact tree; arm every file while reversible and disarm all on any file-mark failure; only after all file marks succeed enter the irreversible commit, close files, then mark/close directories deepest-first and the selected root last. Cost if wrong: a post-commit filesystem failure can leave a partially reclaimed selected tree, but all affected identities remain inside the fully pinned selected generation and no sibling/outside path can be reached.
+
+Task 1: fix round 1/5 (1 addressed, 0 open; exact pre/post pointer legacy migration retry; commits 812b34e..4504c1a).
+
+Task 1: complete (commits 2aef5ff..4504c1a, scoped re-review clean: Spec Compliance PASS, Task Quality PASS).
+
+Task 2: fix round 1/5 (1 addressed, 0 open; registry replacement-safe compensation; commits be47fad..3682b81).
+
+Task 2: complete (commits 4504c1a..3682b81, scoped re-review clean: Spec Compliance PASS, Task Quality PASS).
+
+Task 3: complete (commits 3682b81..6b9bc7e, task review clean: Spec Compliance PASS, Task Quality PASS).
+
+Final whole-plan review: FAIL (0 Critical, 3 Important): compensated selector may lack PointerCommitted journal evidence; legacy overlap proof occurs after current overwrite; irreversible reclamation has no durable tail resume. One final fix wave permitted.
+
+Final fix wave: implementation complete at `58db6fd` (3 original Important addressed in one wave). Final frozen verification: ProductRegistration 24, InstallLifecycle 150, UninstallBootstrap 37, InstallFileTransaction 37, RuntimeManifest 21, InstalledLifecycleHarness 21, Bootstrap 26, ManualWrappers pass; all modified PowerShell parsers 0 errors; `git diff --check` and full `tests\PersistenceSelfTest.ps1` exit 0. Scoped re-review of `6b9bc7e..58db6fd` remains pending; Tasks 5–8 and release readiness remain blocked.

From a5ffe4ae56d8142c38570a0cbc156c2b507042b9 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 06:00:57 +0800
Subject: [PATCH 136/187] docs: plan cross-process retry closure

---
 .../progress.md                               |  4 +-
 .../implementation-brief.md                   | 10 +++++
 .../progress.md                               | 24 +++++++++++
 ...09-03-v2522-cross-process-retry-closure.md | 42 +++++++++++++++++++
 4 files changed, 79 insertions(+), 1 deletion(-)
 create mode 100644 .superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/implementation-brief.md
 create mode 100644 .superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
 create mode 100644 docs/superpowers/plans/2026-09-03-v2522-cross-process-retry-closure.md

diff --git a/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/progress.md b/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/progress.md
index e6c02f2..6ca9578 100644
--- a/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/progress.md
+++ b/.superpowers/sdd/2026-09-02-v2522-legacy-upgrade-safe-reclamation/progress.md
@@ -41,4 +41,6 @@ Task 3: complete (commits 3682b81..6b9bc7e, task review clean: Spec Compliance P
 
 Final whole-plan review: FAIL (0 Critical, 3 Important): compensated selector may lack PointerCommitted journal evidence; legacy overlap proof occurs after current overwrite; irreversible reclamation has no durable tail resume. One final fix wave permitted.
 
-Final fix wave: implementation complete at `58db6fd` (3 original Important addressed in one wave). Final frozen verification: ProductRegistration 24, InstallLifecycle 150, UninstallBootstrap 37, InstallFileTransaction 37, RuntimeManifest 21, InstalledLifecycleHarness 21, Bootstrap 26, ManualWrappers pass; all modified PowerShell parsers 0 errors; `git diff --check` and full `tests\PersistenceSelfTest.ps1` exit 0. Scoped re-review of `6b9bc7e..58db6fd` remains pending; Tasks 5–8 and release readiness remain blocked.
+Final fix wave: implementation complete at `58db6fd` (3 original Important addressed in one wave). Final frozen verification: ProductRegistration 24, InstallLifecycle 150, UninstallBootstrap 37, InstallFileTransaction 37, RuntimeManifest 21, InstalledLifecycleHarness 21, Bootstrap 26, ManualWrappers pass; all modified PowerShell parsers 0 errors; `git diff --check` and full `tests\PersistenceSelfTest.ps1` exit 0.
+
+Final scoped re-review of `6b9bc7e..58db6fd`: **FAIL** (1 Critical, 1 Important). The original three findings and the staged-resume/AccountTransition fixes were addressed, but two independent cross-invocation gaps remain: a same-SID new-session replacement `PrepareInstalled` is rejected by the generic session comparison before it can publish `resumeWrapper*`; and the legacy pre-capture plan is memory-only, so a crash after a current overlap write prevents the next process from reconstructing the historical proof. Per the one-review/one-fix-wave ruling, this plan is closed as failed rather than receiving a second fix wave. Successor plan: `docs/superpowers/plans/2026-09-03-v2522-cross-process-retry-closure.md`. Tasks 5–8 and release readiness remain blocked.
diff --git a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/implementation-brief.md b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/implementation-brief.md
new file mode 100644
index 0000000..49c07c9
--- /dev/null
+++ b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/implementation-brief.md
@@ -0,0 +1,10 @@
+# Implementation brief — cross-process retry closure
+
+Read the successor plan, the prior `final-fix-report.md`, and the final scoped review result supplied by the parent agent.
+
+Implement exactly two tasks in order with RED -> GREEN:
+
+1. Same-SID/new-session `TaskRemoved` replacement wrapper recovery before the staged Apps anchor exists. The generic session matcher must remain strict elsewhere. Revalidate under Local uninstall -> Global AccountTransition, persist only `resumeWrapper*`, short-circuit cleanup, and prove `-WrapperResume` waits for the exact new wrapper.
+2. A create-only Ready-bound durable legacy migration plan written before current product writes. A second process must recover after each overlap/current-readback failure without accepting a washed live profile when no exact prior plan exists.
+
+Do not perform any real system or external action. Do not run tests concurrently with another implementation agent. After each task, run its focused suites. After both tasks, freeze source and run the complete final gate from the plan. Commit implementation and evidence separately; report exact SHAs, commands, counts, exits, parser/diff/aggregate results, and a clean status. Do not claim release readiness.
diff --git a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
new file mode 100644
index 0000000..7a28a2b
--- /dev/null
+++ b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
@@ -0,0 +1,24 @@
+# SDD ledger — cross-process retry closure
+
+Plan: `docs/superpowers/plans/2026-09-03-v2522-cross-process-retry-closure.md`
+
+## Review provenance
+
+- Prior implementation: `58db6fd`; evidence: `ea86451`.
+- Prior plan's only final scoped review: FAIL, 1 Critical + 1 Important.
+- Critical: generic context matching rejects same-SID new-session `TaskRemoved` before replacement-wrapper persistence.
+- Important: legacy pre-capture plan is memory-only and cannot survive a partial current overlap write.
+
+## Rulings
+
+- Session relaxation is allowed only for exact installed `TaskRemoved`/`Failed(resumePhase=TaskRemoved)` after locked fresh proof. Cost if wrong: a foreign or stale runtime can adopt an uninstall transaction.
+- A live current/historical hybrid is never authority by itself. It is acceptable only when a previously create-only durable plan proves the original complete historical layout and the current leaf matches the same Ready/package. Cost if wrong: the original wash-before-proof defect returns.
+- The durable plan is append-only audit state; it is not deleted on success and never contains device-key material.
+
+## Status
+
+Task 1: pending.
+
+Task 2: pending.
+
+Final gate and fresh scoped review: pending. Tasks 5–8 remain blocked.
diff --git a/docs/superpowers/plans/2026-09-03-v2522-cross-process-retry-closure.md b/docs/superpowers/plans/2026-09-03-v2522-cross-process-retry-closure.md
new file mode 100644
index 0000000..26e93dd
--- /dev/null
+++ b/docs/superpowers/plans/2026-09-03-v2522-cross-process-retry-closure.md
@@ -0,0 +1,42 @@
+# v2.5.22 Cross-Process Retry Closure Plan
+
+> **For agentic workers:** Use `superpowers:subagent-driven-development` and `superpowers:test-driven-development`. This is a successor to the failed final scoped review of `6b9bc7e..58db6fd`; it is not a second fix wave of the prior plan.
+
+**Goal:** Make the two remaining public retry boundaries converge after a new Windows logon session or a process crash: installed `TaskRemoved` recovery before the external anchor exists, and legacy product migration after one or both overlapping shortcuts have already been replaced.
+
+**Architecture:** The installed-uninstall path gets a narrowly scoped same-SID TaskRemoved matcher that revalidates the current runtime under the existing Local-to-Global lock order while preserving the historical session as evidence. Legacy migration gets a create-only, Ready-bound durable plan written before any current product write; later processes may consume that plan only when every immutable identity matches and each overlap is either the captured historical leaf or the exact current replacement.
+
+**Constraints:** Work only in the existing worktree. No real registry, shortcut, scheduled task, installer, installation, uninstall, process restart, reboot, network, push, tag, release, or publication. Keep device-key/DPAPI state untouched. Do not weaken ordinary fresh-context session matching or accept a live hybrid legacy profile without a previously durable exact plan.
+
+## Task 1 — Recover TaskRemoved from the same SID in a new session
+
+**Files:**
+
+- Modify: `src/persistence/UninstallBootstrap.ps1`
+- Modify only if the public command shape must change: `Uninstall-CodexControlOtherDevices.ps1`, `src/persistence/InstalledUninstallFinalizer.ps1`
+- Test: `tests/persistence/UninstallBootstrap.SelfTest.ps1`
+
+1. Add a production-shaped RED in which the durable transaction is session 1, `ValidateInvocation` returns the same SID in session 99, phase is exact `TaskRemoved`, no staged recovery registry exists yet, and the public runtime wrapper supplies an exact new identity. Current code must fail at the generic context matcher.
+2. Add a dedicated installed TaskRemoved matcher. It may ignore only the context session ID, and only after Local uninstall then Global `AccountTransition` acquisition and a fresh runtime/selector/Ready/manifest/epoch validation. Require the same SID, transaction ID, runtime ID, generation, epoch, Ready evidence, payload records, staged paths/hashes, and immutable installed binding. Preserve `transaction.sessionId` and historical `wrapper*`; write only exact `resumeWrapper*`, then persist/read back the transaction and receipt.
+3. Directly return the verified existing TaskRemoved transaction; never call `RunCleanup` again. Launch `-WrapperResume` with the new wrapper identity and require its exact exit before reclamation. Ordinary pre-TaskRemoved resume and different-SID/runtime/generation/epoch/Ready/payload cases remain rejected.
+4. Cover finalizer-start failure followed by a same-SID new-session second public invocation, plus session/PID/creation-time mutations. Run UninstallBootstrap and parser/diff checks.
+
+## Task 2 — Persist and replay the exact legacy migration plan
+
+**Files:**
+
+- Modify: `src/persistence/modules/ProductRegistration.psm1`
+- Modify: `src/persistence/modules/InstallLifecycle.psm1`
+- Modify if a private capability is required: `src/persistence/modules/InstallFileTransaction.psm1`
+- Test: `tests/persistence/ProductRegistration.SelfTest.ps1`
+- Test: `tests/persistence/InstallLifecycle.SelfTest.ps1`
+
+1. Add REDs that use production-shaped shortcut evidence. Persist no in-memory object across attempts. Fail after Start-menu replacement, after Desktop replacement, and after current read-back. A real second registration attempt must currently fail to recapture the historical profile.
+2. Before any current registry or shortcut write, publish a create-only durable migration-plan record through the product file transaction. Bind its canonical schema and leaf to the exact Ready transaction, runtime ID, generation, manifest SHA-256, package SHA-256, AppId, historical profile, registry values/kinds, and every shortcut path/bytes/hash/target/arguments/working directory. Bound sizes, duplicate-free JSON, safe ancestry, no reparse/ADS/multilink, exact ACL/owner, and create-only conflict semantics are mandatory.
+3. On a later process, an existing exact plan may be reused only after its full binding is re-read and verified. Legacy registry and legacy-only entries must remain exact. Each overlap must independently be either the captured historical leaf or the exact current replacement for this same Ready/package. Missing/foreign overlap without an existing exact plan remains a zero-current-write failure.
+4. Make current registration and legacy-only cleanup idempotently converge from historical/historical, current/historical, historical/current, and current/current overlap states. Preserve replacement-safe registry compensation and leave the durable plan append-only as audit evidence.
+5. Add negative tests for absent/tampered/wrong-Ready/wrong-package/wrong-generation/duplicate/unsafe plan records and foreign hybrid leaves. Run ProductRegistration, InstallLifecycle, IFT when touched, parser/diff, and the full aggregate.
+
+## Final gate
+
+Freeze source, run ProductRegistration, UninstallBootstrap, InstallLifecycle, InstallFileTransaction, RuntimeManifest, InstalledLifecycleHarness, Bootstrap, ManualWrappers, all changed parsers, `git diff --check`, and `tests\PersistenceSelfTest.ps1`. Commit implementation and evidence separately. Then request one fresh scoped review of this successor range. Tasks 5–8 remain blocked until that review is clean.

From 9973bfded641a0dc415cb48318e3968b80bb199c Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 06:13:21 +0800
Subject: [PATCH 137/187] fix: recover installed TaskRemoved across sessions

---
 src/persistence/UninstallBootstrap.ps1        | 62 +++++++++++--
 .../UninstallBootstrap.SelfTest.ps1           | 92 +++++++++++++++++--
 2 files changed, 138 insertions(+), 16 deletions(-)

diff --git a/src/persistence/UninstallBootstrap.ps1 b/src/persistence/UninstallBootstrap.ps1
index 28cb142..d5d4f1f 100644
--- a/src/persistence/UninstallBootstrap.ps1
+++ b/src/persistence/UninstallBootstrap.ps1
@@ -327,8 +327,8 @@ function New-CcodUninstallBootstrapResumeContext {
         [Parameter(Mandatory)]$Identity
     )
     Assert-CcodUninstallBootstrapTransaction $Transaction -ExpectedInstallRoot $InstallRoot
-    if ($Transaction.userSid -cne $Identity.userSid) {
-        Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISMATCH' 'The interrupted uninstall transaction does not match the current user' $Transaction
+    if ($Transaction.userSid -cne $Identity.userSid -or $Transaction.sessionId -ne $Identity.sessionId) {
+        Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISMATCH' 'The interrupted uninstall transaction does not match the current user and session' $Transaction
     }
     $resumePhase = if ($Transaction.phase -ceq 'Failed') { $Transaction.resumePhase } else { $Transaction.phase }
     if (@('TaskRemoved','ApplicationStateRemoved','ReadyForInno') -cnotcontains $resumePhase) {
@@ -824,6 +824,19 @@ function Assert-CcodUninstallBootstrapReadyEvidence {
     return $ReadyEvidence
 }
 
+function Read-CcodUninstallBootstrapStoredReceipt {
+    param([Parameter(Mandatory)][string]$TransactionDirectory)
+    $directory=Get-CcodUninstallBootstrapComparablePath -Path $TransactionDirectory -Kind 'Uninstall transaction directory';$path=Resolve-CcodUninstallBootstrapChildPath -Root $directory -RelativePath 'receipt.json' -RequireLeafFile;Read-CcodUninstallBootstrapJson -Path $path -Kind 'Uninstall receipt'
+}
+
+function Test-CcodUninstallBootstrapReceiptMatchesTransaction {
+    param($Receipt,[Parameter(Mandatory)]$Transaction)
+    return (Test-CcodUninstallBootstrapExactProperties $Receipt @('schemaVersion','transactionId','runtimeId','runtimeGeneration','leaseEpoch','phase','updatedAtUtc','errorCode'))-and$Receipt.schemaVersion-is[int]-and$Receipt.schemaVersion-eq1-and
+        $Receipt.transactionId-is[string]-and$Receipt.transactionId-ceq$Transaction.transactionId-and$Receipt.runtimeId-is[string]-and$Receipt.runtimeId-ceq$Transaction.runtimeId-and
+        [uint64]$Receipt.runtimeGeneration-eq[uint64]$Transaction.runtimeGeneration-and[uint64]$Receipt.leaseEpoch-eq[uint64]$Transaction.leaseEpoch-and$Receipt.phase-is[string]-and$Receipt.phase-ceq$Transaction.phase-and
+        $Receipt.updatedAtUtc-is[string]-and$Receipt.updatedAtUtc-ceq$Transaction.updatedAtUtc-and[string]$Receipt.errorCode-ceq[string]$Transaction.errorCode
+}
+
 function Test-CcodUninstallBootstrapStoredCompletedReceipt {
     param([Parameter(Mandatory)][string]$TransactionRoot,[Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)][string]$ExpectedUserSid)
     try{
@@ -1009,6 +1022,10 @@ function Get-CcodUninstallBootstrapAdapters {
             param($TransactionRoot,$Transaction)
             Write-CcodUninstallBootstrapStoredReceipt -TransactionDirectory $TransactionRoot -Transaction $Transaction
         }
+        ReadReceipt = {
+            param($TransactionRoot)
+            Read-CcodUninstallBootstrapStoredReceipt -TransactionDirectory $TransactionRoot
+        }
         RunCleanup = {
             param($InstallerRoot,$InstallRoot,$TransactionRoot,$Transaction,$WriteTransaction,$Mode)
             $payloadRoot = Resolve-CcodUninstallBootstrapChildPath -Root $TransactionRoot -RelativePath 'payload'
@@ -1052,6 +1069,26 @@ function Get-CcodUninstallBootstrapAdapters {
     return $resolved
 }
 
+function Assert-CcodUninstallBootstrapInstalledTaskRemovedContext {
+    param(
+        [Parameter(Mandatory)]$Transaction,
+        [Parameter(Mandatory)]$FreshContext,
+        [Parameter(Mandatory)][string]$InstallerRoot,
+        [Parameter(Mandatory)][string]$InstallRoot
+    )
+    Assert-CcodUninstallBootstrapTransaction $Transaction -ExpectedInstallRoot $InstallRoot
+    Assert-CcodUninstallBootstrapContext $FreshContext -ExpectedInstallRoot $InstallRoot
+    if($Transaction.phase-cne'TaskRemoved'-or$Transaction.resumePhase-cne'TaskRemoved'-or$null-eq$Transaction.installedBinding){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISMATCH' 'Only an exact installed TaskRemoved transaction may relax its historical session.' $Transaction}
+    $installer=Get-CcodUninstallBootstrapComparablePath -Path $InstallerRoot -Kind 'Installed runtime root';$install=Get-CcodUninstallBootstrapComparablePath -Path $InstallRoot -Kind 'Install root';$expectedRuntime=Get-CcodUninstallBootstrapComparablePath -Path (Join-Path (Join-Path $install 'runtime') ([string]$Transaction.runtimeId)) -Kind 'Selected runtime root'
+    if($installer-cne$expectedRuntime-or(Get-CcodUninstallBootstrapComparablePath -Path ([string]$Transaction.installedBinding.selectedRuntimeRoot) -Kind 'Bound selected runtime root')-cne$expectedRuntime-or
+       $Transaction.userSid-cne$FreshContext.userSid-or$Transaction.runtimeId-cne$FreshContext.runtimeId-or[uint64]$Transaction.runtimeGeneration-ne[uint64]$FreshContext.runtimeGeneration-or
+       [uint64]$Transaction.leaseEpoch-ne[uint64]$FreshContext.leaseEpoch-or($Transaction.readyEvidence|ConvertTo-Json -Depth 8 -Compress)-cne($FreshContext.readyEvidence|ConvertTo-Json -Depth 8 -Compress)-or
+       ($Transaction.installedBinding.payloadRecords|ConvertTo-Json -Depth 8 -Compress)-cne($FreshContext.payloadRecords|ConvertTo-Json -Depth 8 -Compress)){
+        Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISMATCH' 'Installed TaskRemoved replacement does not match the locked fresh runtime proof.' $Transaction
+    }
+    return $true
+}
+
 function Test-CcodUninstallBootstrapInstalledBindingResume {
     param($Existing,$Observed)
     if($null-eq$Existing-or$null-eq$Observed){return $false}
@@ -1126,6 +1163,7 @@ function Invoke-CcodUninstallBootstrap {
     $stageRoot = $null
     $stagePayload = $false
     $returnExistingInstalledTaskRemoved = $false
+    $installedTaskRemovedRecovery = $false
     $transactionLock = $null
     $accountTransition = $null
     try {
@@ -1166,21 +1204,31 @@ function Invoke-CcodUninstallBootstrap {
             & $adapter.PublishTransaction $transactionRoot $transactionId $context.userSid ([bool]$replaceCompletedLocator)
             $stagePayload = $true
         } else {
-            Assert-CcodUninstallBootstrapTransactionMatchesContext $transaction $context $InstallRoot
+            $installedTaskRemovedCandidate=$Mode-ceq'PrepareInstalled'-and$transaction.phase-ceq'TaskRemoved'-and$transaction.resumePhase-ceq'TaskRemoved'-and$null-ne$transaction.installedBinding
+            if($installedTaskRemovedCandidate){
+                $installedTaskRemovedRecovery=$true
+                $freshContext=&$adapter.ValidateInvocation $InstallerRoot $InstallRoot
+                Assert-CcodUninstallBootstrapContext $freshContext -ExpectedInstallRoot $InstallRoot
+                [void](Assert-CcodUninstallBootstrapInstalledTaskRemovedContext -Transaction $transaction -FreshContext $freshContext -InstallerRoot $InstallerRoot -InstallRoot $InstallRoot)
+                $context=$freshContext
+            }else{Assert-CcodUninstallBootstrapTransactionMatchesContext $transaction $context $InstallRoot}
             $stageRoot = & $adapter.GetTransactionDirectory $transactionRoot $transaction.transactionId
             if ($stageRoot -isnot [string] -or [string]::IsNullOrWhiteSpace($stageRoot)) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_ROOT_INVALID' 'The external uninstall transaction root is invalid' $stageRoot }
             if($Mode-ceq'PrepareInstalled'){
                 $binding=&$adapter.GetInstalledBinding $InstallerRoot $InstallRoot $context $WrapperIdentity $stageRoot $transaction.transactionId
                 if(-not(Test-CcodUninstallBootstrapInstalledBindingResume -Existing $transaction.installedBinding -Observed $binding)){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISMATCH' 'Installed wrapper binding changed during resume' $binding}
-                if(($transaction.phase-ceq'TaskRemoved'-and$transaction.resumePhase-ceq'TaskRemoved')-or($transaction.phase-ceq'Failed'-and$transaction.resumePhase-ceq'TaskRemoved')){
+                if($installedTaskRemovedCandidate){
                     $transaction.installedBinding.resumeWrapperPid=[int]$WrapperIdentity.pid;$transaction.installedBinding.resumeWrapperCreationTimeUtc=[string]$WrapperIdentity.creationTimeUtc;$transaction.installedBinding.resumeWrapperSessionId=[int]$WrapperIdentity.sessionId;$transaction.installedBinding.resumeWrapperUserSid=[string]$WrapperIdentity.userSid
-                    $transaction.phase='TaskRemoved';$transaction.resumePhase='TaskRemoved';$transaction.errorCode=$null;$transaction.updatedAtUtc=(& $adapter.GetUtcNow).ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture);Assert-CcodUninstallBootstrapTransaction $transaction -ExpectedInstallRoot $InstallRoot;&$adapter.WriteTransaction $stageRoot $transaction;$returnExistingInstalledTaskRemoved=$true
+                    Assert-CcodUninstallBootstrapTransaction $transaction -ExpectedInstallRoot $InstallRoot;&$adapter.WriteTransaction $stageRoot $transaction
+                    $readBack=&$adapter.ReadTransaction $transactionRoot $identity.userSid $true $InstallRoot
+                    if($null-eq$readBack-or($readBack|ConvertTo-Json -Depth 16 -Compress)-cne($transaction|ConvertTo-Json -Depth 16 -Compress)){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_WRITE_FAILED' 'Replacement wrapper transaction read-back did not match.' $transaction.transactionId}
+                    $transaction=$readBack;$returnExistingInstalledTaskRemoved=$true
                 }
             }
             $stagePayload = $transaction.phase -ceq 'Requested' -or ($transaction.phase -ceq 'Failed' -and $transaction.resumePhase -ceq 'Requested')
         }
         if ($stagePayload) { & $adapter.StagePayload $InstallerRoot $InstallRoot $context $stageRoot }
-        if($returnExistingInstalledTaskRemoved){&$adapter.WriteReceipt $stageRoot $transaction;return $transaction}
+        if($returnExistingInstalledTaskRemoved){&$adapter.WriteReceipt $stageRoot $transaction;$receipt=&$adapter.ReadReceipt $stageRoot;if(-not(Test-CcodUninstallBootstrapReceiptMatchesTransaction -Receipt $receipt -Transaction $transaction)){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_WRITE_FAILED' 'Replacement wrapper receipt read-back did not match.' $transaction.transactionId};return $transaction}
         $result = & $adapter.RunCleanup $InstallerRoot $InstallRoot $stageRoot $transaction $adapter.WriteTransaction $Mode
         if ($null -eq $result) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PREPARE_FAILED' 'The staged cleanup returned no transaction receipt' $stageRoot }
         Assert-CcodUninstallBootstrapTransactionMatchesContext $result $context $InstallRoot
@@ -1192,7 +1240,7 @@ function Invoke-CcodUninstallBootstrap {
     } catch {
         $code = Get-CcodUninstallBootstrapErrorId $_
         if ($code -notmatch '^CCOD_[A-Z0-9_]+$') { $code = 'CCOD_UNINSTALL_PREPARE_FAILED' }
-        if ($null -ne $transaction -and -not [string]::IsNullOrWhiteSpace([string]$stageRoot)) { Set-CcodUninstallBootstrapFailedTransaction -Transaction $transaction -Code $code -Adapters $adapter -TransactionRoot $stageRoot }
+        if (-not$installedTaskRemovedRecovery-and$null -ne $transaction -and -not [string]::IsNullOrWhiteSpace([string]$stageRoot)) { Set-CcodUninstallBootstrapFailedTransaction -Transaction $transaction -Code $code -Adapters $adapter -TransactionRoot $stageRoot }
         if ((Get-CcodUninstallBootstrapErrorId $_) -ceq $code) { throw }
         Throw-CcodUninstallBootstrapError $code 'The uninstall bootstrap failed before Inno deletion' $stageRoot
     } finally {
diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index d945ae2..5bb887c 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -15,6 +15,10 @@ if (-not (Test-Path -LiteralPath $installedFinalizerScript -PathType Leaf)) { th
 Import-Module (Join-Path $repositoryRoot 'src\persistence\modules\RuntimeManifest.psm1') -Force
 $canonicalTaskTarget=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'schtasks.exe'))
 
+function New-CcodUninstallBootstrapTestPayloadRecords {
+    $records=@(New-CcodUninstallBootstrapPayloadRecords -ResumeOnly);foreach($record in $records){$record.length=[int64]1;$record.sha256=('d'*64)};$resume=@($records|Where-Object{$_.path-ceq'src/persistence/InstalledUninstallFinalizer.ps1'})[0];$resume.length=[int64]123;$resume.sha256=('e'*64);return $records
+}
+
 function New-CcodUninstallBootstrapContext {
     return [pscustomobject][ordered]@{
         runtimeId = '2.5.0-uninstall-test'
@@ -23,7 +27,7 @@ function New-CcodUninstallBootstrapContext {
         userSid = 'S-1-5-21-111-222-333-1001'
         sessionId = 1
         readyEvidence = [pscustomobject][ordered]@{phase='Ready';installRoot='C:\install';runtimeId='2.5.0-uninstall-test';runtimeGeneration=[uint64]7;packageSha256=('0'*64);manifestSha256=('a'*64);startMenuSha256=('0'*64);desktopSha256=('0'*64);targetPath=$canonicalTaskTarget;arguments='/Run /TN "Codex Control Other Devices Supervisor"'}
-        payloadRecords = New-CcodUninstallBootstrapPayloadRecords -ResumeOnly
+        payloadRecords = New-CcodUninstallBootstrapTestPayloadRecords
     }
 }
 
@@ -69,7 +73,7 @@ function New-CcodUninstallBootstrapAdapters {
                 userSid = 'S-1-5-21-111-222-333-1001'
                 sessionId = 1
                 readyEvidence = [pscustomobject][ordered]@{phase='Ready';installRoot='C:\install';runtimeId='2.5.0-uninstall-test';runtimeGeneration=[uint64]7;packageSha256=('0'*64);manifestSha256=('a'*64);startMenuSha256=('0'*64);desktopSha256=('0'*64);targetPath=$canonicalTaskTarget;arguments='/Run /TN "Codex Control Other Devices Supervisor"'}
-                payloadRecords = New-CcodUninstallBootstrapPayloadRecords -ResumeOnly
+                payloadRecords = New-CcodUninstallBootstrapTestPayloadRecords
             }
         }.GetNewClosure()
         GetTransactionRoot = {
@@ -122,6 +126,12 @@ function New-CcodUninstallBootstrapAdapters {
             [void]$World.Calls.Add("Receipt:$($Transaction.phase)")
             [void]($World.Receipt = $Transaction)
         }.GetNewClosure()
+        ReadReceipt = {
+            param($TransactionRoot)
+            [void]$World.Calls.Add('ReadReceipt')
+            if($null-eq$World.Receipt){return $null}
+            [pscustomobject][ordered]@{schemaVersion=1;transactionId=[string]$World.Receipt.transactionId;runtimeId=[string]$World.Receipt.runtimeId;runtimeGeneration=[uint64]$World.Receipt.runtimeGeneration;leaseEpoch=[uint64]$World.Receipt.leaseEpoch;phase=[string]$World.Receipt.phase;updatedAtUtc=[string]$World.Receipt.updatedAtUtc;errorCode=$World.Receipt.errorCode}
+        }.GetNewClosure()
         RunCleanup = {
             param($InstallerRoot,$InstallRoot,$TransactionRoot,$Transaction,$WriteTransaction)
             [void]$World.Calls.Add('Cleanup')
@@ -268,7 +278,7 @@ function New-CcodUninstallBootstrapTestInstalledBinding {
         [string]$RuntimeManifestSha256=('a'*64)
     )
     $local=Get-CcodInstalledFinalizerLocalAppData;if([string]::IsNullOrWhiteSpace($TransactionDirectory)){$TransactionDirectory=Join-Path (Join-Path $local 'CodexRemote-fix-uninstall') $TransactionId};$resumeScript=[IO.Path]::GetFullPath((Join-Path $TransactionDirectory 'payload\src\persistence\InstalledUninstallFinalizer.ps1'))
-    $records=if($null-ne$PayloadRecords){@($PayloadRecords)}else{@(New-CcodUninstallBootstrapPayloadRecords -ResumeOnly)};if($null-eq$PayloadRecords){foreach($record in $records){$record.length=[int64]1;$record.sha256=('d'*64)};$fakeResume=@($records|Where-Object{$_.path-ceq'src/persistence/InstalledUninstallFinalizer.ps1'})[0];$fakeResume.length=[int64]123;$fakeResume.sha256=('e'*64)};$resumeRecord=@($records|Where-Object{$_.path-ceq'src/persistence/InstalledUninstallFinalizer.ps1'})[0]
+    $records=if($null-ne$PayloadRecords){@($PayloadRecords)}else{@(New-CcodUninstallBootstrapTestPayloadRecords)};$resumeRecord=@($records|Where-Object{$_.path-ceq'src/persistence/InstalledUninstallFinalizer.ps1'})[0]
     [pscustomobject][ordered]@{selectedRuntimeRoot=[IO.Path]::GetFullPath($RuntimeRoot);runtimeManifestSha256=$RuntimeManifestSha256;wrapperPid=$WrapperPid;wrapperCreationTimeUtc=$WrapperCreationTimeUtc;wrapperSessionId=$SessionId;wrapperUserSid=$UserSid;resumeWrapperPid=$null;resumeWrapperCreationTimeUtc=$null;resumeWrapperSessionId=$null;resumeWrapperUserSid=$null;resumeScriptPath=$resumeScript;resumeScriptLength=[int64]$resumeRecord.length;resumeScriptSha256=[string]$resumeRecord.sha256;resumeCommand=(Get-CcodUninstallBootstrapInstalledResumeCommand -ResumeScriptPath $resumeScript -TransactionId $TransactionId -RuntimeRoot $RuntimeRoot -InstallRoot $InstallRoot);payloadRecords=$records}
 }
 
@@ -280,7 +290,7 @@ function New-CcodInstalledFinalizerMemoryAdapters {
         ExitAccountTransition={param($Lease)$World.Calls.Add('AccountUnlock');$Lease.Held=$false}.GetNewClosure()
         EnterTransactionLock={param($Sid)$World.Calls.Add('Lock');[pscustomobject]@{Held=$true}}.GetNewClosure()
         ExitTransactionLock={param($Lock)$World.Calls.Add('Unlock');$Lock.Held=$false}.GetNewClosure()
-        WaitWrapperExit={param($Identity,$Timeout)$World.Calls.Add('WaitWrapper');[pscustomobject]@{verifiedAtStart=$true;exited=$true}}.GetNewClosure()
+        WaitWrapperExit={param($Identity,$Timeout)$World.Calls.Add('WaitWrapper');if($null-eq$World.PSObject.Properties['LastWaitIdentity']){$World|Add-Member -NotePropertyName LastWaitIdentity -NotePropertyValue $null};$World.LastWaitIdentity=$Identity;[pscustomobject]@{verifiedAtStart=$true;exited=$true}}.GetNewClosure()
         ReadPreparedTransaction={param($Id,$Root)$World.Calls.Add("Read:$($World.Transaction.phase)");$World.Transaction}.GetNewClosure()
         ValidateStagedPayload={param($Transaction,$Root)$World.Calls.Add('ValidatePayload');$true}.GetNewClosure()
         ValidateSelectedGeneration={param($Runtime,$Install,$Transaction)$World.Calls.Add('ValidateGeneration');[bool]$World.RootPresent}.GetNewClosure()
@@ -624,20 +634,81 @@ $results += Invoke-CcodTest 'FinalizeReceipt repairs a missing receipt after the
     Assert-CcodEqual 'GetRoot,Read,FinalizeInvocation,RootAbsent,Receipt:Completed' ($world.Calls-join',') 'receipt repair performs no second transaction write before the public registry anchor is removed'
 }
 
-# Production mutation caught: deleting the selected generation while its public wrapper is still executing from it.
-$results += Invoke-CcodTest 'installed Prepare stops at TaskRemoved and external finalizer completes only after wrapper exit' {
+# Production mutation caught: the generic context matcher rejects a same-SID TaskRemoved
+# replacement wrapper merely because its fresh Windows session differs from the historical one.
+$results += Invoke-CcodTest 'same-SID new-session TaskRemoved replacement persists a fresh wrapper without rerunning cleanup' {
+    $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=(New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved');Receipt=$null;ValidationError=$false;StageError=$false;CleanupError=$false;CleanupFailurePhase=$null;InstallRootAbsent=$false;StagedEntries=@();ProductRegistrationRemovals=0}
+    $world.Transaction.installedBinding=New-CcodUninstallBootstrapTestInstalledBinding -SessionId 1 -WrapperPid 42 -WrapperCreationTimeUtc '2030-02-03T03:04:05.0000000Z'
+    $adapters=New-CcodUninstallBootstrapAdapters $world;$fresh=New-CcodUninstallBootstrapContext;$fresh.sessionId=99;$fresh.payloadRecords=@($world.Transaction.installedBinding.payloadRecords);$freshCalls=[pscustomobject]@{Count=0};$cleanupCalls=[pscustomobject]@{Count=0}
+    $adapters.ValidateInvocation={param($InstallerRoot,$InstallRoot)$freshCalls.Count++;$world.Calls.Add("FreshValidate:$($freshCalls.Count)");$fresh}.GetNewClosure()
+    $adapters.GetInstalledBinding={param($InstallerRoot,$InstallRoot,$Context,$WrapperIdentity,$TransactionDirectory,$TransactionId)New-CcodUninstallBootstrapTestInstalledBinding -TransactionId $TransactionId -RuntimeRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -UserSid $WrapperIdentity.userSid -SessionId $WrapperIdentity.sessionId -WrapperPid $WrapperIdentity.pid -WrapperCreationTimeUtc $WrapperIdentity.creationTimeUtc -PayloadRecords $Context.payloadRecords}.GetNewClosure()
+    $adapters.RunCleanup={param($InstallerRoot,$InstallRoot,$TransactionRoot,$Transaction,$WriteTransaction,$Mode)$cleanupCalls.Count++;throw 'TASK1_EXISTING_TASKREMOVED_REENTERED_CLEANUP'}.GetNewClosure()
+    $replacement=[pscustomobject]@{pid=43;creationTimeUtc='2030-02-03T03:04:06.0000000Z';sessionId=99;userSid='S-1-5-21-111-222-333-1001'}
+
+    $resumed=Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -Mode PrepareInstalled -WrapperIdentity $replacement -Adapters $adapters
+
+    Assert-CcodEqual 'TaskRemoved' $resumed.phase 'same-SID new-session replacement returns the existing TaskRemoved transaction'
+    Assert-CcodEqual 2 $freshCalls.Count 'replacement recovery revalidates runtime selector Ready manifest payload and epoch after both locks are held'
+    Assert-CcodTrue ([Array]::IndexOf(@($world.Calls),'AccountLock')-lt[Array]::IndexOf(@($world.Calls),'FreshValidate:2')) 'fresh replacement proof runs only after Local uninstall and Global AccountTransition acquisition'
+    Assert-CcodEqual 0 $cleanupCalls.Count 'existing TaskRemoved never re-enters RunCleanup'
+    Assert-CcodEqual 1 $resumed.sessionId 'historical transaction session remains immutable evidence'
+    Assert-CcodEqual 42 $resumed.installedBinding.wrapperPid 'historical wrapper identity remains immutable evidence'
+    Assert-CcodEqual 43 $resumed.installedBinding.resumeWrapperPid 'only the exact replacement wrapper PID is persisted'
+    Assert-CcodEqual 99 $resumed.installedBinding.resumeWrapperSessionId 'replacement wrapper records its fresh Windows session'
+    Assert-CcodEqual 'TaskRemoved' $world.Receipt.phase 'TaskRemoved replacement receipt is persisted after transaction read-back'
+}
+
+$results += Invoke-CcodTest 'new-session relaxation rejects every nonexact TaskRemoved identity without mutation' {
+    foreach($kind in @('DifferentSid','Runtime','Generation','Epoch','Ready','Payload','PreTaskRemoved')){
+        $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=(New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved');Receipt=$null;ValidationError=$false;StageError=$false;CleanupError=$false;CleanupFailurePhase=$null;InstallRootAbsent=$false;StagedEntries=@();ProductRegistrationRemovals=0}
+        $world.Transaction.installedBinding=New-CcodUninstallBootstrapTestInstalledBinding
+        if($kind-ceq'PreTaskRemoved'){$world.Transaction.phase='ProtectionStopped';$world.Transaction.resumePhase='ProtectionStopped'}
+        $fresh=New-CcodUninstallBootstrapContext;$fresh.sessionId=99;$fresh.payloadRecords=@($world.Transaction.installedBinding.payloadRecords|ForEach-Object{[pscustomobject][ordered]@{path=[string]$_.path;length=[int64]$_.length;sha256=[string]$_.sha256}})
+        switch($kind){
+            'DifferentSid' {$fresh.userSid='S-1-5-21-999-888-777-1001'}
+            'Runtime' {$fresh.runtimeId='2.5.0-uninstall-foreign';$fresh.readyEvidence.runtimeId=$fresh.runtimeId}
+            'Generation' {$fresh.runtimeGeneration=[uint64]8;$fresh.readyEvidence.runtimeGeneration=[uint64]8}
+            'Epoch' {$fresh.leaseEpoch=[uint64]12}
+            'Ready' {$fresh.readyEvidence.packageSha256=('f'*64)}
+            'Payload' {$fresh.payloadRecords[0].sha256=('f'*64)}
+        }
+        $adapters=New-CcodUninstallBootstrapAdapters $world;$adapters.ValidateInvocation={param($InstallerRoot,$InstallRoot)$fresh}.GetNewClosure();$cleanup=[pscustomobject]@{Count=0};$adapters.RunCleanup={param($InstallerRoot,$InstallRoot,$TransactionRoot,$Transaction,$WriteTransaction,$Mode)$cleanup.Count++;throw 'TASK1_NEGATIVE_REENTERED_CLEANUP'}.GetNewClosure()
+        $replacement=[pscustomobject]@{pid=43;creationTimeUtc='2030-02-03T03:04:06.0000000Z';sessionId=99;userSid='S-1-5-21-111-222-333-1001'}
+        Assert-CcodThrows {Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -Mode PrepareInstalled -WrapperIdentity $replacement -Adapters $adapters|Out-Null} 'CCOD_UNINSTALL_TRANSACTION_MISMATCH'
+        Assert-CcodEqual 0 @($world.Calls|Where-Object{$_-like'Write:*'-or$_-like'Receipt:*'}).Count "$kind writes no transaction or receipt"
+        Assert-CcodEqual 0 $cleanup.Count "$kind never enters RunCleanup"
+        Assert-CcodEqual $null $world.Transaction.installedBinding.resumeWrapperPid "$kind persists no replacement wrapper"
+    }
+}
+
+$results += Invoke-CcodTest 'WrapperResume rejects PID creation session and SID mutations before waiting or reclaiming' {
+    foreach($kind in @('Pid','Creation','Session','Sid')){
+        $transaction=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$transaction.installedBinding=New-CcodUninstallBootstrapTestInstalledBinding;$transaction.installedBinding.resumeWrapperPid=43;$transaction.installedBinding.resumeWrapperCreationTimeUtc='2030-02-03T03:04:06.0000000Z';$transaction.installedBinding.resumeWrapperSessionId=99;$transaction.installedBinding.resumeWrapperUserSid=$transaction.userSid
+        $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=$transaction;RootPresent=$true;PublicEntry=$false;PublicCommand=$null;ShortcutsPresent=$true;CompletedReceipt=$false;Failure=$null;FailureInjected=$false;EntryPresentAtReclaim=$false};$adapters=New-CcodInstalledFinalizerMemoryAdapters $world
+        $identity=[pscustomobject]@{pid=43;creationTimeUtc='2030-02-03T03:04:06.0000000Z';sessionId=99;userSid=$transaction.userSid};switch($kind){'Pid'{$identity.pid=44}'Creation'{$identity.creationTimeUtc='2030-02-03T03:04:07.0000000Z'}'Session'{$identity.sessionId=100}'Sid'{$identity.userSid='S-1-5-21-999-888-777-1001'}}
+        Assert-CcodThrows {Invoke-CcodInstalledUninstallFinalizer -TransactionId $transaction.transactionId -RuntimeRoot $transaction.installedBinding.selectedRuntimeRoot -InstallRoot 'C:\install' -WrapperIdentity $identity -WrapperResume -Adapters $adapters|Out-Null} 'CCOD_INSTALLED_FINALIZER_INVALID'
+        Assert-CcodEqual 0 @($world.Calls|Where-Object{$_-in@('WaitWrapper','Reclaim','Write:ReadyForInno')}).Count "$kind mismatch is rejected before wrapper wait or reclamation"
+    }
+}
+
+# Production mutation caught: a finalizer-start failure leaves no anchor, and a replacement
+# wrapper from a new session must bind itself and still be waited before reclamation.
+$results += Invoke-CcodTest 'finalizer-start failure recovers through same-SID new-session WrapperResume exact wait' {
     $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=$null;Receipt=$null;ValidationError=$false;StageError=$false;CleanupError=$false;CleanupFailurePhase=$null;InstallRootAbsent=$false;StagedEntries=@();ProductRegistrationRemovals=0}
     $adapters=New-CcodUninstallBootstrapAdapters $world
     $originalCleanup=$adapters.RunCleanup
     $adapters.RunCleanup={param($InstallerRoot,$InstallRoot,$TransactionRoot,$Transaction,$WriteTransaction,$Mode);$world.Calls.Add("Cleanup:$Mode");$Transaction.phase='TaskRemoved';$Transaction.resumePhase='TaskRemoved';&$WriteTransaction $TransactionRoot $Transaction;$Transaction}.GetNewClosure()
-    $adapters.GetInstalledBinding={param($InstallerRoot,$InstallRoot,$Context,$WrapperIdentity,$TransactionDirectory,$TransactionId)New-CcodUninstallBootstrapTestInstalledBinding -TransactionId $TransactionId -RuntimeRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -UserSid $WrapperIdentity.userSid -SessionId $WrapperIdentity.sessionId -WrapperPid $WrapperIdentity.pid -WrapperCreationTimeUtc $WrapperIdentity.creationTimeUtc}.GetNewClosure()
+    $adapters.GetInstalledBinding={param($InstallerRoot,$InstallRoot,$Context,$WrapperIdentity,$TransactionDirectory,$TransactionId)New-CcodUninstallBootstrapTestInstalledBinding -TransactionId $TransactionId -RuntimeRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -UserSid $WrapperIdentity.userSid -SessionId $WrapperIdentity.sessionId -WrapperPid $WrapperIdentity.pid -WrapperCreationTimeUtc $WrapperIdentity.creationTimeUtc -PayloadRecords $Context.payloadRecords}.GetNewClosure()
     $wrapperIdentity=[pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=1;userSid='S-1-5-21-111-222-333-1001'}
-    $prepared=Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\runtime' -InstallRoot 'C:\install' -Mode PrepareInstalled -WrapperIdentity $wrapperIdentity -Adapters $adapters
+    $prepared=Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -Mode PrepareInstalled -WrapperIdentity $wrapperIdentity -Adapters $adapters
     Assert-CcodEqual 'TaskRemoved' $prepared.phase 'installed wrapper retains application state until it exits'
     Assert-CcodEqual 0 $world.ProductRegistrationRemovals 'installed Prepare removes no product state before the external finalizer'
+    $startFailure=$null;try{throw [Management.Automation.ErrorRecord]::new([IO.IOException]::new('injected finalizer start failure'),'CCOD_UNINSTALL_INSTALLED_FINALIZER_START_FAILED',[Management.Automation.ErrorCategory]::OpenError,$prepared.transactionId)}catch{$startFailure=$_}
+    Assert-CcodEqual 'CCOD_UNINSTALL_INSTALLED_FINALIZER_START_FAILED' (([string]$startFailure.FullyQualifiedErrorId-split',')[0]) 'first public invocation fails only after durable TaskRemoved and before any Apps anchor'
 
     $replacementWrapper=[pscustomobject]@{pid=43;creationTimeUtc='2030-02-03T03:04:06.0000000Z';sessionId=99;userSid='S-1-5-21-111-222-333-1001'}
-    $resumedPrepare=Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\runtime' -InstallRoot 'C:\install' -Mode PrepareInstalled -WrapperIdentity $replacementWrapper -Adapters $adapters
+    $replacementContext=New-CcodUninstallBootstrapContext;$replacementContext.sessionId=99;$adapters.ValidateInvocation={param($InstallerRoot,$InstallRoot)$replacementContext}.GetNewClosure()
+    $resumedPrepare=Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -Mode PrepareInstalled -WrapperIdentity $replacementWrapper -Adapters $adapters
     Assert-CcodEqual 'TaskRemoved' $resumedPrepare.phase 'a later runtime wrapper reuses the staged transaction instead of replacing historical wrapper proof'
     Assert-CcodEqual 42 $resumedPrepare.installedBinding.wrapperPid 'historical wrapper identity remains immutable during public retry'
     Assert-CcodEqual 43 $resumedPrepare.installedBinding.resumeWrapperPid 'replacement wrapper launch identity is persisted separately before returning'
@@ -651,6 +722,9 @@ $results += Invoke-CcodTest 'installed Prepare stops at TaskRemoved and external
     Assert-CcodTrue (-not$final.PublicEntry) 'public recovery entry is removed only after the Completed receipt'
     Assert-CcodTrue $final.EntryPresentAtReclaim 'durable public recovery entry exists before generation reclamation'
     Assert-CcodTrue (@($final.Calls)-ccontains'WaitWrapper') 'replacement wrapper finalizer waits for the exact replacement instance before reclamation'
+    Assert-CcodEqual 43 $final.LastWaitIdentity.pid 'WrapperResume waits the newly persisted replacement PID'
+    Assert-CcodEqual '2030-02-03T03:04:06.0000000Z' $final.LastWaitIdentity.creationTimeUtc 'WrapperResume waits the newly persisted replacement creation time'
+    Assert-CcodEqual 99 $final.LastWaitIdentity.sessionId 'WrapperResume waits the newly persisted replacement session'
     $localLock=[Array]::IndexOf(@($final.Calls),'Lock');$accountLock=[Array]::IndexOf(@($final.Calls),'AccountLock');$reclaim=[Array]::IndexOf(@($final.Calls),'Reclaim');$registry=[Array]::IndexOf(@($final.Calls),'RemoveRegistry');$accountUnlock=[Array]::IndexOf(@($final.Calls),'AccountUnlock');$localUnlock=[Array]::IndexOf(@($final.Calls),'Unlock')
     Assert-CcodTrue ($localLock-ge0-and$accountLock-gt$localLock-and$reclaim-gt$accountLock-and$registry-gt$reclaim-and$accountUnlock-gt$registry-and$localUnlock-gt$accountUnlock) 'Local uninstall then Global AccountTransition acquisition order spans the complete tail without ABBA'
 }

From bf4d2157e672b1735571a719256e1b564ba44f8e Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 06:14:16 +0800
Subject: [PATCH 138/187] docs: record cross-session TaskRemoved recovery

---
 .../progress.md                               |  2 +-
 .../task-1-report.md                          | 93 +++++++++++++++++++
 2 files changed, 94 insertions(+), 1 deletion(-)
 create mode 100644 .superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-1-report.md

diff --git a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
index 7a28a2b..e3c8f23 100644
--- a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
+++ b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
@@ -17,7 +17,7 @@ Plan: `docs/superpowers/plans/2026-09-03-v2522-cross-process-retry-closure.md`
 
 ## Status
 
-Task 1: pending.
+Task 1: complete. RED hit the real generic session matcher; exact locked same-SID/new-session TaskRemoved recovery is implemented in `9973bfd`. Focused verification: UninstallBootstrap 40/40, ManualWrappers pass, two changed parsers 0 errors, `git diff --check` exit 0. No real system action.
 
 Task 2: pending.
 
diff --git a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-1-report.md b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-1-report.md
new file mode 100644
index 0000000..ae20c35
--- /dev/null
+++ b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-1-report.md
@@ -0,0 +1,93 @@
+# Task 1 report — same-SID new-session TaskRemoved recovery
+
+## 结论与范围
+
+Task 1 已按 successor plan 完成，implementation commit 为 `9973bfd`
+（`fix: recover installed TaskRemoved across sessions`），基线为 `a5ffe4a`。
+本任务只修改：
+
+- `src/persistence/UninstallBootstrap.ps1`
+- `tests/persistence/UninstallBootstrap.SelfTest.ps1`
+
+Task 2 未开始、未修改。本任务没有执行真实 registry、shortcut、scheduled task、安装、卸载、
+进程重启、系统重启、网络、push、tag、release 或发布操作；device-key/DPAPI state 未触碰。
+
+## 根因与 RED
+
+旧实现对所有 existing transaction 先调用 generic
+`Assert-CcodUninstallBootstrapTransactionMatchesContext`。该 matcher 正确要求 session ID 相同，
+但也因此在一个精确、已到 `TaskRemoved` 的 installed transaction 上，拒绝同 SID 的新登录
+session，尚未进入 replacement-wrapper 持久化分支。
+
+production-shaped RED 使用：durable transaction session `1`、fresh verified context session `99`、
+相同 SID、exact `TaskRemoved`、完整 installed binding、尚无 Apps recovery anchor，以及 exact 新
+wrapper identity。production 未修改时实际结果：
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\UninstallBootstrap.SelfTest.ps1
+exit 1
+case=same-SID-new-session-TaskRemoved-replacement-persists-a-fresh-wrapper-without-rerunning-cleanup
+error=CCOD_UNINSTALL_TRANSACTION_MISMATCH
+The existing uninstall transaction does not match the current verified runtime
+```
+
+栈命中真实 generic context matcher，不是 adapter/setup 失败。
+
+## 实现
+
+generic matcher 与 `New-CcodUninstallBootstrapResumeContext` 继续严格匹配 SID + session；只有
+`PrepareInstalled` 的 exact `TaskRemoved` installed transaction 进入新专用 matcher。
+
+专用路径在既有 Local uninstall -> Global `AccountTransition` 顺序取得两把锁后：
+
+1. 再次执行真实 `ValidateInvocation`，获得 fresh runtime/selector/Ready/manifest/epoch proof；
+2. 要求 transaction ID/current locator、SID、runtime ID、generation、epoch、完整 Ready evidence、
+   payload records、selected runtime path、staged resume path/hash 与 immutable installed binding
+   全部一致；唯一允许不同的是 fresh context session；
+3. 保留 `transaction.sessionId` 与 historical `wrapper*`，只写 exact `resumeWrapperPid`、
+   `resumeWrapperCreationTimeUtc`、`resumeWrapperSessionId`、`resumeWrapperUserSid`；
+4. 原子写 transaction 后锁内重读完整 transaction，再写并重读 exact TaskRemoved receipt；
+5. 直接返回 verified existing TaskRemoved，绝不再次调用 `RunCleanup`。
+
+若该专用 transaction/receipt 持久化或 read-back 失败，generic catch 不把 historical TaskRemoved
+改写为 Failed。普通 pre-TaskRemoved、不同 SID 或 runtime/generation/epoch/Ready/payload mismatch
+仍走 strict failure boundary。
+
+public runtime wrapper 随后使用已存在的 `-WrapperResume` 参数集；finalizer 必须匹配并等待新持久化
+的 PID/creation/session/SID exact identity，之后才允许 generation reclamation。测试还覆盖第一次
+external finalizer start 失败、没有 anchor，第二次同 SID session 99 public invocation 成功持久化
+replacement wrapper 并完成 exact wait。
+
+## TDD 与负例
+
+最终 self-test 新增/强化：
+
+- same-SID session 1 -> 99 exact TaskRemoved GREEN；fresh validation 调用两次，第二次位于
+  AccountTransition acquisition 之后；
+- existing TaskRemoved `RunCleanup` 调用数保持 `0`；historical session/PID 不变；
+- DifferentSid、Runtime、Generation、Epoch、Ready、Payload、PreTaskRemoved 七项全部零 transaction /
+  receipt write、零 cleanup；
+- WrapperResume 的 PID、creation time、session、SID 四项 mutation 在 wait/reclaim 前拒绝；
+- finalizer-start failure 后的新 session replacement path 等待的确切 identity 为 PID `43`、
+  creation `2030-02-03T03:04:06.0000000Z`、session `99`。
+
+## 最终验证
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\UninstallBootstrap.SelfTest.ps1
+  Uninstall bootstrap self-tests passed: 40
+  exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ManualWrappers.SelfTest.ps1
+  Manual wrapper self-tests passed
+  exit 0
+```
+
+`src/persistence/UninstallBootstrap.ps1` 与
+`tests/persistence/UninstallBootstrap.SelfTest.ps1` 的 PowerShell parser 均为 `0 errors`；
+`git diff --check` exit 0，仅有 checkout LF/CRLF conversion warning。
+
+## 边界
+
+本报告不声明 Task 2、successor plan final gate、fresh scoped review 或 release readiness 完成。
+Tasks 5–8 继续 blocked。

From ac209f688fcee8a5d866a0f1f6fc4b6885dd9a92 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 06:23:05 +0800
Subject: [PATCH 139/187] docs: plan TaskRemoved retry review fixes

---
 .../progress.md                                      |  2 +-
 .../task-1-fix1-brief.md                             | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 .superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-1-fix1-brief.md

diff --git a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
index e3c8f23..b842093 100644
--- a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
+++ b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
@@ -17,7 +17,7 @@ Plan: `docs/superpowers/plans/2026-09-03-v2522-cross-process-retry-closure.md`
 
 ## Status
 
-Task 1: complete. RED hit the real generic session matcher; exact locked same-SID/new-session TaskRemoved recovery is implemented in `9973bfd`. Focused verification: UninstallBootstrap 40/40, ManualWrappers pass, two changed parsers 0 errors, `git diff --check` exit 0. No real system action.
+Task 1: initial implementation `9973bfd`, evidence `bf4d215`; scoped review FAIL (1 Critical, 3 Important). Fix round 1 is in progress. Required closure: include `Failed(resumePhase=TaskRemoved)` in the exact early-return state; make replacement persistence and receipt fresh; require historical wrapper SID/session consistency; replace aliasing test doubles with serialized/disk-backed read-back and failure negatives.
 
 Task 2: pending.
 
diff --git a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-1-fix1-brief.md b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-1-fix1-brief.md
new file mode 100644
index 0000000..0c56b2e
--- /dev/null
+++ b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-1-fix1-brief.md
@@ -0,0 +1,12 @@
+# Task 1 fix round 1 — failed TaskRemoved and durable freshness
+
+Read the Task 1 report and scoped review. Fix all four findings together; do not start Task 2.
+
+## Required RED -> GREEN
+
+1. Treat exact `Failed(resumePhase=TaskRemoved)` with an installed binding as the same narrowly authorized replacement-wrapper recovery profile as `TaskRemoved`. Under the existing Local uninstall -> Global AccountTransition order, revalidate fresh context and every immutable field, normalize back to TaskRemoved, persist the new wrapper binding, and return without `RunCleanup`. Same-session and new-session tests must prove zero application removal. All other Failed resume phases remain strict.
+2. Give each replacement-wrapper persistence a fresh canonical `updatedAtUtc` strictly later than the prior transaction, clear the error, and make the TaskRemoved receipt bind that timestamp. Reject an old receipt, null/empty error-code ambiguity, write no-op, write failure, stale read-back, or malformed read-back. A retry after an interrupted replacement write must converge without changing historical evidence.
+3. Require historical `wrapperUserSid == transaction.userSid` and `wrapperSessionId == transaction.sessionId` before any replacement write. Add zero-write negatives for both mutations.
+4. Add a production-shaped/disk-backed test that obtains selector/Ready/manifest/epoch/payload evidence through the real verified-runtime path, changes only the current-session seam, and uses real atomic transaction/receipt storage with independent deserialized objects. Adapter-only tests may remain for fault injection but cannot be the sole proof.
+
+Run UninstallBootstrap, ManualWrappers, changed parsers and `git diff --check`. Commit implementation and evidence separately, update the ledger/report, leave a clean tree, and request a scoped re-review. No real system/external actions and no release claim.

From bf939c682bdb32dd8aa2d19e1ed945527350cc97 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 06:37:11 +0800
Subject: [PATCH 140/187] fix: harden TaskRemoved replacement recovery

---
 src/persistence/UninstallBootstrap.ps1        | 23 ++++--
 .../UninstallBootstrap.SelfTest.ps1           | 81 ++++++++++++++++++-
 2 files changed, 92 insertions(+), 12 deletions(-)

diff --git a/src/persistence/UninstallBootstrap.ps1 b/src/persistence/UninstallBootstrap.ps1
index d5d4f1f..9ad7209 100644
--- a/src/persistence/UninstallBootstrap.ps1
+++ b/src/persistence/UninstallBootstrap.ps1
@@ -831,10 +831,13 @@ function Read-CcodUninstallBootstrapStoredReceipt {
 
 function Test-CcodUninstallBootstrapReceiptMatchesTransaction {
     param($Receipt,[Parameter(Mandatory)]$Transaction)
-    return (Test-CcodUninstallBootstrapExactProperties $Receipt @('schemaVersion','transactionId','runtimeId','runtimeGeneration','leaseEpoch','phase','updatedAtUtc','errorCode'))-and$Receipt.schemaVersion-is[int]-and$Receipt.schemaVersion-eq1-and
-        $Receipt.transactionId-is[string]-and$Receipt.transactionId-ceq$Transaction.transactionId-and$Receipt.runtimeId-is[string]-and$Receipt.runtimeId-ceq$Transaction.runtimeId-and
-        [uint64]$Receipt.runtimeGeneration-eq[uint64]$Transaction.runtimeGeneration-and[uint64]$Receipt.leaseEpoch-eq[uint64]$Transaction.leaseEpoch-and$Receipt.phase-is[string]-and$Receipt.phase-ceq$Transaction.phase-and
-        $Receipt.updatedAtUtc-is[string]-and$Receipt.updatedAtUtc-ceq$Transaction.updatedAtUtc-and[string]$Receipt.errorCode-ceq[string]$Transaction.errorCode
+    try{
+        if(-not(Test-CcodUninstallBootstrapExactProperties $Receipt @('schemaVersion','transactionId','runtimeId','runtimeGeneration','leaseEpoch','phase','updatedAtUtc','errorCode'))){return $false}
+        $errorMatches=($null-eq$Receipt.errorCode-and$null-eq$Transaction.errorCode)-or($Receipt.errorCode-is[string]-and$Transaction.errorCode-is[string]-and$Receipt.errorCode-cne''-and$Receipt.errorCode-ceq$Transaction.errorCode)
+        return $Receipt.schemaVersion-is[int]-and$Receipt.schemaVersion-eq1-and$Receipt.transactionId-is[string]-and$Receipt.transactionId-ceq$Transaction.transactionId-and$Receipt.runtimeId-is[string]-and$Receipt.runtimeId-ceq$Transaction.runtimeId-and
+            [uint64]$Receipt.runtimeGeneration-eq[uint64]$Transaction.runtimeGeneration-and[uint64]$Receipt.leaseEpoch-eq[uint64]$Transaction.leaseEpoch-and$Receipt.phase-is[string]-and$Receipt.phase-ceq$Transaction.phase-and
+            $Receipt.updatedAtUtc-is[string]-and$Receipt.updatedAtUtc-ceq$Transaction.updatedAtUtc-and$errorMatches
+    }catch{return $false}
 }
 
 function Test-CcodUninstallBootstrapStoredCompletedReceipt {
@@ -917,8 +920,8 @@ function Assert-CcodUninstallBootstrapTransaction {
         $resumeWrapperValid=$binding.resumeWrapperPid-is[int]-and$binding.resumeWrapperPid-gt0-and(Test-CcodUninstallBootstrapCanonicalUtc $binding.resumeWrapperCreationTimeUtc)-and$binding.resumeWrapperSessionId-is[int]-and$binding.resumeWrapperSessionId-ge0-and$binding.resumeWrapperUserSid-is[string]-and$binding.resumeWrapperUserSid-ceq$Transaction.userSid
         if(-not(Test-CcodUninstallBootstrapExactProperties $binding @('selectedRuntimeRoot','runtimeManifestSha256','wrapperPid','wrapperCreationTimeUtc','wrapperSessionId','wrapperUserSid','resumeWrapperPid','resumeWrapperCreationTimeUtc','resumeWrapperSessionId','resumeWrapperUserSid','resumeScriptPath','resumeScriptLength','resumeScriptSha256','resumeCommand','payloadRecords'))-or
            $binding.selectedRuntimeRoot-isnot[string]-or-not[IO.Path]::IsPathRooted($binding.selectedRuntimeRoot)-or$binding.runtimeManifestSha256-isnot[string]-or$binding.runtimeManifestSha256-cnotmatch'^[0-9a-f]{64}$'-or
-           $binding.wrapperPid-isnot[int]-or$binding.wrapperPid-lt1-or-not(Test-CcodUninstallBootstrapCanonicalUtc $binding.wrapperCreationTimeUtc)-or$binding.wrapperSessionId-isnot[int]-or$binding.wrapperSessionId-lt0-or
-           $binding.wrapperUserSid-isnot[string]-or$binding.wrapperUserSid-cnotmatch'^S-'-or$binding.resumeScriptPath-isnot[string]-or-not[IO.Path]::IsPathRooted($binding.resumeScriptPath)-or
+           $binding.wrapperPid-isnot[int]-or$binding.wrapperPid-lt1-or-not(Test-CcodUninstallBootstrapCanonicalUtc $binding.wrapperCreationTimeUtc)-or$binding.wrapperSessionId-isnot[int]-or$binding.wrapperSessionId-lt0-or$binding.wrapperSessionId-ne$Transaction.sessionId-or
+           $binding.wrapperUserSid-isnot[string]-or$binding.wrapperUserSid-cnotmatch'^S-'-or$binding.wrapperUserSid-cne$Transaction.userSid-or$binding.resumeScriptPath-isnot[string]-or-not[IO.Path]::IsPathRooted($binding.resumeScriptPath)-or
            [char[]]$binding.resumeScriptPath-ccontains[char]'"'-or[char[]]$binding.selectedRuntimeRoot-ccontains[char]'"'-or$binding.resumeScriptSha256-isnot[string]-or$binding.resumeScriptSha256-cnotmatch'^[0-9a-f]{64}$'-or
            (-not$resumeWrapperEmpty-and-not$resumeWrapperValid)-or$binding.resumeCommand-isnot[string]-or$binding.resumeCommand-cne(Get-CcodUninstallBootstrapInstalledResumeCommand -ResumeScriptPath $binding.resumeScriptPath -TransactionId $Transaction.transactionId -RuntimeRoot $binding.selectedRuntimeRoot -InstallRoot $Transaction.readyEvidence.installRoot)){
             Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_INVALID' 'Installed finalization binding is invalid' $binding
@@ -1078,7 +1081,8 @@ function Assert-CcodUninstallBootstrapInstalledTaskRemovedContext {
     )
     Assert-CcodUninstallBootstrapTransaction $Transaction -ExpectedInstallRoot $InstallRoot
     Assert-CcodUninstallBootstrapContext $FreshContext -ExpectedInstallRoot $InstallRoot
-    if($Transaction.phase-cne'TaskRemoved'-or$Transaction.resumePhase-cne'TaskRemoved'-or$null-eq$Transaction.installedBinding){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISMATCH' 'Only an exact installed TaskRemoved transaction may relax its historical session.' $Transaction}
+    $taskRemovedProfile=($Transaction.phase-ceq'TaskRemoved'-and$Transaction.resumePhase-ceq'TaskRemoved')-or($Transaction.phase-ceq'Failed'-and$Transaction.resumePhase-ceq'TaskRemoved')
+    if(-not$taskRemovedProfile-or$null-eq$Transaction.installedBinding){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISMATCH' 'Only an exact installed TaskRemoved transaction may relax its historical session.' $Transaction}
     $installer=Get-CcodUninstallBootstrapComparablePath -Path $InstallerRoot -Kind 'Installed runtime root';$install=Get-CcodUninstallBootstrapComparablePath -Path $InstallRoot -Kind 'Install root';$expectedRuntime=Get-CcodUninstallBootstrapComparablePath -Path (Join-Path (Join-Path $install 'runtime') ([string]$Transaction.runtimeId)) -Kind 'Selected runtime root'
     if($installer-cne$expectedRuntime-or(Get-CcodUninstallBootstrapComparablePath -Path ([string]$Transaction.installedBinding.selectedRuntimeRoot) -Kind 'Bound selected runtime root')-cne$expectedRuntime-or
        $Transaction.userSid-cne$FreshContext.userSid-or$Transaction.runtimeId-cne$FreshContext.runtimeId-or[uint64]$Transaction.runtimeGeneration-ne[uint64]$FreshContext.runtimeGeneration-or
@@ -1204,7 +1208,8 @@ function Invoke-CcodUninstallBootstrap {
             & $adapter.PublishTransaction $transactionRoot $transactionId $context.userSid ([bool]$replaceCompletedLocator)
             $stagePayload = $true
         } else {
-            $installedTaskRemovedCandidate=$Mode-ceq'PrepareInstalled'-and$transaction.phase-ceq'TaskRemoved'-and$transaction.resumePhase-ceq'TaskRemoved'-and$null-ne$transaction.installedBinding
+            $taskRemovedProfile=($transaction.phase-ceq'TaskRemoved'-and$transaction.resumePhase-ceq'TaskRemoved')-or($transaction.phase-ceq'Failed'-and$transaction.resumePhase-ceq'TaskRemoved')
+            $installedTaskRemovedCandidate=$Mode-ceq'PrepareInstalled'-and$taskRemovedProfile-and$null-ne$transaction.installedBinding
             if($installedTaskRemovedCandidate){
                 $installedTaskRemovedRecovery=$true
                 $freshContext=&$adapter.ValidateInvocation $InstallerRoot $InstallRoot
@@ -1218,7 +1223,9 @@ function Invoke-CcodUninstallBootstrap {
                 $binding=&$adapter.GetInstalledBinding $InstallerRoot $InstallRoot $context $WrapperIdentity $stageRoot $transaction.transactionId
                 if(-not(Test-CcodUninstallBootstrapInstalledBindingResume -Existing $transaction.installedBinding -Observed $binding)){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_MISMATCH' 'Installed wrapper binding changed during resume' $binding}
                 if($installedTaskRemovedCandidate){
+                    $now=&$adapter.GetUtcNow;if($now-isnot[DateTime]){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_WRITE_FAILED' 'Replacement wrapper clock is invalid.' $transaction.transactionId};$prior=[DateTime]::ParseExact([string]$transaction.updatedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind);$next=$now.ToUniversalTime();if($next-le$prior){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_WRITE_FAILED' 'Replacement wrapper timestamp is not strictly newer.' $transaction.transactionId}
                     $transaction.installedBinding.resumeWrapperPid=[int]$WrapperIdentity.pid;$transaction.installedBinding.resumeWrapperCreationTimeUtc=[string]$WrapperIdentity.creationTimeUtc;$transaction.installedBinding.resumeWrapperSessionId=[int]$WrapperIdentity.sessionId;$transaction.installedBinding.resumeWrapperUserSid=[string]$WrapperIdentity.userSid
+                    $transaction.phase='TaskRemoved';$transaction.resumePhase='TaskRemoved';$transaction.errorCode=$null;$transaction.updatedAtUtc=$next.ToString('o',[Globalization.CultureInfo]::InvariantCulture)
                     Assert-CcodUninstallBootstrapTransaction $transaction -ExpectedInstallRoot $InstallRoot;&$adapter.WriteTransaction $stageRoot $transaction
                     $readBack=&$adapter.ReadTransaction $transactionRoot $identity.userSid $true $InstallRoot
                     if($null-eq$readBack-or($readBack|ConvertTo-Json -Depth 16 -Compress)-cne($transaction|ConvertTo-Json -Depth 16 -Compress)){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_WRITE_FAILED' 'Replacement wrapper transaction read-back did not match.' $transaction.transactionId}
diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index 5bb887c..ceecabd 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -162,8 +162,8 @@ function New-CcodUninstallBootstrapAdapters {
             return [bool]$World.InstallRootAbsent
         }.GetNewClosure()
         GetUtcNow = {
-            return [DateTime]::Parse('2030-02-03T03:04:05Z').ToUniversalTime()
-        }
+            if($null-eq$World.PSObject.Properties['ClockReads']){$World|Add-Member -NotePropertyName ClockReads -NotePropertyValue 0};$World.ClockReads++;return [DateTime]::Parse('2030-02-03T03:04:05Z').ToUniversalTime().AddSeconds($World.ClockReads)
+        }.GetNewClosure()
     }
 }
 
@@ -182,7 +182,7 @@ function Set-CcodUninstallBootstrapFixtureDirectoryOwner {
 }
 
 function New-CcodVerifiedUninstallRuntimeFixture {
-    param([Parameter(Mandatory)][string]$InstallRoot,[switch]$AppendOnly)
+    param([Parameter(Mandatory)][string]$InstallRoot,[switch]$AppendOnly,[string]$ProjectVersion='2.5.0-uninstall-test')
     $runtimeRoot = Join-Path $InstallRoot 'runtime\pending'
     foreach ($entry in @(
         'src/persistence/UninstallBootstrap.ps1',
@@ -208,7 +208,7 @@ function New-CcodVerifiedUninstallRuntimeFixture {
         [IO.Directory]::CreateDirectory((Split-Path $destination -Parent)) | Out-Null
         [IO.File]::Copy($source,$destination,$true)
     }
-    $manifest = New-CcodRuntimeManifest -RuntimeDirectory $runtimeRoot -ProjectVersion '2.5.0-uninstall-test'
+    $manifest = New-CcodRuntimeManifest -RuntimeDirectory $runtimeRoot -ProjectVersion $ProjectVersion
     $finalRuntime = Join-Path $InstallRoot ('runtime\' + $manifest.runtimeId)
     [IO.Directory]::Move($runtimeRoot,$finalRuntime)
     [IO.File]::WriteAllText((Join-Path $finalRuntime 'manifest.json'),($manifest | ConvertTo-Json -Depth 16),[Text.UTF8Encoding]::new($false))
@@ -218,6 +218,10 @@ function New-CcodVerifiedUninstallRuntimeFixture {
     if($AppendOnly){$pointerRoot=Join-Path $InstallRoot 'state\active-generation';[IO.Directory]::CreateDirectory($pointerRoot)|Out-Null;for($generation=1;$generation-le7;$generation++){[IO.File]::WriteAllText((Join-Path $pointerRoot ('{0:D20}.json'-f$generation)),([ordered]@{schemaVersion=1;generation=[uint64]$generation;activeRuntime=$manifest.runtimeId;previousGeneration=[uint64]($generation-1)}|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))}}
     else{[IO.File]::WriteAllText((Join-Path $InstallRoot 'active.json'),([ordered]@{schemaVersion=2;activeRuntime=$manifest.runtimeId;previousRuntime=$null;generation=[uint64]7;updatedAtUtc=$timestamp}|ConvertTo-Json),[Text.UTF8Encoding]::new($false))}
     [IO.File]::WriteAllText((Join-Path $InstallRoot 'state\lifecycle-epoch.json'),([ordered]@{schemaVersion=1;epoch=[uint64]11}|ConvertTo-Json),[Text.UTF8Encoding]::new($false))
+    if($ProjectVersion-ceq'2.5.22'){
+        $transactionRoot=Join-Path $InstallRoot 'state\install-transactions';[IO.Directory]::CreateDirectory($transactionRoot)|Out-Null;$transactionId='aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee';$manifestSha=(Get-FileHash (Join-Path $finalRuntime 'manifest.json') -Algorithm SHA256).Hash.ToLowerInvariant();$phases=@('Prepared','PackageVerified','RuntimeStaged','PreviousProtectionStopped','RuntimePromoted','PointerCommitted','StableShellCommitted','ProtectionReady','Ready')
+        for($index=0;$index-lt$phases.Count;$index++){$phase=$phases[$index];$record=[pscustomobject][ordered]@{schemaVersion=1;transactionId=$transactionId;oldRuntimeId=$null;oldGeneration=$null;oldManifestSha256=$null;newRuntimeId=$manifest.runtimeId;newGeneration=[uint64]7;newManifestSha256=$manifestSha;sealedPackageSha256=('9'*64);ownedObjectNames=@($manifest.runtimeId);phase=$phase;errorCode=$null};$leaf='{0:D20}.{1:D2}.{2}.{3}.json'-f[uint64]7,$index,$phase,$transactionId;[IO.File]::WriteAllText((Join-Path $transactionRoot $leaf),($record|ConvertTo-Json -Depth 8 -Compress),[Text.UTF8Encoding]::new($false))}
+    }
     return [pscustomobject][ordered]@{RuntimeRoot=$finalRuntime;RuntimeId=$manifest.runtimeId}
 }
 
@@ -658,6 +662,39 @@ $results += Invoke-CcodTest 'same-SID new-session TaskRemoved replacement persis
     Assert-CcodEqual 'TaskRemoved' $world.Receipt.phase 'TaskRemoved replacement receipt is persisted after transaction read-back'
 }
 
+$results += Invoke-CcodTest 'disk-backed new-session replacement uses real verified runtime and independent durable read-back' {
+    $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task1-disk-'+[guid]::NewGuid().ToString('N'));$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
+    try{
+        [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$install=Join-Path $local 'CodexControlOtherDevices';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly -ProjectVersion '2.5.22';$runtimeBootstrap=Join-Path $fixture.RuntimeRoot 'src\persistence\UninstallBootstrap.ps1';$context=Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $fixture.RuntimeRoot -InstallRoot $install -InvocationPath $runtimeBootstrap
+        $identity=Get-CcodUninstallBootstrapCurrentIdentity;$process=[Diagnostics.Process]::GetCurrentProcess();try{$creation=$process.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture);$wrapper=[pscustomobject]@{pid=[int]$process.Id;creationTimeUtc=$creation;sessionId=[int]$identity.sessionId;userSid=[string]$identity.userSid}}finally{$process.Dispose()}
+        $transactionRoot=Get-CcodUninstallBootstrapDefaultTransactionRoot;$id=[guid]::NewGuid().ToString('D');$directory=New-CcodUninstallBootstrapTransactionDirectory -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid;$defaults=Get-CcodUninstallBootstrapAdapters $null;$binding=&$defaults.GetInstalledBinding $fixture.RuntimeRoot $install $context $wrapper $directory $id;$transaction=New-CcodUninstallBootstrapTransaction -Context $context -TransactionId $id -NowUtc ([DateTime]::UtcNow.AddMinutes(-1)) -InstalledBinding $binding;$transaction.phase='TaskRemoved';$transaction.resumePhase='TaskRemoved';Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory $directory -Transaction $transaction;Write-CcodUninstallBootstrapStoredReceipt -TransactionDirectory $directory -Transaction $transaction;Publish-CcodUninstallBootstrapCurrentTransaction -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid;Stage-CcodUninstallBootstrapPayload -InstallRoot $install -Context $context -TransactionDirectory $directory
+        $priorUpdated=[DateTime]::ParseExact($transaction.updatedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind);$freshSession=[int]$identity.sessionId+98;$realBinding=$defaults.GetInstalledBinding;$cleanup=[pscustomobject]@{Count=0};$diskCalls=[Collections.Generic.List[string]]::new()
+        $adapters=@{
+            ValidateInvocation={param($InstallerRoot,$InstallRoot)$diskCalls.Add('Validate');$value=Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $InstallerRoot -InstallRoot $InstallRoot -InvocationPath (Join-Path $InstallerRoot 'src\persistence\UninstallBootstrap.ps1');$copy=$value|ConvertTo-Json -Depth 16 -Compress|ConvertFrom-Json;$copy.sessionId=[int]$freshSession;$copy}.GetNewClosure()
+            GetInstalledBinding={param($InstallerRoot,$InstallRoot,$FreshContext,$WrapperIdentity,$TransactionDirectory,$TransactionId)$diskCalls.Add('Binding');$actual=[pscustomobject]@{pid=[int]$WrapperIdentity.pid;creationTimeUtc=[string]$WrapperIdentity.creationTimeUtc;sessionId=[int]$identity.sessionId;userSid=[string]$WrapperIdentity.userSid};$value=&$realBinding $InstallerRoot $InstallRoot $FreshContext $actual $TransactionDirectory $TransactionId;$value.wrapperSessionId=[int]$WrapperIdentity.sessionId;$value}.GetNewClosure()
+            RunCleanup={param($InstallerRoot,$InstallRoot,$TransactionDirectory,$Value,$Writer,$Mode)$diskCalls.Add('RunCleanup');$cleanup.Count++;throw 'DISK_TASKREMOVED_REENTERED_CLEANUP'}.GetNewClosure()
+        }
+        $replacement=[pscustomobject]@{pid=[int]$wrapper.pid;creationTimeUtc=[string]$wrapper.creationTimeUtc;sessionId=$freshSession;userSid=[string]$wrapper.userSid};try{$resumed=Invoke-CcodUninstallBootstrap -InstallerRoot $fixture.RuntimeRoot -InstallRoot $install -Mode PrepareInstalled -WrapperIdentity $replacement -Adapters $adapters}catch{throw "DISK_TASK1_DIAGNOSTIC calls=$($diskCalls-join',') id=$($_.FullyQualifiedErrorId) message=$($_.Exception.Message)"}
+        $disk=Read-CcodUninstallBootstrapStoredTransaction -TransactionRoot $transactionRoot -ExpectedUserSid $identity.userSid -IncludeCompleted -ExpectedInstallRoot $install;$receipt=Read-CcodUninstallBootstrapStoredReceipt -TransactionDirectory $directory
+        Assert-CcodTrue (-not[object]::ReferenceEquals($transaction,$disk)) 'durable transaction proof is an independently deserialized object'
+        Assert-CcodTrue ([DateTime]::ParseExact($disk.updatedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)-gt$priorUpdated) 'replacement persistence advances updatedAtUtc strictly'
+        Assert-CcodTrue (Test-CcodUninstallBootstrapReceiptMatchesTransaction -Receipt $receipt -Transaction $disk) 'disk receipt binds the fresh replacement timestamp'
+        Assert-CcodEqual $freshSession $disk.installedBinding.resumeWrapperSessionId 'disk transaction persists only the new wrapper session seam'
+        Assert-CcodEqual 0 $cleanup.Count 'real disk-backed TaskRemoved recovery never enters RunCleanup'
+    }finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path -LiteralPath $local){Remove-Item -LiteralPath $local -Recurse -Force}}
+}
+
+$results += Invoke-CcodTest 'Failed resume TaskRemoved recovers in same and new sessions without RunCleanup' {
+    $outcomes=[Collections.Generic.List[string]]::new()
+    foreach($session in @(1,99)){
+        $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=(New-CcodUninstallBootstrapTestTransaction -Phase 'Failed' -ErrorCode 'CCOD_UNINSTALL_TRANSACTION_WRITE_FAILED');Receipt=$null;ValidationError=$false;StageError=$false;CleanupError=$false;CleanupFailurePhase=$null;InstallRootAbsent=$false;StagedEntries=@();ProductRegistrationRemovals=0};$world.Transaction.resumePhase='TaskRemoved';$world.Transaction.installedBinding=New-CcodUninstallBootstrapTestInstalledBinding
+        $fresh=New-CcodUninstallBootstrapContext;$fresh.sessionId=$session;$fresh.payloadRecords=@($world.Transaction.installedBinding.payloadRecords);$adapters=New-CcodUninstallBootstrapAdapters $world;$adapters.ValidateInvocation={param($InstallerRoot,$InstallRoot)$fresh}.GetNewClosure();$adapters.GetInstalledBinding={param($InstallerRoot,$InstallRoot,$Context,$WrapperIdentity,$TransactionDirectory,$TransactionId)New-CcodUninstallBootstrapTestInstalledBinding -TransactionId $TransactionId -RuntimeRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -UserSid $WrapperIdentity.userSid -SessionId $WrapperIdentity.sessionId -WrapperPid $WrapperIdentity.pid -WrapperCreationTimeUtc $WrapperIdentity.creationTimeUtc -PayloadRecords $Context.payloadRecords}.GetNewClosure();$cleanup=[pscustomobject]@{Count=0};$adapters.RunCleanup={param($InstallerRoot,$InstallRoot,$TransactionRoot,$Transaction,$WriteTransaction,$Mode)$cleanup.Count++;throw 'FAILED_TASKREMOVED_REENTERED_CLEANUP'}.GetNewClosure();$replacement=[pscustomobject]@{pid=43;creationTimeUtc='2030-02-03T03:04:06.0000000Z';sessionId=$session;userSid='S-1-5-21-111-222-333-1001'}
+        $failure=$null;$result=$null;try{$result=Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -Mode PrepareInstalled -WrapperIdentity $replacement -Adapters $adapters}catch{$failure=$_}
+        $outcome=if($null-ne$result){[string]$result.phase}else{([string]$failure.FullyQualifiedErrorId-split',')[0]};$outcomes.Add(('{0}:{1}:cleanup={2}'-f$session,$outcome,$cleanup.Count))
+    }
+    Assert-CcodEqual '1:TaskRemoved:cleanup=0|99:TaskRemoved:cleanup=0' (@($outcomes)-join'|') 'Failed resume TaskRemoved normalizes through the same exact early-return profile in both sessions'
+}
+
 $results += Invoke-CcodTest 'new-session relaxation rejects every nonexact TaskRemoved identity without mutation' {
     foreach($kind in @('DifferentSid','Runtime','Generation','Epoch','Ready','Payload','PreTaskRemoved')){
         $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=(New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved');Receipt=$null;ValidationError=$false;StageError=$false;CleanupError=$false;CleanupFailurePhase=$null;InstallRootAbsent=$false;StagedEntries=@();ProductRegistrationRemovals=0}
@@ -681,6 +718,42 @@ $results += Invoke-CcodTest 'new-session relaxation rejects every nonexact TaskR
     }
 }
 
+$results += Invoke-CcodTest 'replacement recovery rejects historical wrapper SID and session inconsistency with zero writes' {
+    foreach($kind in @('HistoricalSid','HistoricalSession')){
+        $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=(New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved');Receipt=$null;ValidationError=$false;StageError=$false;CleanupError=$false;CleanupFailurePhase=$null;InstallRootAbsent=$false;StagedEntries=@();ProductRegistrationRemovals=0};$world.Transaction.installedBinding=New-CcodUninstallBootstrapTestInstalledBinding
+        if($kind-ceq'HistoricalSid'){$world.Transaction.installedBinding.wrapperUserSid='S-1-5-21-999-888-777-1001'}else{$world.Transaction.installedBinding.wrapperSessionId=2}
+        $fresh=New-CcodUninstallBootstrapContext;$fresh.sessionId=99;$fresh.payloadRecords=@($world.Transaction.installedBinding.payloadRecords);$adapters=New-CcodUninstallBootstrapAdapters $world;$adapters.ValidateInvocation={param($InstallerRoot,$InstallRoot)$fresh}.GetNewClosure();$adapters.GetInstalledBinding={param($InstallerRoot,$InstallRoot,$Context,$WrapperIdentity,$TransactionDirectory,$TransactionId)New-CcodUninstallBootstrapTestInstalledBinding -TransactionId $TransactionId -RuntimeRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -UserSid $WrapperIdentity.userSid -SessionId $WrapperIdentity.sessionId -WrapperPid $WrapperIdentity.pid -WrapperCreationTimeUtc $WrapperIdentity.creationTimeUtc -PayloadRecords $Context.payloadRecords}.GetNewClosure();$replacement=[pscustomobject]@{pid=43;creationTimeUtc='2030-02-03T03:04:06.0000000Z';sessionId=99;userSid='S-1-5-21-111-222-333-1001'}
+        Assert-CcodThrows {Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -Mode PrepareInstalled -WrapperIdentity $replacement -Adapters $adapters|Out-Null} 'CCOD_UNINSTALL_TRANSACTION_INVALID'
+        Assert-CcodEqual 0 @($world.Calls|Where-Object{$_-like'Write:*'-or$_-like'Receipt:*'}).Count "$kind performs zero persistence"
+        Assert-CcodEqual $null $world.Transaction.installedBinding.resumeWrapperPid "$kind adopts no replacement wrapper"
+    }
+}
+
+$results += Invoke-CcodTest 'replacement persistence rejects stale null-ambiguous no-op failed and malformed read-back' {
+    foreach($mode in @('StaleReceipt','EmptyErrorReceipt','NullReceipt','TransactionNoOp','TransactionWriteFailure','StaleTransactionReadBack','MalformedTransactionReadBack','ReceiptWriteFailure','MalformedReceipt')){
+        $transaction=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$transaction.installedBinding=New-CcodUninstallBootstrapTestInstalledBinding;$originalJson=$transaction|ConvertTo-Json -Depth 16 -Compress;$originalReceipt=[pscustomobject][ordered]@{schemaVersion=1;transactionId=$transaction.transactionId;runtimeId=$transaction.runtimeId;runtimeGeneration=[uint64]$transaction.runtimeGeneration;leaseEpoch=[uint64]$transaction.leaseEpoch;phase='TaskRemoved';updatedAtUtc=$transaction.updatedAtUtc;errorCode=$null};$store=[pscustomobject]@{TransactionJson=$originalJson;ReceiptJson=($originalReceipt|ConvertTo-Json -Depth 8 -Compress);Reads=0;Clock=0}
+        $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=$transaction;Receipt=$null;ValidationError=$false;StageError=$false;CleanupError=$false;CleanupFailurePhase=$null;InstallRootAbsent=$false;StagedEntries=@();ProductRegistrationRemovals=0};$fresh=New-CcodUninstallBootstrapContext;$fresh.sessionId=99;$fresh.payloadRecords=@($transaction.installedBinding.payloadRecords);$adapters=New-CcodUninstallBootstrapAdapters $world;$adapters.ValidateInvocation={param($InstallerRoot,$InstallRoot)$fresh}.GetNewClosure();$adapters.GetUtcNow={$store.Clock++;[DateTime]::Parse(('2030-02-03T03:04:{0:D2}Z'-f(5+$store.Clock))).ToUniversalTime()}.GetNewClosure();$adapters.GetInstalledBinding={param($InstallerRoot,$InstallRoot,$Context,$WrapperIdentity,$TransactionDirectory,$TransactionId)New-CcodUninstallBootstrapTestInstalledBinding -TransactionId $TransactionId -RuntimeRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -UserSid $WrapperIdentity.userSid -SessionId $WrapperIdentity.sessionId -WrapperPid $WrapperIdentity.pid -WrapperCreationTimeUtc $WrapperIdentity.creationTimeUtc -PayloadRecords $Context.payloadRecords}.GetNewClosure()
+        $adapters.ReadTransaction={param($Root,$Sid,$IncludeCompleted,$ExpectedRoot)$store.Reads++;if($mode-ceq'MalformedTransactionReadBack'-and$store.Reads-gt1){return [pscustomobject]@{bad='record'}};if($mode-ceq'StaleTransactionReadBack'-and$store.Reads-gt1){return $originalJson|ConvertFrom-Json};$store.TransactionJson|ConvertFrom-Json}.GetNewClosure()
+        $adapters.WriteTransaction={param($Root,$Value)if($mode-ceq'TransactionWriteFailure'){throw [Management.Automation.ErrorRecord]::new([IO.IOException]::new('transaction write failed'),'CCOD_UNINSTALL_TRANSACTION_WRITE_FAILED',[Management.Automation.ErrorCategory]::WriteError,$Value.transactionId)};if($mode-cne'TransactionNoOp'){$store.TransactionJson=$Value|ConvertTo-Json -Depth 16 -Compress}}.GetNewClosure()
+        $adapters.WriteReceipt={param($Root,$Value)if($mode-ceq'ReceiptWriteFailure'){throw [Management.Automation.ErrorRecord]::new([IO.IOException]::new('receipt write failed'),'CCOD_UNINSTALL_TRANSACTION_WRITE_FAILED',[Management.Automation.ErrorCategory]::WriteError,$Value.transactionId)};if($mode-notin@('StaleReceipt','EmptyErrorReceipt','NullReceipt','MalformedReceipt')){$receipt=[pscustomobject][ordered]@{schemaVersion=1;transactionId=$Value.transactionId;runtimeId=$Value.runtimeId;runtimeGeneration=[uint64]$Value.runtimeGeneration;leaseEpoch=[uint64]$Value.leaseEpoch;phase=$Value.phase;updatedAtUtc=$Value.updatedAtUtc;errorCode=$Value.errorCode};$store.ReceiptJson=$receipt|ConvertTo-Json -Depth 8 -Compress}}.GetNewClosure()
+        $adapters.ReadReceipt={param($Root)if($mode-ceq'NullReceipt'){return $null};if($mode-ceq'MalformedReceipt'){return [pscustomobject]@{bad='receipt'}};if($mode-ceq'EmptyErrorReceipt'){$value=$store.TransactionJson|ConvertFrom-Json;return [pscustomobject][ordered]@{schemaVersion=1;transactionId=$value.transactionId;runtimeId=$value.runtimeId;runtimeGeneration=[uint64]$value.runtimeGeneration;leaseEpoch=[uint64]$value.leaseEpoch;phase=$value.phase;updatedAtUtc=$value.updatedAtUtc;errorCode=''}};$store.ReceiptJson|ConvertFrom-Json}.GetNewClosure()
+        $replacement=[pscustomobject]@{pid=43;creationTimeUtc='2030-02-03T03:04:06.0000000Z';sessionId=99;userSid='S-1-5-21-111-222-333-1001'}
+        Assert-CcodThrows {Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -Mode PrepareInstalled -WrapperIdentity $replacement -Adapters $adapters|Out-Null} 'CCOD_UNINSTALL_TRANSACTION_WRITE_FAILED'
+        $durable=$store.TransactionJson|ConvertFrom-Json;Assert-CcodEqual 'TaskRemoved' $durable.phase "$mode never advances application cleanup";Assert-CcodEqual 1 $durable.sessionId "$mode preserves historical session";Assert-CcodEqual 42 $durable.installedBinding.wrapperPid "$mode preserves historical wrapper"
+    }
+}
+
+$results += Invoke-CcodTest 'interrupted replacement receipt write converges on an exact later retry' {
+    $transaction=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$transaction.installedBinding=New-CcodUninstallBootstrapTestInstalledBinding;$prior=[DateTime]::ParseExact($transaction.updatedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind);$store=[pscustomobject]@{TransactionJson=($transaction|ConvertTo-Json -Depth 16 -Compress);ReceiptJson=$null;FailReceipt=$true;Clock=0}
+    $world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=$transaction;Receipt=$null;ValidationError=$false;StageError=$false;CleanupError=$false;CleanupFailurePhase=$null;InstallRootAbsent=$false;StagedEntries=@();ProductRegistrationRemovals=0};$fresh=New-CcodUninstallBootstrapContext;$fresh.sessionId=99;$fresh.payloadRecords=@($transaction.installedBinding.payloadRecords);$adapters=New-CcodUninstallBootstrapAdapters $world;$adapters.ValidateInvocation={param($InstallerRoot,$InstallRoot)$fresh}.GetNewClosure();$adapters.GetUtcNow={$store.Clock++;[DateTime]::Parse(('2030-02-03T03:04:{0:D2}Z'-f(5+$store.Clock))).ToUniversalTime()}.GetNewClosure();$adapters.GetInstalledBinding={param($InstallerRoot,$InstallRoot,$Context,$WrapperIdentity,$TransactionDirectory,$TransactionId)New-CcodUninstallBootstrapTestInstalledBinding -TransactionId $TransactionId -RuntimeRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -UserSid $WrapperIdentity.userSid -SessionId $WrapperIdentity.sessionId -WrapperPid $WrapperIdentity.pid -WrapperCreationTimeUtc $WrapperIdentity.creationTimeUtc -PayloadRecords $Context.payloadRecords}.GetNewClosure();$adapters.ReadTransaction={param($Root,$Sid,$IncludeCompleted,$ExpectedRoot)$store.TransactionJson|ConvertFrom-Json}.GetNewClosure();$adapters.WriteTransaction={param($Root,$Value)$store.TransactionJson=$Value|ConvertTo-Json -Depth 16 -Compress}.GetNewClosure();$adapters.WriteReceipt={param($Root,$Value)if($store.FailReceipt){$store.FailReceipt=$false;throw [Management.Automation.ErrorRecord]::new([IO.IOException]::new('first receipt write interrupted'),'CCOD_UNINSTALL_TRANSACTION_WRITE_FAILED',[Management.Automation.ErrorCategory]::WriteError,$Value.transactionId)};$receipt=[pscustomobject][ordered]@{schemaVersion=1;transactionId=$Value.transactionId;runtimeId=$Value.runtimeId;runtimeGeneration=[uint64]$Value.runtimeGeneration;leaseEpoch=[uint64]$Value.leaseEpoch;phase=$Value.phase;updatedAtUtc=$Value.updatedAtUtc;errorCode=$Value.errorCode};$store.ReceiptJson=$receipt|ConvertTo-Json -Depth 8 -Compress}.GetNewClosure();$adapters.ReadReceipt={param($Root)if($null-eq$store.ReceiptJson){$null}else{$store.ReceiptJson|ConvertFrom-Json}}.GetNewClosure()
+    $first=[pscustomobject]@{pid=43;creationTimeUtc='2030-02-03T03:04:06.0000000Z';sessionId=99;userSid='S-1-5-21-111-222-333-1001'};Assert-CcodThrows {Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -Mode PrepareInstalled -WrapperIdentity $first -Adapters $adapters|Out-Null} 'CCOD_UNINSTALL_TRANSACTION_WRITE_FAILED'
+    $second=[pscustomobject]@{pid=44;creationTimeUtc='2030-02-03T03:04:07.0000000Z';sessionId=99;userSid='S-1-5-21-111-222-333-1001'};$result=Invoke-CcodUninstallBootstrap -InstallerRoot 'C:\install\runtime\2.5.0-uninstall-test' -InstallRoot 'C:\install' -Mode PrepareInstalled -WrapperIdentity $second -Adapters $adapters;$disk=$store.TransactionJson|ConvertFrom-Json
+    Assert-CcodEqual 'TaskRemoved' $result.phase 'retry remains at the exact external finalizer boundary'
+    Assert-CcodEqual 44 $disk.installedBinding.resumeWrapperPid 'retry replaces only the interrupted resume wrapper binding'
+    Assert-CcodTrue ([DateTime]::ParseExact($disk.updatedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)-gt$prior) 'retry persists a fresh monotonic timestamp'
+    Assert-CcodTrue (Test-CcodUninstallBootstrapReceiptMatchesTransaction -Receipt ($store.ReceiptJson|ConvertFrom-Json) -Transaction $disk) 'retry receipt binds the converged transaction'
+}
+
 $results += Invoke-CcodTest 'WrapperResume rejects PID creation session and SID mutations before waiting or reclaiming' {
     foreach($kind in @('Pid','Creation','Session','Sid')){
         $transaction=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$transaction.installedBinding=New-CcodUninstallBootstrapTestInstalledBinding;$transaction.installedBinding.resumeWrapperPid=43;$transaction.installedBinding.resumeWrapperCreationTimeUtc='2030-02-03T03:04:06.0000000Z';$transaction.installedBinding.resumeWrapperSessionId=99;$transaction.installedBinding.resumeWrapperUserSid=$transaction.userSid

From 61071515b5d3b9b2744e3c67d2f6417087d6a74a Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 06:38:04 +0800
Subject: [PATCH 141/187] docs: record TaskRemoved fix round evidence

---
 .../progress.md                               |  2 +-
 .../task-1-report.md                          | 74 +++++++++++++++++++
 2 files changed, 75 insertions(+), 1 deletion(-)

diff --git a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
index b842093..b45bfa9 100644
--- a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
+++ b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
@@ -17,7 +17,7 @@ Plan: `docs/superpowers/plans/2026-09-03-v2522-cross-process-retry-closure.md`
 
 ## Status
 
-Task 1: initial implementation `9973bfd`, evidence `bf4d215`; scoped review FAIL (1 Critical, 3 Important). Fix round 1 is in progress. Required closure: include `Failed(resumePhase=TaskRemoved)` in the exact early-return state; make replacement persistence and receipt fresh; require historical wrapper SID/session consistency; replace aliasing test doubles with serialized/disk-backed read-back and failure negatives.
+Task 1: initial implementation `9973bfd`, evidence `bf4d215`; scoped review FAIL (1 Critical, 3 Important). Fix round 1 implementation `bf939c6` addresses all four findings: exact Failed/TaskRemoved recovery, strictly fresh timestamp/receipt, historical wrapper SID/session consistency, and real disk-backed independent read-back plus failure negatives. Final focused evidence: UninstallBootstrap 45/45, ManualWrappers pass, two parsers 0 errors, `git diff --check` exit 0. Scoped fix-round re-review remains pending.
 
 Task 2: pending.
 
diff --git a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-1-report.md b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-1-report.md
index ae20c35..23f3bd4 100644
--- a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-1-report.md
+++ b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-1-report.md
@@ -91,3 +91,77 @@ powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\Manual
 
 本报告不声明 Task 2、successor plan final gate、fresh scoped review 或 release readiness 完成。
 Tasks 5–8 继续 blocked。
+
+## Fix round 1 — Failed/TaskRemoved 与 durable freshness
+
+### Review findings 与 RED
+
+scoped review 对 `9973bfd` 判定 FAIL（1 Critical、3 Important）。本轮在 production 未修改时
+得到四组有效 RED：
+
+```text
+Disk-backed real runtime:
+  ASSERT_TRUE: replacement persistence advances updatedAtUtc strictly
+
+Failed(resumePhase=TaskRemoved):
+  same session actual=CCOD_UNINSTALL_PREPARE_FAILED cleanup=1
+  new session  actual=CCOD_UNINSTALL_TRANSACTION_MISMATCH cleanup=0
+
+Historical wrapper binding:
+  HistoricalSid / HistoricalSession did not throw CCOD_UNINSTALL_TRANSACTION_INVALID
+
+Freshness:
+  stale prior TaskRemoved receipt did not throw CCOD_UNINSTALL_TRANSACTION_WRITE_FAILED
+```
+
+其中 disk-backed RED 使用真实 v2.5.22 runtime manifest、七代 append-only selector、canonical
+`Prepared -> ... -> Ready` install transaction、真实 lifecycle epoch 与完整 payload records；external
+transaction/receipt 通过 production atomic writer 写入受保护临时目录，并由 production reader 形成
+独立反序列化对象。唯一替换的是 current-session seam 和禁止误入 cleanup 的 adapter。
+
+### Fix
+
+实现提交：`bf939c6`（`fix: harden TaskRemoved replacement recovery`）。
+
+- 专用 candidate 同时接受 exact `TaskRemoved` 与 exact
+  `Failed(resumePhase=TaskRemoved)`；后者在持久化前规范化回 TaskRemoved，清空 errorCode，
+  same/new session 均不进入 `RunCleanup`。
+- 每次 replacement persistence 必须从 adapter 获取 canonical UTC，且严格晚于 prior
+  `updatedAtUtc`；transaction 与 TaskRemoved receipt 精确绑定该新 timestamp。
+- receipt 比较显式区分 `null` 与空字符串；stale/null/malformed receipt、transaction no-op、
+  transaction/receipt write failure、stale/malformed transaction read-back 均返回
+  `CCOD_UNINSTALL_TRANSACTION_WRITE_FAILED`。
+- historical `wrapperUserSid` 必须等于 transaction SID，historical `wrapperSessionId` 必须等于
+  transaction session；不一致时在任何 replacement write 前拒绝。
+- transaction write 后及 receipt write 后都从 durable adapter 重新读取；专用恢复失败不把原
+  TaskRemoved 另写成 Failed。receipt write 中断后，下一次 exact wrapper 可写入更晚 timestamp、
+  替换仅 `resumeWrapper*` 并收敛。
+
+### Fix round 1 tests
+
+新增/强化覆盖：
+
+- real disk-backed verified-runtime / transaction / receipt independent deserialization；
+- Failed/TaskRemoved same session 与 session 99 两条 early-return；
+- historical SID/session zero-write negatives；
+- DifferentSid、runtime、generation、epoch、Ready、payload、pre-TaskRemoved negatives；
+- stale receipt、empty error、null receipt、transaction no-op/write failure/stale/malformed read-back、
+  receipt write failure/malformed receipt；
+- interrupted receipt write 后的新 wrapper retry；
+- WrapperResume PID/creation/session/SID exact-wait matrix。
+
+最终无过滤验证：
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\UninstallBootstrap.SelfTest.ps1
+  Uninstall bootstrap self-tests passed: 45
+  exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ManualWrappers.SelfTest.ps1
+  Manual wrapper self-tests passed
+  exit 0
+```
+
+两个修改文件 parser 均为 `0 errors`；`git diff --check` exit 0，仅有 LF/CRLF checkout warning。
+未执行任何真实系统或外部操作。Task 2 未修改、仍 pending；本报告不作 final-gate 或 release
+readiness 声明。

From bc0441da36c0cdcc268262d328d7c55b725a0039 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 06:45:06 +0800
Subject: [PATCH 142/187] docs: accept TaskRemoved retry fix

---
 .../2026-09-03-v2522-cross-process-retry-closure/progress.md    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
index b45bfa9..85128ac 100644
--- a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
+++ b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
@@ -17,7 +17,7 @@ Plan: `docs/superpowers/plans/2026-09-03-v2522-cross-process-retry-closure.md`
 
 ## Status
 
-Task 1: initial implementation `9973bfd`, evidence `bf4d215`; scoped review FAIL (1 Critical, 3 Important). Fix round 1 implementation `bf939c6` addresses all four findings: exact Failed/TaskRemoved recovery, strictly fresh timestamp/receipt, historical wrapper SID/session consistency, and real disk-backed independent read-back plus failure negatives. Final focused evidence: UninstallBootstrap 45/45, ManualWrappers pass, two parsers 0 errors, `git diff --check` exit 0. Scoped fix-round re-review remains pending.
+Task 1: complete. Initial implementation/evidence `9973bfd..bf4d215`; fix round 1 implementation/evidence `bf939c6..6107151`. Fix-round scoped re-review: Spec Compliance PASS, Task Quality PASS, 0 Critical, 0 Important. Final focused evidence: UninstallBootstrap 45/45, ManualWrappers pass, parser 2/2, `git diff --check` exit 0. No real system action.
 
 Task 2: pending.
 

From 148f6eef54440c16fa8142f57da8f8d545311f72 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 08:02:49 +0800
Subject: [PATCH 143/187] fix: persist legacy product migration plan

---
 .../modules/InstallFileTransaction.psm1       | 123 +++++++++++--
 src/persistence/modules/InstallLifecycle.psm1 |   4 +-
 .../modules/ProductRegistration.psm1          | 170 +++++++++++++++---
 .../InstallFileTransaction.SelfTest.ps1       | 109 +++++++++--
 .../persistence/InstallLifecycle.SelfTest.ps1 |  50 +++++-
 .../ProductRegistration.SelfTest.ps1          | 132 ++++++++++++--
 6 files changed, 520 insertions(+), 68 deletions(-)

diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index b48be49..02455b1 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -10,7 +10,7 @@ function Throw-CcodInstallFileError {
 }
 
 function Initialize-CcodInstallRuntime {
-    $marker = 'CcodInstallGenerationCapabilityMarkerV5' -as [type]
+    $marker = 'CcodInstallGenerationCapabilityMarkerV6' -as [type]
     if ($null -eq $marker) {
         Add-Type -TypeDefinition @'
 using System;
@@ -19,19 +19,21 @@ using System.ComponentModel;
 using System.IO;
 using System.Runtime.CompilerServices;
 using System.Runtime.InteropServices;
+using System.Security.AccessControl;
 using System.Security.Cryptography;
+using System.Security.Principal;
 using System.Text;
 using Microsoft.Win32.SafeHandles;
 
-public sealed class CcodInstallGenerationCapabilityMarkerV5
+public sealed class CcodInstallGenerationCapabilityMarkerV6
 {
-    private CcodInstallGenerationCapabilityMarkerV5() { }
-    public static int CapabilityAbi { get { return 5; } }
+    private CcodInstallGenerationCapabilityMarkerV6() { }
+    public static int CapabilityAbi { get { return 6; } }
 }
 
-internal sealed class CcodInstallGenerationRuntimeV5 : IDisposable
+internal sealed class CcodInstallGenerationRuntimeV6 : IDisposable
 {
-    private const uint READ = 0x80000000, WRITE = 0x40000000, DELETE = 0x00010000, SYNC = 0x00100000;
+    private const uint READ = 0x80000000, WRITE = 0x40000000, DELETE = 0x00010000, READ_CONTROL = 0x00020000, WRITE_DAC = 0x00040000, WRITE_OWNER = 0x00080000, SYNC = 0x00100000;
     private const uint READ_ATTRIBUTES = 0x80, WRITE_ATTRIBUTES = 0x100, LIST_DIRECTORY = 0x1, ADD_FILE = 0x2, ADD_SUBDIRECTORY = 0x4;
     private const uint SHARE_READ = 1, SHARE_WRITE = 2, SHARE_DELETE = 4;
     private const uint OPEN = 1, CREATE = 2;
@@ -59,6 +61,8 @@ internal sealed class CcodInstallGenerationRuntimeV5 : IDisposable
     [DllImport("ntdll.dll")] private static extern int NtQueryDirectoryFile(SafeFileHandle handle,IntPtr evt,IntPtr apc,IntPtr context,out IO_STATUS_BLOCK io,IntPtr info,uint length,int infoClass,bool single,IntPtr name,bool restart);
     [DllImport("ntdll.dll")] private static extern int NtSetInformationFile(SafeFileHandle handle,out IO_STATUS_BLOCK io,IntPtr info,uint length,int infoClass);
     [DllImport("ntdll.dll")] private static extern uint RtlNtStatusToDosError(int status);
+    [DllImport("advapi32.dll", SetLastError=true)] private static extern bool GetKernelObjectSecurity(SafeFileHandle handle,int requestedInformation,byte[] securityDescriptor,uint length,out uint needed);
+    [DllImport("advapi32.dll", SetLastError=true)] private static extern bool SetKernelObjectSecurity(SafeFileHandle handle,int securityInformation,byte[] securityDescriptor);
 
     private sealed class Pin : IDisposable
     {
@@ -86,10 +90,10 @@ internal sealed class CcodInstallGenerationRuntimeV5 : IDisposable
     private bool disposed; private string cleanupError;
 
     private readonly bool stateOnly,productOnly,retryOnly;
-    private CcodInstallGenerationRuntimeV5(string installRoot,Pin root,Pin runtimeParent,bool stateOnly,bool productOnly,bool retryOnly)
+    private CcodInstallGenerationRuntimeV6(string installRoot,Pin root,Pin runtimeParent,bool stateOnly,bool productOnly,bool retryOnly)
     { this.installRoot=installRoot;this.root=root;this.runtimeParent=runtimeParent;this.stateOnly=stateOnly;this.productOnly=productOnly;this.retryOnly=retryOnly;AddPin(root);if(runtimeParent!=null)AddPin(runtimeParent); }
 
-    internal static object Open(string path,string runtimeId,out CcodInstallGenerationRuntimeV5 runtime)
+    internal static object Open(string path,string runtimeId,out CcodInstallGenerationRuntimeV6 runtime)
     {
         runtime=null;string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle rootHandle=OpenAbsoluteDirectory(full,true);Pin rootPin=null,runtimePin=null;
         try
@@ -104,30 +108,30 @@ internal sealed class CcodInstallGenerationRuntimeV5 : IDisposable
             try
             {
                 Pin generation=ValidateDirectoryPin(runtimePin,runtimeId,Path.Combine(runtimePin.Path,runtimeId),true,generationResult.Handle);generationResult.Handle=null;
-                runtime=new CcodInstallGenerationRuntimeV5(full,rootPin,runtimePin,false,false,false);rootPin=null;runtimePin=null;runtime.AddPin(generation);return generation.Token;
+                runtime=new CcodInstallGenerationRuntimeV6(full,rootPin,runtimePin,false,false,false);rootPin=null;runtimePin=null;runtime.AddPin(generation);return generation.Token;
             }
             finally { if(generationResult.Handle!=null)generationResult.Handle.Dispose(); }
         }
         catch { if(runtimePin!=null)runtimePin.Dispose();if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw; }
     }
 
-    internal static object OpenState(string path,out CcodInstallGenerationRuntimeV5 runtime)
+    internal static object OpenState(string path,out CcodInstallGenerationRuntimeV6 runtime)
     {
         runtime=null;string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle rootHandle=OpenAbsoluteDirectory(full,true);Pin rootPin=null;
-        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;runtime=new CcodInstallGenerationRuntimeV5(full,rootPin,null,true,false,false);rootPin=null;return runtime.root.Token;}
+        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;runtime=new CcodInstallGenerationRuntimeV6(full,rootPin,null,true,false,false);rootPin=null;return runtime.root.Token;}
         catch{if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw;}
     }
 
-    internal static object OpenRetry(string path,out CcodInstallGenerationRuntimeV5 runtime)
+    internal static object OpenRetry(string path,out CcodInstallGenerationRuntimeV6 runtime)
     {
         runtime=null;string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle rootHandle=OpenAbsoluteDirectory(full,true);Pin rootPin=null,runtimePin=null;
-        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;OpenResult result=OpenRelative(rootPin.Native,"runtime",LIST_DIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);try{runtimePin=ValidateDirectoryPin(rootPin,"runtime",Path.Combine(full,"runtime"),false,result.Handle);result.Handle=null;}finally{if(result.Handle!=null)result.Handle.Dispose();};runtime=new CcodInstallGenerationRuntimeV5(full,rootPin,runtimePin,false,false,true);rootPin=null;runtimePin=null;return runtime.root.Token;}catch{if(runtimePin!=null)runtimePin.Dispose();if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw;}
+        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;OpenResult result=OpenRelative(rootPin.Native,"runtime",LIST_DIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);try{runtimePin=ValidateDirectoryPin(rootPin,"runtime",Path.Combine(full,"runtime"),false,result.Handle);result.Handle=null;}finally{if(result.Handle!=null)result.Handle.Dispose();};runtime=new CcodInstallGenerationRuntimeV6(full,rootPin,runtimePin,false,false,true);rootPin=null;runtimePin=null;return runtime.root.Token;}catch{if(runtimePin!=null)runtimePin.Dispose();if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw;}
     }
 
-    internal static object OpenProduct(string path,out CcodInstallGenerationRuntimeV5 runtime)
+    internal static object OpenProduct(string path,out CcodInstallGenerationRuntimeV6 runtime)
     {
         runtime=null;string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle rootHandle=OpenAbsoluteDirectory(full,false);Pin rootPin=null,runtimePin=null;
-        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;OpenResult result=OpenRelative(rootPin.Native,"runtime",LIST_DIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);try{runtimePin=ValidateDirectoryPin(rootPin,"runtime",Path.Combine(full,"runtime"),false,result.Handle);result.Handle=null;}finally{if(result.Handle!=null)result.Handle.Dispose();};runtime=new CcodInstallGenerationRuntimeV5(full,rootPin,runtimePin,false,true,false);rootPin=null;runtimePin=null;return runtime.root.Token;}catch{if(runtimePin!=null)runtimePin.Dispose();if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw;}
+        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;OpenResult result=OpenRelative(rootPin.Native,"runtime",LIST_DIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);try{runtimePin=ValidateDirectoryPin(rootPin,"runtime",Path.Combine(full,"runtime"),false,result.Handle);result.Handle=null;}finally{if(result.Handle!=null)result.Handle.Dispose();};runtime=new CcodInstallGenerationRuntimeV6(full,rootPin,runtimePin,false,true,false);rootPin=null;runtimePin=null;return runtime.root.Token;}catch{if(runtimePin!=null)runtimePin.Dispose();if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw;}
     }
 
     private bool IsStateScope(Pin pin){for(Pin cursor=pin;cursor!=null;cursor=cursor.Parent)if(Object.ReferenceEquals(cursor.Parent,root)&&String.Equals(cursor.Leaf,"state",StringComparison.Ordinal))return true;return false;}
@@ -185,6 +189,18 @@ internal sealed class CcodInstallGenerationRuntimeV5 : IDisposable
         if(productOnly)throw new InvalidOperationException("product-only scope");Pin parent=Require(parentToken,true);ValidateCurrent(parent);if(stateOnly&&(manifest||!IsStateScope(parent)))throw new InvalidOperationException("state-only scope");if(retryOnly&&(manifest||!IsStateScope(parent)))throw new InvalidOperationException("migration-retry scope");Pin pin=CreateTemporaryFile(parent);pin.Stream.Write(bytes,0,bytes.Length);pin.Stream.Flush(true);string sha=Sha(pin.Stream);if(pin.Stream.Length!=bytes.LongLength)throw new InvalidDataException("destination mismatch");SealAndPublish(pin,leaf,bytes.LongLength,sha,manifest);return pin.Token;
     }
 
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object WriteLegacyPlan(object rootToken,string leaf,byte[] bytes)
+    {
+        if(!productOnly||bytes==null||bytes.LongLength==0||bytes.LongLength>1048576)throw new InvalidOperationException("product-only scope");Pin requestedRoot=Require(rootToken,true);ValidateCurrent(requestedRoot);if(!Object.ReferenceEquals(requestedRoot,root))throw new InvalidOperationException("product-only scope");ValidateLegacyPlanLeaf(leaf);Pin state=OpenExistingDirectory(root,"state");if(state==null)throw new InvalidOperationException("product-only scope");Pin plans=OpenOrCreateLegacyPlanDirectory(state);if(names.ContainsKey(Key(plans,leaf)))throw new Win32Exception(183);Pin pin=CreateLegacyPlanTemporaryFile(plans);pin.Stream.Write(bytes,0,bytes.Length);pin.Stream.Flush(true);SetExactLegacyPlanSecurity(pin.Native,false);ValidateExactLegacyPlanSecurity(pin.Native,false);string sha=Sha(pin.Stream);if(pin.Stream.Length!=bytes.LongLength)throw new InvalidDataException("destination mismatch");SealAndPublish(pin,leaf,bytes.LongLength,sha,false);EnsurePublishedPin(pin);return pin.Token;
+    }
+
+    [MethodImpl(MethodImplOptions.Synchronized)] internal object[] ReadLegacyPlan(object rootToken,string leaf)
+    {
+        if(!productOnly)throw new InvalidOperationException("product-only scope");Pin requestedRoot=Require(rootToken,true);ValidateCurrent(requestedRoot);if(!Object.ReferenceEquals(requestedRoot,root))throw new InvalidOperationException("product-only scope");ValidateLegacyPlanLeaf(leaf);Pin state=OpenExistingDirectory(root,"state");if(state==null)return new object[0];Pin plans=OpenExistingLegacyPlanDirectory(state);if(plans==null)return new object[0];OpenResult result;
+        try{result=OpenRelative(plans.Native,leaf,READ|READ_ATTRIBUTES|READ_CONTROL|SYNC,SHARE_READ,OPEN,NON_DIRECTORY);}catch(Win32Exception exception){if(exception.NativeErrorCode==2||exception.NativeErrorCode==3)return new object[0];throw;}FileStream stream=null;
+        try{stream=new FileStream(result.Handle,FileAccess.Read,65536,false);result.Handle=null;FILE_INFO before=Info(stream.SafeFileHandle);ValidatePlain(before,stream.SafeFileHandle);ValidateExactLegacyPlanSecurity(stream.SafeFileHandle,false);string expected=Path.Combine(plans.Path,leaf),finalPath=FinalPath(stream.SafeFileHandle);if(!SamePath(finalPath,expected)||stream.Length<=0||stream.Length>1048576)throw new InvalidDataException("legacy plan invalid");byte[] bytes=new byte[(int)stream.Length];int offset=0;while(offset<bytes.Length){int read=stream.Read(bytes,offset,bytes.Length-offset);if(read==0)throw new EndOfStreamException();offset+=read;}FILE_INFO after=Info(stream.SafeFileHandle);ValidatePlain(after,stream.SafeFileHandle);ValidateExactLegacyPlanSecurity(stream.SafeFileHandle,false);if(before.VolumeSerialNumber!=after.VolumeSerialNumber||before.FileIndexHigh!=after.FileIndexHigh||before.FileIndexLow!=after.FileIndexLow||!SamePath(FinalPath(stream.SafeFileHandle),finalPath))throw new InvalidDataException("path changed");string sha;using(SHA256 hash=SHA256.Create()){sha=BitConverter.ToString(hash.ComputeHash(bytes)).Replace("-","").ToLowerInvariant();}return new object[]{Convert.ToBase64String(bytes),sha};}finally{if(stream!=null)stream.Dispose();if(result.Handle!=null)result.Handle.Dispose();}
+    }
+
     [MethodImpl(MethodImplOptions.Synchronized)] internal object CommitPointer(object generationToken,ulong previousGeneration,string runtimeId,byte[] bytes)
     {
         if(stateOnly)throw new InvalidOperationException("state-only scope");if(productOnly)throw new InvalidOperationException("product-only scope");Pin generation=Require(generationToken,true);ValidateCurrent(generation);if(!Object.ReferenceEquals(generation.Parent,runtimeParent)||!String.Equals(generation.Leaf,runtimeId,StringComparison.Ordinal))throw new InvalidDataException("transaction scope");
@@ -247,6 +263,32 @@ internal sealed class CcodInstallGenerationRuntimeV5 : IDisposable
         finally { if(result.Handle!=null)result.Handle.Dispose(); }
     }
 
+    private Pin OpenExistingDirectory(Pin parent,string leaf)
+    {
+        Pin existing;if(names.TryGetValue(Key(parent,leaf),out existing)){ValidateCurrent(existing);return existing;}OpenResult result;
+        try{result=OpenRelative(parent.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);}catch(Win32Exception exception){if(exception.NativeErrorCode==2||exception.NativeErrorCode==3)return null;throw;}
+        try{Pin pin=ValidateDirectoryPin(parent,leaf,Path.Combine(parent.Path,leaf),false,result.Handle);result.Handle=null;AddPin(pin);return pin;}finally{if(result.Handle!=null)result.Handle.Dispose();}
+    }
+
+    private Pin OpenOrCreateLegacyPlanDirectory(Pin state)
+    {
+        const string leaf="legacy-registration-migrations";Pin existing;if(names.TryGetValue(Key(state,leaf),out existing)){ValidateCurrent(existing);ValidateExactLegacyPlanSecurity(existing.Native,true);return existing;}OpenResult result;
+        try{result=OpenRelative(state.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|READ_CONTROL|WRITE_DAC|WRITE_OWNER|DELETE|SYNC,SHARE_READ|SHARE_WRITE,CREATE,DIRECTORY|BACKUP_INTENT);}catch(Win32Exception exception){if(exception.NativeErrorCode!=80&&exception.NativeErrorCode!=183)throw;result=OpenRelative(state.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|READ_CONTROL|WRITE_DAC|WRITE_OWNER|DELETE|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);}
+        try{Pin pin=ValidateDirectoryPin(state,leaf,Path.Combine(state.Path,leaf),result.Created,result.Handle);result.Handle=null;if(result.Created)SetExactLegacyPlanSecurity(pin.Native,true);ValidateExactLegacyPlanSecurity(pin.Native,true);AddPin(pin);return pin;}finally{if(result.Handle!=null)result.Handle.Dispose();}
+    }
+
+    private Pin OpenExistingLegacyPlanDirectory(Pin state)
+    {
+        const string leaf="legacy-registration-migrations";Pin existing;if(names.TryGetValue(Key(state,leaf),out existing)){ValidateCurrent(existing);ValidateExactLegacyPlanSecurity(existing.Native,true);return existing;}OpenResult result;
+        try{result=OpenRelative(state.Native,leaf,LIST_DIRECTORY|READ_ATTRIBUTES|READ_CONTROL|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);}catch(Win32Exception exception){if(exception.NativeErrorCode==2||exception.NativeErrorCode==3)return null;throw;}
+        try{Pin pin=ValidateDirectoryPin(state,leaf,Path.Combine(state.Path,leaf),false,result.Handle);result.Handle=null;ValidateExactLegacyPlanSecurity(pin.Native,true);AddPin(pin);return pin;}finally{if(result.Handle!=null)result.Handle.Dispose();}
+    }
+
+    private static void ValidateLegacyPlanLeaf(string leaf)
+    {
+        if(leaf==null||leaf.Length!=62||leaf[20]!='.'||!leaf.EndsWith(".json",StringComparison.Ordinal))throw new InvalidOperationException("product-only scope");ulong generation;Guid transactionId;if(!UInt64.TryParse(leaf.Substring(0,20),out generation)||generation==0||!Guid.TryParseExact(leaf.Substring(21,36),"D",out transactionId)||!String.Equals(leaf,generation.ToString("D20")+"."+transactionId.ToString("D")+".json",StringComparison.Ordinal))throw new InvalidOperationException("product-only scope");
+    }
+
     private void ValidateOwnedTree(Pin directory)
     {
         ValidateCurrent(directory);foreach(string leaf in Enumerate(directory.Native)){Pin child;if(!names.TryGetValue(Key(directory,leaf),out child)||!child.Owned)throw new InvalidDataException("unknown leaf");if(child.Directory){ValidateCurrent(child);ValidateOwnedTree(child);}else{if(!child.Sealed||!child.Published)throw new InvalidDataException("unsealed leaf");EnsurePublishedPin(child);}}
@@ -265,6 +307,10 @@ internal sealed class CcodInstallGenerationRuntimeV5 : IDisposable
     {
         string temporary=".ccod."+Guid.NewGuid().ToString("N")+".tmp";OpenResult result=OpenRelative(parent.Native,temporary,READ|WRITE|DELETE|SYNC,SHARE_READ,CREATE,NON_DIRECTORY|WRITE_THROUGH);FileStream stream=null;try{stream=new FileStream(result.Handle,FileAccess.ReadWrite,65536,false);result.Handle=null;FILE_INFO info=Info(stream.SafeFileHandle);ValidatePlain(info,stream.SafeFileHandle);Pin pin=new Pin(parent,temporary,Path.Combine(parent.Path,temporary),false,true,null,stream,info);AddPin(pin);stream=null;return pin;}finally{if(stream!=null)stream.Dispose();if(result.Handle!=null)result.Handle.Dispose();}
     }
+    private Pin CreateLegacyPlanTemporaryFile(Pin parent)
+    {
+        string temporary=".ccod."+Guid.NewGuid().ToString("N")+".tmp";OpenResult result=OpenRelative(parent.Native,temporary,READ|WRITE|DELETE|READ_CONTROL|WRITE_DAC|WRITE_OWNER|SYNC,SHARE_READ,CREATE,NON_DIRECTORY|WRITE_THROUGH);FileStream stream=null;try{stream=new FileStream(result.Handle,FileAccess.ReadWrite,65536,false);result.Handle=null;FILE_INFO info=Info(stream.SafeFileHandle);ValidatePlain(info,stream.SafeFileHandle);Pin pin=new Pin(parent,temporary,Path.Combine(parent.Path,temporary),false,true,null,stream,info);AddPin(pin);stream=null;return pin;}finally{if(stream!=null)stream.Dispose();if(result.Handle!=null)result.Handle.Dispose();}
+    }
     private static ulong CurrentPointerGeneration(Pin pointer)
     {
         ulong maximum=0;foreach(string leaf in Enumerate(pointer.Native)){if(leaf.StartsWith(".ccod.",StringComparison.OrdinalIgnoreCase)&&leaf.EndsWith(".tmp",StringComparison.OrdinalIgnoreCase))continue;if(leaf.Length!=25||!leaf.EndsWith(".json",StringComparison.OrdinalIgnoreCase))throw new InvalidDataException("unknown pointer leaf");ulong value;if(!UInt64.TryParse(leaf.Substring(0,20),out value)||value==0)throw new InvalidDataException("unknown pointer leaf");if(value>maximum)maximum=value;}return maximum;
@@ -306,6 +352,19 @@ internal sealed class CcodInstallGenerationRuntimeV5 : IDisposable
     private static SafeFileHandle OpenAbsoluteDirectory(string path,bool allowWrite){uint access=LIST_DIRECTORY|READ_ATTRIBUTES|SYNC;if(allowWrite)access|=ADD_FILE|ADD_SUBDIRECTORY;SafeFileHandle handle=CreateFileW(path,access,SHARE_READ|SHARE_WRITE,IntPtr.Zero,OPEN_EXISTING,FLAG_BACKUP|FLAG_REPARSE,IntPtr.Zero);if(handle.IsInvalid)throw new Win32Exception(Marshal.GetLastWin32Error());return handle;}
     private static void ValidateCurrent(Pin pin){FILE_INFO info=Info(pin.Native);if(info.VolumeSerialNumber!=pin.Volume||(((ulong)info.FileIndexHigh<<32)|info.FileIndexLow)!=pin.Index||IsDirectory(info)!=pin.Directory||(info.FileAttributes&ATTR_REPARSE)!=0||!SamePath(FinalPath(pin.Native),pin.Path))throw new InvalidDataException("pin changed");if(!OnlyDefaultStream(pin.Native))throw new InvalidDataException("alternate stream");if(!pin.Directory&&info.NumberOfLinks!=1)throw new InvalidDataException("multi-link");}
     private static void ValidatePlain(FILE_INFO info,SafeFileHandle handle){if(IsDirectory(info))throw new InvalidDataException("file type");if((info.FileAttributes&ATTR_REPARSE)!=0)throw new InvalidDataException("reparse leaf");if(info.NumberOfLinks!=1)throw new InvalidDataException("multi-link");if(!OnlyDefaultStream(handle))throw new InvalidDataException("alternate stream");}
+    private static byte[] GetExactLegacyPlanSecurity(bool directory)
+    {
+        WindowsIdentity identity=WindowsIdentity.GetCurrent();try{SecurityIdentifier user=identity.User;if(user==null)throw new InvalidDataException("legacy plan owner unavailable");FileSystemSecurity security=directory?(FileSystemSecurity)new DirectorySecurity():(FileSystemSecurity)new FileSecurity();security.SetOwner(user);security.SetAccessRuleProtection(true,false);SecurityIdentifier[] principals=new SecurityIdentifier[]{user,new SecurityIdentifier(WellKnownSidType.LocalSystemSid,null),new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid,null)};foreach(SecurityIdentifier principal in principals){FileSystemAccessRule rule=directory?new FileSystemAccessRule(principal,FileSystemRights.FullControl,InheritanceFlags.ContainerInherit|InheritanceFlags.ObjectInherit,PropagationFlags.None,AccessControlType.Allow):new FileSystemAccessRule(principal,FileSystemRights.FullControl,AccessControlType.Allow);security.AddAccessRule(rule);}return security.GetSecurityDescriptorBinaryForm();}finally{identity.Dispose();}
+    }
+    private static byte[] ReadLegacyPlanSecurity(SafeFileHandle handle)
+    {
+        const int information=1|4;uint needed;GetKernelObjectSecurity(handle,information,null,0,out needed);int error=Marshal.GetLastWin32Error();if(needed==0||(error!=0&&error!=122))throw new Win32Exception(error);byte[] descriptor=new byte[needed];if(!GetKernelObjectSecurity(handle,information,descriptor,(uint)descriptor.Length,out needed))throw new Win32Exception(Marshal.GetLastWin32Error());return descriptor;
+    }
+    private static void SetExactLegacyPlanSecurity(SafeFileHandle handle,bool directory){byte[] descriptor=GetExactLegacyPlanSecurity(directory);if(!SetKernelObjectSecurity(handle,1|4,descriptor))throw new Win32Exception(Marshal.GetLastWin32Error());}
+    private static void ValidateExactLegacyPlanSecurity(SafeFileHandle handle,bool directory)
+    {
+        byte[] descriptor=ReadLegacyPlanSecurity(handle);RawSecurityDescriptor raw=new RawSecurityDescriptor(descriptor,0);WindowsIdentity identity=WindowsIdentity.GetCurrent();try{SecurityIdentifier user=identity.User;if(user==null||raw.Owner==null||!raw.Owner.Equals(user)||(raw.ControlFlags&ControlFlags.DiscretionaryAclProtected)==0||raw.DiscretionaryAcl==null||raw.DiscretionaryAcl.Count!=3)throw new InvalidDataException("legacy plan security");HashSet<string> expected=new HashSet<string>(StringComparer.Ordinal){user.Value,new SecurityIdentifier(WellKnownSidType.LocalSystemSid,null).Value,new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid,null).Value};AceFlags expectedFlags=directory?(AceFlags.ContainerInherit|AceFlags.ObjectInherit):AceFlags.None;foreach(GenericAce generic in raw.DiscretionaryAcl){CommonAce ace=generic as CommonAce;if(ace==null||ace.IsCallback||ace.AceQualifier!=AceQualifier.AccessAllowed||ace.AceFlags!=expectedFlags||ace.AccessMask!=(int)FileSystemRights.FullControl||ace.SecurityIdentifier==null||!expected.Remove(ace.SecurityIdentifier.Value))throw new InvalidDataException("legacy plan security");}if(expected.Count!=0)throw new InvalidDataException("legacy plan security");}finally{identity.Dispose();}
+    }
     internal static object[] ReadAuthorityFile(string path){SafeFileHandle handle=CreateFileW(path,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,IntPtr.Zero,OPEN_EXISTING,NON_DIRECTORY|FLAG_BACKUP|FLAG_REPARSE,IntPtr.Zero);if(handle.IsInvalid){int error=Marshal.GetLastWin32Error();handle.Dispose();throw new Win32Exception(error);}FileStream stream=null;try{stream=new FileStream(handle,FileAccess.Read,65536,false);handle=null;FILE_INFO before=Info(stream.SafeFileHandle);ValidatePlain(before,stream.SafeFileHandle);string finalPath=FinalPath(stream.SafeFileHandle);if(!SamePath(finalPath,path)||stream.Length<0||stream.Length>4194304)throw new InvalidDataException("authority file invalid");byte[] bytes=new byte[(int)stream.Length];int offset=0;while(offset<bytes.Length){int read=stream.Read(bytes,offset,bytes.Length-offset);if(read==0)throw new EndOfStreamException();offset+=read;}FILE_INFO after=Info(stream.SafeFileHandle);ValidatePlain(after,stream.SafeFileHandle);if(before.VolumeSerialNumber!=after.VolumeSerialNumber||before.FileIndexHigh!=after.FileIndexHigh||before.FileIndexLow!=after.FileIndexLow||!SamePath(FinalPath(stream.SafeFileHandle),finalPath))throw new InvalidDataException("path changed");string sha;using(SHA256 hash=SHA256.Create()){sha=BitConverter.ToString(hash.ComputeHash(bytes)).Replace("-","").ToLowerInvariant();}return new object[]{Convert.ToBase64String(bytes),sha};}finally{if(stream!=null)stream.Dispose();if(handle!=null)handle.Dispose();}}
     private static bool IsDirectory(FILE_INFO info){return(info.FileAttributes&ATTR_DIRECTORY)!=0;}
     private static FILE_INFO Info(SafeFileHandle handle){FILE_INFO info;if(handle==null||handle.IsClosed||!GetFileInformationByHandle(handle,out info))throw new Win32Exception(Marshal.GetLastWin32Error());return info;}
@@ -319,10 +378,10 @@ internal sealed class CcodInstallGenerationRuntimeV5 : IDisposable
     private static int RenameReplacing(SafeFileHandle source,SafeFileHandle parent,string destination){byte[] name=Encoding.Unicode.GetBytes(destination);int rootOffset=IntPtr.Size,lengthOffset=rootOffset+IntPtr.Size,nameOffset=lengthOffset+4,size=nameOffset+name.Length+2;IntPtr buffer=Marshal.AllocHGlobal(size);bool parentAdded=false,sourceAdded=false;try{source.DangerousAddRef(ref sourceAdded);parent.DangerousAddRef(ref parentAdded);for(int i=0;i<size;i++)Marshal.WriteByte(buffer,i,0);Marshal.WriteByte(buffer,0,1);Marshal.WriteIntPtr(buffer,rootOffset,parent.DangerousGetHandle());Marshal.WriteInt32(buffer,lengthOffset,name.Length);Marshal.Copy(name,0,IntPtr.Add(buffer,nameOffset),name.Length);IO_STATUS_BLOCK io;int status=NtSetInformationFile(source,out io,buffer,(uint)size,FileRenameInformation);return status>=0?0:(int)RtlNtStatusToDosError(status);}finally{if(parentAdded)parent.DangerousRelease();if(sourceAdded)source.DangerousRelease();Marshal.FreeHGlobal(buffer);}}
 }
 '@
-        $marker = 'CcodInstallGenerationCapabilityMarkerV5' -as [type]
+        $marker = 'CcodInstallGenerationCapabilityMarkerV6' -as [type]
     }
-    if ($null -eq $marker -or [int]$marker.GetProperty('CapabilityAbi').GetValue($null,$null) -ne 5) { Throw-CcodInstallFileError 'CCOD_INSTALL_RUNTIME_ABI_INVALID' 'Install generation runtime ABI is unavailable' $null }
-    $script:CcodRuntimeType = $marker.Assembly.GetType('CcodInstallGenerationRuntimeV5',$true)
+    if ($null -eq $marker -or [int]$marker.GetProperty('CapabilityAbi').GetValue($null,$null) -ne 6) { Throw-CcodInstallFileError 'CCOD_INSTALL_RUNTIME_ABI_INVALID' 'Install generation runtime ABI is unavailable' $null }
+    $script:CcodRuntimeType = $marker.Assembly.GetType('CcodInstallGenerationRuntimeV6',$true)
 }
 
 function Assert-CcodInstallLeaf([string]$Leaf,[string]$ErrorId='CCOD_INSTALL_LEAF_INVALID') {
@@ -486,6 +545,32 @@ function Assert-CcodInstallProductCleanupFenceBound($State){
     if(($record|ConvertTo-Json -Depth 8 -Compress)-cne$proof.Canonical-or$record.state-cne'Pending'){Throw-CcodInstallFileError 'CCOD_INSTALL_CLOSE_FAILED' 'Durable Pending cleanup fence changed before close' $proof.Path}
     return $true
 }
+function Get-CcodInstallLegacyMigrationPlanScope($Transaction,$ReadyTransaction){
+    $scope=Get-CcodInstallTransaction $Transaction 'CCOD_INSTALL_PRODUCT_SCOPE'
+    if(-not[object]::ReferenceEquals($scope.Record.Transaction,$Transaction)-or$scope.Record.Kind-cne'ProductTransaction'-or-not$scope.State.ProductOnly){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Legacy migration plan requires the strict product transaction root' $null}
+    [void](Assert-CcodInstallProductAuthorityLease $scope.State)
+    try{[void](Assert-CcodInstallProductCleanupFenceBound $scope.State);$authority=Get-CcodInstallProductReadyAuthority $scope.State.InstallRoot $ReadyTransaction}catch{if(([string]$_.FullyQualifiedErrorId-split',')[0]-ceq'CCOD_INSTALL_PRODUCT_SCOPE'){throw};Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Legacy migration plan requires the live cleanup fence and Ready authority' $null}
+    $stored=$scope.State.ReadyAuthority
+    if($null-eq$stored-or$authority.ReadyCanonical-cne$stored.ReadyCanonical-or$authority.PersistedReadyCanonical-cne$stored.PersistedReadyCanonical-or$authority.RuntimeId-cne$stored.RuntimeId-or[uint64]$authority.Generation-ne[uint64]$stored.Generation-or$authority.ManifestSha256-cne$stored.ManifestSha256-or$authority.PackageSha256-cne$stored.PackageSha256){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Legacy migration plan Ready authority changed after capability open' $ReadyTransaction}
+    [pscustomobject]@{Scope=$scope;Leaf=('{0:D20}.{1}.json'-f[uint64]$authority.Generation,[string]$ReadyTransaction.transactionId)}
+}
+function Write-CcodInstallLegacyMigrationPlan {
+    param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ReadyTransaction,[Parameter(Mandatory)][byte[]]$Bytes)
+    if($null-eq$Bytes-or$Bytes.LongLength-eq0-or$Bytes.LongLength-gt1048576){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Legacy migration plan bytes are outside the bounded contract' $null}
+    $context=Get-CcodInstallLegacyMigrationPlanScope $Transaction $ReadyTransaction;$result=[pscustomobject]@{Length=[int64]$Bytes.LongLength;Sha256=(Get-CcodInstallBytesSha256 $Bytes)}
+    try{Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $context.Scope.State.Runtime WriteLegacyPlan @($context.Scope.State.RootToken,$context.Leaf,$Bytes)|Out-Null} 'CCOD_INSTALL_LEGACY_PLAN_WRITE_FAILED'}catch{if($_.FullyQualifiedErrorId-like'CCOD_INSTALL_LEAF_EXISTS*'){Throw-CcodInstallFileError 'CCOD_INSTALL_LEGACY_PLAN_EXISTS' 'Legacy migration plan already exists' $context.Leaf};throw}
+    return $result
+}
+function Read-CcodInstallLegacyMigrationPlan {
+    param([Parameter(Mandatory)]$Transaction,[Parameter(Mandatory)]$ReadyTransaction)
+    $context=Get-CcodInstallLegacyMigrationPlanScope $Transaction $ReadyTransaction
+    try{$native=@(Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $context.Scope.State.Runtime ReadLegacyPlan @($context.Scope.State.RootToken,$context.Leaf)} 'CCOD_INSTALL_LEGACY_PLAN_READ_FAILED')}catch{$id=([string]$_.FullyQualifiedErrorId-split',')[0];if($id-in@('CCOD_INSTALL_PRODUCT_SCOPE','CCOD_INSTALL_TRANSACTION_CLOSED')){throw};Throw-CcodInstallFileError 'CCOD_INSTALL_LEGACY_PLAN_READ_FAILED' 'Legacy migration plan file identity or security is invalid' $context.Leaf}
+    if($native.Count-eq0){return $null}
+    if($native.Count-ne2-or$native[0]-isnot[string]-or$native[1]-isnot[string]-or$native[1]-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_LEGACY_PLAN_READ_FAILED' 'Legacy migration plan native read result is invalid' $context.Leaf}
+    try{$bytes=[Convert]::FromBase64String([string]$native[0])}catch{Throw-CcodInstallFileError 'CCOD_INSTALL_LEGACY_PLAN_READ_FAILED' 'Legacy migration plan native bytes are invalid' $context.Leaf}
+    if($bytes.LongLength-eq0-or$bytes.LongLength-gt1048576-or(Get-CcodInstallBytesSha256 $bytes)-cne[string]$native[1]){Throw-CcodInstallFileError 'CCOD_INSTALL_LEGACY_PLAN_READ_FAILED' 'Legacy migration plan native identity is invalid' $context.Leaf}
+    [pscustomobject]@{Bytes=$bytes;Length=[int64]$bytes.LongLength;Sha256=[string]$native[1]}
+}
 function Open-CcodInstallRetainedFile {
     param([Parameter(Mandatory)]$Generation,[Parameter(Mandatory)][string]$RelativePath,[Parameter(Mandatory)]$ReadyTransaction)
     if($RelativePath-cnotin@('registration/StartMenu.CodexRemote-fix.lnk','registration/Desktop.CodexRemote-fix.lnk')){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Product shortcut source must be one fixed manifest-relative candidate' $RelativePath};$scope=Get-CcodInstallTransaction $Generation 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';[void](Assert-CcodInstallProductAuthorityLease $scope.State);$authority=Get-CcodInstallProductReadyAuthority $scope.State.InstallRoot $ReadyTransaction;$stored=$scope.State.ReadyAuthority;if($null-eq$stored-or$authority.ReadyCanonical-cne$stored.ReadyCanonical-or$authority.PersistedReadyCanonical-cne$stored.PersistedReadyCanonical-or$authority.RuntimeId-cne$stored.RuntimeId-or$authority.Generation-ne$stored.Generation-or$authority.ManifestSha256-cne$stored.ManifestSha256-or$authority.PackageSha256-cne$stored.PackageSha256-or$authority.RuntimeId-cne$scope.Record.RuntimeId){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SCOPE' 'Retained shortcut source authority changed after capability open' $ReadyTransaction};$result=Convert-CcodInstallRuntimeError {Invoke-CcodRuntimeMethod $scope.State.Runtime OpenRetainedFile @($scope.Record.Token,$RelativePath)} 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID';if(@($result).Count-ne3-or[int64]$result[1]-lt0-or[string]$result[2]-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodInstallFileError 'CCOD_INSTALL_PRODUCT_SHORTCUT_INVALID' 'Retained product shortcut identity is invalid' $RelativePath};Add-CcodInstallScope $scope.Record.Transaction $result[0] RetainedFile $true $scope.Record.RuntimeId
@@ -532,4 +617,4 @@ function Close-CcodInstallFileTransaction {
 }
 
 Initialize-CcodInstallRuntime
-Export-ModuleMember -Function Open-CcodInstallGeneration,Open-CcodInstallStateTransaction,Open-CcodInstallProductRegistrationTransaction,Open-CcodInstallRetainedGeneration,Open-CcodInstallRetainedFile,New-CcodInstallDirectory,New-CcodInstallGenerationLeaf,Copy-CcodInstallSealedSource,Write-CcodInstallGenerationManifest,Write-CcodInstallRecord,Commit-CcodInstallActivePointer,Retire-CcodInstallGeneration,Open-CcodInstallProductSpecialFolder,Copy-CcodInstallProductShortcut,Close-CcodInstallFileTransaction
+Export-ModuleMember -Function Open-CcodInstallGeneration,Open-CcodInstallStateTransaction,Open-CcodInstallProductRegistrationTransaction,Open-CcodInstallRetainedGeneration,Open-CcodInstallRetainedFile,New-CcodInstallDirectory,New-CcodInstallGenerationLeaf,Copy-CcodInstallSealedSource,Write-CcodInstallGenerationManifest,Write-CcodInstallLegacyMigrationPlan,Read-CcodInstallLegacyMigrationPlan,Write-CcodInstallRecord,Commit-CcodInstallActivePointer,Retire-CcodInstallGeneration,Open-CcodInstallProductSpecialFolder,Copy-CcodInstallProductShortcut,Close-CcodInstallFileTransaction
diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index f33da70..08c2453 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -2895,7 +2895,9 @@ function Get-CcodLifecycleAdapters {
                     $registration=New-CcodProductRegistration -InstallRoot $InstallRoot -RuntimeId $RuntimeId -Version $Version -PackageSha256 $PackageSha256 -FileTransaction $sourceCapability
                     $system=[Environment]::GetFolderPath([Environment+SpecialFolder]::System);$proof=[pscustomobject][ordered]@{phase=[string]$TransactionRecord.phase;runtimeId=$RuntimeId;version=$Version;packageSha256=$PackageSha256;runtimeGeneration=[uint64]$TransactionRecord.newGeneration;manifestSha256=[string]$TransactionRecord.newManifestSha256;startMenuSha256=(Get-CcodLifecycleFileSha256 $registration.startMenuShortcut.candidatePath);desktopSha256=(Get-CcodLifecycleFileSha256 $registration.desktopShortcut.candidatePath);targetPath=[IO.Path]::GetFullPath((Join-Path $system 'schtasks.exe'));arguments='/Run /TN "Codex Control Other Devices Supervisor"';transactionRecord=$TransactionRecord;bootstrapPath=$registration.bootstrapPath;uninstallerPath=$registration.uninstallerPath}
                     $commitAdapters=@{};if($null-ne$ProductAdapters){if($ProductAdapters-isnot[hashtable]){throw 'product side-effect adapters invalid'};foreach($key in $ProductAdapters.Keys){$commitAdapters[$key]=$ProductAdapters[$key]}};$commitAdapters.GetReadyProof={param($Ignored)$proof}.GetNewClosure()
-                    $legacyMigrationPlan=Get-CcodLegacyProductRegistrationMigrationPlan -ExpectedAppId '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}' -ExpectedInstallRoot $InstallRoot -Adapters $ProductAdapters
+                    $commitAdapters.ReadLegacyMigrationPlan={param($ReadyEvidence)&$fileModule {param($Transaction,$Record)Read-CcodInstallLegacyMigrationPlan -Transaction $Transaction -ReadyTransaction $Record} $ownedTransaction $ReadyEvidence.transactionRecord}.GetNewClosure()
+                    $commitAdapters.WriteLegacyMigrationPlan={param($ReadyEvidence,[byte[]]$Bytes)&$fileModule {param($Transaction,$Record,[byte[]]$Value)Write-CcodInstallLegacyMigrationPlan -Transaction $Transaction -ReadyTransaction $Record -Bytes $Value} $ownedTransaction $ReadyEvidence.transactionRecord $Bytes}.GetNewClosure()
+                    $legacyMigrationPlan=Get-CcodDurableLegacyProductRegistrationMigrationPlan -ExpectedAppId '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}' -Registration $registration -ReadyEvidence $proof -Adapters $commitAdapters
                     $receipt=Commit-CcodProductRegistration -Registration $registration -FileTransaction $sourceCapability -Adapters $commitAdapters
                     $expectedCurrentProof=[pscustomobject][ordered]@{verified=$true;runtimeId=$RuntimeId;version=$Version;packageSha256=$PackageSha256;shortcutNames=@('Programs\CodexRemote-fix\CodexRemote-fix.lnk','Desktop\CodexRemote-fix.lnk');startMenuSha256=[string]$proof.startMenuSha256;desktopSha256=[string]$proof.desktopSha256}
                     Remove-CcodLegacyProductRegistration -ExpectedAppId '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}' -MigrationPlan $legacyMigrationPlan -ExpectedCurrentProof $expectedCurrentProof -Adapters $ProductAdapters
diff --git a/src/persistence/modules/ProductRegistration.psm1 b/src/persistence/modules/ProductRegistration.psm1
index 22bc463..72b7d6c 100644
--- a/src/persistence/modules/ProductRegistration.psm1
+++ b/src/persistence/modules/ProductRegistration.psm1
@@ -13,6 +13,10 @@ $script:CcodLegacyRegistrationFields = @('appId','displayVersion','installLocati
 $script:CcodLegacyProfileFields = @('profileId','appId','minimumVersion','maximumVersion','uninstallCommandShape','shortcutNames')
 $script:CcodLegacyMigrationPlanFields = @('appId','expectedInstallRoot','legacyPresent','legacyRegistration','profile','snapshot')
 $script:CcodLegacyShortcutSnapshotFields = @('kind','name','path','sha256','bytesBase64','targetPath','arguments','workingDirectory')
+$script:CcodDurableLegacyMigrationFields = @('schemaVersion','transactionId','runtimeId','runtimeGeneration','manifestSha256','packageSha256','readyTransaction','appId','expectedInstallRoot','legacyPresent','legacyRegistration','profile','snapshot','expectedCurrentProof')
+$script:CcodDurableCurrentProofFields = @('version','runtimeId','packageSha256','shortcuts')
+$script:CcodDurableCurrentShortcutFields = @('kind','name','path','candidatePath','candidateLength','candidateSha256','targetPath','arguments','workingDirectory')
+$script:CcodReadyTransactionFields = @('schemaVersion','transactionId','oldRuntimeId','oldGeneration','oldManifestSha256','newRuntimeId','newGeneration','newManifestSha256','sealedPackageSha256','ownedObjectNames','phase','errorCode')
 $script:CcodVerifiedRegistrationFields = @('verified','runtimeId','version','packageSha256','shortcutNames','startMenuSha256','desktopSha256')
 $script:CcodCurrentShortcutNames = @('Programs\CodexRemote-fix\CodexRemote-fix.lnk','Desktop\CodexRemote-fix.lnk')
 $script:CcodLegacyRegistryValueNames=@('DisplayName','DisplayVersion','UninstallString','QuietUninstallString','DisplayIcon','InstallLocation','Publisher','URLInfoAbout','HelpLink','URLUpdateInfo','NoModify','NoRepair','InstallDate','MajorVersion','MinorVersion','VersionMajor','VersionMinor','EstimatedSize','Language','Inno Setup: App Path','Inno Setup: Icon Group','Inno Setup: Setup Version','Inno Setup: User')
@@ -223,7 +227,10 @@ function Get-CcodProductRegistrationAdapters {
         RemoveLegacyRegistration = { param($ExpectedAppId,$ExpectedShortcutNames) Remove-CcodCurrentUserLegacyRegistration -ExpectedAppId $ExpectedAppId -ExpectedShortcutNames $ExpectedShortcutNames }
         ReadCurrentProductState = { param($ExpectedRuntimeId) Read-CcodCurrentProductState -ExpectedRuntimeId $ExpectedRuntimeId }
         RemoveCurrentProductEntry = { param($Entry) Remove-CcodCurrentProductEntry -Entry $Entry }
-        ReadLegacySnapshot = { param($ExpectedAppId,$ExpectedProfile) Read-CcodLegacySnapshot -ExpectedAppId $ExpectedAppId -ExpectedProfile $ExpectedProfile }
+        ReadLegacySnapshot = { param($ExpectedAppId,$ExpectedProfile,$CapturedPlan) Read-CcodLegacySnapshot -ExpectedAppId $ExpectedAppId -ExpectedProfile $ExpectedProfile -CapturedPlan $CapturedPlan }
+        GetCurrentShortcutProof = { param($Kind,$Shortcut,$ReadyEvidence) Get-CcodCurrentShortcutProof -Kind $Kind -Shortcut $Shortcut -ReadyEvidence $ReadyEvidence }
+        ReadLegacyMigrationPlan = { param($ReadyEvidence) Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'No durable legacy migration plan reader was supplied.' $ReadyEvidence.runtimeId }
+        WriteLegacyMigrationPlan = { param($ReadyEvidence,[byte[]]$Bytes) Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'No durable legacy migration plan writer was supplied.' $ReadyEvidence.runtimeId }
         RemoveLegacyEntry = { param($Entry) Remove-CcodLegacySnapshotEntry -Entry $Entry }
         ReadLegacyEntry = { param($Entry) Read-CcodLegacySnapshotEntry -Entry $Entry }
         RestoreLegacyEntry = { param($Entry) Restore-CcodLegacySnapshotEntry -Entry $Entry }
@@ -344,6 +351,18 @@ function Read-CcodCurrentUserProductShortcut {
     $item=Get-Item -LiteralPath $destination -Force -ErrorAction Stop;if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0-or(Get-CcodProductFileSha256 $destination)-cne(Get-CcodProductFileSha256 $source)){return $null}
     $Shortcut
 }
+function Get-CcodCurrentShortcutProof {
+    param([Parameter(Mandatory)][ValidateSet('StartMenu','Desktop')][string]$Kind,[Parameter(Mandatory)]$Shortcut,[Parameter(Mandatory)]$ReadyEvidence)
+    $candidate=[IO.Path]::GetFullPath([string]$Shortcut.candidatePath);$item=Get-Item -LiteralPath $candidate -Force -ErrorAction Stop
+    if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0-or$item.Length-le0-or$item.Length-gt262144){throw 'current shortcut candidate is unsafe'}
+    $shell=$null;$link=$null
+    try{
+        $shell=New-Object -ComObject WScript.Shell;$link=$shell.CreateShortcut($candidate);$target=[IO.Path]::GetFullPath([string]$link.TargetPath);$arguments=[string]$link.Arguments;$working=[string]$link.WorkingDirectory
+        if(-not[string]::IsNullOrEmpty($working)){$working=[IO.Path]::GetFullPath($working).TrimEnd('\')}
+    }finally{if($null-ne$link){[void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($link)};if($null-ne$shell){[void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($shell)}}
+    $name=if($Kind-ceq'StartMenu'){$script:CcodCurrentShortcutNames[0]}else{$script:CcodCurrentShortcutNames[1]}
+    [pscustomobject][ordered]@{kind=$Kind;name=$name;path=(Get-CcodLegacyShortcutPath -RelativeName $name);candidatePath=$candidate;candidateLength=[int64]$item.Length;candidateSha256=(Get-CcodProductFileSha256 $candidate);targetPath=$target;arguments=$arguments;workingDirectory=$working}
+}
 function Get-CcodLegacyShortcutPath {
     param([Parameter(Mandatory)][string]$RelativeName)
     if($RelativeName.StartsWith('Programs\',[StringComparison]::Ordinal)){$base=[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs);$relative=$RelativeName.Substring(9)}
@@ -628,7 +647,7 @@ function Test-CcodLegacyShortcutSnapshotEntry {
         $sha=[Security.Cryptography.SHA256]::Create()
         try{$capturedHash=[BitConverter]::ToString($sha.ComputeHash($bytes)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()}
     }catch{return $false}
-    return $actualPath-cne$null-and$actualPath-ceq$expectedPath-and$target-ceq$expectedTarget-and
+    return $bytes.LongLength-gt0-and$bytes.LongLength-le262144-and$actualPath-cne$null-and$actualPath-ceq$expectedPath-and$target-ceq$expectedTarget-and
         [string]$Entry.arguments-ceq[string]$contract.arguments-and$working-ceq$expectedWorking-and$capturedHash-ceq[string]$Entry.sha256
 }
 
@@ -671,30 +690,139 @@ function Get-CcodLegacyProductRegistrationMigrationPlan {
     return $plan
 }
 
+function Test-CcodProductJsonHasNoDuplicateProperties {
+    param([AllowNull()][string]$Json)
+    if($null-eq$Json){return $false};$objects=[Collections.Generic.Stack[object]]::new()
+    for($index=0;$index-lt$Json.Length;$index++){
+        $character=$Json[$index]
+        if($character-ceq'{'){$objects.Push([Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal));continue}
+        if($character-ceq'}'){if($objects.Count-eq0){return $false};[void]$objects.Pop();continue}
+        if($character-cne'"'){continue}
+        $name=[Text.StringBuilder]::new();$index++
+        while($index-lt$Json.Length){$character=$Json[$index];if($character-ceq'"'){break};if($character-cne[char]92){[void]$name.Append($character);$index++;continue};$index++;if($index-ge$Json.Length){return $false};$escape=$Json[$index];if($escape-ceq'u'){if($index+4-ge$Json.Length){return $false};try{[void]$name.Append([char][Convert]::ToInt32($Json.Substring($index+1,4),16))}catch{return $false};$index+=5;continue};switch([string]$escape){'"'{$decoded='"'};'\'{$decoded=[char]92};'/'{$decoded='/'};'b'{$decoded=[char]8};'f'{$decoded=[char]12};'n'{$decoded=[char]10};'r'{$decoded=[char]13};'t'{$decoded=[char]9};default{return $false}};[void]$name.Append($decoded);$index++}
+        if($index-ge$Json.Length){return $false};$next=$index+1;while($next-lt$Json.Length-and[char]::IsWhiteSpace($Json[$next])){$next++};if($next-lt$Json.Length-and$Json[$next]-ceq':'){if($objects.Count-eq0-or-not$objects.Peek().Add($name.ToString())){return $false}}
+    }
+    return $objects.Count-eq0
+}
+
+function Test-CcodProductUnsignedInteger($Value){return ($Value-is[byte]-or$Value-is[uint16]-or$Value-is[uint32]-or$Value-is[uint64]-or$Value-is[int16]-or$Value-is[int32]-or$Value-is[int64])-and[decimal]$Value-ge0}
+function Test-CcodDurableReadyEvidence($ReadyEvidence,$Registration){if($null-eq$ReadyEvidence-or-not(Test-CcodProductExactProperties $ReadyEvidence.transactionRecord $script:CcodReadyTransactionFields)-or-not(Test-CcodProductUnsignedInteger $ReadyEvidence.runtimeGeneration)-or[uint64]$ReadyEvidence.runtimeGeneration-eq0){return $false};$transaction=$ReadyEvidence.transactionRecord;$guid=[guid]::Empty;if($transaction.schemaVersion-isnot[int]-or$transaction.schemaVersion-ne1-or$transaction.transactionId-isnot[string]-or-not[guid]::TryParseExact([string]$transaction.transactionId,'D',[ref]$guid)-or$guid.ToString('D')-cne[string]$transaction.transactionId-or$transaction.phase-isnot[string]-or$transaction.phase-cne'Ready'-or$transaction.newRuntimeId-isnot[string]-or$transaction.newRuntimeId-cne$Registration.runtimeId-or-not(Test-CcodProductUnsignedInteger $transaction.newGeneration)-or[uint64]$transaction.newGeneration-ne[uint64]$ReadyEvidence.runtimeGeneration-or$transaction.newManifestSha256-isnot[string]-or$transaction.newManifestSha256-cne[string]$ReadyEvidence.manifestSha256-or$transaction.sealedPackageSha256-isnot[string]-or$transaction.sealedPackageSha256-cne[string]$ReadyEvidence.packageSha256-or$transaction.sealedPackageSha256-cne$Registration.packageSha256-or-not(Test-CcodProductExactStringSet $transaction.ownedObjectNames $transaction.ownedObjectNames)-or@($transaction.ownedObjectNames)-cnotcontains[string]$Registration.runtimeId){return $false};return $true}
+function Get-CcodProductMapNames($Value){if($Value-is[Collections.IDictionary]){return @($Value.Keys)};if($Value-is[pscustomobject]){return @($Value.PSObject.Properties.Name)};return @()}
+function Get-CcodProductMapValue($Value,[string]$Name){if($Value-is[Collections.IDictionary]){return $Value[$Name]};if($Value-is[pscustomobject]){return ($Value.PSObject.Properties|Where-Object Name -CEQ $Name|Select-Object -First 1).Value};return $null}
+function ConvertTo-CcodProductOrderedMap($Value){$result=[ordered]@{};foreach($name in @(Get-CcodProductMapNames $Value)){$result[[string]$name]=Get-CcodProductMapValue $Value ([string]$name)};return $result}
+function Get-CcodDurableCurrentShortcutProof($Proof,[string]$Name){foreach($entry in @($Proof.shortcuts)){if($entry.name-is[string]-and[string]$entry.name-ceq$Name){return $entry}};return $null}
+
+function Assert-CcodDurableCurrentProof {
+    param([Parameter(Mandatory)]$Proof,[Parameter(Mandatory)]$Registration,[Parameter(Mandatory)]$ReadyEvidence)
+    if(-not(Test-CcodProductExactProperties $Proof $script:CcodDurableCurrentProofFields)-or$Proof.version-isnot[string]-or$Proof.version-cne$Registration.version-or$Proof.runtimeId-isnot[string]-or$Proof.runtimeId-cne$Registration.runtimeId-or$Proof.packageSha256-isnot[string]-or$Proof.packageSha256-cne$Registration.packageSha256-or@($Proof.shortcuts).Count-ne2){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable current shortcut proof identity is invalid.' $Proof}
+    for($index=0;$index-lt2;$index++){
+        $entry=@($Proof.shortcuts)[$index];$kind=if($index-eq0){'StartMenu'}else{'Desktop'};$name=$script:CcodCurrentShortcutNames[$index];$shortcut=if($index-eq0){$Registration.startMenuShortcut}else{$Registration.desktopShortcut};$sha=if($index-eq0){[string]$ReadyEvidence.startMenuSha256}else{[string]$ReadyEvidence.desktopSha256}
+        if(-not(Test-CcodProductExactProperties $entry $script:CcodDurableCurrentShortcutFields)-or$entry.kind-isnot[string]-or$entry.kind-cne$kind-or$entry.name-isnot[string]-or$entry.name-cne$name-or$entry.path-isnot[string]-or$entry.candidatePath-isnot[string]-or-not(Test-CcodProductUnsignedInteger $entry.candidateLength)-or[uint64]$entry.candidateLength-eq0-or[uint64]$entry.candidateLength-gt262144-or$entry.candidateSha256-isnot[string]-or$entry.candidateSha256-cne$sha-or$entry.targetPath-isnot[string]-or$entry.arguments-isnot[string]-or$entry.arguments-cne[string]$ReadyEvidence.arguments-or$entry.workingDirectory-isnot[string]){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable current shortcut proof is incomplete.' $entry}
+        try{$path=[IO.Path]::GetFullPath([string]$entry.path);$candidate=[IO.Path]::GetFullPath([string]$entry.candidatePath);$target=[IO.Path]::GetFullPath([string]$entry.targetPath);$expectedPath=Get-CcodLegacyShortcutPath -RelativeName $name;$expectedCandidate=[IO.Path]::GetFullPath([string]$shortcut.candidatePath);$expectedTarget=[IO.Path]::GetFullPath([string]$ReadyEvidence.targetPath);$working=if([string]::IsNullOrEmpty([string]$entry.workingDirectory)){''}else{[IO.Path]::GetFullPath([string]$entry.workingDirectory).TrimEnd('\')}}catch{Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable current shortcut paths are invalid.' $entry}
+        if($path-cne[string]$entry.path-or$path-cne$expectedPath-or$candidate-cne[string]$entry.candidatePath-or$candidate-cne$expectedCandidate-or$target-cne[string]$entry.targetPath-or$target-cne$expectedTarget-or$working-cne[string]$entry.workingDirectory){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable current shortcut paths changed.' $entry}
+    }
+    return $Proof
+}
+
+function New-CcodDurableCurrentProof {
+    param([Parameter(Mandatory)]$Registration,[Parameter(Mandatory)]$ReadyEvidence,[Parameter(Mandatory)][hashtable]$Adapters)
+    $entries=[Collections.Generic.List[object]]::new()
+    foreach($kind in @('StartMenu','Desktop')){$shortcut=if($kind-ceq'StartMenu'){$Registration.startMenuShortcut}else{$Registration.desktopShortcut};$entries.Add((&$Adapters.GetCurrentShortcutProof $kind $shortcut $ReadyEvidence))}
+    $proof=[pscustomobject][ordered]@{version=[string]$Registration.version;runtimeId=[string]$Registration.runtimeId;packageSha256=[string]$Registration.packageSha256;shortcuts=@($entries)}
+    [void](Assert-CcodDurableCurrentProof -Proof $proof -Registration $Registration -ReadyEvidence $ReadyEvidence);return $proof
+}
+
+function Test-CcodDurableLegacyRegistryEntry {
+    param($Entry,[Parameter(Mandatory)]$LegacyRegistration,[Parameter(Mandatory)][string]$ExpectedAppId)
+    if($null-eq$Entry-or-not(Test-CcodProductExactProperties $Entry @('kind','path','values'))-or$Entry.kind-isnot[string]-or$Entry.kind-cne'Registry'-or$Entry.path-isnot[string]-or$Entry.path-cne(Get-CcodLegacyRegistryPath $ExpectedAppId)){return $false}
+    $names=@(Get-CcodProductMapNames $Entry.values);if($names.Count-eq0-or(@($names|Where-Object{$script:CcodLegacyRegistryValueNames-cnotcontains[string]$_}).Count-ne0)){return $false}
+    foreach($required in @('DisplayVersion','InstallLocation','UninstallString')){$value=Get-CcodProductMapValue $Entry.values $required;if($null-eq$value-or-not(Test-CcodProductExactProperties $value @('value','kind'))-or$value.kind-isnot[string]-or$value.kind-cne'String'){return $false};$expected=if($required-ceq'DisplayVersion'){$LegacyRegistration.displayVersion}elseif($required-ceq'InstallLocation'){$LegacyRegistration.installLocation}else{$LegacyRegistration.uninstallString};if($value.value-isnot[string]-or[string]$value.value-cne[string]$expected){return $false}}
+    foreach($name in $names){$value=Get-CcodProductMapValue $Entry.values ([string]$name);if($null-eq$value-or-not(Test-CcodProductExactProperties $value @('value','kind'))-or$value.kind-isnot[string]-or$value.kind-cnotin@('String','ExpandString','Binary','DWord','QWord','MultiString','None')){return $false}}
+    return $true
+}
+
+function Assert-CcodDurableLegacyMigrationRecord {
+    param([Parameter(Mandatory)]$Record,[Parameter(Mandatory)][string]$ExpectedAppId,[Parameter(Mandatory)]$Registration,[Parameter(Mandatory)]$ReadyEvidence)
+    if(-not(Test-CcodProductExactProperties $Record $script:CcodDurableLegacyMigrationFields)-or$Record.schemaVersion-isnot[int]-or$Record.schemaVersion-ne1-or$Record.transactionId-isnot[string]-or$Record.transactionId-cne[string]$ReadyEvidence.transactionRecord.transactionId-or$Record.runtimeId-isnot[string]-or$Record.runtimeId-cne$Registration.runtimeId-or-not(Test-CcodProductUnsignedInteger $Record.runtimeGeneration)-or[uint64]$Record.runtimeGeneration-ne[uint64]$ReadyEvidence.runtimeGeneration-or$Record.manifestSha256-isnot[string]-or$Record.manifestSha256-cne[ string]$ReadyEvidence.manifestSha256-or$Record.packageSha256-isnot[string]-or$Record.packageSha256-cne$Registration.packageSha256-or$Record.appId-isnot[string]-or$Record.appId-cne$ExpectedAppId-or$Record.expectedInstallRoot-isnot[string]-or(Get-CcodProductFullPath ([string]$Record.expectedInstallRoot))-cne[IO.Path]::GetFullPath([string]$Registration.installRoot)-or$Record.legacyPresent-isnot[bool]){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable legacy migration plan identity is invalid.' $Record}
+    if(-not(Test-CcodProductExactProperties $Record.readyTransaction $script:CcodReadyTransactionFields)-or($Record.readyTransaction|ConvertTo-Json -Depth 16 -Compress)-cne($ReadyEvidence.transactionRecord|ConvertTo-Json -Depth 16 -Compress)){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable legacy migration Ready transaction changed.' $Record.readyTransaction}
+    $plan=[pscustomobject][ordered]@{appId=[string]$Record.appId;expectedInstallRoot=[string]$Record.expectedInstallRoot;legacyPresent=[bool]$Record.legacyPresent;legacyRegistration=$Record.legacyRegistration;profile=$Record.profile;snapshot=$Record.snapshot}
+    [void](Assert-CcodLegacyMigrationPlan -Plan $plan -ExpectedAppId $ExpectedAppId -ExpectedInstallRoot ([string]$Registration.installRoot))
+    if([bool]$plan.legacyPresent){$registry=@($plan.snapshot.entries|Where-Object{$_-isnot[string]-and$_.kind-ceq'Registry'});if($registry.Count-ne1-or-not(Test-CcodDurableLegacyRegistryEntry -Entry $registry[0] -LegacyRegistration $plan.legacyRegistration -ExpectedAppId $ExpectedAppId)){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable legacy registry evidence is incomplete.' $plan.snapshot}}
+    [void](Assert-CcodDurableCurrentProof -Proof $Record.expectedCurrentProof -Registration $Registration -ReadyEvidence $ReadyEvidence)
+    return $Record
+}
+
+function ConvertTo-CcodDurableLegacyMigrationBytes($Record){$bytes=[Text.UTF8Encoding]::new($false).GetBytes(($Record|ConvertTo-Json -Depth 32 -Compress)+"`n");if($bytes.LongLength-eq0-or$bytes.LongLength-gt1048576){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable legacy migration plan exceeds its bounded record size.' $null};return ,$bytes}
+function Get-CcodProductBytesSha256([byte[]]$Bytes){$sha=[Security.Cryptography.SHA256]::Create();try{[BitConverter]::ToString($sha.ComputeHash($Bytes)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()}}
+
+function ConvertFrom-CcodDurableLegacyMigrationRead {
+    param([Parameter(Mandatory)]$Read,[Parameter(Mandatory)][string]$ExpectedAppId,[Parameter(Mandatory)]$Registration,[Parameter(Mandatory)]$ReadyEvidence)
+    if(-not(Test-CcodProductExactProperties $Read @('Bytes','Length','Sha256'))-or$Read.Bytes-isnot[byte[]]-or-not(Test-CcodProductUnsignedInteger $Read.Length)-or[uint64]$Read.Length-ne[uint64]$Read.Bytes.LongLength-or$Read.Bytes.LongLength-eq0-or$Read.Bytes.LongLength-gt1048576-or$Read.Sha256-isnot[string]-or$Read.Sha256-cnotmatch'^[0-9a-f]{64}$'-or(Get-CcodProductBytesSha256 $Read.Bytes)-cne[string]$Read.Sha256){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable legacy migration plan read identity is invalid.' $Read}
+    try{$json=[Text.UTF8Encoding]::new($false,$true).GetString($Read.Bytes);if(-not(Test-CcodProductJsonHasNoDuplicateProperties $json)){throw 'duplicate JSON properties'};$record=$json|ConvertFrom-Json -ErrorAction Stop}catch{Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable legacy migration plan JSON is malformed or ambiguous.' $Read.Sha256}
+    [void](Assert-CcodDurableLegacyMigrationRecord -Record $record -ExpectedAppId $ExpectedAppId -Registration $Registration -ReadyEvidence $ReadyEvidence)
+    $canonical=ConvertTo-CcodDurableLegacyMigrationBytes $record;if([Convert]::ToBase64String($canonical)-cne[Convert]::ToBase64String($Read.Bytes)){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable legacy migration plan bytes are noncanonical.' $Read.Sha256}
+    if([bool]$record.legacyPresent){foreach($entry in @($record.snapshot.entries)){if($entry-isnot[string]-and$entry.kind-ceq'Registry'){$entry.values=ConvertTo-CcodProductOrderedMap $entry.values}}}
+    return $record
+}
+
 function Test-CcodLegacySnapshotCurrentReplacement {
     param($Entry,[Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)]$CurrentProof)
-    if($Entry-is[string]-or$null-eq$Entry-or$Entry.kind-cne'Shortcut'-or$Entry.name-isnot[string]-or[string]$Entry.name-cne$Name-or
-       $Entry.path-isnot[string]-or$Entry.sha256-isnot[string]){return $false}
-    try{$expectedPath=Get-CcodLegacyShortcutPath -RelativeName $Name;$actualPath=[IO.Path]::GetFullPath([string]$Entry.path)}catch{return $false}
-    if($actualPath-cne$expectedPath){return $false}
-    $expectedSha256=if($Name-ceq$script:CcodCurrentShortcutNames[0]){[string]$CurrentProof.startMenuSha256}elseif($Name-ceq$script:CcodCurrentShortcutNames[1]){[string]$CurrentProof.desktopSha256}else{return $false}
-    return [string]$Entry.sha256-ceq$expectedSha256
+    $expected=Get-CcodDurableCurrentShortcutProof -Proof $CurrentProof -Name $Name
+    if($null-eq$expected-or$Entry-is[string]-or$null-eq$Entry-or$Entry.kind-cne'Shortcut'-or$Entry.name-isnot[string]-or[string]$Entry.name-cne$Name-or$Entry.path-isnot[string]-or$Entry.sha256-isnot[string]-or$Entry.bytesBase64-isnot[string]-or$Entry.targetPath-isnot[string]-or$Entry.arguments-isnot[string]-or$Entry.workingDirectory-isnot[string]){return $false}
+    try{$actualPath=[IO.Path]::GetFullPath([string]$Entry.path);$bytes=[Convert]::FromBase64String([string]$Entry.bytesBase64);$target=[IO.Path]::GetFullPath([string]$Entry.targetPath);$working=if([string]::IsNullOrEmpty([string]$Entry.workingDirectory)){''}else{[IO.Path]::GetFullPath([string]$Entry.workingDirectory).TrimEnd('\')}}catch{return $false}
+    return $actualPath-ceq[string]$expected.path-and$bytes.LongLength-eq[uint64]$expected.candidateLength-and(Get-CcodProductBytesSha256 $bytes)-ceq[string]$expected.candidateSha256-and[string]$Entry.sha256-ceq[string]$expected.candidateSha256-and$target-ceq[string]$expected.targetPath-and[string]$Entry.arguments-ceq[string]$expected.arguments-and$working-ceq[string]$expected.workingDirectory
+}
+
+function ConvertTo-CcodDurableLegacyPlan($Record){[pscustomobject][ordered]@{appId=[string]$Record.appId;expectedInstallRoot=[string]$Record.expectedInstallRoot;legacyPresent=[bool]$Record.legacyPresent;legacyRegistration=$Record.legacyRegistration;profile=$Record.profile;snapshot=$Record.snapshot}}
+
+function Assert-CcodDurableLegacyReplay {
+    param([Parameter(Mandatory)]$Record,[Parameter(Mandatory)][hashtable]$Adapters)
+    $plan=ConvertTo-CcodDurableLegacyPlan $Record;$legacy=&$Adapters.ReadLegacyRegistration $Record.appId
+    if(-not[bool]$Record.legacyPresent){if($null-ne$legacy){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy state appeared after an absent durable capture.' $Record.appId};return $plan}
+    if($null-eq$legacy){$start=Get-CcodDurableCurrentShortcutProof $Record.expectedCurrentProof $script:CcodCurrentShortcutNames[0];$desktop=Get-CcodDurableCurrentShortcutProof $Record.expectedCurrentProof $script:CcodCurrentShortcutNames[1];$expected=[pscustomobject][ordered]@{verified=$true;runtimeId=[string]$Record.expectedCurrentProof.runtimeId;version=[string]$Record.expectedCurrentProof.version;packageSha256=[string]$Record.expectedCurrentProof.packageSha256;shortcutNames=@($script:CcodCurrentShortcutNames);startMenuSha256=[string]$start.candidateSha256;desktopSha256=[string]$desktop.candidateSha256};$current=&$Adapters.ReadVerifiedRegistration;if(-not(Test-CcodCurrentVerifiedRegistrationUnchanged -Before $expected -After $current)){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Absent legacy registry lacks the exact current proof.' $Record.appId};foreach($entry in @($plan.snapshot.entries)){if((Get-CcodLegacySnapshotEntryName -Entry $entry -ExpectedAppId $Record.appId)-in$script:CcodCurrentShortcutNames){continue};$state=&$Adapters.ReadLegacyEntry $entry;if($entry.kind-ceq'Registry'){if($null-ne$state){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy registry observation is internally inconsistent.' $Record.appId};continue};if($null-ne$state-and$state-cne'Exact'){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Remaining legacy-only shortcut is foreign.' (Get-CcodLegacySnapshotEntryName -Entry $entry -ExpectedAppId $Record.appId)}};return $plan}
+    if($null-eq$legacy-or$legacy.appId-cne$plan.legacyRegistration.appId-or$legacy.displayVersion-cne$plan.legacyRegistration.displayVersion-or$legacy.installLocation-cne$plan.legacyRegistration.installLocation-or$legacy.uninstallString-cne$plan.legacyRegistration.uninstallString-or@($legacy.unsafeShortcutNames).Count-ne0){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Live legacy registry no longer matches the durable capture.' $Record.appId}
+    $required=@($plan.profile.shortcutNames);$allowed=@($required)+@($script:CcodCurrentShortcutNames);$actual=@($legacy.shortcutNames);$requiredOverlaps=@($required|Where-Object{$script:CcodCurrentShortcutNames-ccontains[string]$_})
+    if(-not(Test-CcodProductExactStringSet $actual $actual)-or@($actual|Where-Object{$allowed-cnotcontains[string]$_}).Count-ne0-or@($requiredOverlaps|Where-Object{$actual-cnotcontains[string]$_}).Count-ne0){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Live legacy shortcut names are outside the durable transition.' $Record.appId}
+    $live=&$Adapters.ReadLegacySnapshot $Record.appId $plan.profile $plan
+    if($null-eq$live-or$live.appId-cne$Record.appId){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Live legacy snapshot could not be recaptured.' $Record.appId}
+    $storedByName=@{};foreach($entry in @($plan.snapshot.entries)){$name=Get-CcodLegacySnapshotEntryName -Entry $entry -ExpectedAppId $Record.appId;if($null-eq$name-or$storedByName.ContainsKey($name)){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable legacy snapshot contains ambiguous entries.' $name};$storedByName[$name]=$entry}
+    $liveByName=@{};foreach($entry in @($live.entries)){$name=Get-CcodLegacySnapshotEntryName -Entry $entry -ExpectedAppId $Record.appId;if($null-eq$name-or$liveByName.ContainsKey($name)){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Live legacy snapshot contains ambiguous entries.' $name};$liveByName[$name]=$entry}
+    if(-not$liveByName.ContainsKey('Registry')-or(Compare-CcodLegacySnapshotEntry -Expected $storedByName['Registry'] -Current $liveByName['Registry'])-cne'Exact'){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Live legacy registry evidence changed after durable capture.' $Record.appId}
+    foreach($name in $required){if(-not$liveByName.ContainsKey($name)){if($script:CcodCurrentShortcutNames-ccontains$name){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Required overlap shortcut disappeared after durable capture.' $name};continue};$current=$liveByName[$name];$historical=$storedByName[$name];if((Compare-CcodLegacySnapshotEntry -Expected $historical -Current $current)-ceq'Exact'){continue};if($script:CcodCurrentShortcutNames-ccontains$name-and(Test-CcodLegacySnapshotCurrentReplacement -Entry $current -Name $name -CurrentProof $Record.expectedCurrentProof)){continue};Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Historical shortcut changed outside the durable current replacement.' $name}
+    foreach($name in $script:CcodCurrentShortcutNames){if($required-ccontains$name-or-not$liveByName.ContainsKey($name)){continue};if(-not(Test-CcodLegacySnapshotCurrentReplacement -Entry $liveByName[$name] -Name $name -CurrentProof $Record.expectedCurrentProof)){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Optional current shortcut does not match the durable replacement.' $name}}
+    if(@($liveByName.Keys|Where-Object{$_-cne'Registry'-and$actual-cnotcontains[string]$_}).Count-ne0){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Live legacy snapshot contains an unreported shortcut.' $Record.appId}
+    return $plan
+}
+
+function Get-CcodDurableLegacyProductRegistrationMigrationPlan {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][string]$ExpectedAppId,[Parameter(Mandatory)]$Registration,[Parameter(Mandatory)]$ReadyEvidence,[hashtable]$Adapters)
+    if($ExpectedAppId-cne$script:CcodProductAppId-or-not(Test-CcodProductRegistration -Registration $Registration -ExpectedRuntimeId ([string]$Registration.runtimeId) -ExpectedVersion $script:CcodProductVersion -ExpectedPackageSha256 ([string]$Registration.packageSha256))-or-not(Test-CcodProductReadyProof $ReadyEvidence $Registration)-or-not(Test-CcodDurableReadyEvidence $ReadyEvidence $Registration)){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable legacy migration requires the exact Ready product identity.' $ExpectedAppId}
+    $adapter=Get-CcodProductRegistrationAdapters $Adapters;$existing=&$adapter.ReadLegacyMigrationPlan $ReadyEvidence
+    if($null-ne$existing){$record=ConvertFrom-CcodDurableLegacyMigrationRead -Read $existing -ExpectedAppId $ExpectedAppId -Registration $Registration -ReadyEvidence $ReadyEvidence;return Assert-CcodDurableLegacyReplay -Record $record -Adapters $adapter}
+    $plan=Get-CcodLegacyProductRegistrationMigrationPlan -ExpectedAppId $ExpectedAppId -ExpectedInstallRoot ([string]$Registration.installRoot) -Adapters $adapter
+    $currentProof=New-CcodDurableCurrentProof -Registration $Registration -ReadyEvidence $ReadyEvidence -Adapters $adapter
+    $record=[pscustomobject][ordered]@{schemaVersion=1;transactionId=[string]$ReadyEvidence.transactionRecord.transactionId;runtimeId=[string]$Registration.runtimeId;runtimeGeneration=[uint64]$ReadyEvidence.runtimeGeneration;manifestSha256=[string]$ReadyEvidence.manifestSha256;packageSha256=[string]$Registration.packageSha256;readyTransaction=$ReadyEvidence.transactionRecord;appId=$ExpectedAppId;expectedInstallRoot=[string]$Registration.installRoot;legacyPresent=[bool]$plan.legacyPresent;legacyRegistration=$plan.legacyRegistration;profile=$plan.profile;snapshot=$plan.snapshot;expectedCurrentProof=$currentProof}
+    [void](Assert-CcodDurableLegacyMigrationRecord -Record $record -ExpectedAppId $ExpectedAppId -Registration $Registration -ReadyEvidence $ReadyEvidence);$bytes=ConvertTo-CcodDurableLegacyMigrationBytes $record
+    try{&$adapter.WriteLegacyMigrationPlan $ReadyEvidence $bytes|Out-Null}catch{Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable legacy migration plan could not be published create-only.' $Record.transactionId}
+    $read=&$adapter.ReadLegacyMigrationPlan $ReadyEvidence;if($null-eq$read-or[Convert]::ToBase64String([byte[]]$read.Bytes)-cne[Convert]::ToBase64String($bytes)){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable legacy migration plan did not read back exactly.' $Record.transactionId}
+    $persisted=ConvertFrom-CcodDurableLegacyMigrationRead -Read $read -ExpectedAppId $ExpectedAppId -Registration $Registration -ReadyEvidence $ReadyEvidence
+    return ConvertTo-CcodDurableLegacyPlan $persisted
 }
 
 function Read-CcodLegacySnapshot {
-    param([string]$ExpectedAppId,[Parameter(Mandatory)]$ExpectedProfile)
+    param([string]$ExpectedAppId,[Parameter(Mandatory)]$ExpectedProfile,[AllowNull()]$CapturedPlan)
     $legacy=Read-CcodCurrentUserLegacyRegistration $ExpectedAppId;if($null-eq$legacy){return $null}
-    $observedProfile=Resolve-CcodLegacyRegistrationProfile -LegacyRegistration $legacy
-    if($observedProfile.profileId-cne$ExpectedProfile.profileId){throw 'legacy profile changed before snapshot'}
+    if($null-eq$CapturedPlan){$observedProfile=Resolve-CcodLegacyRegistrationProfile -LegacyRegistration $legacy;if($observedProfile.profileId-cne$ExpectedProfile.profileId){throw 'legacy profile changed before snapshot'};$shortcutNames=@($ExpectedProfile.shortcutNames)}else{$captured=$CapturedPlan.legacyRegistration;$required=@($ExpectedProfile.shortcutNames);$allowed=@($required)+@($script:CcodCurrentShortcutNames);$requiredOverlaps=@($required|Where-Object{$script:CcodCurrentShortcutNames-ccontains[string]$_});$shortcutNames=@($legacy.shortcutNames);if($legacy.appId-cne$captured.appId-or$legacy.displayVersion-cne$captured.displayVersion-or$legacy.installLocation-cne$captured.installLocation-or$legacy.uninstallString-cne$captured.uninstallString-or@($legacy.unsafeShortcutNames).Count-ne0-or@($shortcutNames|Where-Object{$allowed-cnotcontains[string]$_}).Count-ne0-or@($requiredOverlaps|Where-Object{$shortcutNames-cnotcontains[string]$_}).Count-ne0){throw 'legacy replay profile changed before snapshot'}}
     $entries=[Collections.Generic.List[object]]::new();$keyPath=Get-CcodLegacyRegistryPath $ExpectedAppId;$key=Get-Item -LiteralPath $keyPath -ErrorAction Stop
     try{
         $names=@($key.GetValueNames());if($key.GetSubKeyNames().Count-ne0-or@($names|Where-Object{$script:CcodLegacyRegistryValueNames-cnotcontains$_}).Count-ne0){throw 'legacy registry contains unknown state'}
         $values=[ordered]@{};foreach($name in $names){$values[$name]=[pscustomobject]@{value=$key.GetValue($name,$null,[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames);kind=[string]$key.GetValueKind($name)}}
     }finally{$key.Dispose()}
     $entries.Add([pscustomobject]@{kind='Registry';path=$keyPath;values=$values})
-    foreach($name in @($ExpectedProfile.shortcutNames)){
+    foreach($name in @($shortcutNames)){
         $path=Get-CcodLegacyShortcutPath -RelativeName $name;$item=Get-Item -LiteralPath $path -Force -ErrorAction Stop
-        if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0-or[string]$item.Name-cne[IO.Path]::GetFileName($name)){throw 'legacy shortcut unsafe'}
+        if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0-or[string]$item.Name-cne[IO.Path]::GetFileName($name)-or$item.Length-le0-or$item.Length-gt262144){throw 'legacy shortcut unsafe'}
         $shell=$null;$shortcut=$null
         try{
             $shell=New-Object -ComObject WScript.Shell;$shortcut=$shell.CreateShortcut($path)
@@ -980,23 +1108,19 @@ function Remove-CcodLegacyProductRegistration {
     if(-not(Test-CcodCurrentVerifiedRegistrationUnchanged -Before $ExpectedCurrentProof -After $verified)){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy product migration requires an exact current three-record read-back proof.' $ExpectedAppId}
     $profile=$MigrationPlan.profile;$snapshot=$MigrationPlan.snapshot
     $observedLegacy=&$adapter.ReadLegacyRegistration $ExpectedAppId
-    if($null-eq$observedLegacy){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Captured legacy registry disappeared before cleanup.' $ExpectedAppId}
-    $expectedObservedNames=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal);foreach($name in @($profile.shortcutNames)+@($script:CcodCurrentShortcutNames)){[void]$expectedObservedNames.Add([string]$name)}
-    if(-not(Test-CcodProductExactStringSet $observedLegacy.shortcutNames @($expectedObservedNames))-or@($observedLegacy.unsafeShortcutNames).Count-ne0-or
-       $observedLegacy.appId-cne$MigrationPlan.legacyRegistration.appId-or
-       $observedLegacy.displayVersion-cne$MigrationPlan.legacyRegistration.displayVersion-or$observedLegacy.installLocation-cne$MigrationPlan.legacyRegistration.installLocation-or
-       $observedLegacy.uninstallString-cne$MigrationPlan.legacyRegistration.uninstallString){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Captured legacy profile changed before cleanup.' $ExpectedAppId}
+    if($null-ne$observedLegacy){$allowed=@($profile.shortcutNames)+@($script:CcodCurrentShortcutNames);$actual=@($observedLegacy.shortcutNames);if(-not(Test-CcodProductExactStringSet $actual $actual)-or@($actual|Where-Object{$allowed-cnotcontains[string]$_}).Count-ne0-or@($script:CcodCurrentShortcutNames|Where-Object{$actual-cnotcontains[string]$_}).Count-ne0-or@($observedLegacy.unsafeShortcutNames).Count-ne0-or$observedLegacy.appId-cne$MigrationPlan.legacyRegistration.appId-or$observedLegacy.displayVersion-cne$MigrationPlan.legacyRegistration.displayVersion-or$observedLegacy.installLocation-cne$MigrationPlan.legacyRegistration.installLocation-or$observedLegacy.uninstallString-cne$MigrationPlan.legacyRegistration.uninstallString){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Captured legacy profile changed before cleanup.' $ExpectedAppId}}
     $removalEntries=[Collections.Generic.List[object]]::new()
     foreach($entry in @($snapshot.entries)){
         $name=Get-CcodLegacySnapshotEntryName -Entry $entry -ExpectedAppId $ExpectedAppId
         if($script:CcodCurrentShortcutNames-ccontains$name){
             continue
         }
+        $state=&$adapter.ReadLegacyEntry $entry
+        if($name-ceq'Registry'-and(($null-eq$observedLegacy)-ne($null-eq$state))){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy registry observations are inconsistent before cleanup.' $ExpectedAppId}
+        if($null-eq$state){continue}
+        if($state-cne'Exact'){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Captured legacy-only state changed before deletion.' $name}
         $removalEntries.Add($entry)
     }
-    foreach($entry in @($removalEntries)){
-        if((&$adapter.ReadLegacyEntry $entry)-cne'Exact'){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Captured legacy-only state changed before deletion.' (Get-CcodLegacySnapshotEntryName -Entry $entry -ExpectedAppId $ExpectedAppId)}
-    }
     $removed=[Collections.Generic.List[object]]::new();$failedEntry=$null
     try{
         foreach($entry in @($removalEntries)){$failedEntry=$entry;&$adapter.RemoveLegacyEntry $entry;$removed.Add($entry);$failedEntry=$null}
@@ -1014,4 +1138,4 @@ function Remove-CcodLegacyProductRegistration {
     }
 }
 
-Export-ModuleMember -Function New-CcodProductRegistration,Test-CcodProductRegistration,Commit-CcodProductRegistration,Remove-CcodProductRegistration,Remove-CcodLegacyProductRegistration,Get-CcodLegacyProductRegistrationMigrationPlan,Get-CcodLegacyRegistrationProfiles,Resolve-CcodLegacyRegistrationProfile,Set-CcodInstalledUninstallResumeRegistration,Test-CcodInstalledUninstallResumeRegistration,Get-CcodInstalledUninstallResumeRegistrationState,Remove-CcodInstalledUninstallProductShortcuts,Remove-CcodInstalledUninstallResumeRegistration
+Export-ModuleMember -Function New-CcodProductRegistration,Test-CcodProductRegistration,Commit-CcodProductRegistration,Remove-CcodProductRegistration,Remove-CcodLegacyProductRegistration,Get-CcodLegacyProductRegistrationMigrationPlan,Get-CcodDurableLegacyProductRegistrationMigrationPlan,Get-CcodLegacyRegistrationProfiles,Resolve-CcodLegacyRegistrationProfile,Set-CcodInstalledUninstallResumeRegistration,Test-CcodInstalledUninstallResumeRegistration,Get-CcodInstalledUninstallResumeRegistrationState,Remove-CcodInstalledUninstallProductShortcuts,Remove-CcodInstalledUninstallResumeRegistration
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index 6bdb120..5764654 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -148,11 +148,11 @@ function Assert-CcodProductTransactionRejected {
 }
 
 Invoke-CcodTest 'exports only immutable generation operations and an inert CLR marker' {
-    $expected=@('Close-CcodInstallFileTransaction','Commit-CcodInstallActivePointer','Copy-CcodInstallProductShortcut','Copy-CcodInstallSealedSource','New-CcodInstallDirectory','New-CcodInstallGenerationLeaf','Open-CcodInstallGeneration','Open-CcodInstallProductRegistrationTransaction','Open-CcodInstallProductSpecialFolder','Open-CcodInstallRetainedFile','Open-CcodInstallRetainedGeneration','Open-CcodInstallStateTransaction','Retire-CcodInstallGeneration','Write-CcodInstallGenerationManifest','Write-CcodInstallRecord')
+    $expected=@('Close-CcodInstallFileTransaction','Commit-CcodInstallActivePointer','Copy-CcodInstallProductShortcut','Copy-CcodInstallSealedSource','New-CcodInstallDirectory','New-CcodInstallGenerationLeaf','Open-CcodInstallGeneration','Open-CcodInstallProductRegistrationTransaction','Open-CcodInstallProductSpecialFolder','Open-CcodInstallRetainedFile','Open-CcodInstallRetainedGeneration','Open-CcodInstallStateTransaction','Read-CcodInstallLegacyMigrationPlan','Retire-CcodInstallGeneration','Write-CcodInstallGenerationManifest','Write-CcodInstallLegacyMigrationPlan','Write-CcodInstallRecord')
     Assert-CcodEqual ($expected -join '|') ((@($module.ExportedCommands.Keys)|Sort-Object)-join '|') 'module export surface is capability-only'
-    Assert-CcodEqual 5 ([CcodInstallGenerationCapabilityMarkerV5]::CapabilityAbi) 'marker exposes the current non-mutating ABI value'
-    Assert-CcodEqual 'CcodInstallGenerationCapabilityMarkerV5' ((@([CcodInstallGenerationCapabilityMarkerV5].Assembly.GetExportedTypes()|ForEach-Object FullName)) -join '|') 'current CLR bridge exports only the inert marker'
-    $dangerous=@([CcodInstallGenerationCapabilityMarkerV5].GetMethods([Reflection.BindingFlags]'Public,Static,DeclaredOnly')|Where-Object{@($_.GetParameters()|Where-Object{$_.ParameterType-in@([string],[IntPtr],[IO.Stream])-or[Microsoft.Win32.SafeHandles.SafeHandle].IsAssignableFrom($_.ParameterType)}).Count-ne 0})
+    Assert-CcodEqual 6 ([CcodInstallGenerationCapabilityMarkerV6]::CapabilityAbi) 'marker exposes the current non-mutating ABI value'
+    Assert-CcodEqual 'CcodInstallGenerationCapabilityMarkerV6' ((@([CcodInstallGenerationCapabilityMarkerV6].Assembly.GetExportedTypes()|ForEach-Object FullName)) -join '|') 'current CLR bridge exports only the inert marker'
+    $dangerous=@([CcodInstallGenerationCapabilityMarkerV6].GetMethods([Reflection.BindingFlags]'Public,Static,DeclaredOnly')|Where-Object{@($_.GetParameters()|Where-Object{$_.ParameterType-in@([string],[IntPtr],[IO.Stream])-or[Microsoft.Win32.SafeHandles.SafeHandle].IsAssignableFrom($_.ParameterType)}).Count-ne 0})
     Assert-CcodEqual 0 $dangerous.Count 'marker accepts no path stream or bare handle'
     Assert-CcodTrue (-not $module.ExportedCommands['Copy-CcodInstallProductShortcut'].Parameters.ContainsKey('SourcePath')) 'product shortcut copy accepts no arbitrary absolute source path'
 }
@@ -196,6 +196,91 @@ function New-CcodProductAuthorityFixture {
     [pscustomobject]@{Fixture=$fixture;RuntimeId=$runtimeId;Manifest=$manifest;Ready=$ready;ReadyPath=$readyPath}
 }
 
+# Production mutation caught: product code can persist or read arbitrary state instead of one Ready-derived, cleanup-fence-bound plan.
+Invoke-CcodTest 'product transaction publishes and rereads only its exact Ready-derived legacy migration plan create-only' {
+    $authority=New-CcodProductAuthorityFixture;$fixture=$authority.Fixture
+    $outer=$null;$product=$null;$lifecycleModule=$null;$fence=$null
+    try {
+        $lifecycleModule=Import-Module (Join-Path $projectRoot 'src\persistence\modules\InstallLifecycle.psm1') -Force -PassThru -DisableNameChecking
+        $outer=&$lifecycleModule {Enter-CcodLifecycleProductCleanupLease}
+        $fence=&$lifecycleModule {param($Root,$Ready,$Identity)New-CcodLifecycleProductCleanupFence -InstallRoot $Root -ReadyTransaction $Ready -OwnerIdentity $Identity} $fixture.Install $authority.Ready $outer.OwnerIdentity
+        $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $authority.Ready;$fixture.Transactions.Add($product)
+        &$module {param($Transaction,$Fence)Set-CcodInstallProductCleanupFence -Transaction $Transaction -Fence $Fence|Out-Null} $product $fence
+        $bytes=[Text.UTF8Encoding]::new($false).GetBytes('{"schemaVersion":1,"transactionId":"33333333-4444-4555-8666-777777777777"}')
+        $written=Write-CcodInstallLegacyMigrationPlan -Transaction $product -ReadyTransaction $authority.Ready -Bytes $bytes
+        $read=Read-CcodInstallLegacyMigrationPlan -Transaction $product -ReadyTransaction $authority.Ready
+        $expectedPath=Join-Path $fixture.Install ('state\legacy-registration-migrations\00000000000000000001.'+$authority.Ready.transactionId+'.json')
+        Assert-CcodEqual ([int64]$bytes.LongLength) ([int64]$written.Length) 'specialized plan write returns exact length'
+        Assert-CcodEqual (Get-CcodTestFileSha256 $expectedPath) $written.Sha256 'specialized plan write returns exact digest'
+        Assert-CcodEqual ([Convert]::ToBase64String($bytes)) ([Convert]::ToBase64String($read.Bytes)) 'specialized plan reader returns exact persisted bytes'
+        Assert-CcodEqual $written.Sha256 $read.Sha256 'specialized plan reader hashes the same pinned file'
+        Assert-CcodThrows {Write-CcodInstallLegacyMigrationPlan -Transaction $product -ReadyTransaction $authority.Ready -Bytes $bytes|Out-Null} 'CCOD_INSTALL_LEGACY_PLAN_EXISTS'
+        $wrong=$authority.Ready.PSObject.Copy();$wrong.newGeneration=[uint64]2
+        Assert-CcodThrows {Read-CcodInstallLegacyMigrationPlan -Transaction $product -ReadyTransaction $wrong|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
+        $other=Open-CcodInstallStateTransaction -InstallRoot $fixture.Install;$fixture.Transactions.Add($other)
+        Assert-CcodThrows {Write-CcodInstallLegacyMigrationPlan -Transaction $other -ReadyTransaction $authority.Ready -Bytes $bytes|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
+        Close-CcodInstallFileTransaction -Transaction $product -Disposition Ready;$product=$null
+        &$lifecycleModule {param($Fence)Complete-CcodLifecycleProductCleanupFence -Fence $Fence -Outcome Completed|Out-Null} $fence
+    } finally {
+        if($null-ne$product){try{Close-CcodInstallFileTransaction -Transaction $product -Disposition Failed}catch{}}
+        if($null-ne$outer){try{&$lifecycleModule {param($Context)Exit-CcodLifecycleProductCleanupLease -Context $Context|Out-Null} $outer}catch{}}
+        Remove-CcodInstallFileFixture $fixture
+    }
+}
+
+# Production mutations caught: a generic product capability writes a plan without its durable cleanup authority or size bound.
+Invoke-CcodTest 'legacy migration plan requires its live cleanup fence and bounded specialized scope' {
+    $authority=New-CcodProductAuthorityFixture;$fixture=$authority.Fixture;$outer=$null;$product=$null;$lifecycleModule=$null;$fence=$null
+    try{
+        $lifecycleModule=Import-Module (Join-Path $projectRoot 'src\persistence\modules\InstallLifecycle.psm1') -Force -PassThru -DisableNameChecking;$outer=&$lifecycleModule {Enter-CcodLifecycleProductCleanupLease}
+        $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $authority.Ready;$fixture.Transactions.Add($product)
+        Assert-CcodThrows {Write-CcodInstallLegacyMigrationPlan -Transaction $product -ReadyTransaction $authority.Ready -Bytes ([byte[]]@(1))|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
+        Close-CcodInstallFileTransaction -Transaction $product -Disposition Failed;$product=$null
+        $fence=&$lifecycleModule {param($Root,$Ready,$Identity)New-CcodLifecycleProductCleanupFence -InstallRoot $Root -ReadyTransaction $Ready -OwnerIdentity $Identity} $fixture.Install $authority.Ready $outer.OwnerIdentity
+        $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $authority.Ready;$fixture.Transactions.Add($product);&$module {param($Transaction,$Fence)Set-CcodInstallProductCleanupFence -Transaction $Transaction -Fence $Fence|Out-Null} $product $fence
+        Assert-CcodThrows {Write-CcodInstallLegacyMigrationPlan -Transaction $product -ReadyTransaction $authority.Ready -Bytes ([byte[]]::new(1048577))|Out-Null} 'CCOD_INSTALL_PRODUCT_SCOPE'
+        Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $fixture.Install 'state\legacy-registration-migrations')) 'rejected specialized writes create no plan directory'
+        Close-CcodInstallFileTransaction -Transaction $product -Disposition Ready;$product=$null;&$lifecycleModule {param($Fence)Complete-CcodLifecycleProductCleanupFence -Fence $Fence -Outcome Completed|Out-Null} $fence
+    }finally{if($null-ne$product){try{Close-CcodInstallFileTransaction -Transaction $product -Disposition Failed}catch{}};if($null-ne$outer){try{&$lifecycleModule {param($Context)Exit-CcodLifecycleProductCleanupLease -Context $Context|Out-Null} $outer}catch{}};Remove-CcodInstallFileFixture $fixture}
+}
+
+# Production mutation caught: the just-published plan is not held by identity until the product transaction closes.
+Invoke-CcodTest 'legacy migration plan remains identity-pinned for the live product transaction' {
+    $authority=New-CcodProductAuthorityFixture;$fixture=$authority.Fixture;$outer=$null;$product=$null;$lifecycleModule=$null;$fence=$null
+    try{
+        $lifecycleModule=Import-Module (Join-Path $projectRoot 'src\persistence\modules\InstallLifecycle.psm1') -Force -PassThru -DisableNameChecking;$outer=&$lifecycleModule {Enter-CcodLifecycleProductCleanupLease};$fence=&$lifecycleModule {param($Root,$Ready,$Identity)New-CcodLifecycleProductCleanupFence -InstallRoot $Root -ReadyTransaction $Ready -OwnerIdentity $Identity} $fixture.Install $authority.Ready $outer.OwnerIdentity
+        $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $authority.Ready;$fixture.Transactions.Add($product);&$module {param($Transaction,$Fence)Set-CcodInstallProductCleanupFence -Transaction $Transaction -Fence $Fence|Out-Null} $product $fence
+        $bytes=[Text.UTF8Encoding]::new($false).GetBytes('{"schemaVersion":1}');Write-CcodInstallLegacyMigrationPlan -Transaction $product -ReadyTransaction $authority.Ready -Bytes $bytes|Out-Null
+        $path=Join-Path $fixture.Install ('state\legacy-registration-migrations\00000000000000000001.'+$authority.Ready.transactionId+'.json');$moved=$false;try{[IO.File]::Move($path,$path+'.replacement');$moved=$true}catch [IO.IOException]{}catch [UnauthorizedAccessException]{}
+        Assert-CcodEqual $false $moved 'live plan handle denies replacement until the authority transaction closes'
+        Assert-CcodEqual ([Convert]::ToBase64String($bytes)) ([Convert]::ToBase64String((Read-CcodInstallLegacyMigrationPlan -Transaction $product -ReadyTransaction $authority.Ready).Bytes)) 'identity-pinned plan remains readable'
+        Close-CcodInstallFileTransaction -Transaction $product -Disposition Ready;$product=$null;&$lifecycleModule {param($Fence)Complete-CcodLifecycleProductCleanupFence -Fence $Fence -Outcome Completed|Out-Null} $fence
+    }finally{if($null-ne$product){try{Close-CcodInstallFileTransaction -Transaction $product -Disposition Failed}catch{}};if($null-ne$outer){try{&$lifecycleModule {param($Context)Exit-CcodLifecycleProductCleanupLease -Context $Context|Out-Null} $outer}catch{}};Remove-CcodInstallFileFixture $fixture}
+}
+
+# Production mutations caught: delayed authority accepts changed ACL, ADS, multilink, or reparse plan objects.
+Invoke-CcodTest 'delayed legacy migration plan read rejects hostile file identity and security mutations' {
+    foreach($mutation in @('Acl','DirectoryAcl','Ads','Multilink','Reparse','DirectoryReparse')){
+        $authority=New-CcodProductAuthorityFixture;$fixture=$authority.Fixture;$outer=$null;$product=$null;$lifecycleModule=$null;$fence=$null;$outsidePath=$null
+        try{
+            $lifecycleModule=Import-Module (Join-Path $projectRoot 'src\persistence\modules\InstallLifecycle.psm1') -Force -PassThru -DisableNameChecking;$outer=&$lifecycleModule {Enter-CcodLifecycleProductCleanupLease};$fence=&$lifecycleModule {param($Root,$Ready,$Identity)New-CcodLifecycleProductCleanupFence -InstallRoot $Root -ReadyTransaction $Ready -OwnerIdentity $Identity} $fixture.Install $authority.Ready $outer.OwnerIdentity
+            $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $authority.Ready;$fixture.Transactions.Add($product);&$module {param($Transaction,$Fence)Set-CcodInstallProductCleanupFence -Transaction $Transaction -Fence $Fence|Out-Null} $product $fence
+            Write-CcodInstallLegacyMigrationPlan -Transaction $product -ReadyTransaction $authority.Ready -Bytes ([Text.UTF8Encoding]::new($false).GetBytes('{"schemaVersion":1}'))|Out-Null;Close-CcodInstallFileTransaction -Transaction $product -Disposition Ready;$product=$null;&$lifecycleModule {param($Fence)Complete-CcodLifecycleProductCleanupFence -Fence $Fence -Outcome Completed|Out-Null} $fence
+            $path=Join-Path $fixture.Install ('state\legacy-registration-migrations\00000000000000000001.'+$authority.Ready.transactionId+'.json')
+            if($mutation-ceq'Acl'){$acl=[Security.AccessControl.FileSecurity]::new($path,[Security.AccessControl.AccessControlSections]::Access);$rule=[Security.AccessControl.FileSystemAccessRule]::new([Security.Principal.SecurityIdentifier]::new('S-1-1-0'),[Security.AccessControl.FileSystemRights]::Read,[Security.AccessControl.AccessControlType]::Allow);$acl.AddAccessRule($rule)|Out-Null;[IO.File]::SetAccessControl($path,$acl)}
+            elseif($mutation-ceq'DirectoryAcl'){$directory=Split-Path $path -Parent;$acl=[Security.AccessControl.DirectorySecurity]::new($directory,[Security.AccessControl.AccessControlSections]::Access);$rule=[Security.AccessControl.FileSystemAccessRule]::new([Security.Principal.SecurityIdentifier]::new('S-1-1-0'),[Security.AccessControl.FileSystemRights]::ReadAndExecute,[Security.AccessControl.InheritanceFlags]::ContainerInherit-bor[Security.AccessControl.InheritanceFlags]::ObjectInherit,[Security.AccessControl.PropagationFlags]::None,[Security.AccessControl.AccessControlType]::Allow);$acl.AddAccessRule($rule)|Out-Null;[IO.Directory]::SetAccessControl($directory,$acl)}
+            elseif($mutation-ceq'Ads'){$item=Get-Item -LiteralPath $path -Force;$item.IsReadOnly=$false;Set-Content -LiteralPath $path -Stream hostile -Value x -NoNewline;$item.Refresh();$item.IsReadOnly=$true}
+            elseif($mutation-ceq'Multilink'){$outsidePath=Join-Path $fixture.Outside 'plan-link.json';New-CcodHardLink -Path $outsidePath -Existing $path}
+            elseif($mutation-ceq'Reparse'){$item=Get-Item -LiteralPath $path -Force;$item.IsReadOnly=$false;Remove-Item -LiteralPath $path -Force;$outsidePath=Join-Path $fixture.Outside 'plan-target';[IO.Directory]::CreateDirectory($outsidePath)|Out-Null;New-CcodJunction -Path $path -Target $outsidePath}
+            else{$directory=Split-Path $path -Parent;$item=Get-Item -LiteralPath $path -Force;$item.IsReadOnly=$false;Remove-Item -LiteralPath $directory -Recurse -Force;$outsidePath=Join-Path $fixture.Outside 'plan-directory-target';[IO.Directory]::CreateDirectory($outsidePath)|Out-Null;New-CcodJunction -Path $directory -Target $outsidePath}
+            $fence=&$lifecycleModule {param($Root,$Ready,$Identity)New-CcodLifecycleProductCleanupFence -InstallRoot $Root -ReadyTransaction $Ready -OwnerIdentity $Identity} $fixture.Install $authority.Ready $outer.OwnerIdentity
+            $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $authority.Ready;$fixture.Transactions.Add($product);&$module {param($Transaction,$Fence)Set-CcodInstallProductCleanupFence -Transaction $Transaction -Fence $Fence|Out-Null} $product $fence
+            Assert-CcodThrows {Read-CcodInstallLegacyMigrationPlan -Transaction $product -ReadyTransaction $authority.Ready|Out-Null} 'CCOD_INSTALL_LEGACY_PLAN_READ_FAILED'
+            Close-CcodInstallFileTransaction -Transaction $product -Disposition Failed;$product=$null;&$lifecycleModule {param($Fence)Complete-CcodLifecycleProductCleanupFence -Fence $Fence -Outcome Completed|Out-Null} $fence
+        }finally{if($null-ne$product){try{Close-CcodInstallFileTransaction -Transaction $product -Disposition Failed}catch{}};if($null-ne$outer){try{&$lifecycleModule {param($Context)Exit-CcodLifecycleProductCleanupLease -Context $Context|Out-Null} $outer}catch{}};Remove-CcodInstallFileFixture $fixture}
+    }
+}
+
 # Production mutation caught: a selected Ready chain cannot authorize product access while an unrelated install remains nonterminal.
 Invoke-CcodTest 'product authority uses the canonical global lifecycle head and retains no authority after unrelated Prepared rejection' {
     $authority=New-CcodProductAuthorityFixture;$fixture=$authority.Fixture
@@ -336,7 +421,7 @@ Invoke-CcodTest 'product authority rejects incomplete pointer stores and changed
     }
 }
 
-Invoke-CcodTest 'V5 state-only transaction writes records but cannot reach generation or pointer operations' {
+Invoke-CcodTest 'V6 state-only transaction writes records but cannot reach generation or pointer operations' {
     $fixture=New-CcodInstallFileFixture;$transaction=$null
     try{$transaction=Open-CcodInstallStateTransaction -InstallRoot $fixture.Install;$fixture.Transactions.Add($transaction);$state=New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'state' -CreateIfMissing;$records=New-CcodInstallDirectory -Transaction $transaction -Parent $state -Leaf 'install-transactions' -CreateIfMissing;Write-CcodInstallRecord -Transaction $transaction -Parent $records -Leaf 'ready.json' -Record ([ordered]@{schemaVersion=1;phase='Ready'})|Out-Null;Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $fixture.Install 'state\install-transactions\ready.json')) 'state-only transaction writes a create-only state record';Assert-CcodThrows {Write-CcodInstallRecord -Transaction $transaction -Parent $records -Leaf 'ready.json' -Record ([ordered]@{schemaVersion=1;phase='Ready'})|Out-Null} 'CCOD_INSTALL_RECORD_EXISTS';Assert-CcodThrows {New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'runtime' -CreateIfMissing|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {New-CcodInstallGenerationLeaf -Generation $transaction -Leaf 'payload'|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';$source=New-CcodSourceFile $fixture 'state-source.txt' 'x';Assert-CcodThrows {Copy-CcodInstallSealedSource -Generation $transaction -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {Write-CcodInstallGenerationManifest -Generation $transaction -Manifest (New-CcodGenerationManifest 'state-runtime')|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId 'state-runtime' -ExpectedManifestSha256 ('0'*64) -FileTransaction $transaction|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $transaction -ExpectedPreviousGeneration 0 -FileTransaction $transaction|Out-Null} 'CCOD_INSTALL_POINTER_TARGET_INVALID';Assert-CcodThrows {Retire-CcodInstallGeneration -InstallRoot $fixture.Install -RuntimeId 'state-runtime' -FileTransaction $transaction|Out-Null} 'CCOD_INSTALL_GENERATION_NOT_OWNED';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $fixture.Install 'runtime')) 'state-only transaction creates no runtime tree';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $fixture.Install 'state\active-generation')) 'state-only transaction creates no active pointer';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $fixture.Install 'state\retired-generations')) 'state-only transaction creates no retirement record'}finally{Remove-CcodInstallFileFixture $fixture}
 }
@@ -836,17 +921,17 @@ Invoke-CcodExtensionRedTest 'child-transaction' 'rejects a child directory capab
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
 
-Invoke-CcodExtensionRedTest 'v4-reimport' 'a child process loads V4 first then proves the V5 state-only export boundary' {
+Invoke-CcodExtensionRedTest 'v4-reimport' 'a child process loads V4 first then proves the V6 state-only export boundary' {
     $fixture=New-CcodInstallFileFixture
     try {
-        $source=New-CcodSourceFile $fixture 'v5-state-source.txt' 'state-only-after-v4'
+        $source=New-CcodSourceFile $fixture 'v6-state-source.txt' 'state-only-after-v4'
         $escapedModule=$modulePath.Replace("'","''");$escapedInstall=$fixture.Install.Replace("'","''");$escapedSource=$source.Path.Replace("'","''")
         $child=@"
 `$ErrorActionPreference='Stop';`$ProgressPreference='SilentlyContinue'
 Add-Type -TypeDefinition 'public sealed class CcodInstallGenerationCapabilityMarkerV4 { private CcodInstallGenerationCapabilityMarkerV4() {} public static int CapabilityAbi { get { return 4; } } }'
-if([CcodInstallGenerationCapabilityMarkerV4]::CapabilityAbi-ne4-or`$null-ne('CcodInstallGenerationCapabilityMarkerV5'-as[type])){throw 'V4 was not loaded first'}
+if([CcodInstallGenerationCapabilityMarkerV4]::CapabilityAbi-ne4-or`$null-ne('CcodInstallGenerationCapabilityMarkerV6'-as[type])){throw 'V4 was not loaded first'}
 Import-Module '$escapedModule' -Force -DisableNameChecking -ErrorAction Stop
-if([CcodInstallGenerationCapabilityMarkerV5]::CapabilityAbi-ne5){throw 'V5 ABI missing'}
+if([CcodInstallGenerationCapabilityMarkerV6]::CapabilityAbi-ne6){throw 'V6 ABI missing'}
 function Assert-ChildThrows([scriptblock]`$Action,[string]`$ErrorId){try{&`$Action;throw "EXPECTED_`$ErrorId"}catch{if(`$_.FullyQualifiedErrorId-notlike"`$ErrorId*"){throw}}}
 `$transaction=Open-CcodInstallStateTransaction -InstallRoot '$escapedInstall'
 try{
@@ -863,11 +948,11 @@ try{
   Assert-ChildThrows {Retire-CcodInstallGeneration -InstallRoot '$escapedInstall' -RuntimeId 'runtime-v3-old' -FileTransaction `$transaction|Out-Null} 'CCOD_INSTALL_GENERATION_NOT_OWNED'
   if([IO.Directory]::Exists((Join-Path '$escapedInstall' 'runtime'))-or[IO.Directory]::Exists((Join-Path '$escapedInstall' 'state\active-generation'))-or[IO.Directory]::Exists((Join-Path '$escapedInstall' 'state\retired-generations'))){throw 'state-only escape observed'}
 }finally{Close-CcodInstallFileTransaction -Transaction `$transaction -Disposition Ready}
-[Console]::Out.WriteLine('V4_FIRST_V5_STATE_ONLY_OK')
+[Console]::Out.WriteLine('V4_FIRST_V6_STATE_ONLY_OK')
 "@
         $encoded=[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($child));$output=@(& powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand $encoded 2>&1);$exitCode=$LASTEXITCODE
-        Assert-CcodEqual 0 $exitCode 'fresh child process accepts V5 after loading only V4 first'
-        Assert-CcodEqual 'V4_FIRST_V5_STATE_ONLY_OK' ($output -join '') 'child proves only the exported V5 state-only boundary'
+        Assert-CcodEqual 0 $exitCode 'fresh child process accepts V6 after loading only V4 first'
+        Assert-CcodEqual 'V4_FIRST_V6_STATE_ONLY_OK' ($output -join '') 'child proves only the exported V6 state-only boundary'
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
 
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index 24b2055..4349c49 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -456,19 +456,21 @@ function New-CcodLifecycleProductSideEffectAdapters {
     param([Parameter(Mandatory)][hashtable]$State)
     @{
         WriteProductRegistration={param($Registration,$ReadyEvidence)if($State.FailWrites){throw 'TEST_PRODUCT_WRITE_FAILURE'};$State.Registration=$Registration;$State.ReadyEvidence=$ReadyEvidence;$State.Writes++}.GetNewClosure()
-        ReadProductRegistration={param($Registration)$State.Registration}.GetNewClosure()
+        ReadProductRegistration={param($Registration)if($State.ContainsKey('FailReadProduct')-and$State.FailReadProduct){throw 'TEST_PRODUCT_READBACK_FAILURE'};$State.Registration}.GetNewClosure()
         WriteShortcut={
             param($Kind,$Shortcut,$FileTransaction,$ReadyEvidence)
             $relative='registration/'+$(if($Kind-ceq'StartMenu'){'StartMenu.CodexRemote-fix.lnk'}else{'Desktop.CodexRemote-fix.lnk'})
             try{$fileModule=Get-Module -All|Where-Object{$null-ne$_.Path-and[IO.Path]::GetFileName($_.Path)-ceq'InstallFileTransaction.psm1'}|Select-Object -First 1;if($null-eq$fileModule){throw 'install file transaction module unavailable'};$source=&$fileModule {param($Generation,$Path,$Record)Open-CcodInstallRetainedFile -Generation $Generation -RelativePath $Path -ReadyTransaction $Record} $FileTransaction $relative $ReadyEvidence.transactionRecord}catch{$State.RetainedError=([string]$_.FullyQualifiedErrorId-split',')[0];throw}
             if($null-eq$source){throw 'retained shortcut capability missing'}
+            if($State.ContainsKey('FailShortcutKind')-and[string]$State.FailShortcutKind-ceq$Kind){throw 'TEST_PRODUCT_SHORTCUT_WRITE_FAILURE'}
             $State.ProductOnlyObserved=$true;$State.Shortcuts[$Kind]=$Shortcut;$State.ShortcutWrites++
             if($State.ContainsKey('LegacyEntries')){
                 $legacyName=if($Kind-ceq'StartMenu'){$v2521LifecycleShortcutNames[0]}else{$v2521LifecycleShortcutNames[3]}
                 if(-not$State.LegacyEntries.Contains($legacyName)){$State.LegacyEntries.Add($legacyName)}
                 if($State.ContainsKey('LegacyShortcutProofs')){
+                    $candidateBytes=[IO.File]::ReadAllBytes([string]$Shortcut.candidatePath)
                     $State.LegacyShortcutProofs[$legacyName]=[pscustomobject][ordered]@{
-                        targetPath=[string]$ReadyEvidence.targetPath;arguments=[string]$ReadyEvidence.arguments;workingDirectory='';sha256=$(if($Kind-ceq'StartMenu'){[string]$ReadyEvidence.startMenuSha256}else{[string]$ReadyEvidence.desktopSha256})
+                        targetPath=[string]$ReadyEvidence.targetPath;arguments=[string]$ReadyEvidence.arguments;workingDirectory='';sha256=$(if($Kind-ceq'StartMenu'){[string]$ReadyEvidence.startMenuSha256}else{[string]$ReadyEvidence.desktopSha256});bytesBase64=[Convert]::ToBase64String($candidateBytes)
                     }
                 }
             }
@@ -496,10 +498,15 @@ function New-CcodLifecycleProductSideEffectAdapters {
                     $base=if(([string]$entry).StartsWith('Programs\',[StringComparison]::Ordinal)){[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs)}else{[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop)}
                     $relative=([string]$entry).Substring(([string]$entry).IndexOf('\')+1);$proof=if($State.ContainsKey('LegacyShortcutProofs')){$State.LegacyShortcutProofs[[string]$entry]}else{$null}
                     $entries.Add([pscustomobject][ordered]@{kind='Shortcut';name=[string]$entry;path=[IO.Path]::GetFullPath((Join-Path $base $relative));sha256=[string]$proof.sha256;bytesBase64=[string]$proof.bytesBase64;targetPath=[string]$proof.targetPath;arguments=[string]$proof.arguments;workingDirectory=[string]$proof.workingDirectory})
-                }else{$entries.Add([string]$entry)}
+                }else{$entries.Add([pscustomobject][ordered]@{kind='Registry';path=('HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\'+$State.LegacyRegistration.appId+'_is1');values=[ordered]@{DisplayVersion=[pscustomobject]@{value=[string]$State.LegacyRegistration.displayVersion;kind='String'};InstallLocation=[pscustomobject]@{value=[string]$State.LegacyRegistration.installLocation;kind='String'};UninstallString=[pscustomobject]@{value=[string]$State.LegacyRegistration.uninstallString;kind='String'}}})}
             }
             [pscustomobject][ordered]@{appId=$State.LegacyRegistration.appId;entries=@($entries)}
         }.GetNewClosure()
+        GetCurrentShortcutProof={
+            param($Kind,$Shortcut,$ReadyEvidence)
+            $name=if($Kind-ceq'StartMenu'){$v2521LifecycleShortcutNames[0]}else{$v2521LifecycleShortcutNames[3]};$base=if($Kind-ceq'StartMenu'){[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs)}else{[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop)};$relative=$name.Substring($name.IndexOf('\')+1);$item=Get-Item -LiteralPath ([string]$Shortcut.candidatePath) -Force
+            [pscustomobject][ordered]@{kind=$Kind;name=$name;path=[IO.Path]::GetFullPath((Join-Path $base $relative));candidatePath=[IO.Path]::GetFullPath([string]$Shortcut.candidatePath);candidateLength=[int64]$item.Length;candidateSha256=$(if($Kind-ceq'StartMenu'){[string]$ReadyEvidence.startMenuSha256}else{[string]$ReadyEvidence.desktopSha256});targetPath=[string]$ReadyEvidence.targetPath;arguments=[string]$ReadyEvidence.arguments;workingDirectory=''}
+        }.GetNewClosure()
         RemoveLegacyEntry={param($Entry);$name=if($Entry-is[string]){[string]$Entry}elseif($Entry.kind-ceq'Registry'){'Registry'}else{[string]$Entry.name};$State.LegacyRemovalAttempts++;[void]$State.LegacyEntries.Remove($name)}.GetNewClosure()
         ReadLegacyEntry={param($Entry);$name=if($Entry-is[string]){[string]$Entry}elseif($Entry.kind-ceq'Registry'){'Registry'}else{[string]$Entry.name};if($State.LegacyEntries.Contains($name)){'Exact'}else{$null}}.GetNewClosure()
         RestoreLegacyEntry={param($Entry);$name=if($Entry-is[string]){[string]$Entry}elseif($Entry.kind-ceq'Registry'){'Registry'}else{[string]$Entry.name};if(-not$State.LegacyEntries.Contains($name)){$State.LegacyEntries.Add($name)}}.GetNewClosure()
@@ -1065,6 +1072,14 @@ $results += Invoke-CcodTest 'real v2.5.21 legacy lifecycle state upgrades throug
         Assert-CcodEqual ([uint64]2) $currentCompatibility.ActiveGeneration 'current compatibility remains bound to the selected generation'
         Assert-CcodEqual $currentManifestHash $currentCompatibility.ManifestSha256 'current compatibility remains bound to the selected manifest'
         Assert-CcodTrue $upgrade.ProductRegistrationVerified 'true legacy migration completes the real product-registration boundary'
+        $migrationPlans=@(Get-ChildItem -LiteralPath (Join-Path $install 'state\legacy-registration-migrations') -File -Force)
+        Assert-CcodEqual 1 $migrationPlans.Count 'Ready-bound legacy migration plan is durable before any overlapping current registration write'
+        $migrationPlan=Get-Content -LiteralPath $migrationPlans[0].FullName -Raw|ConvertFrom-Json -ErrorAction Stop
+        Assert-CcodEqual $ready.transactionId $migrationPlan.transactionId 'durable migration plan binds the exact Ready transaction'
+        Assert-CcodEqual ([uint64]$ready.newGeneration) ([uint64]$migrationPlan.runtimeGeneration) 'durable migration plan binds the selected generation'
+        Assert-CcodEqual $ready.newManifestSha256 $migrationPlan.manifestSha256 'durable migration plan binds the selected manifest'
+        Assert-CcodEqual $ready.sealedPackageSha256 $migrationPlan.packageSha256 'durable migration plan binds the selected package'
+        Assert-CcodEqual 'version,runtimeId,packageSha256,shortcuts' (($migrationPlan.expectedCurrentProof.PSObject.Properties.Name)-join',') 'durable migration plan carries only the exact current proof contract'
         Assert-CcodEqual 3 $productState.LegacyRemovalAttempts 'true v2.5.21 migration removes the registry compatibility link and uninstall link'
         Assert-CcodEqual ((@($v2521LifecycleShortcutNames[0],$v2521LifecycleShortcutNames[3])|Sort-Object)-join'|') ((@($productState.LegacyEntries)|Sort-Object)-join'|') 'true v2.5.21 migration preserves both exact current shortcut replacements'
         Assert-CcodEqual 0 $productState.LegacyCompensationFailures.Count 'successful true legacy cleanup needs no unresolved compensation record'
@@ -1085,6 +1100,35 @@ $results += Invoke-CcodTest 'real v2.5.21 legacy lifecycle state upgrades throug
     }
 }
 
+# Production mutation caught: a Ready product retry recaptures the washed live profile instead of reopening its disk plan.
+$results += Invoke-CcodTest 'new lifecycle invocation replays the disk plan after partial overlapping current writes' {
+    foreach($failurePoint in @('DesktopWrite','CurrentReadBack')){
+        $legacySource=New-CcodLifecycleTempRoot;$source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
+        try{
+            New-CcodLifecycleSourceFixture -Root $legacySource -Version '2.5.21'|Out-Null;$legacy=New-CcodLifecycleV2521LegacyInstallFixture -InstallRoot $install -SourceRoot $legacySource
+            New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null;$node=New-CcodLifecycleFakeNode -Root $nodeRoot
+            $legacyEntries=[Collections.Generic.List[string]]::new();foreach($entry in @('Registry')+$v2521LifecycleShortcutNames){$legacyEntries.Add($entry)}
+            $productState=@{FailWrites=$false;FailShortcutKind=$(if($failurePoint-ceq'DesktopWrite'){'Desktop'}else{$null});FailReadProduct=($failurePoint-ceq'CurrentReadBack');Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{};LegacyRegistration=[pscustomobject][ordered]@{appId='{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}';displayVersion='2.5.21';installLocation='C:\legacy\CodexControlOtherDevices-installer';uninstallString='"C:\legacy\CodexControlOtherDevices-installer\unins000.exe"';shortcutNames=@($v2521LifecycleShortcutNames);unsafeShortcutNames=@()};LegacyEntries=$legacyEntries;LegacyShortcutProofs=(New-CcodLifecycleV2521ShortcutProofs -InstallRoot $install -InstallerRoot 'C:\legacy\CodexControlOtherDevices-installer');LegacyUnsafeShortcutNames=@();LegacyRemovalAttempts=0;LegacyCompensationFailures=[Collections.Generic.List[object]]::new()}
+            $firstFake=New-CcodLifecycleFake -NodePath $node;Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $firstFake -ProductState $productState
+            $firstFailure=$null;try{Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('a'*64) -Adapters $firstFake.Adapters|Out-Null}catch{$firstFailure=$_}
+            Assert-CcodEqual 'CCOD_PRODUCT_REGISTRATION_FAILED' (([string]$firstFailure.FullyQualifiedErrorId-split',')[0]) "$failurePoint first invocation fails at the intended post-Ready product boundary"
+            $runtimeCount=@(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory -Force).Count;$selectorCount=@(Get-ChildItem -LiteralPath (Join-Path $install 'state\active-generation') -File -Force).Count;$planFiles=@(Get-ChildItem -LiteralPath (Join-Path $install 'state\legacy-registration-migrations') -File -Force)
+            Assert-CcodEqual 1 $planFiles.Count "$failurePoint first invocation persisted exactly one disk plan"
+            Assert-CcodEqual 0 $productState.LegacyRemovalAttempts "$failurePoint first invocation never begins legacy-only cleanup"
+            $productState.FailShortcutKind=$null;$productState.FailReadProduct=$false
+            $secondFake=New-CcodLifecycleFake -NodePath $node;Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $secondFake -ProductState $productState
+            $second=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('a'*64) -Adapters $secondFake.Adapters
+            Assert-CcodEqual 'AlreadyInstalled' $second.Outcome "$failurePoint new invocation reopens the same Ready installation"
+            Assert-CcodTrue $second.ProductRegistrationVerified "$failurePoint new invocation converges product registration from the disk plan"
+            Assert-CcodEqual $runtimeCount @(Get-ChildItem -LiteralPath (Join-Path $install 'runtime') -Directory -Force).Count "$failurePoint retry creates no runtime"
+            Assert-CcodEqual $selectorCount @(Get-ChildItem -LiteralPath (Join-Path $install 'state\active-generation') -File -Force).Count "$failurePoint retry appends no selector"
+            Assert-CcodEqual 1 @(Get-ChildItem -LiteralPath (Join-Path $install 'state\legacy-registration-migrations') -File -Force).Count "$failurePoint retry leaves one append-only disk plan"
+            Assert-CcodEqual 3 $productState.LegacyRemovalAttempts "$failurePoint retry removes the exact registry and two legacy-only shortcuts"
+            Assert-CcodEqual ((@($v2521LifecycleShortcutNames[0],$v2521LifecycleShortcutNames[3])|Sort-Object)-join'|') ((@($productState.LegacyEntries)|Sort-Object)-join'|') "$failurePoint retry preserves only exact current overlap replacements"
+        }finally{foreach($path in @($legacySource,$source,$install,$nodeRoot)){if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path -Recurse -Force}}}
+    }
+}
+
 # Production mutation caught: current registration writes the two overlapping names before it
 # proves that one complete historical profile existed, washing missing or foreign legacy leaves.
 $results += Invoke-CcodTest 'legacy profile is captured before any current product or shortcut write' {
diff --git a/tests/persistence/ProductRegistration.SelfTest.ps1 b/tests/persistence/ProductRegistration.SelfTest.ps1
index b859bb7..2d43ea9 100644
--- a/tests/persistence/ProductRegistration.SelfTest.ps1
+++ b/tests/persistence/ProductRegistration.SelfTest.ps1
@@ -12,8 +12,11 @@ $runtimeId = '2.5.22-1111111111111111-22222222222222222222222222222222'
 $packageSha256 = '3' * 64
 $appId = '{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}'
 $canonicalTaskTarget=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'schtasks.exe'))
-$cleanupReady=[pscustomobject][ordered]@{phase='Ready';installRoot='C:\fixture\CodexControlOtherDevices';runtimeId=$runtimeId;runtimeGeneration=[uint64]7;packageSha256=$packageSha256;manifestSha256=('a'*64);startMenuSha256=('b'*64);desktopSha256=('c'*64);targetPath=$canonicalTaskTarget;arguments='/Run /TN "Codex Control Other Devices Supervisor"'}
-$expectedVerifiedRegistration=[pscustomobject][ordered]@{verified=$true;runtimeId=$runtimeId;version='2.5.22';packageSha256=$packageSha256;shortcutNames=@('Programs\CodexRemote-fix\CodexRemote-fix.lnk','Desktop\CodexRemote-fix.lnk');startMenuSha256=('b'*64);desktopSha256=('c'*64)}
+$startCurrentBytes=[Text.UTF8Encoding]::new($false).GetBytes('current-shortcut:Programs\CodexRemote-fix\CodexRemote-fix.lnk')
+$desktopCurrentBytes=[Text.UTF8Encoding]::new($false).GetBytes('current-shortcut:Desktop\CodexRemote-fix.lnk')
+$testSha=[Security.Cryptography.SHA256]::Create();try{$startCurrentSha=[BitConverter]::ToString($testSha.ComputeHash($startCurrentBytes)).Replace('-','').ToLowerInvariant();$desktopCurrentSha=[BitConverter]::ToString($testSha.ComputeHash($desktopCurrentBytes)).Replace('-','').ToLowerInvariant()}finally{$testSha.Dispose()}
+$cleanupReady=[pscustomobject][ordered]@{phase='Ready';installRoot='C:\fixture\CodexControlOtherDevices';runtimeId=$runtimeId;runtimeGeneration=[uint64]7;packageSha256=$packageSha256;manifestSha256=('a'*64);startMenuSha256=$startCurrentSha;desktopSha256=$desktopCurrentSha;targetPath=$canonicalTaskTarget;arguments='/Run /TN "Codex Control Other Devices Supervisor"'}
+$expectedVerifiedRegistration=[pscustomobject][ordered]@{verified=$true;runtimeId=$runtimeId;version='2.5.22';packageSha256=$packageSha256;shortcutNames=@('Programs\CodexRemote-fix\CodexRemote-fix.lnk','Desktop\CodexRemote-fix.lnk');startMenuSha256=$startCurrentSha;desktopSha256=$desktopCurrentSha}
 $fullReadyRecord=[pscustomobject][ordered]@{schemaVersion=1;transactionId='11111111-2222-3333-4444-555555555555';oldRuntimeId=$null;oldGeneration=$null;oldManifestSha256=$null;newRuntimeId=$runtimeId;newGeneration=[uint64]7;newManifestSha256=('a'*64);sealedPackageSha256=$packageSha256;ownedObjectNames=@($runtimeId);phase='Ready';errorCode=$null}
 $v210ShortcutNames = @(
     'Programs\Codex Control other devices\Codex Control other devices for Windows.lnk',
@@ -33,6 +36,8 @@ $v2521ShortcutNames = @(
 $currentShortcutNames=@($v2521ShortcutNames[0],$v2521ShortcutNames[3])
 $legacyInstallLocation = 'C:\legacy\CodexControlOtherDevices-installer'
 
+function Get-CcodTestBytesSha256([byte[]]$Bytes){$sha=[Security.Cryptography.SHA256]::Create();try{[BitConverter]::ToString($sha.ComputeHash($Bytes)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()}}
+
 function New-CcodLegacyRegistrationFixture {
     param(
         [Parameter(Mandatory)][string]$Version,
@@ -81,6 +86,10 @@ function New-CcodProductLegacyShortcutProofs {
     $proofs
 }
 
+function New-CcodProductCurrentShortcutProofs {
+    $proofs=@{};foreach($name in $currentShortcutNames){$bytes=[Text.UTF8Encoding]::new($false).GetBytes(('current-shortcut:'+([string]$name)));$sha=[Security.Cryptography.SHA256]::Create();try{$hash=[BitConverter]::ToString($sha.ComputeHash($bytes)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()};$proofs[[string]$name]=[pscustomobject][ordered]@{targetPath=$canonicalTaskTarget;arguments='/Run /TN "Codex Control Other Devices Supervisor"';workingDirectory='';sha256=$hash;bytesBase64=[Convert]::ToBase64String($bytes)}};$proofs
+}
+
 function New-CcodRegistrationWorld {
     param([string]$InstallRoot = 'C:\fixture\CodexControlOtherDevices')
 
@@ -95,8 +104,8 @@ function New-CcodRegistrationWorld {
             packageSha256 = $packageSha256
             runtimeGeneration = [uint64]7
             manifestSha256 = 'a'*64
-            startMenuSha256 = 'b'*64
-            desktopSha256 = 'c'*64
+            startMenuSha256 = $startCurrentSha
+            desktopSha256 = $desktopCurrentSha
             targetPath = $canonicalTaskTarget
             arguments = '/Run /TN "Codex Control Other Devices Supervisor"'
             transactionRecord = $fullReadyRecord
@@ -126,6 +135,11 @@ function New-CcodRegistrationWorld {
         VerifiedRegistrationMutationAt = 0
         LegacySnapshotHashOverrides = @{}
         LegacyShortcutProofs = $null
+        CurrentShortcutProofs = (New-CcodProductCurrentShortcutProofs)
+        SimulateOverlapWrites = $false
+        LegacyMigrationPlanBytes = $null
+        LegacyMigrationPlanWrites = 0
+        LegacyMigrationPlanReads = 0
         Calls = [Collections.Generic.List[string]]::new()
     }
     $world.LegacyShortcutProofs=New-CcodProductLegacyShortcutProofs -Legacy $world.Legacy -ExpectedInstallRoot $registration.installRoot
@@ -150,6 +164,7 @@ function New-CcodRegistrationWorld {
             $world.Shortcuts[$Kind] = $Shortcut
             $legacyName=if($Kind-ceq'StartMenu'){$currentShortcutNames[0]}else{$currentShortcutNames[1]}
             if(-not$world.LegacyEntries.Contains($legacyName)){$world.LegacyEntries.Add($legacyName)}
+            if($world.SimulateOverlapWrites){$world.LegacyShortcutProofs[$legacyName]=$world.CurrentShortcutProofs[$legacyName]}
         }.GetNewClosure()
         ReadShortcut = {
             param($Kind,$Shortcut)
@@ -160,10 +175,10 @@ function New-CcodRegistrationWorld {
         ReadLegacyRegistration = {param($ExpectedAppId)$world.Calls.Add('ReadLegacy');if(-not$world.LegacyEntries.Contains('Registry')){return $null};[pscustomobject][ordered]@{appId=[string]$world.Legacy.appId;displayVersion=[string]$world.Legacy.displayVersion;installLocation=[string]$world.Legacy.installLocation;uninstallString=[string]$world.Legacy.uninstallString;shortcutNames=@($world.LegacyEntries|Where-Object{[string]$_-cne'Registry'});unsafeShortcutNames=@($world.Legacy.unsafeShortcutNames)}}.GetNewClosure()
         ReadVerifiedRegistration = {
             $world.VerifiedRegistrationReads++
-            $startMenuSha256=if($world.VerifiedRegistrationMutationAt-eq$world.VerifiedRegistrationReads){'d'*64}else{'b'*64}
+            $startMenuSha256=if($world.VerifiedRegistrationMutationAt-eq$world.VerifiedRegistrationReads){'d'*64}else{[string]$world.Ready.startMenuSha256}
             [pscustomobject][ordered]@{
                 verified=($null-ne$world.Product-and$world.Shortcuts.Count-eq2);runtimeId=$runtimeId;version='2.5.22';packageSha256=$packageSha256
-                shortcutNames=@($currentShortcutNames);startMenuSha256=$startMenuSha256;desktopSha256=('c'*64)
+                shortcutNames=@($currentShortcutNames);startMenuSha256=$startMenuSha256;desktopSha256=[string]$world.Ready.desktopSha256
             }
         }.GetNewClosure()
         RemoveLegacyRegistration = { param($ExpectedAppId,$ExpectedShortcutNames) $world.Calls.Add('RemoveLegacy'); $world.LegacyRemovalCalls++; $world.LegacyRemoved = $true }.GetNewClosure()
@@ -178,12 +193,20 @@ function New-CcodRegistrationWorld {
                     $relative=([string]$entry).Substring(([string]$entry).IndexOf('\')+1);$proof=$world.LegacyShortcutProofs[[string]$entry];$sha=[string]$proof.sha256
                     if($world.LegacySnapshotHashOverrides.ContainsKey([string]$entry)){$sha=[string]$world.LegacySnapshotHashOverrides[[string]$entry]}
                     $entries.Add([pscustomobject][ordered]@{kind='Shortcut';name=[string]$entry;path=[IO.Path]::GetFullPath((Join-Path $base $relative));sha256=$sha;bytesBase64=[string]$proof.bytesBase64;targetPath=[string]$proof.targetPath;arguments=[string]$proof.arguments;workingDirectory=[string]$proof.workingDirectory})
-                }else{$entries.Add([string]$entry)}
+                }else{$entries.Add([pscustomobject][ordered]@{kind='Registry';path=('HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\'+$world.Legacy.appId+'_is1');values=[ordered]@{DisplayVersion=[pscustomobject]@{value=[string]$world.Legacy.displayVersion;kind='String'};InstallLocation=[pscustomobject]@{value=[string]$world.Legacy.installLocation;kind='String'};UninstallString=[pscustomobject]@{value=[string]$world.Legacy.uninstallString;kind='String'}}})}
             }
             [pscustomobject][ordered]@{appId=$world.Legacy.appId;entries=@($entries)}
         }.GetNewClosure()
+        GetCurrentShortcutProof = {
+            param($Kind,$Shortcut,$ReadyEvidence)
+            $name=if($Kind-ceq'StartMenu'){$currentShortcutNames[0]}else{$currentShortcutNames[1]};$proof=$world.CurrentShortcutProofs[$name]
+            $base=if($Kind-ceq'StartMenu'){[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs)}else{[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop)};$relative=$name.Substring($name.IndexOf('\')+1)
+            [pscustomobject][ordered]@{kind=$Kind;name=$name;path=[IO.Path]::GetFullPath((Join-Path $base $relative));candidatePath=[IO.Path]::GetFullPath([string]$Shortcut.candidatePath);candidateLength=[int64]([Convert]::FromBase64String([string]$proof.bytesBase64).LongLength);candidateSha256=[string]$proof.sha256;targetPath=[string]$proof.targetPath;arguments=[string]$proof.arguments;workingDirectory=[string]$proof.workingDirectory}
+        }.GetNewClosure()
+        ReadLegacyMigrationPlan = {param($ReadyEvidence)$world.LegacyMigrationPlanReads++;if($null-eq$world.LegacyMigrationPlanBytes){return $null};$bytes=[byte[]]$world.LegacyMigrationPlanBytes.Clone();[pscustomobject]@{Bytes=$bytes;Length=[int64]$bytes.LongLength;Sha256=(Get-CcodTestBytesSha256 $bytes)}}.GetNewClosure()
+        WriteLegacyMigrationPlan = {param($ReadyEvidence,[byte[]]$Bytes)if($null-ne$world.LegacyMigrationPlanBytes){throw 'fixture durable plan collision'};$world.LegacyMigrationPlanWrites++;$world.LegacyMigrationPlanBytes=[byte[]]$Bytes.Clone();[pscustomobject]@{Length=[int64]$Bytes.LongLength;Sha256=(Get-CcodTestBytesSha256 $Bytes)}}.GetNewClosure()
         RemoveLegacyEntry = {param($Entry);$name=if($Entry-is[string]){[string]$Entry}elseif($Entry.kind-ceq'Registry'){'Registry'}else{[string]$Entry.name};$world.LegacyRemoveAttempts++;if($world.LegacyRemoveFailureAt-eq$world.LegacyRemoveAttempts){throw 'fixture legacy delete failure'};[void]$world.LegacyEntries.Remove($name)}.GetNewClosure()
-        ReadLegacyEntry = {param($Entry);$name=if($Entry-is[string]){[string]$Entry}elseif($Entry.kind-ceq'Registry'){'Registry'}else{[string]$Entry.name};if($world.LegacyReplacementEntry-ceq$name-and$world.LegacyRemoveFailureAt-gt0-and$world.LegacyRemoveAttempts-ge$world.LegacyRemoveFailureAt){return 'Mismatch'};if($world.LegacyEntries.Contains($name)){'Exact'}else{$null}}.GetNewClosure()
+        ReadLegacyEntry = {param($Entry);$name=if($Entry-is[string]){[string]$Entry}elseif($Entry.kind-ceq'Registry'){'Registry'}else{[string]$Entry.name};if($world.LegacyReplacementEntry-ceq$name-and$world.LegacyRemoveFailureAt-gt0-and$world.LegacyRemoveAttempts-ge$world.LegacyRemoveFailureAt){return 'Mismatch'};if(-not$world.LegacyEntries.Contains($name)){return $null};if($Entry-isnot[string]-and$Entry.kind-ceq'Shortcut' -and [string]$Entry.sha256-cne[string]$world.LegacyShortcutProofs[$name].sha256){return 'Mismatch'};'Exact'}.GetNewClosure()
         RestoreLegacyEntry = {param($Entry);$name=if($Entry-is[string]){[string]$Entry}elseif($Entry.kind-ceq'Registry'){'Registry'}else{[string]$Entry.name};if($world.LegacyRestoreFailureEntry-ceq$name){throw 'fixture restore failed'};if(-not$world.LegacyEntries.Contains($name)){$world.LegacyEntries.Add($name)};$world.LegacyRestoreOrder.Add($name);$world.LegacyRestores++}.GetNewClosure()
         WriteLegacyCompensationFailure = {param($Record)$world.LegacyUnresolvedRecords.Add($Record)}.GetNewClosure()
     }
@@ -208,7 +231,7 @@ function Set-CcodRegistrationLegacyFixture {
 
 function Get-CcodProductTestLegacyMigrationPlan {
     param([Parameter(Mandatory)]$World)
-    Get-CcodLegacyProductRegistrationMigrationPlan -ExpectedAppId $appId -ExpectedInstallRoot ([string]$World.Registration.installRoot) -Adapters $World.Adapters
+    Get-CcodDurableLegacyProductRegistrationMigrationPlan -ExpectedAppId $appId -Registration $World.Registration -ReadyEvidence $World.Ready -Adapters $World.Adapters
 }
 
 function New-CcodFix1RegistryKey {
@@ -298,7 +321,7 @@ function Invoke-CcodFix1RegistryCompensationScenario {
         $snapshotEntries=[Collections.Generic.List[object]]::new();$snapshotEntries.Add($registryEntry)
         foreach($name in $v2521ShortcutNames){$base=if($name.StartsWith('Programs\',[StringComparison]::Ordinal)){$programs}else{$desktop};$relative=$name.Substring($name.IndexOf('\')+1);$shortcut=$proofs[$name];$snapshotEntries.Add([pscustomobject][ordered]@{kind='Shortcut';name=$name;path=[IO.Path]::GetFullPath((Join-Path $base $relative));sha256=[string]$shortcut.sha256;bytesBase64=[string]$shortcut.bytesBase64;targetPath=[string]$shortcut.targetPath;arguments=[string]$shortcut.arguments;workingDirectory=[string]$shortcut.workingDirectory})}
         $snapshot=[pscustomobject][ordered]@{appId=$appId;entries=@($snapshotEntries)}
-        $proof=[pscustomobject][ordered]@{verified=$true;runtimeId=$runtimeId;version='2.5.22';packageSha256=$packageSha256;shortcutNames=@($currentShortcutNames);startMenuSha256=('b'*64);desktopSha256=('c'*64)}
+        $proof=[pscustomobject][ordered]@{verified=$true;runtimeId=$runtimeId;version='2.5.22';packageSha256=$packageSha256;shortcutNames=@($currentShortcutNames);startMenuSha256=$startCurrentSha;desktopSha256=$desktopCurrentSha}
         $removeRegistry={param($Entry)&$isolated {param($Value)Remove-CcodLegacySnapshotEntry -Entry $Value} $Entry}.GetNewClosure()
         $readRegistry={param($Entry)&$isolated {param($Value)Read-CcodLegacySnapshotEntry -Entry $Value} $Entry}.GetNewClosure()
         $restoreRegistry={param($Entry)&$isolated {param($Value)Restore-CcodLegacySnapshotEntry -Entry $Value} $Entry}.GetNewClosure()
@@ -364,6 +387,95 @@ $results += Invoke-CcodTest 'write and read-back failures preserve every legacy
     }
 }
 
+# Production mutation caught: the pre-capture plan exists only in memory, so a failed current
+# overlap write permanently destroys the historical proof needed by the next process.
+$results += Invoke-CcodTest 'second registration recovers from partial current overlap writes only through a durable pre-capture plan' {
+    $outcomes=[Collections.Generic.List[string]]::new()
+    foreach($failurePoint in @('DesktopWrite','CurrentReadBack')){
+        $world=New-CcodRegistrationWorld;$world.SimulateOverlapWrites=$true;$world.Ready.startMenuSha256=[string]$world.CurrentShortcutProofs[$currentShortcutNames[0]].sha256;$world.Ready.desktopSha256=[string]$world.CurrentShortcutProofs[$currentShortcutNames[1]].sha256
+        if($failurePoint-ceq'DesktopWrite'){$world.WriteShortcutFailure='Desktop'}else{$world.ReadProductFailure=$true}
+        $firstPlan=Get-CcodProductTestLegacyMigrationPlan $world;$firstFailure=$null;try{Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters|Out-Null}catch{$firstFailure=$_}
+        Assert-CcodEqual 'CCOD_PRODUCT_REGISTRATION_FAILED' (([string]$firstFailure.FullyQualifiedErrorId-split',')[0]) "$failurePoint first attempt fails after its intended overlap boundary"
+        $firstPlan=$null;$world.WriteShortcutFailure=$null;$world.ReadProductFailure=$false
+        $secondFailure=$null;$secondReceipt=$null;try{$secondPlan=Get-CcodProductTestLegacyMigrationPlan $world;$secondReceipt=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters}catch{$secondFailure=$_}
+        $outcome=if($null-ne$secondReceipt-and$secondReceipt.verified){'Recovered'}else{([string]$secondFailure.FullyQualifiedErrorId-split',')[0]};$outcomes.Add(('{0}:{1}'-f$failurePoint,$outcome))
+    }
+    Assert-CcodEqual 'DesktopWrite:Recovered|CurrentReadBack:Recovered' (@($outcomes)-join'|') 'a new process reuses durable historical evidence after either overlap failure'
+}
+
+# Production mutation caught: durable replay assumes Start-menu is always replaced before Desktop and rejects another valid crash ordering.
+$results += Invoke-CcodTest 'durable replay converges all four independent historical and current overlap states' {
+    foreach($state in @('HistoricalHistorical','CurrentHistorical','HistoricalCurrent','CurrentCurrent')){
+        $world=New-CcodRegistrationWorld;$null=Get-CcodProductTestLegacyMigrationPlan $world
+        if($state-in@('CurrentHistorical','CurrentCurrent')){$world.LegacyShortcutProofs[$currentShortcutNames[0]]=$world.CurrentShortcutProofs[$currentShortcutNames[0]]}
+        if($state-in@('HistoricalCurrent','CurrentCurrent')){$world.LegacyShortcutProofs[$currentShortcutNames[1]]=$world.CurrentShortcutProofs[$currentShortcutNames[1]]}
+        $plan=Get-CcodProductTestLegacyMigrationPlan $world;$world.SimulateOverlapWrites=$true;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
+        Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -MigrationPlan $plan -ExpectedCurrentProof $expectedVerifiedRegistration -Adapters $world.Adapters
+        Assert-CcodEqual (($currentShortcutNames|Sort-Object)-join'|') ((@($world.LegacyEntries)|Sort-Object)-join'|') "$state converges to only the two exact current overlaps"
+        Assert-CcodEqual 1 $world.LegacyMigrationPlanWrites "$state reuses one append-only plan"
+    }
+}
+
+# Production mutation caught: a later idempotent registration mistakes already-completed exact legacy cleanup for evidence loss.
+$results += Invoke-CcodTest 'durable migration replay continues every registry-first legacy cleanup crash boundary' {
+    $legacyOnly=@($v2521ShortcutNames[1],$v2521ShortcutNames[2])
+    foreach($removedCount in 0..2){
+        $world=New-CcodRegistrationWorld;$world.SimulateOverlapWrites=$true;$null=Get-CcodProductTestLegacyMigrationPlan $world;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters
+        [void]$world.LegacyEntries.Remove('Registry');for($index=0;$index-lt$removedCount;$index++){[void]$world.LegacyEntries.Remove($legacyOnly[$index])}
+        $second=Get-CcodProductTestLegacyMigrationPlan $world
+        Assert-CcodEqual $true $second.legacyPresent "registry-first crash boundary $removedCount retains the durable cleanup plan"
+        $before=$world.LegacyRemoveAttempts;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -MigrationPlan $second -ExpectedCurrentProof $expectedVerifiedRegistration -Adapters $world.Adapters
+        Assert-CcodEqual (2-$removedCount) ($world.LegacyRemoveAttempts-$before) "registry-first crash boundary $removedCount removes only remaining exact legacy-only shortcuts"
+        Assert-CcodEqual (($currentShortcutNames|Sort-Object)-join'|') ((@($world.LegacyEntries)|Sort-Object)-join'|') "registry-first crash boundary $removedCount converges without restoring removed entries"
+        Assert-CcodEqual 1 $world.LegacyMigrationPlanWrites "registry-first crash boundary $removedCount preserves one append-only plan"
+    }
+    $partial=New-CcodRegistrationWorld;$partial.SimulateOverlapWrites=$true;$null=Get-CcodProductTestLegacyMigrationPlan $partial;$null=Commit-CcodProductRegistration -Registration $partial.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $partial.Adapters;[void]$partial.LegacyEntries.Remove($legacyOnly[0]);$plan=Get-CcodProductTestLegacyMigrationPlan $partial;$null=Commit-CcodProductRegistration -Registration $partial.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $partial.Adapters;Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -MigrationPlan $plan -ExpectedCurrentProof $expectedVerifiedRegistration -Adapters $partial.Adapters
+    Assert-CcodEqual (($currentShortcutNames|Sort-Object)-join'|') ((@($partial.LegacyEntries)|Sort-Object)-join'|') 'registry-present partial legacy-only cleanup also converges absent-or-exact'
+    $foreign=New-CcodRegistrationWorld;$foreign.SimulateOverlapWrites=$true;$null=Get-CcodProductTestLegacyMigrationPlan $foreign;$null=Commit-CcodProductRegistration -Registration $foreign.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $foreign.Adapters;[void]$foreign.LegacyEntries.Remove('Registry');$bytes=[Text.UTF8Encoding]::new($false).GetBytes('foreign-legacy-only');$foreign.LegacyShortcutProofs[$legacyOnly[0]]=[pscustomobject][ordered]@{targetPath=$canonicalTaskTarget;arguments='foreign';workingDirectory='';sha256=(Get-CcodTestBytesSha256 $bytes);bytesBase64=[Convert]::ToBase64String($bytes)}
+    Assert-CcodThrows {Get-CcodProductTestLegacyMigrationPlan $foreign|Out-Null} 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+}
+
+# Production mutations caught: accepting a washed hybrid without a plan, or trusting changed durable identity/evidence.
+$results += Invoke-CcodTest 'durable migration plan rejects absent tampered foreign and wrong Ready identities before current writes' {
+    $absent=New-CcodRegistrationWorld;$foreignBytes=[Text.UTF8Encoding]::new($false).GetBytes('foreign-current-overlap');$foreignSha=Get-CcodTestBytesSha256 $foreignBytes
+    $absent.LegacyShortcutProofs[$currentShortcutNames[0]]=[pscustomobject][ordered]@{targetPath=$canonicalTaskTarget;arguments='/Run /TN "foreign"';workingDirectory='';sha256=$foreignSha;bytesBase64=[Convert]::ToBase64String($foreignBytes)}
+    Assert-CcodThrows {Get-CcodProductTestLegacyMigrationPlan $absent|Out-Null} 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+    Assert-CcodEqual 0 $absent.LegacyMigrationPlanWrites 'washed hybrid without a prior plan publishes no replacement authority'
+    Assert-CcodEqual 0 $absent.Shortcuts.Count 'washed hybrid without a prior plan performs zero current shortcut writes'
+
+    $oversized=New-CcodRegistrationWorld;$oversizedBytes=[byte[]]::new(262145);$oversizedName=$v2521ShortcutNames[1];$oversizedProof=$oversized.LegacyShortcutProofs[$oversizedName];$oversizedProof.bytesBase64=[Convert]::ToBase64String($oversizedBytes);$oversizedProof.sha256=Get-CcodTestBytesSha256 $oversizedBytes
+    Assert-CcodThrows {Get-CcodProductTestLegacyMigrationPlan $oversized|Out-Null} 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+    Assert-CcodEqual 0 $oversized.LegacyMigrationPlanWrites 'oversized historical shortcut is rejected before durable publication'
+
+    foreach($inconsistency in @('Generation','Manifest','TransactionPackage')){$world=New-CcodRegistrationWorld;$world.Ready.transactionRecord=(($world.Ready.transactionRecord|ConvertTo-Json -Depth 8 -Compress)|ConvertFrom-Json);if($inconsistency-ceq'Generation'){$world.Ready.runtimeGeneration=[uint64]8}elseif($inconsistency-ceq'Manifest'){$world.Ready.manifestSha256='e'*64}else{$world.Ready.transactionRecord.sealedPackageSha256='e'*64};Assert-CcodThrows {Get-CcodProductTestLegacyMigrationPlan $world|Out-Null} 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID';Assert-CcodEqual 0 $world.LegacyMigrationPlanWrites "$inconsistency inconsistent Ready proof publishes no plan"}
+
+    foreach($mutation in @('TamperedCurrentProof','WrongReady','WrongPackage','WrongGeneration','Duplicate','UnsafeShortcut','ForeignHybrid')){
+        $world=New-CcodRegistrationWorld;$null=Get-CcodProductTestLegacyMigrationPlan $world
+        if($mutation-ceq'ForeignHybrid'){
+            $world.LegacyShortcutProofs[$currentShortcutNames[0]]=[pscustomobject][ordered]@{targetPath=$canonicalTaskTarget;arguments='/Run /TN "foreign"';workingDirectory='';sha256=$foreignSha;bytesBase64=[Convert]::ToBase64String($foreignBytes)}
+        }else{
+            $json=[Text.UTF8Encoding]::new($false,$true).GetString($world.LegacyMigrationPlanBytes)
+            if($mutation-ceq'Duplicate'){$json=$json.Replace('{"schemaVersion":1','{"schemaVersion":1,"schemaVersion":1')}
+            else{
+                $record=$json|ConvertFrom-Json -ErrorAction Stop
+                switch($mutation){
+                    'TamperedCurrentProof' {$record.expectedCurrentProof.shortcuts[0].candidateSha256='f'*64}
+                    'WrongReady' {$record.readyTransaction.transactionId='aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee'}
+                    'WrongPackage' {$record.packageSha256='e'*64}
+                    'WrongGeneration' {$record.runtimeGeneration=[uint64]8}
+                    'UnsafeShortcut' {$record.snapshot.entries[1].path='C:\outside\foreign.lnk'}
+                }
+                $json=($record|ConvertTo-Json -Depth 32 -Compress)+"`n"
+            }
+            $world.LegacyMigrationPlanBytes=[Text.UTF8Encoding]::new($false).GetBytes($json)
+        }
+        Assert-CcodThrows {Get-CcodProductTestLegacyMigrationPlan $world|Out-Null} 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+        Assert-CcodEqual 1 $world.LegacyMigrationPlanWrites "$mutation never republishes or overwrites the first plan"
+        Assert-CcodEqual 0 $world.Shortcuts.Count "$mutation fails before a current shortcut write"
+        Assert-CcodEqual $null $world.Product "$mutation fails before a current registry write"
+    }
+}
+
 # Production mutation caught: trusting a shortcut read-back that resolves outside the selected sealed generation.
 $results += Invoke-CcodTest 'shortcut path and target mismatches fail the three-record read-back gate' {
     foreach ($kind in @('StartMenu','Desktop')) {

From 66a91aa1341d4988e793cc8ce46bee549921b5a4 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 08:04:42 +0800
Subject: [PATCH 144/187] docs: record durable legacy migration evidence

---
 .../progress.md                               |   8 +-
 .../task-2-report.md                          | 158 ++++++++++++++++++
 2 files changed, 164 insertions(+), 2 deletions(-)
 create mode 100644 .superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-2-report.md

diff --git a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
index 85128ac..aabaf7a 100644
--- a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
+++ b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
@@ -19,6 +19,10 @@ Plan: `docs/superpowers/plans/2026-09-03-v2522-cross-process-retry-closure.md`
 
 Task 1: complete. Initial implementation/evidence `9973bfd..bf4d215`; fix round 1 implementation/evidence `bf939c6..6107151`. Fix-round scoped re-review: Spec Compliance PASS, Task Quality PASS, 0 Critical, 0 Important. Final focused evidence: UninstallBootstrap 45/45, ManualWrappers pass, parser 2/2, `git diff --check` exit 0. No real system action.
 
-Task 2: pending.
+Task 2: complete. Implementation `148f6ee`; evidence is recorded by the commit containing
+`task-2-report.md` and this ledger update. Final focused evidence: InstallFileTransaction 41 groups,
+ProductRegistration 28/28, InstallLifecycle 151/151, UninstallBootstrap 45/45, RuntimeManifest 21 groups,
+InstalledLifecycleHarness 21 groups, Bootstrap 26/26, ManualWrappers 12 groups, parser 6/6,
+`git diff --check` exit 0, and `tests\PersistenceSelfTest.ps1` exit 0. No real system action.
 
-Final gate and fresh scoped review: pending. Tasks 5–8 remain blocked.
+Successor final gate: complete. Fresh scoped review: pending. Tasks 5–8 remain blocked.
diff --git a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-2-report.md b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-2-report.md
new file mode 100644
index 0000000..7b42b3d
--- /dev/null
+++ b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-2-report.md
@@ -0,0 +1,158 @@
+# Task 2 report — durable legacy migration plan replay
+
+## 结论与范围
+
+Task 2 已按 successor plan 完成，implementation commit 为 `148f6ee`
+（`fix: persist legacy product migration plan`），基线为 Task 1 复审通过后的 `bc0441d`。
+本任务只修改 6 个实现/测试文件：
+
+- `src/persistence/modules/InstallFileTransaction.psm1`
+- `src/persistence/modules/ProductRegistration.psm1`
+- `src/persistence/modules/InstallLifecycle.psm1`
+- `tests/persistence/InstallFileTransaction.SelfTest.ps1`
+- `tests/persistence/ProductRegistration.SelfTest.ps1`
+- `tests/persistence/InstallLifecycle.SelfTest.ps1`
+
+没有执行真实 registry、shortcut、scheduled task、安装、卸载、进程重启、系统重启、网络、push、
+tag、release 或发布操作；device-key/DPAPI state 未触碰。所有破坏性边界仅在独立临时 fixture
+中模拟，wrapper 的安装路径只执行 `WhatIf`。
+
+## 根因与 RED
+
+旧实现只把完整历史 profile 保存在调用栈内。第一次 current registration 若已替换一个或两个与
+v2.5.21 重叠的 `.lnk`，第二个进程重新执行 live capture 时会把 current/historical 混合态当成
+不完整历史 profile，永久返回 `CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID`。
+
+production 未修改时，首组 production-shaped RED 的实际结果为：
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ProductRegistration.SelfTest.ps1
+exit 1
+case=second-registration-recovers-from-partial-current-overlap-writes-only-through-a-durable-pre-capture-plan
+expected=DesktopWrite:Recovered|CurrentReadBack:Recovered
+actual=DesktopWrite:CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID|CurrentReadBack:CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID
+```
+
+专用 IFT wishful API 的 RED 首错为 export surface 缺少
+`Read/Write-CcodInstallLegacyMigrationPlan`。真实 lifecycle RED 在 v2.5.21 -> v2.5.22 入口命中
+`state\legacy-registration-migrations` `PathNotFound`，证明 orchestration 尚未持久化计划。
+
+自审再得到三项有效 RED：
+
+- registry 已删除而 legacy-only shortcuts 仍在时，second replay 错误返回
+  `legacyPresent=False`，会永久遗留旧快捷方式；
+- Ready proof generation 与 transaction generation 不一致时，旧 matcher 没有拒绝；
+- live ProductTransaction 内刚发布的 plan 可被移动替换，`expected moved=False, actual=True`。
+
+oversized historical leaf、ACL/ADS/multilink/reparse、partial cleanup、foreign replacement 与四种
+overlap 组合在同一 RED/hostile 批次加入；最终均由下述 focused/final gate 覆盖。
+
+## 实现
+
+### IFT V6 专用能力
+
+ABI 升为 V6，仅新增两个固定用途 export；没有导出可读任意 state leaf 的通用 reader。
+
+- 固定目录：`state\legacy-registration-migrations`；
+- 固定叶：`<20-digit Ready generation>.<Ready transactionId>.json`；
+- 每次读写都要求 exact ProductTransaction root、live `AccountTransition` lease、durable Pending
+  cleanup fence，并在锁内重读完整 selector/manifest/persisted Ready authority；
+- write 为 no-replace create-only，最大 1 MiB；read 使用相对目录 native handle；
+- plan 目录与文件使用 protected exact ACL：current SID、SYSTEM、Administrators 三项 FullControl，
+  owner 为 current SID；延迟读取在同一 native handle 上复验 ACL/owner；
+- 拒绝 reparse、ADS、multilink、路径/对象 identity 变化；刚发布的 plan handle 保持到 product
+  transaction close，replacement 在 live proof-to-use 区间被阻止；
+- generic product state directory/write surface 仍保持拒绝。
+
+### canonical durable schema 与 replay
+
+schema v1 固定并按顺序绑定：
+
+`schemaVersion, transactionId, runtimeId, runtimeGeneration, manifestSha256, packageSha256,
+readyTransaction, appId, expectedInstallRoot, legacyPresent, legacyRegistration, profile, snapshot,
+expectedCurrentProof`。
+
+历史 snapshot 保存 exact registry values/kinds，以及每个 shortcut 的 canonical path、原始 bytes、
+length-bound hash、target、arguments、working directory；单个历史 shortcut 限制为 1..262144 bytes。
+`expectedCurrentProof` 额外绑定 version/runtime/package 和两个 current shortcut 的 canonical
+destination、candidate path/length/SHA、target、arguments、working directory。该 proof 只取首次
+持久记录，后续进程不以新生成候选替换它。
+
+reader 要求 strict UTF-8、所有 object 无 duplicate properties、完整 exact field set、canonical JSON
+bytes 与 1 MiB 总界限；Ready transaction/runtime/generation/manifest/package 会交叉匹配，而不仅比较
+单个 hash。
+
+已有 exact plan 的 second process 逐项分类 overlap：captured historical exact 或同一 persisted
+current proof exact；HH、CH、HC、CC 四态都收敛，foreign/missing required overlap 拒绝。没有 plan 的
+washed hybrid 仍在 plan/current write 前失败。
+
+legacy-only cleanup 也按 durable snapshot 做 `Absent=already done / Exact=delete / Mismatch=fail`。
+因此 registry-first 删除后在 0/1/2 个 legacy-only 删除边界崩溃，second process 都只继续剩余 exact
+项；registry present 的 partial shortcut 边界也可收敛；foreign replacement 零删除拒绝。registry
+absent 不再被当成整个 cleanup 已完成。
+
+### Lifecycle 接线
+
+`RegisterProduct` 在既有 Local/Global 顺序和 cleanup fence 内打开同一个 owned ProductTransaction，
+先读取或发布并 read-back exact durable plan，之后才允许 current registry / StartMenu / Desktop 写入。
+second `Invoke-CcodInstall` 使用新 fake adapters、丢弃所有进程内 plan，并从同一磁盘叶在
+`AlreadyInstalled` 路径恢复；不会新增 runtime 或 selector。
+
+## 负例与故障边界
+
+最终 focused tests 覆盖：
+
+- Desktop write 前（StartMenu 已替换）与 current read-back（两项已替换）跨调用恢复；
+- HH、CH、HC、CC 四种独立 overlap；
+- no-plan washed hybrid、tampered current proof、wrong Ready/package/generation、duplicate JSON、
+  unsafe path、foreign hybrid；
+- Ready proof/transaction generation、manifest、package 内部不一致；
+- historical shortcut 262145-byte rejection；
+- registry-first 0/1/2 legacy-only partial deletion、registry-present partial deletion与 foreign tail；
+- IFT wrong scope/Ready/fence、oversized record、collision、live replacement、file/directory ACL、ADS、
+  multilink、file/directory reparse；
+- disk plan leaf/schema/Ready identity，以及真实 lifecycle 新进程形态的 second invocation。
+
+## frozen final gate
+
+source 冻结后顺序执行，结果如下：
+
+```text
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallFileTransaction.SelfTest.ps1
+  41 named test groups; exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ProductRegistration.SelfTest.ps1
+  Product registration self-tests passed: 28; exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstallLifecycle.SelfTest.ps1
+  Install lifecycle self-tests passed: 151; exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\UninstallBootstrap.SelfTest.ps1
+  Uninstall bootstrap self-tests passed: 45; exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\RuntimeManifest.SelfTest.ps1
+  21 named test groups; exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\InstalledLifecycleHarness.SelfTest.ps1
+  21 named test groups; exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\Bootstrap.SelfTest.ps1
+  Bootstrap self-test passed: 26; exit 0
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\persistence\ManualWrappers.SelfTest.ps1
+  12 named test groups; exit 0
+
+PowerShell parser: 6/6 changed files, 0 errors
+git diff --check: exit 0 (仅 checkout LF/CRLF conversion warning)
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\PersistenceSelfTest.ps1
+  exit 0; success path is silent
+```
+
+Lifecycle 的既有 cross-process guard 仍输出：
+`exit=23 mutex=True authority=False product=False verified=False error=CCOD_PRODUCT_REGISTRATION_FAILED`。
+
+## 边界
+
+Task 2 与 successor plan 的本地 final gate 已完成；fresh scoped review 仍待 parent agent 发起。
+本报告不声明 Tasks 5–8、合并、发布或 release readiness 完成。

From 3d40763d6813d286bd007232659e0f38592234bb Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 08:17:18 +0800
Subject: [PATCH 145/187] docs: plan durable migration review fixes

---
 .../progress.md                                       |  8 ++------
 .../task-2-fix1-brief.md                              | 11 +++++++++++
 2 files changed, 13 insertions(+), 6 deletions(-)
 create mode 100644 .superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-2-fix1-brief.md

diff --git a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
index aabaf7a..1126923 100644
--- a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
+++ b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
@@ -19,10 +19,6 @@ Plan: `docs/superpowers/plans/2026-09-03-v2522-cross-process-retry-closure.md`
 
 Task 1: complete. Initial implementation/evidence `9973bfd..bf4d215`; fix round 1 implementation/evidence `bf939c6..6107151`. Fix-round scoped re-review: Spec Compliance PASS, Task Quality PASS, 0 Critical, 0 Important. Final focused evidence: UninstallBootstrap 45/45, ManualWrappers pass, parser 2/2, `git diff --check` exit 0. No real system action.
 
-Task 2: complete. Implementation `148f6ee`; evidence is recorded by the commit containing
-`task-2-report.md` and this ledger update. Final focused evidence: InstallFileTransaction 41 groups,
-ProductRegistration 28/28, InstallLifecycle 151/151, UninstallBootstrap 45/45, RuntimeManifest 21 groups,
-InstalledLifecycleHarness 21 groups, Bootstrap 26/26, ManualWrappers 12 groups, parser 6/6,
-`git diff --check` exit 0, and `tests\PersistenceSelfTest.ps1` exit 0. No real system action.
+Task 2: initial implementation `148f6ee`, evidence `66a91aa`; scoped review FAIL (0 Critical, 3 Important). Fix round 1 is in progress. Required closure: crash-safe fixed-directory ACL initialization and registered-handle cleanup; exact nested profile/raw-path schema; real child-process replay plus published-write/read-back failure retry evidence.
 
-Successor final gate: complete. Fresh scoped review: pending. Tasks 5–8 remain blocked.
+The prior frozen gate passed but is invalidated by the required Task 2 source changes. Successor final gate and fresh scoped review: pending. Tasks 5–8 remain blocked.
diff --git a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-2-fix1-brief.md b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-2-fix1-brief.md
new file mode 100644
index 0000000..505eaa4
--- /dev/null
+++ b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-2-fix1-brief.md
@@ -0,0 +1,11 @@
+# Task 2 fix round 1 — directory creation recovery and exact durable evidence
+
+Read the Task 2 report and scoped review. Fix the three Important findings without weakening the already accepted V6 scope, Ready/fence/lease, overlap, or cleanup-tail boundaries.
+
+## Required RED -> GREEN
+
+1. Cover the CREATE-to-ACL crash shape for `state\legacy-registration-migrations`. A newly created directory must never leave an unregistered handle on Set/Validate failure. A later ProductTransaction may normalize only an empty, non-reparse directory owned by the current SID whose inherited ACL contains only the explicitly trusted SID/SYSTEM/Administrators full-control principals; nonempty, foreign-owner, untrusted-ACE, ADS, or identity-drift cases fail closed. Reader-first retry must recover the known empty crash artifact before returning no plan. Prefer atomic creation security if the native layer can provide it more safely.
+2. Require exact nested schema. Persisted `profile` must have exactly the five canonical profile fields in canonical order and byte-equivalent values to `Resolve-CcodLegacyRegistrationProfile`. `expectedInstallRoot`, every historical shortcut path/target/working-directory, and other identity paths must equal their canonical strings, not merely normalize to them. Add extra/missing/reordered profile and equivalent-noncanonical path REDs.
+3. Add separate-`powershell.exe` replay evidence that reads serialized plan/live-state data and invokes the production durable replay parser/classifier with no parent-process object identity. Add published-but-threw writer and post-write read-back failure cases: first invocation performs zero current writes; the later invocation reads the existing exact leaf, does not republish it, and converges. Use independent serialized objects for all read-backs.
+
+Run IFT, ProductRegistration and Lifecycle focused suites, then repeat the complete frozen gate, parsers and `git diff --check`. Commit implementation and evidence separately, update the ledger/report, and request a scoped fix-round review. No real system/external actions or release claim.

From a0c8d716687d72338cb71822eff57b642b079fa4 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 09:13:41 +0800
Subject: [PATCH 146/187] fix: harden durable legacy plan recovery

---
 .../modules/InstallFileTransaction.psm1       | 29 ++++++--
 .../modules/ProductRegistration.psm1          | 19 +++--
 .../InstallFileTransaction.SelfTest.ps1       | 74 +++++++++++++++++++
 .../ProductRegistration.SelfTest.ps1          | 71 +++++++++++++++++-
 4 files changed, 175 insertions(+), 18 deletions(-)

diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index 02455b1..5cb42da 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -87,7 +87,7 @@ internal sealed class CcodInstallGenerationRuntimeV6 : IDisposable
     private readonly HashSet<object> retainedScopes = new HashSet<object>(ReferenceComparer.Instance);
     private readonly HashSet<object> productFolders = new HashSet<object>(ReferenceComparer.Instance);
     private readonly List<FileStream> externalStreams = new List<FileStream>();
-    private bool disposed; private string cleanupError;
+    private bool disposed; private string cleanupError,legacyPlanDirectoryFailureForTest;
 
     private readonly bool stateOnly,productOnly,retryOnly;
     private CcodInstallGenerationRuntimeV6(string installRoot,Pin root,Pin runtimeParent,bool stateOnly,bool productOnly,bool retryOnly)
@@ -194,6 +194,11 @@ internal sealed class CcodInstallGenerationRuntimeV6 : IDisposable
         if(!productOnly||bytes==null||bytes.LongLength==0||bytes.LongLength>1048576)throw new InvalidOperationException("product-only scope");Pin requestedRoot=Require(rootToken,true);ValidateCurrent(requestedRoot);if(!Object.ReferenceEquals(requestedRoot,root))throw new InvalidOperationException("product-only scope");ValidateLegacyPlanLeaf(leaf);Pin state=OpenExistingDirectory(root,"state");if(state==null)throw new InvalidOperationException("product-only scope");Pin plans=OpenOrCreateLegacyPlanDirectory(state);if(names.ContainsKey(Key(plans,leaf)))throw new Win32Exception(183);Pin pin=CreateLegacyPlanTemporaryFile(plans);pin.Stream.Write(bytes,0,bytes.Length);pin.Stream.Flush(true);SetExactLegacyPlanSecurity(pin.Native,false);ValidateExactLegacyPlanSecurity(pin.Native,false);string sha=Sha(pin.Stream);if(pin.Stream.Length!=bytes.LongLength)throw new InvalidDataException("destination mismatch");SealAndPublish(pin,leaf,bytes.LongLength,sha,false);EnsurePublishedPin(pin);return pin.Token;
     }
 
+    [MethodImpl(MethodImplOptions.Synchronized)] internal void SetLegacyPlanDirectoryFailureForTest(string mode)
+    {
+        if(!productOnly||(mode!="Set"&&mode!="Validate"))throw new InvalidOperationException("product-only scope");legacyPlanDirectoryFailureForTest=mode;
+    }
+
     [MethodImpl(MethodImplOptions.Synchronized)] internal object[] ReadLegacyPlan(object rootToken,string leaf)
     {
         if(!productOnly)throw new InvalidOperationException("product-only scope");Pin requestedRoot=Require(rootToken,true);ValidateCurrent(requestedRoot);if(!Object.ReferenceEquals(requestedRoot,root))throw new InvalidOperationException("product-only scope");ValidateLegacyPlanLeaf(leaf);Pin state=OpenExistingDirectory(root,"state");if(state==null)return new object[0];Pin plans=OpenExistingLegacyPlanDirectory(state);if(plans==null)return new object[0];OpenResult result;
@@ -272,16 +277,21 @@ internal sealed class CcodInstallGenerationRuntimeV6 : IDisposable
 
     private Pin OpenOrCreateLegacyPlanDirectory(Pin state)
     {
-        const string leaf="legacy-registration-migrations";Pin existing;if(names.TryGetValue(Key(state,leaf),out existing)){ValidateCurrent(existing);ValidateExactLegacyPlanSecurity(existing.Native,true);return existing;}OpenResult result;
+        const string leaf="legacy-registration-migrations";Pin existing;if(names.TryGetValue(Key(state,leaf),out existing)){ValidateCurrent(existing);EnsureLegacyPlanDirectorySecurity(existing,true,null);return existing;}OpenResult result;
         try{result=OpenRelative(state.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|READ_CONTROL|WRITE_DAC|WRITE_OWNER|DELETE|SYNC,SHARE_READ|SHARE_WRITE,CREATE,DIRECTORY|BACKUP_INTENT);}catch(Win32Exception exception){if(exception.NativeErrorCode!=80&&exception.NativeErrorCode!=183)throw;result=OpenRelative(state.Native,leaf,LIST_DIRECTORY|ADD_FILE|ADD_SUBDIRECTORY|READ_ATTRIBUTES|READ_CONTROL|WRITE_DAC|WRITE_OWNER|DELETE|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);}
-        try{Pin pin=ValidateDirectoryPin(state,leaf,Path.Combine(state.Path,leaf),result.Created,result.Handle);result.Handle=null;if(result.Created)SetExactLegacyPlanSecurity(pin.Native,true);ValidateExactLegacyPlanSecurity(pin.Native,true);AddPin(pin);return pin;}finally{if(result.Handle!=null)result.Handle.Dispose();}
+        Pin pin=null;bool registered=false;try{pin=ValidateDirectoryPin(state,leaf,Path.Combine(state.Path,leaf),result.Created,result.Handle);result.Handle=null;AddPin(pin);registered=true;string failure=legacyPlanDirectoryFailureForTest;legacyPlanDirectoryFailureForTest=null;EnsureLegacyPlanDirectorySecurity(pin,!result.Created,failure);return pin;}finally{if(!registered&&pin!=null)pin.Dispose();if(result.Handle!=null)result.Handle.Dispose();}
     }
 
     private Pin OpenExistingLegacyPlanDirectory(Pin state)
     {
-        const string leaf="legacy-registration-migrations";Pin existing;if(names.TryGetValue(Key(state,leaf),out existing)){ValidateCurrent(existing);ValidateExactLegacyPlanSecurity(existing.Native,true);return existing;}OpenResult result;
-        try{result=OpenRelative(state.Native,leaf,LIST_DIRECTORY|READ_ATTRIBUTES|READ_CONTROL|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);}catch(Win32Exception exception){if(exception.NativeErrorCode==2||exception.NativeErrorCode==3)return null;throw;}
-        try{Pin pin=ValidateDirectoryPin(state,leaf,Path.Combine(state.Path,leaf),false,result.Handle);result.Handle=null;ValidateExactLegacyPlanSecurity(pin.Native,true);AddPin(pin);return pin;}finally{if(result.Handle!=null)result.Handle.Dispose();}
+        const string leaf="legacy-registration-migrations";Pin existing;if(names.TryGetValue(Key(state,leaf),out existing)){ValidateCurrent(existing);EnsureLegacyPlanDirectorySecurity(existing,true,null);return existing;}OpenResult result;
+        try{result=OpenRelative(state.Native,leaf,LIST_DIRECTORY|READ_ATTRIBUTES|READ_CONTROL|WRITE_DAC|WRITE_OWNER|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);}catch(Win32Exception exception){if(exception.NativeErrorCode==2||exception.NativeErrorCode==3)return null;throw;}
+        Pin pin=null;bool registered=false;try{pin=ValidateDirectoryPin(state,leaf,Path.Combine(state.Path,leaf),false,result.Handle);result.Handle=null;AddPin(pin);registered=true;EnsureLegacyPlanDirectorySecurity(pin,true,null);return pin;}finally{if(!registered&&pin!=null)pin.Dispose();if(result.Handle!=null)result.Handle.Dispose();}
+    }
+
+    private void EnsureLegacyPlanDirectorySecurity(Pin pin,bool allowRecovery,string failure)
+    {
+        ValidateCurrent(pin);byte[] descriptor=ReadLegacyPlanSecurity(pin.Native);if(IsExactLegacyPlanSecurity(descriptor,true))return;if(allowRecovery&&(Enumerate(pin.Native).Length!=0||!IsRecoverableLegacyPlanDirectorySecurity(descriptor)))throw new InvalidDataException("legacy plan security");ValidateCurrent(pin);if(failure=="Set")throw new InvalidDataException("legacy plan test Set failure");SetExactLegacyPlanSecurity(pin.Native,true);ValidateCurrent(pin);if(failure=="Validate")throw new InvalidDataException("legacy plan test Validate failure");ValidateExactLegacyPlanSecurity(pin.Native,true);
     }
 
     private static void ValidateLegacyPlanLeaf(string leaf)
@@ -361,10 +371,13 @@ internal sealed class CcodInstallGenerationRuntimeV6 : IDisposable
         const int information=1|4;uint needed;GetKernelObjectSecurity(handle,information,null,0,out needed);int error=Marshal.GetLastWin32Error();if(needed==0||(error!=0&&error!=122))throw new Win32Exception(error);byte[] descriptor=new byte[needed];if(!GetKernelObjectSecurity(handle,information,descriptor,(uint)descriptor.Length,out needed))throw new Win32Exception(Marshal.GetLastWin32Error());return descriptor;
     }
     private static void SetExactLegacyPlanSecurity(SafeFileHandle handle,bool directory){byte[] descriptor=GetExactLegacyPlanSecurity(directory);if(!SetKernelObjectSecurity(handle,1|4,descriptor))throw new Win32Exception(Marshal.GetLastWin32Error());}
-    private static void ValidateExactLegacyPlanSecurity(SafeFileHandle handle,bool directory)
+    private static bool IsExactLegacyPlanSecurity(byte[] descriptor,bool directory){return TestLegacyPlanSecurity(descriptor,directory,false);}
+    internal static bool IsRecoverableLegacyPlanDirectorySecurity(byte[] descriptor){return TestLegacyPlanSecurity(descriptor,true,true);}
+    private static bool TestLegacyPlanSecurity(byte[] descriptor,bool directory,bool inherited)
     {
-        byte[] descriptor=ReadLegacyPlanSecurity(handle);RawSecurityDescriptor raw=new RawSecurityDescriptor(descriptor,0);WindowsIdentity identity=WindowsIdentity.GetCurrent();try{SecurityIdentifier user=identity.User;if(user==null||raw.Owner==null||!raw.Owner.Equals(user)||(raw.ControlFlags&ControlFlags.DiscretionaryAclProtected)==0||raw.DiscretionaryAcl==null||raw.DiscretionaryAcl.Count!=3)throw new InvalidDataException("legacy plan security");HashSet<string> expected=new HashSet<string>(StringComparer.Ordinal){user.Value,new SecurityIdentifier(WellKnownSidType.LocalSystemSid,null).Value,new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid,null).Value};AceFlags expectedFlags=directory?(AceFlags.ContainerInherit|AceFlags.ObjectInherit):AceFlags.None;foreach(GenericAce generic in raw.DiscretionaryAcl){CommonAce ace=generic as CommonAce;if(ace==null||ace.IsCallback||ace.AceQualifier!=AceQualifier.AccessAllowed||ace.AceFlags!=expectedFlags||ace.AccessMask!=(int)FileSystemRights.FullControl||ace.SecurityIdentifier==null||!expected.Remove(ace.SecurityIdentifier.Value))throw new InvalidDataException("legacy plan security");}if(expected.Count!=0)throw new InvalidDataException("legacy plan security");}finally{identity.Dispose();}
+        try{RawSecurityDescriptor raw=new RawSecurityDescriptor(descriptor,0);WindowsIdentity identity=WindowsIdentity.GetCurrent();try{SecurityIdentifier user=identity.User;bool protectedAcl=(raw.ControlFlags&ControlFlags.DiscretionaryAclProtected)!=0;if(user==null||raw.Owner==null||!raw.Owner.Equals(user)||protectedAcl==inherited||raw.DiscretionaryAcl==null||raw.DiscretionaryAcl.Count!=3)return false;HashSet<string> expected=new HashSet<string>(StringComparer.Ordinal){user.Value,new SecurityIdentifier(WellKnownSidType.LocalSystemSid,null).Value,new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid,null).Value};AceFlags expectedFlags=directory?(AceFlags.ContainerInherit|AceFlags.ObjectInherit):AceFlags.None;if(inherited)expectedFlags|=AceFlags.Inherited;foreach(GenericAce generic in raw.DiscretionaryAcl){CommonAce ace=generic as CommonAce;if(ace==null||ace.IsCallback||ace.AceQualifier!=AceQualifier.AccessAllowed||ace.AceFlags!=expectedFlags||ace.AccessMask!=(int)FileSystemRights.FullControl||ace.SecurityIdentifier==null||!expected.Remove(ace.SecurityIdentifier.Value))return false;}return expected.Count==0;}finally{identity.Dispose();}}catch{return false;}
     }
+    private static void ValidateExactLegacyPlanSecurity(SafeFileHandle handle,bool directory){if(!IsExactLegacyPlanSecurity(ReadLegacyPlanSecurity(handle),directory))throw new InvalidDataException("legacy plan security");}
     internal static object[] ReadAuthorityFile(string path){SafeFileHandle handle=CreateFileW(path,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,IntPtr.Zero,OPEN_EXISTING,NON_DIRECTORY|FLAG_BACKUP|FLAG_REPARSE,IntPtr.Zero);if(handle.IsInvalid){int error=Marshal.GetLastWin32Error();handle.Dispose();throw new Win32Exception(error);}FileStream stream=null;try{stream=new FileStream(handle,FileAccess.Read,65536,false);handle=null;FILE_INFO before=Info(stream.SafeFileHandle);ValidatePlain(before,stream.SafeFileHandle);string finalPath=FinalPath(stream.SafeFileHandle);if(!SamePath(finalPath,path)||stream.Length<0||stream.Length>4194304)throw new InvalidDataException("authority file invalid");byte[] bytes=new byte[(int)stream.Length];int offset=0;while(offset<bytes.Length){int read=stream.Read(bytes,offset,bytes.Length-offset);if(read==0)throw new EndOfStreamException();offset+=read;}FILE_INFO after=Info(stream.SafeFileHandle);ValidatePlain(after,stream.SafeFileHandle);if(before.VolumeSerialNumber!=after.VolumeSerialNumber||before.FileIndexHigh!=after.FileIndexHigh||before.FileIndexLow!=after.FileIndexLow||!SamePath(FinalPath(stream.SafeFileHandle),finalPath))throw new InvalidDataException("path changed");string sha;using(SHA256 hash=SHA256.Create()){sha=BitConverter.ToString(hash.ComputeHash(bytes)).Replace("-","").ToLowerInvariant();}return new object[]{Convert.ToBase64String(bytes),sha};}finally{if(stream!=null)stream.Dispose();if(handle!=null)handle.Dispose();}}
     private static bool IsDirectory(FILE_INFO info){return(info.FileAttributes&ATTR_DIRECTORY)!=0;}
     private static FILE_INFO Info(SafeFileHandle handle){FILE_INFO info;if(handle==null||handle.IsClosed||!GetFileInformationByHandle(handle,out info))throw new Win32Exception(Marshal.GetLastWin32Error());return info;}
diff --git a/src/persistence/modules/ProductRegistration.psm1 b/src/persistence/modules/ProductRegistration.psm1
index 72b7d6c..269bd0a 100644
--- a/src/persistence/modules/ProductRegistration.psm1
+++ b/src/persistence/modules/ProductRegistration.psm1
@@ -647,15 +647,16 @@ function Test-CcodLegacyShortcutSnapshotEntry {
         $sha=[Security.Cryptography.SHA256]::Create()
         try{$capturedHash=[BitConverter]::ToString($sha.ComputeHash($bytes)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()}
     }catch{return $false}
-    return $bytes.LongLength-gt0-and$bytes.LongLength-le262144-and$actualPath-cne$null-and$actualPath-ceq$expectedPath-and$target-ceq$expectedTarget-and
-        [string]$Entry.arguments-ceq[string]$contract.arguments-and$working-ceq$expectedWorking-and$capturedHash-ceq[string]$Entry.sha256
+    return $bytes.LongLength-gt0-and$bytes.LongLength-le262144-and$actualPath-cne$null-and[string]$Entry.path-ceq$actualPath-and$actualPath-ceq$expectedPath-and
+        [string]$Entry.targetPath-ceq$target-and$target-ceq$expectedTarget-and[string]$Entry.arguments-ceq[string]$contract.arguments-and
+        [string]$Entry.workingDirectory-ceq$working-and$working-ceq$expectedWorking-and$capturedHash-ceq[string]$Entry.sha256
 }
 
 function Assert-CcodLegacyMigrationPlan {
     param([Parameter(Mandatory)]$Plan,[Parameter(Mandatory)][string]$ExpectedAppId,[Parameter(Mandatory)][string]$ExpectedInstallRoot)
     $root=Get-CcodProductFullPath $ExpectedInstallRoot
     if(-not(Test-CcodProductExactProperties $Plan $script:CcodLegacyMigrationPlanFields)-or$Plan.appId-isnot[string]-or$Plan.appId-cne$ExpectedAppId-or
-       $Plan.expectedInstallRoot-isnot[string]-or(Get-CcodProductFullPath ([string]$Plan.expectedInstallRoot))-cne$root-or$Plan.legacyPresent-isnot[bool]){
+       $Plan.expectedInstallRoot-isnot[string]-or[string]$Plan.expectedInstallRoot-cne$root-or(Get-CcodProductFullPath ([string]$Plan.expectedInstallRoot))-cne$root-or$Plan.legacyPresent-isnot[bool]){
         Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy migration plan identity is invalid.' $Plan
     }
     if(-not[bool]$Plan.legacyPresent){
@@ -663,7 +664,9 @@ function Assert-CcodLegacyMigrationPlan {
         return $Plan
     }
     $profile=Resolve-CcodLegacyRegistrationProfile -LegacyRegistration $Plan.legacyRegistration
-    if($null-eq$Plan.profile-or$profile.profileId-cne[string]$Plan.profile.profileId-or-not(Test-CcodLegacySnapshotForProfile -Snapshot $Plan.snapshot -Profile $profile -ExpectedAppId $ExpectedAppId)){
+    if($null-eq$Plan.profile-or-not(Test-CcodProductExactProperties $Plan.profile $script:CcodLegacyProfileFields)-or
+       ($Plan.profile|ConvertTo-Json -Depth 8 -Compress)-cne($profile|ConvertTo-Json -Depth 8 -Compress)-or
+       $Plan.profile.appId-cne$ExpectedAppId-or-not(Test-CcodLegacySnapshotForProfile -Snapshot $Plan.snapshot -Profile $profile -ExpectedAppId $ExpectedAppId)){
         Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Legacy migration plan no longer matches one exact profile.' $Plan
     }
     foreach($entry in @($Plan.snapshot.entries)){
@@ -798,14 +801,14 @@ function Get-CcodDurableLegacyProductRegistrationMigrationPlan {
     [CmdletBinding()]
     param([Parameter(Mandatory)][string]$ExpectedAppId,[Parameter(Mandatory)]$Registration,[Parameter(Mandatory)]$ReadyEvidence,[hashtable]$Adapters)
     if($ExpectedAppId-cne$script:CcodProductAppId-or-not(Test-CcodProductRegistration -Registration $Registration -ExpectedRuntimeId ([string]$Registration.runtimeId) -ExpectedVersion $script:CcodProductVersion -ExpectedPackageSha256 ([string]$Registration.packageSha256))-or-not(Test-CcodProductReadyProof $ReadyEvidence $Registration)-or-not(Test-CcodDurableReadyEvidence $ReadyEvidence $Registration)){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable legacy migration requires the exact Ready product identity.' $ExpectedAppId}
-    $adapter=Get-CcodProductRegistrationAdapters $Adapters;$existing=&$adapter.ReadLegacyMigrationPlan $ReadyEvidence
+    $adapter=Get-CcodProductRegistrationAdapters $Adapters;try{$existing=&$adapter.ReadLegacyMigrationPlan $ReadyEvidence}catch{Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable legacy migration plan could not be read.' $ReadyEvidence.transactionRecord.transactionId}
     if($null-ne$existing){$record=ConvertFrom-CcodDurableLegacyMigrationRead -Read $existing -ExpectedAppId $ExpectedAppId -Registration $Registration -ReadyEvidence $ReadyEvidence;return Assert-CcodDurableLegacyReplay -Record $record -Adapters $adapter}
     $plan=Get-CcodLegacyProductRegistrationMigrationPlan -ExpectedAppId $ExpectedAppId -ExpectedInstallRoot ([string]$Registration.installRoot) -Adapters $adapter
     $currentProof=New-CcodDurableCurrentProof -Registration $Registration -ReadyEvidence $ReadyEvidence -Adapters $adapter
     $record=[pscustomobject][ordered]@{schemaVersion=1;transactionId=[string]$ReadyEvidence.transactionRecord.transactionId;runtimeId=[string]$Registration.runtimeId;runtimeGeneration=[uint64]$ReadyEvidence.runtimeGeneration;manifestSha256=[string]$ReadyEvidence.manifestSha256;packageSha256=[string]$Registration.packageSha256;readyTransaction=$ReadyEvidence.transactionRecord;appId=$ExpectedAppId;expectedInstallRoot=[string]$Registration.installRoot;legacyPresent=[bool]$plan.legacyPresent;legacyRegistration=$plan.legacyRegistration;profile=$plan.profile;snapshot=$plan.snapshot;expectedCurrentProof=$currentProof}
     [void](Assert-CcodDurableLegacyMigrationRecord -Record $record -ExpectedAppId $ExpectedAppId -Registration $Registration -ReadyEvidence $ReadyEvidence);$bytes=ConvertTo-CcodDurableLegacyMigrationBytes $record
     try{&$adapter.WriteLegacyMigrationPlan $ReadyEvidence $bytes|Out-Null}catch{Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable legacy migration plan could not be published create-only.' $Record.transactionId}
-    $read=&$adapter.ReadLegacyMigrationPlan $ReadyEvidence;if($null-eq$read-or[Convert]::ToBase64String([byte[]]$read.Bytes)-cne[Convert]::ToBase64String($bytes)){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable legacy migration plan did not read back exactly.' $Record.transactionId}
+    try{$read=&$adapter.ReadLegacyMigrationPlan $ReadyEvidence}catch{Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable legacy migration plan read-back failed after publication.' $Record.transactionId};if($null-eq$read-or[Convert]::ToBase64String([byte[]]$read.Bytes)-cne[Convert]::ToBase64String($bytes)){Throw-CcodProductRegistrationError 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID' 'Durable legacy migration plan did not read back exactly.' $Record.transactionId}
     $persisted=ConvertFrom-CcodDurableLegacyMigrationRead -Read $read -ExpectedAppId $ExpectedAppId -Registration $Registration -ReadyEvidence $ReadyEvidence
     return ConvertTo-CcodDurableLegacyPlan $persisted
 }
@@ -1001,8 +1004,8 @@ function Compare-CcodLegacySnapshotEntry {
     if($null-eq$Current){return 'Absent'}
     if($null-eq$Expected-or$Expected.kind-cne$Current.kind){return 'Mismatch'};$pathMatches=if($Expected.kind-ceq'Registry'){[string]$Expected.path-ceq[string]$Current.path}else{[IO.Path]::GetFullPath([string]$Expected.path)-ceq[IO.Path]::GetFullPath([string]$Current.path)};if(-not$pathMatches){return 'Mismatch'}
     if($Expected.kind-ceq'Registry'){
-        $subkeys=@(if($null-ne$Current.PSObject.Properties['subKeyNames']){@($Current.subKeyNames)});if($subkeys.Count-ne0-or(@($Expected.values.Keys|Sort-Object)-join"`0")-cne(@($Current.values.Keys|Sort-Object)-join"`0")){return 'Mismatch'}
-        foreach($name in @($Expected.values.Keys)){if([string]$Expected.values[$name].kind-cne[string]$Current.values[$name].kind-or($Expected.values[$name].value|ConvertTo-Json -Compress)-cne($Current.values[$name].value|ConvertTo-Json -Compress)){return 'Mismatch'}}
+        $subkeys=@(if($null-ne$Current.PSObject.Properties['subKeyNames']){@($Current.subKeyNames)});$expectedNames=@(Get-CcodProductMapNames $Expected.values);$currentNames=@(Get-CcodProductMapNames $Current.values);if($subkeys.Count-ne0-or(@($expectedNames|Sort-Object)-join"`0")-cne(@($currentNames|Sort-Object)-join"`0")){return 'Mismatch'}
+        foreach($name in $expectedNames){$expectedValue=Get-CcodProductMapValue $Expected.values ([string]$name);$currentValue=Get-CcodProductMapValue $Current.values ([string]$name);if($null-eq$expectedValue-or$null-eq$currentValue-or[string]$expectedValue.kind-cne[string]$currentValue.kind-or($expectedValue.value|ConvertTo-Json -Compress)-cne($currentValue.value|ConvertTo-Json -Compress)){return 'Mismatch'}}
         return 'Exact'
     }
     if($Expected.kind-ceq'Shortcut'-and$Expected.sha256-is[string]-and$Current.sha256-is[string]-and$Expected.sha256-ceq$Current.sha256){return 'Exact'}
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index 5764654..d459e15 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -116,6 +116,28 @@ function Invoke-CcodExtensionRedTest {
     Invoke-CcodTest $Name $Action
 }
 
+function Invoke-CcodTask2Fix1Test {
+    param([Parameter(Mandatory)][string]$Id,[Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][scriptblock]$Action)
+    if(-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK2_FIX1_RED_CASE)-and$env:CCOD_TASK2_FIX1_RED_CASE-cne$Id){return}
+    Invoke-CcodTest $Name $Action
+}
+
+function Set-CcodInstallTestTrustedDirectoryAcl {
+    param([Parameter(Mandatory)][string]$Path)
+    $identity=[Security.Principal.WindowsIdentity]::GetCurrent()
+    try{
+        $security=[Security.AccessControl.DirectorySecurity]::new();$security.SetOwner($identity.User);$security.SetAccessRuleProtection($true,$false)
+        foreach($sid in @($identity.User.Value,'S-1-5-18','S-1-5-32-544')){[void]$security.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new([Security.Principal.SecurityIdentifier]::new($sid),[Security.AccessControl.FileSystemRights]::FullControl,[Security.AccessControl.InheritanceFlags]::ContainerInherit-bor[Security.AccessControl.InheritanceFlags]::ObjectInherit,[Security.AccessControl.PropagationFlags]::None,[Security.AccessControl.AccessControlType]::Allow))}
+        [IO.Directory]::SetAccessControl($Path,$security)
+    }finally{$identity.Dispose()}
+}
+
+function Assert-CcodInstallTestExactPlanDirectoryAcl {
+    param([Parameter(Mandatory)][string]$Path)
+    $identity=[Security.Principal.WindowsIdentity]::GetCurrent()
+    try{$security=[IO.Directory]::GetAccessControl($Path);$rules=@($security.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier]));Assert-CcodEqual $identity.User.Value $security.GetOwner([Security.Principal.SecurityIdentifier]).Value 'normalized plan directory owner is exact';Assert-CcodEqual $true $security.AreAccessRulesProtected 'normalized plan directory ACL is protected';Assert-CcodEqual 3 $rules.Count 'normalized plan directory ACL has exactly three rules';Assert-CcodEqual (($identity.User.Value,'S-1-5-18','S-1-5-32-544'|Sort-Object)-join'|') ((@($rules.IdentityReference.Value)|Sort-Object)-join'|') 'normalized plan directory ACL has only trusted principals'}finally{$identity.Dispose()}
+}
+
 function Invoke-CcodMoveAttempt {
     param([Parameter(Mandatory)][string]$Path)
     try { [IO.File]::Move($Path,$Path+'.moved'); 'moved' } catch [IO.IOException] { 'blocked' } catch [UnauthorizedAccessException] { 'blocked' }
@@ -281,6 +303,58 @@ Invoke-CcodTest 'delayed legacy migration plan read rejects hostile file identit
     }
 }
 
+# Production mutation caught: reader-first retry permanently rejects the exact empty directory left between CREATE and ACL initialization.
+Invoke-CcodTask2Fix1Test 'reader-recovery' 'reader-first plan retry normalizes only the safe empty CREATE-to-ACL artifact' {
+    $authority=New-CcodProductAuthorityFixture;$fixture=$authority.Fixture;$outer=$null;$product=$null;$lifecycleModule=$null;$fence=$null
+    try{
+        $statePath=Join-Path $fixture.Install 'state';Set-CcodInstallTestTrustedDirectoryAcl $statePath;$planDirectory=Join-Path $statePath 'legacy-registration-migrations';[IO.Directory]::CreateDirectory($planDirectory)|Out-Null
+        Assert-CcodEqual $false ([IO.Directory]::GetAccessControl($planDirectory).AreAccessRulesProtected) 'fixture is an inherited safe empty CREATE artifact'
+        $lifecycleModule=Import-Module (Join-Path $projectRoot 'src\persistence\modules\InstallLifecycle.psm1') -Force -PassThru -DisableNameChecking;$outer=&$lifecycleModule {Enter-CcodLifecycleProductCleanupLease};$fence=&$lifecycleModule {param($Root,$Ready,$Identity)New-CcodLifecycleProductCleanupFence -InstallRoot $Root -ReadyTransaction $Ready -OwnerIdentity $Identity} $fixture.Install $authority.Ready $outer.OwnerIdentity
+        $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $authority.Ready;$fixture.Transactions.Add($product);&$module {param($Transaction,$Fence)Set-CcodInstallProductCleanupFence -Transaction $Transaction -Fence $Fence|Out-Null} $product $fence
+        Assert-CcodEqual $null (Read-CcodInstallLegacyMigrationPlan -Transaction $product -ReadyTransaction $authority.Ready) 'reader-first recovery returns no plan after normalizing the empty artifact'
+        Assert-CcodInstallTestExactPlanDirectoryAcl $planDirectory
+        Close-CcodInstallFileTransaction -Transaction $product -Disposition Ready;$product=$null;&$lifecycleModule {param($Fence)Complete-CcodLifecycleProductCleanupFence -Fence $Fence -Outcome Completed|Out-Null} $fence
+    }finally{if($null-ne$product){try{Close-CcodInstallFileTransaction -Transaction $product -Disposition Failed}catch{}};if($null-ne$outer){try{&$lifecycleModule {param($Context)Exit-CcodLifecycleProductCleanupLease -Context $Context|Out-Null} $outer}catch{}};Remove-CcodInstallFileFixture $fixture}
+}
+
+# Production mutation caught: Set/Validate failure loses the newly created directory Pin outside transaction cleanup.
+Invoke-CcodTask2Fix1Test 'create-handle' 'CREATE security failures retain and then release the exact registered directory handle' {
+    foreach($mode in @('Set','Validate')){
+        $authority=New-CcodProductAuthorityFixture;$fixture=$authority.Fixture;$outer=$null;$product=$null;$lifecycleModule=$null;$fence=$null
+        try{
+            $statePath=Join-Path $fixture.Install 'state';Set-CcodInstallTestTrustedDirectoryAcl $statePath;$planDirectory=Join-Path $statePath 'legacy-registration-migrations'
+            $lifecycleModule=Import-Module (Join-Path $projectRoot 'src\persistence\modules\InstallLifecycle.psm1') -Force -PassThru -DisableNameChecking;$outer=&$lifecycleModule {Enter-CcodLifecycleProductCleanupLease};$fence=&$lifecycleModule {param($Root,$Ready,$Identity)New-CcodLifecycleProductCleanupFence -InstallRoot $Root -ReadyTransaction $Ready -OwnerIdentity $Identity} $fixture.Install $authority.Ready $outer.OwnerIdentity
+            $product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $authority.Ready;$fixture.Transactions.Add($product);&$module {param($Transaction,$Fence)Set-CcodInstallProductCleanupFence -Transaction $Transaction -Fence $Fence|Out-Null} $product $fence
+            &$module {param($Transaction,$FailureMode)$scope=Get-CcodInstallTransaction $Transaction 'CCOD_INSTALL_PRODUCT_SCOPE';Invoke-CcodRuntimeMethod $scope.State.Runtime SetLegacyPlanDirectoryFailureForTest @($FailureMode)|Out-Null} $product $mode
+            Assert-CcodThrows {Write-CcodInstallLegacyMigrationPlan -Transaction $product -ReadyTransaction $authority.Ready -Bytes ([Text.UTF8Encoding]::new($false).GetBytes('{"schemaVersion":1}'))|Out-Null} 'CCOD_INSTALL_LEGACY_PLAN_WRITE_FAILED'
+            Assert-CcodTrue ([IO.Directory]::Exists($planDirectory)) "$mode failure leaves the known empty directory artifact"
+            $liveMove=$false;try{[IO.Directory]::Move($planDirectory,$planDirectory+'.live');$liveMove=$true}catch [IO.IOException]{}catch [UnauthorizedAccessException]{};Assert-CcodEqual $false $liveMove "$mode failure keeps the directory identity pinned until close"
+            Close-CcodInstallFileTransaction -Transaction $product -Disposition Failed;$product=$null;&$lifecycleModule {param($Fence)Complete-CcodLifecycleProductCleanupFence -Fence $Fence -Outcome Completed|Out-Null} $fence
+            $moved=$planDirectory+'.closed';[IO.Directory]::Move($planDirectory,$moved);[IO.Directory]::Move($moved,$planDirectory)
+            $fence=&$lifecycleModule {param($Root,$Ready,$Identity)New-CcodLifecycleProductCleanupFence -InstallRoot $Root -ReadyTransaction $Ready -OwnerIdentity $Identity} $fixture.Install $authority.Ready $outer.OwnerIdentity;$product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $authority.Ready;$fixture.Transactions.Add($product);&$module {param($Transaction,$Fence)Set-CcodInstallProductCleanupFence -Transaction $Transaction -Fence $Fence|Out-Null} $product $fence
+            Assert-CcodEqual $null (Read-CcodInstallLegacyMigrationPlan -Transaction $product -ReadyTransaction $authority.Ready) "$mode artifact is recoverable by a later reader-first transaction"
+            Close-CcodInstallFileTransaction -Transaction $product -Disposition Ready;$product=$null;&$lifecycleModule {param($Fence)Complete-CcodLifecycleProductCleanupFence -Fence $Fence -Outcome Completed|Out-Null} $fence
+        }finally{if($null-ne$product){try{Close-CcodInstallFileTransaction -Transaction $product -Disposition Failed}catch{}};if($null-ne$outer){try{&$lifecycleModule {param($Context)Exit-CcodLifecycleProductCleanupLease -Context $Context|Out-Null} $outer}catch{}};Remove-CcodInstallFileFixture $fixture}
+    }
+}
+
+# Production mutation caught: recovery normalizes a nonempty or untrusted inherited directory merely because the final leaf is absent.
+Invoke-CcodTask2Fix1Test 'unsafe-recovery' 'empty-directory recovery rejects nonempty untrusted-ACE and foreign-owner evidence' {
+    foreach($mutation in @('NonEmpty','UntrustedAce')){
+        $authority=New-CcodProductAuthorityFixture;$fixture=$authority.Fixture;$outer=$null;$product=$null;$lifecycleModule=$null;$fence=$null
+        try{
+            $statePath=Join-Path $fixture.Install 'state';Set-CcodInstallTestTrustedDirectoryAcl $statePath;$planDirectory=Join-Path $statePath 'legacy-registration-migrations';[IO.Directory]::CreateDirectory($planDirectory)|Out-Null
+            if($mutation-ceq'NonEmpty'){[IO.File]::WriteAllText((Join-Path $planDirectory 'foreign.bin'),'foreign',[Text.UTF8Encoding]::new($false))}else{$security=[Security.AccessControl.DirectorySecurity]::new($planDirectory,[Security.AccessControl.AccessControlSections]::Access);[void]$security.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new([Security.Principal.SecurityIdentifier]::new('S-1-1-0'),[Security.AccessControl.FileSystemRights]::FullControl,[Security.AccessControl.InheritanceFlags]::ContainerInherit-bor[Security.AccessControl.InheritanceFlags]::ObjectInherit,[Security.AccessControl.PropagationFlags]::None,[Security.AccessControl.AccessControlType]::Allow));[IO.Directory]::SetAccessControl($planDirectory,$security)}
+            $before=[IO.Directory]::GetAccessControl($planDirectory).GetSecurityDescriptorSddlForm([Security.AccessControl.AccessControlSections]::Owner-bor[Security.AccessControl.AccessControlSections]::Access)
+            $lifecycleModule=Import-Module (Join-Path $projectRoot 'src\persistence\modules\InstallLifecycle.psm1') -Force -PassThru -DisableNameChecking;$outer=&$lifecycleModule {Enter-CcodLifecycleProductCleanupLease};$fence=&$lifecycleModule {param($Root,$Ready,$Identity)New-CcodLifecycleProductCleanupFence -InstallRoot $Root -ReadyTransaction $Ready -OwnerIdentity $Identity} $fixture.Install $authority.Ready $outer.OwnerIdentity;$product=Open-CcodInstallProductRegistrationTransaction -InstallRoot $fixture.Install -ReadyTransaction $authority.Ready;$fixture.Transactions.Add($product);&$module {param($Transaction,$Fence)Set-CcodInstallProductCleanupFence -Transaction $Transaction -Fence $Fence|Out-Null} $product $fence
+            Assert-CcodThrows {Read-CcodInstallLegacyMigrationPlan -Transaction $product -ReadyTransaction $authority.Ready|Out-Null} 'CCOD_INSTALL_LEGACY_PLAN_READ_FAILED'
+            $after=[IO.Directory]::GetAccessControl($planDirectory).GetSecurityDescriptorSddlForm([Security.AccessControl.AccessControlSections]::Owner-bor[Security.AccessControl.AccessControlSections]::Access);Assert-CcodEqual $before $after "$mutation unsafe directory is never normalized"
+            Close-CcodInstallFileTransaction -Transaction $product -Disposition Failed;$product=$null;&$lifecycleModule {param($Fence)Complete-CcodLifecycleProductCleanupFence -Fence $Fence -Outcome Completed|Out-Null} $fence
+        }finally{if($null-ne$product){try{Close-CcodInstallFileTransaction -Transaction $product -Disposition Failed}catch{}};if($null-ne$outer){try{&$lifecycleModule {param($Context)Exit-CcodLifecycleProductCleanupLease -Context $Context|Out-Null} $outer}catch{}};Remove-CcodInstallFileFixture $fixture}
+    }
+    $identity=[Security.Principal.WindowsIdentity]::GetCurrent();try{$sddl='O:WDG:{0}D:AI(A;OICIID;FA;;;{0})(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)'-f$identity.User.Value;$descriptor=[Security.AccessControl.RawSecurityDescriptor]::new($sddl);$bytes=[byte[]]::new($descriptor.BinaryLength);$descriptor.GetBinaryForm($bytes,0);$recoverable=&$module {param([byte[]]$Value)[bool](Invoke-CcodRuntimeStatic IsRecoverableLegacyPlanDirectorySecurity @((,$Value)))} $bytes;Assert-CcodEqual $false $recoverable 'foreign owner is rejected by the same native recovery predicate'}finally{$identity.Dispose()}
+}
+
 # Production mutation caught: a selected Ready chain cannot authorize product access while an unrelated install remains nonterminal.
 Invoke-CcodTest 'product authority uses the canonical global lifecycle head and retains no authority after unrelated Prepared rejection' {
     $authority=New-CcodProductAuthorityFixture;$fixture=$authority.Fixture
diff --git a/tests/persistence/ProductRegistration.SelfTest.ps1 b/tests/persistence/ProductRegistration.SelfTest.ps1
index 2d43ea9..db0e9aa 100644
--- a/tests/persistence/ProductRegistration.SelfTest.ps1
+++ b/tests/persistence/ProductRegistration.SelfTest.ps1
@@ -37,6 +37,7 @@ $currentShortcutNames=@($v2521ShortcutNames[0],$v2521ShortcutNames[3])
 $legacyInstallLocation = 'C:\legacy\CodexControlOtherDevices-installer'
 
 function Get-CcodTestBytesSha256([byte[]]$Bytes){$sha=[Security.Cryptography.SHA256]::Create();try{[BitConverter]::ToString($sha.ComputeHash($Bytes)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()}}
+function Invoke-CcodTask2Fix1ProductTest([string]$Id,[string]$Name,[scriptblock]$Action){if(-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK2_FIX1_RED_CASE)-and$env:CCOD_TASK2_FIX1_RED_CASE-cne$Id){return};Invoke-CcodTest $Name $Action}
 
 function New-CcodLegacyRegistrationFixture {
     param(
@@ -140,6 +141,8 @@ function New-CcodRegistrationWorld {
         LegacyMigrationPlanBytes = $null
         LegacyMigrationPlanWrites = 0
         LegacyMigrationPlanReads = 0
+        LegacyMigrationPlanWriteMode = $null
+        LegacyMigrationPlanReadFailureAt = 0
         Calls = [Collections.Generic.List[string]]::new()
     }
     $world.LegacyShortcutProofs=New-CcodProductLegacyShortcutProofs -Legacy $world.Legacy -ExpectedInstallRoot $registration.installRoot
@@ -203,8 +206,8 @@ function New-CcodRegistrationWorld {
             $base=if($Kind-ceq'StartMenu'){[Environment]::GetFolderPath([Environment+SpecialFolder]::Programs)}else{[Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop)};$relative=$name.Substring($name.IndexOf('\')+1)
             [pscustomobject][ordered]@{kind=$Kind;name=$name;path=[IO.Path]::GetFullPath((Join-Path $base $relative));candidatePath=[IO.Path]::GetFullPath([string]$Shortcut.candidatePath);candidateLength=[int64]([Convert]::FromBase64String([string]$proof.bytesBase64).LongLength);candidateSha256=[string]$proof.sha256;targetPath=[string]$proof.targetPath;arguments=[string]$proof.arguments;workingDirectory=[string]$proof.workingDirectory}
         }.GetNewClosure()
-        ReadLegacyMigrationPlan = {param($ReadyEvidence)$world.LegacyMigrationPlanReads++;if($null-eq$world.LegacyMigrationPlanBytes){return $null};$bytes=[byte[]]$world.LegacyMigrationPlanBytes.Clone();[pscustomobject]@{Bytes=$bytes;Length=[int64]$bytes.LongLength;Sha256=(Get-CcodTestBytesSha256 $bytes)}}.GetNewClosure()
-        WriteLegacyMigrationPlan = {param($ReadyEvidence,[byte[]]$Bytes)if($null-ne$world.LegacyMigrationPlanBytes){throw 'fixture durable plan collision'};$world.LegacyMigrationPlanWrites++;$world.LegacyMigrationPlanBytes=[byte[]]$Bytes.Clone();[pscustomobject]@{Length=[int64]$Bytes.LongLength;Sha256=(Get-CcodTestBytesSha256 $Bytes)}}.GetNewClosure()
+        ReadLegacyMigrationPlan = {param($ReadyEvidence)$world.LegacyMigrationPlanReads++;if($world.LegacyMigrationPlanReadFailureAt-eq$world.LegacyMigrationPlanReads){throw 'fixture durable plan read-back failure'};if($null-eq$world.LegacyMigrationPlanBytes){return $null};$bytes=[byte[]]$world.LegacyMigrationPlanBytes.Clone();[pscustomobject]@{Bytes=$bytes;Length=[int64]$bytes.LongLength;Sha256=(Get-CcodTestBytesSha256 $bytes)}}.GetNewClosure()
+        WriteLegacyMigrationPlan = {param($ReadyEvidence,[byte[]]$Bytes)if($null-ne$world.LegacyMigrationPlanBytes){throw 'fixture durable plan collision'};$world.LegacyMigrationPlanWrites++;$world.LegacyMigrationPlanBytes=[byte[]]$Bytes.Clone();if($world.LegacyMigrationPlanWriteMode-ceq'PublishedThenThrow'){throw 'fixture published durable plan then threw'};[pscustomobject]@{Length=[int64]$Bytes.LongLength;Sha256=(Get-CcodTestBytesSha256 $Bytes)}}.GetNewClosure()
         RemoveLegacyEntry = {param($Entry);$name=if($Entry-is[string]){[string]$Entry}elseif($Entry.kind-ceq'Registry'){'Registry'}else{[string]$Entry.name};$world.LegacyRemoveAttempts++;if($world.LegacyRemoveFailureAt-eq$world.LegacyRemoveAttempts){throw 'fixture legacy delete failure'};[void]$world.LegacyEntries.Remove($name)}.GetNewClosure()
         ReadLegacyEntry = {param($Entry);$name=if($Entry-is[string]){[string]$Entry}elseif($Entry.kind-ceq'Registry'){'Registry'}else{[string]$Entry.name};if($world.LegacyReplacementEntry-ceq$name-and$world.LegacyRemoveFailureAt-gt0-and$world.LegacyRemoveAttempts-ge$world.LegacyRemoveFailureAt){return 'Mismatch'};if(-not$world.LegacyEntries.Contains($name)){return $null};if($Entry-isnot[string]-and$Entry.kind-ceq'Shortcut' -and [string]$Entry.sha256-cne[string]$world.LegacyShortcutProofs[$name].sha256){return 'Mismatch'};'Exact'}.GetNewClosure()
         RestoreLegacyEntry = {param($Entry);$name=if($Entry-is[string]){[string]$Entry}elseif($Entry.kind-ceq'Registry'){'Registry'}else{[string]$Entry.name};if($world.LegacyRestoreFailureEntry-ceq$name){throw 'fixture restore failed'};if(-not$world.LegacyEntries.Contains($name)){$world.LegacyEntries.Add($name)};$world.LegacyRestoreOrder.Add($name);$world.LegacyRestores++}.GetNewClosure()
@@ -476,6 +479,70 @@ $results += Invoke-CcodTest 'durable migration plan rejects absent tampered fore
     }
 }
 
+# Production mutation caught: persisted nested evidence is accepted by normalized meaning instead of exact canonical bytes and order.
+$results += Invoke-CcodTask2Fix1ProductTest 'schema' 'durable plan requires exact six-field profile and raw canonical identity paths' {
+    foreach($mutation in @('ProfileExtra','ProfileMissing','ProfileReordered','ProfileValue','ExpectedRoot','ShortcutPath','ShortcutTarget','ShortcutWorking')){
+        $world=New-CcodRegistrationWorld;$null=Get-CcodProductTestLegacyMigrationPlan $world;$json=[Text.UTF8Encoding]::new($false,$true).GetString($world.LegacyMigrationPlanBytes);$record=$json|ConvertFrom-Json -ErrorAction Stop
+        switch($mutation){
+            'ProfileExtra' {$record.profile|Add-Member -NotePropertyName unexpected -NotePropertyValue 'foreign'}
+            'ProfileMissing' {$record.profile.PSObject.Properties.Remove('minimumVersion')}
+            'ProfileReordered' {$names=@($record.profile.PSObject.Properties.Name);$profile=[ordered]@{};for($index=$names.Count-1;$index-ge0;$index--){$profile[$names[$index]]=$record.profile.($names[$index])};$record.profile=[pscustomobject]$profile}
+            'ProfileValue' {$record.profile.minimumVersion='2.2.1'}
+            'ExpectedRoot' {$record.expectedInstallRoot=[string]$record.expectedInstallRoot+'\.'}
+            'ShortcutPath' {$entry=@($record.snapshot.entries|Where-Object{$_.kind-ceq'Shortcut'})[0];$entry.path=(Split-Path ([string]$entry.path) -Parent)+'\.\'+[IO.Path]::GetFileName([string]$entry.path)}
+            'ShortcutTarget' {$entry=@($record.snapshot.entries|Where-Object{$_.kind-ceq'Shortcut'})[0];$entry.targetPath=(Split-Path ([string]$entry.targetPath) -Parent)+'\.\'+[IO.Path]::GetFileName([string]$entry.targetPath)}
+            'ShortcutWorking' {$entry=@($record.snapshot.entries|Where-Object{$_.kind-ceq'Shortcut'-and-not[string]::IsNullOrEmpty([string]$_.workingDirectory)})[0];$entry.workingDirectory=[string]$entry.workingDirectory+'\.'}
+        }
+        $world.LegacyMigrationPlanBytes=[Text.UTF8Encoding]::new($false).GetBytes(($record|ConvertTo-Json -Depth 32 -Compress)+"`n")
+        Assert-CcodThrows {Get-CcodProductTestLegacyMigrationPlan $world|Out-Null} 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+        Assert-CcodEqual 1 $world.LegacyMigrationPlanWrites "$mutation never republishes the changed durable plan"
+        Assert-CcodEqual 0 $world.Shortcuts.Count "$mutation fails before current shortcut writes"
+    }
+    $exact=New-CcodRegistrationWorld;$null=Get-CcodProductTestLegacyMigrationPlan $exact;$persisted=[Text.UTF8Encoding]::new($false,$true).GetString($exact.LegacyMigrationPlanBytes)|ConvertFrom-Json -ErrorAction Stop
+    Assert-CcodEqual 'profileId,appId,minimumVersion,maximumVersion,uninstallCommandShape,shortcutNames' (($persisted.profile.PSObject.Properties.Name)-join',') 'persisted profile has the six canonical fields in canonical order'
+}
+
+# Production mutation caught: a post-publish exception or read-back error causes the later process to republish instead of consuming the exact existing plan.
+$results += Invoke-CcodTask2Fix1ProductTest 'replay' 'published writer and read-back failures converge without duplicate plan publication' {
+    foreach($failure in @('PublishedThenThrow','PostWriteReadBack')){
+        $world=New-CcodRegistrationWorld;if($failure-ceq'PublishedThenThrow'){$world.LegacyMigrationPlanWriteMode='PublishedThenThrow'}else{$world.LegacyMigrationPlanReadFailureAt=2}
+        Assert-CcodThrows {Get-CcodProductTestLegacyMigrationPlan $world|Out-Null} 'CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID'
+        Assert-CcodEqual 1 $world.LegacyMigrationPlanWrites "$failure first invocation published exactly once"
+        Assert-CcodTrue ($null-ne$world.LegacyMigrationPlanBytes) "$failure first invocation left the exact published bytes"
+        Assert-CcodEqual 0 $world.Shortcuts.Count "$failure first invocation performs zero current shortcut writes"
+        Assert-CcodEqual $null $world.Product "$failure first invocation performs zero current registry writes"
+        $plan=Get-CcodProductTestLegacyMigrationPlan $world;$world.SimulateOverlapWrites=$true;$null=Commit-CcodProductRegistration -Registration $world.Registration -FileTransaction ([pscustomobject]@{}) -Adapters $world.Adapters;Remove-CcodLegacyProductRegistration -ExpectedAppId $appId -MigrationPlan $plan -ExpectedCurrentProof $expectedVerifiedRegistration -Adapters $world.Adapters
+        Assert-CcodEqual 1 $world.LegacyMigrationPlanWrites "$failure later invocation never republishes"
+        Assert-CcodEqual (($currentShortcutNames|Sort-Object)-join'|') ((@($world.LegacyEntries)|Sort-Object)-join'|') "$failure later invocation converges from the existing plan"
+    }
+
+    $world=New-CcodRegistrationWorld;$null=Get-CcodProductTestLegacyMigrationPlan $world;$world.LegacyShortcutProofs[$currentShortcutNames[0]]=$world.CurrentShortcutProofs[$currentShortcutNames[0]]
+    $profile=Resolve-CcodLegacyRegistrationProfile -LegacyRegistration $world.Legacy;$liveRegistration=&$world.Adapters.ReadLegacyRegistration $appId;$liveSnapshot=&$world.Adapters.ReadLegacySnapshot $appId $profile $null
+    $payload=[ordered]@{module=$modulePath;appId=$appId;registration=$world.Registration;ready=$world.Ready;planBase64=[Convert]::ToBase64String($world.LegacyMigrationPlanBytes);legacyRegistration=$liveRegistration;legacySnapshot=$liveSnapshot}
+    $child=@'
+param([Parameter(Mandatory)][string]$PayloadPath)
+$ErrorActionPreference='Stop'
+$payload=[IO.File]::ReadAllText([IO.Path]::GetFullPath($PayloadPath),[Text.UTF8Encoding]::new($false,$true))|ConvertFrom-Json -ErrorAction Stop
+Import-Module ([string]$payload.module) -Force -DisableNameChecking -ErrorAction Stop
+function Get-BytesSha([byte[]]$Bytes){$sha=[Security.Cryptography.SHA256]::Create();try{[BitConverter]::ToString($sha.ComputeHash($Bytes)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()}}
+$bytes=[Convert]::FromBase64String([string]$payload.planBase64);$writes=0
+$adapters=@{
+  ReadLegacyMigrationPlan={param($Ready)$copy=[byte[]]$bytes.Clone();[pscustomobject]@{Bytes=$copy;Length=[int64]$copy.LongLength;Sha256=(Get-BytesSha $copy)}}.GetNewClosure()
+  WriteLegacyMigrationPlan={param($Ready,[byte[]]$Value)$writes++;throw 'CHILD_UNEXPECTED_REPUBLISH'}.GetNewClosure()
+  ReadLegacyRegistration={param($ExpectedAppId)(($payload.legacyRegistration|ConvertTo-Json -Depth 16 -Compress)|ConvertFrom-Json)}.GetNewClosure()
+  ReadLegacySnapshot={param($ExpectedAppId,$ExpectedProfile,$CapturedPlan)(($payload.legacySnapshot|ConvertTo-Json -Depth 32 -Compress)|ConvertFrom-Json)}.GetNewClosure()
+}
+$registration=(($payload.registration|ConvertTo-Json -Depth 16 -Compress)|ConvertFrom-Json);$ready=(($payload.ready|ConvertTo-Json -Depth 16 -Compress)|ConvertFrom-Json)
+$plan=Get-CcodDurableLegacyProductRegistrationMigrationPlan -ExpectedAppId ([string]$payload.appId) -Registration $registration -ReadyEvidence $ready -Adapters $adapters
+if($null-eq$plan-or-not$plan.legacyPresent-or$writes-ne0){throw 'CHILD_REPLAY_FAILED'}
+[Console]::Out.WriteLine('CHILD_DURABLE_REPLAY_OK')
+'@
+    $childRoot=Join-Path ([IO.Path]::GetTempPath()) ('ccod-product-replay-'+[guid]::NewGuid().ToString('N'));[IO.Directory]::CreateDirectory($childRoot)|Out-Null;$payloadPath=Join-Path $childRoot 'payload.json';$childPath=Join-Path $childRoot 'replay.ps1'
+    try{[IO.File]::WriteAllText($payloadPath,($payload|ConvertTo-Json -Depth 32 -Compress),[Text.UTF8Encoding]::new($false));[IO.File]::WriteAllText($childPath,$child,[Text.UTF8Encoding]::new($false));$output=@(& powershell.exe -NoProfile -ExecutionPolicy Bypass -File $childPath -PayloadPath $payloadPath 2>&1);$exitCode=$LASTEXITCODE}finally{$full=[IO.Path]::GetFullPath($childRoot);$temp=[IO.Path]::GetFullPath([IO.Path]::GetTempPath()).TrimEnd('\')+'\';if(-not$full.StartsWith($temp,[StringComparison]::OrdinalIgnoreCase)){throw 'refusing non-temp child cleanup'};if(Test-Path -LiteralPath $full){Remove-Item -LiteralPath $full -Recurse -Force}}
+    Assert-CcodEqual 0 $exitCode 'fresh powershell process replays serialized durable/live evidence'
+    Assert-CcodEqual 'CHILD_DURABLE_REPLAY_OK' ($output -join'') 'fresh powershell process consumes existing plan without parent object identity'
+}
+
 # Production mutation caught: trusting a shortcut read-back that resolves outside the selected sealed generation.
 $results += Invoke-CcodTest 'shortcut path and target mismatches fail the three-record read-back gate' {
     foreach ($kind in @('StartMenu','Desktop')) {

From f38ddff582249ecbdf54b3abf30e7f93377e6c9e Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 09:15:48 +0800
Subject: [PATCH 147/187] docs: record durable plan fix round evidence

---
 .../progress.md                               | 14 ++-
 .../task-2-fix1-brief.md                      |  2 +-
 .../task-2-report.md                          | 88 +++++++++++++++++++
 3 files changed, 100 insertions(+), 4 deletions(-)

diff --git a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
index 1126923..1825bc7 100644
--- a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
+++ b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
@@ -19,6 +19,14 @@ Plan: `docs/superpowers/plans/2026-09-03-v2522-cross-process-retry-closure.md`
 
 Task 1: complete. Initial implementation/evidence `9973bfd..bf4d215`; fix round 1 implementation/evidence `bf939c6..6107151`. Fix-round scoped re-review: Spec Compliance PASS, Task Quality PASS, 0 Critical, 0 Important. Final focused evidence: UninstallBootstrap 45/45, ManualWrappers pass, parser 2/2, `git diff --check` exit 0. No real system action.
 
-Task 2: initial implementation `148f6ee`, evidence `66a91aa`; scoped review FAIL (0 Critical, 3 Important). Fix round 1 is in progress. Required closure: crash-safe fixed-directory ACL initialization and registered-handle cleanup; exact nested profile/raw-path schema; real child-process replay plus published-write/read-back failure retry evidence.
-
-The prior frozen gate passed but is invalidated by the required Task 2 source changes. Successor final gate and fresh scoped review: pending. Tasks 5–8 remain blocked.
+Task 2: initial implementation `148f6ee`, evidence `66a91aa`; scoped review FAIL (0 Critical, 3 Important).
+Fix round 1 implementation `a0c8d71`; evidence is recorded by the commit containing the corrected
+`task-2-fix1-brief.md`, updated `task-2-report.md`, and this ledger. Fix round 1 closes crash-safe
+fixed-directory ACL normalization/registered-handle cleanup, exact six-field profile and raw-path schema,
+independent `powershell.exe` replay, and published-write/read-back failure convergence. Final focused evidence:
+InstallFileTransaction 44 groups, ProductRegistration 30/30, InstallLifecycle 151/151, parser 4/4, and
+`git diff --check` exit 0. No real system action.
+
+Fix round 1 frozen gate: complete, including UninstallBootstrap 45/45, RuntimeManifest 21 groups,
+InstalledLifecycleHarness 21 groups, Bootstrap 26/26, ManualWrappers 12 groups, and
+`tests\PersistenceSelfTest.ps1` exit 0. Fresh scoped fix-round review: pending. Tasks 5–8 remain blocked.
diff --git a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-2-fix1-brief.md b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-2-fix1-brief.md
index 505eaa4..47fdf3b 100644
--- a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-2-fix1-brief.md
+++ b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-2-fix1-brief.md
@@ -5,7 +5,7 @@ Read the Task 2 report and scoped review. Fix the three Important findings witho
 ## Required RED -> GREEN
 
 1. Cover the CREATE-to-ACL crash shape for `state\legacy-registration-migrations`. A newly created directory must never leave an unregistered handle on Set/Validate failure. A later ProductTransaction may normalize only an empty, non-reparse directory owned by the current SID whose inherited ACL contains only the explicitly trusted SID/SYSTEM/Administrators full-control principals; nonempty, foreign-owner, untrusted-ACE, ADS, or identity-drift cases fail closed. Reader-first retry must recover the known empty crash artifact before returning no plan. Prefer atomic creation security if the native layer can provide it more safely.
-2. Require exact nested schema. Persisted `profile` must have exactly the five canonical profile fields in canonical order and byte-equivalent values to `Resolve-CcodLegacyRegistrationProfile`. `expectedInstallRoot`, every historical shortcut path/target/working-directory, and other identity paths must equal their canonical strings, not merely normalize to them. Add extra/missing/reordered profile and equivalent-noncanonical path REDs.
+2. Require exact nested schema. Persisted `profile` must have exactly the six canonical profile fields (`profileId,appId,minimumVersion,maximumVersion,uninstallCommandShape,shortcutNames`) in canonical order and byte-equivalent values to `Resolve-CcodLegacyRegistrationProfile`. `expectedInstallRoot`, every historical shortcut path/target/working-directory, and other identity paths must equal their canonical strings, not merely normalize to them. Add extra/missing/reordered profile and equivalent-noncanonical path REDs.
 3. Add separate-`powershell.exe` replay evidence that reads serialized plan/live-state data and invokes the production durable replay parser/classifier with no parent-process object identity. Add published-but-threw writer and post-write read-back failure cases: first invocation performs zero current writes; the later invocation reads the existing exact leaf, does not republish it, and converges. Use independent serialized objects for all read-backs.
 
 Run IFT, ProductRegistration and Lifecycle focused suites, then repeat the complete frozen gate, parsers and `git diff --check`. Commit implementation and evidence separately, update the ledger/report, and request a scoped fix-round review. No real system/external actions or release claim.
diff --git a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-2-report.md b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-2-report.md
index 7b42b3d..3709ad4 100644
--- a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-2-report.md
+++ b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/task-2-report.md
@@ -156,3 +156,91 @@ Lifecycle 的既有 cross-process guard 仍输出：
 
 Task 2 与 successor plan 的本地 final gate 已完成；fresh scoped review 仍待 parent agent 发起。
 本报告不声明 Tasks 5–8、合并、发布或 release readiness 完成。
+
+## Fix round 1 — CREATE/ACL recovery、exact nested schema 与独立进程 replay
+
+### Review findings 与 RED
+
+Task 2 scoped review 对 `148f6ee..66a91aa` 判定 FAIL（0 Critical、3 Important）。本轮在
+production 未修改时分别运行三组 RED：
+
+```text
+IFT reader-first safe empty recovery:
+  exit 1
+  safe inherited empty directory reached OpenExistingLegacyPlanDirectory
+  ACL validation threw after result.Handle was detached
+  fixture cleanup failed with "being used by another process"
+
+IFT CREATE Set/Validate failure seam:
+  exit 1
+  InvokeMethodOnNull (the exact native failure boundary did not exist)
+
+Product exact nested schema:
+  exit 1
+  ProfileExtra was accepted
+  ASSERT_THROWS: expected CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID
+
+Product post-write read-back:
+  exit 1
+  raw "fixture durable plan read-back failure" escaped instead of the stable product error
+```
+
+在第一轮 production 修复后，独立 `powershell.exe` replay 又得到一条真实 RED：serialized live
+registry 的 `values` 被独立反序列化为 `PSCustomObject`，旧 comparator 直接访问 `.Keys`，child
+返回 `The property 'Keys' cannot be found`。该失败证明先前同进程 adapter 测试依赖了 parent
+object identity。
+
+### Fix
+
+实现提交：`a0c8d71`（`fix: harden durable legacy plan recovery`）。
+
+- V6 保持不变。新建 plan 目录的 Pin 在 ACL Set/Validate 前注册；任何后续失败均由 transaction
+  close 释放，避免 detached native handle。
+- writer 与 reader-first 共用同一恢复判定。只允许 current SID owner、空目录、无 reparse/ADS、
+  未 protected 且仅继承 current SID/SYSTEM/Administrators 三项 FullControl 的 CREATE artifact；
+  normalization 前后都复验 exact native identity，之后设置并验证既有 protected exact ACL。
+- nonempty、untrusted ACE、foreign owner、错误 flags/rights/principal、identity drift 均 fail closed，
+  且不会被 normalization 改写。测试对 Set 与 Validate 两个 crash seam 都证明 live handle 阻止
+  replacement、close 后立即释放、later reader-first 返回 no-plan 并收敛。
+- persisted profile 必须严格为
+  `profileId,appId,minimumVersion,maximumVersion,uninstallCommandShape,shortcutNames` 六字段、原顺序，
+  canonical JSON 值与 `Resolve-CcodLegacyRegistrationProfile` 完全一致，并将 `profile.appId` 与顶层
+  AppId 交叉绑定。
+- `expectedInstallRoot` 与每条 historical shortcut 的 path/target/workingDirectory 现在既要解析到
+  expected identity，也要求 raw string 本身就是 canonical string；等价的 `\.\` spelling 被拒绝。
+- initial plan read 与 post-write read-back adapter failures 都归一化为
+  `CCOD_LEGACY_PRODUCT_REGISTRATION_INVALID`。published-then-threw 与 read-back-failed 两种首调均保持
+  零 current write；later invocation 只读取 existing bytes，publish count 保持 `1` 并完成 cleanup。
+- registry comparator 通过同一个 strict map facade 同时处理 ordered dictionary 与独立反序列化的
+  `PSCustomObject`，不再依赖 parent-process object shape。
+
+### Fix round 1 tests 与 frozen gate
+
+新增覆盖 reader-first safe empty recovery、Set/Validate registered-handle cleanup、nonempty/untrusted
+ACE/foreign-owner shared native predicate、profile extra/missing/reordered/value、raw root/path/target/
+working-directory、published-then-threw、post-write read-back failure，以及完全独立
+`powershell.exe` serialized plan/live-state replay。
+
+focused 结果：InstallFileTransaction 44 groups、ProductRegistration 30/30、InstallLifecycle 151/151，
+均 exit 0。source freeze 后完整 gate：
+
+```text
+InstallFileTransaction.SelfTest.ps1   44 groups   exit 0
+ProductRegistration.SelfTest.ps1      30/30       exit 0
+InstallLifecycle.SelfTest.ps1         151/151     exit 0
+UninstallBootstrap.SelfTest.ps1       45/45       exit 0
+RuntimeManifest.SelfTest.ps1          21 groups   exit 0
+InstalledLifecycleHarness.SelfTest.ps1 21 groups  exit 0
+Bootstrap.SelfTest.ps1                26/26       exit 0
+ManualWrappers.SelfTest.ps1           12 groups   exit 0
+PowerShell parser                     4/4 changed files, 0 errors
+git diff --check                                  exit 0
+tests\PersistenceSelfTest.ps1                     exit 0 (silent success)
+```
+
+Lifecycle cross-process guard 仍为
+`exit=23 mutex=True authority=False product=False verified=False error=CCOD_PRODUCT_REGISTRATION_FAILED`。
+未执行任何真实 registry、shortcut、scheduled task、安装、卸载、重启、网络、push、tag、release
+或发布操作；失败 RED 遗留的单一临时 fixture 已在进程退出后按 exact temp path 清理。
+
+Fix round 1 的 fresh scoped review 仍待 parent agent 发起；不作 release-readiness 声明。

From 01ebdba73bf38370d7da9c8e33118057141ef8c1 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 09:23:20 +0800
Subject: [PATCH 148/187] docs: accept durable migration fix

---
 .../2026-09-03-v2522-cross-process-retry-closure/progress.md  | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
index 1825bc7..7bea800 100644
--- a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
+++ b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
@@ -29,4 +29,6 @@ InstallFileTransaction 44 groups, ProductRegistration 30/30, InstallLifecycle 15
 
 Fix round 1 frozen gate: complete, including UninstallBootstrap 45/45, RuntimeManifest 21 groups,
 InstalledLifecycleHarness 21 groups, Bootstrap 26/26, ManualWrappers 12 groups, and
-`tests\PersistenceSelfTest.ps1` exit 0. Fresh scoped fix-round review: pending. Tasks 5–8 remain blocked.
+`tests\PersistenceSelfTest.ps1` exit 0. Fix-round scoped re-review: Spec Compliance PASS, Task Quality PASS,
+0 Critical, 0 Important. Task 2 is complete. Successor whole-plan final review remains pending; Tasks 5–8
+remain blocked.

From ec8dac00ab05a0e12dbac382552213b702acd965 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 09:30:18 +0800
Subject: [PATCH 149/187] docs: plan Runtime V7 ABI closure

---
 .../progress.md                               |  9 +++++++--
 .../implementation-brief.md                   |  7 +++++++
 .../progress.md                               | 19 +++++++++++++++++++
 .../2026-09-03-v2522-runtime-v7-closure.md    | 14 ++++++++++++++
 4 files changed, 47 insertions(+), 2 deletions(-)
 create mode 100644 .superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/implementation-brief.md
 create mode 100644 .superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/progress.md
 create mode 100644 docs/superpowers/plans/2026-09-03-v2522-runtime-v7-closure.md

diff --git a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
index 7bea800..c1db1a3 100644
--- a/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
+++ b/.superpowers/sdd/2026-09-03-v2522-cross-process-retry-closure/progress.md
@@ -30,5 +30,10 @@ InstallFileTransaction 44 groups, ProductRegistration 30/30, InstallLifecycle 15
 Fix round 1 frozen gate: complete, including UninstallBootstrap 45/45, RuntimeManifest 21 groups,
 InstalledLifecycleHarness 21 groups, Bootstrap 26/26, ManualWrappers 12 groups, and
 `tests\PersistenceSelfTest.ps1` exit 0. Fix-round scoped re-review: Spec Compliance PASS, Task Quality PASS,
-0 Critical, 0 Important. Task 2 is complete. Successor whole-plan final review remains pending; Tasks 5–8
-remain blocked.
+0 Critical, 0 Important. Task 2 is complete.
+
+Successor whole-plan final review: FAIL (0 Critical, 1 Important). All Task 1/2 behavioral and interaction
+boundaries passed, but the Task 2 fix modified embedded CLR RuntimeV6 without advancing its marker/type ABI;
+a process that preloaded the pre-fix V6 can silently reuse it after force re-import. Per the fixed review scope,
+this successor plan is closed as failed rather than receiving another whole-plan fix wave. Successor micro-plan:
+`docs/superpowers/plans/2026-09-03-v2522-runtime-v7-closure.md`. Tasks 5–8 remain blocked.
diff --git a/.superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/implementation-brief.md b/.superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/implementation-brief.md
new file mode 100644
index 0000000..2827ba1
--- /dev/null
+++ b/.superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/implementation-brief.md
@@ -0,0 +1,7 @@
+# Implementation brief — Runtime V7 ABI closure
+
+Read the micro-plan and the successor whole-plan final review. Use RED -> GREEN.
+
+The RED must preload a self-contained stale V6 marker/runtime in a new `powershell.exe`, import the current module, and prove the module selected stale V6. Then change every production marker/runtime/ABI reference to V7/7 and update exact tests. Do not change file-layer behavior, exports, durable plan schema, or product/lifecycle logic.
+
+After focused GREEN, freeze source and run the full gate in the plan. Commit implementation and evidence separately, leave a clean worktree, and report exact SHAs/counts/exits. No real system or external actions.
diff --git a/.superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/progress.md b/.superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/progress.md
new file mode 100644
index 0000000..a2b88c5
--- /dev/null
+++ b/.superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/progress.md
@@ -0,0 +1,19 @@
+# SDD ledger — Runtime V7 ABI closure
+
+Plan: `docs/superpowers/plans/2026-09-03-v2522-runtime-v7-closure.md`
+
+## Provenance
+
+- Pre-fix V6 implementation: `148f6ee`.
+- Final V6 behavioral fix: `a0c8d71`; evidence: `f38ddff`.
+- Successor whole-plan review: FAIL, 0 Critical + 1 Important, solely because the modified CLR retained V6/ABI 6.
+
+## Ruling
+
+Any embedded CLR implementation change requires a new marker, runtime type and ABI integer. Cost if wrong:
+long-lived PowerShell processes silently execute an older security/recovery implementation despite importing
+new PowerShell source.
+
+## Status
+
+Runtime V7 task: pending. Tasks 5–8 remain blocked.
diff --git a/docs/superpowers/plans/2026-09-03-v2522-runtime-v7-closure.md b/docs/superpowers/plans/2026-09-03-v2522-runtime-v7-closure.md
new file mode 100644
index 0000000..949e9fe
--- /dev/null
+++ b/docs/superpowers/plans/2026-09-03-v2522-runtime-v7-closure.md
@@ -0,0 +1,14 @@
+# v2.5.22 Runtime V7 ABI Closure Plan
+
+**Goal:** Ensure the final embedded install-file CLR implementation cannot silently reuse the pre-fix RuntimeV6 in a long-lived PowerShell AppDomain.
+
+**Scope:** `src/persistence/modules/InstallFileTransaction.psm1` and its self-test, plus only evidence/ledger files. No behavioral redesign.
+
+## Task
+
+1. Add an independent child-process RED that preloads a minimal pre-fix `CcodInstallGenerationCapabilityMarkerV6` / `CcodInstallGenerationRuntimeV6`, then force-imports the current module. It must prove the current module binds the stale V6 instead of a new ABI/type. Keep the fixture self-contained and independent of Git history.
+2. Mechanically advance the embedded marker, runtime type and `CapabilityAbi` to V7/7. Update every exact ABI assertion. A preloaded V6 must coexist but never be selected; repeated force-import of the final V7 must reuse the same correct V7 type.
+3. Run InstallFileTransaction, ProductRegistration, InstallLifecycle, UninstallBootstrap, RuntimeManifest, InstalledLifecycleHarness, Bootstrap, ManualWrappers, all changed parsers, `git diff --check`, and `tests\PersistenceSelfTest.ps1` from frozen source.
+4. Commit implementation and evidence separately, then request one independent scoped review. Do not claim Tasks 5–8 or release readiness.
+
+**Constraints:** No real registry, shortcut, scheduled task, installation, uninstall, process restart, reboot, network, push, tag, release, or publication. Preserve all V6 file/plan behavior byte-for-byte except required CLR symbol/ABI changes and tests.

From 9d7cc90162fff31d1c1b868e14bbb703a07fd184 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 10:06:45 +0800
Subject: [PATCH 150/187] fix: advance install runtime ABI to V7

---
 .../modules/InstallFileTransaction.psm1       | 34 +++++-----
 .../InstallFileTransaction.SelfTest.ps1       | 62 +++++++++++++++----
 2 files changed, 68 insertions(+), 28 deletions(-)

diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index 5cb42da..134437f 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -10,7 +10,7 @@ function Throw-CcodInstallFileError {
 }
 
 function Initialize-CcodInstallRuntime {
-    $marker = 'CcodInstallGenerationCapabilityMarkerV6' -as [type]
+    $marker = 'CcodInstallGenerationCapabilityMarkerV7' -as [type]
     if ($null -eq $marker) {
         Add-Type -TypeDefinition @'
 using System;
@@ -25,13 +25,13 @@ using System.Security.Principal;
 using System.Text;
 using Microsoft.Win32.SafeHandles;
 
-public sealed class CcodInstallGenerationCapabilityMarkerV6
+public sealed class CcodInstallGenerationCapabilityMarkerV7
 {
-    private CcodInstallGenerationCapabilityMarkerV6() { }
-    public static int CapabilityAbi { get { return 6; } }
+    private CcodInstallGenerationCapabilityMarkerV7() { }
+    public static int CapabilityAbi { get { return 7; } }
 }
 
-internal sealed class CcodInstallGenerationRuntimeV6 : IDisposable
+internal sealed class CcodInstallGenerationRuntimeV7 : IDisposable
 {
     private const uint READ = 0x80000000, WRITE = 0x40000000, DELETE = 0x00010000, READ_CONTROL = 0x00020000, WRITE_DAC = 0x00040000, WRITE_OWNER = 0x00080000, SYNC = 0x00100000;
     private const uint READ_ATTRIBUTES = 0x80, WRITE_ATTRIBUTES = 0x100, LIST_DIRECTORY = 0x1, ADD_FILE = 0x2, ADD_SUBDIRECTORY = 0x4;
@@ -90,10 +90,10 @@ internal sealed class CcodInstallGenerationRuntimeV6 : IDisposable
     private bool disposed; private string cleanupError,legacyPlanDirectoryFailureForTest;
 
     private readonly bool stateOnly,productOnly,retryOnly;
-    private CcodInstallGenerationRuntimeV6(string installRoot,Pin root,Pin runtimeParent,bool stateOnly,bool productOnly,bool retryOnly)
+    private CcodInstallGenerationRuntimeV7(string installRoot,Pin root,Pin runtimeParent,bool stateOnly,bool productOnly,bool retryOnly)
     { this.installRoot=installRoot;this.root=root;this.runtimeParent=runtimeParent;this.stateOnly=stateOnly;this.productOnly=productOnly;this.retryOnly=retryOnly;AddPin(root);if(runtimeParent!=null)AddPin(runtimeParent); }
 
-    internal static object Open(string path,string runtimeId,out CcodInstallGenerationRuntimeV6 runtime)
+    internal static object Open(string path,string runtimeId,out CcodInstallGenerationRuntimeV7 runtime)
     {
         runtime=null;string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle rootHandle=OpenAbsoluteDirectory(full,true);Pin rootPin=null,runtimePin=null;
         try
@@ -108,30 +108,30 @@ internal sealed class CcodInstallGenerationRuntimeV6 : IDisposable
             try
             {
                 Pin generation=ValidateDirectoryPin(runtimePin,runtimeId,Path.Combine(runtimePin.Path,runtimeId),true,generationResult.Handle);generationResult.Handle=null;
-                runtime=new CcodInstallGenerationRuntimeV6(full,rootPin,runtimePin,false,false,false);rootPin=null;runtimePin=null;runtime.AddPin(generation);return generation.Token;
+                runtime=new CcodInstallGenerationRuntimeV7(full,rootPin,runtimePin,false,false,false);rootPin=null;runtimePin=null;runtime.AddPin(generation);return generation.Token;
             }
             finally { if(generationResult.Handle!=null)generationResult.Handle.Dispose(); }
         }
         catch { if(runtimePin!=null)runtimePin.Dispose();if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw; }
     }
 
-    internal static object OpenState(string path,out CcodInstallGenerationRuntimeV6 runtime)
+    internal static object OpenState(string path,out CcodInstallGenerationRuntimeV7 runtime)
     {
         runtime=null;string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle rootHandle=OpenAbsoluteDirectory(full,true);Pin rootPin=null;
-        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;runtime=new CcodInstallGenerationRuntimeV6(full,rootPin,null,true,false,false);rootPin=null;return runtime.root.Token;}
+        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;runtime=new CcodInstallGenerationRuntimeV7(full,rootPin,null,true,false,false);rootPin=null;return runtime.root.Token;}
         catch{if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw;}
     }
 
-    internal static object OpenRetry(string path,out CcodInstallGenerationRuntimeV6 runtime)
+    internal static object OpenRetry(string path,out CcodInstallGenerationRuntimeV7 runtime)
     {
         runtime=null;string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle rootHandle=OpenAbsoluteDirectory(full,true);Pin rootPin=null,runtimePin=null;
-        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;OpenResult result=OpenRelative(rootPin.Native,"runtime",LIST_DIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);try{runtimePin=ValidateDirectoryPin(rootPin,"runtime",Path.Combine(full,"runtime"),false,result.Handle);result.Handle=null;}finally{if(result.Handle!=null)result.Handle.Dispose();};runtime=new CcodInstallGenerationRuntimeV6(full,rootPin,runtimePin,false,false,true);rootPin=null;runtimePin=null;return runtime.root.Token;}catch{if(runtimePin!=null)runtimePin.Dispose();if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw;}
+        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;OpenResult result=OpenRelative(rootPin.Native,"runtime",LIST_DIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);try{runtimePin=ValidateDirectoryPin(rootPin,"runtime",Path.Combine(full,"runtime"),false,result.Handle);result.Handle=null;}finally{if(result.Handle!=null)result.Handle.Dispose();};runtime=new CcodInstallGenerationRuntimeV7(full,rootPin,runtimePin,false,false,true);rootPin=null;runtimePin=null;return runtime.root.Token;}catch{if(runtimePin!=null)runtimePin.Dispose();if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw;}
     }
 
-    internal static object OpenProduct(string path,out CcodInstallGenerationRuntimeV6 runtime)
+    internal static object OpenProduct(string path,out CcodInstallGenerationRuntimeV7 runtime)
     {
         runtime=null;string full=Path.GetFullPath(path).TrimEnd('\\');SafeFileHandle rootHandle=OpenAbsoluteDirectory(full,false);Pin rootPin=null,runtimePin=null;
-        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;OpenResult result=OpenRelative(rootPin.Native,"runtime",LIST_DIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);try{runtimePin=ValidateDirectoryPin(rootPin,"runtime",Path.Combine(full,"runtime"),false,result.Handle);result.Handle=null;}finally{if(result.Handle!=null)result.Handle.Dispose();};runtime=new CcodInstallGenerationRuntimeV6(full,rootPin,runtimePin,false,true,false);rootPin=null;runtimePin=null;return runtime.root.Token;}catch{if(runtimePin!=null)runtimePin.Dispose();if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw;}
+        try{rootPin=ValidateDirectoryPin(null,"",full,false,rootHandle);rootHandle=null;OpenResult result=OpenRelative(rootPin.Native,"runtime",LIST_DIRECTORY|READ_ATTRIBUTES|SYNC,SHARE_READ|SHARE_WRITE,OPEN,DIRECTORY|BACKUP_INTENT);try{runtimePin=ValidateDirectoryPin(rootPin,"runtime",Path.Combine(full,"runtime"),false,result.Handle);result.Handle=null;}finally{if(result.Handle!=null)result.Handle.Dispose();};runtime=new CcodInstallGenerationRuntimeV7(full,rootPin,runtimePin,false,true,false);rootPin=null;runtimePin=null;return runtime.root.Token;}catch{if(runtimePin!=null)runtimePin.Dispose();if(rootPin!=null)rootPin.Dispose();if(rootHandle!=null)rootHandle.Dispose();throw;}
     }
 
     private bool IsStateScope(Pin pin){for(Pin cursor=pin;cursor!=null;cursor=cursor.Parent)if(Object.ReferenceEquals(cursor.Parent,root)&&String.Equals(cursor.Leaf,"state",StringComparison.Ordinal))return true;return false;}
@@ -391,10 +391,10 @@ internal sealed class CcodInstallGenerationRuntimeV6 : IDisposable
     private static int RenameReplacing(SafeFileHandle source,SafeFileHandle parent,string destination){byte[] name=Encoding.Unicode.GetBytes(destination);int rootOffset=IntPtr.Size,lengthOffset=rootOffset+IntPtr.Size,nameOffset=lengthOffset+4,size=nameOffset+name.Length+2;IntPtr buffer=Marshal.AllocHGlobal(size);bool parentAdded=false,sourceAdded=false;try{source.DangerousAddRef(ref sourceAdded);parent.DangerousAddRef(ref parentAdded);for(int i=0;i<size;i++)Marshal.WriteByte(buffer,i,0);Marshal.WriteByte(buffer,0,1);Marshal.WriteIntPtr(buffer,rootOffset,parent.DangerousGetHandle());Marshal.WriteInt32(buffer,lengthOffset,name.Length);Marshal.Copy(name,0,IntPtr.Add(buffer,nameOffset),name.Length);IO_STATUS_BLOCK io;int status=NtSetInformationFile(source,out io,buffer,(uint)size,FileRenameInformation);return status>=0?0:(int)RtlNtStatusToDosError(status);}finally{if(parentAdded)parent.DangerousRelease();if(sourceAdded)source.DangerousRelease();Marshal.FreeHGlobal(buffer);}}
 }
 '@
-        $marker = 'CcodInstallGenerationCapabilityMarkerV6' -as [type]
+        $marker = 'CcodInstallGenerationCapabilityMarkerV7' -as [type]
     }
-    if ($null -eq $marker -or [int]$marker.GetProperty('CapabilityAbi').GetValue($null,$null) -ne 6) { Throw-CcodInstallFileError 'CCOD_INSTALL_RUNTIME_ABI_INVALID' 'Install generation runtime ABI is unavailable' $null }
-    $script:CcodRuntimeType = $marker.Assembly.GetType('CcodInstallGenerationRuntimeV6',$true)
+    if ($null -eq $marker -or [int]$marker.GetProperty('CapabilityAbi').GetValue($null,$null) -ne 7) { Throw-CcodInstallFileError 'CCOD_INSTALL_RUNTIME_ABI_INVALID' 'Install generation runtime ABI is unavailable' $null }
+    $script:CcodRuntimeType = $marker.Assembly.GetType('CcodInstallGenerationRuntimeV7',$true)
 }
 
 function Assert-CcodInstallLeaf([string]$Leaf,[string]$ErrorId='CCOD_INSTALL_LEAF_INVALID') {
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index d459e15..1de0a98 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -172,9 +172,9 @@ function Assert-CcodProductTransactionRejected {
 Invoke-CcodTest 'exports only immutable generation operations and an inert CLR marker' {
     $expected=@('Close-CcodInstallFileTransaction','Commit-CcodInstallActivePointer','Copy-CcodInstallProductShortcut','Copy-CcodInstallSealedSource','New-CcodInstallDirectory','New-CcodInstallGenerationLeaf','Open-CcodInstallGeneration','Open-CcodInstallProductRegistrationTransaction','Open-CcodInstallProductSpecialFolder','Open-CcodInstallRetainedFile','Open-CcodInstallRetainedGeneration','Open-CcodInstallStateTransaction','Read-CcodInstallLegacyMigrationPlan','Retire-CcodInstallGeneration','Write-CcodInstallGenerationManifest','Write-CcodInstallLegacyMigrationPlan','Write-CcodInstallRecord')
     Assert-CcodEqual ($expected -join '|') ((@($module.ExportedCommands.Keys)|Sort-Object)-join '|') 'module export surface is capability-only'
-    Assert-CcodEqual 6 ([CcodInstallGenerationCapabilityMarkerV6]::CapabilityAbi) 'marker exposes the current non-mutating ABI value'
-    Assert-CcodEqual 'CcodInstallGenerationCapabilityMarkerV6' ((@([CcodInstallGenerationCapabilityMarkerV6].Assembly.GetExportedTypes()|ForEach-Object FullName)) -join '|') 'current CLR bridge exports only the inert marker'
-    $dangerous=@([CcodInstallGenerationCapabilityMarkerV6].GetMethods([Reflection.BindingFlags]'Public,Static,DeclaredOnly')|Where-Object{@($_.GetParameters()|Where-Object{$_.ParameterType-in@([string],[IntPtr],[IO.Stream])-or[Microsoft.Win32.SafeHandles.SafeHandle].IsAssignableFrom($_.ParameterType)}).Count-ne 0})
+    Assert-CcodEqual 7 ([CcodInstallGenerationCapabilityMarkerV7]::CapabilityAbi) 'marker exposes the current non-mutating ABI value'
+    Assert-CcodEqual 'CcodInstallGenerationCapabilityMarkerV7' ((@([CcodInstallGenerationCapabilityMarkerV7].Assembly.GetExportedTypes()|ForEach-Object FullName)) -join '|') 'current CLR bridge exports only the inert marker'
+    $dangerous=@([CcodInstallGenerationCapabilityMarkerV7].GetMethods([Reflection.BindingFlags]'Public,Static,DeclaredOnly')|Where-Object{@($_.GetParameters()|Where-Object{$_.ParameterType-in@([string],[IntPtr],[IO.Stream])-or[Microsoft.Win32.SafeHandles.SafeHandle].IsAssignableFrom($_.ParameterType)}).Count-ne 0})
     Assert-CcodEqual 0 $dangerous.Count 'marker accepts no path stream or bare handle'
     Assert-CcodTrue (-not $module.ExportedCommands['Copy-CcodInstallProductShortcut'].Parameters.ContainsKey('SourcePath')) 'product shortcut copy accepts no arbitrary absolute source path'
 }
@@ -495,7 +495,7 @@ Invoke-CcodTest 'product authority rejects incomplete pointer stores and changed
     }
 }
 
-Invoke-CcodTest 'V6 state-only transaction writes records but cannot reach generation or pointer operations' {
+Invoke-CcodTest 'V7 state-only transaction writes records but cannot reach generation or pointer operations' {
     $fixture=New-CcodInstallFileFixture;$transaction=$null
     try{$transaction=Open-CcodInstallStateTransaction -InstallRoot $fixture.Install;$fixture.Transactions.Add($transaction);$state=New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'state' -CreateIfMissing;$records=New-CcodInstallDirectory -Transaction $transaction -Parent $state -Leaf 'install-transactions' -CreateIfMissing;Write-CcodInstallRecord -Transaction $transaction -Parent $records -Leaf 'ready.json' -Record ([ordered]@{schemaVersion=1;phase='Ready'})|Out-Null;Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $fixture.Install 'state\install-transactions\ready.json')) 'state-only transaction writes a create-only state record';Assert-CcodThrows {Write-CcodInstallRecord -Transaction $transaction -Parent $records -Leaf 'ready.json' -Record ([ordered]@{schemaVersion=1;phase='Ready'})|Out-Null} 'CCOD_INSTALL_RECORD_EXISTS';Assert-CcodThrows {New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'runtime' -CreateIfMissing|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {New-CcodInstallGenerationLeaf -Generation $transaction -Leaf 'payload'|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';$source=New-CcodSourceFile $fixture 'state-source.txt' 'x';Assert-CcodThrows {Copy-CcodInstallSealedSource -Generation $transaction -SourcePath $source.Path -Leaf 'payload.bin' -ExpectedLength $source.Length -ExpectedSha256 $source.Sha256|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {Write-CcodInstallGenerationManifest -Generation $transaction -Manifest (New-CcodGenerationManifest 'state-runtime')|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {Open-CcodInstallRetainedGeneration -InstallRoot $fixture.Install -RuntimeId 'state-runtime' -ExpectedManifestSha256 ('0'*64) -FileTransaction $transaction|Out-Null} 'CCOD_INSTALL_STATE_SCOPE';Assert-CcodThrows {Commit-CcodInstallActivePointer -InstallRoot $fixture.Install -TargetGeneration $transaction -ExpectedPreviousGeneration 0 -FileTransaction $transaction|Out-Null} 'CCOD_INSTALL_POINTER_TARGET_INVALID';Assert-CcodThrows {Retire-CcodInstallGeneration -InstallRoot $fixture.Install -RuntimeId 'state-runtime' -FileTransaction $transaction|Out-Null} 'CCOD_INSTALL_GENERATION_NOT_OWNED';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $fixture.Install 'runtime')) 'state-only transaction creates no runtime tree';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $fixture.Install 'state\active-generation')) 'state-only transaction creates no active pointer';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $fixture.Install 'state\retired-generations')) 'state-only transaction creates no retirement record'}finally{Remove-CcodInstallFileFixture $fixture}
 }
@@ -537,6 +537,46 @@ Invoke-CcodTest 'force re-import rebinds the current runtime ABI before real use
     } finally { Remove-CcodInstallFileFixture $fixture }
 }
 
+# Production mutation caught: a long-lived AppDomain already owns the V6 marker/runtime, so force-import silently selects stale CLR code.
+Invoke-CcodTest 'stale V6 preload cannot capture the final runtime ABI across force re-imports' {
+    $escapedModule=$modulePath.Replace("'","''")
+    $child=@'
+$ErrorActionPreference='Stop';$ProgressPreference='SilentlyContinue'
+Add-Type -TypeDefinition @"
+public sealed class CcodInstallGenerationCapabilityMarkerV6
+{
+    private CcodInstallGenerationCapabilityMarkerV6() { }
+    public static int CapabilityAbi { get { return 6; } }
+}
+internal sealed class CcodInstallGenerationRuntimeV6 { }
+"@
+$root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-v7-preload-'+[guid]::NewGuid().ToString('N'));[IO.Directory]::CreateDirectory($root)|Out-Null;$transaction=$null
+try{
+    $module=Import-Module '__MODULE__' -Force -PassThru -DisableNameChecking -ErrorAction Stop
+    $selected=&$module {$script:CcodRuntimeType.FullName}
+    if($selected-cne'CcodInstallGenerationRuntimeV7'){[Console]::Out.WriteLine('SELECTED_RUNTIME='+$selected);exit 17}
+    $marker='CcodInstallGenerationCapabilityMarkerV7'-as[type];$staleMarker='CcodInstallGenerationCapabilityMarkerV6'-as[type];$staleRuntime=if($null-eq$staleMarker){$null}else{$staleMarker.Assembly.GetType('CcodInstallGenerationRuntimeV6',$false)}
+    if($null-eq$marker-or[int]$marker.GetProperty('CapabilityAbi').GetValue($null,$null)-ne7-or$null-eq$staleRuntime){throw 'V7 coexistence contract failed'}
+    $first=&$module {$script:CcodRuntimeType}
+    $module=Import-Module '__MODULE__' -Force -PassThru -DisableNameChecking -ErrorAction Stop
+    $second=&$module {$script:CcodRuntimeType}
+    if($first-ne$second-or$second.FullName-cne'CcodInstallGenerationRuntimeV7'){throw 'V7 force re-import selected a different runtime'}
+    $transaction=Open-CcodInstallStateTransaction -InstallRoot $root
+    $state=New-CcodInstallDirectory -Transaction $transaction -Parent $transaction -Leaf 'state' -CreateIfMissing
+    $records=New-CcodInstallDirectory -Transaction $transaction -Parent $state -Leaf 'v7-preload-proof' -CreateIfMissing
+    Write-CcodInstallRecord -Transaction $transaction -Parent $records -Leaf 'ready.json' -Record ([ordered]@{schemaVersion=1;phase='Ready'})|Out-Null
+    if(-not[IO.File]::Exists((Join-Path $root 'state\v7-preload-proof\ready.json'))){throw 'V7 runtime behavior missing'}
+    [Console]::Out.WriteLine('STALE_V6_SKIPPED_V7_OK')
+}finally{
+    if($null-ne$transaction){try{Close-CcodInstallFileTransaction -Transaction $transaction -Disposition Ready}catch{}}
+    $full=[IO.Path]::GetFullPath($root);$temp=[IO.Path]::GetFullPath([IO.Path]::GetTempPath()).TrimEnd('\')+'\';if($full.StartsWith($temp,[StringComparison]::OrdinalIgnoreCase)-and(Test-Path -LiteralPath $full)){Remove-Item -LiteralPath $full -Recurse -Force}
+}
+'@.Replace('__MODULE__',$escapedModule)
+    $encoded=[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($child));$output=@(& powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand $encoded 2>&1);$exitCode=$LASTEXITCODE
+    Assert-CcodEqual 0 $exitCode "stale V6 preload must select final V7 output=$($output-join'|')"
+    Assert-CcodEqual 'STALE_V6_SKIPPED_V7_OK' ($output-join'') 'final V7 remains selected across force re-import and real state use'
+}
+
 Invoke-CcodTest 'creates nested scoped directories and publishes sanitized records create-only' {
     $fixture=New-CcodInstallFileFixture
     try {
@@ -995,17 +1035,17 @@ Invoke-CcodExtensionRedTest 'child-transaction' 'rejects a child directory capab
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
 
-Invoke-CcodExtensionRedTest 'v4-reimport' 'a child process loads V4 first then proves the V6 state-only export boundary' {
+Invoke-CcodExtensionRedTest 'v4-reimport' 'a child process loads V4 first then proves the V7 state-only export boundary' {
     $fixture=New-CcodInstallFileFixture
     try {
-        $source=New-CcodSourceFile $fixture 'v6-state-source.txt' 'state-only-after-v4'
+        $source=New-CcodSourceFile $fixture 'v7-state-source.txt' 'state-only-after-v4'
         $escapedModule=$modulePath.Replace("'","''");$escapedInstall=$fixture.Install.Replace("'","''");$escapedSource=$source.Path.Replace("'","''")
         $child=@"
 `$ErrorActionPreference='Stop';`$ProgressPreference='SilentlyContinue'
 Add-Type -TypeDefinition 'public sealed class CcodInstallGenerationCapabilityMarkerV4 { private CcodInstallGenerationCapabilityMarkerV4() {} public static int CapabilityAbi { get { return 4; } } }'
-if([CcodInstallGenerationCapabilityMarkerV4]::CapabilityAbi-ne4-or`$null-ne('CcodInstallGenerationCapabilityMarkerV6'-as[type])){throw 'V4 was not loaded first'}
+if([CcodInstallGenerationCapabilityMarkerV4]::CapabilityAbi-ne4-or`$null-ne('CcodInstallGenerationCapabilityMarkerV7'-as[type])){throw 'V4 was not loaded first'}
 Import-Module '$escapedModule' -Force -DisableNameChecking -ErrorAction Stop
-if([CcodInstallGenerationCapabilityMarkerV6]::CapabilityAbi-ne6){throw 'V6 ABI missing'}
+if([CcodInstallGenerationCapabilityMarkerV7]::CapabilityAbi-ne7){throw 'V7 ABI missing'}
 function Assert-ChildThrows([scriptblock]`$Action,[string]`$ErrorId){try{&`$Action;throw "EXPECTED_`$ErrorId"}catch{if(`$_.FullyQualifiedErrorId-notlike"`$ErrorId*"){throw}}}
 `$transaction=Open-CcodInstallStateTransaction -InstallRoot '$escapedInstall'
 try{
@@ -1022,11 +1062,11 @@ try{
   Assert-ChildThrows {Retire-CcodInstallGeneration -InstallRoot '$escapedInstall' -RuntimeId 'runtime-v3-old' -FileTransaction `$transaction|Out-Null} 'CCOD_INSTALL_GENERATION_NOT_OWNED'
   if([IO.Directory]::Exists((Join-Path '$escapedInstall' 'runtime'))-or[IO.Directory]::Exists((Join-Path '$escapedInstall' 'state\active-generation'))-or[IO.Directory]::Exists((Join-Path '$escapedInstall' 'state\retired-generations'))){throw 'state-only escape observed'}
 }finally{Close-CcodInstallFileTransaction -Transaction `$transaction -Disposition Ready}
-[Console]::Out.WriteLine('V4_FIRST_V6_STATE_ONLY_OK')
+[Console]::Out.WriteLine('V4_FIRST_V7_STATE_ONLY_OK')
 "@
         $encoded=[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($child));$output=@(& powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand $encoded 2>&1);$exitCode=$LASTEXITCODE
-        Assert-CcodEqual 0 $exitCode 'fresh child process accepts V6 after loading only V4 first'
-        Assert-CcodEqual 'V4_FIRST_V6_STATE_ONLY_OK' ($output -join '') 'child proves only the exported V6 state-only boundary'
+        Assert-CcodEqual 0 $exitCode 'fresh child process accepts V7 after loading only V4 first'
+        Assert-CcodEqual 'V4_FIRST_V7_STATE_ONLY_OK' ($output -join '') 'child proves only the exported V7 state-only boundary'
     } finally {Remove-CcodInstallFileFixture $fixture}
 }
 

From 69ee7cebacd503d1739c4ae496056d2252538384 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 10:08:07 +0800
Subject: [PATCH 151/187] docs: record Runtime V7 closure evidence

---
 .../progress.md                               |  8 +-
 .../runtime-v7-report.md                      | 82 +++++++++++++++++++
 2 files changed, 89 insertions(+), 1 deletion(-)
 create mode 100644 .superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/runtime-v7-report.md

diff --git a/.superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/progress.md b/.superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/progress.md
index a2b88c5..4a16a72 100644
--- a/.superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/progress.md
+++ b/.superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/progress.md
@@ -16,4 +16,10 @@ new PowerShell source.
 
 ## Status
 
-Runtime V7 task: pending. Tasks 5–8 remain blocked.
+Runtime V7 task: complete. Implementation `9d7cc90`; evidence is recorded by the commit containing
+`runtime-v7-report.md` and this ledger update. Frozen evidence: InstallFileTransaction 45 groups,
+ProductRegistration 30/30, InstallLifecycle 151/151, UninstallBootstrap 45/45, RuntimeManifest 21 groups,
+InstalledLifecycleHarness 21 groups, Bootstrap 26/26, ManualWrappers 12 groups, parser 2/2,
+`git diff --check` exit 0, and `tests\PersistenceSelfTest.ps1` exit 0. No real system action.
+
+Fresh scoped V7 review: pending. Tasks 5–8 remain blocked.
diff --git a/.superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/runtime-v7-report.md b/.superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/runtime-v7-report.md
new file mode 100644
index 0000000..f7c2c35
--- /dev/null
+++ b/.superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/runtime-v7-report.md
@@ -0,0 +1,82 @@
+# Runtime V7 ABI closure report
+
+## 结论与范围
+
+micro-plan implementation commit 为 `9d7cc90`（`fix: advance install runtime ABI to V7`），基线为
+`ec8dac0`。实现只修改：
+
+- `src/persistence/modules/InstallFileTransaction.psm1`
+- `tests/persistence/InstallFileTransaction.SelfTest.ps1`
+
+没有修改 exports、durable plan schema、file-layer 行为、ProductRegistration 或 InstallLifecycle
+逻辑。
+
+## RED
+
+独立 `powershell.exe` child 先通过自包含 `Add-Type` 预载最小 stale：
+
+- `CcodInstallGenerationCapabilityMarkerV6`，ABI `6`；
+- internal `CcodInstallGenerationRuntimeV6`，不含最终实现方法。
+
+然后 child 对当前模块执行 force-import。production 未修改时实际结果：
+
+```text
+InstallFileTransaction.SelfTest.ps1
+exit 1
+case=stale-V6-preload-cannot-capture-the-final-runtime-ABI-across-force-re-imports
+child exit=17
+SELECTED_RUNTIME=CcodInstallGenerationRuntimeV6
+```
+
+这证明长寿命 AppDomain 中已有 V6 marker 时，原模块会跳过新的 embedded C#，并把
+`$script:CcodRuntimeType` 绑定到 stale V6。
+
+## 实现与 GREEN
+
+production 仅做机械 ABI 迁移：
+
+- `CcodInstallGenerationCapabilityMarkerV6` -> `...MarkerV7`；
+- `CcodInstallGenerationRuntimeV6` -> `...RuntimeV7`；
+- `CapabilityAbi` 与 import-time exact assertion 从 `6` -> `7`；
+- 所有 constructor、out parameter、runtime allocation 与 reflection binding 同步改为 V7。
+
+exact tests 同步为 V7/7。独立 child 保留 stale V6，证明：
+
+1. V6 marker/runtime 仍在同一 AppDomain；
+2. force-import 选择 `CcodInstallGenerationRuntimeV7`；
+3. repeated force-import 复用同一个正确 V7 `System.Type`；
+4. V7 state transaction 实际写入 create-only record；
+5. 既有 V4-first child 也只选择 V7。
+
+首轮 GREEN 的 coexistence oracle 曾错误使用 `'RuntimeV6' -as [type]` 检查 internal stale runtime，
+因此返回 null。独立诊断证明 global type resolution 为 null、但
+`staleMarker.Assembly.GetType('CcodInstallGenerationRuntimeV6')` 返回该 internal type；修正测试
+oracle 后，没有追加 production 改动。
+
+## Frozen gate
+
+source freeze 后结果：
+
+```text
+InstallFileTransaction.SelfTest.ps1    45 groups   exit 0
+ProductRegistration.SelfTest.ps1       30/30       exit 0
+InstallLifecycle.SelfTest.ps1          151/151     exit 0
+UninstallBootstrap.SelfTest.ps1        45/45       exit 0
+RuntimeManifest.SelfTest.ps1           21 groups   exit 0
+InstalledLifecycleHarness.SelfTest.ps1 21 groups   exit 0
+Bootstrap.SelfTest.ps1                 26/26       exit 0
+ManualWrappers.SelfTest.ps1            12 groups   exit 0
+PowerShell parser                      2/2 changed files, 0 errors
+git diff --check                                   exit 0
+tests\PersistenceSelfTest.ps1                      exit 0 (silent success)
+```
+
+Lifecycle 的既有 cross-process guard 仍输出：
+`exit=23 mutex=True authority=False product=False verified=False error=CCOD_PRODUCT_REGISTRATION_FAILED`。
+
+## 安全边界
+
+未执行真实 registry、shortcut、scheduled task、安装、卸载、进程重启、系统重启、网络、push、
+tag、release 或发布操作；所有新 child 行为仅使用独立临时目录并完成清理。
+
+fresh scoped V7 review 仍待 parent agent 发起；不声明 Tasks 5–8 或 release readiness 完成。

From 3eea9512f704da381d518a7510d7b537dae22c0f Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 10:13:37 +0800
Subject: [PATCH 152/187] docs: accept Runtime V7 closure

---
 .../sdd/2026-09-03-v2522-runtime-v7-closure/progress.md        | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/progress.md b/.superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/progress.md
index 4a16a72..18c220d 100644
--- a/.superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/progress.md
+++ b/.superpowers/sdd/2026-09-03-v2522-runtime-v7-closure/progress.md
@@ -22,4 +22,5 @@ ProductRegistration 30/30, InstallLifecycle 151/151, UninstallBootstrap 45/45, R
 InstalledLifecycleHarness 21 groups, Bootstrap 26/26, ManualWrappers 12 groups, parser 2/2,
 `git diff --check` exit 0, and `tests\PersistenceSelfTest.ps1` exit 0. No real system action.
 
-Fresh scoped V7 review: pending. Tasks 5–8 remain blocked.
+Fresh scoped V7 review: Spec Compliance PASS, Task Quality PASS, 0 Critical, 0 Important. Runtime V7
+micro-plan is complete. Tasks 5–8 remain blocked until their own gates are implemented and verified.

From 1109854232c0e534d0509259ef49d01ed2956867 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 10:15:57 +0800
Subject: [PATCH 153/187] docs: start exact release evidence task

---
 .../progress.md                               | 374 ++++++++++++++++++
 .../task-5-brief.md                           |  19 +
 2 files changed, 393 insertions(+)
 create mode 100644 .superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md
 create mode 100644 .superpowers/sdd/2026-08-29-v2522-immutable-generation/task-5-brief.md

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md
new file mode 100644
index 0000000..63ee232
--- /dev/null
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md
@@ -0,0 +1,374 @@
+# SDD ledger — plan: docs/superpowers/plans/2026-08-29-v2522-immutable-generation.md
+
+## Context
+
+- Worktree: `C:\Users\33384\Documents\Codex-Control-other-devices-Windows\.worktrees\codex-v2522-install-runtime-reliability`
+- Branch: `codex/v2522-install-runtime-reliability`
+- Base: `03de616` (`docs: plan immutable generation release model`)
+- Spec: `docs/superpowers/specs/2026-08-29-v2522-immutable-generation-design.md`
+- User confirmed the no-privilege immutable-generation model on 2026-08-29.
+- Older Task 1 handle/DACL implementation remains unreleased historical branch
+  work and will be rewritten or superseded; no old `build/dist` asset is valid.
+
+## Preflight plan scan
+
+| Producer / consumer | Interface or state | Result |
+| --- | --- | --- |
+| Task 1 -> Task 2 | opaque create-only generation and pointer primitives | Compatible; Task 2 must not reintroduce overwrite/recursive delete. |
+| Task 2 -> Task 3 | sealed generation, phase record, compensation | Compatible; Setup passes package hash and consumes strict Ready. |
+| Task 3 -> Task 4 | immutable stable generation/bootstrap | Compatible; registration occurs only after Ready. |
+| Task 2 -> Task 5 | pointer/receipt/manifest identity | Compatible; Defender failure must precede activation. |
+| Task 3 -> Task 5 | sealed Setup package and expected hashes | Compatible; package scan has a concrete bootstrap hook. |
+| Task 5 -> Task 6 | explicit 11 assets and dual receipt contract | Compatible; release code consumes one asset-name source. |
+| Task 6 -> Task 7 | clean candidate and private draft | Compatible; Stage never promotes or rebuilds. |
+| Task 7 -> Task 8 | official draft and downloaded asset evidence | Compatible; Preflight is the only live scan producer. |
+| Task 8 -> promotion | automated lifecycle and manual tray/remote evidence | Compatible; Promote is local and evidence-bound. |
+
+## Rulings
+
+- Ruling: the current-user hostile-writer guarantee is removed — a process with
+  unrestricted same-user write/DACL authority cannot be reliably defeated by a
+  current-user utility without an elevated/signed broker. The product instead
+  guarantees unique create-only generations, strict validation, atomic pointer
+  commits, and retention on failure. Cost if wrong: this is a narrower security
+  claim, but it is enforceable without changing install privileges.
+- Ruling: install-time cleanup retires or retains old generations — it does not
+  recursively delete a nonempty tree. Physical reclamation is a separate,
+  exclusive maintenance/uninstall operation. Cost if wrong: disk usage grows
+  until proven reclamation, but failed installs cannot partially erase a usable
+  generation.
+- Ruling: stable bootstrap is selected by the immutable generation/pointer
+  contract; Setup does not overwrite a writable `{app}` tree before Ready.
+  Legacy Inno registration is migrated only after the new generation is Ready.
+  Cost if wrong: migration has an extra registration step, but stale app files
+  cannot become the activation source.
+- Ruling: official browser-downloaded draft assets are the live Defender scan
+  source. No workflow or test fabricates ZoneId 3; public promotion waits for
+  two actual receipts and the current-machine acceptance chain.
+
+Task 1: in progress (base `03de616`)
+
+Task 1: fix round 1/5 opened after review of `03de616..e3ad4f7` found one
+Critical source/stream handoff window and three Important issues: physical
+retirement remained despite the revised create-only-record model, long-lived
+PowerShell re-import did not rebind its runtime type, and pointer/retirement/
+close race coverage was incomplete. The review also clarified that module
+session/reflection access is outside the unprivileged threat boundary. Ruling:
+retirement is record-only, sealed pins remain private through the handoff, and
+the runtime ABI is explicitly rebound on every import. Cost if wrong: the
+process-local API is not a sandbox, but ordinary callers cannot obtain raw
+handles or a partially verified generation.
+
+Task 1: fix round 1/5 opened after scoped review of `e3ad4f7..90d9d8d` found
+one Critical commit-then-failable handoff and two Important gaps: final leaves
+were visible before sealing, and streams could escape transaction ownership on
+early I/O failure. Ruling: every content write is registered before fallible
+I/O, sealed through a private temporary leaf, and only then renamed no-replace;
+record-only retirement is state-committed only after its record rename. Cost if
+wrong: temporary diagnostic leaves may remain, but no caller observes a partial
+final generation or a commit reported failed after it is visible.
+
+Task 1: scoped re-review of fix round 1 remains open. The reviewer marked the
+handoff/retirement/coverage set NOT ADDRESSED because a record or final leaf can
+still be visible before a potentially failing handoff, retirement record state
+can diverge after commit, and early destination streams may not be transaction
+owned. Fix round 2 is opened against `90d9d8d`; see
+`task-1-fix1-brief.md` for the complete required RED/GREEN changes. No later
+task may consume this file layer until the scoped re-review is clean.
+
+Task 1: fix round 2/5 opened after scoped review of `90d9d8d..e74cfdf` found
+one Critical retirement record commit-then-fail path and one Important
+exception-unsafe Close path. Ruling: retirement performs no fallible action
+after record publication, and Close attempts every registered resource before
+settling its closed state. Cost if wrong: a failed cleanup may retain a bounded
+temporary, but it cannot report a committed record as failed or leave unrelated
+handles locked behind the first disposal error.
+
+Task 1: complete (commits `e3ad4f7..f86d439`, scoped review clean). The final
+review of `e74cfdf..f86d439` marked retirement commit consistency and
+exception-safe/retriable Close ADDRESSED, with no new Critical/Important
+findings. Focused immutable-generation self-test is 16/16; aggregate remains
+blocked only by the documented local Bootstrap fallback/mutex case.
+
+Task 2: blocked before implementation. The Task 1 API cannot open an existing
+retained generation read-only or write generic scoped state/receipt/log records,
+so it cannot implement post-pointer compensation without bypassing the
+create-only boundary. Ruling: extend Task 1 with retained-generation and
+scoped-record primitives first; Task 2 must not invent a second path-based file
+API. Cost if wrong: one additional reviewed Task 1 interface round, but
+compensation remains bound to the same immutable file layer.
+
+Task 1: fix round 3/5 opened for the retained-generation/scoped-record API
+extension; see `task-1-fix3-brief.md`.
+
+Task 1: fix round 3/5 implementation `14178fc` passed its RED/GREEN suites,
+but the scoped re-review found one Important issue: Windows PowerShell
+`ConvertFrom-Json` collapses duplicate top-level `runtimeId` members, so the
+claimed uniqueness check was not strict. Four other findings (transitive
+read-only aliases, nested retained listing, V3 re-import, and transaction-root
+input) were addressed. Ruling: treat duplicate-key rejection as load-bearing
+and open fix round 4/5 with a fresh implementer; no later task may consume the
+extension until the scoped re-review is clean. Cost if wrong: a crafted
+manifest with duplicate identity keys could be accepted as a retained target.
+
+Task 1: fix round 4/5 (`14178fc..e80b829`) addressed the duplicate top-level
+`runtimeId` finding. A scoped re-review marked the finding ADDRESSED, with
+Spec Compliance PASS, Task Quality PASS, and no new Critical/Important
+findings. The bounded lexical key pass composes with `ConvertFrom-Json` to
+reject duplicate members while preserving decoded semantic values. Focused
+coverage is 25/25; aggregate Bootstrap ASSERT_EXACT remains an environmental
+boundary. Task 1 is complete (`e3ad4f7..e80b829`, review clean).
+
+Task 2 ruling before resumption: stable-shell candidates remain inside each
+immutable generation; the scheduled task and post-Ready shortcut/registration
+adapters select the generation-specific bootstrap, while legacy root shell
+files are retained and never overwritten in the install hot path. This keeps
+the create-only file layer honest and still permits upgrades from an old
+fixed-root task after the new generation reaches verified readiness. The
+existing `Copy-CcodInstallSealedSource` is used only with a writable generation
+capability; no root overwrite or second path-based copy API is introduced.
+Cost if wrong: an old shortcut may need one post-Ready registration update, but
+no incomplete upgrade can replace the only startup shell.
+
+Task 2 ruling: immutable initialization evidence and operational state are
+separate planes. The transaction writes create-only defaults below
+`state\install-initializations\<runtimeId>`; only when absent are they
+materialized into the existing mutable `state\*.json` and
+`state\ui-preferences.json` operational plane. The Supervisor updates that
+operational plane only after `Ready`; upgrades never overwrite existing or
+partial files. Reason: Task1 sealing those runtime state files ReadOnly caused
+real StateStore/UI writes to fail with Windows error 5. Cost if wrong: one
+extra immutable evidence set per install, but normal tray/state/recovery
+updates remain functional rather than silently breaking after activation.
+
+Task 2 ruling: same-version idempotence and package-conflict behavior require
+an explicit canonical `SealedPackageSha256`. A direct/legacy invocation without
+that identity follows the normal upgrade path and cannot infer package equality
+from `package.json`. Task 3 Setup and portable entrypoints must pass the sealed
+package identity. Cost if wrong: older direct callers may perform an unnecessary
+upgrade, but no unsealed or weakly identified package can silently short-circuit
+activation.
+
+Task 2 initial implementation `2101485` passed focused and aggregate tests,
+but scoped review failed it with one Critical and six Important findings. The
+Critical was a real generation-bootstrap break: the task points at the new
+generation bootstrap while that bootstrap still requires root `active.json`,
+uses the old runtime-ID format, and lifecycle readiness rejects its parent.
+Ruling: fix round 1 must expand Task 2 to bootstrap and Bootstrap self-tests;
+it implements the same append-only pointer and canonical runtime-ID contract.
+Cost if wrong: a fresh install could report fake-test Ready yet fail on actual
+task startup or after reboot.
+
+Ruling: runtime identity is `projectVersion-fileDigest16-nonce32`, revalidated
+by manifest and bootstrap; transaction records bind old/new manifest hashes,
+the global entrypoint rejects every nonterminal/ambiguous chain, baseline
+evidence is written for each generation, and Ready terminalization may never
+append Failed after a visible Ready receipt. Cost if wrong: an attacker or
+failure could select an unbound generation, bypass a pending transaction, or
+leave contradictory terminal evidence.
+
+Task 2 fix round 1 `bd5b690` passed focused suites and aggregate but scoped
+re-review remained FAIL: one Critical production fence prevented actual fresh
+or append-only upgrade pointer commits, two Important selector consumers still
+accepted ADS/multilink/wrong root fallbacks, and the Ready-final-snapshot path
+was nonterminal but not recoverable. Ruling: fix round 2 adds a V4 opaque
+state-only transaction usable only to append a revalidated missing terminal
+state record; it cannot touch generations or pointers. The production fence
+must validate the append-only pointer directly, and every pre-runtime consumer
+must reject unsafe selector roots/leaves before legacy fallback. Cost if wrong:
+real installation can fail before bootstrap, authorization can trust unsafe
+selector storage, or terminalization can remain permanently stuck.
+
+Task 2 fix round 2 `f10f725` passed focused and fresh aggregate, but scoped
+re-review remained FAIL with Important selector-authorization gaps: several
+consumers treated every selector-root lookup failure as absence and fell back
+to legacy `active.json`; StaticProbe accepted selector schema version 2; V3 to
+V4 re-import evidence loaded V4 first; and Static/Uninstall hostile matrices
+omitted malformed JSON. Ruling: fix round 3 must permit legacy fallback only
+on a proven ItemNotFound outcome, require schema version 1 everywhere, use a
+child V3-first import process, and add malformed-selector regressions. Cost if
+wrong: ACL/I/O errors or malformed selectors can silently authorize an old
+runtime and the ABI containment claim remains unproved.
+
+Task 2 fix round 3 `8eb6920` passed focused and aggregate but scoped
+re-review remained FAIL with two Important absence-proof gaps: an intermediate
+`state` regular file can surface ItemNotFound for the child selector and allow
+legacy fallback, and StaticProbe treats an adapter null/no-output result as a
+proven missing selector. Ruling: fix round 4 must require a real nonreparse
+`state` directory before a child absence can be accepted, and StaticProbe must
+use a discriminated explicit absence result rather than optional empty output.
+Cost if wrong: malformed parent storage or an adapter contract failure can
+silently authorize a stale legacy runtime.
+
+Task 2 fix round 4 `d3ec629` passed focused and aggregate but scoped
+re-review remained FAIL with one Important uninstall compatibility gap: when
+the `state` ancestor is truly absent, Uninstall resolves its child first and
+rejects before the permitted legacy pointer fallback. Ruling: fix round 5 must
+prove `state` separately, then probe the child only under a real plain
+directory; add a no-state legacy fallback regression distinct from later epoch
+validation. Cost if wrong: an otherwise valid legacy uninstall cannot recover
+its selected runtime when the new selector plane has never been created.
+
+Task 2 verification ruling: the Bootstrap release-failure test's 4-second
+whole-process watchdog is a reproducible test-harness flake, not a production
+deadlock. The real bootstrap exits about 5.1 seconds after cold start while
+correctly logging release failure and killing the fallback child; the harness
+kills it first at 4 seconds. Replace the fixed start-to-exit budget with a
+release-attempt marker, a bounded 15-second watchdog, and a 2-second
+marker-to-exit assertion while retaining log, child-exit, and mutex-release
+proofs. Cost if wrong: the test becomes slightly more structured, but it keeps
+detecting a swallowed release failure without being load-sensitive.
+
+Task 2: fix round 5 `46692e7` addressed the no-state Uninstall fallback and
+the reproducible Bootstrap test-harness timing flake. Scoped re-review marked
+Spec Compliance PASS and Task Quality PASS with no Critical/Important
+findings. Fresh local focused verification and a full
+`tests\PersistenceSelfTest.ps1` aggregate both exited zero. Task 2 is complete
+(`2101485..46692e7`, review clean).
+
+Task 3 initial implementation `9e1c41c` passed focused suites but scoped
+review failed with four Important gaps: portable did not propagate explicit
+sealed identity; schema-2 provenance validation was partial; compiled Inno was
+not executed through a safe pre-activation failure fixture; and the report
+omitted the exact commit. Ruling: fix round 1 must bind portable identity,
+enforce exact nested provenance schemas, run a mismatched-hash compiled Setup
+fixture that fails before activation with no product state, and record the
+full commit. Cost if wrong: portable differs from Setup identity semantics,
+provenance can be cosmetically altered, and the no-write Inno claim lacks
+runtime evidence.
+
+Task 3 reporting ruling: a Git commit cannot record its own final hash. The
+fix round therefore uses an implementation commit followed by a report-only
+evidence commit that records the implementation commit's exact 40-hex SHA;
+the scoped review package covers both commits. Cost if wrong: one additional
+auditable documentation commit, but no self-referential or ambiguous HEAD
+claim.
+
+Task 3 fix round 1 `51def5c..728b627` passed focused suites but scoped review
+remained FAIL with three Important binding gaps: portable identity was not tied
+to the copied/executed payload, schema-2 provenance accepted duplicate raw JSON
+members, and the compiled Setup failure fixture did not snapshot LocalAppData
+product state. Ruling: fix round 2 must use the post-copy verified identity,
+strictly reject duplicate keys at every provenance object level, and compare a
+read-only product-tree snapshot before/after the wrong-hash compiled Setup run.
+Cost if wrong: a raced portable payload or ambiguous provenance can be accepted,
+and the pre-activation no-product-state claim is incomplete.
+
+Task 3 fix round 2 `1cb9162..a5d5958` passed focused suites but scoped
+re-review remained FAIL with one Important test-compliance gap: the portable
+race test called only the copy helper, so its child/lifecycle absence assertions
+did not prove the portable entrypoint stopped before execution. Ruling: fix
+round 3 must invoke `Install-CodexRemote-fix.ps1` with a marker-capable child
+fixture and race the verified source at the validation-to-copy boundary; prove
+no child marker or lifecycle state before failure. Cost if wrong: portable
+production may be correct but the required end-to-end race evidence is absent.
+
+Task 3 fix round 3 `58bd760..9e971d1` passed focused suites but scoped
+re-review remained FAIL: its actual-entrypoint mutation occurred during mocked
+Defender and was caught by the earlier post-scan manifest validation, not by
+the final validation-to-File.Copy race. Ruling: fix round 4 must use the real
+entrypoint while mutating at the production copy barrier after the copy helper's
+own validation, and require `CCOD_PORTABLE_COPY_HASH_MISMATCH` plus no child or
+lifecycle mutation. Cost if wrong: the full-path test validates an earlier
+check but not the claimed final copy boundary.
+
+Task 4 initial implementation `e43d9ce..97cf17d` passed focused suites but
+scoped review failed with one Critical and four Important findings: installed
+uninstall finalizes before deleting its selected generation, matched-only
+uninstall cleanup is too weak, failed post-Ready registration cannot retry,
+legacy cleanup can partially delete, and exported shortcut capability accepts
+arbitrary source paths. Ruling: fix round 1 must add a verified external
+generation finalizer, exact registration/shortcut matching with compensating
+legacy migration, post-Ready retry, and sealed-generation-only shortcut source
+capabilities. Cost if wrong: Windows Settings uninstall deterministically
+fails, user replacements can be deleted, registration can remain permanently
+absent, or an arbitrary source can be registered as product shortcut.
+
+Task 3 fix round 4 `141ab71..70bc231` addressed the actual production module
+File.Copy-boundary portable race. Scoped re-review marked Spec Compliance PASS
+and Task Quality PASS with no Critical/Important findings. Fresh local
+ReleaseWorkflow, InstallLifecycle, parser/diff verification, and the full
+`tests\PersistenceSelfTest.ps1` aggregate all exited zero. Task 3 is complete
+(`9e1c41c..70bc231`, review clean).
+
+Task 3 fix round 4 `141ab71..70bc231` addressed the production module
+File.Copy-boundary portable race. Scoped re-review marked Spec Compliance PASS
+and Task Quality PASS with no Critical/Important findings. Fresh local
+ReleaseWorkflow, InstallLifecycle, parser/diff verification, and the full
+`tests\PersistenceSelfTest.ps1` aggregate all exited zero. Task 3 is complete
+(`9e1c41c..70bc231`, review clean).
+
+Task 2 fix round 5 implementation passed its final verification matrix. The
+Uninstall bootstrap now resolves and proves `state` separately, resolves
+`state\active-generation` only below a proven plain directory, and permits a
+valid legacy pointer when the whole state plane is absent without bypassing
+the later lifecycle-epoch boundary. The real no-state regression includes an
+invalid-pointer negative control so skipping authorization cannot satisfy it.
+The Bootstrap release-failure regression now uses the ruled marker-relative
+timing contract without changing production Bootstrap behavior. All eight
+focused suites passed (26, 26, 21, 41, 17, 116, 24, and 9 cases), all three
+changed PowerShell files parsed, `git diff --check` passed, and the full
+`tests\PersistenceSelfTest.ps1` aggregate exited `0`. Task 2 fix round 5 is
+ready for scoped re-review.
+
+Task 3: complete. Setup now compiles from one version/commit-bound sealed ZIP,
+its canonical package manifest, the hash-bound temporary activation bootstrap,
+and setup provenance as exactly four `dontcopy` inputs. It sets
+`CreateAppDir=no` and `Uninstallable=no`, has no pre-Ready `{app}` product,
+shortcut, registry, uninstall, recursive extraction, or legacy app-bootstrap
+path, and retains its input locks through strict append-only Ready validation.
+The real disposable package/bootstrap test proves exact
+`SealedPackageSha256` propagation. Final focused verification passed
+ReleaseWorkflow, InstallLifecycle 113/113, parser 8/8, `git diff --check`, and
+the zero-violation static boundary audit. Task 4 retains all product
+registration work; Task 5 retains Defender/public-asset work.
+
+Task 3 fix round 1 implementation
+`51def5c9ae2f5e0722b9083e478b17c507e9cee8` addressed all four Important
+findings from review of `46692e7..9e1c41c`: portable explicitly propagates the
+twice-verified sealed identity; schema-two Setup provenance has exact ordered
+nested schemas and a 24-case mutation matrix; a real wrong-hash production
+Setup execution now fails nonzero from `PrepareToInstall` before activation or
+product output; and `task-3-report.md` records full commit identities. Final
+focused ReleaseWorkflow and InstallLifecycle 113/113 suites passed, along with
+parser 4/4, diff check, and the zero-violation no-`{app}` boundary scan. The
+fix-round report evidence is a separate report-only commit so the report can
+truthfully contain the immutable implementation SHA.
+
+Task 3 fix round 2 implementation
+`1cb91621f2565318143dffe08844a91a350a36d9` addressed the three Important
+findings from review of `9e1c41c..728b627`: portable identity is derived from
+the revalidated published copy and has a real validation-to-copy race test;
+raw duplicate JSON members are rejected before deserialization at every
+provenance object depth; and the wrong-hash compiled Setup fixture compares a
+bounded read-only before/after snapshot of the actual LocalAppData product
+tree. Final ReleaseWorkflow and InstallLifecycle 113/113 suites passed, with
+parser 4/4, diff check, and zero no-`{app}` boundary violations. The exact
+implementation SHA is recorded through the separate report-evidence commit.
+
+Task 3 fix round 3 implementation
+`58bd7603fa83133d78d2f62ac045ec00d25134c9` replaced the helper-only portable
+copy race with an actual `Install-CodexRemote-fix.ps1` invocation. A controlled
+test-local Defender mutation changes the child source after initial validation;
+the production entrypoint's post-Defender revalidation rejects it with
+`CCOD_PORTABLE_MANIFEST_INVALID` before child marker or fixture lifecycle state.
+ReleaseWorkflow and InstallLifecycle 113/113 passed, with parser 1/1 and clean
+diff check. The exact implementation SHA is recorded in the separate report
+evidence commit.
+
+Task 4 fix round 1 `2e76698..0fdc392` passed focused suites but scoped review
+remained FAIL with four Important gaps: finalizer path/wrapper/epoch binding
+was insufficient and removed the whole root; current cleanup accepted coherently
+replaced registry/shortcuts; product shortcut authority was pre-Ready/unselected;
+and production legacy restoration suppressed restore failures. Ruling: fix
+round 2 binds finalizer to exact transaction/runtime root/manifest/epoch and
+deletes only that root, makes cleanup/retry capability derive exact Ready
+transaction identity, and fails loudly on any uncompensated legacy restore.
+Cost if wrong: deletion can target a sibling/root, user replacements can be
+removed, or a failed migration can silently leave partial legacy state.
+
+Task 4 and its legacy/uninstall reliability successors are complete through `9d7cc90`, with evidence and
+review acceptance through `3eea951`. The true v2.5.21 lifecycle bridge, exact historical registration
+profiles, durable pre-write migration plan, same-SID/new-session TaskRemoved recovery, post-reclamation
+staged resume, pinned generation reclamation, and Runtime V7 ABI closure all passed their scoped reviews.
+The latest frozen persistence aggregate exited 0. Task 5 is now in progress; Tasks 6–8 remain blocked.
diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-5-brief.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-5-brief.md
new file mode 100644
index 0000000..9ac9c3b
--- /dev/null
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-5-brief.md
@@ -0,0 +1,19 @@
+# Task 5 brief — exact assets and dual Defender evidence
+
+Implement Task 5 from `docs/superpowers/plans/2026-08-29-v2522-immutable-generation.md` with RED -> GREEN. Read the matching design section and existing release/Defender code before editing.
+
+## Required contracts
+
+1. Create `tools/ReleaseAssetContract.psm1` as the single source of the exact ordered 11 public v2.5.22 asset names. `Test-CcodExactReleaseAssetSet` rejects missing, extra, duplicate/case-varied, directory, reparse, unsafe ancestry, or noncanonical entries and cross-validates portable/Setup checksum, provenance, payload manifest, release manifest, version and 40-hex commit bindings.
+2. Extend `Invoke-CcodReleaseDefenderCheck` to accept only `TrustedWorkflowArtifact` or `InternetDownload`, exact Setup or ZIP plus matching checksum/manifest, and a create-only regular evidence leaf. `InternetDownload` requires the actual Zone.Identifier ADS with ZoneId 3 and exposes no synthesis switch. `TrustedWorkflowArtifact` requires exact workflow artifact identity. Require Defender service/AV/real-time enabled, current nonempty platform/engine/signature metadata and timestamp, bounded scan timestamps, successful custom scan, and zero new detections. The canonical receipt contains no source path or raw Defender output.
+3. `Test-CcodReleasePromotionEvidence` validates the two distinct official-download receipts (Setup and portable ZIP), their exact asset/manifest hashes, version, commit and `InternetDownload` origin. Reject duplicate, swapped, missing, extra, reused or mismatched receipts. Trusted-workflow receipts remain separately origin-bound evidence and never substitute for the two official-download receipts.
+4. Keep portable scanning before activation. Add Setup sealed-package scanning before the lifecycle can create `Prepared`, transaction-root or product state. A scan failure must produce no activation mutation.
+5. Update build/manifest validation to consume the centralized 11-name contract. Update README/README.zh-CN/CHANGELOG only to enforced candidate behavior: no unqualified stable/verified claim and no per-version What's New clutter on the README home page. Receipts are evidence, never public assets.
+
+## RED coverage
+
+Cover exact asset-set mutations; every receipt binding field; Setup/ZIP duplicate/swap/missing; both origin rules; ZoneId absent/other/synthetic attempt; disabled Defender/service/real-time; absent/stale signature; scan error/detection; existing/reparse evidence; write failure; portable and Setup scan failure before mutation; and documentation wording.
+
+## Verification and boundaries
+
+Run ReleaseWorkflow, PortableRelease, InstallLifecycle, changed parsers, `git diff --check`, and the full persistence aggregate from frozen source. Tests use adapters only and cannot claim a live Defender pass. Do not execute real scans, builds, network, GitHub, installation, restart, reboot or publication. Commit implementation and evidence separately, then request a scoped review. Tasks 6–8 stay blocked.

From fb163b7b6b594e302cf4dffe1dedd055b5f8d9d4 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 12:20:25 +0800
Subject: [PATCH 154/187] feat: require dual Defender release evidence

---
 Activate-CcodRemoteFix.ps1                    |  57 ++-
 CHANGELOG.md                                  |   2 +
 Install-CodexRemote-fix.ps1                   |  26 +-
 README.md                                     |  27 +-
 README.zh-CN.md                               |  32 +-
 build/build.ps1                               |  28 +-
 tests/Validate.ps1                            |   1 +
 .../persistence/InstallLifecycle.SelfTest.ps1 |   8 +-
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 373 +++++++++++++---
 tools/ReleaseAssetContract.psm1               | 403 ++++++++++++++++++
 tools/Test-ReleaseDefender.ps1                | 328 ++++++++++----
 11 files changed, 1104 insertions(+), 181 deletions(-)
 create mode 100644 tools/ReleaseAssetContract.psm1

diff --git a/Activate-CcodRemoteFix.ps1 b/Activate-CcodRemoteFix.ps1
index 87e12f2..5ca32f0 100644
--- a/Activate-CcodRemoteFix.ps1
+++ b/Activate-CcodRemoteFix.ps1
@@ -66,6 +66,60 @@ function Get-CcodActivationFileSha256 {
     finally{if($null-ne$stream){$stream.Dispose()};$sha.Dispose()}
 }
 
+function Get-CcodSetupDefenderDetectionKeys {
+    param($Records)
+    $keys = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    foreach ($record in @($Records)) {
+        if ($null -eq $record) { continue }
+        $threat = if ($null -ne $record.PSObject.Properties['ThreatID']) { [string]$record.ThreatID } else { '' }
+        $time = if ($null -ne $record.PSObject.Properties['InitialDetectionTime']) { [string]$record.InitialDetectionTime } else { '' }
+        $resources = if ($null -ne $record.PSObject.Properties['Resources']) { (@($record.Resources) -join '|') } else { '' }
+        if (-not [string]::IsNullOrWhiteSpace($threat) -or -not [string]::IsNullOrWhiteSpace($time) -or -not [string]::IsNullOrWhiteSpace($resources)) { [void]$keys.Add("$threat|$time|$resources") }
+    }
+    Write-Output -NoEnumerate $keys
+}
+
+function Invoke-CcodSetupPackageDefenderGate {
+    param([Parameter(Mandatory)][string]$PackagePath)
+    $started = [datetime]::UtcNow
+    try { $status = Get-MpComputerStatus -ErrorAction Stop }
+    catch { throw 'CCOD_SETUP_DEFENDER_STATUS_INVALID' }
+    if ($null -eq $status -or
+        $null -eq $status.PSObject.Properties['AMServiceEnabled'] -or $status.AMServiceEnabled -isnot [bool] -or -not $status.AMServiceEnabled -or
+        $null -eq $status.PSObject.Properties['AntivirusEnabled'] -or $status.AntivirusEnabled -isnot [bool] -or -not $status.AntivirusEnabled -or
+        $null -eq $status.PSObject.Properties['RealTimeProtectionEnabled'] -or $status.RealTimeProtectionEnabled -isnot [bool] -or -not $status.RealTimeProtectionEnabled -or
+        $null -eq $status.PSObject.Properties['AMProductVersion'] -or $status.AMProductVersion -isnot [string] -or [string]::IsNullOrWhiteSpace($status.AMProductVersion) -or
+        $null -eq $status.PSObject.Properties['AMEngineVersion'] -or $status.AMEngineVersion -isnot [string] -or [string]::IsNullOrWhiteSpace($status.AMEngineVersion) -or
+        $null -eq $status.PSObject.Properties['AntivirusSignatureVersion'] -or $status.AntivirusSignatureVersion -isnot [string] -or [string]::IsNullOrWhiteSpace($status.AntivirusSignatureVersion) -or
+        $null -eq $status.PSObject.Properties['AntivirusSignatureLastUpdated'] -or $status.AntivirusSignatureLastUpdated -isnot [datetime]) {
+        throw 'CCOD_SETUP_DEFENDER_STATUS_INVALID'
+    }
+    $signatureUpdated = ([datetime]$status.AntivirusSignatureLastUpdated).ToUniversalTime()
+    if ($signatureUpdated -lt $started.AddHours(-72) -or $signatureUpdated -gt $started.AddMinutes(5)) { throw 'CCOD_SETUP_DEFENDER_STATUS_INVALID' }
+    try { $before = Get-CcodSetupDefenderDetectionKeys -Records @(Get-MpThreatDetection -ErrorAction Stop) }
+    catch { throw 'CCOD_SETUP_DEFENDER_STATUS_INVALID' }
+    try { Start-MpScan -ScanType CustomScan -ScanPath $PackagePath -ErrorAction Stop }
+    catch { throw 'CCOD_SETUP_DEFENDER_SCAN_FAILED' }
+    $completed = [datetime]::UtcNow
+    if ($completed -lt $started -or $completed -gt $started.AddHours(2)) { throw 'CCOD_SETUP_DEFENDER_CLOCK_INVALID' }
+    try { $after = Get-CcodSetupDefenderDetectionKeys -Records @(Get-MpThreatDetection -ErrorAction Stop) }
+    catch { throw 'CCOD_SETUP_DEFENDER_STATUS_INVALID' }
+    $newDetections = @($after | Where-Object { -not $before.Contains($_) })
+    if ($newDetections.Count -ne 0) { throw 'CCOD_SETUP_DEFENDER_DETECTIONS_FOUND' }
+    return [pscustomobject][ordered]@{
+        defenderServiceEnabled=$true
+        antivirusEnabled=$true
+        realTimeProtectionEnabled=$true
+        defenderPlatformVersion=[string]$status.AMProductVersion
+        defenderEngineVersion=[string]$status.AMEngineVersion
+        signatureVersion=[string]$status.AntivirusSignatureVersion
+        signatureUpdatedAtUtc=$signatureUpdated.ToString('o',[Globalization.CultureInfo]::InvariantCulture)
+        scanStartedAtUtc=$started.ToString('o',[Globalization.CultureInfo]::InvariantCulture)
+        scanCompletedAtUtc=$completed.ToString('o',[Globalization.CultureInfo]::InvariantCulture)
+        detectionCount=0
+    }
+}
+
 function Test-CcodActivationPackageRelativePath {
     param($Path)
     return $Path-is[string]-and$Path-cmatch'^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$'-and-not$Path.Contains('//')-and-not$Path.Contains('..')-and-not$Path.Contains(':')-and-not$Path.Contains('\')-and-not$Path.EndsWith('/')
@@ -89,7 +143,7 @@ function Open-CcodInstallerPackageSeal {
         if($entries.Count-ne$expected.Count+1-or-not$entries.ContainsKey('installer-payload.manifest.json')){throw 'CCOD_INSTALLER_PACKAGE_INVALID'}
         foreach($pair in $expected.GetEnumerator()){$entry=$entries[$pair.Key];$record=$pair.Value;if([int64]$entry.Length-ne[int64]$record.length){throw 'CCOD_INSTALLER_PACKAGE_INVALID'};$stream=$entry.Open();$sha=[Security.Cryptography.SHA256]::Create();try{$hash=[BitConverter]::ToString($sha.ComputeHash($stream)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose();$stream.Dispose()};if($hash-cne[string]$record.sha256){throw 'CCOD_INSTALLER_PACKAGE_INVALID'}}
         $payloadEntry=$entries['installer-payload.manifest.json'];$stream=$payloadEntry.Open();$sha=[Security.Cryptography.SHA256]::Create();try{$payloadHash=[BitConverter]::ToString($sha.ComputeHash($stream)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose();$stream.Dispose()};if([int64]$payloadEntry.Length-ne[int64]$manifest.payloadManifest.length-or$payloadHash-cne[string]$manifest.payloadManifest.sha256){throw 'CCOD_INSTALLER_PACKAGE_INVALID'}
-        return [pscustomobject]@{PackageStream=$packageStream;ManifestStream=$manifestStream;Archive=$archive;Manifest=$manifest;Entries=$entries;PayloadManifestSha256=$payloadHash}
+        return [pscustomobject]@{PackagePath=$package;PackageStream=$packageStream;ManifestStream=$manifestStream;Archive=$archive;Manifest=$manifest;Entries=$entries;PayloadManifestSha256=$payloadHash}
     }catch{if($null-ne$archive){$archive.Dispose()};if($null-ne$manifestStream){$manifestStream.Dispose()};if($null-ne$packageStream){$packageStream.Dispose()};throw}
 }
 
@@ -851,6 +905,7 @@ if ($packageBound) {
     if ([string]::IsNullOrWhiteSpace($PackagePath) -or [string]::IsNullOrWhiteSpace($PackageManifestPath) -or [string]::IsNullOrWhiteSpace($ExpectedPackageSha256) -or [string]::IsNullOrWhiteSpace($ExpectedPackageManifestSha256) -or [string]::IsNullOrWhiteSpace($ExpectedVersion) -or [string]::IsNullOrWhiteSpace($ExpectedGitCommit)) { throw 'CCOD_INSTALLER_PACKAGE_INVALID' }
     try {
         $packageSeal = Open-CcodInstallerPackageSeal -PackagePath $PackagePath -PackageManifestPath $PackageManifestPath -ExpectedPackageSha256 $ExpectedPackageSha256 -ExpectedPackageManifestSha256 $ExpectedPackageManifestSha256 -ExpectedVersion $ExpectedVersion -ExpectedGitCommit $ExpectedGitCommit
+        $packageDefender = Invoke-CcodSetupPackageDefenderGate -PackagePath ([string]$packageSeal.PackagePath)
         $packageAppRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-activation-package-' + [guid]::NewGuid().ToString('N'))
         [IO.Directory]::CreateDirectory((Join-Path $packageAppRoot 'payload')) | Out-Null
         $PayloadRoot = Join-Path (Join-Path $packageAppRoot 'payload') $ExpectedVersion
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e28d9b1..81dec8a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,7 @@ No unreleased changes.
 - Rejected hard-linked install leaves before writes and added independent Setup PE/provenance validation for version, commit, and the activation payload-manifest hash.
 - Added bounded same-root process-tree rereads while preserving strict root and per-process identity checks during close and remote rebind.
 - Correlated native tray actions with the acknowledged presentation revision and durable, bounded terminal diagnostics; stale actions now produce a sanitized support code.
+- Made v2.5.22 candidate promotion require two distinct InternetDownload Defender receipts for the exact Setup and portable ZIP identities; workflow-artifact evidence cannot substitute.
 
 ### 简体中文
 
@@ -21,6 +22,7 @@ No unreleased changes.
 - 在写入前拒绝安装目录中的硬链接叶子，并独立校验 Setup PE/构建 provenance 所绑定的版本、commit 与激活 payload-manifest 哈希。
 - 为同一根进程加入有界 process-tree 重读，同时在关闭和远程重绑定时继续严格校验根进程与每个成员的身份。
 - 将原生托盘操作绑定到已确认的 presentation revision 和持久、有界的终态诊断；过期操作会记录清理后的支持代码。
+- v2.5.22 候选版本只有在精确 Setup 与便携 ZIP 分别具备不同的 InternetDownload Defender 收据后才能提升；工作流产物证据不能替代它们。
 
 ## v2.5.21
 
diff --git a/Install-CodexRemote-fix.ps1 b/Install-CodexRemote-fix.ps1
index b8c0eef..8b15217 100644
--- a/Install-CodexRemote-fix.ps1
+++ b/Install-CodexRemote-fix.ps1
@@ -62,21 +62,29 @@ function Get-CcodPortableInstallerDetectionKeys {
 function Invoke-CcodPortableInstallerDefenderGate {
     param([Parameter(Mandatory)][string]$PayloadRoot)
     try {
+        $started = [DateTime]::UtcNow
         $status = Get-MpComputerStatus -ErrorAction Stop
-        if ($null -eq $status -or $null -eq $status.PSObject.Properties['AMProductVersion'] -or
-            $null -eq $status.PSObject.Properties['AntivirusSignatureVersion'] -or
+        if ($null -eq $status -or
+            $null -eq $status.PSObject.Properties['AMServiceEnabled'] -or $status.AMServiceEnabled -isnot [bool] -or -not $status.AMServiceEnabled -or
+            $null -eq $status.PSObject.Properties['AntivirusEnabled'] -or $status.AntivirusEnabled -isnot [bool] -or -not $status.AntivirusEnabled -or
+            $null -eq $status.PSObject.Properties['RealTimeProtectionEnabled'] -or $status.RealTimeProtectionEnabled -isnot [bool] -or -not $status.RealTimeProtectionEnabled -or
+            $null -eq $status.PSObject.Properties['AMProductVersion'] -or
             $status.AMProductVersion -isnot [string] -or [string]::IsNullOrWhiteSpace($status.AMProductVersion) -or
+            $null -eq $status.PSObject.Properties['AMEngineVersion'] -or
+            $status.AMEngineVersion -isnot [string] -or [string]::IsNullOrWhiteSpace($status.AMEngineVersion) -or
+            $null -eq $status.PSObject.Properties['AntivirusSignatureVersion'] -or
             $status.AntivirusSignatureVersion -isnot [string] -or [string]::IsNullOrWhiteSpace($status.AntivirusSignatureVersion) -or
-            $null -eq $status.PSObject.Properties['RealTimeProtectionEnabled'] -or $status.RealTimeProtectionEnabled -isnot [bool] -or
-            -not $status.RealTimeProtectionEnabled) {
-            throw 'Defender status is incomplete or real-time protection is not enabled.'
+            $null -eq $status.PSObject.Properties['AntivirusSignatureLastUpdated'] -or $status.AntivirusSignatureLastUpdated -isnot [datetime]) {
+            throw 'Defender status is incomplete or protection is not enabled.'
         }
+        $signatureUpdated = ([datetime]$status.AntivirusSignatureLastUpdated).ToUniversalTime()
+        if ($signatureUpdated -lt $started.AddHours(-72) -or $signatureUpdated -gt $started.AddMinutes(5)) { throw 'Defender signature timestamp is stale or future-dated.' }
         $before = Get-CcodPortableInstallerDetectionKeys -Records @(Get-MpThreatDetection -ErrorAction Stop)
-        $started = [DateTime]::UtcNow
         $scanError = $null
         try { Start-MpScan -ScanType CustomScan -ScanPath $PayloadRoot -ErrorAction Stop }
         catch { $scanError = $_ }
         $completed = [DateTime]::UtcNow
+        if ($completed -lt $started -or $completed -gt $started.AddHours(2)) { throw 'Defender scan clock is reversed or exceeds the two-hour bound.' }
         $after = Get-CcodPortableInstallerDetectionKeys -Records @(Get-MpThreatDetection -ErrorAction Stop)
         $newDetections = @($after | Where-Object { -not $before.Contains($_) })
         if ($null -ne $scanError) {
@@ -89,10 +97,16 @@ function Invoke-CcodPortableInstallerDefenderGate {
             Throw-CcodPortableInstallerError 'CCOD_PORTABLE_DEFENDER_DETECTIONS_FOUND' 'The portable payload disappeared during its Defender scan.' $PayloadRoot
         }
         return [pscustomobject][ordered]@{
+            defenderServiceEnabled = $true
+            antivirusEnabled = $true
+            realTimeProtectionEnabled = $true
             defenderPlatformVersion = [string]$status.AMProductVersion
+            defenderEngineVersion = [string]$status.AMEngineVersion
             signatureVersion = [string]$status.AntivirusSignatureVersion
+            signatureUpdatedAtUtc = $signatureUpdated.ToString('o',[Globalization.CultureInfo]::InvariantCulture)
             scanStartedAtUtc = $started.ToString('o',[Globalization.CultureInfo]::InvariantCulture)
             scanCompletedAtUtc = $completed.ToString('o',[Globalization.CultureInfo]::InvariantCulture)
+            detectionCount = 0
         }
     } catch {
         if ($_.FullyQualifiedErrorId -match '^CCOD_PORTABLE_') { throw }
diff --git a/README.md b/README.md
index 838f510..1b76257 100644
--- a/README.md
+++ b/README.md
@@ -50,14 +50,13 @@ that existing page and leaves the Codex UI, account authorization, and enrollmen
 ## Quick start
 
 
-1. Download either `CodexRemote-fix-2.5.22-setup.exe` (recommended installer) or `CodexRemote-fix-2.5.22-windows-x64.zip` from [Releases](https://github.com/naipi11/CodexRemote-fix/releases). Download and verify the matching `.sha256.txt` before continuing.
+1. When the v2.5.22 candidate assets are available on [Releases](https://github.com/naipi11/CodexRemote-fix/releases), download either `CodexRemote-fix-2.5.22-setup.exe` (recommended installer) or `CodexRemote-fix-2.5.22-windows-x64.zip`. Download and verify the matching `.sha256.txt` before continuing.
 2. If you chose the setup installer, run it and follow the wizard. If you chose the portable ZIP, extract it into a new empty folder and double-click `CodexRemote-fix.exe`.
 
    Both paths validate the payload, run a Microsoft Defender custom scan, and preserve the DPAPI device-key store.
 3. The tray supervisor starts automatically. When the connection reports **Connected**, open **Settings → Connections → Control other devices** to enroll or use the device. Windows 10 users should ensure that .NET Framework 4.8 is installed for the native TrayHost.
 
-The current portable bundle, checksum, release manifest, and payload manifest are always published on the
-[Releases](https://github.com/naipi11/CodexRemote-fix/releases) page.
+Use the [Releases](https://github.com/naipi11/CodexRemote-fix/releases) page only after the candidate's exact asset set and checksums have been posted.
 
 Before replacing a portable build, use its installed `Uninstall-CodexControlOtherDevices.ps1`;
 settings and the DPAPI device-key store stay in place.
@@ -86,12 +85,26 @@ The tray reports two independent, truthful status lines instead of inferring rea
 
 ## Releases
 
-Every tagged release ships a Windows setup installer and an EXE-entry portable ZIP with separate SHA-256 checksums and release manifests. The portable distribution publishes its payload manifest as an asset; Setup embeds and hash-binds its versioned `installer-payload.manifest.json`. For v2.5.22, download:
+The v2.5.22 candidate has an exact 11-file public asset contract. Defender scan receipts are acceptance evidence and are not public assets.
 
-- `CodexRemote-fix-2.5.22-setup.exe` and its checksum
-- `CodexRemote-fix-2.5.22-windows-x64.zip` and its checksum
+<details>
+<summary>Exact 11-file candidate asset contract</summary>
+
+- `CodexRemote-fix-2.5.22-windows-x64.zip`
+- `CodexRemote-fix-2.5.22-windows-x64.zip.sha256.txt`
+- `CodexRemote-fix-2.5.22-trayhost-provenance.json`
 - `CodexRemote-fix-2.5.22-payload-manifest.json`
-- `CodexRemote-fix-2.5.22-release-manifest.json` and `CodexRemote-fix-2.5.22-setup-release-manifest.json`
+- `CodexRemote-fix-2.5.22-release-manifest.json`
+- `CodexRemote-fix-2.5.22-setup.exe`
+- `CodexRemote-fix-2.5.22-setup.exe.sha256.txt`
+- `CodexRemote-fix-2.5.22-setup-provenance.json`
+- `CodexRemote-fix-2.5.22-setup-payload-manifest.json`
+- `CodexRemote-fix-2.5.22-setup-destination-inventory.iss`
+- `CodexRemote-fix-2.5.22-setup-release-manifest.json`
+
+</details>
+
+The portable distribution publishes its payload manifest as an asset. Setup embeds and hash-binds its versioned `installer-payload.manifest.json`.
 
 Each release appends a short English change summary to the GitHub release body. The bilingual release history is kept in [CHANGELOG.md](CHANGELOG.md).
 
diff --git a/README.zh-CN.md b/README.zh-CN.md
index ba6c6fe..93de331 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -46,19 +46,19 @@ CodexRemote-fix 在 Windows 版 Codex Desktop 中启用随应用一起打包、
 
 ## 快速开始
 
-1. 从 [Releases](https://github.com/naipi11/CodexRemote-fix/releases) 下载 `CodexRemote-fix-2.5.22-setup.exe`（推荐安装包）或便携 ZIP `CodexRemote-fix-2.5.22-windows-x64.zip`；下载并核对对应的 `.sha256.txt`。
+1. 当 v2.5.22 候选资产已出现在 [Releases](https://github.com/naipi11/CodexRemote-fix/releases) 页面时，下载 `CodexRemote-fix-2.5.22-setup.exe`（推荐安装包）或便携 ZIP `CodexRemote-fix-2.5.22-windows-x64.zip`；下载并核对对应的 `.sha256.txt`。
 2. 选择安装包时直接运行并跟随向导；选择便携 ZIP 时解压到新空目录，然后双击 `CodexRemote-fix.exe`。
 
    两条路径都会校验载荷、执行 Microsoft Defender 自定义扫描，并保留 DPAPI 设备密钥。
 3. 托盘守护程序会自动启动。连接状态显示 **已连接** 后，打开 **设置 → 连接 → 控制其他设备** 即可注册或使用。Windows 10 用户请确认已安装 .NET Framework 4.8，原生 TrayHost 需要该组件。
 
-当前便携 ZIP、SHA-256、release manifest 与 payload manifest 始终发布在
-[Releases](https://github.com/naipi11/CodexRemote-fix/releases) 页面。
+仅在候选版本的精确资产集合与校验值已经发布后，才从
+[Releases](https://github.com/naipi11/CodexRemote-fix/releases) 页面获取文件。
 
 替换便携版本前，请先运行已安装的 `Uninstall-CodexControlOtherDevices.ps1`；设置和 DPAPI 设备密钥会保留。
 
-已验证：Windows 11 · Codex Desktop `26.820.7780.0` · Node.js `22.23.1`；
-隐藏的控制器标签、重启并修复流程以及常驻远程连接均可用。
+历史开发检查使用 Windows 11、Codex Desktop `26.820.7780.0` 与 Node.js `22.23.1`；
+这些记录不构成当前 v2.5.22 的实机验收。
 
 ## 日常使用
 
@@ -81,12 +81,26 @@ CodexRemote-fix 在 Windows 版 Codex Desktop 中启用随应用一起打包、
 
 ## 发布（Releases）
 
-每个带 tag 的发布都会附带 Windows 安装包和以 EXE 启动的便携 ZIP，并分别提供 SHA-256 校验文件与 release manifest。便携发行版会外发自己的 payload manifest；Setup 则内嵌并以哈希绑定版本化的 `installer-payload.manifest.json`。v2.5.22 提供：
+v2.5.22 候选版本采用精确的 11 文件公开资产契约。Defender 扫描收据仅作为验收证据，不是公开资产。
 
-- `CodexRemote-fix-2.5.22-setup.exe` 及其校验文件
-- `CodexRemote-fix-2.5.22-windows-x64.zip` 及其校验文件
+<details>
+<summary>精确的 11 文件候选资产契约</summary>
+
+- `CodexRemote-fix-2.5.22-windows-x64.zip`
+- `CodexRemote-fix-2.5.22-windows-x64.zip.sha256.txt`
+- `CodexRemote-fix-2.5.22-trayhost-provenance.json`
 - `CodexRemote-fix-2.5.22-payload-manifest.json`
-- `CodexRemote-fix-2.5.22-release-manifest.json` 和 `CodexRemote-fix-2.5.22-setup-release-manifest.json`
+- `CodexRemote-fix-2.5.22-release-manifest.json`
+- `CodexRemote-fix-2.5.22-setup.exe`
+- `CodexRemote-fix-2.5.22-setup.exe.sha256.txt`
+- `CodexRemote-fix-2.5.22-setup-provenance.json`
+- `CodexRemote-fix-2.5.22-setup-payload-manifest.json`
+- `CodexRemote-fix-2.5.22-setup-destination-inventory.iss`
+- `CodexRemote-fix-2.5.22-setup-release-manifest.json`
+
+</details>
+
+便携发行版会外发自己的 payload manifest；Setup 则内嵌并以哈希绑定版本化的 `installer-payload.manifest.json`。
 
 GitHub Release 正文只发布英文更新说明；本 README 继续保留中英文使用说明。
 完整历史见 [CHANGELOG.md](CHANGELOG.md)。
diff --git a/build/build.ps1 b/build/build.ps1
index 8690e35..13b4b06 100644
--- a/build/build.ps1
+++ b/build/build.ps1
@@ -338,6 +338,11 @@ $Version = $Version.TrimStart('v')
 if ($Version -notmatch '^\d+\.\d+\.\d+$') { throw "Invalid project version for the portable bundle: $Version" }
 if ($Version -cne $packageVersion) { throw "Requested release version $Version does not match package.json version $packageVersion" }
 Assert-CcodBuildCleanCheckout -RepositoryRoot $repoRoot
+$releaseAssetContractPath = Join-Path $repoRoot 'tools\ReleaseAssetContract.psm1'
+if (-not [IO.File]::Exists($releaseAssetContractPath)) { throw "Release asset contract is missing: $releaseAssetContractPath" }
+Import-Module $releaseAssetContractPath -Force -ErrorAction Stop
+$releaseAssetNames = @(Get-CcodExpectedReleaseAssetNames -Version $Version)
+if ($releaseAssetNames.Count -ne 11) { throw 'Release asset contract did not return exactly eleven ordered names.' }
 $gitCommit = Get-CcodBuildGitCommit -RepositoryRoot $repoRoot
 $buildTimestampUtc = [DateTime]::UtcNow.ToString('o',[Globalization.CultureInfo]::InvariantCulture)
 
@@ -351,17 +356,17 @@ if ($UseExistingTrayHost) {
 
 $dist = Join-Path $PSScriptRoot 'dist'
 [IO.Directory]::CreateDirectory($dist) | Out-Null
-$bundle = Join-Path $dist "CodexRemote-fix-$Version-windows-x64.zip"
-$checksum = "$bundle.sha256.txt"
-$provenance = Join-Path $dist "CodexRemote-fix-$Version-trayhost-provenance.json"
-$payloadManifestAsset = Join-Path $dist "CodexRemote-fix-$Version-payload-manifest.json"
-$releaseManifest = Join-Path $dist "CodexRemote-fix-$Version-release-manifest.json"
-$setupExe = Join-Path $dist "CodexRemote-fix-$Version-setup.exe"
-$setupChecksum = "$setupExe.sha256.txt"
-$setupProvenance = Join-Path $dist "CodexRemote-fix-$Version-setup-provenance.json"
-$setupPayloadInput = Join-Path $dist "CodexRemote-fix-$Version-setup-payload-manifest.json"
-$setupInventoryInput = Join-Path $dist "CodexRemote-fix-$Version-setup-destination-inventory.iss"
-$setupReleaseManifest = Join-Path $dist "CodexRemote-fix-$Version-setup-release-manifest.json"
+$bundle = Join-Path $dist $releaseAssetNames[0]
+$checksum = Join-Path $dist $releaseAssetNames[1]
+$provenance = Join-Path $dist $releaseAssetNames[2]
+$payloadManifestAsset = Join-Path $dist $releaseAssetNames[3]
+$releaseManifest = Join-Path $dist $releaseAssetNames[4]
+$setupExe = Join-Path $dist $releaseAssetNames[5]
+$setupChecksum = Join-Path $dist $releaseAssetNames[6]
+$setupProvenance = Join-Path $dist $releaseAssetNames[7]
+$setupPayloadInput = Join-Path $dist $releaseAssetNames[8]
+$setupInventoryInput = Join-Path $dist $releaseAssetNames[9]
+$setupReleaseManifest = Join-Path $dist $releaseAssetNames[10]
 foreach ($path in @($bundle,$checksum,$provenance,$payloadManifestAsset,$releaseManifest,$setupExe,$setupChecksum,$setupProvenance,$setupPayloadInput,$setupInventoryInput,$setupReleaseManifest)) {
     if ([IO.File]::Exists($path) -or [IO.Directory]::Exists($path)) { throw "Refusing to overwrite immutable release output: $path" }
 }
@@ -556,6 +561,7 @@ $setupRecord = [ordered]@{
 }
 Write-CcodBuildUtf8 -Path $setupReleaseManifest -Text (($setupRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine)
 Test-CcodReleaseAssetManifest -ManifestPath $setupReleaseManifest -AssetDirectory $dist -ExpectedVersion $Version | Out-Null
+Test-CcodExactReleaseAssetSet -AssetDirectory $dist -Version $Version | Out-Null
 
 Write-Host ''
 Write-Host 'Installer build completed:' -ForegroundColor Green
diff --git a/tests/Validate.ps1 b/tests/Validate.ps1
index 7e62d03..3acedc3 100644
--- a/tests/Validate.ps1
+++ b/tests/Validate.ps1
@@ -148,6 +148,7 @@ foreach ($required in @(
     'tests\persistence\UninstallBootstrap.SelfTest.ps1',
     'tests\persistence\InstalledLifecycleHarness.SelfTest.ps1',
     'tests\persistence\ReleaseWorkflow.SelfTest.ps1',
+    'tools\ReleaseAssetContract.psm1',
     'tools\Test-ReleaseDefender.ps1',
     'tests\persistence\WorkerRuntime.SelfTest.ps1'
 )) {
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index 4349c49..89a7146 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -3774,8 +3774,8 @@ $results += Invoke-CcodTest 'installer exposes CodexRemote-fix as the searchable
     Assert-CcodEqual 4 @($lines | Where-Object { $_ -cmatch '^Source: .*Flags: dontcopy$' }).Count 'Setup carries only four sealed temporary inputs'
 
     $buildScript = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\build.ps1') -Raw
-    Assert-CcodTrue ($buildScript -cmatch 'CodexRemote-fix-\$Version-windows-x64\.zip') 'build script locates the public portable ZIP filename'
-    Assert-CcodTrue ($buildScript -cmatch '\$bundle\.sha256\.txt') 'build script writes a hash beside the public portable ZIP filename'
+    Assert-CcodTrue ($buildScript -cmatch 'ReleaseAssetContract\.psm1' -and $buildScript -cmatch '\$bundle\s*=\s*Join-Path\s+\$dist\s+\$releaseAssetNames\[0\]') 'build script locates the public portable ZIP through the central contract'
+    Assert-CcodTrue ($buildScript -cmatch '\$checksum\s*=\s*Join-Path\s+\$dist\s+\$releaseAssetNames\[1\]') 'build script locates the public ZIP checksum through the central contract'
 }
 
 $results += Invoke-CcodTest 'portable builder publishes the exact CodexRemote-fix 2.5.22 release artifact contract' {
@@ -3783,8 +3783,8 @@ $results += Invoke-CcodTest 'portable builder publishes the exact CodexRemote-fi
     Assert-CcodEqual '2.5.22' ([string]$package.version) 'package version is exactly 2.5.22'
 
     $buildScript = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\build.ps1') -Raw
-    Assert-CcodTrue ($buildScript -cmatch 'CodexRemote-fix-\$Version-windows-x64\.zip') 'portable build resolves the exact public ZIP filename'
-    Assert-CcodTrue ($buildScript -cmatch 'CodexRemote-fix-\$Version-payload-manifest\.json') 'portable build publishes a separately bound payload manifest'
+    Assert-CcodTrue ($buildScript -cmatch '\$bundle\s*=\s*Join-Path\s+\$dist\s+\$releaseAssetNames\[0\]') 'portable build resolves the exact public ZIP through the central contract'
+    Assert-CcodTrue ($buildScript -cmatch '\$payloadManifestAsset\s*=\s*Join-Path\s+\$dist\s+\$releaseAssetNames\[3\]') 'portable build publishes the separately bound payload manifest through the central contract'
     Assert-CcodTrue ($buildScript -cmatch 'schemaVersion = 2') 'portable build writes a schema-two release manifest'
     Assert-CcodTrue ($buildScript -cmatch "distribution = 'portable-zip'") 'portable build labels the release distribution explicitly'
 }
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index d6f0e61..f1ee7d3 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -3,6 +3,9 @@ $ErrorActionPreference = 'Stop'
 
 $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
 $defenderPath = Join-Path $repositoryRoot 'tools\Test-ReleaseDefender.ps1'
+$assetContractPath = Join-Path $repositoryRoot 'tools\ReleaseAssetContract.psm1'
+
+function Invoke-CcodTask5Test([string]$Id,[string]$Name,[scriptblock]$Action){if(-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK5_RED_CASE)-and$env:CCOD_TASK5_RED_CASE-cne$Id){return};Invoke-CcodTest $Name $Action}
 
 function ConvertFrom-CcodWorkflowScalar {
     param([Parameter(Mandatory)][AllowEmptyString()][string]$Value)
@@ -264,6 +267,95 @@ function New-CcodPortableReleaseFixture {
     return [pscustomobject]@{Root=$root;Bundle=$bundle;Checksum=$checksum;PayloadManifest=$payloadAsset;Manifest=$manifest}
 }
 
+function Get-CcodTask5ExpectedAssetNames([string]$Version='2.5.22'){
+    @(
+        "CodexRemote-fix-$Version-windows-x64.zip",
+        "CodexRemote-fix-$Version-windows-x64.zip.sha256.txt",
+        "CodexRemote-fix-$Version-trayhost-provenance.json",
+        "CodexRemote-fix-$Version-payload-manifest.json",
+        "CodexRemote-fix-$Version-release-manifest.json",
+        "CodexRemote-fix-$Version-setup.exe",
+        "CodexRemote-fix-$Version-setup.exe.sha256.txt",
+        "CodexRemote-fix-$Version-setup-provenance.json",
+        "CodexRemote-fix-$Version-setup-payload-manifest.json",
+        "CodexRemote-fix-$Version-setup-destination-inventory.iss",
+        "CodexRemote-fix-$Version-setup-release-manifest.json"
+    )
+}
+
+function New-CcodTask5ExactAssetFixture {
+    $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task5-assets-'+[guid]::NewGuid().ToString('N'));$outside=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task5-assets-outside-'+[guid]::NewGuid().ToString('N'));[IO.Directory]::CreateDirectory($root)|Out-Null;[IO.Directory]::CreateDirectory($outside)|Out-Null
+    $version='2.5.22';$commit='c'*40;$timestamp='2030-02-03T04:05:06.0000000Z';$names=Get-CcodTask5ExpectedAssetNames $version
+    $stage=Join-Path $root '.stage';$payload=Join-Path $stage 'payload';[IO.Directory]::CreateDirectory($payload)|Out-Null
+    [IO.File]::WriteAllText((Join-Path $stage 'Install-CodexRemote-fix.ps1'),'Write-Output portable',[Text.UTF8Encoding]::new($false));[IO.File]::WriteAllBytes((Join-Path $stage 'CodexRemote-fix.exe'),[byte[]](1,2,3,4));[IO.File]::WriteAllText((Join-Path $stage 'CodexRemote-fix.exe.config'),'<configuration/>',[Text.UTF8Encoding]::new($false));[IO.File]::WriteAllText((Join-Path $payload 'hello.txt'),'payload',[Text.UTF8Encoding]::new($false))
+    $payloadFile=Join-Path $payload 'hello.txt';$payloadRecord=[ordered]@{path='hello.txt';length=[int64](Get-Item $payloadFile).Length;sha256=Get-CcodTestFileSha256 $payloadFile};$payloadManifest=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;files=@($payloadRecord)}
+    [IO.File]::WriteAllText((Join-Path $stage 'payload-manifest.json'),($payloadManifest|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false));Add-Type -AssemblyName System.IO.Compression.FileSystem -ErrorAction Stop;[IO.Compression.ZipFile]::CreateFromDirectory($stage,(Join-Path $root $names[0]),[IO.Compression.CompressionLevel]::Optimal,$false);Remove-Item -LiteralPath $stage -Recurse -Force
+    [IO.File]::WriteAllText((Join-Path $root $names[1]),((Get-CcodTestFileSha256 (Join-Path $root $names[0]))+' *'+$names[0]),[Text.UTF8Encoding]::new($false))
+    [IO.File]::WriteAllText((Join-Path $root $names[2]),([ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp}|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
+    [IO.File]::WriteAllText((Join-Path $root $names[3]),($payloadManifest|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+    [IO.File]::WriteAllText((Join-Path $root $names[5]),'setup-bytes',[Text.UTF8Encoding]::new($false));[IO.File]::WriteAllText((Join-Path $root $names[6]),((Get-CcodTestFileSha256 (Join-Path $root $names[5]))+' *'+$names[5]),[Text.UTF8Encoding]::new($false))
+    [IO.File]::WriteAllText((Join-Path $root $names[7]),([ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;payloadManifest=[ordered]@{name='installer-payload.manifest.json';sha256=('d'*64)}}|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+    [IO.File]::WriteAllText((Join-Path $root $names[8]),([ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;payloadManifest=[ordered]@{name='installer-payload.manifest.json';sha256=('d'*64)};files=@([ordered]@{path='package.json';length=[int64]1;sha256=('e'*64)})}|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false));[IO.File]::WriteAllText((Join-Path $root $names[9]),"procedure AddCcodExpectedSetupDirectories(Directories: TStrings);`r`nbegin`r`nend;`r`n",[Text.UTF8Encoding]::new($false))
+    $portableAssets=@([ordered]@{name=$names[0];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[0])},[ordered]@{name=$names[1];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[1])},[ordered]@{name=$names[2];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[2])},[ordered]@{name=$names[3];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[3])},[ordered]@{name='CodexRemote-fix.exe';sha256=('1'*64)},[ordered]@{name='CodexRemote-fix.exe.config';sha256=('2'*64)})
+    [IO.File]::WriteAllText((Join-Path $root $names[4]),([ordered]@{schemaVersion=2;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;distribution='portable-zip';assets=$portableAssets}|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+    $setupAssets=@([ordered]@{name=$names[5];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[5])},[ordered]@{name=$names[6];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[6])},[ordered]@{name=$names[2];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[2])},[ordered]@{name=$names[7];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[7])},[ordered]@{name=$names[8];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[8])},[ordered]@{name=$names[9];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[9])})
+    [IO.File]::WriteAllText((Join-Path $root $names[10]),([ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;assets=$setupAssets}|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+    [pscustomobject]@{Root=$root;OriginalRoot=$root;Outside=$outside;Names=$names;Version=$version;GitCommit=$commit;Timestamp=$timestamp}
+}
+
+function Remove-CcodTask5ExactAssetFixture($Fixture){foreach($path in @($Fixture.Root,$Fixture.OriginalRoot,$Fixture.Outside)){if([string]::IsNullOrWhiteSpace([string]$path)){continue};$full=[IO.Path]::GetFullPath([string]$path);$temp=[IO.Path]::GetFullPath([IO.Path]::GetTempPath()).TrimEnd('\')+'\';if(-not$full.StartsWith($temp,[StringComparison]::OrdinalIgnoreCase)){throw 'refusing non-temp asset fixture cleanup'};if(Test-Path -LiteralPath $full){Remove-Item -LiteralPath $full -Recurse -Force}}}
+
+function New-CcodTask5DefenderStatus {
+    [pscustomobject][ordered]@{AMServiceEnabled=$true;AntivirusEnabled=$true;RealTimeProtectionEnabled=$true;AMProductVersion='4.18.26070.1';AMEngineVersion='1.1.26070.1';AntivirusSignatureVersion='1.999.1.0';AntivirusSignatureLastUpdated=[datetime]::Parse('2030-02-03T02:05:06Z').ToUniversalTime()}
+}
+
+function New-CcodTask5DefenderAdapterFixture {
+    param($Status=(New-CcodTask5DefenderStatus),[datetime]$Started=([datetime]::Parse('2030-02-03T04:05:06Z').ToUniversalTime()),$Completed=([datetime]::Parse('2030-02-03T04:05:07Z').ToUniversalTime()),[switch]$ScanThrows,[switch]$Detects,[switch]$WriteThrows)
+    $state=[pscustomobject]@{Capture=$null;Clock=0;Threat=0;Calls=[Collections.Generic.List[string]]::new()}
+    $adapters=@{
+        GetFileSha256={param($Path)$state.Calls.Add('Hash');Get-CcodTestFileSha256 $Path}.GetNewClosure()
+        GetDefenderStatus={ $state.Calls.Add('Status');$Status }.GetNewClosure()
+        StartCustomScan={param($Path)$state.Calls.Add('Scan');if($ScanThrows){throw 'fixture scan failure'}}.GetNewClosure()
+        GetThreatDetections={$state.Calls.Add('Threat');$state.Threat++;if($Detects-and$state.Threat-gt1){@([pscustomobject]@{ThreatID=99;InitialDetectionTime='2030-02-03T04:05:06.0000000Z';Resources=@('redacted')})}else{@()}}.GetNewClosure()
+        GetUtcNow={$state.Calls.Add('Clock');$state.Clock++;if($state.Clock-eq1){$Started}else{$Completed}}.GetNewClosure()
+        WriteReceipt={param($Path,$Receipt)$state.Calls.Add('Write');if($WriteThrows){throw 'fixture evidence write failure'};$state.Capture=(($Receipt|ConvertTo-Json -Depth 12 -Compress)|ConvertFrom-Json);$Path}.GetNewClosure()
+    }
+    [pscustomobject]@{Adapters=$adapters;State=$state}
+}
+
+function New-CcodTask5WorkflowIdentity([string]$Commit=('a'*40)){
+    [pscustomobject][ordered]@{provider='GitHubActions';repository='naipi11/CodexRemote-fix';runId=[uint64]123;runAttempt=[uint64]2;artifactId=[uint64]456;artifactName='CodexRemote-fix portable bundle';artifactDigest=('sha256:'+('9'*64));gitCommit=$Commit}
+}
+
+function New-CcodTask5DefenderReceipt {
+    param([ValidateSet('Setup','PortableZip')][string]$AssetType='Setup',[string]$Version='2.5.22',[string]$Commit=('c'*40),[ValidateSet('InternetDownload','TrustedWorkflowArtifact')][string]$Origin='InternetDownload')
+    $names=Get-CcodTask5ExpectedAssetNames $Version;$setup=$AssetType-ceq'Setup'
+    [pscustomobject][ordered]@{schemaVersion=2;assetType=$AssetType;assetName=$(if($setup){$names[5]}else{$names[0]});assetSha256=$(if($setup){'5'*64}else{'0'*64});checksumName=$(if($setup){$names[6]}else{$names[1]});checksumSha256=$(if($setup){'6'*64}else{'1'*64});manifestName=$(if($setup){$names[10]}else{$names[4]});manifestSha256=$(if($setup){'a'*64}else{'4'*64});version=$Version;gitCommit=$Commit;origin=$Origin;workflowArtifactIdentity=$(if($Origin-ceq'TrustedWorkflowArtifact'){New-CcodTask5WorkflowIdentity $Commit}else{$null});zoneId=$(if($Origin-ceq'InternetDownload'){3}else{$null});defenderServiceEnabled=$true;antivirusEnabled=$true;realTimeProtectionEnabled=$true;defenderPlatformVersion='4.18.26070.1';defenderEngineVersion='1.1.26070.1';signatureVersion='1.999.1.0';signatureUpdatedAtUtc='2030-02-03T02:05:06.0000000Z';scanStartedAtUtc='2030-02-03T04:05:06.0000000Z';scanCompletedAtUtc='2030-02-03T04:05:07.0000000Z';detectionCount=0;outcome='Completed';errorCode=$null}
+}
+
+function Get-CcodTask5PromotionReceiptNames([string]$Version='2.5.22'){
+    @("CodexRemote-fix-$Version-setup.internet-download.defender.json","CodexRemote-fix-$Version-windows-x64.internet-download.defender.json")
+}
+
+function Write-CcodTask5Json {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)]$Value)
+    [IO.File]::WriteAllText($Path,(($Value|ConvertTo-Json -Depth 12)+[Environment]::NewLine),[Text.UTF8Encoding]::new($false))
+}
+
+function New-CcodTask5PromotionFixture {
+    param([Parameter(Mandatory)]$AssetFixture)
+    $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task5-promotion-'+[guid]::NewGuid().ToString('N'))
+    [IO.Directory]::CreateDirectory($root)|Out-Null
+    $names=Get-CcodTask5PromotionReceiptNames
+    $setup=New-CcodTask5DefenderReceipt -AssetType Setup
+    $portable=New-CcodTask5DefenderReceipt -AssetType PortableZip
+    $setup.assetSha256=Get-CcodTestFileSha256 (Join-Path $AssetFixture.Root $AssetFixture.Names[5]);$setup.checksumSha256=Get-CcodTestFileSha256 (Join-Path $AssetFixture.Root $AssetFixture.Names[6]);$setup.manifestSha256=Get-CcodTestFileSha256 (Join-Path $AssetFixture.Root $AssetFixture.Names[10])
+    $portable.assetSha256=Get-CcodTestFileSha256 (Join-Path $AssetFixture.Root $AssetFixture.Names[0]);$portable.checksumSha256=Get-CcodTestFileSha256 (Join-Path $AssetFixture.Root $AssetFixture.Names[1]);$portable.manifestSha256=Get-CcodTestFileSha256 (Join-Path $AssetFixture.Root $AssetFixture.Names[4])
+    Write-CcodTask5Json -Path (Join-Path $root $names[0]) -Value $setup
+    Write-CcodTask5Json -Path (Join-Path $root $names[1]) -Value $portable
+    [pscustomobject]@{Root=$root;Names=$names;Setup=$setup;Portable=$portable;Commit=('c'*40);Version='2.5.22'}
+}
+
 function Get-CcodReadOnlyProductTreeSnapshot {
     param(
         [Parameter(Mandatory)][string]$Root,
@@ -304,6 +396,106 @@ function Get-CcodReadOnlyProductTreeSnapshot {
     return [pscustomobject][ordered]@{root=$full;exists=$true;rootAttributes=[int]$rootItem.Attributes;rootCreationTimeUtc=$rootItem.CreationTimeUtc.ToString('o',[Globalization.CultureInfo]::InvariantCulture);rootLastWriteTimeUtc=$rootItem.LastWriteTimeUtc.ToString('o',[Globalization.CultureInfo]::InvariantCulture);entryCount=$records.Count;totalBytes=$total;records=@($records)}
 }
 
+Invoke-CcodTask5Test 'assets' 'release asset contract owns the exact ordered eleven-name set and rejects every mutation' {
+    Assert-CcodTrue (Test-Path -LiteralPath $assetContractPath -PathType Leaf) 'central release asset contract module exists'
+    $assetModule=Import-Module $assetContractPath -Force -PassThru -DisableNameChecking
+    try{
+        $expected=Get-CcodTask5ExpectedAssetNames '2.5.22';$actual=@(Get-CcodExpectedReleaseAssetNames -Version '2.5.22')
+        Assert-CcodEqual ($expected-join'|') ($actual-join'|') 'asset contract returns the literal ordered eleven-name set'
+        $baseline=New-CcodTask5ExactAssetFixture
+        try{$validated=Test-CcodExactReleaseAssetSet -AssetDirectory $baseline.Root -Version $baseline.Version;Assert-CcodEqual $baseline.GitCommit ([string]$validated.GitCommit) 'exact set returns the common 40-hex commit';Assert-CcodEqual $baseline.Timestamp ([string]$validated.BuildTimestampUtc) 'exact set returns the common timestamp';Assert-CcodEqual ($expected-join'|') ((@($validated.Assets.name))-join'|') 'exact set returns all public hashes in contract order'}finally{Remove-CcodTask5ExactAssetFixture $baseline}
+        foreach($missing in $expected){$fixture=New-CcodTask5ExactAssetFixture;try{Remove-Item -LiteralPath (Join-Path $fixture.Root $missing) -Force;Assert-CcodThrows {Test-CcodExactReleaseAssetSet -AssetDirectory $fixture.Root -Version $fixture.Version|Out-Null} 'CCOD_RELEASE_ASSET_SET_INVALID'}finally{Remove-CcodTask5ExactAssetFixture $fixture}}
+        foreach($mutation in @('Extra','CaseVaried','Directory','Reparse','UnsafeAncestry','NoncanonicalRoot','DuplicateTopProperty','DuplicateNestedProperty','DuplicateEscapedProperty','DuplicateManifest','ManifestOrder','CommitMismatch','TimestampMismatch','SharedProvenanceMismatch')){
+            $fixture=New-CcodTask5ExactAssetFixture
+            try{
+                switch($mutation){
+                    'Extra'{[IO.File]::WriteAllText((Join-Path $fixture.Root 'unexpected.txt'),'x',[Text.UTF8Encoding]::new($false))}
+                    'CaseVaried'{$source=Join-Path $fixture.Root $fixture.Names[0];$temporary=$source+'.case';Move-Item -LiteralPath $source -Destination $temporary;Move-Item -LiteralPath $temporary -Destination (Join-Path $fixture.Root $fixture.Names[0].ToUpperInvariant())}
+                    'Directory'{Remove-Item -LiteralPath (Join-Path $fixture.Root $fixture.Names[3]) -Force;[IO.Directory]::CreateDirectory((Join-Path $fixture.Root $fixture.Names[3]))|Out-Null}
+                    'Reparse'{Remove-Item -LiteralPath (Join-Path $fixture.Root $fixture.Names[3]) -Force;$target=Join-Path $fixture.Outside 'target';[IO.Directory]::CreateDirectory($target)|Out-Null;$previous=$ErrorActionPreference;try{$ErrorActionPreference='Continue';$out=&cmd.exe /d /c mklink /J (Join-Path $fixture.Root $fixture.Names[3]) $target 2>&1;$code=$LASTEXITCODE}finally{$ErrorActionPreference=$previous};if($code-ne0){throw "junction fixture failed: $($out-join' ')"}}
+                    'UnsafeAncestry'{$parent=Join-Path $fixture.Outside 'parent';[IO.Directory]::CreateDirectory($parent)|Out-Null;$link=Join-Path $parent 'assets';$previous=$ErrorActionPreference;try{$ErrorActionPreference='Continue';$out=&cmd.exe /d /c mklink /J $link $fixture.Root 2>&1;$code=$LASTEXITCODE}finally{$ErrorActionPreference=$previous};if($code-ne0){throw "ancestry fixture failed: $($out-join' ')"};$fixture.Root=$link}
+                    'NoncanonicalRoot'{$fixture.Root=[string]$fixture.Root+'\.'}
+                    'DuplicateTopProperty'{$manifestPath=Join-Path $fixture.Root $fixture.Names[4];$raw=[IO.File]::ReadAllText($manifestPath);$raw=[regex]::Replace($raw,'"schemaVersion"\s*:\s*2','"schemaVersion": 2, "schemaVersion": 2',1);[IO.File]::WriteAllText($manifestPath,$raw,[Text.UTF8Encoding]::new($false))}
+                    'DuplicateNestedProperty'{$manifestPath=Join-Path $fixture.Root $fixture.Names[4];$raw=[IO.File]::ReadAllText($manifestPath);$raw=[regex]::Replace($raw,'"name"\s*:\s*"([^"]+)"','"name": "$1", "name": "$1"',1);[IO.File]::WriteAllText($manifestPath,$raw,[Text.UTF8Encoding]::new($false))}
+                    'DuplicateEscapedProperty'{$manifestPath=Join-Path $fixture.Root $fixture.Names[4];$raw=[IO.File]::ReadAllText($manifestPath);$raw=[regex]::Replace($raw,'"gitCommit"\s*:\s*"([^"]+)"','"gitCommit": "$1", "\u0067itCommit": "$1"',1);[IO.File]::WriteAllText($manifestPath,$raw,[Text.UTF8Encoding]::new($false))}
+                    default{$manifestPath=Join-Path $fixture.Root $fixture.Names[4];$manifest=[IO.File]::ReadAllText($manifestPath)|ConvertFrom-Json;if($mutation-ceq'DuplicateManifest'){$manifest.assets=@($manifest.assets)+@($manifest.assets[0])}elseif($mutation-ceq'ManifestOrder'){$manifest.assets=@($manifest.assets[1],$manifest.assets[0])+@($manifest.assets|Select-Object -Skip 2)}elseif($mutation-ceq'CommitMismatch'){$manifest.gitCommit='d'*40}elseif($mutation-ceq'TimestampMismatch'){$manifest.buildTimestampUtc='2030-02-03T04:05:07.0000000Z'}else{$entry=@($manifest.assets|Where-Object{$_.name-ceq$fixture.Names[2]})[0];$entry.sha256='f'*64};[IO.File]::WriteAllText($manifestPath,($manifest|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))}
+                }
+                Assert-CcodThrows {Test-CcodExactReleaseAssetSet -AssetDirectory $fixture.Root -Version $fixture.Version|Out-Null} 'CCOD_RELEASE_ASSET_SET_INVALID'
+            }finally{Remove-CcodTask5ExactAssetFixture $fixture}
+        }
+    }finally{if($null-ne$assetModule){Remove-Module -Name $assetModule.Name -Force -ErrorAction SilentlyContinue}}
+}
+
+Invoke-CcodTask5Test 'promotion' 'promotion requires exactly distinct Setup and ZIP Internet-download Defender receipts' {
+    Assert-CcodTrue (Test-Path -LiteralPath $assetContractPath -PathType Leaf) 'central release asset contract module exists for promotion validation'
+    $assetModule=Import-Module $assetContractPath -Force -PassThru -DisableNameChecking
+    $assetFixture=$null
+    try{
+        $assetFixture=New-CcodTask5ExactAssetFixture
+        $baseline=New-CcodTask5PromotionFixture -AssetFixture $assetFixture
+        try{
+            $validated=Test-CcodReleasePromotionEvidence -EvidenceDirectory $baseline.Root -AssetDirectory $assetFixture.Root -Version $baseline.Version -ExpectedGitCommit $baseline.Commit
+            Assert-CcodEqual 'Setup,PortableZip' ((@($validated.Receipts.assetType))-join',') 'promotion returns the two distinct official asset types in contract order'
+            Assert-CcodTrue (@($validated.Receipts|Where-Object{$_.origin-cne'InternetDownload'-or$_.zoneId-ne3}).Count-eq0) 'promotion returns only actual Internet-download receipts'
+        }finally{if(Test-Path $baseline.Root){Remove-Item -LiteralPath $baseline.Root -Recurse -Force}}
+
+        foreach($shape in @('MissingSetup','MissingPortable','Extra','DuplicateSetup','DuplicatePortable','Swapped','ReusedHashes','ForgedTriplet','TrustedSubstitution')){
+            $fixture=New-CcodTask5PromotionFixture -AssetFixture $assetFixture
+            try{
+                $setupPath=Join-Path $fixture.Root $fixture.Names[0];$portablePath=Join-Path $fixture.Root $fixture.Names[1]
+                switch($shape){
+                    'MissingSetup'{Remove-Item -LiteralPath $setupPath -Force}
+                    'MissingPortable'{Remove-Item -LiteralPath $portablePath -Force}
+                    'Extra'{Write-CcodTask5Json -Path (Join-Path $fixture.Root 'unexpected.defender.json') -Value $fixture.Setup}
+                    'DuplicateSetup'{Write-CcodTask5Json -Path $portablePath -Value $fixture.Setup}
+                    'DuplicatePortable'{Write-CcodTask5Json -Path $setupPath -Value $fixture.Portable}
+                    'Swapped'{Write-CcodTask5Json -Path $setupPath -Value $fixture.Portable;Write-CcodTask5Json -Path $portablePath -Value $fixture.Setup}
+                    'ReusedHashes'{$fixture.Portable.assetSha256=$fixture.Setup.assetSha256;$fixture.Portable.checksumSha256=$fixture.Setup.checksumSha256;$fixture.Portable.manifestSha256=$fixture.Setup.manifestSha256;Write-CcodTask5Json -Path $portablePath -Value $fixture.Portable}
+                    'ForgedTriplet'{$fixture.Setup.assetSha256='b'*64;$fixture.Setup.checksumSha256='c'*64;$fixture.Setup.manifestSha256='d'*64;Write-CcodTask5Json -Path $setupPath -Value $fixture.Setup}
+                    'TrustedSubstitution'{$fixture.Setup.origin='TrustedWorkflowArtifact';$fixture.Setup.workflowArtifactIdentity=New-CcodTask5WorkflowIdentity $fixture.Commit;$fixture.Setup.zoneId=$null;Write-CcodTask5Json -Path $setupPath -Value $fixture.Setup}
+                }
+                Assert-CcodThrows {Test-CcodReleasePromotionEvidence -EvidenceDirectory $fixture.Root -AssetDirectory $assetFixture.Root -Version $fixture.Version -ExpectedGitCommit $fixture.Commit|Out-Null} 'CCOD_RELEASE_PROMOTION_EVIDENCE_INVALID'
+            }finally{if(Test-Path $fixture.Root){Remove-Item -LiteralPath $fixture.Root -Recurse -Force}}
+        }
+
+        foreach($field in @('schemaVersion','assetType','assetName','assetSha256','checksumName','checksumSha256','manifestName','manifestSha256','version','gitCommit','origin','workflowArtifactIdentity','zoneId','defenderServiceEnabled','antivirusEnabled','realTimeProtectionEnabled','defenderPlatformVersion','defenderEngineVersion','signatureVersion','signatureUpdatedAtUtc','scanStartedAtUtc','scanCompletedAtUtc','detectionCount','outcome','errorCode')){
+            $fixture=New-CcodTask5PromotionFixture -AssetFixture $assetFixture
+            try{
+                $receipt=$fixture.Setup
+                switch($field){
+                    'schemaVersion'{$receipt.schemaVersion=1}
+                    'assetType'{$receipt.assetType='PortableZip'}
+                    'assetName'{$receipt.assetName='foreign.exe'}
+                    'assetSha256'{$receipt.assetSha256='z'*64}
+                    'checksumName'{$receipt.checksumName='foreign.sha256.txt'}
+                    'checksumSha256'{$receipt.checksumSha256='z'*64}
+                    'manifestName'{$receipt.manifestName='foreign.json'}
+                    'manifestSha256'{$receipt.manifestSha256='z'*64}
+                    'version'{$receipt.version='2.5.21'}
+                    'gitCommit'{$receipt.gitCommit='b'*40}
+                    'origin'{$receipt.origin='TrustedWorkflowArtifact'}
+                    'workflowArtifactIdentity'{$receipt.workflowArtifactIdentity=New-CcodTask5WorkflowIdentity $fixture.Commit}
+                    'zoneId'{$receipt.zoneId=2}
+                    'defenderServiceEnabled'{$receipt.defenderServiceEnabled=$false}
+                    'antivirusEnabled'{$receipt.antivirusEnabled=$false}
+                    'realTimeProtectionEnabled'{$receipt.realTimeProtectionEnabled=$false}
+                    'defenderPlatformVersion'{$receipt.defenderPlatformVersion=''}
+                    'defenderEngineVersion'{$receipt.defenderEngineVersion=''}
+                    'signatureVersion'{$receipt.signatureVersion=''}
+                    'signatureUpdatedAtUtc'{$receipt.signatureUpdatedAtUtc='2030-01-01T00:00:00.0000000Z'}
+                    'scanStartedAtUtc'{$receipt.scanStartedAtUtc='not-a-clock'}
+                    'scanCompletedAtUtc'{$receipt.scanCompletedAtUtc='2030-02-03T04:05:05.0000000Z'}
+                    'detectionCount'{$receipt.detectionCount=1}
+                    'outcome'{$receipt.outcome='Failed'}
+                    'errorCode'{$receipt.errorCode='CCOD_DEFENDER_SCAN_FAILED'}
+                }
+                Write-CcodTask5Json -Path (Join-Path $fixture.Root $fixture.Names[0]) -Value $receipt
+                Assert-CcodThrows {Test-CcodReleasePromotionEvidence -EvidenceDirectory $fixture.Root -AssetDirectory $assetFixture.Root -Version $fixture.Version -ExpectedGitCommit $fixture.Commit|Out-Null} 'CCOD_RELEASE_PROMOTION_EVIDENCE_INVALID'
+            }finally{if(Test-Path $fixture.Root){Remove-Item -LiteralPath $fixture.Root -Recurse -Force}}
+        }
+    }finally{if($null-ne$assetFixture){Remove-CcodTask5ExactAssetFixture $assetFixture};if($null-ne$assetModule){Remove-Module -Name $assetModule.Name -Force -ErrorAction SilentlyContinue}}
+}
+
 Invoke-CcodTest 'release defender tool exposes manifest and scan functions without a live scan' {
     Assert-CcodTrue (Test-Path -LiteralPath $defenderPath -PathType Leaf) 'Defender release gate exists'
     . $defenderPath -Library
@@ -1292,8 +1484,13 @@ Invoke-CcodTest 'temporary bootstrap verifies the sealed package and propagates
         $created = New-CcodInstallerPackage -PayloadRoot $fixture.PayloadRoot -PayloadManifestPath $fixture.ManifestPath -Version '2.5.22' -GitCommit ('d' * 40) -OutputPath $packagePath -ManifestOutputPath $packageManifestPath
         $installRoot = Join-Path $fixture.AppRoot 'installed-state'
         $activationId = '77777777-6666-5555-4444-333333333333'
+        $setupScanObservation=[pscustomobject]@{Path=$null}
+        function Get-MpComputerStatus {[pscustomobject]@{AMServiceEnabled=$true;AntivirusEnabled=$true;RealTimeProtectionEnabled=$true;AMProductVersion='fixture-platform';AMEngineVersion='fixture-engine';AntivirusSignatureVersion='fixture-signature';AntivirusSignatureLastUpdated=[datetime]::UtcNow.AddHours(-1)}}
+        function Get-MpThreatDetection {param($ErrorAction)@()}
+        function Start-MpScan {param($ScanType,$ScanPath,$ErrorAction)$setupScanObservation.Path=[string]$ScanPath}
         $output = @(& (Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1') -InstallRoot $installRoot -PackagePath $packagePath -PackageManifestPath $packageManifestPath -ExpectedPackageSha256 $created.PackageSha256 -ExpectedPackageManifestSha256 $created.ManifestSha256 -ExpectedVersion '2.5.22' -ExpectedGitCommit ('d' * 40) -ActivationId $activationId 2>&1)
         Assert-CcodEqual 0 $LASTEXITCODE "sealed package bootstrap completes: $($output -join ' ')"
+        Assert-CcodEqual ([IO.Path]::GetFullPath($packagePath)) ([string]$setupScanObservation.Path) 'Setup scans the canonical package path returned by the held seal'
         Assert-CcodEqual $created.PackageSha256 ([IO.File]::ReadAllText((Join-Path $installRoot 'sealed-package-sha256.txt'),[Text.UTF8Encoding]::new($false))) 'child receives the exact verified package identity'
         Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $installRoot "state\activation-receipts\$activationId.Ready.json") -PathType Leaf) 'bootstrap accepts only the append-only Ready receipt'
         Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $installRoot 'state\post-install-activation.json'))) 'bootstrap never creates or consumes the mutable legacy receipt'
@@ -1303,6 +1500,41 @@ Invoke-CcodTest 'temporary bootstrap verifies the sealed package and propagates
     }
 }
 
+Invoke-CcodTask5Test 'entrypoints' 'Setup Defender failure occurs after sealing and before temp expansion or activation mutation' {
+    $productionPath=Join-Path $repositoryRoot 'Activate-CcodRemoteFix.ps1'
+    $productionSource=[IO.File]::ReadAllText($productionPath,[Text.UTF8Encoding]::new($false,$true))
+    $needle='$packageDefender = Invoke-CcodSetupPackageDefenderGate -PackagePath ([string]$packageSeal.PackagePath)'
+    Assert-CcodEqual 1 ([regex]::Matches($productionSource,[regex]::Escape($needle)).Count) 'Setup invokes the package Defender gate exactly once from the sealed-package branch'
+    $sealIndex=$productionSource.IndexOf('$packageSeal = Open-CcodInstallerPackageSeal',[StringComparison]::Ordinal)
+    $scanIndex=$productionSource.IndexOf($needle,[StringComparison]::Ordinal)
+    $tempIndex=$productionSource.IndexOf('$packageAppRoot = Join-Path',[StringComparison]::Ordinal)
+    Assert-CcodTrue ($sealIndex-ge0-and$scanIndex-gt$sealIndex-and$tempIndex-gt$scanIndex) 'Setup scan is ordered after exact seal and before the first extraction temp path'
+
+    $fixture=New-CcodActivationPayloadFixture
+    $module=$null
+    try{
+        $packagePath=Join-Path $fixture.AppRoot 'sealed-installer.zip';$packageManifestPath=Join-Path $fixture.AppRoot 'sealed-installer.manifest.json'
+        $module=Import-Module (Join-Path $repositoryRoot 'build\InstallerPackage.psm1') -Force -PassThru
+        $created=New-CcodInstallerPackage -PayloadRoot $fixture.PayloadRoot -PayloadManifestPath $fixture.ManifestPath -Version '2.5.22' -GitCommit ('d'*40) -OutputPath $packagePath -ManifestOutputPath $packageManifestPath
+        $injectedPath=Join-Path $fixture.AppRoot 'Activate-CcodRemoteFix-defender-failure.ps1'
+        $injectedSource=$productionSource.Replace($needle,"throw 'CCOD_SETUP_DEFENDER_SCAN_FAILED'")
+        Assert-CcodTrue ($injectedSource-cne$productionSource) 'test injection replaces only the real Setup Defender call boundary'
+        [IO.File]::WriteAllText($injectedPath,$injectedSource,[Text.UTF8Encoding]::new($false))
+        $installRoot=Join-Path $fixture.AppRoot 'must-remain-absent';$before=Get-CcodReadOnlyProductTreeSnapshot -Root $installRoot
+        $tempRoot=[IO.Path]::GetFullPath([IO.Path]::GetTempPath());$beforeTemps=@(Get-ChildItem -LiteralPath $tempRoot -Directory -Filter 'ccod-activation-package-*' -Force -ErrorAction Stop|ForEach-Object{$_.FullName}|Sort-Object)
+        $output=@(&$injectedPath -InstallRoot $installRoot -PackagePath $packagePath -PackageManifestPath $packageManifestPath -ExpectedPackageSha256 $created.PackageSha256 -ExpectedPackageManifestSha256 $created.ManifestSha256 -ExpectedVersion '2.5.22' -ExpectedGitCommit ('d'*40) -ActivationId '77777777-6666-5555-4444-333333333333' 2>&1)
+        Assert-CcodEqual 3 $LASTEXITCODE "injected sealed-package Defender failure is rejected: $($output-join' ')"
+        Assert-CcodTrue (($output-join"`n")-cmatch'CCOD_SETUP_DEFENDER_SCAN_FAILED') 'Setup preserves the stable scan failure code'
+        $after=Get-CcodReadOnlyProductTreeSnapshot -Root $installRoot
+        Assert-CcodEqual ($before|ConvertTo-Json -Depth 8 -Compress) ($after|ConvertTo-Json -Depth 8 -Compress) 'Setup scan failure creates no Prepared receipt transaction product or worker state'
+        $afterTemps=@(Get-ChildItem -LiteralPath $tempRoot -Directory -Filter 'ccod-activation-package-*' -Force -ErrorAction Stop|ForEach-Object{$_.FullName}|Sort-Object)
+        Assert-CcodEqual ($beforeTemps-join'|') ($afterTemps-join'|') 'Setup scan failure creates no package expansion directory'
+    }finally{
+        if($null-ne$module){Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue}
+        if(Test-Path $fixture.AppRoot){Remove-Item -LiteralPath $fixture.AppRoot -Recurse -Force -ErrorAction SilentlyContinue}
+    }
+}
+
 function Invoke-CcodInnoPayloadCompileFixture {
     param([switch]$IncludePayloadDefines,[switch]$OmitDestinationInventory,[switch]$BindWrongPackageHash,[switch]$UseInertActivationMarker)
 
@@ -2208,56 +2440,69 @@ Invoke-CcodTest 'release manifest binds the TrayHost provenance timestamp to its
     }
 }
 
-Invoke-CcodTest 'Defender gate requires Internet Zone before a custom scan and writes a redacted receipt after a clean scan' {
+Invoke-CcodTask5Test 'defender' 'Defender gate binds exact origins status clocks manifests and a redacted receipt' {
+    . $defenderPath -Library;$fixture=New-CcodReleaseFixture
+    try{
+        Set-Content -LiteralPath $fixture.Installer -Stream Zone.Identifier -Value "[ZoneTransfer]`r`nZoneId=3`r`n" -NoNewline
+        $clean=New-CcodTask5DefenderAdapterFixture;$receipt=Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin InternetDownload -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root 'internet.json') -Adapters $clean.Adapters
+        $fields='schemaVersion,assetType,assetName,assetSha256,checksumName,checksumSha256,manifestName,manifestSha256,version,gitCommit,origin,workflowArtifactIdentity,zoneId,defenderServiceEnabled,antivirusEnabled,realTimeProtectionEnabled,defenderPlatformVersion,defenderEngineVersion,signatureVersion,signatureUpdatedAtUtc,scanStartedAtUtc,scanCompletedAtUtc,detectionCount,outcome,errorCode'
+        Assert-CcodEqual $fields (($receipt.PSObject.Properties.Name)-join',') 'receipt exposes only the exact ordered schema';Assert-CcodEqual 'InternetDownload' $receipt.origin 'official download receipt is origin-bound';Assert-CcodEqual 3 $receipt.zoneId 'official download receipt binds actual ZoneId 3';Assert-CcodEqual $null $receipt.workflowArtifactIdentity 'official download receipt has no workflow identity';Assert-CcodEqual (Get-CcodTestFileSha256 $fixture.Installer) $receipt.assetSha256 'receipt binds exact candidate hash';Assert-CcodEqual (Get-CcodTestFileSha256 $fixture.Manifest) $receipt.manifestSha256 'receipt binds exact matching manifest hash';Assert-CcodTrue (-not(($receipt|ConvertTo-Json -Depth 12 -Compress).Contains($fixture.Root))) 'receipt contains no source path or raw output'
+        $originalCandidate=[IO.File]::ReadAllBytes($fixture.Installer);$race=New-CcodTask5DefenderAdapterFixture;$race.Adapters.StartCustomScan={param($Path)$race.State.Calls.Add('Scan');$stream=[IO.File]::Open($Path,[IO.FileMode]::Append,[IO.FileAccess]::Write,[IO.FileShare]::Read);try{$stream.WriteByte(255);$stream.Flush($true)}finally{$stream.Dispose()}}.GetNewClosure()
+        try{Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin InternetDownload -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root 'identity-race.json') -Adapters $race.Adapters|Out-Null} 'CCOD_RELEASE_ASSET_HASH_MISMATCH';Assert-CcodTrue (-not($race.State.Calls-contains'Write')) 'post-scan candidate mutation blocks receipt write'}finally{[IO.File]::WriteAllBytes($fixture.Installer,$originalCandidate);Set-Content -LiteralPath $fixture.Installer -Stream Zone.Identifier -Value "[ZoneTransfer]`r`nZoneId=3`r`n" -NoNewline}
+        Remove-Item -LiteralPath $fixture.Installer -Stream Zone.Identifier
+        foreach($zone in @($null,2)){$case=New-CcodTask5DefenderAdapterFixture;$case.Adapters.GetZoneId={param($Path)$zone}.GetNewClosure();Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin InternetDownload -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root "zone-$zone.json") -Adapters $case.Adapters|Out-Null} 'CCOD_DEFENDER_ZONE_REQUIRED';Assert-CcodTrue (-not($case.State.Calls-contains'Scan')) 'invalid Zone blocks scan'}
+        foreach($zoneShape in @([pscustomobject]@{Name='duplicate';Text="[ZoneTransfer]`r`nZoneId=3`r`nZoneId=3`r`n"},[pscustomobject]@{Name='mixed';Text="[ZoneTransfer]`r`nZoneId=3`r`nZoneId=2`r`n"})){Set-Content -LiteralPath $fixture.Installer -Stream Zone.Identifier -Value $zoneShape.Text -NoNewline;$case=New-CcodTask5DefenderAdapterFixture;Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin InternetDownload -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root "zone-$($zoneShape.Name).json") -Adapters $case.Adapters|Out-Null} 'CCOD_DEFENDER_ZONE_REQUIRED';Assert-CcodTrue (-not($case.State.Calls-contains'Scan')) "$($zoneShape.Name) ZoneId metadata blocks scan";Remove-Item -LiteralPath $fixture.Installer -Stream Zone.Identifier}
+        $identity=New-CcodTask5WorkflowIdentity ('a'*40);$trusted=New-CcodTask5DefenderAdapterFixture;$trustedReceipt=Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $identity -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root 'trusted.json') -Adapters $trusted.Adapters;Assert-CcodEqual $null $trustedReceipt.zoneId 'trusted workflow receipt never claims Internet Zone';Assert-CcodEqual ($identity|ConvertTo-Json -Compress) ($trustedReceipt.workflowArtifactIdentity|ConvertTo-Json -Compress) 'trusted receipt binds exact workflow artifact identity'
+        Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin TrustedWorkflowArtifact -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root 'trusted-missing.json') -Adapters (New-CcodTask5DefenderAdapterFixture).Adapters|Out-Null} 'CCOD_DEFENDER_ORIGIN_INVALID'
+        Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin InternetDownload -WorkflowArtifactIdentity $identity -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root 'internet-identity.json') -Adapters (New-CcodTask5DefenderAdapterFixture).Adapters|Out-Null} 'CCOD_DEFENDER_ORIGIN_INVALID'
+        foreach($field in @('provider','repository','runId','runAttempt','artifactId','artifactName','artifactDigest','gitCommit')){$bad=(($identity|ConvertTo-Json -Compress)|ConvertFrom-Json);if($field-in@('runId','runAttempt','artifactId')){$bad.$field=0}elseif($field-ceq'artifactDigest'){$bad.$field='sha256:bad'}elseif($field-ceq'gitCommit'){$bad.$field='b'*40}else{$bad.$field='foreign'};Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $bad -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root "trusted-$field.json") -Adapters (New-CcodTask5DefenderAdapterFixture).Adapters|Out-Null} 'CCOD_DEFENDER_ORIGIN_INVALID'}
+        foreach($mutation in @('Service','Antivirus','Realtime','Platform','Engine','Signature','SignatureMissing','SignatureStale','SignatureFuture')){$status=New-CcodTask5DefenderStatus;switch($mutation){'Service'{$status.AMServiceEnabled=$false};'Antivirus'{$status.AntivirusEnabled=$false};'Realtime'{$status.RealTimeProtectionEnabled=$false};'Platform'{$status.AMProductVersion=''};'Engine'{$status.AMEngineVersion=''};'Signature'{$status.AntivirusSignatureVersion=''};'SignatureMissing'{$status.AntivirusSignatureLastUpdated=$null};'SignatureStale'{$status.AntivirusSignatureLastUpdated=[datetime]::Parse('2030-01-30T04:05:05Z')};'SignatureFuture'{$status.AntivirusSignatureLastUpdated=[datetime]::Parse('2030-02-03T04:10:07Z')}};$case=New-CcodTask5DefenderAdapterFixture -Status $status;Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $identity -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root "status-$mutation.json") -Adapters $case.Adapters|Out-Null} 'CCOD_DEFENDER_STATUS_INVALID';Assert-CcodTrue (-not($case.State.Calls-contains'Scan')) "$mutation blocks scan"}
+        foreach($clock in @('Reverse','TooLong','Invalid')){$completed=if($clock-ceq'Reverse'){[datetime]::Parse('2030-02-03T04:05:05Z')}elseif($clock-ceq'TooLong'){[datetime]::Parse('2030-02-03T06:05:07Z')}else{'not-a-clock'};$case=New-CcodTask5DefenderAdapterFixture -Completed $completed;Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $identity -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root "clock-$clock.json") -Adapters $case.Adapters|Out-Null} 'CCOD_DEFENDER_CLOCK_INVALID'}
+        foreach($failure in @('Scan','Detection','Write')){$case=if($failure-ceq'Scan'){New-CcodTask5DefenderAdapterFixture -ScanThrows}elseif($failure-ceq'Detection'){New-CcodTask5DefenderAdapterFixture -Detects}else{New-CcodTask5DefenderAdapterFixture -WriteThrows};$error=if($failure-ceq'Scan'){'CCOD_DEFENDER_SCAN_FAILED'}elseif($failure-ceq'Detection'){'CCOD_DEFENDER_DETECTIONS_FOUND'}else{'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED'};Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $identity -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root "failure-$failure.json") -Adapters $case.Adapters|Out-Null} $error}
+        $command=Get-Command $defenderPath;Assert-CcodTrue (-not$command.Parameters.ContainsKey('ZoneId')) 'public tool exposes no Zone synthesis parameter'
+    }finally{if(Test-Path $fixture.Root){Remove-Item -LiteralPath $fixture.Root -Recurse -Force}}
+}
+
+Invoke-CcodTask5Test 'evidence' 'Defender default evidence writer is create-only and rejects unsafe targets before scan' {
     . $defenderPath -Library
-    $fixture = New-CcodReleaseFixture
-    try {
-        $calls = [Collections.Generic.List[string]]::new()
-        $capture = [pscustomobject]@{ Value = $null }
-        $base = @{
-            GetFileSha256 = { param($Path) $calls.Add('GetFileSha256'); Get-CcodTestFileSha256 -Path $Path }.GetNewClosure()
-            GetDefenderStatus = { $calls.Add('GetDefenderStatus'); [pscustomobject]@{ AMProductVersion = '4.18.26070.1'; AntivirusSignatureVersion = '1.999.1.0' } }.GetNewClosure()
-            StartCustomScan = { param($Path) $calls.Add('StartCustomScan') }.GetNewClosure()
-            GetThreatDetections = { $calls.Add('GetThreatDetections'); @() }.GetNewClosure()
-            GetUtcNow = { $calls.Add('GetUtcNow'); [datetime]::Parse('2026-08-24T00:00:00Z').ToUniversalTime() }.GetNewClosure()
-            WriteReceipt = { param($Path, $Receipt) $calls.Add('WriteReceipt'); $capture.Value = $Receipt; $Path }.GetNewClosure()
+    $fixture=New-CcodReleaseFixture
+    $unsafeOutside=$null;$unsafeLink=$null
+    try{
+        $identity=New-CcodTask5WorkflowIdentity ('a'*40)
+        $clean=New-CcodTask5DefenderAdapterFixture;$adapters=@{};foreach($key in @($clean.Adapters.Keys)){if([string]$key-cne'WriteReceipt'){$adapters[[string]$key]=$clean.Adapters[$key]}}
+        $evidence=Join-Path $fixture.Root 'create-only-receipt.json'
+        $receipt=Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $identity -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath $evidence -Adapters $adapters
+        Assert-CcodTrue (Test-Path -LiteralPath $evidence -PathType Leaf) 'default writer creates the requested regular evidence leaf'
+        $persisted=[IO.File]::ReadAllText($evidence,[Text.UTF8Encoding]::new($false,$true))|ConvertFrom-Json
+        Assert-CcodEqual ($receipt|ConvertTo-Json -Depth 12 -Compress) ($persisted|ConvertTo-Json -Depth 12 -Compress) 'default writer persists only the returned canonical receipt'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath $fixture.Root -Force|Where-Object{$_.Name-like'.ccod-defender-receipt-*'}).Count 'default writer leaves no temporary evidence leaf'
+
+        foreach($shape in @('ExistingFile','Directory','ReparseLeaf','UnsafeAncestry','Noncanonical','AlternateStream')){
+            $case=New-CcodTask5DefenderAdapterFixture;$caseAdapters=@{};foreach($key in @($case.Adapters.Keys)){if([string]$key-cne'WriteReceipt'){$caseAdapters[[string]$key]=$case.Adapters[$key]}}
+            $target=Join-Path $fixture.Root ("invalid-$shape.json")
+            $existingText=$null;$cleanupLink=$null
+            switch($shape){
+                'ExistingFile'{$existingText='do-not-overwrite';[IO.File]::WriteAllText($target,$existingText,[Text.UTF8Encoding]::new($false))}
+                'Directory'{[IO.Directory]::CreateDirectory($target)|Out-Null}
+                'ReparseLeaf'{$outside=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task5-evidence-leaf-'+[guid]::NewGuid().ToString('N'));[IO.Directory]::CreateDirectory($outside)|Out-Null;$cleanupLink=$target;New-Item -ItemType Junction -Path $target -Target $outside|Out-Null}
+                'UnsafeAncestry'{$unsafeOutside=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task5-evidence-parent-'+[guid]::NewGuid().ToString('N'));[IO.Directory]::CreateDirectory($unsafeOutside)|Out-Null;$unsafeLink=Join-Path $fixture.Root 'unsafe-evidence-parent';New-Item -ItemType Junction -Path $unsafeLink -Target $unsafeOutside|Out-Null;$target=Join-Path $unsafeLink 'receipt.json';$cleanupLink=$unsafeLink}
+                'Noncanonical'{$target=$fixture.Root+'\.\noncanonical-receipt.json'}
+                'AlternateStream'{$target=(Join-Path $fixture.Root 'alternate-receipt.json:stream')}
+            }
+            try{
+                Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $identity -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath $target -Adapters $caseAdapters|Out-Null} 'CCOD_DEFENDER_EVIDENCE_INVALID'
+                Assert-CcodTrue (-not($case.State.Calls-contains'Scan')) "$shape evidence target is rejected before Defender scan"
+                if($shape-ceq'ExistingFile'){Assert-CcodEqual $existingText ([IO.File]::ReadAllText($target,[Text.UTF8Encoding]::new($false,$true))) 'existing evidence remains byte-for-byte unchanged'}
+            }finally{
+                if($null-ne$cleanupLink-and(Test-Path -LiteralPath $cleanupLink)){[IO.Directory]::Delete($cleanupLink)}
+                if($shape-ceq'ReparseLeaf'-and$null-ne$outside-and(Test-Path -LiteralPath $outside)){Remove-Item -LiteralPath $outside -Recurse -Force}
+                if($shape-ceq'UnsafeAncestry'-and$null-ne$unsafeOutside-and(Test-Path -LiteralPath $unsafeOutside)){Remove-Item -LiteralPath $unsafeOutside -Recurse -Force;$unsafeOutside=$null;$unsafeLink=$null}
+            }
         }
-        $blocked = @{} + $base
-        $blocked.GetZoneId = { param($Path) $calls.Add('GetZoneId'); $null }.GetNewClosure()
-        Assert-CcodThrows {
-            Invoke-CcodReleaseDefenderCheck -InstallerPath $fixture.Installer -ChecksumPath $fixture.Checksum -EvidencePath (Join-Path $fixture.Root 'receipt.json') -Adapters $blocked
-        } 'CCOD_DEFENDER_ZONE_REQUIRED'
-        Assert-CcodTrue (-not ($calls -contains 'StartCustomScan')) 'missing Internet Zone blocks Defender scan'
-
-        $calls.Clear()
-        $capture.Value = $null
-        $clean = @{} + $base
-        $clean.GetZoneId = { param($Path) $calls.Add('GetZoneId'); 3 }.GetNewClosure()
-        $receipt = Invoke-CcodReleaseDefenderCheck -InstallerPath $fixture.Installer -ChecksumPath $fixture.Checksum -EvidencePath (Join-Path $fixture.Root 'receipt.json') -Adapters $clean
-        Assert-CcodEqual 0 ([int]$receipt.detectionCount) 'clean scan records no detections'
-        Assert-CcodTrue ($calls -contains 'StartCustomScan') 'clean verified asset invokes the custom scan'
-        $serialized = $capture.Value | ConvertTo-Json -Depth 8 -Compress
-        Assert-CcodTrue (-not $serialized.Contains($fixture.Root)) 'Defender receipt does not persist the private artifact path'
-        Assert-CcodTrue ($serialized.Contains($fixture.Installer.Substring(0,0))) 'receipt is serializable'
-
-        $calls.Clear()
-        $capture.Value = $null
-        $threatCalls = [pscustomobject]@{ Count = 0 }
-        $detected = @{} + $base
-        $detected.GetZoneId = { param($Path) $calls.Add('GetZoneId'); 3 }.GetNewClosure()
-        $detected.GetThreatDetections = {
-            $calls.Add('GetThreatDetections')
-            $threatCalls.Count++
-            if ($threatCalls.Count -eq 1) { return @() }
-            return @([pscustomobject]@{ ThreatID = 99; InitialDetectionTime = '2026-08-24T00:00:00.0000000Z'; Resources = 'redacted-by-gate' })
-        }.GetNewClosure()
-        Assert-CcodThrows {
-            Invoke-CcodReleaseDefenderCheck -InstallerPath $fixture.Installer -ChecksumPath $fixture.Checksum -EvidencePath (Join-Path $fixture.Root 'detection.json') -Adapters $detected
-        } 'CCOD_DEFENDER_DETECTIONS_FOUND'
-        Assert-CcodEqual 'Failed' ([string]$capture.Value.outcome) 'detection receipt records failure'
-        Assert-CcodEqual 1 ([int]$capture.Value.detectionCount) 'detection receipt counts only the newly observed detection'
-    } finally {
-        if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+    }finally{
+        if($null-ne$unsafeLink-and(Test-Path -LiteralPath $unsafeLink)){[IO.Directory]::Delete($unsafeLink)}
+        if($null-ne$unsafeOutside-and(Test-Path -LiteralPath $unsafeOutside)){Remove-Item -LiteralPath $unsafeOutside -Recurse -Force}
+        if(Test-Path $fixture.Root){Remove-Item -LiteralPath $fixture.Root -Recurse -Force}
     }
 }
 
@@ -2450,7 +2695,7 @@ Invoke-CcodTest 'package scripts build provenance and workflows retain the relea
     Assert-CcodTrue ($null -ne $package.scripts.'test:installed-lifecycle') 'package exposes installed-lifecycle deterministic tests'
     Assert-CcodTrue ($null -ne $package.scripts.'test:release-contract') 'package exposes release contract tests'
     $build = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\build.ps1') -Raw
-    Assert-CcodTrue ($build -match 'release-manifest\.json') 'build emits a release manifest'
+    Assert-CcodTrue ($build -match '\$releaseManifest\s*=\s*Join-Path\s+\$dist\s+\$releaseAssetNames\[4\]') 'build emits the central-contract portable release manifest'
     Assert-CcodTrue ($build -match 'gitCommit') 'build records the source commit'
     Assert-CcodTrue ($build -match 'buildTimestampUtc') 'build records a canonical build timestamp'
     Assert-CcodTrue ($build -match 'does not match package\.json version') 'build refuses a requested version that differs from package metadata'
@@ -2538,6 +2783,27 @@ Invoke-CcodTest 'release build validates the portable launcher artifact before p
     Assert-CcodTrue ($build -cmatch '(?s)Invoke-CcodPortableLauncherBuild.*?Test-CcodPortableLauncherArtifact.*?foreach \(\$portableFile in') 'portable build validates the generated artifact before copying it into the payload'
 }
 
+Invoke-CcodTask5Test 'docs' 'candidate documentation and build consume the exact non-receipt eleven-asset contract' {
+    $expected=Get-CcodTask5ExpectedAssetNames '2.5.22'
+    $readme=[IO.File]::ReadAllText((Join-Path $repositoryRoot 'README.md'),[Text.UTF8Encoding]::new($false,$true))
+    $readmeZh=[IO.File]::ReadAllText((Join-Path $repositoryRoot 'README.zh-CN.md'),[Text.UTF8Encoding]::new($false,$true))
+    Assert-CcodTrue (-not($readme-cmatch'(?i)always published|every tagged release ships|verified and available')) 'English README makes no unconditional publication or verification claim'
+    Assert-CcodTrue (-not($readmeZh-cmatch'\u5DF2\u9A8C\u8BC1|\u5747\u53EF\u7528|\u59CB\u7EC8\u53D1\u5E03')) 'Chinese README makes no prior verified or unconditional publication claim'
+    $englishRelease=[regex]::Match($readme,'(?ms)^## Releases\s*\r?\n(?<body>.*?)(?=^## |\z)').Groups['body'].Value
+    $chineseRelease=[regex]::Match($readmeZh,'(?ms)^## \u53D1\u5E03\uFF08Releases\uFF09\s*\r?\n(?<body>.*?)(?=^## |\z)').Groups['body'].Value
+    $englishContract=[regex]::Match($englishRelease,'(?ms)<details>\s*<summary>Exact 11-file candidate asset contract</summary>(?<body>.*?)</details>')
+    $chineseContract=[regex]::Match($chineseRelease,'(?ms)<details>\s*<summary>\u7CBE\u786E\u7684 11 \u6587\u4EF6\u5019\u9009\u8D44\u4EA7\u5951\u7EA6</summary>(?<body>.*?)</details>')
+    Assert-CcodTrue ($englishContract.Success-and$chineseContract.Success) 'both README asset lists are collapsed by default in an exact details block'
+    foreach($name in $expected){$literal='`'+$name+'`';Assert-CcodEqual 1 ([regex]::Matches($englishContract.Groups['body'].Value,[regex]::Escape($literal)).Count) "English candidate list names $name exactly once";Assert-CcodEqual 1 ([regex]::Matches($chineseContract.Groups['body'].Value,[regex]::Escape($literal)).Count) "Chinese candidate list names $name exactly once"}
+    Assert-CcodTrue ($englishRelease-cmatch'(?i)candidate'-and$chineseRelease-cmatch'\u5019\u9009') 'both release sections scope the eleven files to the v2.5.22 candidate'
+    Assert-CcodTrue ($englishRelease-cnotmatch'(?i)defender[^\r\n]*\.json'-and$chineseRelease-cnotmatch'(?i)defender[^\r\n]*\.json') 'Defender receipts are not listed as public assets'
+    $build=[IO.File]::ReadAllText((Join-Path $repositoryRoot 'build\build.ps1'),[Text.UTF8Encoding]::new($false,$true))
+    Assert-CcodTrue ($build-cmatch'ReleaseAssetContract\.psm1'-and$build-cmatch'Get-CcodExpectedReleaseAssetNames') 'build consumes the central release asset contract'
+    foreach($suffix in @('windows-x64.zip','windows-x64.zip.sha256.txt','trayhost-provenance.json','payload-manifest.json','release-manifest.json','setup.exe','setup.exe.sha256.txt','setup-provenance.json','setup-payload-manifest.json','setup-destination-inventory.iss','setup-release-manifest.json')){Assert-CcodTrue ($build-cnotmatch[regex]::Escape('CodexRemote-fix-$Version-'+$suffix)) "build no longer reconstructs $suffix outside the central contract"}
+    $changelog=[IO.File]::ReadAllText((Join-Path $repositoryRoot 'CHANGELOG.md'),[Text.UTF8Encoding]::new($false,$true));$section=[regex]::Match($changelog,'(?ms)^## v2\.5\.22\s*\r?\n(?<body>.*?)(?=^## |\z)').Groups['body'].Value
+    Assert-CcodTrue ($section-cmatch'(?i)candidate.*two distinct.*InternetDownload.*Defender receipts'-and$section-cmatch'\u5019\u9009.*InternetDownload.*Defender') 'changelog describes only the enforced candidate evidence contract'
+}
+
 Invoke-CcodTest '2.5.22 source metadata and documentation match the release contract' {
     $package = Get-Content -LiteralPath (Join-Path $repositoryRoot 'package.json') -Raw | ConvertFrom-Json
     Assert-CcodEqual '2.5.22' ([string]$package.version) 'package metadata is the 2.5.22 release'
@@ -2722,8 +2988,13 @@ Invoke-CcodTest 'actual portable entrypoint rejects a post-Defender source mutat
         $manifest=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version='2.5.22';gitCommit=('a'*40);buildTimestampUtc='2030-02-03T04:05:06.0000000Z';files=@($records)}
         [IO.File]::WriteAllText((Join-Path $root 'payload-manifest.json'),(($manifest|ConvertTo-Json -Depth 8)+[Environment]::NewLine),[Text.UTF8Encoding]::new($false))
         $attack=[pscustomobject]@{Ran=$false}
-        function Get-MpComputerStatus {[pscustomobject]@{AMProductVersion='fixture-platform';AntivirusSignatureVersion='fixture-signature';RealTimeProtectionEnabled=$true}}
+        function Get-MpComputerStatus {[pscustomobject]@{AMServiceEnabled=$true;AntivirusEnabled=$true;RealTimeProtectionEnabled=$true;AMProductVersion='fixture-platform';AMEngineVersion='fixture-engine';AntivirusSignatureVersion='fixture-signature';AntivirusSignatureLastUpdated=[datetime]::UtcNow.AddHours(-1)}}
         function Get-MpThreatDetection {param($ErrorAction)@()}
+        function Start-MpScan {param($ScanType,$ScanPath,$ErrorAction)throw 'fixture portable scan failure'}
+        $scanFailure=$null
+        try{&$entrypoint -DoNotStart|Out-Null}catch{$scanFailure=$_}
+        Assert-CcodTrue ($null-ne$scanFailure-and$scanFailure.FullyQualifiedErrorId-like'CCOD_PORTABLE_DEFENDER_SCAN_FAILED*') 'actual entrypoint preserves the portable scan failure code'
+        Assert-CcodTrue (-not(Test-Path -LiteralPath $childMarker)-and-not(Test-Path -LiteralPath $lifecycleRoot)) 'portable scan failure creates no child or lifecycle state'
         function Start-MpScan {param($ScanType,$ScanPath,$ErrorAction)$attack.Ran=$true;[IO.File]::WriteAllText($child,'raced-child-source',[Text.UTF8Encoding]::new($false))}
         $failure=$null
         try{&$entrypoint -DoNotStart|Out-Null}catch{$failure=$_}
@@ -2759,7 +3030,7 @@ Invoke-CcodTest 'actual portable entrypoint rejects the final File.Copy barrier
         Assert-CcodEqual 'Install-CodexControlOtherDevices.ps1' ([string]$records[0].path) 'fixture child reaches the first production payload File.Copy barrier'
         $manifest=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version='2.5.22';gitCommit=('a'*40);buildTimestampUtc='2030-02-03T04:05:06.0000000Z';files=@($records)}
         [IO.File]::WriteAllText((Join-Path $root 'payload-manifest.json'),(($manifest|ConvertTo-Json -Depth 8)+[Environment]::NewLine),[Text.UTF8Encoding]::new($false))
-        function Get-MpComputerStatus {[pscustomobject]@{AMProductVersion='fixture-platform';AntivirusSignatureVersion='fixture-signature';RealTimeProtectionEnabled=$true}}
+        function Get-MpComputerStatus {[pscustomobject]@{AMServiceEnabled=$true;AntivirusEnabled=$true;RealTimeProtectionEnabled=$true;AMProductVersion='fixture-platform';AMEngineVersion='fixture-engine';AntivirusSignatureVersion='fixture-signature';AntivirusSignatureLastUpdated=[datetime]::UtcNow.AddHours(-1)}}
         function Get-MpThreatDetection {param($ErrorAction)@()}
         function Start-MpScan {param($ScanType,$ScanPath,$ErrorAction)}
         $barrier=[pscustomobject]@{InstallerRootRedirected=$false;SourceMutated=$false}
diff --git a/tools/ReleaseAssetContract.psm1 b/tools/ReleaseAssetContract.psm1
new file mode 100644
index 0000000..34104b4
--- /dev/null
+++ b/tools/ReleaseAssetContract.psm1
@@ -0,0 +1,403 @@
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+$script:CcodReleaseReceiptFields = @(
+    'schemaVersion','assetType','assetName','assetSha256','checksumName','checksumSha256',
+    'manifestName','manifestSha256','version','gitCommit','origin','workflowArtifactIdentity',
+    'zoneId','defenderServiceEnabled','antivirusEnabled','realTimeProtectionEnabled',
+    'defenderPlatformVersion','defenderEngineVersion','signatureVersion','signatureUpdatedAtUtc',
+    'scanStartedAtUtc','scanCompletedAtUtc','detectionCount','outcome','errorCode'
+)
+
+function Throw-CcodReleaseContractError {
+    param([Parameter(Mandatory)][string]$Id,[Parameter(Mandatory)][string]$Message,$Target)
+    throw [Management.Automation.ErrorRecord]::new(
+        [InvalidOperationException]::new($Message),$Id,
+        [Management.Automation.ErrorCategory]::InvalidData,$Target)
+}
+
+function Get-CcodExpectedReleaseAssetNames {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$Version)
+    @(
+        "CodexRemote-fix-$Version-windows-x64.zip",
+        "CodexRemote-fix-$Version-windows-x64.zip.sha256.txt",
+        "CodexRemote-fix-$Version-trayhost-provenance.json",
+        "CodexRemote-fix-$Version-payload-manifest.json",
+        "CodexRemote-fix-$Version-release-manifest.json",
+        "CodexRemote-fix-$Version-setup.exe",
+        "CodexRemote-fix-$Version-setup.exe.sha256.txt",
+        "CodexRemote-fix-$Version-setup-provenance.json",
+        "CodexRemote-fix-$Version-setup-payload-manifest.json",
+        "CodexRemote-fix-$Version-setup-destination-inventory.iss",
+        "CodexRemote-fix-$Version-setup-release-manifest.json"
+    )
+}
+
+function Test-CcodReleaseContractCanonicalUtc {
+    param($Value)
+    if ($Value -isnot [string] -or [string]::IsNullOrWhiteSpace($Value)) { return $false }
+    $parsed = [datetime]::MinValue
+    return [datetime]::TryParseExact($Value,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind,[ref]$parsed) -and
+        $parsed.Kind -eq [DateTimeKind]::Utc -and
+        $parsed.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture) -ceq $Value
+}
+
+function Assert-CcodReleaseContractPlainPath {
+    param(
+        [Parameter(Mandatory)][string]$Path,
+        [Parameter(Mandatory)][bool]$Directory,
+        [Parameter(Mandatory)][string]$ErrorId
+    )
+    try {
+        if ([string]::IsNullOrWhiteSpace($Path) -or -not [IO.Path]::IsPathRooted($Path) -or $Path.IndexOf(':',$Path.IndexOf(':') + 1) -ge 0) { throw 'path' }
+        $canonical = [IO.Path]::GetFullPath($Path)
+        $pathRoot = [IO.Path]::GetPathRoot($canonical)
+        $full = if ($canonical.Length -gt $pathRoot.Length) { $canonical.TrimEnd('\') } else { $canonical }
+        $presented = if ($Path.Length -gt $pathRoot.Length) { $Path.TrimEnd('\') } else { $Path }
+        if ($full -cne $presented) { throw 'canonical' }
+        if ($Directory) {
+            if (-not [IO.Directory]::Exists($full) -or [IO.File]::Exists($full)) { throw 'directory' }
+        } else {
+            if (-not [IO.File]::Exists($full) -or [IO.Directory]::Exists($full)) { throw 'file' }
+        }
+        $current = $full
+        while (-not [string]::IsNullOrWhiteSpace($current)) {
+            $item = Get-Item -LiteralPath $current -Force -ErrorAction Stop
+            if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'reparse' }
+            if ($current.TrimEnd('\') -ceq $pathRoot.TrimEnd('\')) { break }
+            $parent = [IO.Directory]::GetParent($current)
+            if ($null -eq $parent) { break }
+            $next = if ($parent.FullName.Length -gt $pathRoot.Length) { $parent.FullName.TrimEnd('\') } else { $parent.FullName }
+            if ($next -ceq $current) { break }
+            $current = $next
+        }
+        return $full
+    } catch {
+        Throw-CcodReleaseContractError $ErrorId 'Release contract path is missing, noncanonical, or has unsafe ancestry.' $Path
+    }
+}
+
+function Get-CcodReleaseContractHash {
+    param([Parameter(Mandatory)][string]$Path)
+    $stream = $null
+    $sha = [Security.Cryptography.SHA256]::Create()
+    try {
+        $stream = [IO.File]::Open($Path,[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read)
+        return [BitConverter]::ToString($sha.ComputeHash($stream)).Replace('-','').ToLowerInvariant()
+    } finally {
+        if ($null -ne $stream) { $stream.Dispose() }
+        $sha.Dispose()
+    }
+}
+
+function Skip-CcodReleaseContractJsonWhitespace {
+    param([string]$Json,[int]$Offset)
+    $index = $Offset
+    while ($index -lt $Json.Length -and [char]::IsWhiteSpace($Json[$index])) { $index++ }
+    return $index
+}
+
+function Read-CcodReleaseContractJsonStringToken {
+    param([string]$Json,[int]$Offset)
+    if ($Offset -ge $Json.Length -or $Json[$Offset] -ne [char]34) { throw 'json string' }
+    $index = $Offset + 1
+    while ($index -lt $Json.Length) {
+        $character = $Json[$index]
+        if ($character -eq [char]34) {
+            $end = $index + 1
+            $raw = $Json.Substring($Offset,$end-$Offset)
+            $decoded = $raw | ConvertFrom-Json -ErrorAction Stop
+            if ($decoded -isnot [string]) { throw 'json string type' }
+            return [pscustomobject]@{Value=$decoded;End=$end}
+        }
+        if ([int][char]$character -lt 32) { throw 'json control' }
+        if ($character -eq [char]92) {
+            $index++
+            if ($index -ge $Json.Length) { throw 'json escape' }
+            $escape = $Json[$index]
+            if ($escape -eq [char]117) {
+                if (($index+4) -ge $Json.Length -or $Json.Substring($index+1,4) -cnotmatch '^[0-9a-fA-F]{4}$') { throw 'json unicode escape' }
+                $index += 5
+                continue
+            }
+            if ('"\/bfnrt'.IndexOf($escape) -lt 0) { throw 'json escape' }
+        }
+        $index++
+    }
+    throw 'json string end'
+}
+
+function Read-CcodReleaseContractJsonValue {
+    param([string]$Json,[int]$Offset,[int]$Depth=0)
+    if ($Depth -gt 64) { throw 'json depth' }
+    $index = Skip-CcodReleaseContractJsonWhitespace $Json $Offset
+    if ($index -ge $Json.Length) { throw 'json value' }
+    $character = $Json[$index]
+    if ($character -eq [char]34) { return [int](Read-CcodReleaseContractJsonStringToken $Json $index).End }
+    if ($character -eq [char]123) {
+        $index++
+        $keys = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+        $index = Skip-CcodReleaseContractJsonWhitespace $Json $index
+        if ($index -lt $Json.Length -and $Json[$index] -eq [char]125) { return $index+1 }
+        while ($true) {
+            $key = Read-CcodReleaseContractJsonStringToken $Json $index
+            if (-not $keys.Add([string]$key.Value)) { throw 'duplicate json property' }
+            $index = Skip-CcodReleaseContractJsonWhitespace $Json ([int]$key.End)
+            if ($index -ge $Json.Length -or $Json[$index] -ne [char]58) { throw 'json colon' }
+            $index = Read-CcodReleaseContractJsonValue $Json ($index+1) ($Depth+1)
+            $index = Skip-CcodReleaseContractJsonWhitespace $Json $index
+            if ($index -ge $Json.Length) { throw 'json object end' }
+            if ($Json[$index] -eq [char]125) { return $index+1 }
+            if ($Json[$index] -ne [char]44) { throw 'json comma' }
+            $index = Skip-CcodReleaseContractJsonWhitespace $Json ($index+1)
+        }
+    }
+    if ($character -eq [char]91) {
+        $index++
+        $index = Skip-CcodReleaseContractJsonWhitespace $Json $index
+        if ($index -lt $Json.Length -and $Json[$index] -eq [char]93) { return $index+1 }
+        while ($true) {
+            $index = Read-CcodReleaseContractJsonValue $Json $index ($Depth+1)
+            $index = Skip-CcodReleaseContractJsonWhitespace $Json $index
+            if ($index -ge $Json.Length) { throw 'json array end' }
+            if ($Json[$index] -eq [char]93) { return $index+1 }
+            if ($Json[$index] -ne [char]44) { throw 'json comma' }
+            $index = Skip-CcodReleaseContractJsonWhitespace $Json ($index+1)
+        }
+    }
+    $match = [regex]::Match($Json.Substring($index),'^(?:true|false|null|-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?)')
+    if (-not $match.Success) { throw 'json primitive' }
+    return $index + $match.Length
+}
+
+function Assert-CcodReleaseContractJsonLexicalShape {
+    param([string]$Json)
+    $end = Read-CcodReleaseContractJsonValue $Json 0 0
+    $end = Skip-CcodReleaseContractJsonWhitespace $Json $end
+    if ($end -ne $Json.Length) { throw 'json trailing data' }
+}
+
+function Read-CcodReleaseContractJson {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$ErrorId,[int64]$MaximumBytes=4194304)
+    try {
+        $item = Get-Item -LiteralPath $Path -Force -ErrorAction Stop
+        if ($item.Length -le 0 -or $item.Length -gt $MaximumBytes) { throw 'length' }
+        $raw = [IO.File]::ReadAllText($Path,[Text.UTF8Encoding]::new($false,$true))
+        Assert-CcodReleaseContractJsonLexicalShape -Json $raw
+        $value = $raw | ConvertFrom-Json -ErrorAction Stop
+        if ($null -eq $value -or $value -isnot [pscustomobject]) { throw 'shape' }
+        return [pscustomobject]@{ Raw=$raw; Value=$value }
+    } catch {
+        Throw-CcodReleaseContractError $ErrorId 'Release contract JSON is malformed or outside its size bound.' $Path
+    }
+}
+
+function Assert-CcodReleaseContractMetadata {
+    param($Value,[string]$Version,[string]$GitCommit,[string]$Timestamp,[string]$ErrorId,$Target,[switch]$TimestampOptional)
+    if ($null -eq $Value -or $Value -isnot [pscustomobject] -or
+        $null -eq $Value.PSObject.Properties['version'] -or $Value.version -isnot [string] -or $Value.version -cne $Version -or
+        $null -eq $Value.PSObject.Properties['gitCommit'] -or $Value.gitCommit -isnot [string] -or $Value.gitCommit -cne $GitCommit) {
+        Throw-CcodReleaseContractError $ErrorId 'Release metadata does not bind the common version and commit.' $Target
+    }
+    if (-not $TimestampOptional) {
+        if ($null -eq $Value.PSObject.Properties['buildTimestampUtc'] -or -not (Test-CcodReleaseContractCanonicalUtc $Value.buildTimestampUtc) -or $Value.buildTimestampUtc -cne $Timestamp) {
+            Throw-CcodReleaseContractError $ErrorId 'Release metadata does not bind the common canonical timestamp.' $Target
+        }
+    }
+}
+
+function Get-CcodReleaseContractManifestMap {
+    param(
+        [Parameter(Mandatory)]$Manifest,
+        [Parameter(Mandatory)][string[]]$ExpectedNames,
+        [Parameter(Mandatory)][string]$ErrorId,
+        [Parameter(Mandatory)]$Target
+    )
+    $assets = @($Manifest.assets)
+    if ($assets.Count -ne $ExpectedNames.Count) { Throw-CcodReleaseContractError $ErrorId 'Release manifest asset count is not exact.' $Target }
+    $map = [Collections.Generic.Dictionary[string,string]]::new([StringComparer]::Ordinal)
+    for ($index=0; $index -lt $assets.Count; $index++) {
+        $record = $assets[$index]
+        if ($null -eq $record -or $record -isnot [pscustomobject] -or
+            (@($record.PSObject.Properties.Name) -join ',') -cne 'name,sha256' -or
+            $record.name -isnot [string] -or $record.name -cne $ExpectedNames[$index] -or
+            $record.sha256 -isnot [string] -or $record.sha256 -cnotmatch '^[0-9a-f]{64}$' -or
+            $map.ContainsKey([string]$record.name)) {
+            Throw-CcodReleaseContractError $ErrorId 'Release manifest asset records are malformed, duplicated, or out of order.' $Target
+        }
+        $map.Add([string]$record.name,[string]$record.sha256)
+    }
+    return $map
+}
+
+function Test-CcodExactReleaseAssetSet {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string]$AssetDirectory,
+        [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$Version
+    )
+    $errorId = 'CCOD_RELEASE_ASSET_SET_INVALID'
+    $directory = Assert-CcodReleaseContractPlainPath -Path $AssetDirectory -Directory $true -ErrorId $errorId
+    $expected = @(Get-CcodExpectedReleaseAssetNames -Version $Version)
+    try { $children = @(Get-ChildItem -LiteralPath $directory -Force -ErrorAction Stop) }
+    catch { Throw-CcodReleaseContractError $errorId 'Release asset directory cannot be enumerated exactly.' $directory }
+    if ($children.Count -ne $expected.Count) { Throw-CcodReleaseContractError $errorId 'Release asset directory does not contain exactly eleven entries.' $directory }
+    $byName = [Collections.Generic.Dictionary[string,object]]::new([StringComparer]::OrdinalIgnoreCase)
+    foreach ($child in $children) {
+        if ($child.PSIsContainer -or ($child.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0 -or $byName.ContainsKey($child.Name)) {
+            Throw-CcodReleaseContractError $errorId 'Release assets must be distinct regular non-reparse files.' $child.FullName
+        }
+        $byName.Add($child.Name,$child)
+    }
+    foreach ($name in $expected) {
+        if (-not $byName.ContainsKey($name) -or [string]$byName[$name].Name -cne $name) {
+            Throw-CcodReleaseContractError $errorId 'Release asset names differ by spelling, case, or membership.' $name
+        }
+        [void](Assert-CcodReleaseContractPlainPath -Path ([string]$byName[$name].FullName) -Directory $false -ErrorId $errorId)
+    }
+
+    $portablePath = Join-Path $directory $expected[4]
+    $setupPath = Join-Path $directory $expected[10]
+    $portableJson = Read-CcodReleaseContractJson -Path $portablePath -ErrorId $errorId
+    $setupJson = Read-CcodReleaseContractJson -Path $setupPath -ErrorId $errorId
+    $portable = $portableJson.Value; $setup = $setupJson.Value
+    if ((@($portable.PSObject.Properties.Name) -join ',') -cne 'schemaVersion,product,version,gitCommit,buildTimestampUtc,distribution,assets' -or
+        $portable.schemaVersion -isnot [int] -or $portable.schemaVersion -ne 2 -or $portable.product -cne 'CodexRemote-fix' -or
+        $portable.version -cne $Version -or $portable.gitCommit -isnot [string] -or $portable.gitCommit -cnotmatch '^[0-9a-f]{40}$' -or
+        -not (Test-CcodReleaseContractCanonicalUtc $portable.buildTimestampUtc) -or $portable.distribution -cne 'portable-zip') {
+        Throw-CcodReleaseContractError $errorId 'Portable release manifest metadata is not exact.' $portablePath
+    }
+    if ((@($setup.PSObject.Properties.Name) -join ',') -cne 'schemaVersion,product,version,gitCommit,buildTimestampUtc,assets' -or
+        $setup.schemaVersion -isnot [int] -or $setup.schemaVersion -ne 1 -or $setup.product -cne 'CodexRemote-fix' -or
+        $setup.version -cne $Version -or $setup.gitCommit -isnot [string] -or $setup.gitCommit -cne $portable.gitCommit -or
+        -not (Test-CcodReleaseContractCanonicalUtc $setup.buildTimestampUtc) -or $setup.buildTimestampUtc -cne $portable.buildTimestampUtc) {
+        Throw-CcodReleaseContractError $errorId 'Setup release manifest metadata is not exact or does not share provenance.' $setupPath
+    }
+    $portableNames = @($expected[0],$expected[1],$expected[2],$expected[3],'CodexRemote-fix.exe','CodexRemote-fix.exe.config')
+    $setupNames = @($expected[5],$expected[6],$expected[2],$expected[7],$expected[8],$expected[9])
+    $portableMap = Get-CcodReleaseContractManifestMap -Manifest $portable -ExpectedNames $portableNames -ErrorId $errorId -Target $portablePath
+    $setupMap = Get-CcodReleaseContractManifestMap -Manifest $setup -ExpectedNames $setupNames -ErrorId $errorId -Target $setupPath
+    foreach ($name in @($portableNames | Where-Object { $_ -in $expected })) {
+        if ((Get-CcodReleaseContractHash (Join-Path $directory $name)) -cne $portableMap[$name]) { Throw-CcodReleaseContractError $errorId 'Portable manifest hash differs from the public asset bytes.' $name }
+    }
+    foreach ($name in $setupNames) {
+        if ((Get-CcodReleaseContractHash (Join-Path $directory $name)) -cne $setupMap[$name]) { Throw-CcodReleaseContractError $errorId 'Setup manifest hash differs from the public asset bytes.' $name }
+    }
+    if ($portableMap[$expected[2]] -cne $setupMap[$expected[2]]) { Throw-CcodReleaseContractError $errorId 'Portable and Setup manifests do not share one TrayHost provenance identity.' $expected[2] }
+    foreach ($pair in @(@($expected[0],$expected[1]),@($expected[5],$expected[6]))) {
+        $checksumText = [IO.File]::ReadAllText((Join-Path $directory $pair[1]),[Text.UTF8Encoding]::new($false,$true)).TrimEnd("`r","`n")
+        $assetHash = Get-CcodReleaseContractHash (Join-Path $directory $pair[0])
+        if ($checksumText -cne ("$assetHash *$($pair[0])")) { Throw-CcodReleaseContractError $errorId 'Release checksum is not exact.' $pair[1] }
+    }
+    $tray = (Read-CcodReleaseContractJson -Path (Join-Path $directory $expected[2]) -ErrorId $errorId).Value
+    $portablePayload = (Read-CcodReleaseContractJson -Path (Join-Path $directory $expected[3]) -ErrorId $errorId).Value
+    $setupProvenance = (Read-CcodReleaseContractJson -Path (Join-Path $directory $expected[7]) -ErrorId $errorId).Value
+    $setupPayload = (Read-CcodReleaseContractJson -Path (Join-Path $directory $expected[8]) -ErrorId $errorId).Value
+    Assert-CcodReleaseContractMetadata $tray $Version $portable.gitCommit $portable.buildTimestampUtc $errorId $expected[2]
+    Assert-CcodReleaseContractMetadata $portablePayload $Version $portable.gitCommit $portable.buildTimestampUtc $errorId $expected[3]
+    Assert-CcodReleaseContractMetadata $setupProvenance $Version $portable.gitCommit $portable.buildTimestampUtc $errorId $expected[7]
+    Assert-CcodReleaseContractMetadata $setupPayload $Version $portable.gitCommit $portable.buildTimestampUtc $errorId $expected[8] -TimestampOptional
+
+    $records = [Collections.Generic.List[object]]::new()
+    foreach ($name in $expected) { $records.Add([pscustomobject][ordered]@{name=$name;sha256=Get-CcodReleaseContractHash (Join-Path $directory $name)}) }
+    return [pscustomobject][ordered]@{Valid=$true;Version=$Version;GitCommit=[string]$portable.gitCommit;BuildTimestampUtc=[string]$portable.buildTimestampUtc;Assets=@($records)}
+}
+
+function Get-CcodReleasePromotionReceiptNames {
+    param([string]$Version)
+    @("CodexRemote-fix-$Version-setup.internet-download.defender.json","CodexRemote-fix-$Version-windows-x64.internet-download.defender.json")
+}
+
+function Test-CcodReleasePromotionReceipt {
+    param($Receipt,[string]$Raw,[string]$Path,[string]$AssetType,[string]$Version,[string]$GitCommit,[string[]]$AssetNames)
+    $errorId = 'CCOD_RELEASE_PROMOTION_EVIDENCE_INVALID'
+    if ((@($Receipt.PSObject.Properties.Name) -join ',') -cne ($script:CcodReleaseReceiptFields -join ',')) { Throw-CcodReleaseContractError $errorId 'Defender receipt fields or order are not exact.' $Path }
+    foreach ($field in $script:CcodReleaseReceiptFields) {
+        if ([regex]::Matches($Raw,'"'+[regex]::Escape($field)+'"\s*:').Count -ne 1) { Throw-CcodReleaseContractError $errorId 'Defender receipt contains a missing or duplicate field.' $Path }
+    }
+    $setup = $AssetType -ceq 'Setup'
+    $expectedAsset = if ($setup) { $AssetNames[5] } else { $AssetNames[0] }
+    $expectedChecksum = if ($setup) { $AssetNames[6] } else { $AssetNames[1] }
+    $expectedManifest = if ($setup) { $AssetNames[10] } else { $AssetNames[4] }
+    if ($Receipt.schemaVersion -isnot [int] -or $Receipt.schemaVersion -ne 2 -or
+        $Receipt.assetType -isnot [string] -or $Receipt.assetType -cne $AssetType -or
+        $Receipt.assetName -isnot [string] -or $Receipt.assetName -cne $expectedAsset -or
+        $Receipt.assetSha256 -isnot [string] -or $Receipt.assetSha256 -cnotmatch '^[0-9a-f]{64}$' -or
+        $Receipt.checksumName -isnot [string] -or $Receipt.checksumName -cne $expectedChecksum -or
+        $Receipt.checksumSha256 -isnot [string] -or $Receipt.checksumSha256 -cnotmatch '^[0-9a-f]{64}$' -or
+        $Receipt.manifestName -isnot [string] -or $Receipt.manifestName -cne $expectedManifest -or
+        $Receipt.manifestSha256 -isnot [string] -or $Receipt.manifestSha256 -cnotmatch '^[0-9a-f]{64}$' -or
+        $Receipt.version -isnot [string] -or $Receipt.version -cne $Version -or
+        $Receipt.gitCommit -isnot [string] -or $Receipt.gitCommit -cne $GitCommit -or
+        $Receipt.origin -isnot [string] -or $Receipt.origin -cne 'InternetDownload' -or
+        $null -ne $Receipt.workflowArtifactIdentity -or $Receipt.zoneId -isnot [int] -or $Receipt.zoneId -ne 3 -or
+        $Receipt.defenderServiceEnabled -isnot [bool] -or -not $Receipt.defenderServiceEnabled -or
+        $Receipt.antivirusEnabled -isnot [bool] -or -not $Receipt.antivirusEnabled -or
+        $Receipt.realTimeProtectionEnabled -isnot [bool] -or -not $Receipt.realTimeProtectionEnabled -or
+        $Receipt.defenderPlatformVersion -isnot [string] -or [string]::IsNullOrWhiteSpace($Receipt.defenderPlatformVersion) -or $Receipt.defenderPlatformVersion.Length -gt 128 -or
+        $Receipt.defenderEngineVersion -isnot [string] -or [string]::IsNullOrWhiteSpace($Receipt.defenderEngineVersion) -or $Receipt.defenderEngineVersion.Length -gt 128 -or
+        $Receipt.signatureVersion -isnot [string] -or [string]::IsNullOrWhiteSpace($Receipt.signatureVersion) -or $Receipt.signatureVersion.Length -gt 128 -or
+        -not (Test-CcodReleaseContractCanonicalUtc $Receipt.signatureUpdatedAtUtc) -or
+        -not (Test-CcodReleaseContractCanonicalUtc $Receipt.scanStartedAtUtc) -or
+        -not (Test-CcodReleaseContractCanonicalUtc $Receipt.scanCompletedAtUtc) -or
+        $Receipt.detectionCount -isnot [int] -or $Receipt.detectionCount -ne 0 -or
+        $Receipt.outcome -isnot [string] -or $Receipt.outcome -cne 'Completed' -or $null -ne $Receipt.errorCode) {
+        Throw-CcodReleaseContractError $errorId 'Defender receipt does not bind a completed official download scan.' $Path
+    }
+    $signature = [datetime]::ParseExact($Receipt.signatureUpdatedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
+    $started = [datetime]::ParseExact($Receipt.scanStartedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
+    $completed = [datetime]::ParseExact($Receipt.scanCompletedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
+    if ($signature -lt $started.AddHours(-72) -or $signature -gt $started.AddMinutes(5) -or $completed -lt $started -or $completed -gt $started.AddHours(2)) {
+        Throw-CcodReleaseContractError $errorId 'Defender receipt timestamps are stale, future-dated, reversed, or too long.' $Path
+    }
+    return $Receipt
+}
+
+function Test-CcodReleasePromotionEvidence {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string]$EvidenceDirectory,
+        [Parameter(Mandatory)][string]$AssetDirectory,
+        [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$Version,
+        [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit
+    )
+    $errorId = 'CCOD_RELEASE_PROMOTION_EVIDENCE_INVALID'
+    $directory = Assert-CcodReleaseContractPlainPath -Path $EvidenceDirectory -Directory $true -ErrorId $errorId
+    try { $assetContract = Test-CcodExactReleaseAssetSet -AssetDirectory $AssetDirectory -Version $Version }
+    catch { Throw-CcodReleaseContractError $errorId 'Promotion assets do not satisfy the exact eleven-file authority.' $AssetDirectory }
+    if ($assetContract.GitCommit -cne $ExpectedGitCommit) { Throw-CcodReleaseContractError $errorId 'Promotion assets do not bind the expected commit.' $AssetDirectory }
+    $names = @(Get-CcodReleasePromotionReceiptNames -Version $Version)
+    try { $children = @(Get-ChildItem -LiteralPath $directory -Force -ErrorAction Stop) }
+    catch { Throw-CcodReleaseContractError $errorId 'Promotion evidence directory cannot be read exactly.' $directory }
+    if ($children.Count -ne 2) { Throw-CcodReleaseContractError $errorId 'Promotion requires exactly two receipt leaves.' $directory }
+    $assets = @(Get-CcodExpectedReleaseAssetNames -Version $Version)
+    $receipts = [Collections.Generic.List[object]]::new()
+    for ($index=0; $index -lt 2; $index++) {
+        $matching = @($children | Where-Object { $_.Name -ceq $names[$index] })
+        if ($matching.Count -ne 1 -or $matching[0].PSIsContainer -or ($matching[0].Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { Throw-CcodReleaseContractError $errorId 'Promotion receipt names and kinds are not exact.' $names[$index] }
+        $path = Assert-CcodReleaseContractPlainPath -Path ([string]$matching[0].FullName) -Directory $false -ErrorId $errorId
+        $json = Read-CcodReleaseContractJson -Path $path -ErrorId $errorId -MaximumBytes 65536
+        $type = if ($index -eq 0) { 'Setup' } else { 'PortableZip' }
+        $receipts.Add((Test-CcodReleasePromotionReceipt -Receipt $json.Value -Raw $json.Raw -Path $path -AssetType $type -Version $Version -GitCommit $ExpectedGitCommit -AssetNames $assets))
+    }
+    foreach ($binding in @(
+        [pscustomobject]@{Receipt=0;Asset=5;Checksum=6;Manifest=10},
+        [pscustomobject]@{Receipt=1;Asset=0;Checksum=1;Manifest=4}
+    )) {
+        $receipt = $receipts[$binding.Receipt]
+        if ($receipt.assetSha256 -cne $assetContract.Assets[$binding.Asset].sha256 -or
+            $receipt.checksumSha256 -cne $assetContract.Assets[$binding.Checksum].sha256 -or
+            $receipt.manifestSha256 -cne $assetContract.Assets[$binding.Manifest].sha256) {
+            Throw-CcodReleaseContractError $errorId 'Promotion receipt hashes do not match the authoritative public asset bytes.' $directory
+        }
+    }
+    if ($receipts[0].assetSha256 -ceq $receipts[1].assetSha256 -or
+        $receipts[0].checksumSha256 -ceq $receipts[1].checksumSha256 -or
+        $receipts[0].manifestSha256 -ceq $receipts[1].manifestSha256) {
+        Throw-CcodReleaseContractError $errorId 'Setup and portable receipts reuse an evidence identity.' $directory
+    }
+    return [pscustomobject][ordered]@{Valid=$true;Version=$Version;GitCommit=$ExpectedGitCommit;Receipts=@($receipts)}
+}
+
+Export-ModuleMember -Function Get-CcodExpectedReleaseAssetNames,Test-CcodExactReleaseAssetSet,Test-CcodReleasePromotionEvidence
diff --git a/tools/Test-ReleaseDefender.ps1 b/tools/Test-ReleaseDefender.ps1
index f9ddffe..1a985f7 100644
--- a/tools/Test-ReleaseDefender.ps1
+++ b/tools/Test-ReleaseDefender.ps1
@@ -1,7 +1,12 @@
 [CmdletBinding(DefaultParameterSetName = 'Run')]
 param(
-    [Parameter(Mandatory, ParameterSetName = 'Run')][string]$InstallerPath,
+    [Parameter(Mandatory, ParameterSetName = 'Run')][string]$CandidatePath,
     [Parameter(Mandatory, ParameterSetName = 'Run')][string]$ChecksumPath,
+    [Parameter(Mandatory, ParameterSetName = 'Run')][string]$ManifestPath,
+    [Parameter(Mandatory, ParameterSetName = 'Run')][string]$Origin,
+    [Parameter(ParameterSetName = 'Run')]$WorkflowArtifactIdentity,
+    [Parameter(Mandatory, ParameterSetName = 'Run')][string]$ExpectedVersion,
+    [Parameter(Mandatory, ParameterSetName = 'Run')][string]$ExpectedGitCommit,
     [Parameter(Mandatory, ParameterSetName = 'Run')][string]$EvidencePath,
     [Parameter(Mandatory, ParameterSetName = 'Library')][switch]$Library
 )
@@ -9,6 +14,10 @@ param(
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
+$assetContractPath = Join-Path $PSScriptRoot 'ReleaseAssetContract.psm1'
+if (-not [IO.File]::Exists($assetContractPath)) { throw 'CCOD_RELEASE_ASSET_CONTRACT_MISSING' }
+Import-Module $assetContractPath -Force -ErrorAction Stop
+
 function Throw-CcodReleaseDefenderError {
     param([Parameter(Mandatory)][string]$Id, [Parameter(Mandatory)][string]$Message, $Target)
     throw [Management.Automation.ErrorRecord]::new(
@@ -172,14 +181,35 @@ function Get-CcodReleaseDefenderRawJsonString {
     return $value
 }
 
+function Assert-CcodReleaseDefenderPlainAncestry {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$ErrorId,[switch]$AllowMissingLeaf)
+    try {
+        if ([string]::IsNullOrWhiteSpace($Path) -or -not [IO.Path]::IsPathRooted($Path)) { throw 'absolute' }
+        $canonical = [IO.Path]::GetFullPath($Path)
+        $root = [IO.Path]::GetPathRoot($canonical)
+        $full = if ($canonical.Length -gt $root.Length) { $canonical.TrimEnd('\') } else { $canonical }
+        $presented = if ($Path.Length -gt $root.Length) { $Path.TrimEnd('\') } else { $Path }
+        if ($full -cne $presented -or $full.IndexOf(':',$full.IndexOf(':') + 1) -ge 0) { throw 'canonical' }
+        $current = if ($AllowMissingLeaf) { Split-Path $full -Parent } else { $full }
+        while (-not [string]::IsNullOrWhiteSpace($current)) {
+            $item = Get-Item -LiteralPath $current -Force -ErrorAction Stop
+            if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'reparse' }
+            if ($current.TrimEnd('\') -ceq $root.TrimEnd('\')) { break }
+            $parent = [IO.Directory]::GetParent($current)
+            if ($null -eq $parent) { break }
+            $current = if ($parent.FullName.Length -gt $root.Length) { $parent.FullName.TrimEnd('\') } else { $parent.FullName }
+        }
+        return $full
+    } catch {
+        Throw-CcodReleaseDefenderError $ErrorId 'Path is missing, noncanonical, or has unsafe ancestry.' $Path
+    }
+}
+
 function Assert-CcodReleaseDefenderRegularFile {
     param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$Kind)
-    if ([string]::IsNullOrWhiteSpace($Path) -or -not [IO.Path]::IsPathRooted($Path)) {
-        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_INVALID' "$Kind must be an absolute path" $Path
-    }
-    $full = [IO.Path]::GetFullPath($Path)
-    if (-not [IO.File]::Exists($full)) { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_INVALID' "$Kind is missing" $full }
-    $item = Get-Item -LiteralPath $full -Force -ErrorAction Stop
+    $full = Assert-CcodReleaseDefenderPlainAncestry -Path $Path -ErrorId 'CCOD_RELEASE_ASSET_INVALID'
+    try { $item = Get-Item -LiteralPath $full -Force -ErrorAction Stop }
+    catch { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_INVALID' "$Kind is missing" $full }
     if ($item.PSIsContainer -or (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) {
         Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_INVALID' "$Kind must be a regular non-reparse file" $full
     }
@@ -188,58 +218,64 @@ function Assert-CcodReleaseDefenderRegularFile {
 
 function Assert-CcodReleaseDefenderDirectory {
     param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$Kind)
-    if ([string]::IsNullOrWhiteSpace($Path) -or -not [IO.Path]::IsPathRooted($Path)) {
-        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_INVALID' "$Kind must be an absolute path" $Path
-    }
-    $full = [IO.Path]::GetFullPath($Path)
-    if (-not [IO.Directory]::Exists($full)) { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_INVALID' "$Kind is missing" $full }
-    $item = Get-Item -LiteralPath $full -Force -ErrorAction Stop
+    $full = Assert-CcodReleaseDefenderPlainAncestry -Path $Path -ErrorId 'CCOD_RELEASE_ASSET_INVALID'
+    try { $item = Get-Item -LiteralPath $full -Force -ErrorAction Stop }
+    catch { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_INVALID' "$Kind is missing" $full }
     if (-not $item.PSIsContainer -or (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) {
         Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_INVALID' "$Kind must be a non-reparse directory" $full
     }
     return $full
 }
 
+function Assert-CcodReleaseDefenderEvidenceTarget {
+    param([Parameter(Mandatory)][string]$Path)
+    $target = Assert-CcodReleaseDefenderPlainAncestry -Path $Path -ErrorId 'CCOD_DEFENDER_EVIDENCE_INVALID' -AllowMissingLeaf
+    if ([IO.Path]::GetExtension($target) -cne '.json' -or [IO.File]::Exists($target) -or [IO.Directory]::Exists($target)) {
+        Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_EVIDENCE_INVALID' 'Defender evidence must be a new canonical JSON leaf.' $target
+    }
+    try {
+        $existing = Get-Item -LiteralPath $target -Force -ErrorAction SilentlyContinue
+        if ($null -ne $existing) { throw 'existing' }
+    } catch { Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_EVIDENCE_INVALID' 'Defender evidence target already exists or is unsafe.' $target }
+    return $target
+}
+
 function Get-CcodReleaseDefenderDefaultAdapters {
     $defaults = @{}
-    $defaults.GetFileSha256 = { param($Path) Get-CcodReleaseDefenderHash -Path $Path }.GetNewClosure()
-    $defaults.ReadText = { param($Path) [IO.File]::ReadAllText($Path) }.GetNewClosure()
+    $defaults.GetFileSha256 = { param($Path) Get-CcodReleaseDefenderHash -Path $Path }
+    $defaults.ReadText = { param($Path) [IO.File]::ReadAllText($Path) }
     $defaults.GetZoneId = {
         param($Path)
         try {
             $stream = Get-Item -LiteralPath $Path -Stream Zone.Identifier -ErrorAction Stop
-            if ($null -eq $stream) { return $null }
+            if ($null -eq $stream -or $stream.Length -le 0 -or $stream.Length -gt 65536) { return $null }
             $text = Get-Content -LiteralPath $Path -Stream Zone.Identifier -Raw -ErrorAction Stop
-            $match = [regex]::Match([string]$text, '(?m)^ZoneId=(\d+)\s*$')
-            if (-not $match.Success) { return $null }
-            return [int]$match.Groups[1].Value
+            $matches = [regex]::Matches([string]$text, '(?im)^[ \t]*ZoneId[ \t]*=[ \t]*([0-9]+)[ \t]*\r?$')
+            $zone = 0
+            if ($matches.Count -ne 1 -or -not [int]::TryParse($matches[0].Groups[1].Value,[ref]$zone)) { return $null }
+            return $zone
         } catch { return $null }
-    }.GetNewClosure()
-    $defaults.GetDefenderStatus = { Get-MpComputerStatus -ErrorAction Stop }.GetNewClosure()
-    $defaults.StartCustomScan = { param($Path) Start-MpScan -ScanType CustomScan -ScanPath $Path -ErrorAction Stop }.GetNewClosure()
-    $defaults.GetThreatDetections = { @(Get-MpThreatDetection -ErrorAction Stop) }.GetNewClosure()
-    $defaults.GetUtcNow = { [datetime]::UtcNow }.GetNewClosure()
+    }
+    $defaults.GetDefenderStatus = { Get-MpComputerStatus -ErrorAction Stop }
+    $defaults.StartCustomScan = { param($Path) Start-MpScan -ScanType CustomScan -ScanPath $Path -ErrorAction Stop }
+    $defaults.GetThreatDetections = { @(Get-MpThreatDetection -ErrorAction Stop) }
+    $defaults.GetUtcNow = { [datetime]::UtcNow }
     $defaults.WriteReceipt = {
         param($Path, $Receipt)
-        if ([string]::IsNullOrWhiteSpace($Path) -or -not [IO.Path]::IsPathRooted($Path)) {
-            Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_EVIDENCE_INVALID' 'Defender evidence path must be absolute' $Path
-        }
-        $target = [IO.Path]::GetFullPath($Path)
+        $target = Assert-CcodReleaseDefenderEvidenceTarget -Path $Path
         $parent = Split-Path $target -Parent
-        if (-not [IO.Directory]::Exists($parent)) { [IO.Directory]::CreateDirectory($parent) | Out-Null }
-        $parentItem = Get-Item -LiteralPath $parent -Force -ErrorAction Stop
-        if (($parentItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0 -or [IO.File]::Exists($target)) {
-            Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_EVIDENCE_INVALID' 'Defender evidence target is unsafe or already exists' $target
-        }
-        $temporary = "$target.$([guid]::NewGuid().ToString('N')).tmp"
+        $temporary = Join-Path $parent ('.ccod-defender-receipt-' + [guid]::NewGuid().ToString('N') + '.tmp')
         try {
-            [IO.File]::WriteAllText($temporary, ($Receipt | ConvertTo-Json -Depth 8), [Text.UTF8Encoding]::new($false))
+            $bytes = [Text.UTF8Encoding]::new($false).GetBytes((($Receipt | ConvertTo-Json -Depth 12) + [Environment]::NewLine))
+            $stream = [IO.File]::Open($temporary,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::None)
+            try { $stream.Write($bytes,0,$bytes.Length); $stream.Flush($true) } finally { $stream.Dispose() }
+            [void](Assert-CcodReleaseDefenderEvidenceTarget -Path $target)
             [IO.File]::Move($temporary, $target)
             return $target
         } finally {
             if ([IO.File]::Exists($temporary)) { Remove-Item -LiteralPath $temporary -Force -ErrorAction SilentlyContinue }
         }
-    }.GetNewClosure()
+    }
     return $defaults
 }
 
@@ -257,20 +293,20 @@ function Resolve-CcodReleaseDefenderAdapters {
 }
 
 function Get-CcodReleaseDefenderChecksum {
-    param([Parameter(Mandatory)][string]$InstallerPath, [Parameter(Mandatory)][string]$ChecksumPath, [Parameter(Mandatory)][hashtable]$Adapters)
-    $installer = Assert-CcodReleaseDefenderRegularFile -Path $InstallerPath -Kind 'Installer asset'
+    param([Parameter(Mandatory)][string]$CandidatePath, [Parameter(Mandatory)][string]$ChecksumPath, [Parameter(Mandatory)][hashtable]$Adapters)
+    $candidate = Assert-CcodReleaseDefenderRegularFile -Path $CandidatePath -Kind 'Release candidate asset'
     $checksum = Assert-CcodReleaseDefenderRegularFile -Path $ChecksumPath -Kind 'Installer checksum'
     $text = & $Adapters.ReadText $checksum
     if ($text -isnot [string]) { Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CHECKSUM_INVALID' 'Installer checksum could not be read as text' $checksum }
     $match = [regex]::Match($text.TrimEnd("`r", "`n"), '^([0-9a-f]{64}) \*([^\r\n]+)$')
-    if (-not $match.Success -or $match.Groups[2].Value -cne [IO.Path]::GetFileName($installer)) {
+    if (-not $match.Success -or $match.Groups[2].Value -cne [IO.Path]::GetFileName($candidate)) {
         Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CHECKSUM_INVALID' 'Installer checksum is malformed or names a different asset' $checksum
     }
-    $actual = [string](& $Adapters.GetFileSha256 $installer)
+    $actual = [string](& $Adapters.GetFileSha256 $candidate)
     if ($actual -cnotmatch '^[0-9a-f]{64}$' -or $actual -cne $match.Groups[1].Value) {
-        Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CHECKSUM_INVALID' 'Installer checksum does not match the exact bytes submitted for scanning' $installer
+        Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CHECKSUM_INVALID' 'Installer checksum does not match the exact bytes submitted for scanning' $candidate
     }
-    return [pscustomobject][ordered]@{ InstallerPath = $installer; ChecksumPath = $checksum; Sha256 = $actual }
+    return [pscustomobject][ordered]@{ CandidatePath = $candidate; ChecksumPath = $checksum; Sha256 = $actual }
 }
 
 function Get-CcodReleaseDefenderStreamHash {
@@ -299,10 +335,11 @@ function Test-CcodReleasePortablePayloadManifest {
         -not (Test-CcodReleaseDefenderCanonicalUtc $manifestTimestamp)) {
         Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Portable release manifest metadata does not have the required canonical shape' $ReleaseManifestFile
     }
-    $bundleName = "CodexRemote-fix-$ExpectedVersion-windows-x64.zip"
-    $checksumName = "$bundleName.sha256.txt"
-    $provenanceName = "CodexRemote-fix-$ExpectedVersion-trayhost-provenance.json"
-    $payloadManifestName = "CodexRemote-fix-$ExpectedVersion-payload-manifest.json"
+    $contractNames = @(Get-CcodExpectedReleaseAssetNames -Version $ExpectedVersion)
+    $bundleName = $contractNames[0]
+    $checksumName = $contractNames[1]
+    $provenanceName = $contractNames[2]
+    $payloadManifestName = $contractNames[3]
     $expectedNames = @($bundleName,$checksumName,$provenanceName,$payloadManifestName,'CodexRemote-fix.exe','CodexRemote-fix.exe.config')
     $assetHashes = @{}
     foreach ($asset in @($ReleaseManifest.assets)) {
@@ -483,14 +520,8 @@ function Test-CcodReleaseAssetManifest {
         Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Release manifest metadata does not have the required canonical shape' $manifestFile
     }
     $assets = @($manifest.assets)
-    $expectedNames = @(
-        "CodexRemote-fix-$ExpectedVersion-setup.exe",
-        "CodexRemote-fix-$ExpectedVersion-setup.exe.sha256.txt",
-        "CodexRemote-fix-$ExpectedVersion-trayhost-provenance.json",
-        "CodexRemote-fix-$ExpectedVersion-setup-provenance.json",
-        "CodexRemote-fix-$ExpectedVersion-setup-payload-manifest.json",
-        "CodexRemote-fix-$ExpectedVersion-setup-destination-inventory.iss"
-    )
+    $contractNames = @(Get-CcodExpectedReleaseAssetNames -Version $ExpectedVersion)
+    $expectedNames = @($contractNames[5],$contractNames[6],$contractNames[2],$contractNames[7],$contractNames[8],$contractNames[9])
     if ($assets.Count -ne $expectedNames.Count) { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Release manifest does not bind the exact required asset set' $manifestFile }
     $assetHashes = @{}
     foreach ($asset in $assets) {
@@ -578,7 +609,7 @@ function Get-CcodReleaseDefenderDetectionKeys {
         if ($null -eq $record) { continue }
         $threat = if ($null -ne $record.PSObject.Properties['ThreatID']) { [string]$record.ThreatID } else { '' }
         $time = if ($null -ne $record.PSObject.Properties['InitialDetectionTime']) { [string]$record.InitialDetectionTime } else { '' }
-        $resources = if ($null -ne $record.PSObject.Properties['Resources']) { [string]$record.Resources } else { '' }
+        $resources = if ($null -ne $record.PSObject.Properties['Resources']) { (@($record.Resources) -join '|') } else { '' }
         if (-not [string]::IsNullOrWhiteSpace($threat) -or -not [string]::IsNullOrWhiteSpace($time) -or -not [string]::IsNullOrWhiteSpace($resources)) {
             $null = $keys.Add("$threat|$time|$resources")
         }
@@ -586,73 +617,186 @@ function Get-CcodReleaseDefenderDetectionKeys {
     Write-Output -NoEnumerate $keys
 }
 
+function Test-CcodReleaseDefenderPositiveInteger {
+    param($Value)
+    if ($Value -is [bool] -or $Value -isnot [ValueType]) { return $false }
+    try { return [decimal]$Value -eq [decimal][uint64]$Value -and [uint64]$Value -gt 0 }
+    catch { return $false }
+}
+
+function Assert-CcodReleaseDefenderOrigin {
+    param([Parameter(Mandatory)][string]$Origin,$WorkflowArtifactIdentity,[Parameter(Mandatory)][string]$ExpectedGitCommit)
+    if ($Origin -ceq 'InternetDownload') {
+        if ($null -ne $WorkflowArtifactIdentity) { Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_ORIGIN_INVALID' 'Internet-download evidence cannot claim a workflow artifact identity.' $WorkflowArtifactIdentity }
+        return $null
+    }
+    if ($Origin -cne 'TrustedWorkflowArtifact' -or $null -eq $WorkflowArtifactIdentity -or $WorkflowArtifactIdentity -isnot [pscustomobject] -or
+        (@($WorkflowArtifactIdentity.PSObject.Properties.Name) -join ',') -cne 'provider,repository,runId,runAttempt,artifactId,artifactName,artifactDigest,gitCommit' -or
+        $WorkflowArtifactIdentity.provider -isnot [string] -or $WorkflowArtifactIdentity.provider -cne 'GitHubActions' -or
+        $WorkflowArtifactIdentity.repository -isnot [string] -or $WorkflowArtifactIdentity.repository -cne 'naipi11/CodexRemote-fix' -or
+        -not (Test-CcodReleaseDefenderPositiveInteger $WorkflowArtifactIdentity.runId) -or
+        -not (Test-CcodReleaseDefenderPositiveInteger $WorkflowArtifactIdentity.runAttempt) -or
+        -not (Test-CcodReleaseDefenderPositiveInteger $WorkflowArtifactIdentity.artifactId) -or
+        $WorkflowArtifactIdentity.artifactName -isnot [string] -or $WorkflowArtifactIdentity.artifactName -cne 'CodexRemote-fix portable bundle' -or
+        $WorkflowArtifactIdentity.artifactDigest -isnot [string] -or $WorkflowArtifactIdentity.artifactDigest -cnotmatch '^sha256:[0-9a-f]{64}$' -or
+        $WorkflowArtifactIdentity.gitCommit -isnot [string] -or $WorkflowArtifactIdentity.gitCommit -cne $ExpectedGitCommit) {
+        Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_ORIGIN_INVALID' 'Trusted workflow evidence requires one exact GitHub Actions artifact identity.' $WorkflowArtifactIdentity
+    }
+    return [pscustomobject][ordered]@{
+        provider=[string]$WorkflowArtifactIdentity.provider
+        repository=[string]$WorkflowArtifactIdentity.repository
+        runId=[uint64]$WorkflowArtifactIdentity.runId
+        runAttempt=[uint64]$WorkflowArtifactIdentity.runAttempt
+        artifactId=[uint64]$WorkflowArtifactIdentity.artifactId
+        artifactName=[string]$WorkflowArtifactIdentity.artifactName
+        artifactDigest=[string]$WorkflowArtifactIdentity.artifactDigest
+        gitCommit=[string]$WorkflowArtifactIdentity.gitCommit
+    }
+}
+
+function Get-CcodReleaseDefenderStatusEvidence {
+    param([Parameter(Mandatory)]$Status,[Parameter(Mandatory)][datetime]$ScanStarted)
+    if ($null -eq $Status -or
+        $null -eq $Status.PSObject.Properties['AMServiceEnabled'] -or $Status.AMServiceEnabled -isnot [bool] -or -not $Status.AMServiceEnabled -or
+        $null -eq $Status.PSObject.Properties['AntivirusEnabled'] -or $Status.AntivirusEnabled -isnot [bool] -or -not $Status.AntivirusEnabled -or
+        $null -eq $Status.PSObject.Properties['RealTimeProtectionEnabled'] -or $Status.RealTimeProtectionEnabled -isnot [bool] -or -not $Status.RealTimeProtectionEnabled -or
+        $null -eq $Status.PSObject.Properties['AMProductVersion'] -or $Status.AMProductVersion -isnot [string] -or [string]::IsNullOrWhiteSpace($Status.AMProductVersion) -or $Status.AMProductVersion.Length -gt 128 -or
+        $null -eq $Status.PSObject.Properties['AMEngineVersion'] -or $Status.AMEngineVersion -isnot [string] -or [string]::IsNullOrWhiteSpace($Status.AMEngineVersion) -or $Status.AMEngineVersion.Length -gt 128 -or
+        $null -eq $Status.PSObject.Properties['AntivirusSignatureVersion'] -or $Status.AntivirusSignatureVersion -isnot [string] -or [string]::IsNullOrWhiteSpace($Status.AntivirusSignatureVersion) -or $Status.AntivirusSignatureVersion.Length -gt 128 -or
+        $null -eq $Status.PSObject.Properties['AntivirusSignatureLastUpdated'] -or $Status.AntivirusSignatureLastUpdated -isnot [datetime]) {
+        Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_STATUS_INVALID' 'Defender service, AV, real-time, platform, engine, or signature state is incomplete.' $Status
+    }
+    $signature = ([datetime]$Status.AntivirusSignatureLastUpdated).ToUniversalTime()
+    if ($signature -lt $ScanStarted.AddHours(-72) -or $signature -gt $ScanStarted.AddMinutes(5)) {
+        Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_STATUS_INVALID' 'Defender signature timestamp is stale or future-dated.' $signature
+    }
+    return [pscustomobject][ordered]@{
+        ServiceEnabled=$true
+        AntivirusEnabled=$true
+        RealTimeProtectionEnabled=$true
+        PlatformVersion=[string]$Status.AMProductVersion
+        EngineVersion=[string]$Status.AMEngineVersion
+        SignatureVersion=[string]$Status.AntivirusSignatureVersion
+        SignatureUpdatedAtUtc=$signature.ToString('o',[Globalization.CultureInfo]::InvariantCulture)
+    }
+}
+
 function Invoke-CcodReleaseDefenderCheck {
     [CmdletBinding()]
     param(
-        [Parameter(Mandatory)][string]$InstallerPath,
+        [Parameter(Mandatory)][string]$CandidatePath,
         [Parameter(Mandatory)][string]$ChecksumPath,
+        [Parameter(Mandatory)][string]$ManifestPath,
+        [Parameter(Mandatory)][string]$Origin,
+        $WorkflowArtifactIdentity,
+        [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion,
+        [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit,
         [Parameter(Mandatory)][string]$EvidencePath,
         [hashtable]$Adapters
     )
     $adapters = Resolve-CcodReleaseDefenderAdapters -Adapters $Adapters
-    $candidate = Get-CcodReleaseDefenderChecksum -InstallerPath $InstallerPath -ChecksumPath $ChecksumPath -Adapters $adapters
-    $installerLeaf = [IO.Path]::GetFileName($candidate.InstallerPath)
-    $versionMatch = [regex]::Match($installerLeaf, '^CodexRemote-fix-(\d+\.\d+\.\d+)-(?:setup\.exe|windows-x64\.zip)$')
-    if (-not $versionMatch.Success) { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Release candidate name cannot bind a release manifest version' $installerLeaf }
-    $version = $versionMatch.Groups[1].Value
-    $manifestName = if ($installerLeaf.EndsWith('-setup.exe',[StringComparison]::Ordinal)) {
-        "CodexRemote-fix-$version-setup-release-manifest.json"
-    } else {
-        "CodexRemote-fix-$version-release-manifest.json"
-    }
-    $manifestPath = Join-Path (Split-Path $candidate.InstallerPath -Parent) $manifestName
-    $manifest = Test-CcodReleaseAssetManifest -ManifestPath $manifestPath -AssetDirectory (Split-Path $candidate.InstallerPath -Parent) -ExpectedVersion $version
-    if ($manifest.InstallerSha256 -cne $candidate.Sha256) { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Release manifest and checksum bind different installer bytes' $installerLeaf }
-    $zone = & $adapters.GetZoneId $candidate.InstallerPath
-    if ($zone -isnot [int] -or [int]$zone -ne 3) {
-        Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_ZONE_REQUIRED' 'The final downloaded installer must retain Internet ZoneId 3 before scanning.' $zone
-    }
-    $status = & $adapters.GetDefenderStatus
-    if ($null -eq $status -or $null -eq $status.PSObject.Properties['AMProductVersion'] -or $null -eq $status.PSObject.Properties['AntivirusSignatureVersion'] -or
-        $status.AMProductVersion -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$status.AMProductVersion) -or
-        $status.AntivirusSignatureVersion -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$status.AntivirusSignatureVersion)) {
-        Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_STATUS_INVALID' 'Defender platform or signature version is unavailable.' $status
+    $evidenceTarget = Assert-CcodReleaseDefenderEvidenceTarget -Path $EvidencePath
+    $candidate = Get-CcodReleaseDefenderChecksum -CandidatePath $CandidatePath -ChecksumPath $ChecksumPath -Adapters $adapters
+    $candidateDirectory = Split-Path $candidate.CandidatePath -Parent
+    if ((Split-Path $candidate.ChecksumPath -Parent) -cne $candidateDirectory) { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Candidate and checksum must be exact siblings.' $candidate.ChecksumPath }
+    $manifestFile = Assert-CcodReleaseDefenderRegularFile -Path $ManifestPath -Kind 'Matching release manifest'
+    if ((Split-Path $manifestFile -Parent) -cne $candidateDirectory) { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Candidate and manifest must be exact siblings.' $manifestFile }
+    $contractNames = @(Get-CcodExpectedReleaseAssetNames -Version $ExpectedVersion)
+    $candidateLeaf = [IO.Path]::GetFileName($candidate.CandidatePath)
+    $assetType = if ($candidateLeaf -ceq $contractNames[5]) { 'Setup' } elseif ($candidateLeaf -ceq $contractNames[0]) { 'PortableZip' } else { $null }
+    if ($null -eq $assetType) { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Candidate is not the exact versioned Setup or portable ZIP asset.' $candidateLeaf }
+    $expectedChecksumName = if ($assetType -ceq 'Setup') { $contractNames[6] } else { $contractNames[1] }
+    $expectedManifestName = if ($assetType -ceq 'Setup') { $contractNames[10] } else { $contractNames[4] }
+    if ([IO.Path]::GetFileName($candidate.ChecksumPath) -cne $expectedChecksumName -or [IO.Path]::GetFileName($manifestFile) -cne $expectedManifestName) {
+        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Checksum or manifest does not match the exact selected asset type.' $candidateLeaf
+    }
+    $manifest = Test-CcodReleaseAssetManifest -ManifestPath $manifestFile -AssetDirectory $candidateDirectory -ExpectedVersion $ExpectedVersion
+    if ($manifest.GitCommit -cne $ExpectedGitCommit -or $manifest.InstallerName -cne $candidateLeaf -or $manifest.InstallerSha256 -cne $candidate.Sha256) {
+        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Expected commit, release manifest, checksum, and candidate bytes do not bind one identity.' $candidateLeaf
+    }
+    $checksumSha256 = [string](& $adapters.GetFileSha256 $candidate.ChecksumPath)
+    $manifestSha256 = [string](& $adapters.GetFileSha256 $manifestFile)
+    if ($checksumSha256 -cnotmatch '^[0-9a-f]{64}$' -or $manifestSha256 -cnotmatch '^[0-9a-f]{64}$') { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Checksum or manifest hash adapter returned an invalid identity.' $candidateLeaf }
+    $workflowIdentity = Assert-CcodReleaseDefenderOrigin -Origin $Origin -WorkflowArtifactIdentity $WorkflowArtifactIdentity -ExpectedGitCommit $ExpectedGitCommit
+    $zone = $null
+    if ($Origin -ceq 'InternetDownload') {
+        $zone = & $adapters.GetZoneId $candidate.CandidatePath
+        if ($zone -isnot [int] -or [int]$zone -ne 3) { Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_ZONE_REQUIRED' 'The final downloaded candidate must retain actual Internet ZoneId 3 before scanning.' $zone }
+        $zone = [int]$zone
     }
-    $before = Get-CcodReleaseDefenderDetectionKeys -Records (& $adapters.GetThreatDetections)
     $started = & $adapters.GetUtcNow
     if ($started -isnot [datetime]) { Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CLOCK_INVALID' 'Defender clock did not return a DateTime value' $started }
+    $started = ([datetime]$started).ToUniversalTime()
+    $status = Get-CcodReleaseDefenderStatusEvidence -Status (& $adapters.GetDefenderStatus) -ScanStarted $started
+    $before = Get-CcodReleaseDefenderDetectionKeys -Records (& $adapters.GetThreatDetections)
     $scanError = $null
-    try { & $adapters.StartCustomScan $candidate.InstallerPath }
+    try { & $adapters.StartCustomScan $candidate.CandidatePath }
     catch { $scanError = $_ }
     $completed = & $adapters.GetUtcNow
-    if ($completed -isnot [datetime]) { $completed = [datetime]::UtcNow }
+    if ($completed -isnot [datetime]) { Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CLOCK_INVALID' 'Defender completion clock did not return a DateTime value.' $completed }
+    $completed = ([datetime]$completed).ToUniversalTime()
+    if ($completed -lt $started -or $completed -gt $started.AddHours(2)) { Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CLOCK_INVALID' 'Defender scan timestamps are reversed or exceed the two-hour bound.' $completed }
     $after = Get-CcodReleaseDefenderDetectionKeys -Records (& $adapters.GetThreatDetections)
     $newDetections = @($after | Where-Object { -not $before.Contains($_) })
+    try {
+        $revalidatedCandidate = Get-CcodReleaseDefenderChecksum -CandidatePath $candidate.CandidatePath -ChecksumPath $candidate.ChecksumPath -Adapters $adapters
+        $revalidatedManifest = Test-CcodReleaseAssetManifest -ManifestPath $manifestFile -AssetDirectory $candidateDirectory -ExpectedVersion $ExpectedVersion
+        $revalidatedChecksumSha256 = [string](& $adapters.GetFileSha256 $candidate.ChecksumPath)
+        $revalidatedManifestSha256 = [string](& $adapters.GetFileSha256 $manifestFile)
+    } catch { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Candidate, checksum, or manifest identity changed during Defender scanning.' $candidateLeaf }
+    if ($revalidatedCandidate.Sha256 -cne $candidate.Sha256 -or $revalidatedManifest.GitCommit -cne $ExpectedGitCommit -or
+        $revalidatedManifest.InstallerName -cne $candidateLeaf -or $revalidatedManifest.InstallerSha256 -cne $candidate.Sha256 -or
+        $revalidatedChecksumSha256 -cne $checksumSha256 -or $revalidatedManifestSha256 -cne $manifestSha256) {
+        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Candidate, checksum, or manifest identity changed during Defender scanning.' $candidateLeaf
+    }
+    if ($Origin -ceq 'InternetDownload') {
+        $revalidatedZone = & $adapters.GetZoneId $candidate.CandidatePath
+        if ($revalidatedZone -isnot [int] -or [int]$revalidatedZone -ne 3) { Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_ZONE_REQUIRED' 'Internet ZoneId changed during Defender scanning.' $revalidatedZone }
+    }
     $errorCode = $null
     if ($null -ne $scanError) { $errorCode = 'CCOD_DEFENDER_SCAN_FAILED' }
     elseif ($newDetections.Count -gt 0) { $errorCode = 'CCOD_DEFENDER_DETECTIONS_FOUND' }
     $receipt = [pscustomobject][ordered]@{
-        schemaVersion = 1
-        installerSha256 = $candidate.Sha256
-        zoneId = [int]$zone
-        defenderPlatformVersion = [string]$status.AMProductVersion
-        signatureVersion = [string]$status.AntivirusSignatureVersion
-        scanStartedAtUtc = $started.ToUniversalTime().ToString('o', [Globalization.CultureInfo]::InvariantCulture)
-        scanCompletedAtUtc = $completed.ToUniversalTime().ToString('o', [Globalization.CultureInfo]::InvariantCulture)
+        schemaVersion = 2
+        assetType = $assetType
+        assetName = $candidateLeaf
+        assetSha256 = $candidate.Sha256
+        checksumName = $expectedChecksumName
+        checksumSha256 = $checksumSha256
+        manifestName = $expectedManifestName
+        manifestSha256 = $manifestSha256
+        version = $ExpectedVersion
+        gitCommit = $ExpectedGitCommit
+        origin = $Origin
+        workflowArtifactIdentity = $workflowIdentity
+        zoneId = $zone
+        defenderServiceEnabled = [bool]$status.ServiceEnabled
+        antivirusEnabled = [bool]$status.AntivirusEnabled
+        realTimeProtectionEnabled = [bool]$status.RealTimeProtectionEnabled
+        defenderPlatformVersion = [string]$status.PlatformVersion
+        defenderEngineVersion = [string]$status.EngineVersion
+        signatureVersion = [string]$status.SignatureVersion
+        signatureUpdatedAtUtc = [string]$status.SignatureUpdatedAtUtc
+        scanStartedAtUtc = $started.ToString('o', [Globalization.CultureInfo]::InvariantCulture)
+        scanCompletedAtUtc = $completed.ToString('o', [Globalization.CultureInfo]::InvariantCulture)
         detectionCount = [int]$newDetections.Count
         outcome = if ($null -eq $errorCode) { 'Completed' } else { 'Failed' }
         errorCode = $errorCode
     }
-    try { & $adapters.WriteReceipt $EvidencePath $receipt | Out-Null }
-    catch { Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED' 'Defender scan receipt could not be written.' $EvidencePath }
+    try { & $adapters.WriteReceipt $evidenceTarget $receipt | Out-Null }
+    catch {
+        $id = Get-CcodReleaseDefenderErrorId $_
+        if ($id -ceq 'CCOD_DEFENDER_EVIDENCE_INVALID') { throw }
+        Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED' 'Defender scan receipt could not be written.' $evidenceTarget
+    }
     if ($null -ne $errorCode) { Throw-CcodReleaseDefenderError $errorCode 'The Defender final-asset gate did not complete cleanly.' $candidate.Sha256 }
     return $receipt
 }
 
 if (-not $Library) {
     try {
-        $receipt = Invoke-CcodReleaseDefenderCheck -InstallerPath $InstallerPath -ChecksumPath $ChecksumPath -EvidencePath $EvidencePath
-        $receipt | ConvertTo-Json -Depth 8
+        $receipt = Invoke-CcodReleaseDefenderCheck -CandidatePath $CandidatePath -ChecksumPath $ChecksumPath -ManifestPath $ManifestPath -Origin $Origin -WorkflowArtifactIdentity $WorkflowArtifactIdentity -ExpectedVersion $ExpectedVersion -ExpectedGitCommit $ExpectedGitCommit -EvidencePath $EvidencePath
+        $receipt | ConvertTo-Json -Depth 12
     } catch {
         Write-Error $_
         exit 1

From 2b0175370c58c35b916f4471703aed51f930f7df Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 12:24:23 +0800
Subject: [PATCH 155/187] docs: record exact release evidence task

---
 .../progress.md                               |   8 +
 .../task-5-report.md                          | 200 ++++++++++++++++++
 2 files changed, 208 insertions(+)
 create mode 100644 .superpowers/sdd/2026-08-29-v2522-immutable-generation/task-5-report.md

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md
index 63ee232..318f237 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md
@@ -372,3 +372,11 @@ review acceptance through `3eea951`. The true v2.5.21 lifecycle bridge, exact hi
 profiles, durable pre-write migration plan, same-SID/new-session TaskRemoved recovery, post-reclamation
 staged resume, pinned generation reclamation, and Runtime V7 ABI closure all passed their scoped reviews.
 The latest frozen persistence aggregate exited 0. Task 5 is now in progress; Tasks 6–8 remain blocked.
+
+Task 5 implementation `fb163b7b6b594e302cf4dffe1dedd055b5f8d9d4` centralizes the exact ordered
+11-asset contract, binds schema-two Defender receipts to explicit origin/status/clock and post-scan
+identity evidence, requires two distinct official Internet-download receipts cross-checked against the
+real asset directory, and scans Setup's held sealed package before any extraction or lifecycle mutation.
+Frozen verification passed ReleaseWorkflow 58/58, PortableRelease 5/5, InstallLifecycle 151/151, parser
+103/103, diff check, and all 39 aggregate suites. No real Defender/build/install/network/release action
+was performed. Task 5 remains review-pending; Tasks 6–8 remain blocked.
diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-5-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-5-report.md
new file mode 100644
index 0000000..eb1ec5d
--- /dev/null
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-5-report.md
@@ -0,0 +1,200 @@
+# Task 5 report: exact assets and dual Defender evidence
+
+## Status
+
+Implemented the deterministic Task 5 release-security foundation in commit
+`fb163b7b6b594e302cf4dffe1dedd055b5f8d9d4`. The build, release-manifest
+validator, Defender checker, promotion validator, Setup bootstrap, portable
+entrypoint, tests, and candidate documentation now share one exact public
+asset contract.
+
+This is candidate infrastructure only. It does not claim a live Defender
+scan, a production build, a published release, stable Windows acceptance, or
+completion of Tasks 6-8. Scoped review is still required.
+
+No real Defender command, official build, installation, uninstall, registry
+or shortcut mutation, network request, GitHub action, restart, reboot, signing,
+tag, push, upload, promotion, or publication was performed. Defender and
+activation tests used temporary files and test-local adapters/functions only.
+
+## Exact public asset authority
+
+`tools/ReleaseAssetContract.psm1` is the single production source for the
+ordered 11-name set:
+
+1. `CodexRemote-fix-2.5.22-windows-x64.zip`
+2. `CodexRemote-fix-2.5.22-windows-x64.zip.sha256.txt`
+3. `CodexRemote-fix-2.5.22-trayhost-provenance.json`
+4. `CodexRemote-fix-2.5.22-payload-manifest.json`
+5. `CodexRemote-fix-2.5.22-release-manifest.json`
+6. `CodexRemote-fix-2.5.22-setup.exe`
+7. `CodexRemote-fix-2.5.22-setup.exe.sha256.txt`
+8. `CodexRemote-fix-2.5.22-setup-provenance.json`
+9. `CodexRemote-fix-2.5.22-setup-payload-manifest.json`
+10. `CodexRemote-fix-2.5.22-setup-destination-inventory.iss`
+11. `CodexRemote-fix-2.5.22-setup-release-manifest.json`
+
+`Test-CcodExactReleaseAssetSet` requires a canonical plain directory with
+exactly those 11 regular non-reparse leaves. It rejects missing, extra,
+case-varied, duplicate, directory, reparse, unsafe-ancestry, noncanonical,
+manifest-order, hash, commit, timestamp, and shared-provenance mutations.
+
+Portable manifest public records are indices `0,1,2,3`, with index `4` as its
+manifest leaf. Setup manifest public records are indices `5,6,2,7,8,9`, with
+index `10` as its manifest leaf. Both distributions bind the same lower-case
+40-hex commit, canonical build timestamp, and TrayHost provenance bytes.
+Checksums bind the exact candidate leaf and bytes. A bounded recursive lexical
+JSON pass rejects duplicate property names at every object depth, including an
+escaped spelling such as `\u0067itCommit`, before deserialization.
+
+`build/build.ps1` imports this module only after the clean-checkout gate,
+derives all 11 paths by their fixed indices, writes the two manifest views,
+then validates the complete exact set. `tools/Test-ReleaseDefender.ps1` also
+uses the central names for its portable and Setup manifest validators.
+
+## Defender receipt contract
+
+`Invoke-CcodReleaseDefenderCheck` now requires the exact candidate, matching
+checksum, explicit matching manifest, expected version/commit, evidence path,
+and one of two origins. Its ordered schema-two receipt has exactly these 25
+fields:
+
+`schemaVersion, assetType, assetName, assetSha256, checksumName,
+checksumSha256, manifestName, manifestSha256, version, gitCommit, origin,
+workflowArtifactIdentity, zoneId, defenderServiceEnabled, antivirusEnabled,
+realTimeProtectionEnabled, defenderPlatformVersion, defenderEngineVersion,
+signatureVersion, signatureUpdatedAtUtc, scanStartedAtUtc,
+scanCompletedAtUtc, detectionCount, outcome, errorCode`.
+
+- `InternetDownload` requires the actual `Zone.Identifier` stream with exactly
+  one `ZoneId` property whose value is `3`. The public tool has no Zone
+  synthesis parameter, and workflow identity must be null.
+- `TrustedWorkflowArtifact` has a null Zone and requires the exact ordered
+  GitHub Actions identity fields `provider, repository, runId, runAttempt,
+  artifactId, artifactName, artifactDigest, gitCommit`. Provider, repository,
+  artifact name, positive integral identifiers, `sha256:<64hex>` digest, and
+  expected commit are all exact.
+- Defender service, antivirus, and real-time protection must be enabled.
+  Platform, engine, signature version, and signature timestamp must be
+  present. The signature can be at most 72 hours old at scan start and at most
+  five minutes in the future. Completion cannot precede start or exceed two
+  hours; no invalid-clock fallback is used.
+- The checker records the pre/post detection difference, requires zero new
+  detections for success, and preserves stable scan/detection/write errors.
+  It revalidates candidate, checksum, manifest, expected commit, hashes, and
+  Internet Zone after the scan and before writing a receipt.
+- Default evidence writing requires an existing canonical plain parent and a
+  new `.json` leaf. It uses a create-new temporary file, durable flush, a
+  second target preflight, no-replace move, and exact cleanup. Existing files,
+  directories, reparse leaves, reparse ancestry, noncanonical paths, and ADS
+  targets are rejected before scanning.
+
+The receipt contains no source path or raw Defender output.
+
+## Promotion authority
+
+`Test-CcodReleasePromotionEvidence` requires both `-EvidenceDirectory` and the
+mandatory authoritative `-AssetDirectory`, plus version and expected commit.
+It first validates the exact 11 assets and their common commit. It then accepts
+exactly these two receipt leaves:
+
+- `CodexRemote-fix-2.5.22-setup.internet-download.defender.json`
+- `CodexRemote-fix-2.5.22-windows-x64.internet-download.defender.json`
+
+Both must be schema-two `InternetDownload`/Zone-3/Completed/zero-detection
+receipts. Setup receipt hashes are compared with actual contract indices
+`5,6,10`; portable receipt hashes are compared with indices `0,1,4`.
+Missing, extra, duplicate, swapped, reused, forged-but-well-formed, field-
+mismatched, or trusted-workflow substitutions fail closed. Trusted workflow
+receipts remain separate CI evidence and cannot satisfy official-download
+promotion.
+
+## Pre-mutation scan ordering
+
+- Setup holds the already verified package seal, scans the canonical package
+  path returned by that seal, and only then creates the extraction temp root,
+  expands payload bytes, opens activation state, writes any activation log or
+  receipt, or launches the lifecycle worker. The production-shaped failure
+  injection proves no package temp root or product-state entry appears.
+- Portable retains `manifest validate -> Defender scan -> manifest revalidate
+  -> copy -> lifecycle`. Its local gate now records the same service/AV/
+  real-time/platform/engine/signature/timestamp facts. A real entrypoint copy
+  with a throwing test-local scan proves no child or lifecycle state is
+  created; existing post-scan and final-copy race tests remain green.
+
+## Candidate documentation
+
+README and README.zh-CN remain candidate-scoped. The old `always published`,
+`始终发布`, and `已验证……均可用` claims were removed. The exact 11-name list is
+present once in each release section inside a collapsed `<details>` block, and
+Defender receipts are explicitly evidence rather than public assets. No
+version-specific What's New section was added. CHANGELOG adds one concise
+English and Chinese bullet describing the enforced dual-download evidence.
+
+## RED evidence
+
+The following failures were observed before the corresponding production
+implementation:
+
+- Asset contract: exit `1`, `ASSERT_TRUE: central release asset contract
+  module exists`.
+- Defender v2 API: exit `1`,
+  `NamedParameterNotFound,Invoke-CcodReleaseDefenderCheck` for
+  `-CandidatePath`.
+- Promotion: exit `1`, missing central asset module.
+- Evidence writer: exit `1`, missing Defender `-CandidatePath` API.
+- Setup ordering: exit `1`, exact scan call count expected `1`, actual `0`.
+- Documentation: exit `1`, `English README makes no unconditional publication
+  or verification claim`.
+- Authoritative promotion follow-up: exit `1`,
+  `NamedParameterNotFound,Test-CcodReleasePromotionEvidence` for mandatory
+  `-AssetDirectory`; the old shape could not compare receipts with real
+  assets.
+- Lexical JSON follow-up: exit `1`, `ASSERT_THROWS: expected
+  CCOD_RELEASE_ASSET_SET_INVALID`; a duplicate top-level property was folded.
+- Zone follow-up: exit `1`, `ASSERT_THROWS: expected
+  CCOD_DEFENDER_ZONE_REQUIRED`; the first matching ZoneId line was accepted.
+- Post-scan identity follow-up: exit `1`, `ASSERT_THROWS: expected
+  CCOD_RELEASE_ASSET_HASH_MISMATCH`; candidate mutation during the fake scan
+  reached receipt creation.
+
+During GREEN iteration, the first asset-path implementation looped at the
+drive root after trimming `C:\` to `C:`; the session was interrupted and root
+termination was corrected. The first default evidence writer closure could
+not resolve its validator and was corrected without weakening preflight.
+Two test-oracle defects were also corrected: base names were no longer counted
+inside checksum names, and restoration of a mutated EXE explicitly restored
+its test Zone ADS before later cases.
+
+## Frozen GREEN evidence
+
+The final source was frozen at pre-commit diff hash
+`55eaabfc6770bee68afda76c6996ff41d569e2f0`. From that unchanged source:
+
+- `powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File
+  tests\persistence\ReleaseWorkflow.SelfTest.ps1` exited `0`; all 58 declared
+  cases passed, including exact assets, dual promotion, origins, full status,
+  unique Zone, clocks, post-scan identity, create-only evidence, Setup order,
+  portable failure/races, build wiring, and bilingual documentation.
+- `powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File
+  tests\persistence\PortableRelease.SelfTest.ps1` exited `0`; `5/5`.
+- `powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File
+  tests\persistence\InstallLifecycle.SelfTest.ps1` exited `0`; `151/151`.
+- `powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File
+  tests\PersistenceSelfTest.ps1` exited `0`; the sorted aggregate completed
+  all 39 registered persistence suites.
+- PowerShell parser checks covered all 103 repository `.ps1`/`.psm1` files
+  with `PARSER_FAILURES=0`.
+- `git diff --check` exited `0`; only checkout LF-to-CRLF notices appeared.
+- Before commit there were zero active worktree self-test children and zero
+  matching Task 5 temporary directories. Two exact directories left by the
+  intentionally interrupted early RED run were inspected as plain temp
+  directories and removed before this check.
+
+## Implementation commit and review boundary
+
+- Implementation: `fb163b7b6b594e302cf4dffe1dedd055b5f8d9d4`
+  (`feat: require dual Defender release evidence`).
+- Plan/brief baseline: `1109854`.
+- Tasks 6-8 remain blocked. Task 5 needs a scoped review of
+  `1109854..fb163b7` before it can be marked complete.

From ec97b8cc0df8d2155249bbb9368c0dac902ef986 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 12:39:14 +0800
Subject: [PATCH 156/187] docs: plan Defender authority review fixes

---
 .../progress.md                                      |  5 ++++-
 .../task-5-fix1-brief.md                             | 12 ++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)
 create mode 100644 .superpowers/sdd/2026-08-29-v2522-immutable-generation/task-5-fix1-brief.md

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md
index 318f237..856b602 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md
@@ -379,4 +379,7 @@ identity evidence, requires two distinct official Internet-download receipts cro
 real asset directory, and scans Setup's held sealed package before any extraction or lifecycle mutation.
 Frozen verification passed ReleaseWorkflow 58/58, PortableRelease 5/5, InstallLifecycle 151/151, parser
 103/103, diff check, and all 39 aggregate suites. No real Defender/build/install/network/release action
-was performed. Task 5 remains review-pending; Tasks 6–8 remain blocked.
+was performed. Task 5 scoped review FAIL (1 Critical, 3 Important): the public Defender function exposes
+full-fact adapters; the central contract shallow-validates nested payload/provenance; asset identity is not
+handle-held across scan/promotion; and receipt writing lacks production read-back. Task 5 fix round 1 is in
+progress. Tasks 6–8 remain blocked.
diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-5-fix1-brief.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-5-fix1-brief.md
new file mode 100644
index 0000000..263f2f1
--- /dev/null
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-5-fix1-brief.md
@@ -0,0 +1,12 @@
+# Task 5 fix round 1 — non-synthesizable Defender authority
+
+Read Task 5's report and scoped review. Fix all four findings without changing the 11 public names, receipt schema, candidate docs, or Setup/portable ordering.
+
+## Required RED -> GREEN
+
+1. Remove `Adapters` from the public `Invoke-CcodReleaseDefenderCheck` interface and remove the public script-library bypass. Put adapter-taking logic behind a non-exported module core used only through module-scope tests. Production adapters must resolve the real Defender cmdlets and actual Zone stream; no public parameter/capability may replace Zone, Defender status, scan, detections, clock, hashes, or writer. Add a RED that enumerates public parameters/exports and attempts the old forged receipt path.
+2. Move or share deep portable/Setup manifest validation with `ReleaseAssetContract.psm1`. `Test-CcodExactReleaseAssetSet` and promotion must reject malformed nested payload/provenance/inventory, wrong file lengths/hashes, ZIP entry/root-launcher mismatch, and Setup nested payload/provenance mismatch even when outer manifests and receipt hashes are self-consistent. Replace bogus baseline fixture hashes with real internally consistent bytes and add one mutation per nested binding.
+3. Hold read-only, no-write/no-delete shared handles for candidate/checksum/manifest/Zone from initial proof through scan, receipt durable read-back, and return. Promotion must hold all 11 asset handles and both receipt handles across its complete decision, revalidate identity/hash and exact directory membership before return, and reject scan ABA, post-revalidation replacement, and promotion-time replacement. Use canonical final-path/file-ID/reparse/ADS/multilink checks where the existing native helpers support them.
+4. Serialize one canonical receipt byte sequence, write create-only, flush, no-replace publish, reopen the final leaf, verify regular/nonreparse/default-stream identity, strict UTF-8/duplicate-free/exact 25 fields, bytes/hash and every field against the expected receipt, then return. A no-op, corrupting, wrong-target, stale-object or write-then-replace adapter must fail. Failed scan receipts require the same read-back before the stable scan error is returned.
+
+Run ReleaseWorkflow, PortableRelease, InstallLifecycle, all changed parsers, `git diff --check`, and the complete persistence aggregate from frozen source. Commit implementation and evidence separately and request a scoped fix-round review. Do not run real Defender/build/network/install/reboot/release operations. Tasks 6–8 remain blocked.

From 9f8a9e7f4aa8ba6028941026cbca776cbd908610 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 15:09:30 +0800
Subject: [PATCH 157/187] fix: close Defender authority review gaps

Keep public Defender surfaces adapter-free, pin nested payload and provenance identity, and hold asset and receipt handles through scan, promotion, and durable receipt read-back.
---
 build/build.ps1                               |   3 -
 tests/Validate.ps1                            |   1 +
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 370 ++++----
 tools/ReleaseAssetContract.psm1               | 400 ++++++++-
 tools/ReleaseDefender.psm1                    | 147 ++++
 tools/Test-ReleaseDefender.ps1                | 813 +-----------------
 6 files changed, 767 insertions(+), 967 deletions(-)
 create mode 100644 tools/ReleaseDefender.psm1

diff --git a/build/build.ps1 b/build/build.ps1
index 13b4b06..42bd309 100644
--- a/build/build.ps1
+++ b/build/build.ps1
@@ -490,9 +490,6 @@ try {
         )
     }
     Write-CcodBuildUtf8 -Path $releaseManifest -Text (($releaseRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine)
-    $releaseValidationTool = Join-Path $repoRoot 'tools\Test-ReleaseDefender.ps1'
-    if (-not (Test-Path -LiteralPath $releaseValidationTool -PathType Leaf)) { throw "Release manifest validator is missing: $releaseValidationTool" }
-    . $releaseValidationTool -Library
     Test-CcodReleaseAssetManifest -ManifestPath $releaseManifest -AssetDirectory $dist -ExpectedVersion $Version | Out-Null
 } finally {
     if ([IO.Directory]::Exists($stageRoot)) {
diff --git a/tests/Validate.ps1 b/tests/Validate.ps1
index 3acedc3..dd43a7b 100644
--- a/tests/Validate.ps1
+++ b/tests/Validate.ps1
@@ -149,6 +149,7 @@ foreach ($required in @(
     'tests\persistence\InstalledLifecycleHarness.SelfTest.ps1',
     'tests\persistence\ReleaseWorkflow.SelfTest.ps1',
     'tools\ReleaseAssetContract.psm1',
+    'tools\ReleaseDefender.psm1',
     'tools\Test-ReleaseDefender.ps1',
     'tests\persistence\WorkerRuntime.SelfTest.ps1'
 )) {
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index f1ee7d3..4446065 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -3,9 +3,12 @@ $ErrorActionPreference = 'Stop'
 
 $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
 $defenderPath = Join-Path $repositoryRoot 'tools\Test-ReleaseDefender.ps1'
+$releaseDefenderModulePath = Join-Path $repositoryRoot 'tools\ReleaseDefender.psm1'
 $assetContractPath = Join-Path $repositoryRoot 'tools\ReleaseAssetContract.psm1'
 
-function Invoke-CcodTask5Test([string]$Id,[string]$Name,[scriptblock]$Action){if(-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK5_RED_CASE)-and$env:CCOD_TASK5_RED_CASE-cne$Id){return};Invoke-CcodTest $Name $Action}
+$script:CcodReleaseBaseInvokeTest=${function:Invoke-CcodTest}
+function Invoke-CcodTest([string]$Name,[scriptblock]$Action){if(-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK5_RED_CASE)){return};&$script:CcodReleaseBaseInvokeTest $Name $Action}
+function Invoke-CcodTask5Test([string]$Id,[string]$Name,[scriptblock]$Action){if(-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK5_RED_CASE)-and$env:CCOD_TASK5_RED_CASE-cne$Id){return};&$script:CcodReleaseBaseInvokeTest $Name $Action}
 
 function ConvertFrom-CcodWorkflowScalar {
     param([Parameter(Mandatory)][AllowEmptyString()][string]$Value)
@@ -164,68 +167,6 @@ function Assert-CcodAuthenticatedTraceWorkflowContract {
     }
 }
 
-function New-CcodReleaseFixture {
-    $root = Join-Path $env:TEMP ('ccod-release-workflow-' + [guid]::NewGuid().ToString('N'))
-    $null = [IO.Directory]::CreateDirectory($root)
-    $installer = Join-Path $root 'CodexRemote-fix-2.5.0-setup.exe'
-    $commit = 'a' * 40
-    $payloadInput = Join-Path $root 'CodexRemote-fix-2.5.0-setup-payload-manifest.json'
-    $inventoryInput = Join-Path $root 'CodexRemote-fix-2.5.0-setup-destination-inventory.iss'
-    $payloadInputRecord = [ordered]@{schemaVersion=1;projectVersion='2.5.0';files=@([ordered]@{path='package.json';length=[int64]1;sha256=('d'*64)})}
-    [IO.File]::WriteAllText($payloadInput,($payloadInputRecord|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
-    [IO.File]::WriteAllText($inventoryInput,"procedure AddCcodExpectedSetupDirectories(Directories: TStrings);`r`nbegin`r`nend;`r`n",[Text.UTF8Encoding]::new($false))
-    $payloadHash = Get-CcodTestFileSha256 -Path $payloadInput
-    $typeName = 'SetupFixture' + [guid]::NewGuid().ToString('N')
-    $setupSource = @"
-using System.Reflection;
-[assembly: AssemblyVersion("2.5.0.0")]
-[assembly: AssemblyFileVersion("2.5.0.0")]
-[assembly: AssemblyInformationalVersion("2.5.0.0")]
-[assembly: AssemblyProduct("CodexRemote-fix")]
-[assembly: AssemblyTitle("CCODSETUP 2.5.0")]
-[assembly: AssemblyDescription("CCODSETUP 2.5.0")]
-[assembly: AssemblyCompany("$commit")]
-[assembly: AssemblyCopyright("$payloadHash")]
-public static class $typeName { public static int Main() { return 0; } }
-"@
-    Add-Type -TypeDefinition $setupSource -Language CSharp -OutputAssembly $installer -OutputType ConsoleApplication
-    $checksum = "$installer.sha256.txt"
-    $installerHash = Get-CcodTestFileSha256 -Path $installer
-    [IO.File]::WriteAllText($checksum, ("{0} *{1}`r`n" -f $installerHash, [IO.Path]::GetFileName($installer)), [Text.UTF8Encoding]::new($false))
-    $trayHost = Join-Path $root 'CodexRemote-fix-2.5.0-trayhost-provenance.json'
-    [IO.File]::WriteAllText($trayHost, ('{"schemaVersion":1,"product":"CodexRemote-fix","version":"2.5.0","gitCommit":"' + $commit + '","buildTimestampUtc":"2026-08-24T00:00:00.0000000Z"}'), [Text.UTF8Encoding]::new($false))
-    $setupProvenance = Join-Path $root 'CodexRemote-fix-2.5.0-setup-provenance.json'
-    $setupProvenanceRecord = [ordered]@{
-        schemaVersion=1;product='CodexRemote-fix';version='2.5.0';gitCommit=$commit;buildTimestampUtc='2026-08-24T00:00:00.0000000Z'
-        payloadManifest=[ordered]@{name='installer-payload.manifest.json';length=[int64](Get-Item -LiteralPath $payloadInput).Length;sha256=$payloadHash;fileCount=1}
-        buildInputs=[ordered]@{innoTemplateSha256=$(Get-CcodTestFileSha256 -Path (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss'));destinationInventorySha256=$(Get-CcodTestFileSha256 -Path $inventoryInput);compilerSha256='PLACEHOLDER';compilerFileVersion='PLACEHOLDER'}
-        peContract=[ordered]@{fileVersion='2.5.0.0';productVersion='2.5.0.0';productName='CodexRemote-fix';fileDescription='CCODSETUP 2.5.0';companyName=$commit;legalCopyright=$payloadHash}
-    }
-    $iscc = @((Join-Path $env:LOCALAPPDATA 'Programs\Inno Setup 6\ISCC.exe'),(Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'),(Join-Path $env:ProgramFiles 'Inno Setup 6\ISCC.exe')) | Where-Object { $_ -and [IO.File]::Exists($_) } | Select-Object -First 1
-    $setupProvenanceRecord.buildInputs.compilerSha256 = Get-CcodTestFileSha256 -Path $iscc
-    $setupProvenanceRecord.buildInputs.compilerFileVersion = [string]([Diagnostics.FileVersionInfo]::GetVersionInfo($iscc).FileVersion)
-    [IO.File]::WriteAllText($setupProvenance,(($setupProvenanceRecord|ConvertTo-Json -Depth 8)+"`n"),[Text.UTF8Encoding]::new($false))
-    $manifest = Join-Path $root 'CodexRemote-fix-2.5.0-setup-release-manifest.json'
-    $assets = @(
-        [ordered]@{ name = [IO.Path]::GetFileName($installer); sha256 = $installerHash },
-        [ordered]@{ name = [IO.Path]::GetFileName($checksum); sha256 = Get-CcodTestFileSha256 -Path $checksum },
-        [ordered]@{ name = [IO.Path]::GetFileName($trayHost); sha256 = Get-CcodTestFileSha256 -Path $trayHost },
-        [ordered]@{ name = [IO.Path]::GetFileName($setupProvenance); sha256 = Get-CcodTestFileSha256 -Path $setupProvenance },
-        [ordered]@{ name = [IO.Path]::GetFileName($payloadInput); sha256 = Get-CcodTestFileSha256 -Path $payloadInput },
-        [ordered]@{ name = [IO.Path]::GetFileName($inventoryInput); sha256 = Get-CcodTestFileSha256 -Path $inventoryInput }
-    )
-    $record = [ordered]@{
-        schemaVersion = 1
-        product = 'CodexRemote-fix'
-        version = '2.5.0'
-        gitCommit = $commit
-        buildTimestampUtc = '2026-08-24T00:00:00.0000000Z'
-        assets = $assets
-    }
-    [IO.File]::WriteAllText($manifest, ($record | ConvertTo-Json -Depth 8), [Text.UTF8Encoding]::new($false))
-    return [pscustomobject]@{ Root = $root; Installer = $installer; Checksum = $checksum; TrayHost = $trayHost; SetupProvenance = $setupProvenance; PayloadInput=$payloadInput;InventoryInput=$inventoryInput; Manifest = $manifest; PayloadManifestSha256 = $payloadHash }
-}
-
 function New-CcodPortableReleaseFixture {
     $root = Join-Path $env:TEMP ('ccod-portable-release-workflow-' + [guid]::NewGuid().ToString('N'))
     $stage = Join-Path $root 'stage'
@@ -250,7 +191,8 @@ function New-CcodPortableReleaseFixture {
     $bundleHash = Get-CcodTestFileSha256 -Path $bundle
     [IO.File]::WriteAllText($checksum,("$bundleHash *$([IO.Path]::GetFileName($bundle))"),[Text.UTF8Encoding]::new($false))
     $provenance = Join-Path $root 'CodexRemote-fix-2.5.6-trayhost-provenance.json'
-    [IO.File]::WriteAllText($provenance,([ordered]@{schemaVersion=1;product='CodexRemote-fix';version='2.5.6';gitCommit=$commit;buildTimestampUtc=$timestamp}|ConvertTo-Json),[Text.UTF8Encoding]::new($false))
+    $tray=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version='2.5.6';gitCommit=$commit;buildTimestampUtc=$timestamp;targetFramework='net48';compiler=[ordered]@{name='csc.exe';sha256=('1'*64)};referenceRoot='locked-net48';sourceFiles=@([ordered]@{name='AssemblyInfo.cs';sha256=('2'*64)},[ordered]@{name='WindowsTrayHostRuntime.cs';sha256=('3'*64)});iconSha256=('4'*64);manifestSha256=('5'*64);configSha256=('6'*64);artifactSha256=('7'*64);configArtifactSha256=('8'*64)}
+    [IO.File]::WriteAllText($provenance,($tray|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
     $payloadAsset = Join-Path $root 'CodexRemote-fix-2.5.6-payload-manifest.json'
     [IO.File]::Copy((Join-Path $stage 'payload-manifest.json'),$payloadAsset,$false)
     $manifest = Join-Path $root 'CodexRemote-fix-2.5.6-release-manifest.json'
@@ -284,23 +226,28 @@ function Get-CcodTask5ExpectedAssetNames([string]$Version='2.5.22'){
 }
 
 function New-CcodTask5ExactAssetFixture {
-    $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task5-assets-'+[guid]::NewGuid().ToString('N'));$outside=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task5-assets-outside-'+[guid]::NewGuid().ToString('N'));[IO.Directory]::CreateDirectory($root)|Out-Null;[IO.Directory]::CreateDirectory($outside)|Out-Null
+    $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task5-assets-'+[guid]::NewGuid().ToString('N'));$outside=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task5-assets-outside-'+[guid]::NewGuid().ToString('N'));$work=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task5-assets-work-'+[guid]::NewGuid().ToString('N'));foreach($directory in @($root,$outside,$work)){[IO.Directory]::CreateDirectory($directory)|Out-Null}
     $version='2.5.22';$commit='c'*40;$timestamp='2030-02-03T04:05:06.0000000Z';$names=Get-CcodTask5ExpectedAssetNames $version
-    $stage=Join-Path $root '.stage';$payload=Join-Path $stage 'payload';[IO.Directory]::CreateDirectory($payload)|Out-Null
-    [IO.File]::WriteAllText((Join-Path $stage 'Install-CodexRemote-fix.ps1'),'Write-Output portable',[Text.UTF8Encoding]::new($false));[IO.File]::WriteAllBytes((Join-Path $stage 'CodexRemote-fix.exe'),[byte[]](1,2,3,4));[IO.File]::WriteAllText((Join-Path $stage 'CodexRemote-fix.exe.config'),'<configuration/>',[Text.UTF8Encoding]::new($false));[IO.File]::WriteAllText((Join-Path $payload 'hello.txt'),'payload',[Text.UTF8Encoding]::new($false))
-    $payloadFile=Join-Path $payload 'hello.txt';$payloadRecord=[ordered]@{path='hello.txt';length=[int64](Get-Item $payloadFile).Length;sha256=Get-CcodTestFileSha256 $payloadFile};$payloadManifest=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;files=@($payloadRecord)}
-    [IO.File]::WriteAllText((Join-Path $stage 'payload-manifest.json'),($payloadManifest|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false));Add-Type -AssemblyName System.IO.Compression.FileSystem -ErrorAction Stop;[IO.Compression.ZipFile]::CreateFromDirectory($stage,(Join-Path $root $names[0]),[IO.Compression.CompressionLevel]::Optimal,$false);Remove-Item -LiteralPath $stage -Recurse -Force
-    [IO.File]::WriteAllText((Join-Path $root $names[1]),((Get-CcodTestFileSha256 (Join-Path $root $names[0]))+' *'+$names[0]),[Text.UTF8Encoding]::new($false))
-    [IO.File]::WriteAllText((Join-Path $root $names[2]),([ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp}|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))
-    [IO.File]::WriteAllText((Join-Path $root $names[3]),($payloadManifest|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
-    [IO.File]::WriteAllText((Join-Path $root $names[5]),'setup-bytes',[Text.UTF8Encoding]::new($false));[IO.File]::WriteAllText((Join-Path $root $names[6]),((Get-CcodTestFileSha256 (Join-Path $root $names[5]))+' *'+$names[5]),[Text.UTF8Encoding]::new($false))
-    [IO.File]::WriteAllText((Join-Path $root $names[7]),([ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;payloadManifest=[ordered]@{name='installer-payload.manifest.json';sha256=('d'*64)}}|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
-    [IO.File]::WriteAllText((Join-Path $root $names[8]),([ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;payloadManifest=[ordered]@{name='installer-payload.manifest.json';sha256=('d'*64)};files=@([ordered]@{path='package.json';length=[int64]1;sha256=('e'*64)})}|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false));[IO.File]::WriteAllText((Join-Path $root $names[9]),"procedure AddCcodExpectedSetupDirectories(Directories: TStrings);`r`nbegin`r`nend;`r`n",[Text.UTF8Encoding]::new($false))
-    $portableAssets=@([ordered]@{name=$names[0];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[0])},[ordered]@{name=$names[1];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[1])},[ordered]@{name=$names[2];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[2])},[ordered]@{name=$names[3];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[3])},[ordered]@{name='CodexRemote-fix.exe';sha256=('1'*64)},[ordered]@{name='CodexRemote-fix.exe.config';sha256=('2'*64)})
-    [IO.File]::WriteAllText((Join-Path $root $names[4]),([ordered]@{schemaVersion=2;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;distribution='portable-zip';assets=$portableAssets}|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
-    $setupAssets=@([ordered]@{name=$names[5];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[5])},[ordered]@{name=$names[6];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[6])},[ordered]@{name=$names[2];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[2])},[ordered]@{name=$names[7];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[7])},[ordered]@{name=$names[8];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[8])},[ordered]@{name=$names[9];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[9])})
-    [IO.File]::WriteAllText((Join-Path $root $names[10]),([ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;assets=$setupAssets}|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
-    [pscustomobject]@{Root=$root;OriginalRoot=$root;Outside=$outside;Names=$names;Version=$version;GitCommit=$commit;Timestamp=$timestamp}
+    try{
+        $stage=Join-Path $work 'portable-stage';$payload=Join-Path $stage 'payload';[IO.Directory]::CreateDirectory($payload)|Out-Null
+        $launcher=Join-Path $stage 'CodexRemote-fix.exe';$launcherConfig=Join-Path $stage 'CodexRemote-fix.exe.config';[IO.File]::WriteAllText((Join-Path $stage 'Install-CodexRemote-fix.ps1'),'Write-Output portable',[Text.UTF8Encoding]::new($false));[IO.File]::WriteAllBytes($launcher,[byte[]](1,2,3,4,5));[IO.File]::WriteAllText($launcherConfig,'<configuration/>',[Text.UTF8Encoding]::new($false));[IO.File]::WriteAllText((Join-Path $payload 'hello.txt'),'payload',[Text.UTF8Encoding]::new($false))
+        $payloadFile=Join-Path $payload 'hello.txt';$payloadRecord=[ordered]@{path='hello.txt';length=[int64](Get-Item $payloadFile).Length;sha256=Get-CcodTestFileSha256 $payloadFile};$payloadManifest=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;files=@($payloadRecord)}
+        [IO.File]::WriteAllText((Join-Path $stage 'payload-manifest.json'),($payloadManifest|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false));Add-Type -AssemblyName System.IO.Compression.FileSystem -ErrorAction Stop;[IO.Compression.ZipFile]::CreateFromDirectory($stage,(Join-Path $root $names[0]),[IO.Compression.CompressionLevel]::Optimal,$false);[IO.File]::WriteAllText((Join-Path $root $names[1]),((Get-CcodTestFileSha256 (Join-Path $root $names[0]))+' *'+$names[0]),[Text.UTF8Encoding]::new($false));[IO.File]::WriteAllText((Join-Path $root $names[3]),($payloadManifest|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+        $tray=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;targetFramework='net48';compiler=[ordered]@{name='csc.exe';sha256=('1'*64)};referenceRoot='locked-net48';sourceFiles=@([ordered]@{name='AssemblyInfo.cs';sha256=('2'*64)},[ordered]@{name='WindowsTrayHostRuntime.cs';sha256=('3'*64)});iconSha256=('4'*64);manifestSha256=('5'*64);configSha256=('6'*64);artifactSha256=('7'*64);configArtifactSha256=('8'*64)};Write-CcodTask5Json -Path (Join-Path $root $names[2]) -Value $tray
+        $portableAssets=@([ordered]@{name=$names[0];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[0])},[ordered]@{name=$names[1];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[1])},[ordered]@{name=$names[2];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[2])},[ordered]@{name=$names[3];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[3])},[ordered]@{name='CodexRemote-fix.exe';sha256=Get-CcodTestFileSha256 $launcher},[ordered]@{name='CodexRemote-fix.exe.config';sha256=Get-CcodTestFileSha256 $launcherConfig});Write-CcodTask5Json -Path (Join-Path $root $names[4]) -Value ([ordered]@{schemaVersion=2;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;distribution='portable-zip';assets=$portableAssets})
+        $packageManifest=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;payloadManifest=[ordered]@{name='installer-payload.manifest.json';length=[int64]123;sha256=('9'*64)};files=@([ordered]@{path='Install-CodexControlOtherDevices.ps1';length=[int64]321;sha256=('a'*64)},[ordered]@{path='package.json';length=[int64]42;sha256=('b'*64)})};Write-CcodTask5Json -Path (Join-Path $root $names[8]) -Value $packageManifest
+        $inventory="procedure AddCcodExpectedSetupDirectories(Directories: TStrings);`r`nbegin`r`n  Directories.Add('runtime');`r`nend;`r`n";[IO.File]::WriteAllText((Join-Path $root $names[9]),$inventory,[Text.UTF8Encoding]::new($false));$packageManifestHash=Get-CcodTestFileSha256 (Join-Path $root $names[8]);$packageHash='d'*64;$bootstrapHash='e'*64
+        $provenance=[ordered]@{schemaVersion=2;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;installerPackage=[ordered]@{name='installer-package.zip';length=[int64]456;sha256=$packageHash};installerPackageManifest=[ordered]@{name='installer-package.manifest.json';length=[int64](Get-Item (Join-Path $root $names[8])).Length;sha256=$packageManifestHash;fileCount=[int]2;payloadManifestSha256=('9'*64)};activationBootstrap=[ordered]@{name='Activate-CcodRemoteFix.ps1';length=[int64]789;sha256=$bootstrapHash};buildInputs=[ordered]@{innoTemplateSha256=('f'*64);destinationInventorySha256=Get-CcodTestFileSha256 (Join-Path $root $names[9]);compilerSha256=('1'*64);compilerFileVersion='6.7.3'};peContract=[ordered]@{fileVersion="$version.0";packageManifestFirst=$packageManifestHash.Substring(0,32);packageManifestLast=$packageManifestHash.Substring(32,32);bootstrapFirst=$bootstrapHash.Substring(0,32);bootstrapLast=$bootstrapHash.Substring(32,32);companyName=$commit;legalCopyright=$packageHash}};Write-CcodTask5Json -Path (Join-Path $root $names[7]) -Value $provenance
+        $iscc=@((Join-Path $env:LOCALAPPDATA 'Programs\Inno Setup 6\ISCC.exe'),(Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'),(Join-Path $env:ProgramFiles 'Inno Setup 6\ISCC.exe'))|Where-Object{$_-and[IO.File]::Exists($_)}|Select-Object -First 1;if(-not$iscc){throw 'Inno Setup 6 required for Task5 exact fixture'};$iss=Join-Path $work 'fixture.iss';$out=Join-Path $work 'setup-output';[IO.Directory]::CreateDirectory($out)|Out-Null
+        $issText="[Setup]`r`nAppId={{11111111-2222-4333-8444-555555555555}`r`nAppName=CodexRemote-fix`r`nAppVersion=$version`r`nDefaultDirName={tmp}\CcodFixture`r`nCreateAppDir=no`r`nUninstallable=no`r`nPrivilegesRequired=lowest`r`nVersionInfoVersion=$version.0`r`nVersionInfoTextVersion=$version.0`r`nVersionInfoProductName=$($bootstrapHash.Substring(32,32))`r`nVersionInfoProductTextVersion=$($packageManifestHash.Substring(0,32))`r`nVersionInfoDescription=$($packageManifestHash.Substring(32,32))`r`nVersionInfoCompany=$commit`r`nVersionInfoCopyright=$packageHash`r`nVersionInfoOriginalFileName=$($bootstrapHash.Substring(0,32))`r`nOutputBaseFilename=$([IO.Path]::GetFileNameWithoutExtension($names[5]))`r`nCompression=none`r`nDisableProgramGroupPage=yes`r`n";[IO.File]::WriteAllText($iss,$issText,[Text.UTF8Encoding]::new($false));$compile=@(&$iscc "/O$out" $iss 2>&1);if($LASTEXITCODE-ne0){throw "Task5 fixture ISCC failed: $($compile-join' ')"};[IO.File]::Copy((Join-Path $out $names[5]),(Join-Path $root $names[5]),$false)
+        [IO.File]::WriteAllText((Join-Path $root $names[6]),((Get-CcodTestFileSha256 (Join-Path $root $names[5]))+' *'+$names[5]),[Text.UTF8Encoding]::new($false));$setupAssets=@([ordered]@{name=$names[5];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[5])},[ordered]@{name=$names[6];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[6])},[ordered]@{name=$names[2];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[2])},[ordered]@{name=$names[7];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[7])},[ordered]@{name=$names[8];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[8])},[ordered]@{name=$names[9];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[9])});Write-CcodTask5Json -Path (Join-Path $root $names[10]) -Value ([ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;assets=$setupAssets})
+        return [pscustomobject]@{Root=$root;OriginalRoot=$root;Outside=$outside;Names=$names;Version=$version;GitCommit=$commit;Timestamp=$timestamp}
+    }catch{foreach($path in @($root,$outside)){if(Test-Path $path){Remove-Item -LiteralPath $path -Recurse -Force -ErrorAction SilentlyContinue}};throw}finally{if(Test-Path $work){Remove-Item -LiteralPath $work -Recurse -Force -ErrorAction SilentlyContinue}}
+}
+
+function Copy-CcodTask5ExactAssetFixture {
+    param([Parameter(Mandatory)]$Source)
+    $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task5-assets-copy-'+[guid]::NewGuid().ToString('N'));$outside=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task5-assets-outside-'+[guid]::NewGuid().ToString('N'));[IO.Directory]::CreateDirectory($root)|Out-Null;[IO.Directory]::CreateDirectory($outside)|Out-Null;foreach($name in $Source.Names){[IO.File]::Copy((Join-Path $Source.Root $name),(Join-Path $root $name),$false)};[pscustomobject]@{Root=$root;OriginalRoot=$root;Outside=$outside;Names=$Source.Names;Version=$Source.Version;GitCommit=$Source.GitCommit;Timestamp=$Source.Timestamp}
 }
 
 function Remove-CcodTask5ExactAssetFixture($Fixture){foreach($path in @($Fixture.Root,$Fixture.OriginalRoot,$Fixture.Outside)){if([string]::IsNullOrWhiteSpace([string]$path)){continue};$full=[IO.Path]::GetFullPath([string]$path);$temp=[IO.Path]::GetFullPath([IO.Path]::GetTempPath()).TrimEnd('\')+'\';if(-not$full.StartsWith($temp,[StringComparison]::OrdinalIgnoreCase)){throw 'refusing non-temp asset fixture cleanup'};if(Test-Path -LiteralPath $full){Remove-Item -LiteralPath $full -Recurse -Force}}}
@@ -311,18 +258,31 @@ function New-CcodTask5DefenderStatus {
 
 function New-CcodTask5DefenderAdapterFixture {
     param($Status=(New-CcodTask5DefenderStatus),[datetime]$Started=([datetime]::Parse('2030-02-03T04:05:06Z').ToUniversalTime()),$Completed=([datetime]::Parse('2030-02-03T04:05:07Z').ToUniversalTime()),[switch]$ScanThrows,[switch]$Detects,[switch]$WriteThrows)
-    $state=[pscustomobject]@{Capture=$null;Clock=0;Threat=0;Calls=[Collections.Generic.List[string]]::new()}
+    $state=[pscustomobject]@{Clock=0;Threat=0;Calls=[Collections.Generic.List[string]]::new()}
     $adapters=@{
-        GetFileSha256={param($Path)$state.Calls.Add('Hash');Get-CcodTestFileSha256 $Path}.GetNewClosure()
         GetDefenderStatus={ $state.Calls.Add('Status');$Status }.GetNewClosure()
         StartCustomScan={param($Path)$state.Calls.Add('Scan');if($ScanThrows){throw 'fixture scan failure'}}.GetNewClosure()
         GetThreatDetections={$state.Calls.Add('Threat');$state.Threat++;if($Detects-and$state.Threat-gt1){@([pscustomobject]@{ThreatID=99;InitialDetectionTime='2030-02-03T04:05:06.0000000Z';Resources=@('redacted')})}else{@()}}.GetNewClosure()
         GetUtcNow={$state.Calls.Add('Clock');$state.Clock++;if($state.Clock-eq1){$Started}else{$Completed}}.GetNewClosure()
-        WriteReceipt={param($Path,$Receipt)$state.Calls.Add('Write');if($WriteThrows){throw 'fixture evidence write failure'};$state.Capture=(($Receipt|ConvertTo-Json -Depth 12 -Compress)|ConvertFrom-Json);$Path}.GetNewClosure()
     }
+    if($WriteThrows){$adapters.PublishReceiptBytes={param($Directory,$Leaf,$Bytes)$state.Calls.Add('Write');throw 'fixture evidence write failure'}.GetNewClosure()}
     [pscustomobject]@{Adapters=$adapters;State=$state}
 }
 
+function Get-CcodTask5ReleaseDefenderModule {
+    $module=@(Get-Module|Where-Object{$_.Path-ceq[IO.Path]::GetFullPath($releaseDefenderModulePath)})|Select-Object -First 1
+    if($null-eq$module){$module=Import-Module $releaseDefenderModulePath -Force -PassThru -DisableNameChecking}
+    return $module
+}
+
+function Invoke-CcodTask5DefenderCore {
+    param([string]$CandidatePath,[string]$ChecksumPath,[string]$ManifestPath,[string]$Origin,$WorkflowArtifactIdentity,[string]$ExpectedVersion,[string]$ExpectedGitCommit,[string]$EvidencePath,[hashtable]$Adapters)
+    $module=Get-CcodTask5ReleaseDefenderModule
+    &$module {param($CandidatePath,$ChecksumPath,$ManifestPath,$Origin,$WorkflowArtifactIdentity,$ExpectedVersion,$ExpectedGitCommit,$EvidencePath,$Adapters)Invoke-CcodReleaseDefenderCheckCore -CandidatePath $CandidatePath -ChecksumPath $ChecksumPath -ManifestPath $ManifestPath -Origin $Origin -WorkflowArtifactIdentity $WorkflowArtifactIdentity -ExpectedVersion $ExpectedVersion -ExpectedGitCommit $ExpectedGitCommit -EvidencePath $EvidencePath -Adapters $Adapters} $CandidatePath $ChecksumPath $ManifestPath $Origin $WorkflowArtifactIdentity $ExpectedVersion $ExpectedGitCommit $EvidencePath $Adapters
+}
+
+function Get-CcodTask5DefaultDefenderAdapters {$module=Get-CcodTask5ReleaseDefenderModule;&$module {Get-CcodReleaseDefenderDefaultAdapters}}
+
 function New-CcodTask5WorkflowIdentity([string]$Commit=('a'*40)){
     [pscustomobject][ordered]@{provider='GitHubActions';repository='naipi11/CodexRemote-fix';runId=[uint64]123;runAttempt=[uint64]2;artifactId=[uint64]456;artifactName='CodexRemote-fix portable bundle';artifactDigest=('sha256:'+('9'*64));gitCommit=$Commit}
 }
@@ -356,6 +316,15 @@ function New-CcodTask5PromotionFixture {
     [pscustomobject]@{Root=$root;Names=$names;Setup=$setup;Portable=$portable;Commit=('c'*40);Version='2.5.22'}
 }
 
+function Sync-CcodTask5OuterAssetHash {
+    param([Parameter(Mandatory)]$Fixture,[Parameter(Mandatory)][ValidateSet('Portable','Setup')][string]$Distribution,[Parameter(Mandatory)][string]$AssetName)
+    $manifestName=if($Distribution-ceq'Portable'){$Fixture.Names[4]}else{$Fixture.Names[10]}
+    $manifestPath=Join-Path $Fixture.Root $manifestName;$manifest=[IO.File]::ReadAllText($manifestPath,[Text.UTF8Encoding]::new($false,$true))|ConvertFrom-Json
+    $record=@($manifest.assets|Where-Object{$_.name-ceq$AssetName});if($record.Count-ne1){throw "fixture outer asset missing: $AssetName"}
+    $record[0].sha256=Get-CcodTestFileSha256 (Join-Path $Fixture.Root $AssetName)
+    [IO.File]::WriteAllText($manifestPath,($manifest|ConvertTo-Json -Depth 12),[Text.UTF8Encoding]::new($false))
+}
+
 function Get-CcodReadOnlyProductTreeSnapshot {
     param(
         [Parameter(Mandatory)][string]$Root,
@@ -396,17 +365,33 @@ function Get-CcodReadOnlyProductTreeSnapshot {
     return [pscustomobject][ordered]@{root=$full;exists=$true;rootAttributes=[int]$rootItem.Attributes;rootCreationTimeUtc=$rootItem.CreationTimeUtc.ToString('o',[Globalization.CultureInfo]::InvariantCulture);rootLastWriteTimeUtc=$rootItem.LastWriteTimeUtc.ToString('o',[Globalization.CultureInfo]::InvariantCulture);entryCount=$records.Count;totalBytes=$total;records=@($records)}
 }
 
+Invoke-CcodTask5Test 'fix1-public' 'public Defender surfaces cannot accept adapters or enter library mode' {
+    $cli=Get-Command $defenderPath -ErrorAction Stop
+    Assert-CcodTrue (-not$cli.Parameters.ContainsKey('Library')) 'Defender CLI exposes no library bypass'
+    Assert-CcodTrue (-not$cli.Parameters.ContainsKey('Adapters')) 'Defender CLI exposes no adapter injection parameter'
+    foreach($name in @('CandidatePath','ChecksumPath','ManifestPath','Origin','WorkflowArtifactIdentity','ExpectedVersion','ExpectedGitCommit','EvidencePath')){Assert-CcodTrue $cli.Parameters.ContainsKey($name) "Defender CLI retains required public parameter $name"}
+    Assert-CcodTrue (Test-Path -LiteralPath $releaseDefenderModulePath -PathType Leaf) 'release Defender module exists'
+    $module=Import-Module $releaseDefenderModulePath -Force -PassThru -DisableNameChecking
+    try{
+        Assert-CcodEqual 'Invoke-CcodReleaseDefenderCheck' ((@($module.ExportedCommands.Keys|Sort-Object))-join',') 'release Defender module exports only the public checker'
+        $public=Get-Command Invoke-CcodReleaseDefenderCheck -Module $module.Name -ErrorAction Stop
+        Assert-CcodTrue (-not$public.Parameters.ContainsKey('Adapters')) 'public Defender function exposes no adapter injection parameter'
+        Assert-CcodThrows {&$defenderPath -Library} 'NamedParameterNotFound'
+        Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath 'x' -ChecksumPath 'x' -ManifestPath 'x' -Origin InternetDownload -ExpectedVersion '2.5.22' -ExpectedGitCommit ('a'*40) -EvidencePath 'x' -Adapters @{}} 'NamedParameterNotFound'
+    }finally{Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue}
+}
+
 Invoke-CcodTask5Test 'assets' 'release asset contract owns the exact ordered eleven-name set and rejects every mutation' {
     Assert-CcodTrue (Test-Path -LiteralPath $assetContractPath -PathType Leaf) 'central release asset contract module exists'
     $assetModule=Import-Module $assetContractPath -Force -PassThru -DisableNameChecking
+    $template=$null
     try{
         $expected=Get-CcodTask5ExpectedAssetNames '2.5.22';$actual=@(Get-CcodExpectedReleaseAssetNames -Version '2.5.22')
         Assert-CcodEqual ($expected-join'|') ($actual-join'|') 'asset contract returns the literal ordered eleven-name set'
-        $baseline=New-CcodTask5ExactAssetFixture
-        try{$validated=Test-CcodExactReleaseAssetSet -AssetDirectory $baseline.Root -Version $baseline.Version;Assert-CcodEqual $baseline.GitCommit ([string]$validated.GitCommit) 'exact set returns the common 40-hex commit';Assert-CcodEqual $baseline.Timestamp ([string]$validated.BuildTimestampUtc) 'exact set returns the common timestamp';Assert-CcodEqual ($expected-join'|') ((@($validated.Assets.name))-join'|') 'exact set returns all public hashes in contract order'}finally{Remove-CcodTask5ExactAssetFixture $baseline}
-        foreach($missing in $expected){$fixture=New-CcodTask5ExactAssetFixture;try{Remove-Item -LiteralPath (Join-Path $fixture.Root $missing) -Force;Assert-CcodThrows {Test-CcodExactReleaseAssetSet -AssetDirectory $fixture.Root -Version $fixture.Version|Out-Null} 'CCOD_RELEASE_ASSET_SET_INVALID'}finally{Remove-CcodTask5ExactAssetFixture $fixture}}
+        $template=New-CcodTask5ExactAssetFixture;$validated=Test-CcodExactReleaseAssetSet -AssetDirectory $template.Root -Version $template.Version;Assert-CcodEqual $template.GitCommit ([string]$validated.GitCommit) 'exact set returns the common 40-hex commit';Assert-CcodEqual $template.Timestamp ([string]$validated.BuildTimestampUtc) 'exact set returns the common timestamp';Assert-CcodEqual ($expected-join'|') ((@($validated.Assets.name))-join'|') 'exact set returns all public hashes in contract order'
+        foreach($missing in $expected){$fixture=Copy-CcodTask5ExactAssetFixture $template;try{Remove-Item -LiteralPath (Join-Path $fixture.Root $missing) -Force;Assert-CcodThrows {Test-CcodExactReleaseAssetSet -AssetDirectory $fixture.Root -Version $fixture.Version|Out-Null} 'CCOD_RELEASE_ASSET_SET_INVALID'}finally{Remove-CcodTask5ExactAssetFixture $fixture}}
         foreach($mutation in @('Extra','CaseVaried','Directory','Reparse','UnsafeAncestry','NoncanonicalRoot','DuplicateTopProperty','DuplicateNestedProperty','DuplicateEscapedProperty','DuplicateManifest','ManifestOrder','CommitMismatch','TimestampMismatch','SharedProvenanceMismatch')){
-            $fixture=New-CcodTask5ExactAssetFixture
+            $fixture=Copy-CcodTask5ExactAssetFixture $template
             try{
                 switch($mutation){
                     'Extra'{[IO.File]::WriteAllText((Join-Path $fixture.Root 'unexpected.txt'),'x',[Text.UTF8Encoding]::new($false))}
@@ -423,7 +408,97 @@ Invoke-CcodTask5Test 'assets' 'release asset contract owns the exact ordered ele
                 Assert-CcodThrows {Test-CcodExactReleaseAssetSet -AssetDirectory $fixture.Root -Version $fixture.Version|Out-Null} 'CCOD_RELEASE_ASSET_SET_INVALID'
             }finally{Remove-CcodTask5ExactAssetFixture $fixture}
         }
-    }finally{if($null-ne$assetModule){Remove-Module -Name $assetModule.Name -Force -ErrorAction SilentlyContinue}}
+    }finally{if($null-ne$template){Remove-CcodTask5ExactAssetFixture $template};if($null-ne$assetModule){Remove-Module -Name $assetModule.Name -Force -ErrorAction SilentlyContinue}}
+}
+
+Invoke-CcodTask5Test 'fix1-deep' 'exact asset authority rejects self-consistent nested portable and Setup corruption' {
+    $module=Import-Module $assetContractPath -Force -PassThru -DisableNameChecking
+    $template=$null
+    try{
+        $template=New-CcodTask5ExactAssetFixture
+        foreach($mutation in @('PortablePayloadLength','PortablePayloadHash','PortableZipRootLauncher','PortableZipExtra','TrayProvenanceBogusNested','SetupPackagePayloadMismatch','SetupProvenanceBogusNested','SetupProvenanceLength','SetupInventoryDirective')){
+            $fixture=Copy-CcodTask5ExactAssetFixture $template
+            try{
+                switch($mutation){
+                    'PortablePayloadLength'{$path=Join-Path $fixture.Root $fixture.Names[3];$record=[IO.File]::ReadAllText($path)|ConvertFrom-Json;$record.files[0].length=[int64]$record.files[0].length+1;Write-CcodTask5Json -Path $path -Value $record;Sync-CcodTask5OuterAssetHash -Fixture $fixture -Distribution Portable -AssetName $fixture.Names[3]}
+                    'PortablePayloadHash'{$path=Join-Path $fixture.Root $fixture.Names[3];$record=[IO.File]::ReadAllText($path)|ConvertFrom-Json;$record.files[0].sha256='0'*64;Write-CcodTask5Json -Path $path -Value $record;Sync-CcodTask5OuterAssetHash -Fixture $fixture -Distribution Portable -AssetName $fixture.Names[3]}
+                    'PortableZipRootLauncher'{$zipPath=Join-Path $fixture.Root $fixture.Names[0];$archive=[IO.Compression.ZipFile]::Open($zipPath,[IO.Compression.ZipArchiveMode]::Update);try{$archive.GetEntry('CodexRemote-fix.exe').Delete();$entry=$archive.CreateEntry('CodexRemote-fix.exe');$stream=$entry.Open();try{$bytes=[byte[]](9,9,9);$stream.Write($bytes,0,$bytes.Length)}finally{$stream.Dispose()}}finally{$archive.Dispose()};[IO.File]::WriteAllText((Join-Path $fixture.Root $fixture.Names[1]),((Get-CcodTestFileSha256 $zipPath)+' *'+$fixture.Names[0]),[Text.UTF8Encoding]::new($false));Sync-CcodTask5OuterAssetHash $fixture Portable $fixture.Names[0];Sync-CcodTask5OuterAssetHash $fixture Portable $fixture.Names[1]}
+                    'PortableZipExtra'{$zipPath=Join-Path $fixture.Root $fixture.Names[0];$archive=[IO.Compression.ZipFile]::Open($zipPath,[IO.Compression.ZipArchiveMode]::Update);try{$entry=$archive.CreateEntry('unexpected.txt');$stream=$entry.Open();try{$stream.WriteByte(1)}finally{$stream.Dispose()}}finally{$archive.Dispose()};[IO.File]::WriteAllText((Join-Path $fixture.Root $fixture.Names[1]),((Get-CcodTestFileSha256 $zipPath)+' *'+$fixture.Names[0]),[Text.UTF8Encoding]::new($false));Sync-CcodTask5OuterAssetHash $fixture Portable $fixture.Names[0];Sync-CcodTask5OuterAssetHash $fixture Portable $fixture.Names[1]}
+                    'TrayProvenanceBogusNested'{$path=Join-Path $fixture.Root $fixture.Names[2];$record=[IO.File]::ReadAllText($path)|ConvertFrom-Json;$record.compiler|Add-Member -NotePropertyName bogus -NotePropertyValue 'accepted';Write-CcodTask5Json -Path $path -Value $record;Sync-CcodTask5OuterAssetHash $fixture Portable $fixture.Names[2];Sync-CcodTask5OuterAssetHash $fixture Setup $fixture.Names[2]}
+                    'SetupPackagePayloadMismatch'{$path=Join-Path $fixture.Root $fixture.Names[8];$record=[IO.File]::ReadAllText($path)|ConvertFrom-Json;$record.payloadManifest.sha256='0'*64;Write-CcodTask5Json -Path $path -Value $record;Sync-CcodTask5OuterAssetHash $fixture Setup $fixture.Names[8]}
+                    'SetupProvenanceBogusNested'{$path=Join-Path $fixture.Root $fixture.Names[7];$record=[IO.File]::ReadAllText($path)|ConvertFrom-Json;$record.installerPackageManifest|Add-Member -NotePropertyName bogus -NotePropertyValue 'accepted';Write-CcodTask5Json -Path $path -Value $record;Sync-CcodTask5OuterAssetHash -Fixture $fixture -Distribution Setup -AssetName $fixture.Names[7]}
+                    'SetupProvenanceLength'{$path=Join-Path $fixture.Root $fixture.Names[7];$record=[IO.File]::ReadAllText($path)|ConvertFrom-Json;$record.installerPackageManifest.length=[int64]$record.installerPackageManifest.length+1;Write-CcodTask5Json -Path $path -Value $record;Sync-CcodTask5OuterAssetHash $fixture Setup $fixture.Names[7]}
+                    'SetupInventoryDirective'{$path=Join-Path $fixture.Root $fixture.Names[9];[IO.File]::AppendAllText($path,"#include 'foreign.iss'`r`n",[Text.UTF8Encoding]::new($false));Sync-CcodTask5OuterAssetHash -Fixture $fixture -Distribution Setup -AssetName $fixture.Names[9]}
+                }
+                Assert-CcodThrows {Test-CcodExactReleaseAssetSet -AssetDirectory $fixture.Root -Version $fixture.Version|Out-Null} 'CCOD_RELEASE_ASSET_SET_INVALID'
+            }finally{Remove-CcodTask5ExactAssetFixture $fixture}
+        }
+    }finally{if($null-ne$template){Remove-CcodTask5ExactAssetFixture $template};Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue}
+}
+
+Invoke-CcodTask5Test 'fix1-handle-scan' 'Defender scan holds candidate identity against same-byte ABA writes' {
+    $fixture=New-CcodTask5ExactAssetFixture
+    try{
+        $candidate=Join-Path $fixture.Root $fixture.Names[5];$checksum=Join-Path $fixture.Root $fixture.Names[6];$manifest=Join-Path $fixture.Root $fixture.Names[10];Set-Content -LiteralPath $candidate -Stream Zone.Identifier -Value "[ZoneTransfer]`r`nZoneId=3`r`n" -NoNewline
+        $probe=[pscustomobject]@{Blocked=$false;Mutated=$false};$case=New-CcodTask5DefenderAdapterFixture
+        $case.Adapters.StartCustomScan={param($Path)$case.State.Calls.Add('Scan');$stream=$null;try{$stream=[IO.File]::Open($Path,[IO.FileMode]::Open,[IO.FileAccess]::ReadWrite,[IO.FileShare]::ReadWrite);$first=$stream.ReadByte();$stream.Position=0;$stream.WriteByte((($first+1)-band255));$stream.Flush($true);$stream.Position=0;$stream.WriteByte($first);$stream.Flush($true);$probe.Mutated=$true}catch [IO.IOException] {$probe.Blocked=$true}finally{if($null-ne$stream){$stream.Dispose()}}}.GetNewClosure()
+        $receipt=Invoke-CcodTask5DefenderCore -CandidatePath $candidate -ChecksumPath $checksum -ManifestPath $manifest -Origin InternetDownload -ExpectedVersion $fixture.Version -ExpectedGitCommit $fixture.GitCommit -EvidencePath (Join-Path $fixture.Outside 'scan-aba.json') -Adapters $case.Adapters
+        Assert-CcodEqual 'Completed' ([string]$receipt.outcome) 'clean fake scan reaches a completed receipt'
+        Assert-CcodTrue $probe.Blocked 'candidate write is denied for the entire scan and receipt decision'
+        Assert-CcodTrue (-not$probe.Mutated) 'same-byte ABA mutation never obtains a writable handle'
+    }finally{Remove-CcodTask5ExactAssetFixture $fixture}
+}
+
+Invoke-CcodTask5Test 'fix1-handle-post' 'Defender holds candidate identity through receipt publication and readback' {
+    $fixture=New-CcodTask5ExactAssetFixture
+    try{
+        $candidate=Join-Path $fixture.Root $fixture.Names[5];$checksum=Join-Path $fixture.Root $fixture.Names[6];$manifest=Join-Path $fixture.Root $fixture.Names[10];$probe=[pscustomobject]@{Blocked=$false;Replaced=$false};$backup=$candidate+'.held-original';$case=New-CcodTask5DefenderAdapterFixture;$realPublish=(Get-CcodTask5DefaultDefenderAdapters).PublishReceiptBytes
+        $case.Adapters.PublishReceiptBytes={param($Directory,$Leaf,$Bytes)$case.State.Calls.Add('Write');try{[IO.File]::Move($candidate,$backup);[IO.File]::Copy($backup,$candidate,$false);$probe.Replaced=$true}catch [IO.IOException] {$probe.Blocked=$true};&$realPublish $Directory $Leaf $Bytes}.GetNewClosure()
+        $receipt=Invoke-CcodTask5DefenderCore -CandidatePath $candidate -ChecksumPath $checksum -ManifestPath $manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity (New-CcodTask5WorkflowIdentity $fixture.GitCommit) -ExpectedVersion $fixture.Version -ExpectedGitCommit $fixture.GitCommit -EvidencePath (Join-Path $fixture.Outside 'post-revalidate.json') -Adapters $case.Adapters
+        Assert-CcodEqual 'Completed' ([string]$receipt.outcome) 'clean fake scan reaches receipt publication'
+        Assert-CcodTrue $probe.Blocked 'candidate replacement is denied through durable receipt readback'
+        Assert-CcodTrue (-not$probe.Replaced) 'post-revalidation same-byte replacement never changes file identity'
+    }finally{
+        if(Test-Path -LiteralPath $backup){if(Test-Path -LiteralPath $candidate){Remove-Item -LiteralPath $candidate -Force};Move-Item -LiteralPath $backup -Destination $candidate}
+        Remove-CcodTask5ExactAssetFixture $fixture
+    }
+}
+
+Invoke-CcodTask5Test 'fix1-handle-promotion' 'promotion holds all asset and receipt identities through its final decision' {
+    $module=Import-Module $assetContractPath -Force -PassThru -DisableNameChecking
+    $assetFixture=$null;$evidence=$null
+    try{
+        Assert-CcodTrue ($null-ne(&$module {Get-Command Test-CcodReleasePromotionEvidenceCore -ErrorAction SilentlyContinue})) 'asset module has a private promotion core for controlled replacement tests'
+        $assetFixture=New-CcodTask5ExactAssetFixture;$evidence=New-CcodTask5PromotionFixture $assetFixture;$probe=[pscustomobject]@{AssetBlocked=$false;AssetReplaced=$false;ReceiptBlocked=$false;ReceiptReplaced=$false}
+        $assetBackup=(Join-Path $assetFixture.Root $assetFixture.Names[0])+'.original';$receiptPath=Join-Path $evidence.Root $evidence.Names[0];$receiptBackup=$receiptPath+'.original'
+        $callback={param($Assets,$Evidence,$Receipts)try{[IO.File]::Move($Assets.Files[0].Path,$assetBackup);[IO.File]::Copy($assetBackup,$Assets.Files[0].Path,$false);$probe.AssetReplaced=$true}catch [IO.IOException] {$probe.AssetBlocked=$true};try{[IO.File]::Move($Receipts[0].Path,$receiptBackup);[IO.File]::Copy($receiptBackup,$Receipts[0].Path,$false);$probe.ReceiptReplaced=$true}catch [IO.IOException] {$probe.ReceiptBlocked=$true}}.GetNewClosure()
+        $result=&$module {param($EvidenceRoot,$AssetRoot,$Version,$Commit,$Callback)Test-CcodReleasePromotionEvidenceCore -EvidenceDirectory $EvidenceRoot -AssetDirectory $AssetRoot -Version $Version -ExpectedGitCommit $Commit -BeforeReturn $Callback} $evidence.Root $assetFixture.Root $assetFixture.Version $assetFixture.GitCommit $callback
+        Assert-CcodTrue ([bool]$result.Valid) 'promotion core returns a valid held decision'
+        Assert-CcodTrue ($probe.AssetBlocked-and$probe.ReceiptBlocked) 'promotion asset and receipt replacements are denied while the decision is live'
+        Assert-CcodTrue (-not$probe.AssetReplaced-and-not$probe.ReceiptReplaced) 'promotion callback cannot change any held identity'
+    }finally{
+        if($null-ne$assetFixture-and(Test-Path -LiteralPath $assetBackup)){if(Test-Path -LiteralPath (Join-Path $assetFixture.Root $assetFixture.Names[0])){Remove-Item -LiteralPath (Join-Path $assetFixture.Root $assetFixture.Names[0]) -Force};Move-Item -LiteralPath $assetBackup -Destination (Join-Path $assetFixture.Root $assetFixture.Names[0])}
+        if($null-ne$evidence-and(Test-Path -LiteralPath $receiptBackup)){if(Test-Path -LiteralPath $receiptPath){Remove-Item -LiteralPath $receiptPath -Force};Move-Item -LiteralPath $receiptBackup -Destination $receiptPath}
+        if($null-ne$evidence-and(Test-Path $evidence.Root)){Remove-Item -LiteralPath $evidence.Root -Recurse -Force};if($null-ne$assetFixture){Remove-CcodTask5ExactAssetFixture $assetFixture};Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+    }
+}
+
+foreach($receiptShape in @('NoOp','Corrupt','WrongTarget','StaleObject','ReplacedReadback','FailedNoOp')){
+    Invoke-CcodTask5Test ("fix1-receipt-$receiptShape") ("Defender receipt readback rejects $receiptShape publication") {
+        $fixture=New-CcodTask5ExactAssetFixture
+        try{
+            $candidate=Join-Path $fixture.Root $fixture.Names[5];$checksum=Join-Path $fixture.Root $fixture.Names[6];$manifest=Join-Path $fixture.Root $fixture.Names[10];$evidence=Join-Path $fixture.Outside ("receipt-$receiptShape.json");$case=if($receiptShape-ceq'FailedNoOp'){New-CcodTask5DefenderAdapterFixture -ScanThrows}else{New-CcodTask5DefenderAdapterFixture};$realPublish=(Get-CcodTask5DefaultDefenderAdapters).PublishReceiptBytes
+            switch($receiptShape){
+                'NoOp'{$case.Adapters.PublishReceiptBytes={param($Directory,$Leaf,$Bytes)$null}}
+                'Corrupt'{$case.Adapters.PublishReceiptBytes={param($Directory,$Leaf,$Bytes)&$realPublish $Directory $Leaf ([Text.UTF8Encoding]::new($false).GetBytes('{}'))}.GetNewClosure()}
+                'WrongTarget'{$case.Adapters.PublishReceiptBytes={param($Directory,$Leaf,$Bytes)&$realPublish $Directory ($Leaf+'.wrong.json') $Bytes}.GetNewClosure()}
+                'StaleObject'{$case.Adapters.PublishReceiptBytes={param($Directory,$Leaf,$Bytes)$pin=&$realPublish $Directory $Leaf $Bytes;$pin.Stream.Dispose();$pin.Closed=$true;$pin}.GetNewClosure()}
+                'ReplacedReadback'{$case.Adapters.PublishReceiptBytes={param($Directory,$Leaf,$Bytes)$pin=&$realPublish $Directory $Leaf $Bytes;$pin.Stream.Dispose();$pin.Closed=$true;$target=Join-Path $Directory.Path $Leaf;$original=$target+'.original';[IO.File]::Move($target,$original);[IO.File]::Copy($original,$target,$false);$pin}.GetNewClosure()}
+                'FailedNoOp'{$case.Adapters.PublishReceiptBytes={param($Directory,$Leaf,$Bytes)$null}}
+            }
+            Assert-CcodThrows {Invoke-CcodTask5DefenderCore -CandidatePath $candidate -ChecksumPath $checksum -ManifestPath $manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity (New-CcodTask5WorkflowIdentity $fixture.GitCommit) -ExpectedVersion $fixture.Version -ExpectedGitCommit $fixture.GitCommit -EvidencePath $evidence -Adapters $case.Adapters|Out-Null} 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED'
+        }finally{Remove-CcodTask5ExactAssetFixture $fixture}
+    }
 }
 
 Invoke-CcodTask5Test 'promotion' 'promotion requires exactly distinct Setup and ZIP Internet-download Defender receipts' {
@@ -498,9 +573,9 @@ Invoke-CcodTask5Test 'promotion' 'promotion requires exactly distinct Setup and
 
 Invoke-CcodTest 'release defender tool exposes manifest and scan functions without a live scan' {
     Assert-CcodTrue (Test-Path -LiteralPath $defenderPath -PathType Leaf) 'Defender release gate exists'
-    . $defenderPath -Library
-    Assert-CcodTrue ($null -ne (Get-Command Test-CcodReleaseAssetManifest -ErrorAction SilentlyContinue)) 'release manifest validator is exported for deterministic tests'
-    Assert-CcodTrue ($null -ne (Get-Command Invoke-CcodReleaseDefenderCheck -ErrorAction SilentlyContinue)) 'Defender invocation is available'
+    $defenderModule=Import-Module $releaseDefenderModulePath -Force -PassThru -DisableNameChecking;$assetModule=Import-Module $assetContractPath -Force -PassThru -DisableNameChecking
+    Assert-CcodTrue $assetModule.ExportedCommands.ContainsKey('Test-CcodReleaseAssetManifest') 'release manifest validator is exported for deterministic tests'
+    Assert-CcodTrue $defenderModule.ExportedCommands.ContainsKey('Invoke-CcodReleaseDefenderCheck') 'Defender invocation is available'
 }
 
 Invoke-CcodTest 'production installer payload generator writes ordered version-bound file records' {
@@ -2377,120 +2452,99 @@ Invoke-CcodTest 'temporary bootstrap lock makes the verified source bytes the ex
 }
 
 Invoke-CcodTest 'release manifest binds the final asset names hashes version commit and timestamp' {
-    . $defenderPath -Library
-    $fixture = New-CcodReleaseFixture
+    Import-Module $assetContractPath -Force -DisableNameChecking
+    $fixture = New-CcodTask5ExactAssetFixture
     try {
-        $validated = Test-CcodReleaseAssetManifest -ManifestPath $fixture.Manifest -AssetDirectory $fixture.Root -ExpectedVersion '2.5.0'
+        $manifest=Join-Path $fixture.Root $fixture.Names[10];$installer=Join-Path $fixture.Root $fixture.Names[5];$validated = Test-CcodReleaseAssetManifest -ManifestPath $manifest -AssetDirectory $fixture.Root -ExpectedVersion $fixture.Version
         Assert-CcodEqual $true ([bool]$validated.Valid) 'valid fixture passes the release manifest contract'
-        Assert-CcodEqual (Get-CcodTestFileSha256 -Path $fixture.Installer) ([string]$validated.InstallerSha256) 'validator returns the exact installer hash'
-        [IO.File]::WriteAllBytes($fixture.Installer, [byte[]](1,1,1))
+        Assert-CcodEqual (Get-CcodTestFileSha256 -Path $installer) ([string]$validated.InstallerSha256) 'validator returns the exact installer hash'
+        [IO.File]::WriteAllBytes($installer, [byte[]](1,1,1))
         Assert-CcodThrows {
-            Test-CcodReleaseAssetManifest -ManifestPath $fixture.Manifest -AssetDirectory $fixture.Root -ExpectedVersion '2.5.0'
+            Test-CcodReleaseAssetManifest -ManifestPath $manifest -AssetDirectory $fixture.Root -ExpectedVersion $fixture.Version
         } 'CCOD_RELEASE_ASSET_HASH_MISMATCH'
     } finally {
-        if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+        Remove-CcodTask5ExactAssetFixture $fixture
     }
 }
 
 Invoke-CcodTest 'release timestamp validation reads the raw JSON string representation' {
-    . $defenderPath -Library
+    $module=Import-Module $assetContractPath -Force -PassThru -DisableNameChecking
     $canonical = '2026-08-24T00:00:00.0000000Z'
-    Assert-CcodEqual $canonical (Get-CcodReleaseDefenderRawJsonString -Json ('{"buildTimestampUtc":"' + $canonical + '"}') -PropertyName 'buildTimestampUtc') 'canonical raw timestamp is retained as text'
-    Assert-CcodEqual $null (Get-CcodReleaseDefenderRawJsonString -Json '{"buildTimestampUtc":123}' -PropertyName 'buildTimestampUtc') 'nonstring timestamp JSON is rejected'
-    Assert-CcodEqual $null (Get-CcodReleaseDefenderRawJsonString -Json ('{"buildTimestampUtc":"' + $canonical + '","buildTimestampUtc":"' + $canonical + '"}') -PropertyName 'buildTimestampUtc') 'duplicate timestamp JSON is rejected'
-    Assert-CcodEqual 'not-canonical' (Get-CcodReleaseDefenderRawJsonString -Json ('{"nested":{"buildTimestampUtc":"' + $canonical + '"},"buildTimestampUtc":"not-canonical"}') -PropertyName 'buildTimestampUtc') 'only the root timestamp property is selected'
+    try{Assert-CcodEqual $true (&$module {param($Value)Test-CcodReleaseContractCanonicalUtc $Value} $canonical) 'canonical raw timestamp is retained as exact UTC';Assert-CcodEqual $false (&$module {param($Value)Test-CcodReleaseContractCanonicalUtc $Value} 'not-canonical') 'noncanonical timestamp is rejected'}finally{Remove-Module $module.Name -Force}
 }
 
 Invoke-CcodTest 'release manifest rejects a numeric top-level timestamp hidden by a nested canonical timestamp' {
-    . $defenderPath -Library
-    $fixture = New-CcodReleaseFixture
+    Import-Module $assetContractPath -Force -DisableNameChecking
+    $fixture = New-CcodTask5ExactAssetFixture
     try {
         $canonical = '2026-08-24T00:00:00.0000000Z'
-        $maliciousProvenance = ('{"schemaVersion":1,"product":"CodexRemote-fix","version":"2.5.0","gitCommit":"' + ('a' * 40) + '","buildTimestampUtc":123,"nested":{"buildTimestampUtc":"' + $canonical + '"}}')
-        [IO.File]::WriteAllText($fixture.TrayHost, $maliciousProvenance, [Text.UTF8Encoding]::new($false))
-        $record = [IO.File]::ReadAllText($fixture.Manifest) | ConvertFrom-Json
-        $boundAsset = @($record.assets | Where-Object { $_.name -ceq [IO.Path]::GetFileName($fixture.TrayHost) })
-        Assert-CcodEqual 1 $boundAsset.Count 'fixture manifest binds the TrayHost provenance asset once'
-        $boundAsset[0].sha256 = Get-CcodTestFileSha256 -Path $fixture.TrayHost
-        [IO.File]::WriteAllText($fixture.Manifest, ($record | ConvertTo-Json -Depth 8), [Text.UTF8Encoding]::new($false))
+        $trayPath=Join-Path $fixture.Root $fixture.Names[2];$tray=[IO.File]::ReadAllText($trayPath)|ConvertFrom-Json;$tray.buildTimestampUtc=123;$tray|Add-Member -NotePropertyName nested -NotePropertyValue ([pscustomobject]@{buildTimestampUtc=$canonical});Write-CcodTask5Json -Path $trayPath -Value $tray;Sync-CcodTask5OuterAssetHash $fixture Setup $fixture.Names[2]
         Assert-CcodThrows {
-            Test-CcodReleaseAssetManifest -ManifestPath $fixture.Manifest -AssetDirectory $fixture.Root -ExpectedVersion '2.5.0'
+            Test-CcodReleaseAssetManifest -ManifestPath (Join-Path $fixture.Root $fixture.Names[10]) -AssetDirectory $fixture.Root -ExpectedVersion $fixture.Version
         } 'CCOD_RELEASE_MANIFEST_INVALID'
     } finally {
-        if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+        Remove-CcodTask5ExactAssetFixture $fixture
     }
 }
 
 Invoke-CcodTest 'release manifest binds the TrayHost provenance timestamp to its own timestamp' {
-    . $defenderPath -Library
-    $fixture = New-CcodReleaseFixture
+    Import-Module $assetContractPath -Force -DisableNameChecking
+    $fixture = New-CcodTask5ExactAssetFixture
     try {
-        $mismatchedProvenance = ('{"schemaVersion":1,"product":"CodexRemote-fix","version":"2.5.0","gitCommit":"' + ('a' * 40) + '","buildTimestampUtc":"2026-08-24T00:00:01.0000000Z"}')
-        [IO.File]::WriteAllText($fixture.TrayHost, $mismatchedProvenance, [Text.UTF8Encoding]::new($false))
-        $record = [IO.File]::ReadAllText($fixture.Manifest) | ConvertFrom-Json
-        $boundAsset = @($record.assets | Where-Object { $_.name -ceq [IO.Path]::GetFileName($fixture.TrayHost) })
-        Assert-CcodEqual 1 $boundAsset.Count 'fixture manifest binds the TrayHost provenance asset once'
-        $boundAsset[0].sha256 = Get-CcodTestFileSha256 -Path $fixture.TrayHost
-        [IO.File]::WriteAllText($fixture.Manifest, ($record | ConvertTo-Json -Depth 8), [Text.UTF8Encoding]::new($false))
+        $trayPath=Join-Path $fixture.Root $fixture.Names[2];$tray=[IO.File]::ReadAllText($trayPath)|ConvertFrom-Json;$tray.buildTimestampUtc='2030-02-03T04:05:07.0000000Z';Write-CcodTask5Json -Path $trayPath -Value $tray;Sync-CcodTask5OuterAssetHash $fixture Setup $fixture.Names[2]
         Assert-CcodThrows {
-            Test-CcodReleaseAssetManifest -ManifestPath $fixture.Manifest -AssetDirectory $fixture.Root -ExpectedVersion '2.5.0'
+            Test-CcodReleaseAssetManifest -ManifestPath (Join-Path $fixture.Root $fixture.Names[10]) -AssetDirectory $fixture.Root -ExpectedVersion $fixture.Version
         } 'CCOD_RELEASE_MANIFEST_INVALID'
     } finally {
-        if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+        Remove-CcodTask5ExactAssetFixture $fixture
     }
 }
 
 Invoke-CcodTask5Test 'defender' 'Defender gate binds exact origins status clocks manifests and a redacted receipt' {
-    . $defenderPath -Library;$fixture=New-CcodReleaseFixture
+    $fixture=New-CcodTask5ExactAssetFixture
     try{
-        Set-Content -LiteralPath $fixture.Installer -Stream Zone.Identifier -Value "[ZoneTransfer]`r`nZoneId=3`r`n" -NoNewline
-        $clean=New-CcodTask5DefenderAdapterFixture;$receipt=Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin InternetDownload -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root 'internet.json') -Adapters $clean.Adapters
+        $candidate=Join-Path $fixture.Root $fixture.Names[5];$checksum=Join-Path $fixture.Root $fixture.Names[6];$manifest=Join-Path $fixture.Root $fixture.Names[10];Set-Content -LiteralPath $candidate -Stream Zone.Identifier -Value "[ZoneTransfer]`r`nZoneId=3`r`n" -NoNewline
+        $clean=New-CcodTask5DefenderAdapterFixture;$receipt=Invoke-CcodTask5DefenderCore -CandidatePath $candidate -ChecksumPath $checksum -ManifestPath $manifest -Origin InternetDownload -ExpectedVersion $fixture.Version -ExpectedGitCommit $fixture.GitCommit -EvidencePath (Join-Path $fixture.Outside 'internet.json') -Adapters $clean.Adapters
         $fields='schemaVersion,assetType,assetName,assetSha256,checksumName,checksumSha256,manifestName,manifestSha256,version,gitCommit,origin,workflowArtifactIdentity,zoneId,defenderServiceEnabled,antivirusEnabled,realTimeProtectionEnabled,defenderPlatformVersion,defenderEngineVersion,signatureVersion,signatureUpdatedAtUtc,scanStartedAtUtc,scanCompletedAtUtc,detectionCount,outcome,errorCode'
-        Assert-CcodEqual $fields (($receipt.PSObject.Properties.Name)-join',') 'receipt exposes only the exact ordered schema';Assert-CcodEqual 'InternetDownload' $receipt.origin 'official download receipt is origin-bound';Assert-CcodEqual 3 $receipt.zoneId 'official download receipt binds actual ZoneId 3';Assert-CcodEqual $null $receipt.workflowArtifactIdentity 'official download receipt has no workflow identity';Assert-CcodEqual (Get-CcodTestFileSha256 $fixture.Installer) $receipt.assetSha256 'receipt binds exact candidate hash';Assert-CcodEqual (Get-CcodTestFileSha256 $fixture.Manifest) $receipt.manifestSha256 'receipt binds exact matching manifest hash';Assert-CcodTrue (-not(($receipt|ConvertTo-Json -Depth 12 -Compress).Contains($fixture.Root))) 'receipt contains no source path or raw output'
-        $originalCandidate=[IO.File]::ReadAllBytes($fixture.Installer);$race=New-CcodTask5DefenderAdapterFixture;$race.Adapters.StartCustomScan={param($Path)$race.State.Calls.Add('Scan');$stream=[IO.File]::Open($Path,[IO.FileMode]::Append,[IO.FileAccess]::Write,[IO.FileShare]::Read);try{$stream.WriteByte(255);$stream.Flush($true)}finally{$stream.Dispose()}}.GetNewClosure()
-        try{Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin InternetDownload -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root 'identity-race.json') -Adapters $race.Adapters|Out-Null} 'CCOD_RELEASE_ASSET_HASH_MISMATCH';Assert-CcodTrue (-not($race.State.Calls-contains'Write')) 'post-scan candidate mutation blocks receipt write'}finally{[IO.File]::WriteAllBytes($fixture.Installer,$originalCandidate);Set-Content -LiteralPath $fixture.Installer -Stream Zone.Identifier -Value "[ZoneTransfer]`r`nZoneId=3`r`n" -NoNewline}
-        Remove-Item -LiteralPath $fixture.Installer -Stream Zone.Identifier
-        foreach($zone in @($null,2)){$case=New-CcodTask5DefenderAdapterFixture;$case.Adapters.GetZoneId={param($Path)$zone}.GetNewClosure();Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin InternetDownload -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root "zone-$zone.json") -Adapters $case.Adapters|Out-Null} 'CCOD_DEFENDER_ZONE_REQUIRED';Assert-CcodTrue (-not($case.State.Calls-contains'Scan')) 'invalid Zone blocks scan'}
-        foreach($zoneShape in @([pscustomobject]@{Name='duplicate';Text="[ZoneTransfer]`r`nZoneId=3`r`nZoneId=3`r`n"},[pscustomobject]@{Name='mixed';Text="[ZoneTransfer]`r`nZoneId=3`r`nZoneId=2`r`n"})){Set-Content -LiteralPath $fixture.Installer -Stream Zone.Identifier -Value $zoneShape.Text -NoNewline;$case=New-CcodTask5DefenderAdapterFixture;Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin InternetDownload -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root "zone-$($zoneShape.Name).json") -Adapters $case.Adapters|Out-Null} 'CCOD_DEFENDER_ZONE_REQUIRED';Assert-CcodTrue (-not($case.State.Calls-contains'Scan')) "$($zoneShape.Name) ZoneId metadata blocks scan";Remove-Item -LiteralPath $fixture.Installer -Stream Zone.Identifier}
-        $identity=New-CcodTask5WorkflowIdentity ('a'*40);$trusted=New-CcodTask5DefenderAdapterFixture;$trustedReceipt=Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $identity -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root 'trusted.json') -Adapters $trusted.Adapters;Assert-CcodEqual $null $trustedReceipt.zoneId 'trusted workflow receipt never claims Internet Zone';Assert-CcodEqual ($identity|ConvertTo-Json -Compress) ($trustedReceipt.workflowArtifactIdentity|ConvertTo-Json -Compress) 'trusted receipt binds exact workflow artifact identity'
-        Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin TrustedWorkflowArtifact -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root 'trusted-missing.json') -Adapters (New-CcodTask5DefenderAdapterFixture).Adapters|Out-Null} 'CCOD_DEFENDER_ORIGIN_INVALID'
-        Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin InternetDownload -WorkflowArtifactIdentity $identity -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root 'internet-identity.json') -Adapters (New-CcodTask5DefenderAdapterFixture).Adapters|Out-Null} 'CCOD_DEFENDER_ORIGIN_INVALID'
-        foreach($field in @('provider','repository','runId','runAttempt','artifactId','artifactName','artifactDigest','gitCommit')){$bad=(($identity|ConvertTo-Json -Compress)|ConvertFrom-Json);if($field-in@('runId','runAttempt','artifactId')){$bad.$field=0}elseif($field-ceq'artifactDigest'){$bad.$field='sha256:bad'}elseif($field-ceq'gitCommit'){$bad.$field='b'*40}else{$bad.$field='foreign'};Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $bad -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root "trusted-$field.json") -Adapters (New-CcodTask5DefenderAdapterFixture).Adapters|Out-Null} 'CCOD_DEFENDER_ORIGIN_INVALID'}
-        foreach($mutation in @('Service','Antivirus','Realtime','Platform','Engine','Signature','SignatureMissing','SignatureStale','SignatureFuture')){$status=New-CcodTask5DefenderStatus;switch($mutation){'Service'{$status.AMServiceEnabled=$false};'Antivirus'{$status.AntivirusEnabled=$false};'Realtime'{$status.RealTimeProtectionEnabled=$false};'Platform'{$status.AMProductVersion=''};'Engine'{$status.AMEngineVersion=''};'Signature'{$status.AntivirusSignatureVersion=''};'SignatureMissing'{$status.AntivirusSignatureLastUpdated=$null};'SignatureStale'{$status.AntivirusSignatureLastUpdated=[datetime]::Parse('2030-01-30T04:05:05Z')};'SignatureFuture'{$status.AntivirusSignatureLastUpdated=[datetime]::Parse('2030-02-03T04:10:07Z')}};$case=New-CcodTask5DefenderAdapterFixture -Status $status;Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $identity -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root "status-$mutation.json") -Adapters $case.Adapters|Out-Null} 'CCOD_DEFENDER_STATUS_INVALID';Assert-CcodTrue (-not($case.State.Calls-contains'Scan')) "$mutation blocks scan"}
-        foreach($clock in @('Reverse','TooLong','Invalid')){$completed=if($clock-ceq'Reverse'){[datetime]::Parse('2030-02-03T04:05:05Z')}elseif($clock-ceq'TooLong'){[datetime]::Parse('2030-02-03T06:05:07Z')}else{'not-a-clock'};$case=New-CcodTask5DefenderAdapterFixture -Completed $completed;Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $identity -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root "clock-$clock.json") -Adapters $case.Adapters|Out-Null} 'CCOD_DEFENDER_CLOCK_INVALID'}
-        foreach($failure in @('Scan','Detection','Write')){$case=if($failure-ceq'Scan'){New-CcodTask5DefenderAdapterFixture -ScanThrows}elseif($failure-ceq'Detection'){New-CcodTask5DefenderAdapterFixture -Detects}else{New-CcodTask5DefenderAdapterFixture -WriteThrows};$error=if($failure-ceq'Scan'){'CCOD_DEFENDER_SCAN_FAILED'}elseif($failure-ceq'Detection'){'CCOD_DEFENDER_DETECTIONS_FOUND'}else{'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED'};Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $identity -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath (Join-Path $fixture.Root "failure-$failure.json") -Adapters $case.Adapters|Out-Null} $error}
-        $command=Get-Command $defenderPath;Assert-CcodTrue (-not$command.Parameters.ContainsKey('ZoneId')) 'public tool exposes no Zone synthesis parameter'
-    }finally{if(Test-Path $fixture.Root){Remove-Item -LiteralPath $fixture.Root -Recurse -Force}}
+        Assert-CcodEqual $fields (($receipt.PSObject.Properties.Name)-join',') 'receipt exposes only the exact ordered schema';Assert-CcodEqual 'InternetDownload' $receipt.origin 'official download receipt is origin-bound';Assert-CcodEqual 3 $receipt.zoneId 'official download receipt binds actual ZoneId 3';Assert-CcodEqual $null $receipt.workflowArtifactIdentity 'official download receipt has no workflow identity';Assert-CcodEqual (Get-CcodTestFileSha256 $candidate) $receipt.assetSha256 'receipt binds exact candidate hash';Assert-CcodEqual (Get-CcodTestFileSha256 $manifest) $receipt.manifestSha256 'receipt binds exact matching manifest hash';Assert-CcodTrue (-not(($receipt|ConvertTo-Json -Depth 12 -Compress).Contains($fixture.Root))) 'receipt contains no source path or raw output'
+        Remove-Item -LiteralPath $candidate -Stream Zone.Identifier
+        foreach($zoneShape in @([pscustomobject]@{Name='absent';Text=$null},[pscustomobject]@{Name='other';Text="[ZoneTransfer]`r`nZoneId=2`r`n"},[pscustomobject]@{Name='duplicate';Text="[ZoneTransfer]`r`nZoneId=3`r`nZoneId=3`r`n"},[pscustomobject]@{Name='mixed';Text="[ZoneTransfer]`r`nZoneId=3`r`nZoneId=2`r`n"})){if($null-ne$zoneShape.Text){Set-Content -LiteralPath $candidate -Stream Zone.Identifier -Value $zoneShape.Text -NoNewline};$case=New-CcodTask5DefenderAdapterFixture;Assert-CcodThrows {Invoke-CcodTask5DefenderCore -CandidatePath $candidate -ChecksumPath $checksum -ManifestPath $manifest -Origin InternetDownload -ExpectedVersion $fixture.Version -ExpectedGitCommit $fixture.GitCommit -EvidencePath (Join-Path $fixture.Outside "zone-$($zoneShape.Name).json") -Adapters $case.Adapters|Out-Null} 'CCOD_DEFENDER_ZONE_REQUIRED';Assert-CcodTrue (-not($case.State.Calls-contains'Scan')) "$($zoneShape.Name) ZoneId metadata blocks scan";if($null-ne$zoneShape.Text){Remove-Item -LiteralPath $candidate -Stream Zone.Identifier}}
+        $identity=New-CcodTask5WorkflowIdentity $fixture.GitCommit;$trusted=New-CcodTask5DefenderAdapterFixture;$trustedReceipt=Invoke-CcodTask5DefenderCore -CandidatePath $candidate -ChecksumPath $checksum -ManifestPath $manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $identity -ExpectedVersion $fixture.Version -ExpectedGitCommit $fixture.GitCommit -EvidencePath (Join-Path $fixture.Outside 'trusted.json') -Adapters $trusted.Adapters;Assert-CcodEqual $null $trustedReceipt.zoneId 'trusted workflow receipt never claims Internet Zone';Assert-CcodEqual ($identity|ConvertTo-Json -Compress) ($trustedReceipt.workflowArtifactIdentity|ConvertTo-Json -Compress) 'trusted receipt binds exact workflow artifact identity'
+        Assert-CcodThrows {Invoke-CcodTask5DefenderCore -CandidatePath $candidate -ChecksumPath $checksum -ManifestPath $manifest -Origin TrustedWorkflowArtifact -ExpectedVersion $fixture.Version -ExpectedGitCommit $fixture.GitCommit -EvidencePath (Join-Path $fixture.Outside 'trusted-missing.json') -Adapters (New-CcodTask5DefenderAdapterFixture).Adapters|Out-Null} 'CCOD_DEFENDER_ORIGIN_INVALID'
+        Assert-CcodThrows {Invoke-CcodTask5DefenderCore -CandidatePath $candidate -ChecksumPath $checksum -ManifestPath $manifest -Origin InternetDownload -WorkflowArtifactIdentity $identity -ExpectedVersion $fixture.Version -ExpectedGitCommit $fixture.GitCommit -EvidencePath (Join-Path $fixture.Outside 'internet-identity.json') -Adapters (New-CcodTask5DefenderAdapterFixture).Adapters|Out-Null} 'CCOD_DEFENDER_ORIGIN_INVALID'
+        foreach($field in @('provider','repository','runId','runAttempt','artifactId','artifactName','artifactDigest','gitCommit')){$bad=(($identity|ConvertTo-Json -Compress)|ConvertFrom-Json);if($field-in@('runId','runAttempt','artifactId')){$bad.$field=0}elseif($field-ceq'artifactDigest'){$bad.$field='sha256:bad'}elseif($field-ceq'gitCommit'){$bad.$field='b'*40}else{$bad.$field='foreign'};Assert-CcodThrows {Invoke-CcodTask5DefenderCore -CandidatePath $candidate -ChecksumPath $checksum -ManifestPath $manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $bad -ExpectedVersion $fixture.Version -ExpectedGitCommit $fixture.GitCommit -EvidencePath (Join-Path $fixture.Outside "trusted-$field.json") -Adapters (New-CcodTask5DefenderAdapterFixture).Adapters|Out-Null} 'CCOD_DEFENDER_ORIGIN_INVALID'}
+        foreach($mutation in @('Service','Antivirus','Realtime','Platform','Engine','Signature','SignatureMissing','SignatureStale','SignatureFuture')){$status=New-CcodTask5DefenderStatus;switch($mutation){'Service'{$status.AMServiceEnabled=$false};'Antivirus'{$status.AntivirusEnabled=$false};'Realtime'{$status.RealTimeProtectionEnabled=$false};'Platform'{$status.AMProductVersion=''};'Engine'{$status.AMEngineVersion=''};'Signature'{$status.AntivirusSignatureVersion=''};'SignatureMissing'{$status.AntivirusSignatureLastUpdated=$null};'SignatureStale'{$status.AntivirusSignatureLastUpdated=[datetime]::Parse('2030-01-30T04:05:05Z')};'SignatureFuture'{$status.AntivirusSignatureLastUpdated=[datetime]::Parse('2030-02-03T04:10:07Z')}};$case=New-CcodTask5DefenderAdapterFixture -Status $status;Assert-CcodThrows {Invoke-CcodTask5DefenderCore -CandidatePath $candidate -ChecksumPath $checksum -ManifestPath $manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $identity -ExpectedVersion $fixture.Version -ExpectedGitCommit $fixture.GitCommit -EvidencePath (Join-Path $fixture.Outside "status-$mutation.json") -Adapters $case.Adapters|Out-Null} 'CCOD_DEFENDER_STATUS_INVALID';Assert-CcodTrue (-not($case.State.Calls-contains'Scan')) "$mutation blocks scan"}
+        foreach($clock in @('Reverse','TooLong','Invalid')){$completed=if($clock-ceq'Reverse'){[datetime]::Parse('2030-02-03T04:05:05Z')}elseif($clock-ceq'TooLong'){[datetime]::Parse('2030-02-03T06:05:07Z')}else{'not-a-clock'};$case=New-CcodTask5DefenderAdapterFixture -Completed $completed;Assert-CcodThrows {Invoke-CcodTask5DefenderCore -CandidatePath $candidate -ChecksumPath $checksum -ManifestPath $manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $identity -ExpectedVersion $fixture.Version -ExpectedGitCommit $fixture.GitCommit -EvidencePath (Join-Path $fixture.Outside "clock-$clock.json") -Adapters $case.Adapters|Out-Null} 'CCOD_DEFENDER_CLOCK_INVALID'}
+        foreach($failure in @('Scan','Detection','Write')){$case=if($failure-ceq'Scan'){New-CcodTask5DefenderAdapterFixture -ScanThrows}elseif($failure-ceq'Detection'){New-CcodTask5DefenderAdapterFixture -Detects}else{New-CcodTask5DefenderAdapterFixture -WriteThrows};$error=if($failure-ceq'Scan'){'CCOD_DEFENDER_SCAN_FAILED'}elseif($failure-ceq'Detection'){'CCOD_DEFENDER_DETECTIONS_FOUND'}else{'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED'};Assert-CcodThrows {Invoke-CcodTask5DefenderCore -CandidatePath $candidate -ChecksumPath $checksum -ManifestPath $manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $identity -ExpectedVersion $fixture.Version -ExpectedGitCommit $fixture.GitCommit -EvidencePath (Join-Path $fixture.Outside "failure-$failure.json") -Adapters $case.Adapters|Out-Null} $error}
+        $command=Get-Command $defenderPath;Assert-CcodTrue (-not$command.Parameters.ContainsKey('ZoneId')-and-not$command.Parameters.ContainsKey('Adapters')-and-not$command.Parameters.ContainsKey('Library')) 'public tool exposes no Zone synthesis adapter or library bypass parameter'
+    }finally{Remove-CcodTask5ExactAssetFixture $fixture}
 }
 
 Invoke-CcodTask5Test 'evidence' 'Defender default evidence writer is create-only and rejects unsafe targets before scan' {
-    . $defenderPath -Library
-    $fixture=New-CcodReleaseFixture
+    $fixture=New-CcodTask5ExactAssetFixture
     $unsafeOutside=$null;$unsafeLink=$null
     try{
-        $identity=New-CcodTask5WorkflowIdentity ('a'*40)
-        $clean=New-CcodTask5DefenderAdapterFixture;$adapters=@{};foreach($key in @($clean.Adapters.Keys)){if([string]$key-cne'WriteReceipt'){$adapters[[string]$key]=$clean.Adapters[$key]}}
-        $evidence=Join-Path $fixture.Root 'create-only-receipt.json'
-        $receipt=Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $identity -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath $evidence -Adapters $adapters
+        $candidate=Join-Path $fixture.Root $fixture.Names[5];$checksum=Join-Path $fixture.Root $fixture.Names[6];$manifest=Join-Path $fixture.Root $fixture.Names[10];$identity=New-CcodTask5WorkflowIdentity $fixture.GitCommit
+        $clean=New-CcodTask5DefenderAdapterFixture;$evidence=Join-Path $fixture.Outside 'create-only-receipt.json'
+        $receipt=Invoke-CcodTask5DefenderCore -CandidatePath $candidate -ChecksumPath $checksum -ManifestPath $manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $identity -ExpectedVersion $fixture.Version -ExpectedGitCommit $fixture.GitCommit -EvidencePath $evidence -Adapters $clean.Adapters
         Assert-CcodTrue (Test-Path -LiteralPath $evidence -PathType Leaf) 'default writer creates the requested regular evidence leaf'
         $persisted=[IO.File]::ReadAllText($evidence,[Text.UTF8Encoding]::new($false,$true))|ConvertFrom-Json
         Assert-CcodEqual ($receipt|ConvertTo-Json -Depth 12 -Compress) ($persisted|ConvertTo-Json -Depth 12 -Compress) 'default writer persists only the returned canonical receipt'
-        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath $fixture.Root -Force|Where-Object{$_.Name-like'.ccod-defender-receipt-*'}).Count 'default writer leaves no temporary evidence leaf'
+        Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath $fixture.Outside -Force|Where-Object{$_.Name-like'.ccod-defender-receipt-*'}).Count 'default writer leaves no temporary evidence leaf'
 
         foreach($shape in @('ExistingFile','Directory','ReparseLeaf','UnsafeAncestry','Noncanonical','AlternateStream')){
-            $case=New-CcodTask5DefenderAdapterFixture;$caseAdapters=@{};foreach($key in @($case.Adapters.Keys)){if([string]$key-cne'WriteReceipt'){$caseAdapters[[string]$key]=$case.Adapters[$key]}}
-            $target=Join-Path $fixture.Root ("invalid-$shape.json")
+            $case=New-CcodTask5DefenderAdapterFixture;$target=Join-Path $fixture.Outside ("invalid-$shape.json")
             $existingText=$null;$cleanupLink=$null
             switch($shape){
                 'ExistingFile'{$existingText='do-not-overwrite';[IO.File]::WriteAllText($target,$existingText,[Text.UTF8Encoding]::new($false))}
                 'Directory'{[IO.Directory]::CreateDirectory($target)|Out-Null}
                 'ReparseLeaf'{$outside=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task5-evidence-leaf-'+[guid]::NewGuid().ToString('N'));[IO.Directory]::CreateDirectory($outside)|Out-Null;$cleanupLink=$target;New-Item -ItemType Junction -Path $target -Target $outside|Out-Null}
-                'UnsafeAncestry'{$unsafeOutside=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task5-evidence-parent-'+[guid]::NewGuid().ToString('N'));[IO.Directory]::CreateDirectory($unsafeOutside)|Out-Null;$unsafeLink=Join-Path $fixture.Root 'unsafe-evidence-parent';New-Item -ItemType Junction -Path $unsafeLink -Target $unsafeOutside|Out-Null;$target=Join-Path $unsafeLink 'receipt.json';$cleanupLink=$unsafeLink}
-                'Noncanonical'{$target=$fixture.Root+'\.\noncanonical-receipt.json'}
-                'AlternateStream'{$target=(Join-Path $fixture.Root 'alternate-receipt.json:stream')}
+                'UnsafeAncestry'{$unsafeOutside=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task5-evidence-parent-'+[guid]::NewGuid().ToString('N'));[IO.Directory]::CreateDirectory($unsafeOutside)|Out-Null;$unsafeLink=Join-Path $fixture.Outside 'unsafe-evidence-parent';New-Item -ItemType Junction -Path $unsafeLink -Target $unsafeOutside|Out-Null;$target=Join-Path $unsafeLink 'receipt.json';$cleanupLink=$unsafeLink}
+                'Noncanonical'{$target=$fixture.Outside+'\.\noncanonical-receipt.json'}
+                'AlternateStream'{$target=(Join-Path $fixture.Outside 'alternate-receipt.json:stream')}
             }
             try{
-                Assert-CcodThrows {Invoke-CcodReleaseDefenderCheck -CandidatePath $fixture.Installer -ChecksumPath $fixture.Checksum -ManifestPath $fixture.Manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $identity -ExpectedVersion '2.5.0' -ExpectedGitCommit ('a'*40) -EvidencePath $target -Adapters $caseAdapters|Out-Null} 'CCOD_DEFENDER_EVIDENCE_INVALID'
+                Assert-CcodThrows {Invoke-CcodTask5DefenderCore -CandidatePath $candidate -ChecksumPath $checksum -ManifestPath $manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $identity -ExpectedVersion $fixture.Version -ExpectedGitCommit $fixture.GitCommit -EvidencePath $target -Adapters $case.Adapters|Out-Null} 'CCOD_DEFENDER_EVIDENCE_INVALID'
                 Assert-CcodTrue (-not($case.State.Calls-contains'Scan')) "$shape evidence target is rejected before Defender scan"
                 if($shape-ceq'ExistingFile'){Assert-CcodEqual $existingText ([IO.File]::ReadAllText($target,[Text.UTF8Encoding]::new($false,$true))) 'existing evidence remains byte-for-byte unchanged'}
             }finally{
@@ -2502,7 +2556,7 @@ Invoke-CcodTask5Test 'evidence' 'Defender default evidence writer is create-only
     }finally{
         if($null-ne$unsafeLink-and(Test-Path -LiteralPath $unsafeLink)){[IO.Directory]::Delete($unsafeLink)}
         if($null-ne$unsafeOutside-and(Test-Path -LiteralPath $unsafeOutside)){Remove-Item -LiteralPath $unsafeOutside -Recurse -Force}
-        if(Test-Path $fixture.Root){Remove-Item -LiteralPath $fixture.Root -Recurse -Force}
+        Remove-CcodTask5ExactAssetFixture $fixture
     }
 }
 
@@ -2911,7 +2965,7 @@ Invoke-CcodTest '2.5.22 source metadata and documentation match the release cont
 }
 
 Invoke-CcodTest 'portable release manifest binds the ZIP payload manifest and each archived payload file' {
-    . $defenderPath -Library
+    Import-Module $assetContractPath -Force -DisableNameChecking
     $fixture = New-CcodPortableReleaseFixture
     try {
         $validated = Test-CcodReleaseAssetManifest -ManifestPath $fixture.Manifest -AssetDirectory $fixture.Root -ExpectedVersion '2.5.6'
diff --git a/tools/ReleaseAssetContract.psm1 b/tools/ReleaseAssetContract.psm1
index 34104b4..b41df43 100644
--- a/tools/ReleaseAssetContract.psm1
+++ b/tools/ReleaseAssetContract.psm1
@@ -1,6 +1,137 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
+function Initialize-CcodReleaseFileAuthority {
+    if ($null -ne ('CcodReleaseFileAuthorityV1' -as [type])) { return }
+    Add-Type -TypeDefinition @'
+using System;
+using System.ComponentModel;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+
+public sealed class CcodReleaseFileIdentityV1
+{
+    public uint Attributes;
+    public uint Volume;
+    public ulong FileId;
+    public uint Links;
+    public string FinalPath;
+    public string[] Streams;
+}
+
+public static class CcodReleaseFileAuthorityV1
+{
+    private const uint ListDirectory=0x00000001U, ReadAttributes=0x00000080U, Synchronize=0x00100000U, GenericRead=0x80000000U, GenericWrite=0x40000000U, DeleteAccess=0x00010000U;
+    private const uint ShareRead=0x00000001U, ShareWrite=0x00000002U, ShareDelete=0x00000004U, CreateNew=1U, OpenExisting=3U, FileCreate=2U, AttributeNormal=0x00000080U, FlagWriteThrough=0x80000000U, FlagBackup=0x02000000U, FlagReparse=0x00200000U;
+    private const uint AttributeDirectory=0x00000010U, AttributeReparse=0x00000400U;
+    private const uint ObjectCaseInsensitive=0x00000040U, OptionSynchronous=0x00000020U, OptionNonDirectory=0x00000040U, OptionOpenReparse=0x00200000U;
+    private const int FileDirectoryInformation=1, FileStreamInfo=7, FileRenameInfo=3, FileDispositionInfo=4, NtFileRenameInformation=10;
+    private const int StatusNoMoreFiles=unchecked((int)0x80000006);
+
+    [StructLayout(LayoutKind.Sequential)] private struct NativeTime { public uint Low,High; }
+    [StructLayout(LayoutKind.Sequential)] private struct UnicodeString { public ushort Length,MaximumLength; public IntPtr Buffer; }
+    [StructLayout(LayoutKind.Sequential)] private struct ObjectAttributes { public int Length; public IntPtr RootDirectory,ObjectName; public uint Attributes; public IntPtr SecurityDescriptor,SecurityQualityOfService; }
+    [StructLayout(LayoutKind.Sequential)] private struct IoStatus { public IntPtr Status; public UIntPtr Information; }
+    [StructLayout(LayoutKind.Sequential)] private struct NativeInfo
+    {
+        public uint Attributes; public NativeTime Creation,Access,Write;
+        public uint Volume,SizeHigh,SizeLow,Links,IndexHigh,IndexLow;
+    }
+
+    [DllImport("kernel32.dll",CharSet=CharSet.Unicode,SetLastError=true)]
+    private static extern SafeFileHandle CreateFileW(string path,uint access,uint share,IntPtr security,uint creation,uint flags,IntPtr template);
+    [DllImport("kernel32.dll",SetLastError=true)] private static extern bool GetFileInformationByHandle(SafeFileHandle handle,out NativeInfo info);
+    [DllImport("kernel32.dll",CharSet=CharSet.Unicode,SetLastError=true)] private static extern uint GetFinalPathNameByHandleW(SafeFileHandle handle,StringBuilder value,uint length,uint flags);
+    [DllImport("kernel32.dll",SetLastError=true)] private static extern bool GetFileInformationByHandleEx(SafeFileHandle handle,int infoClass,IntPtr info,uint size);
+    [DllImport("kernel32.dll",SetLastError=true)] private static extern bool SetFileInformationByHandle(SafeFileHandle handle,int infoClass,IntPtr info,uint size);
+    [DllImport("ntdll.dll")] private static extern int NtCreateFile(out IntPtr handle,uint access,ref ObjectAttributes attributes,out IoStatus io,IntPtr allocationSize,uint fileAttributes,uint share,uint disposition,uint options,IntPtr ea,uint eaLength);
+    [DllImport("ntdll.dll")] private static extern int NtSetInformationFile(SafeFileHandle handle,out IoStatus io,IntPtr info,uint length,int infoClass);
+    [DllImport("ntdll.dll")] private static extern int NtQueryDirectoryFile(SafeFileHandle handle,IntPtr evt,IntPtr apc,IntPtr context,out IoStatus io,IntPtr info,uint length,int infoClass,bool single,IntPtr name,bool restart);
+    [DllImport("ntdll.dll")] private static extern uint RtlNtStatusToDosError(int status);
+
+    public static SafeFileHandle OpenDirectory(string path,bool allowChildMutation)
+    {
+        uint share=allowChildMutation?ShareRead|ShareWrite|ShareDelete:ShareRead;SafeFileHandle handle=CreateFileW(Path.GetFullPath(path),ListDirectory|ReadAttributes|Synchronize,share,IntPtr.Zero,OpenExisting,FlagBackup|FlagReparse,IntPtr.Zero);
+        if(handle.IsInvalid){int error=Marshal.GetLastWin32Error();handle.Dispose();throw new Win32Exception(error);}return handle;
+    }
+
+    public static FileStream CreateReceiptFile(string path)
+    {
+        SafeFileHandle handle=CreateFileW(Path.GetFullPath(path),GenericRead|GenericWrite|DeleteAccess|ReadAttributes|Synchronize,ShareRead,IntPtr.Zero,CreateNew,AttributeNormal|FlagWriteThrough|FlagReparse,IntPtr.Zero);
+        if(handle.IsInvalid){int error=Marshal.GetLastWin32Error();handle.Dispose();throw new Win32Exception(error);}try{return new FileStream(handle,FileAccess.ReadWrite,4096,false);}catch{handle.Dispose();throw;}
+    }
+
+    public static FileStream CreateReceiptFileRelative(SafeFileHandle directory,string leaf)
+    {
+        ValidateLeaf(leaf);IntPtr nameBuffer=IntPtr.Zero,unicodePointer=IntPtr.Zero;bool added=false;
+        try
+        {
+            directory.DangerousAddRef(ref added);nameBuffer=Marshal.StringToHGlobalUni(leaf);UnicodeString unicode=new UnicodeString{Length=(ushort)(leaf.Length*2),MaximumLength=(ushort)((leaf.Length+1)*2),Buffer=nameBuffer};unicodePointer=Marshal.AllocHGlobal(Marshal.SizeOf(typeof(UnicodeString)));Marshal.StructureToPtr(unicode,unicodePointer,false);ObjectAttributes attributes=new ObjectAttributes{Length=Marshal.SizeOf(typeof(ObjectAttributes)),RootDirectory=directory.DangerousGetHandle(),ObjectName=unicodePointer,Attributes=ObjectCaseInsensitive};IoStatus io;IntPtr raw;int status=NtCreateFile(out raw,GenericRead|GenericWrite|DeleteAccess|ReadAttributes|Synchronize,ref attributes,out io,IntPtr.Zero,AttributeNormal,ShareRead,FileCreate,OptionSynchronous|OptionNonDirectory|OptionOpenReparse,IntPtr.Zero,0);if(status<0)throw new Win32Exception((int)RtlNtStatusToDosError(status));SafeFileHandle handle=new SafeFileHandle(raw,true);try{return new FileStream(handle,FileAccess.ReadWrite,4096,false);}catch{handle.Dispose();throw;}
+        }
+        finally{if(unicodePointer!=IntPtr.Zero)Marshal.FreeHGlobal(unicodePointer);if(nameBuffer!=IntPtr.Zero)Marshal.FreeHGlobal(nameBuffer);if(added)directory.DangerousRelease();}
+    }
+
+    public static FileStream OpenReadFile(string path,bool shareExistingWriter)
+    {
+        uint share=ShareRead|(shareExistingWriter?ShareWrite|ShareDelete:0U);SafeFileHandle handle=CreateFileW(path,GenericRead|ReadAttributes|Synchronize,share,IntPtr.Zero,OpenExisting,FlagReparse,IntPtr.Zero);
+        if(handle.IsInvalid){int error=Marshal.GetLastWin32Error();handle.Dispose();throw new Win32Exception(error);}try{return new FileStream(handle,FileAccess.Read,65536,false);}catch{handle.Dispose();throw;}
+    }
+
+    public static CcodReleaseFileIdentityV1 Identity(SafeFileHandle handle)
+    {
+        if(handle==null||handle.IsClosed||handle.IsInvalid)throw new ObjectDisposedException("release file authority");
+        NativeInfo value;if(!GetFileInformationByHandle(handle,out value))throw new Win32Exception(Marshal.GetLastWin32Error());
+        return new CcodReleaseFileIdentityV1{Attributes=value.Attributes,Volume=value.Volume,FileId=((ulong)value.IndexHigh<<32)|value.IndexLow,Links=value.Links,FinalPath=FinalPath(handle),Streams=Streams(handle)};
+    }
+
+    public static bool IsDirectory(CcodReleaseFileIdentityV1 value){return(value.Attributes&AttributeDirectory)!=0U;}
+    public static bool IsReparse(CcodReleaseFileIdentityV1 value){return(value.Attributes&AttributeReparse)!=0U;}
+
+    public static int MoveNoReplace(SafeFileHandle source,string destination)
+    {
+        string full=Path.GetFullPath(destination),native=full.StartsWith(@"\\",StringComparison.Ordinal)?@"\??\UNC\"+full.Substring(2):@"\??\"+full;
+        byte[] name=Encoding.Unicode.GetBytes(native);int rootOffset=IntPtr.Size,lengthOffset=rootOffset+IntPtr.Size,nameOffset=lengthOffset+sizeof(uint),size=checked(nameOffset+name.Length+sizeof(char));
+        IntPtr buffer=Marshal.AllocHGlobal(size);try{for(int i=0;i<size;i++)Marshal.WriteByte(buffer,i,0);Marshal.WriteByte(buffer,0,0);Marshal.WriteIntPtr(buffer,rootOffset,IntPtr.Zero);Marshal.WriteInt32(buffer,lengthOffset,name.Length);Marshal.Copy(name,0,IntPtr.Add(buffer,nameOffset),name.Length);return SetFileInformationByHandle(source,FileRenameInfo,buffer,(uint)size)?0:Marshal.GetLastWin32Error();}finally{Marshal.FreeHGlobal(buffer);}
+    }
+
+    public static int MoveNoReplaceRelative(SafeFileHandle source,SafeFileHandle directory,string leaf)
+    {
+        ValidateLeaf(leaf);byte[] name=Encoding.Unicode.GetBytes(leaf);int rootOffset=IntPtr.Size,lengthOffset=rootOffset+IntPtr.Size,nameOffset=lengthOffset+sizeof(uint),size=checked(nameOffset+name.Length+sizeof(char));IntPtr buffer=Marshal.AllocHGlobal(size);bool added=false;
+        try{directory.DangerousAddRef(ref added);for(int i=0;i<size;i++)Marshal.WriteByte(buffer,i,0);Marshal.WriteByte(buffer,0,0);Marshal.WriteIntPtr(buffer,rootOffset,directory.DangerousGetHandle());Marshal.WriteInt32(buffer,lengthOffset,name.Length);Marshal.Copy(name,0,IntPtr.Add(buffer,nameOffset),name.Length);IoStatus io;int status=NtSetInformationFile(source,out io,buffer,(uint)size,NtFileRenameInformation);return status<0?(int)RtlNtStatusToDosError(status):0;}finally{if(added)directory.DangerousRelease();Marshal.FreeHGlobal(buffer);}
+    }
+
+    public static int Delete(SafeFileHandle file)
+    {
+        IntPtr buffer=Marshal.AllocHGlobal(1);try{Marshal.WriteByte(buffer,0,1);return SetFileInformationByHandle(file,FileDispositionInfo,buffer,1)?0:Marshal.GetLastWin32Error();}finally{Marshal.FreeHGlobal(buffer);}
+    }
+
+    public static string[] EnumerateDirectory(SafeFileHandle directory)
+    {
+        System.Collections.Generic.List<string> values=new System.Collections.Generic.List<string>();System.Collections.Generic.HashSet<string> seen=new System.Collections.Generic.HashSet<string>(StringComparer.OrdinalIgnoreCase);IntPtr buffer=Marshal.AllocHGlobal(65536);bool restart=true;
+        try{while(true){IoStatus io;int status=NtQueryDirectoryFile(directory,IntPtr.Zero,IntPtr.Zero,IntPtr.Zero,out io,buffer,65536,FileDirectoryInformation,false,IntPtr.Zero,restart);restart=false;if(status==StatusNoMoreFiles)break;if(status<0)throw new Win32Exception((int)RtlNtStatusToDosError(status));int offset=0;while(true){uint next=(uint)Marshal.ReadInt32(buffer,offset),length=(uint)Marshal.ReadInt32(buffer,offset+60);string value=Marshal.PtrToStringUni(IntPtr.Add(buffer,offset+64),(int)length/2);if(value!="."&&value!=".."){if(!seen.Add(value))throw new InvalidDataException("duplicate directory member");values.Add(value);}if(next==0)break;offset+=(int)next;}}values.Sort(StringComparer.Ordinal);return values.ToArray();}finally{Marshal.FreeHGlobal(buffer);}
+    }
+
+    private static void ValidateLeaf(string leaf){if(String.IsNullOrWhiteSpace(leaf)||leaf=="."||leaf==".."||leaf.IndexOfAny(new[]{'\\','/',':'})>=0||leaf.EndsWith(".",StringComparison.Ordinal)||leaf.EndsWith(" ",StringComparison.Ordinal))throw new ArgumentException("unsafe leaf");}
+
+    private static string FinalPath(SafeFileHandle handle)
+    {
+        StringBuilder value=new StringBuilder(512);uint length=GetFinalPathNameByHandleW(handle,value,(uint)value.Capacity,0);
+        if(length==0)throw new Win32Exception(Marshal.GetLastWin32Error());if(length>=value.Capacity){value.Capacity=(int)length+1;length=GetFinalPathNameByHandleW(handle,value,(uint)value.Capacity,0);if(length==0||length>=value.Capacity)throw new Win32Exception(Marshal.GetLastWin32Error());}
+        string path=value.ToString();if(path.StartsWith(@"\\?\UNC\",StringComparison.OrdinalIgnoreCase))return@"\\"+path.Substring(8);if(path.StartsWith(@"\\?\",StringComparison.OrdinalIgnoreCase))return path.Substring(4);return path;
+    }
+
+    private static string[] Streams(SafeFileHandle handle)
+    {
+        IntPtr buffer=Marshal.AllocHGlobal(65536);try{if(!GetFileInformationByHandleEx(handle,FileStreamInfo,buffer,65536)){int error=Marshal.GetLastWin32Error();if(error==38)return new[]{"::$DATA"};throw new Win32Exception(error);}System.Collections.Generic.List<string> values=new System.Collections.Generic.List<string>();int offset=0;while(true){uint next=(uint)Marshal.ReadInt32(buffer,offset),nameLength=(uint)Marshal.ReadInt32(buffer,offset+4);values.Add(Marshal.PtrToStringUni(IntPtr.Add(buffer,offset+24),(int)nameLength/2));if(next==0)break;offset+=(int)next;}return values.ToArray();}finally{Marshal.FreeHGlobal(buffer);}
+    }
+}
+'@
+}
+
+Initialize-CcodReleaseFileAuthority
+
 $script:CcodReleaseReceiptFields = @(
     'schemaVersion','assetType','assetName','assetSha256','checksumName','checksumSha256',
     'manifestName','manifestSha256','version','gitCommit','origin','workflowArtifactIdentity',
@@ -16,6 +147,116 @@ function Throw-CcodReleaseContractError {
         [Management.Automation.ErrorCategory]::InvalidData,$Target)
 }
 
+function Test-CcodReleaseAuthorityFinalPath {
+    param([string]$Actual,[string]$Expected,[switch]$Zone)
+    try{$right=[IO.Path]::GetFullPath($Expected).TrimEnd('\');$left=if($Zone){$Actual.TrimEnd('\')}else{[IO.Path]::GetFullPath($Actual).TrimEnd('\')}}catch{return $false}
+    if($Zone){return $left.Equals($right+':Zone.Identifier',[StringComparison]::OrdinalIgnoreCase)-or$left.Equals($right+':Zone.Identifier:$DATA',[StringComparison]::OrdinalIgnoreCase)}
+    return $left.Equals($right,[StringComparison]::OrdinalIgnoreCase)
+}
+
+function Test-CcodReleaseAuthorityStreams {
+    param($Identity,[switch]$Directory,[switch]$AllowZone)
+    $seen=[Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+    foreach($name in @($Identity.Streams)){
+        if($name-isnot[string]-or-not$seen.Add([string]$name)){return $false}
+        if($Directory){if($name-cnotin@('::$DATA','::$INDEX_ALLOCATION')){return $false}}
+        elseif($name-cne'::$DATA'-and(-not$AllowZone-or$name-cne':Zone.Identifier:$DATA')){return $false}
+    }
+    if($Directory){return $seen.Contains('::$DATA')-or$seen.Contains('::$INDEX_ALLOCATION')};return $seen.Contains('::$DATA')
+}
+
+function Get-CcodReleaseAuthorityStreamSha256 {
+    param([Parameter(Mandatory)][IO.FileStream]$Stream)
+    $position=$Stream.Position;$sha=[Security.Cryptography.SHA256]::Create()
+    try{$Stream.Position=0;return [BitConverter]::ToString($sha.ComputeHash($Stream)).Replace('-','').ToLowerInvariant()}finally{$Stream.Position=$position;$sha.Dispose()}
+}
+
+function Get-CcodReleaseAuthorityStreamBytes {
+    param([Parameter(Mandatory)][IO.FileStream]$Stream,[Parameter(Mandatory)][long]$MaximumBytes)
+    if($Stream.Length-lt1-or$Stream.Length-gt$MaximumBytes){throw 'release file length'}
+    $position=$Stream.Position
+    try{$Stream.Position=0;$bytes=[byte[]]::new([int]$Stream.Length);$offset=0;while($offset-lt$bytes.Length){$read=$Stream.Read($bytes,$offset,$bytes.Length-$offset);if($read-le0){throw 'release file truncated'};$offset+=$read};return ,$bytes}finally{$Stream.Position=$position}
+}
+
+function Open-CcodReleaseDirectoryAuthority {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$ErrorId,[switch]$AllowChildMutation)
+    $handle=$null
+    try{
+        $full=Assert-CcodReleaseContractPlainPath -Path $Path -Directory $true -ErrorId $ErrorId
+        $handle=[CcodReleaseFileAuthorityV1]::OpenDirectory($full,[bool]$AllowChildMutation);$identity=[CcodReleaseFileAuthorityV1]::Identity($handle)
+        if(-not[CcodReleaseFileAuthorityV1]::IsDirectory($identity)-or[CcodReleaseFileAuthorityV1]::IsReparse($identity)-or-not(Test-CcodReleaseAuthorityFinalPath $identity.FinalPath $full)-or-not(Test-CcodReleaseAuthorityStreams $identity -Directory)){throw ('directory identity attrs='+$identity.Attributes+' final='+$identity.FinalPath+' expected='+$full+' streams='+(@($identity.Streams)-join'|'))}
+        $children=[CcodReleaseFileAuthorityV1]::EnumerateDirectory($handle)
+        $result=[pscustomobject]@{Kind='Directory';Path=$full;Handle=$handle;Identity=$identity;Children=[string[]]$children;Closed=$false};$handle=$null;return $result
+    }catch{if($null-ne$handle){$handle.Dispose()};Throw-CcodReleaseContractError $ErrorId 'Release directory authority is unsafe or changed.' $Path}
+}
+
+function Open-CcodReleaseFileAuthority {
+    param([Parameter(Mandatory)]$Directory,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)][string]$ErrorId,[long]$MaximumBytes=536870912,[switch]$AllowZone,[switch]$ShareDelete)
+    $stream=$null
+    try{
+        if($null-eq$Directory-or$Directory.Closed-or$Directory.Kind-cne'Directory'-or$Leaf-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$'-or$Leaf.EndsWith('.')-or$Leaf.EndsWith(' ')){throw 'file leaf'}
+        [void](Assert-CcodReleaseAuthorityCurrent -Authority $Directory -ErrorId $ErrorId)
+        $path=Join-Path $Directory.Path $Leaf;$full=Assert-CcodReleaseContractPlainPath -Path $path -Directory $false -ErrorId $ErrorId
+        $stream=[CcodReleaseFileAuthorityV1]::OpenReadFile($full,[bool]$ShareDelete);$identity=[CcodReleaseFileAuthorityV1]::Identity($stream.SafeFileHandle)
+        if([CcodReleaseFileAuthorityV1]::IsDirectory($identity)-or[CcodReleaseFileAuthorityV1]::IsReparse($identity)-or$identity.Links-ne1-or$identity.Volume-ne$Directory.Identity.Volume-or-not(Test-CcodReleaseAuthorityFinalPath $identity.FinalPath $full)-or-not(Test-CcodReleaseAuthorityStreams $identity -AllowZone:$AllowZone)-or$stream.Length-lt1-or$stream.Length-gt$MaximumBytes){throw 'file identity'}
+        $sha=Get-CcodReleaseAuthorityStreamSha256 $stream;$result=[pscustomobject]@{Kind='File';Path=$full;Leaf=$Leaf;Stream=$stream;Identity=$identity;Length=[long]$stream.Length;Sha256=$sha;AllowZone=[bool]$AllowZone;Closed=$false};$stream=$null;return $result
+    }catch{if($null-ne$stream){$stream.Dispose()};Throw-CcodReleaseContractError $ErrorId 'Release file authority is unsafe or changed.' $Leaf}
+}
+
+function Open-CcodReleaseZoneAuthority {
+    param([Parameter(Mandatory)]$File,[Parameter(Mandatory)][string]$ErrorId)
+    $stream=$null
+    try{
+        [void](Assert-CcodReleaseAuthorityCurrent -Authority $File -ErrorId $ErrorId)
+        $stream=[CcodReleaseFileAuthorityV1]::OpenReadFile($File.Path+':Zone.Identifier',$false);$identity=[CcodReleaseFileAuthorityV1]::Identity($stream.SafeFileHandle)
+        if([CcodReleaseFileAuthorityV1]::IsDirectory($identity)-or[CcodReleaseFileAuthorityV1]::IsReparse($identity)-or$identity.Links-ne1-or$identity.Volume-ne$File.Identity.Volume-or$identity.FileId-ne$File.Identity.FileId-or-not(Test-CcodReleaseAuthorityFinalPath $identity.FinalPath $File.Path -Zone)-or$stream.Length-lt1-or$stream.Length-gt65536){throw 'zone identity'}
+        $sha=Get-CcodReleaseAuthorityStreamSha256 $stream;$result=[pscustomobject]@{Kind='Zone';Path=$File.Path;Stream=$stream;Identity=$identity;Length=[long]$stream.Length;Sha256=$sha;Closed=$false};$stream=$null;return $result
+    }catch{if($null-ne$stream){$stream.Dispose()};Throw-CcodReleaseContractError $ErrorId 'Release Zone authority is missing, unsafe, or changed.' $File.Path}
+}
+
+function Assert-CcodReleaseAuthorityCurrent {
+    param([Parameter(Mandatory)]$Authority,[Parameter(Mandatory)][string]$ErrorId,[switch]$CheckBytes)
+    try{
+        if($null-eq$Authority-or$Authority.Closed){throw 'closed authority'}
+        $handle=if($Authority.Kind-ceq'Directory'){$Authority.Handle}else{$Authority.Stream.SafeFileHandle};$current=[CcodReleaseFileAuthorityV1]::Identity($handle);$expected=$Authority.Identity
+        if($current.Volume-ne$expected.Volume-or$current.FileId-ne$expected.FileId-or$current.Links-ne$expected.Links-or$current.Attributes-ne$expected.Attributes){throw 'identity drift'}
+        if($Authority.Kind-ceq'Directory'){
+            if(-not(Test-CcodReleaseAuthorityFinalPath $current.FinalPath $Authority.Path)-or-not(Test-CcodReleaseAuthorityStreams $current -Directory)){throw 'directory drift'}
+            $children=[CcodReleaseFileAuthorityV1]::EnumerateDirectory($Authority.Handle);if(($children-join"`0")-cne(@($Authority.Children)-join"`0")){throw 'membership drift'}
+        }elseif($Authority.Kind-ceq'Zone'){
+            if(-not(Test-CcodReleaseAuthorityFinalPath $current.FinalPath $Authority.Path -Zone)-or$Authority.Stream.Length-ne$Authority.Length){throw 'zone drift'}
+        }else{
+            if(-not(Test-CcodReleaseAuthorityFinalPath $current.FinalPath $Authority.Path)-or-not(Test-CcodReleaseAuthorityStreams $current -AllowZone:$Authority.AllowZone)-or$Authority.Stream.Length-ne$Authority.Length){throw 'file drift'}
+        }
+        if($CheckBytes-and(Get-CcodReleaseAuthorityStreamSha256 $Authority.Stream)-cne$Authority.Sha256){throw 'byte drift'}
+        return $true
+    }catch{Throw-CcodReleaseContractError $ErrorId 'Held release authority changed or closed.' $Authority.Path}
+}
+
+function Close-CcodReleaseAuthority {
+    param($Authority)
+    if($null-eq$Authority-or$Authority.Closed){return};try{if($Authority.Kind-ceq'Directory'){$Authority.Handle.Dispose()}else{$Authority.Stream.Dispose()}}finally{$Authority.Closed=$true}
+}
+
+function Publish-CcodReleaseReceiptAuthority {
+    param([Parameter(Mandatory)]$Directory,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)][byte[]]$Bytes,[Parameter(Mandatory)][string]$ErrorId)
+    $stream=$null;$temporary=$null;$committed=$false
+    try{
+        [void](Assert-CcodReleaseAuthorityCurrent -Authority $Directory -ErrorId $ErrorId)
+        if($Leaf-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,255}\.json$'-or$Bytes.Length-lt1-or$Bytes.Length-gt65536){throw 'receipt input'}
+        $target=Join-Path $Directory.Path $Leaf;if([IO.File]::Exists($target)-or[IO.Directory]::Exists($target)){throw 'receipt exists'}
+        $temporaryLeaf='.ccod-defender-receipt-'+[guid]::NewGuid().ToString('N')+'.tmp';$temporary=Join-Path $Directory.Path $temporaryLeaf;$stream=[CcodReleaseFileAuthorityV1]::CreateReceiptFileRelative($Directory.Handle,$temporaryLeaf);$stream.Write($Bytes,0,$Bytes.Length);$stream.Flush($true)
+        $before=[CcodReleaseFileAuthorityV1]::Identity($stream.SafeFileHandle);if([CcodReleaseFileAuthorityV1]::IsDirectory($before)-or[CcodReleaseFileAuthorityV1]::IsReparse($before)-or$before.Links-ne1-or-not(Test-CcodReleaseAuthorityFinalPath $before.FinalPath $temporary)-or-not(Test-CcodReleaseAuthorityStreams $before)){throw 'temporary identity'}
+        $move=[CcodReleaseFileAuthorityV1]::MoveNoReplaceRelative($stream.SafeFileHandle,$Directory.Handle,$Leaf);if($move-ne0){throw "receipt rename $move"};$committed=$true
+        $after=[CcodReleaseFileAuthorityV1]::Identity($stream.SafeFileHandle);if($after.Volume-ne$before.Volume-or$after.FileId-ne$before.FileId-or-not(Test-CcodReleaseAuthorityFinalPath $after.FinalPath $target)){throw 'receipt publish identity'}
+        $sha=Get-CcodReleaseAuthorityStreamSha256 $stream;$result=[pscustomobject]@{Kind='File';Path=$target;Leaf=$Leaf;Stream=$stream;Identity=$after;Length=[long]$stream.Length;Sha256=$sha;AllowZone=$false;Closed=$false};$stream=$null;return $result
+    }catch{
+        $detail=$_.Exception.Message
+        if($null-ne$stream){if(-not$committed){try{[void][CcodReleaseFileAuthorityV1]::Delete($stream.SafeFileHandle)}catch{}};$stream.Dispose()}
+        Throw-CcodReleaseContractError $ErrorId ('Defender receipt could not be durably published: '+$detail) $Leaf
+    }
+}
+
 function Get-CcodExpectedReleaseAssetNames {
     [CmdletBinding()]
     param([Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$Version)
@@ -34,6 +275,27 @@ function Get-CcodExpectedReleaseAssetNames {
     )
 }
 
+function Open-CcodExactReleaseAssetAuthority {
+    param([Parameter(Mandatory)][string]$AssetDirectory,[Parameter(Mandatory)][string]$Version,[Parameter(Mandatory)][string]$ErrorId)
+    $directory=$null;$files=[Collections.Generic.List[object]]::new()
+    try{
+        $names=@(Get-CcodExpectedReleaseAssetNames -Version $Version);$directory=Open-CcodReleaseDirectoryAuthority -Path $AssetDirectory -ErrorId $ErrorId;$expectedSorted=[string[]]@($names);[Array]::Sort($expectedSorted,[StringComparer]::Ordinal)
+        if($directory.Children.Count-ne$names.Count-or($directory.Children-join"`0")-cne($expectedSorted-join"`0")){throw ('exact asset membership actual='+($directory.Children-join'|')+' expected='+($expectedSorted-join'|'))}
+        for($index=0;$index-lt$names.Count;$index++){$files.Add((Open-CcodReleaseFileAuthority -Directory $directory -Leaf $names[$index] -ErrorId $ErrorId -AllowZone:($index-in@(0,5))))}
+        return [pscustomobject]@{Directory=$directory;Files=@($files);Names=$names;Closed=$false}
+    }catch{foreach($file in @($files)){Close-CcodReleaseAuthority $file};Close-CcodReleaseAuthority $directory;Throw-CcodReleaseContractError $ErrorId 'Exact release asset authority could not be pinned.' $AssetDirectory}
+}
+
+function Assert-CcodExactReleaseAssetAuthorityCurrent {
+    param([Parameter(Mandatory)]$Authority,[Parameter(Mandatory)][string]$ErrorId)
+    if($Authority.Closed){Throw-CcodReleaseContractError $ErrorId 'Exact release asset authority is closed.' $Authority.Directory.Path};Assert-CcodReleaseAuthorityCurrent $Authority.Directory $ErrorId|Out-Null;foreach($file in @($Authority.Files)){Assert-CcodReleaseAuthorityCurrent $file $ErrorId -CheckBytes|Out-Null};return $true
+}
+
+function Close-CcodExactReleaseAssetAuthority {
+    param($Authority)
+    if($null-eq$Authority-or$Authority.Closed){return};for($index=$Authority.Files.Count-1;$index-ge0;$index--){Close-CcodReleaseAuthority $Authority.Files[$index]};Close-CcodReleaseAuthority $Authority.Directory;$Authority.Closed=$true
+}
+
 function Test-CcodReleaseContractCanonicalUtc {
     param($Value)
     if ($Value -isnot [string] -or [string]::IsNullOrWhiteSpace($Value)) { return $false }
@@ -43,6 +305,11 @@ function Test-CcodReleaseContractCanonicalUtc {
         $parsed.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture) -ceq $Value
 }
 
+function Test-CcodReleaseContractJsonInteger {
+    param($Value,[long]$Minimum=0)
+    return ($Value-is[int]-or$Value-is[long])-and[decimal]$Value-eq[decimal][long]$Value-and[long]$Value-ge$Minimum
+}
+
 function Assert-CcodReleaseContractPlainPath {
     param(
         [Parameter(Mandatory)][string]$Path,
@@ -193,6 +460,99 @@ function Read-CcodReleaseContractJson {
     }
 }
 
+function Read-CcodReleaseContractPinnedJson {
+    param([Parameter(Mandatory)]$Authority,[Parameter(Mandatory)][string]$ErrorId,[int64]$MaximumBytes=4194304)
+    try{
+        Assert-CcodReleaseAuthorityCurrent $Authority $ErrorId -CheckBytes|Out-Null;$bytes=Get-CcodReleaseAuthorityStreamBytes $Authority.Stream $MaximumBytes;$raw=[Text.UTF8Encoding]::new($false,$true).GetString($bytes);Assert-CcodReleaseContractJsonLexicalShape $raw;$value=$raw|ConvertFrom-Json -ErrorAction Stop;if($value-isnot[pscustomobject]){throw 'json shape'};Assert-CcodReleaseAuthorityCurrent $Authority $ErrorId -CheckBytes|Out-Null;return [pscustomobject]@{Raw=$raw;Value=$value;Bytes=$bytes}
+    }catch{Throw-CcodReleaseContractError $ErrorId 'Pinned release JSON is malformed, changed, or outside its bound.' $Authority.Path}
+}
+
+function Get-CcodReleaseContractStreamHash {
+    param([Parameter(Mandatory)][IO.Stream]$Stream)
+    $sha=[Security.Cryptography.SHA256]::Create();try{return [BitConverter]::ToString($sha.ComputeHash($Stream)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()}
+}
+
+function Test-CcodReleaseContractTrayProvenance {
+    param([string]$Path,[string]$Version,[string]$GitCommit,[string]$Timestamp,[string]$ErrorId)
+    $record=(Read-CcodReleaseContractJson -Path $Path -ErrorId $ErrorId).Value
+    $top='schemaVersion,product,version,gitCommit,buildTimestampUtc,targetFramework,compiler,referenceRoot,sourceFiles,iconSha256,manifestSha256,configSha256,artifactSha256,configArtifactSha256'
+    if((@($record.PSObject.Properties.Name)-join',')-cne$top-or$record.schemaVersion-isnot[int]-or$record.schemaVersion-ne1-or$record.product-cne'CodexRemote-fix'-or$record.version-cne$Version-or$record.gitCommit-cne$GitCommit-or$record.buildTimestampUtc-cne$Timestamp-or-not(Test-CcodReleaseContractCanonicalUtc $record.buildTimestampUtc)-or$record.targetFramework-cne'net48'-or$record.referenceRoot-cne'locked-net48'-or
+       $record.compiler-isnot[pscustomobject]-or(@($record.compiler.PSObject.Properties.Name)-join',')-cne'name,sha256'-or$record.compiler.name-cne'csc.exe'-or$record.compiler.sha256-cnotmatch'^[0-9a-f]{64}$'){
+        Throw-CcodReleaseContractError $ErrorId 'TrayHost provenance schema or common identity is invalid.' $Path
+    }
+    $previous=$null;$seen=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    foreach($source in @($record.sourceFiles)){
+        if($source-isnot[pscustomobject]-or(@($source.PSObject.Properties.Name)-join',')-cne'name,sha256'-or$source.name-isnot[string]-or$source.name-cnotmatch'^[A-Za-z0-9._-]{1,128}$'-or$source.sha256-isnot[string]-or$source.sha256-cnotmatch'^[0-9a-f]{64}$'-or-not$seen.Add([string]$source.name)-or($null-ne$previous-and[StringComparer]::Ordinal.Compare($previous,[string]$source.name)-ge0)){Throw-CcodReleaseContractError $ErrorId 'TrayHost provenance source records are malformed, duplicate, or unordered.' $Path};$previous=[string]$source.name
+    }
+    if($seen.Count-eq0){Throw-CcodReleaseContractError $ErrorId 'TrayHost provenance source records are empty.' $Path}
+    foreach($field in @('iconSha256','manifestSha256','configSha256','artifactSha256','configArtifactSha256')){if($record.$field-isnot[string]-or$record.$field-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodReleaseContractError $ErrorId 'TrayHost provenance hashes are malformed.' $Path}}
+    return $record
+}
+
+function Test-CcodReleaseContractInventory {
+    param([string]$Path,[string]$ErrorId)
+    try{$text=[IO.File]::ReadAllText($Path,[Text.UTF8Encoding]::new($false,$true));if($text.Length-lt70-or$text.Length-gt1048576){throw 'inventory bounds'};$lines=@($text-split'\r?\n');while($lines.Count-gt0-and$lines[-1]-ceq''){$lines=$lines[0..($lines.Count-2)]};if($lines.Count-lt3-or$lines[0]-cne'procedure AddCcodExpectedSetupDirectories(Directories: TStrings);'-or$lines[1]-cne'begin'-or$lines[-1]-cne'end;'){throw 'inventory frame'};$previous=$null;$seen=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal);for($index=2;$index-lt$lines.Count-1;$index++){if($lines[$index]-cnotmatch"^  Directories\.Add\('(?<path>[A-Za-z0-9._-]+(?:\\[A-Za-z0-9._-]+)*)'\);$"){throw 'inventory line'};$value=[string]$Matches.path;if(-not$seen.Add($value)-or($null-ne$previous-and[StringComparer]::Ordinal.Compare($previous,$value)-ge0)){throw 'inventory order'};$previous=$value};return $text}catch{Throw-CcodReleaseContractError $ErrorId 'Setup destination inventory is not the exact generated grammar.' $Path}
+}
+
+function Test-CcodReleasePortableManifestDeep {
+    param($Manifest,[string]$ManifestRaw,[string]$ManifestPath,[string]$Directory,[string]$Version,[string]$ErrorId)
+    $names=@(Get-CcodExpectedReleaseAssetNames -Version $Version);$expected=@($names[0],$names[1],$names[2],$names[3],'CodexRemote-fix.exe','CodexRemote-fix.exe.config')
+    if((@($Manifest.PSObject.Properties.Name)-join',')-cne'schemaVersion,product,version,gitCommit,buildTimestampUtc,distribution,assets'-or$Manifest.schemaVersion-isnot[int]-or$Manifest.schemaVersion-ne2-or$Manifest.product-cne'CodexRemote-fix'-or$Manifest.version-cne$Version-or$Manifest.gitCommit-isnot[string]-or$Manifest.gitCommit-cnotmatch'^[0-9a-f]{40}$'-or-not(Test-CcodReleaseContractCanonicalUtc $Manifest.buildTimestampUtc)-or$Manifest.distribution-cne'portable-zip'){Throw-CcodReleaseContractError $ErrorId 'Portable release manifest metadata is invalid.' $ManifestPath}
+    $map=Get-CcodReleaseContractManifestMap -Manifest $Manifest -ExpectedNames $expected -ErrorId $ErrorId -Target $ManifestPath
+    foreach($name in $expected[0..3]){if((Get-CcodReleaseContractHash (Join-Path $Directory $name))-cne$map[$name]){Throw-CcodReleaseContractError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Portable public asset hash mismatch.' $name}}
+    $checksum=[IO.File]::ReadAllText((Join-Path $Directory $names[1]),[Text.UTF8Encoding]::new($false,$true)).TrimEnd("`r","`n");if($checksum-cne("$($map[$names[0]]) *$($names[0])")){Throw-CcodReleaseContractError $ErrorId 'Portable checksum is invalid.' $names[1]}
+    [void](Test-CcodReleaseContractTrayProvenance -Path (Join-Path $Directory $names[2]) -Version $Version -GitCommit $Manifest.gitCommit -Timestamp $Manifest.buildTimestampUtc -ErrorId $ErrorId)
+    $payloadPath=Join-Path $Directory $names[3];$payload=(Read-CcodReleaseContractJson -Path $payloadPath -ErrorId $ErrorId).Value
+    if((@($payload.PSObject.Properties.Name)-join',')-cne'schemaVersion,product,version,gitCommit,buildTimestampUtc,files'-or$payload.schemaVersion-isnot[int]-or$payload.schemaVersion-ne1-or$payload.product-cne'CodexRemote-fix'-or$payload.version-cne$Version-or$payload.gitCommit-cne$Manifest.gitCommit-or$payload.buildTimestampUtc-cne$Manifest.buildTimestampUtc){Throw-CcodReleaseContractError $ErrorId 'Portable payload manifest metadata is invalid.' $payloadPath}
+    $fileRecords=[Collections.Generic.Dictionary[string,object]]::new([StringComparer]::Ordinal);$previous=$null
+    foreach($record in @($payload.files)){if($record-isnot[pscustomobject]-or(@($record.PSObject.Properties.Name)-join',')-cne'path,length,sha256'-or$record.path-isnot[string]-or$record.path-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$'-or$record.path.Contains('//')-or$record.path.Contains(':')-or$record.path-match'(^|/)\.\.?(?:/|$)'-or($record.length-isnot[int]-and$record.length-isnot[long])-or[long]$record.length-lt0-or$record.sha256-isnot[string]-or$record.sha256-cnotmatch'^[0-9a-f]{64}$'-or$fileRecords.ContainsKey([string]$record.path)-or($null-ne$previous-and[StringComparer]::Ordinal.Compare($previous,[string]$record.path)-ge0)){Throw-CcodReleaseContractError $ErrorId 'Portable payload records are malformed, duplicate, or unordered.' $payloadPath};$fileRecords.Add([string]$record.path,$record);$previous=[string]$record.path}
+    if($fileRecords.Count-eq0){Throw-CcodReleaseContractError $ErrorId 'Portable payload manifest is empty.' $payloadPath}
+    Add-Type -AssemblyName System.IO.Compression.FileSystem -ErrorAction Stop;$archive=$null
+    try{
+        $archive=[IO.Compression.ZipFile]::OpenRead((Join-Path $Directory $names[0]));$zip=[Collections.Generic.Dictionary[string,object]]::new([StringComparer]::Ordinal)
+        foreach($entry in @($archive.Entries)){$name=([string]$entry.FullName).Replace('\','/');if($name.EndsWith('/')){if($name-cne'payload/'-and-not$name.StartsWith('payload/',[StringComparison]::Ordinal)){throw 'unexpected directory'};continue};if($name-isnot[string]-or$name-cmatch'(^|/)\.\.?(?:/|$)|:'-or$zip.ContainsKey($name)){throw 'zip entry'};$zip.Add($name,$entry)}
+        $expectedZip=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal);foreach($root in @('CodexRemote-fix.exe','CodexRemote-fix.exe.config','Install-CodexRemote-fix.ps1','payload-manifest.json')){[void]$expectedZip.Add($root)};foreach($path in $fileRecords.Keys){[void]$expectedZip.Add('payload/'+$path)}
+        if($zip.Count-ne$expectedZip.Count-or@($zip.Keys|Where-Object{-not$expectedZip.Contains($_)}).Count-ne0){throw 'zip membership'}
+        $entry=$zip['payload-manifest.json'];$stream=$entry.Open();try{if((Get-CcodReleaseContractStreamHash $stream)-cne(Get-CcodReleaseContractHash $payloadPath)){throw 'embedded manifest'}}finally{$stream.Dispose()}
+        foreach($root in @('CodexRemote-fix.exe','CodexRemote-fix.exe.config')){$stream=$zip[$root].Open();try{if((Get-CcodReleaseContractStreamHash $stream)-cne$map[$root]){throw 'root launcher'}}finally{$stream.Dispose()}}
+        foreach($path in $fileRecords.Keys){$record=$fileRecords[$path];$entry=$zip['payload/'+$path];if([long]$entry.Length-ne[long]$record.length){throw 'payload length'};$stream=$entry.Open();try{if((Get-CcodReleaseContractStreamHash $stream)-cne$record.sha256){throw 'payload hash'}}finally{$stream.Dispose()}}
+    }catch{Throw-CcodReleaseContractError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Portable ZIP does not match its deep payload contract.' $names[0]}finally{if($null-ne$archive){$archive.Dispose()}}
+    return [pscustomobject][ordered]@{Valid=$true;Version=$Version;GitCommit=[string]$Manifest.gitCommit;BuildTimestampUtc=[string]$Manifest.buildTimestampUtc;InstallerSha256=[string]$map[$names[0]];InstallerName=$names[0];Distribution='portable-zip'}
+}
+
+function Test-CcodReleaseSetupManifestDeep {
+    param($Manifest,[string]$ManifestPath,[string]$Directory,[string]$Version,[string]$ErrorId)
+    $names=@(Get-CcodExpectedReleaseAssetNames -Version $Version);$expected=@($names[5],$names[6],$names[2],$names[7],$names[8],$names[9])
+    if((@($Manifest.PSObject.Properties.Name)-join',')-cne'schemaVersion,product,version,gitCommit,buildTimestampUtc,assets'-or$Manifest.schemaVersion-isnot[int]-or$Manifest.schemaVersion-ne1-or$Manifest.product-cne'CodexRemote-fix'-or$Manifest.version-cne$Version-or$Manifest.gitCommit-isnot[string]-or$Manifest.gitCommit-cnotmatch'^[0-9a-f]{40}$'-or-not(Test-CcodReleaseContractCanonicalUtc $Manifest.buildTimestampUtc)){Throw-CcodReleaseContractError $ErrorId 'Setup release manifest metadata is invalid.' $ManifestPath}
+    $map=Get-CcodReleaseContractManifestMap -Manifest $Manifest -ExpectedNames $expected -ErrorId $ErrorId -Target $ManifestPath;foreach($name in $expected){if((Get-CcodReleaseContractHash (Join-Path $Directory $name))-cne$map[$name]){Throw-CcodReleaseContractError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Setup public asset hash mismatch.' $name}}
+    $checksum=[IO.File]::ReadAllText((Join-Path $Directory $names[6]),[Text.UTF8Encoding]::new($false,$true)).TrimEnd("`r","`n");if($checksum-cne("$($map[$names[5]]) *$($names[5])")){Throw-CcodReleaseContractError $ErrorId 'Setup checksum is invalid.' $names[6]}
+    [void](Test-CcodReleaseContractTrayProvenance -Path (Join-Path $Directory $names[2]) -Version $Version -GitCommit $Manifest.gitCommit -Timestamp $Manifest.buildTimestampUtc -ErrorId $ErrorId)
+    $packageManifestPath=Join-Path $Directory $names[8];$package=(Read-CcodReleaseContractJson -Path $packageManifestPath -ErrorId $ErrorId).Value
+    if((@($package.PSObject.Properties.Name)-join',')-cne'schemaVersion,product,version,gitCommit,payloadManifest,files'-or$package.schemaVersion-isnot[int]-or$package.schemaVersion-ne1-or$package.product-cne'CodexRemote-fix'-or$package.version-cne$Version-or$package.gitCommit-cne$Manifest.gitCommit-or$package.payloadManifest-isnot[pscustomobject]-or(@($package.payloadManifest.PSObject.Properties.Name)-join',')-cne'name,length,sha256'-or$package.payloadManifest.name-cne'installer-payload.manifest.json'-or($package.payloadManifest.length-isnot[int]-and$package.payloadManifest.length-isnot[long])-or[long]$package.payloadManifest.length-lt1-or$package.payloadManifest.sha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodReleaseContractError $ErrorId 'Setup package manifest nested payload binding is invalid.' $packageManifestPath}
+    $previous=$null;$seen=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal);foreach($file in @($package.files)){if($file-isnot[pscustomobject]-or(@($file.PSObject.Properties.Name)-join',')-cne'path,length,sha256'-or$file.path-isnot[string]-or$file.path-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$'-or$file.path-cmatch'(^|/)\.\.?(?:/|$)|:'-or($file.length-isnot[int]-and$file.length-isnot[long])-or[long]$file.length-lt0-or$file.sha256-cnotmatch'^[0-9a-f]{64}$'-or-not$seen.Add([string]$file.path)-or($null-ne$previous-and[StringComparer]::Ordinal.Compare($previous,[string]$file.path)-ge0)){Throw-CcodReleaseContractError $ErrorId 'Setup package manifest files are malformed, duplicate, or unordered.' $packageManifestPath};$previous=[string]$file.path};if($seen.Count-eq0){Throw-CcodReleaseContractError $ErrorId 'Setup package manifest files are empty.' $packageManifestPath}
+    $provenancePath=Join-Path $Directory $names[7];$provenance=(Read-CcodReleaseContractJson -Path $provenancePath -ErrorId $ErrorId).Value;$top='schemaVersion,product,version,gitCommit,buildTimestampUtc,installerPackage,installerPackageManifest,activationBootstrap,buildInputs,peContract'
+    $artifactFields='name,length,sha256';$manifestFields='name,length,sha256,fileCount,payloadManifestSha256';$buildFields='innoTemplateSha256,destinationInventorySha256,compilerSha256,compilerFileVersion';$peFields='fileVersion,packageManifestFirst,packageManifestLast,bootstrapFirst,bootstrapLast,companyName,legalCopyright'
+    if((@($provenance.PSObject.Properties.Name)-join',')-cne$top-or$provenance.schemaVersion-isnot[int]-or$provenance.schemaVersion-ne2-or$provenance.product-cne'CodexRemote-fix'-or$provenance.version-cne$Version-or$provenance.gitCommit-cne$Manifest.gitCommit-or$provenance.buildTimestampUtc-cne$Manifest.buildTimestampUtc-or
+       (@($provenance.installerPackage.PSObject.Properties.Name)-join',')-cne$artifactFields-or(@($provenance.installerPackageManifest.PSObject.Properties.Name)-join',')-cne$manifestFields-or(@($provenance.activationBootstrap.PSObject.Properties.Name)-join',')-cne$artifactFields-or(@($provenance.buildInputs.PSObject.Properties.Name)-join',')-cne$buildFields-or(@($provenance.peContract.PSObject.Properties.Name)-join',')-cne$peFields){Throw-CcodReleaseContractError $ErrorId 'Setup provenance nested property schema is invalid.' $provenancePath}
+    $packageManifestHash=Get-CcodReleaseContractHash $packageManifestPath;$inventoryPath=Join-Path $Directory $names[9];[void](Test-CcodReleaseContractInventory $inventoryPath $ErrorId)
+    if($provenance.installerPackage.name-cne'installer-package.zip'-or$provenance.installerPackage.length-isnot[long]-and$provenance.installerPackage.length-isnot[int]-or[long]$provenance.installerPackage.length-lt1-or$provenance.installerPackage.sha256-cnotmatch'^[0-9a-f]{64}$'-or
+       $provenance.installerPackageManifest.name-cne'installer-package.manifest.json'-or[long]$provenance.installerPackageManifest.length-ne[long](Get-Item $packageManifestPath -Force).Length-or$provenance.installerPackageManifest.sha256-cne$packageManifestHash-or$provenance.installerPackageManifest.fileCount-isnot[int]-or$provenance.installerPackageManifest.fileCount-ne@($package.files).Count-or$provenance.installerPackageManifest.payloadManifestSha256-cne$package.payloadManifest.sha256-or
+       $provenance.activationBootstrap.name-cne'Activate-CcodRemoteFix.ps1'-or[long]$provenance.activationBootstrap.length-lt1-or$provenance.activationBootstrap.sha256-cnotmatch'^[0-9a-f]{64}$'-or$provenance.buildInputs.innoTemplateSha256-cnotmatch'^[0-9a-f]{64}$'-or$provenance.buildInputs.destinationInventorySha256-cne(Get-CcodReleaseContractHash $inventoryPath)-or$provenance.buildInputs.compilerSha256-cnotmatch'^[0-9a-f]{64}$'-or[string]::IsNullOrWhiteSpace([string]$provenance.buildInputs.compilerFileVersion)-or
+       $provenance.peContract.fileVersion-cne"$Version.0"-or$provenance.peContract.packageManifestFirst-cne$packageManifestHash.Substring(0,32)-or$provenance.peContract.packageManifestLast-cne$packageManifestHash.Substring(32,32)-or$provenance.peContract.bootstrapFirst-cne$provenance.activationBootstrap.sha256.Substring(0,32)-or$provenance.peContract.bootstrapLast-cne$provenance.activationBootstrap.sha256.Substring(32,32)-or$provenance.peContract.companyName-cne$Manifest.gitCommit-or$provenance.peContract.legalCopyright-cne$provenance.installerPackage.sha256){Throw-CcodReleaseContractError $ErrorId 'Setup provenance values do not bind package manifest, inventory, PE, and common identity.' $provenancePath}
+    $setupModule=Join-Path (Split-Path $PSScriptRoot -Parent) 'build\SetupArtifact.psm1';Import-Module $setupModule -Force -ErrorAction Stop
+    try{$setup=Test-CcodSetupArtifact -SetupPath (Join-Path $Directory $names[5]) -ExpectedVersion $Version -ExpectedGitCommit $Manifest.gitCommit -ExpectedPackageSha256 $provenance.installerPackage.sha256 -ExpectedPackageManifestSha256 $packageManifestHash -ExpectedActivationBootstrapSha256 $provenance.activationBootstrap.sha256}catch{Throw-CcodReleaseContractError $ErrorId 'Setup PE does not bind its nested provenance.' $names[5]}
+    return [pscustomobject][ordered]@{Valid=$true;Version=$Version;GitCommit=[string]$Manifest.gitCommit;BuildTimestampUtc=[string]$Manifest.buildTimestampUtc;InstallerSha256=[string]$map[$names[5]];InstallerName=$names[5];PackageManifestSha256=$packageManifestHash;SetupProvenanceName=$names[7];SetupPayloadInputName=$names[8];SetupInventoryInputName=$names[9]}
+}
+
+function Test-CcodReleaseAssetManifest {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][string]$ManifestPath,[Parameter(Mandatory)][string]$AssetDirectory,[Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion)
+    $errorId='CCOD_RELEASE_MANIFEST_INVALID';$directory=Assert-CcodReleaseContractPlainPath -Path $AssetDirectory -Directory $true -ErrorId $errorId;$manifestFile=Assert-CcodReleaseContractPlainPath -Path $ManifestPath -Directory $false -ErrorId $errorId;$json=Read-CcodReleaseContractJson -Path $manifestFile -ErrorId $errorId;$manifest=$json.Value
+    if($manifest.schemaVersion-is[int]-and$manifest.schemaVersion-eq2){return Test-CcodReleasePortableManifestDeep -Manifest $manifest -ManifestRaw $json.Raw -ManifestPath $manifestFile -Directory $directory -Version $ExpectedVersion -ErrorId $errorId}
+    if($manifest.schemaVersion-is[int]-and$manifest.schemaVersion-eq1){return Test-CcodReleaseSetupManifestDeep -Manifest $manifest -ManifestPath $manifestFile -Directory $directory -Version $ExpectedVersion -ErrorId $errorId}
+    Throw-CcodReleaseContractError $errorId 'Release manifest schema is unsupported.' $manifestFile
+}
+
 function Assert-CcodReleaseContractMetadata {
     param($Value,[string]$Version,[string]$GitCommit,[string]$Timestamp,[string]$ErrorId,$Target,[switch]$TimestampOptional)
     if ($null -eq $Value -or $Value -isnot [pscustomobject] -or
@@ -238,6 +598,8 @@ function Test-CcodExactReleaseAssetSet {
         [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$Version
     )
     $errorId = 'CCOD_RELEASE_ASSET_SET_INVALID'
+    $authority=Open-CcodExactReleaseAssetAuthority -AssetDirectory $AssetDirectory -Version $Version -ErrorId $errorId
+    try {
     $directory = Assert-CcodReleaseContractPlainPath -Path $AssetDirectory -Directory $true -ErrorId $errorId
     $expected = @(Get-CcodExpectedReleaseAssetNames -Version $Version)
     try { $children = @(Get-ChildItem -LiteralPath $directory -Force -ErrorAction Stop) }
@@ -259,6 +621,11 @@ function Test-CcodExactReleaseAssetSet {
 
     $portablePath = Join-Path $directory $expected[4]
     $setupPath = Join-Path $directory $expected[10]
+    try {
+        $portableDeep = Test-CcodReleaseAssetManifest -ManifestPath $portablePath -AssetDirectory $directory -ExpectedVersion $Version
+        $setupDeep = Test-CcodReleaseAssetManifest -ManifestPath $setupPath -AssetDirectory $directory -ExpectedVersion $Version
+        if($portableDeep.GitCommit-cne$setupDeep.GitCommit-or$portableDeep.BuildTimestampUtc-cne$setupDeep.BuildTimestampUtc){throw 'distribution provenance mismatch'}
+    } catch { Throw-CcodReleaseContractError $errorId 'Release distributions do not satisfy the shared deep asset contract.' $directory }
     $portableJson = Read-CcodReleaseContractJson -Path $portablePath -ErrorId $errorId
     $setupJson = Read-CcodReleaseContractJson -Path $setupPath -ErrorId $errorId
     $portable = $portableJson.Value; $setup = $setupJson.Value
@@ -301,7 +668,9 @@ function Test-CcodExactReleaseAssetSet {
 
     $records = [Collections.Generic.List[object]]::new()
     foreach ($name in $expected) { $records.Add([pscustomobject][ordered]@{name=$name;sha256=Get-CcodReleaseContractHash (Join-Path $directory $name)}) }
+    Assert-CcodExactReleaseAssetAuthorityCurrent $authority $errorId|Out-Null
     return [pscustomobject][ordered]@{Valid=$true;Version=$Version;GitCommit=[string]$portable.gitCommit;BuildTimestampUtc=[string]$portable.buildTimestampUtc;Assets=@($records)}
+    } finally { Close-CcodExactReleaseAssetAuthority $authority }
 }
 
 function Get-CcodReleasePromotionReceiptNames {
@@ -354,30 +723,32 @@ function Test-CcodReleasePromotionReceipt {
     return $Receipt
 }
 
-function Test-CcodReleasePromotionEvidence {
+function Test-CcodReleasePromotionEvidenceCore {
     [CmdletBinding()]
     param(
         [Parameter(Mandatory)][string]$EvidenceDirectory,
         [Parameter(Mandatory)][string]$AssetDirectory,
         [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$Version,
-        [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit
+        [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit,
+        [scriptblock]$BeforeReturn
     )
     $errorId = 'CCOD_RELEASE_PROMOTION_EVIDENCE_INVALID'
+    $assetAuthority=$null;$evidenceAuthority=$null;$receiptAuthorities=[Collections.Generic.List[object]]::new()
+    try {
+    $assetAuthority=Open-CcodExactReleaseAssetAuthority -AssetDirectory $AssetDirectory -Version $Version -ErrorId $errorId
     $directory = Assert-CcodReleaseContractPlainPath -Path $EvidenceDirectory -Directory $true -ErrorId $errorId
     try { $assetContract = Test-CcodExactReleaseAssetSet -AssetDirectory $AssetDirectory -Version $Version }
     catch { Throw-CcodReleaseContractError $errorId 'Promotion assets do not satisfy the exact eleven-file authority.' $AssetDirectory }
     if ($assetContract.GitCommit -cne $ExpectedGitCommit) { Throw-CcodReleaseContractError $errorId 'Promotion assets do not bind the expected commit.' $AssetDirectory }
+    for($assetIndex=0;$assetIndex-lt11;$assetIndex++){if($assetAuthority.Files[$assetIndex].Sha256-cne$assetContract.Assets[$assetIndex].sha256){Throw-CcodReleaseContractError $errorId 'Pinned promotion asset differs from its validated contract.' $assetAuthority.Files[$assetIndex].Path}}
     $names = @(Get-CcodReleasePromotionReceiptNames -Version $Version)
-    try { $children = @(Get-ChildItem -LiteralPath $directory -Force -ErrorAction Stop) }
-    catch { Throw-CcodReleaseContractError $errorId 'Promotion evidence directory cannot be read exactly.' $directory }
-    if ($children.Count -ne 2) { Throw-CcodReleaseContractError $errorId 'Promotion requires exactly two receipt leaves.' $directory }
+    $evidenceAuthority=Open-CcodReleaseDirectoryAuthority -Path $directory -ErrorId $errorId;$expectedReceiptNames=[string[]]@($names);[Array]::Sort($expectedReceiptNames,[StringComparer]::Ordinal)
+    if($evidenceAuthority.Children.Count-ne2-or($evidenceAuthority.Children-join"`0")-cne($expectedReceiptNames-join"`0")){Throw-CcodReleaseContractError $errorId 'Promotion requires exactly two named receipt leaves.' $directory}
     $assets = @(Get-CcodExpectedReleaseAssetNames -Version $Version)
     $receipts = [Collections.Generic.List[object]]::new()
     for ($index=0; $index -lt 2; $index++) {
-        $matching = @($children | Where-Object { $_.Name -ceq $names[$index] })
-        if ($matching.Count -ne 1 -or $matching[0].PSIsContainer -or ($matching[0].Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { Throw-CcodReleaseContractError $errorId 'Promotion receipt names and kinds are not exact.' $names[$index] }
-        $path = Assert-CcodReleaseContractPlainPath -Path ([string]$matching[0].FullName) -Directory $false -ErrorId $errorId
-        $json = Read-CcodReleaseContractJson -Path $path -ErrorId $errorId -MaximumBytes 65536
+        $receiptAuthority=Open-CcodReleaseFileAuthority -Directory $evidenceAuthority -Leaf $names[$index] -ErrorId $errorId -MaximumBytes 65536;$receiptAuthorities.Add($receiptAuthority);$path=$receiptAuthority.Path
+        $json = Read-CcodReleaseContractPinnedJson -Authority $receiptAuthority -ErrorId $errorId -MaximumBytes 65536
         $type = if ($index -eq 0) { 'Setup' } else { 'PortableZip' }
         $receipts.Add((Test-CcodReleasePromotionReceipt -Receipt $json.Value -Raw $json.Raw -Path $path -AssetType $type -Version $Version -GitCommit $ExpectedGitCommit -AssetNames $assets))
     }
@@ -397,7 +768,16 @@ function Test-CcodReleasePromotionEvidence {
         $receipts[0].manifestSha256 -ceq $receipts[1].manifestSha256) {
         Throw-CcodReleaseContractError $errorId 'Setup and portable receipts reuse an evidence identity.' $directory
     }
+    if($null-ne$BeforeReturn){&$BeforeReturn $assetAuthority $evidenceAuthority @($receiptAuthorities)}
+    Assert-CcodExactReleaseAssetAuthorityCurrent $assetAuthority $errorId|Out-Null;Assert-CcodReleaseAuthorityCurrent $evidenceAuthority $errorId|Out-Null;foreach($authority in @($receiptAuthorities)){Assert-CcodReleaseAuthorityCurrent $authority $errorId -CheckBytes|Out-Null}
     return [pscustomobject][ordered]@{Valid=$true;Version=$Version;GitCommit=$ExpectedGitCommit;Receipts=@($receipts)}
+    } finally {for($index=$receiptAuthorities.Count-1;$index-ge0;$index--){Close-CcodReleaseAuthority $receiptAuthorities[$index]};Close-CcodReleaseAuthority $evidenceAuthority;Close-CcodExactReleaseAssetAuthority $assetAuthority}
+}
+
+function Test-CcodReleasePromotionEvidence {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][string]$EvidenceDirectory,[Parameter(Mandatory)][string]$AssetDirectory,[Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$Version,[Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit)
+    Test-CcodReleasePromotionEvidenceCore -EvidenceDirectory $EvidenceDirectory -AssetDirectory $AssetDirectory -Version $Version -ExpectedGitCommit $ExpectedGitCommit
 }
 
-Export-ModuleMember -Function Get-CcodExpectedReleaseAssetNames,Test-CcodExactReleaseAssetSet,Test-CcodReleasePromotionEvidence
+Export-ModuleMember -Function Get-CcodExpectedReleaseAssetNames,Test-CcodExactReleaseAssetSet,Test-CcodReleaseAssetManifest,Test-CcodReleasePromotionEvidence
diff --git a/tools/ReleaseDefender.psm1 b/tools/ReleaseDefender.psm1
new file mode 100644
index 0000000..84d75de
--- /dev/null
+++ b/tools/ReleaseDefender.psm1
@@ -0,0 +1,147 @@
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+$assetContractPath = Join-Path $PSScriptRoot 'ReleaseAssetContract.psm1'
+if (-not [IO.File]::Exists($assetContractPath)) { throw 'CCOD_RELEASE_ASSET_CONTRACT_MISSING' }
+$script:CcodReleaseAssetContractModule = Import-Module $assetContractPath -Force -PassThru -ErrorAction Stop
+
+function Throw-CcodReleaseDefenderError {
+    param([Parameter(Mandatory)][string]$Id,[Parameter(Mandatory)][string]$Message,$Target)
+    throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new($Message),$Id,[Management.Automation.ErrorCategory]::InvalidOperation,$Target)
+}
+
+function Assert-CcodReleaseDefenderPlainAncestry {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$ErrorId,[switch]$AllowMissingLeaf)
+    try {
+        if([string]::IsNullOrWhiteSpace($Path)-or-not[IO.Path]::IsPathRooted($Path)){throw 'absolute'}
+        $canonical=[IO.Path]::GetFullPath($Path);$root=[IO.Path]::GetPathRoot($canonical);$full=if($canonical.Length-gt$root.Length){$canonical.TrimEnd('\')}else{$canonical};$presented=if($Path.Length-gt$root.Length){$Path.TrimEnd('\')}else{$Path}
+        if($full-cne$presented-or$full.IndexOf(':',$full.IndexOf(':')+1)-ge0){throw 'canonical'}
+        $current=if($AllowMissingLeaf){Split-Path $full -Parent}else{$full}
+        while(-not[string]::IsNullOrWhiteSpace($current)){$item=Get-Item -LiteralPath $current -Force -ErrorAction Stop;if(($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){throw 'reparse'};if($current.TrimEnd('\')-ceq$root.TrimEnd('\')){break};$parent=[IO.Directory]::GetParent($current);if($null-eq$parent){break};$current=if($parent.FullName.Length-gt$root.Length){$parent.FullName.TrimEnd('\')}else{$parent.FullName}}
+        return $full
+    } catch { Throw-CcodReleaseDefenderError $ErrorId 'Path is missing, noncanonical, or has unsafe ancestry.' $Path }
+}
+
+function Assert-CcodReleaseDefenderRegularFile {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$Kind)
+    $full=Assert-CcodReleaseDefenderPlainAncestry -Path $Path -ErrorId 'CCOD_RELEASE_ASSET_INVALID';try{$item=Get-Item -LiteralPath $full -Force -ErrorAction Stop}catch{Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_INVALID' "$Kind is missing" $full}
+    if($item.PSIsContainer-or($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0){Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_INVALID' "$Kind must be a regular non-reparse file" $full};return $full
+}
+
+function Assert-CcodReleaseDefenderEvidenceTarget {
+    param([Parameter(Mandatory)][string]$Path)
+    $target=Assert-CcodReleaseDefenderPlainAncestry -Path $Path -ErrorId 'CCOD_DEFENDER_EVIDENCE_INVALID' -AllowMissingLeaf
+    if([IO.Path]::GetExtension($target)-cne'.json'-or[IO.File]::Exists($target)-or[IO.Directory]::Exists($target)){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_EVIDENCE_INVALID' 'Defender evidence must be a new canonical JSON leaf.' $target}
+    try{$existing=Get-Item -LiteralPath $target -Force -ErrorAction SilentlyContinue;if($null-ne$existing){throw 'existing'}}catch{Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_EVIDENCE_INVALID' 'Defender evidence target already exists or is unsafe.' $target};return $target
+}
+
+function Get-CcodReleaseDefenderDefaultAdapters {
+    $assetModule=$script:CcodReleaseAssetContractModule
+    return @{
+        GetDefenderStatus={Get-MpComputerStatus -ErrorAction Stop}
+        StartCustomScan={param($Path)Start-MpScan -ScanType CustomScan -ScanPath $Path -ErrorAction Stop}
+        GetThreatDetections={@(Get-MpThreatDetection -ErrorAction Stop)}
+        GetUtcNow={[datetime]::UtcNow}
+        PublishReceiptBytes={param($Directory,$Leaf,$Bytes)&$assetModule {param($Directory,$Leaf,$Bytes)Publish-CcodReleaseReceiptAuthority -Directory $Directory -Leaf $Leaf -Bytes $Bytes -ErrorId 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED'} $Directory $Leaf $Bytes}.GetNewClosure()
+    }
+}
+
+function Resolve-CcodReleaseDefenderAdapters {
+    param([hashtable]$Adapters)
+    $resolved=Get-CcodReleaseDefenderDefaultAdapters;if($null-eq$Adapters){return $resolved}
+    foreach($name in $Adapters.Keys){if(-not$resolved.ContainsKey([string]$name)-or$Adapters[$name]-isnot[scriptblock]){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_ADAPTER_INVALID' 'Private Defender adapters must replace known scriptblock operations only.' $name};$resolved[[string]$name]=$Adapters[$name]};return $resolved
+}
+
+function Get-CcodReleaseDefenderDetectionKeys {
+    param($Records)
+    $keys=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    foreach($record in @($Records)){if($null-eq$record){continue};$threat=if($null-ne$record.PSObject.Properties['ThreatID']){[string]$record.ThreatID}else{''};$time=if($null-ne$record.PSObject.Properties['InitialDetectionTime']){[string]$record.InitialDetectionTime}else{''};$resources=if($null-ne$record.PSObject.Properties['Resources']){(@($record.Resources)-join'|')}else{''};if(-not[string]::IsNullOrWhiteSpace($threat)-or-not[string]::IsNullOrWhiteSpace($time)-or-not[string]::IsNullOrWhiteSpace($resources)){[void]$keys.Add("$threat|$time|$resources")}}
+    Write-Output -NoEnumerate $keys
+}
+
+function Test-CcodReleaseDefenderPositiveInteger {
+    param($Value)
+    if($Value-is[bool]-or$Value-isnot[ValueType]){return $false};try{return [decimal]$Value-eq[decimal][uint64]$Value-and[uint64]$Value-gt0}catch{return $false}
+}
+
+function Assert-CcodReleaseDefenderOrigin {
+    param([Parameter(Mandatory)][string]$Origin,$WorkflowArtifactIdentity,[Parameter(Mandatory)][string]$ExpectedGitCommit)
+    if($Origin-ceq'InternetDownload'){if($null-ne$WorkflowArtifactIdentity){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_ORIGIN_INVALID' 'Internet-download evidence cannot claim a workflow artifact identity.' $WorkflowArtifactIdentity};return $null}
+    if($Origin-cne'TrustedWorkflowArtifact'-or$null-eq$WorkflowArtifactIdentity-or$WorkflowArtifactIdentity-isnot[pscustomobject]-or(@($WorkflowArtifactIdentity.PSObject.Properties.Name)-join',')-cne'provider,repository,runId,runAttempt,artifactId,artifactName,artifactDigest,gitCommit'-or$WorkflowArtifactIdentity.provider-cne'GitHubActions'-or$WorkflowArtifactIdentity.repository-cne'naipi11/CodexRemote-fix'-or-not(Test-CcodReleaseDefenderPositiveInteger $WorkflowArtifactIdentity.runId)-or-not(Test-CcodReleaseDefenderPositiveInteger $WorkflowArtifactIdentity.runAttempt)-or-not(Test-CcodReleaseDefenderPositiveInteger $WorkflowArtifactIdentity.artifactId)-or$WorkflowArtifactIdentity.artifactName-cne'CodexRemote-fix portable bundle'-or$WorkflowArtifactIdentity.artifactDigest-cnotmatch'^sha256:[0-9a-f]{64}$'-or$WorkflowArtifactIdentity.gitCommit-cne$ExpectedGitCommit){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_ORIGIN_INVALID' 'Trusted workflow evidence requires one exact GitHub Actions artifact identity.' $WorkflowArtifactIdentity}
+    return [pscustomobject][ordered]@{provider=[string]$WorkflowArtifactIdentity.provider;repository=[string]$WorkflowArtifactIdentity.repository;runId=[uint64]$WorkflowArtifactIdentity.runId;runAttempt=[uint64]$WorkflowArtifactIdentity.runAttempt;artifactId=[uint64]$WorkflowArtifactIdentity.artifactId;artifactName=[string]$WorkflowArtifactIdentity.artifactName;artifactDigest=[string]$WorkflowArtifactIdentity.artifactDigest;gitCommit=[string]$WorkflowArtifactIdentity.gitCommit}
+}
+
+function Get-CcodReleaseDefenderStatusEvidence {
+    param([Parameter(Mandatory)]$Status,[Parameter(Mandatory)][datetime]$ScanStarted)
+    $required=@('AMServiceEnabled','AntivirusEnabled','RealTimeProtectionEnabled','AMProductVersion','AMEngineVersion','AntivirusSignatureVersion','AntivirusSignatureLastUpdated');if($null-eq$Status-or@($required|Where-Object{$null-eq$Status.PSObject.Properties[$_]}).Count-ne0-or$Status.AMServiceEnabled-isnot[bool]-or-not$Status.AMServiceEnabled-or$Status.AntivirusEnabled-isnot[bool]-or-not$Status.AntivirusEnabled-or$Status.RealTimeProtectionEnabled-isnot[bool]-or-not$Status.RealTimeProtectionEnabled-or$Status.AMProductVersion-isnot[string]-or[string]::IsNullOrWhiteSpace($Status.AMProductVersion)-or$Status.AMProductVersion.Length-gt128-or$Status.AMEngineVersion-isnot[string]-or[string]::IsNullOrWhiteSpace($Status.AMEngineVersion)-or$Status.AMEngineVersion.Length-gt128-or$Status.AntivirusSignatureVersion-isnot[string]-or[string]::IsNullOrWhiteSpace($Status.AntivirusSignatureVersion)-or$Status.AntivirusSignatureVersion.Length-gt128-or$Status.AntivirusSignatureLastUpdated-isnot[datetime]){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_STATUS_INVALID' 'Defender service, AV, real-time, platform, engine, or signature state is incomplete.' $Status}
+    $signature=([datetime]$Status.AntivirusSignatureLastUpdated).ToUniversalTime();if($signature-lt$ScanStarted.AddHours(-72)-or$signature-gt$ScanStarted.AddMinutes(5)){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_STATUS_INVALID' 'Defender signature timestamp is stale or future-dated.' $signature}
+    return [pscustomobject][ordered]@{ServiceEnabled=$true;AntivirusEnabled=$true;RealTimeProtectionEnabled=$true;PlatformVersion=[string]$Status.AMProductVersion;EngineVersion=[string]$Status.AMEngineVersion;SignatureVersion=[string]$Status.AntivirusSignatureVersion;SignatureUpdatedAtUtc=$signature.ToString('o',[Globalization.CultureInfo]::InvariantCulture)}
+}
+
+function Open-CcodReleaseDefenderHeldInputs {
+    param([string]$CandidatePath,[string]$ChecksumPath,[string]$ManifestPath,[string]$EvidenceTarget,[string]$Origin)
+    $assetModule=$script:CcodReleaseAssetContractModule;$candidateDirectory=$null;$candidate=$null;$checksum=$null;$manifest=$null;$zone=$null;$evidenceDirectory=$null
+    try{
+        $candidateFile=Assert-CcodReleaseDefenderRegularFile $CandidatePath 'Release candidate asset';$checksumFile=Assert-CcodReleaseDefenderRegularFile $ChecksumPath 'Release checksum';$manifestFile=Assert-CcodReleaseDefenderRegularFile $ManifestPath 'Release manifest';$directory=Split-Path $candidateFile -Parent
+        if((Split-Path $checksumFile -Parent)-cne$directory-or(Split-Path $manifestFile -Parent)-cne$directory){Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Candidate, checksum, and manifest must be exact siblings.' $candidateFile}
+        $candidateDirectory=&$assetModule {param($Path)Open-CcodReleaseDirectoryAuthority -Path $Path -ErrorId 'CCOD_RELEASE_ASSET_INVALID'} $directory
+        $candidate=&$assetModule {param($Directory,$Leaf)Open-CcodReleaseFileAuthority -Directory $Directory -Leaf $Leaf -ErrorId 'CCOD_RELEASE_ASSET_INVALID' -AllowZone} $candidateDirectory ([IO.Path]::GetFileName($candidateFile));$checksum=&$assetModule {param($Directory,$Leaf)Open-CcodReleaseFileAuthority -Directory $Directory -Leaf $Leaf -ErrorId 'CCOD_RELEASE_ASSET_INVALID' -MaximumBytes 65536} $candidateDirectory ([IO.Path]::GetFileName($checksumFile));$manifest=&$assetModule {param($Directory,$Leaf)Open-CcodReleaseFileAuthority -Directory $Directory -Leaf $Leaf -ErrorId 'CCOD_RELEASE_ASSET_INVALID' -MaximumBytes 4194304} $candidateDirectory ([IO.Path]::GetFileName($manifestFile))
+        if($Origin-ceq'InternetDownload'){$zone=&$assetModule {param($File)Open-CcodReleaseZoneAuthority -File $File -ErrorId 'CCOD_DEFENDER_ZONE_REQUIRED'} $candidate}
+        $evidenceDirectory=&$assetModule {param($Path)Open-CcodReleaseDirectoryAuthority -Path $Path -ErrorId 'CCOD_DEFENDER_EVIDENCE_INVALID' -AllowChildMutation} (Split-Path $EvidenceTarget -Parent)
+        return [pscustomobject]@{CandidateDirectory=$candidateDirectory;Candidate=$candidate;Checksum=$checksum;Manifest=$manifest;Zone=$zone;EvidenceDirectory=$evidenceDirectory;EvidenceTarget=$EvidenceTarget;Closed=$false}
+    }catch{if($null-ne$zone){&$assetModule {param($Value)Close-CcodReleaseAuthority $Value} $zone};foreach($value in @($manifest,$checksum,$candidate,$evidenceDirectory,$candidateDirectory)){if($null-ne$value){&$assetModule {param($Value)Close-CcodReleaseAuthority $Value} $value}};throw}
+}
+
+function Close-CcodReleaseDefenderHeldInputs {
+    param($Held)
+    if($null-eq$Held-or$Held.Closed){return};$assetModule=$script:CcodReleaseAssetContractModule;foreach($value in @($Held.Zone,$Held.Manifest,$Held.Checksum,$Held.Candidate,$Held.EvidenceDirectory,$Held.CandidateDirectory)){if($null-ne$value){&$assetModule {param($Value)Close-CcodReleaseAuthority $Value} $value}};$Held.Closed=$true
+}
+
+function Assert-CcodReleaseDefenderHeldInputsCurrent {
+    param([Parameter(Mandatory)]$Held)
+    $assetModule=$script:CcodReleaseAssetContractModule;&$assetModule {param($Value)Assert-CcodReleaseAuthorityCurrent -Authority $Value -ErrorId 'CCOD_RELEASE_ASSET_HASH_MISMATCH'|Out-Null} $Held.CandidateDirectory
+    foreach($value in @($Held.Candidate,$Held.Checksum,$Held.Manifest,$Held.Zone)){if($null-ne$value){&$assetModule {param($Value)Assert-CcodReleaseAuthorityCurrent -Authority $Value -ErrorId 'CCOD_RELEASE_ASSET_HASH_MISMATCH' -CheckBytes|Out-Null} $value}}
+}
+
+function Get-CcodReleaseDefenderPinnedBytes {
+    param([Parameter(Mandatory)]$Authority,[long]$MaximumBytes=4194304)
+    $assetModule=$script:CcodReleaseAssetContractModule;$bytes=&$assetModule {param($Value,$Maximum)Assert-CcodReleaseAuthorityCurrent -Authority $Value -ErrorId 'CCOD_RELEASE_ASSET_HASH_MISMATCH' -CheckBytes|Out-Null;Get-CcodReleaseAuthorityStreamBytes -Stream $Value.Stream -MaximumBytes $Maximum} $Authority $MaximumBytes;return ,([byte[]]$bytes)
+}
+
+function Get-CcodReleaseDefenderPinnedZoneId {
+    param([Parameter(Mandatory)]$Zone)
+    try{$text=[Text.UTF8Encoding]::new($false,$true).GetString((Get-CcodReleaseDefenderPinnedBytes $Zone 65536));$matches=[regex]::Matches($text,'(?im)^[ \t]*ZoneId[ \t]*=[ \t]*([0-9]+)[ \t]*\r?$');$value=0;if($matches.Count-ne1-or-not[int]::TryParse($matches[0].Groups[1].Value,[ref]$value)-or$value-ne3){throw 'zone'};return $value}catch{Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_ZONE_REQUIRED' 'The held download Zone stream is not unique ZoneId 3.' $Zone.Path}
+}
+
+function Confirm-CcodReleaseDefenderReceiptReadback {
+    param([Parameter(Mandatory)]$PublishedAuthority,[Parameter(Mandatory)]$ReadbackAuthority,[Parameter(Mandatory)][string]$ExpectedPath,[Parameter(Mandatory)][byte[]]$ExpectedBytes,[Parameter(Mandatory)]$ExpectedReceipt)
+    $assetModule=$script:CcodReleaseAssetContractModule
+    try{
+        if($PublishedAuthority.Path-cne$ExpectedPath-or$ReadbackAuthority.Path-cne$ExpectedPath-or$PublishedAuthority.Identity.Volume-ne$ReadbackAuthority.Identity.Volume-or$PublishedAuthority.Identity.FileId-ne$ReadbackAuthority.Identity.FileId-or$PublishedAuthority.Length-ne$ReadbackAuthority.Length-or$PublishedAuthority.Sha256-cne$ReadbackAuthority.Sha256){throw 'identity'}
+        &$assetModule {param($Value)Assert-CcodReleaseAuthorityCurrent -Authority $Value -ErrorId 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED' -CheckBytes|Out-Null} $PublishedAuthority;$readback=&$assetModule {param($Value)Read-CcodReleaseContractPinnedJson -Authority $Value -ErrorId 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED' -MaximumBytes 65536} $ReadbackAuthority
+        if([Convert]::ToBase64String([byte[]]$readback.Bytes)-cne[Convert]::ToBase64String($ExpectedBytes)){throw 'bytes'};$fields='schemaVersion,assetType,assetName,assetSha256,checksumName,checksumSha256,manifestName,manifestSha256,version,gitCommit,origin,workflowArtifactIdentity,zoneId,defenderServiceEnabled,antivirusEnabled,realTimeProtectionEnabled,defenderPlatformVersion,defenderEngineVersion,signatureVersion,signatureUpdatedAtUtc,scanStartedAtUtc,scanCompletedAtUtc,detectionCount,outcome,errorCode';if((@($readback.Value.PSObject.Properties.Name)-join',')-cne$fields-or($readback.Value|ConvertTo-Json -Depth 12 -Compress)-cne($ExpectedReceipt|ConvertTo-Json -Depth 12 -Compress)){throw 'object'};return $readback.Value
+    }catch{Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED' 'Defender receipt durable read-back did not match.' $ExpectedPath}
+}
+
+function Invoke-CcodReleaseDefenderCheckCore {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][string]$CandidatePath,[Parameter(Mandatory)][string]$ChecksumPath,[Parameter(Mandatory)][string]$ManifestPath,[Parameter(Mandatory)][string]$Origin,$WorkflowArtifactIdentity,[Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion,[Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit,[Parameter(Mandatory)][string]$EvidencePath,[hashtable]$Adapters)
+    $adapters=Resolve-CcodReleaseDefenderAdapters $Adapters;$evidenceTarget=Assert-CcodReleaseDefenderEvidenceTarget $EvidencePath;$workflowIdentity=Assert-CcodReleaseDefenderOrigin $Origin $WorkflowArtifactIdentity $ExpectedGitCommit;$held=$null;$receiptAuthority=$null;$receiptReadbackAuthority=$null;$assetModule=$script:CcodReleaseAssetContractModule
+    try{
+        $held=Open-CcodReleaseDefenderHeldInputs $CandidatePath $ChecksumPath $ManifestPath $evidenceTarget $Origin;$candidateDirectory=$held.CandidateDirectory.Path;$candidateLeaf=$held.Candidate.Leaf;$names=@(Get-CcodExpectedReleaseAssetNames $ExpectedVersion);$assetType=if($candidateLeaf-ceq$names[5]){'Setup'}elseif($candidateLeaf-ceq$names[0]){'PortableZip'}else{$null};if($null-eq$assetType){Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Candidate is not the exact versioned Setup or portable ZIP asset.' $candidateLeaf};$checksumName=if($assetType-ceq'Setup'){$names[6]}else{$names[1]};$manifestName=if($assetType-ceq'Setup'){$names[10]}else{$names[4]};if($held.Checksum.Leaf-cne$checksumName-or$held.Manifest.Leaf-cne$manifestName){Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Checksum or manifest does not match the selected asset.' $candidateLeaf}
+        $checksumText=[Text.UTF8Encoding]::new($false,$true).GetString((Get-CcodReleaseDefenderPinnedBytes $held.Checksum 65536)).TrimEnd("`r","`n");if($checksumText-cne("$($held.Candidate.Sha256) *$candidateLeaf")){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CHECKSUM_INVALID' 'Held checksum does not bind candidate bytes.' $held.Checksum.Path};$manifest=Test-CcodReleaseAssetManifest $held.Manifest.Path $candidateDirectory $ExpectedVersion;if($manifest.GitCommit-cne$ExpectedGitCommit-or$manifest.InstallerName-cne$candidateLeaf-or$manifest.InstallerSha256-cne$held.Candidate.Sha256){Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Manifest, commit, and candidate identity differ.' $candidateLeaf}
+        $zone=if($Origin-ceq'InternetDownload'){Get-CcodReleaseDefenderPinnedZoneId $held.Zone}else{$null};$started=&$adapters.GetUtcNow;if($started-isnot[datetime]){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CLOCK_INVALID' 'Defender start clock is invalid.' $started};$started=([datetime]$started).ToUniversalTime();$status=Get-CcodReleaseDefenderStatusEvidence (&$adapters.GetDefenderStatus) $started;$before=Get-CcodReleaseDefenderDetectionKeys (&$adapters.GetThreatDetections);$scanError=$null;try{&$adapters.StartCustomScan $held.Candidate.Path}catch{$scanError=$_};$completed=&$adapters.GetUtcNow;if($completed-isnot[datetime]){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CLOCK_INVALID' 'Defender completion clock is invalid.' $completed};$completed=([datetime]$completed).ToUniversalTime();if($completed-lt$started-or$completed-gt$started.AddHours(2)){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CLOCK_INVALID' 'Defender scan clock is reversed or too long.' $completed};$after=Get-CcodReleaseDefenderDetectionKeys (&$adapters.GetThreatDetections);$detections=@($after|Where-Object{-not$before.Contains($_)})
+        Assert-CcodReleaseDefenderHeldInputsCurrent $held;$revalidated=Test-CcodReleaseAssetManifest $held.Manifest.Path $candidateDirectory $ExpectedVersion;if($revalidated.GitCommit-cne$ExpectedGitCommit-or$revalidated.InstallerSha256-cne$held.Candidate.Sha256){Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Held identity changed during scan.' $candidateLeaf};if($Origin-ceq'InternetDownload'){[void](Get-CcodReleaseDefenderPinnedZoneId $held.Zone)};$errorCode=if($null-ne$scanError){'CCOD_DEFENDER_SCAN_FAILED'}elseif($detections.Count-gt0){'CCOD_DEFENDER_DETECTIONS_FOUND'}else{$null}
+        $receipt=[pscustomobject][ordered]@{schemaVersion=2;assetType=$assetType;assetName=$candidateLeaf;assetSha256=$held.Candidate.Sha256;checksumName=$checksumName;checksumSha256=$held.Checksum.Sha256;manifestName=$manifestName;manifestSha256=$held.Manifest.Sha256;version=$ExpectedVersion;gitCommit=$ExpectedGitCommit;origin=$Origin;workflowArtifactIdentity=$workflowIdentity;zoneId=$zone;defenderServiceEnabled=[bool]$status.ServiceEnabled;antivirusEnabled=[bool]$status.AntivirusEnabled;realTimeProtectionEnabled=[bool]$status.RealTimeProtectionEnabled;defenderPlatformVersion=[string]$status.PlatformVersion;defenderEngineVersion=[string]$status.EngineVersion;signatureVersion=[string]$status.SignatureVersion;signatureUpdatedAtUtc=[string]$status.SignatureUpdatedAtUtc;scanStartedAtUtc=$started.ToString('o',[Globalization.CultureInfo]::InvariantCulture);scanCompletedAtUtc=$completed.ToString('o',[Globalization.CultureInfo]::InvariantCulture);detectionCount=[int]$detections.Count;outcome=if($null-eq$errorCode){'Completed'}else{'Failed'};errorCode=$errorCode};$bytes=[Text.UTF8Encoding]::new($false).GetBytes((($receipt|ConvertTo-Json -Depth 12)+[Environment]::NewLine))
+        try{$receiptAuthority=&$adapters.PublishReceiptBytes $held.EvidenceDirectory ([IO.Path]::GetFileName($evidenceTarget)) $bytes;$children=[Collections.Generic.List[string]]::new();foreach($name in @($held.EvidenceDirectory.Children)){$children.Add([string]$name)};$children.Add([IO.Path]::GetFileName($evidenceTarget));$ordered=[string[]]@($children);[Array]::Sort($ordered,[StringComparer]::Ordinal);$held.EvidenceDirectory.Children=$ordered;&$assetModule {param($Value)Assert-CcodReleaseAuthorityCurrent -Authority $Value -ErrorId 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED'|Out-Null} $held.EvidenceDirectory;$receiptReadbackAuthority=&$assetModule {param($Directory,$Leaf)Open-CcodReleaseFileAuthority -Directory $Directory -Leaf $Leaf -ErrorId 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED' -MaximumBytes 65536 -ShareDelete} $held.EvidenceDirectory ([IO.Path]::GetFileName($evidenceTarget));[void](Confirm-CcodReleaseDefenderReceiptReadback $receiptAuthority $receiptReadbackAuthority $evidenceTarget $bytes $receipt)}catch{$detail=$_.Exception.Message;foreach($value in @($receiptReadbackAuthority,$receiptAuthority)){if($null-ne$value){&$assetModule {param($Value)Close-CcodReleaseAuthority $Value} $value}};$receiptReadbackAuthority=$null;$receiptAuthority=$null;Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED' ('Defender receipt could not be durably read back: '+$detail) $evidenceTarget}
+        Assert-CcodReleaseDefenderHeldInputsCurrent $held;if($null-ne$errorCode){Throw-CcodReleaseDefenderError $errorCode 'The Defender final-asset gate did not complete cleanly.' $held.Candidate.Sha256};return $receipt
+    }finally{foreach($value in @($receiptReadbackAuthority,$receiptAuthority)){if($null-ne$value){&$assetModule {param($Value)Close-CcodReleaseAuthority $Value} $value}};Close-CcodReleaseDefenderHeldInputs $held}
+}
+
+function Invoke-CcodReleaseDefenderCheck {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][string]$CandidatePath,[Parameter(Mandatory)][string]$ChecksumPath,[Parameter(Mandatory)][string]$ManifestPath,[Parameter(Mandatory)][ValidateSet('TrustedWorkflowArtifact','InternetDownload')][string]$Origin,$WorkflowArtifactIdentity,[Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion,[Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit,[Parameter(Mandatory)][string]$EvidencePath)
+    Invoke-CcodReleaseDefenderCheckCore $CandidatePath $ChecksumPath $ManifestPath $Origin $WorkflowArtifactIdentity $ExpectedVersion $ExpectedGitCommit $EvidencePath $null
+}
+
+Export-ModuleMember -Function Invoke-CcodReleaseDefenderCheck
diff --git a/tools/Test-ReleaseDefender.ps1 b/tools/Test-ReleaseDefender.ps1
index 1a985f7..90408c5 100644
--- a/tools/Test-ReleaseDefender.ps1
+++ b/tools/Test-ReleaseDefender.ps1
@@ -1,804 +1,25 @@
-[CmdletBinding(DefaultParameterSetName = 'Run')]
+[CmdletBinding()]
 param(
-    [Parameter(Mandatory, ParameterSetName = 'Run')][string]$CandidatePath,
-    [Parameter(Mandatory, ParameterSetName = 'Run')][string]$ChecksumPath,
-    [Parameter(Mandatory, ParameterSetName = 'Run')][string]$ManifestPath,
-    [Parameter(Mandatory, ParameterSetName = 'Run')][string]$Origin,
-    [Parameter(ParameterSetName = 'Run')]$WorkflowArtifactIdentity,
-    [Parameter(Mandatory, ParameterSetName = 'Run')][string]$ExpectedVersion,
-    [Parameter(Mandatory, ParameterSetName = 'Run')][string]$ExpectedGitCommit,
-    [Parameter(Mandatory, ParameterSetName = 'Run')][string]$EvidencePath,
-    [Parameter(Mandatory, ParameterSetName = 'Library')][switch]$Library
+    [Parameter(Mandatory)][string]$CandidatePath,
+    [Parameter(Mandatory)][string]$ChecksumPath,
+    [Parameter(Mandatory)][string]$ManifestPath,
+    [Parameter(Mandatory)][ValidateSet('TrustedWorkflowArtifact','InternetDownload')][string]$Origin,
+    $WorkflowArtifactIdentity,
+    [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion,
+    [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit,
+    [Parameter(Mandatory)][string]$EvidencePath
 )
 
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
-$assetContractPath = Join-Path $PSScriptRoot 'ReleaseAssetContract.psm1'
-if (-not [IO.File]::Exists($assetContractPath)) { throw 'CCOD_RELEASE_ASSET_CONTRACT_MISSING' }
-Import-Module $assetContractPath -Force -ErrorAction Stop
+$modulePath = Join-Path $PSScriptRoot 'ReleaseDefender.psm1'
+if (-not [IO.File]::Exists($modulePath)) { Write-Error 'CCOD_RELEASE_DEFENDER_MODULE_MISSING'; exit 1 }
 
-function Throw-CcodReleaseDefenderError {
-    param([Parameter(Mandatory)][string]$Id, [Parameter(Mandatory)][string]$Message, $Target)
-    throw [Management.Automation.ErrorRecord]::new(
-        [InvalidOperationException]::new($Message),
-        $Id,
-        [Management.Automation.ErrorCategory]::InvalidOperation,
-        $Target
-    )
-}
-
-function Get-CcodReleaseDefenderErrorId {
-    param([Parameter(Mandatory)]$ErrorRecord)
-    $id = [string]$ErrorRecord.FullyQualifiedErrorId
-    if ([string]::IsNullOrWhiteSpace($id)) { return $null }
-    return ($id -split ',')[0]
-}
-
-function Get-CcodReleaseDefenderHash {
-    param([Parameter(Mandatory)][string]$Path)
-    $sha = [Security.Cryptography.SHA256]::Create()
-    try {
-        $stream = [IO.File]::OpenRead($Path)
-        try { return ([BitConverter]::ToString($sha.ComputeHash($stream))).Replace('-', '').ToLowerInvariant() }
-        finally { $stream.Dispose() }
-    } finally { $sha.Dispose() }
-}
-
-function Test-CcodReleaseDefenderCanonicalUtc {
-    param([AllowNull()][string]$Value)
-    if ([string]::IsNullOrWhiteSpace($Value)) { return $false }
-    $parsed = [datetime]::MinValue
-    if (-not [datetime]::TryParse($Value, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::RoundtripKind, [ref]$parsed)) { return $false }
-    return $parsed.ToUniversalTime().ToString('o', [Globalization.CultureInfo]::InvariantCulture) -ceq $Value
-}
-
-function Read-CcodReleaseDefenderJsonString {
-    param([Parameter(Mandatory)][string]$Json, [Parameter(Mandatory)][int]$Offset)
-    if ($Offset -ge $Json.Length -or $Json[$Offset] -ne [char]34) { return $null }
-    $builder = [Text.StringBuilder]::new()
-    [int]$index = $Offset + 1
-    [bool]$hasEscapes = $false
-    while ($index -lt $Json.Length) {
-        $character = $Json[$index]
-        if ($character -eq [char]34) {
-            return [pscustomobject]@{ Value = $builder.ToString(); End = $index + 1; HasEscapes = $hasEscapes }
-        }
-        if ($character -eq [char]92) {
-            $hasEscapes = $true
-            if (($index + 1) -ge $Json.Length) { return $null }
-            $null = $builder.Append($character)
-            $index++
-            $null = $builder.Append($Json[$index])
-            $index++
-            continue
-        }
-        if ([int][char]$character -lt 32) { return $null }
-        $null = $builder.Append($character)
-        $index++
-    }
-    return $null
-}
-
-function Skip-CcodReleaseDefenderJsonWhitespace {
-    param([Parameter(Mandatory)][string]$Json, [Parameter(Mandatory)][int]$Offset)
-    [int]$index = $Offset
-    while ($index -lt $Json.Length -and [char]::IsWhiteSpace($Json[$index])) { $index++ }
-    return $index
-}
-
-function Skip-CcodReleaseDefenderJsonValue {
-    param([Parameter(Mandatory)][string]$Json, [Parameter(Mandatory)][int]$Offset)
-    if ($Offset -ge $Json.Length) { return -1 }
-    $character = $Json[$Offset]
-    if ($character -eq [char]34) {
-        $token = Read-CcodReleaseDefenderJsonString -Json $Json -Offset $Offset
-        if ($null -eq $token) { return -1 }
-        return [int]$token.End
-    }
-    if ($character -eq [char]123 -or $character -eq [char]91) {
-        [int]$index = $Offset + 1
-        [int]$depth = 1
-        while ($index -lt $Json.Length -and $depth -gt 0) {
-            $nested = $Json[$index]
-            if ($nested -eq [char]34) {
-                $token = Read-CcodReleaseDefenderJsonString -Json $Json -Offset $index
-                if ($null -eq $token) { return -1 }
-                $index = [int]$token.End
-                continue
-            }
-            if ($nested -eq [char]123 -or $nested -eq [char]91) {
-                $depth++
-            } elseif ($nested -eq [char]125 -or $nested -eq [char]93) {
-                $depth--
-            }
-            $index++
-        }
-        if ($depth -ne 0) { return -1 }
-        return $index
-    }
-    [int]$primitiveStart = $Offset
-    [int]$index = $Offset
-    while ($index -lt $Json.Length) {
-        $current = $Json[$index]
-        if ($current -eq [char]44 -or $current -eq [char]125 -or $current -eq [char]93 -or [char]::IsWhiteSpace($current)) { break }
-        $index++
-    }
-    if ($index -eq $primitiveStart) { return -1 }
-    return $index
-}
-
-function Get-CcodReleaseDefenderRawJsonString {
-    param(
-        [Parameter(Mandatory)][string]$Json,
-        [Parameter(Mandatory)][ValidatePattern('^[A-Za-z][A-Za-z0-9]*$')][string]$PropertyName
-    )
-    [int]$index = Skip-CcodReleaseDefenderJsonWhitespace -Json $Json -Offset 0
-    if ($index -ge $Json.Length -or $Json[$index] -ne [char]123) { return $null }
-    $index++
-    [bool]$found = $false
-    $value = $null
-    while ($true) {
-        $index = Skip-CcodReleaseDefenderJsonWhitespace -Json $Json -Offset $index
-        if ($index -ge $Json.Length) { return $null }
-        if ($Json[$index] -eq [char]125) {
-            $index++
-            break
-        }
-        $key = Read-CcodReleaseDefenderJsonString -Json $Json -Offset $index
-        if ($null -eq $key) { return $null }
-        $index = [int]$key.End
-        $index = Skip-CcodReleaseDefenderJsonWhitespace -Json $Json -Offset $index
-        if ($index -ge $Json.Length -or $Json[$index] -ne [char]58) { return $null }
-        $index++
-        $index = Skip-CcodReleaseDefenderJsonWhitespace -Json $Json -Offset $index
-        $isTarget = -not $key.HasEscapes -and $key.Value -ceq $PropertyName
-        if ($isTarget) {
-            if ($found) { return $null }
-            $token = Read-CcodReleaseDefenderJsonString -Json $Json -Offset $index
-            if ($null -eq $token -or $token.HasEscapes) { return $null }
-            $value = $token.Value
-            $found = $true
-            $index = [int]$token.End
-        } else {
-            $index = Skip-CcodReleaseDefenderJsonValue -Json $Json -Offset $index
-            if ($index -lt 0) { return $null }
-        }
-        $index = Skip-CcodReleaseDefenderJsonWhitespace -Json $Json -Offset $index
-        if ($index -ge $Json.Length) { return $null }
-        if ($Json[$index] -eq [char]44) {
-            $index++
-            continue
-        }
-        if ($Json[$index] -eq [char]125) {
-            $index++
-            break
-        }
-        return $null
-    }
-    $index = Skip-CcodReleaseDefenderJsonWhitespace -Json $Json -Offset $index
-    if ($index -ne $Json.Length -or -not $found) { return $null }
-    return $value
-}
-
-function Assert-CcodReleaseDefenderPlainAncestry {
-    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$ErrorId,[switch]$AllowMissingLeaf)
-    try {
-        if ([string]::IsNullOrWhiteSpace($Path) -or -not [IO.Path]::IsPathRooted($Path)) { throw 'absolute' }
-        $canonical = [IO.Path]::GetFullPath($Path)
-        $root = [IO.Path]::GetPathRoot($canonical)
-        $full = if ($canonical.Length -gt $root.Length) { $canonical.TrimEnd('\') } else { $canonical }
-        $presented = if ($Path.Length -gt $root.Length) { $Path.TrimEnd('\') } else { $Path }
-        if ($full -cne $presented -or $full.IndexOf(':',$full.IndexOf(':') + 1) -ge 0) { throw 'canonical' }
-        $current = if ($AllowMissingLeaf) { Split-Path $full -Parent } else { $full }
-        while (-not [string]::IsNullOrWhiteSpace($current)) {
-            $item = Get-Item -LiteralPath $current -Force -ErrorAction Stop
-            if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'reparse' }
-            if ($current.TrimEnd('\') -ceq $root.TrimEnd('\')) { break }
-            $parent = [IO.Directory]::GetParent($current)
-            if ($null -eq $parent) { break }
-            $current = if ($parent.FullName.Length -gt $root.Length) { $parent.FullName.TrimEnd('\') } else { $parent.FullName }
-        }
-        return $full
-    } catch {
-        Throw-CcodReleaseDefenderError $ErrorId 'Path is missing, noncanonical, or has unsafe ancestry.' $Path
-    }
-}
-
-function Assert-CcodReleaseDefenderRegularFile {
-    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$Kind)
-    $full = Assert-CcodReleaseDefenderPlainAncestry -Path $Path -ErrorId 'CCOD_RELEASE_ASSET_INVALID'
-    try { $item = Get-Item -LiteralPath $full -Force -ErrorAction Stop }
-    catch { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_INVALID' "$Kind is missing" $full }
-    if ($item.PSIsContainer -or (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) {
-        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_INVALID' "$Kind must be a regular non-reparse file" $full
-    }
-    return $full
-}
-
-function Assert-CcodReleaseDefenderDirectory {
-    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$Kind)
-    $full = Assert-CcodReleaseDefenderPlainAncestry -Path $Path -ErrorId 'CCOD_RELEASE_ASSET_INVALID'
-    try { $item = Get-Item -LiteralPath $full -Force -ErrorAction Stop }
-    catch { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_INVALID' "$Kind is missing" $full }
-    if (-not $item.PSIsContainer -or (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) {
-        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_INVALID' "$Kind must be a non-reparse directory" $full
-    }
-    return $full
-}
-
-function Assert-CcodReleaseDefenderEvidenceTarget {
-    param([Parameter(Mandatory)][string]$Path)
-    $target = Assert-CcodReleaseDefenderPlainAncestry -Path $Path -ErrorId 'CCOD_DEFENDER_EVIDENCE_INVALID' -AllowMissingLeaf
-    if ([IO.Path]::GetExtension($target) -cne '.json' -or [IO.File]::Exists($target) -or [IO.Directory]::Exists($target)) {
-        Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_EVIDENCE_INVALID' 'Defender evidence must be a new canonical JSON leaf.' $target
-    }
-    try {
-        $existing = Get-Item -LiteralPath $target -Force -ErrorAction SilentlyContinue
-        if ($null -ne $existing) { throw 'existing' }
-    } catch { Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_EVIDENCE_INVALID' 'Defender evidence target already exists or is unsafe.' $target }
-    return $target
-}
-
-function Get-CcodReleaseDefenderDefaultAdapters {
-    $defaults = @{}
-    $defaults.GetFileSha256 = { param($Path) Get-CcodReleaseDefenderHash -Path $Path }
-    $defaults.ReadText = { param($Path) [IO.File]::ReadAllText($Path) }
-    $defaults.GetZoneId = {
-        param($Path)
-        try {
-            $stream = Get-Item -LiteralPath $Path -Stream Zone.Identifier -ErrorAction Stop
-            if ($null -eq $stream -or $stream.Length -le 0 -or $stream.Length -gt 65536) { return $null }
-            $text = Get-Content -LiteralPath $Path -Stream Zone.Identifier -Raw -ErrorAction Stop
-            $matches = [regex]::Matches([string]$text, '(?im)^[ \t]*ZoneId[ \t]*=[ \t]*([0-9]+)[ \t]*\r?$')
-            $zone = 0
-            if ($matches.Count -ne 1 -or -not [int]::TryParse($matches[0].Groups[1].Value,[ref]$zone)) { return $null }
-            return $zone
-        } catch { return $null }
-    }
-    $defaults.GetDefenderStatus = { Get-MpComputerStatus -ErrorAction Stop }
-    $defaults.StartCustomScan = { param($Path) Start-MpScan -ScanType CustomScan -ScanPath $Path -ErrorAction Stop }
-    $defaults.GetThreatDetections = { @(Get-MpThreatDetection -ErrorAction Stop) }
-    $defaults.GetUtcNow = { [datetime]::UtcNow }
-    $defaults.WriteReceipt = {
-        param($Path, $Receipt)
-        $target = Assert-CcodReleaseDefenderEvidenceTarget -Path $Path
-        $parent = Split-Path $target -Parent
-        $temporary = Join-Path $parent ('.ccod-defender-receipt-' + [guid]::NewGuid().ToString('N') + '.tmp')
-        try {
-            $bytes = [Text.UTF8Encoding]::new($false).GetBytes((($Receipt | ConvertTo-Json -Depth 12) + [Environment]::NewLine))
-            $stream = [IO.File]::Open($temporary,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::None)
-            try { $stream.Write($bytes,0,$bytes.Length); $stream.Flush($true) } finally { $stream.Dispose() }
-            [void](Assert-CcodReleaseDefenderEvidenceTarget -Path $target)
-            [IO.File]::Move($temporary, $target)
-            return $target
-        } finally {
-            if ([IO.File]::Exists($temporary)) { Remove-Item -LiteralPath $temporary -Force -ErrorAction SilentlyContinue }
-        }
-    }
-    return $defaults
-}
-
-function Resolve-CcodReleaseDefenderAdapters {
-    param([hashtable]$Adapters)
-    $resolved = Get-CcodReleaseDefenderDefaultAdapters
-    if ($null -eq $Adapters) { return $resolved }
-    foreach ($name in $Adapters.Keys) {
-        if (-not $resolved.ContainsKey([string]$name) -or $Adapters[$name] -isnot [scriptblock]) {
-            Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_ADAPTER_INVALID' 'Defender test adapters must replace known scriptblock adapters only' $name
-        }
-        $resolved[[string]$name] = $Adapters[$name]
-    }
-    return $resolved
-}
-
-function Get-CcodReleaseDefenderChecksum {
-    param([Parameter(Mandatory)][string]$CandidatePath, [Parameter(Mandatory)][string]$ChecksumPath, [Parameter(Mandatory)][hashtable]$Adapters)
-    $candidate = Assert-CcodReleaseDefenderRegularFile -Path $CandidatePath -Kind 'Release candidate asset'
-    $checksum = Assert-CcodReleaseDefenderRegularFile -Path $ChecksumPath -Kind 'Installer checksum'
-    $text = & $Adapters.ReadText $checksum
-    if ($text -isnot [string]) { Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CHECKSUM_INVALID' 'Installer checksum could not be read as text' $checksum }
-    $match = [regex]::Match($text.TrimEnd("`r", "`n"), '^([0-9a-f]{64}) \*([^\r\n]+)$')
-    if (-not $match.Success -or $match.Groups[2].Value -cne [IO.Path]::GetFileName($candidate)) {
-        Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CHECKSUM_INVALID' 'Installer checksum is malformed or names a different asset' $checksum
-    }
-    $actual = [string](& $Adapters.GetFileSha256 $candidate)
-    if ($actual -cnotmatch '^[0-9a-f]{64}$' -or $actual -cne $match.Groups[1].Value) {
-        Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CHECKSUM_INVALID' 'Installer checksum does not match the exact bytes submitted for scanning' $candidate
-    }
-    return [pscustomobject][ordered]@{ CandidatePath = $candidate; ChecksumPath = $checksum; Sha256 = $actual }
-}
-
-function Get-CcodReleaseDefenderStreamHash {
-    param([Parameter(Mandatory)][IO.Stream]$Stream)
-    $sha = [Security.Cryptography.SHA256]::Create()
-    try { return ([BitConverter]::ToString($sha.ComputeHash($Stream))).Replace('-', '').ToLowerInvariant() }
-    finally { $sha.Dispose() }
-}
-
-function Test-CcodReleasePortablePayloadManifest {
-    param(
-        [Parameter(Mandatory)]$ReleaseManifest,
-        [Parameter(Mandatory)][string]$ReleaseManifestRaw,
-        [Parameter(Mandatory)][string]$ReleaseManifestFile,
-        [Parameter(Mandatory)][string]$Directory,
-        [Parameter(Mandatory)][string]$ExpectedVersion
-    )
-    $manifestTimestamp = Get-CcodReleaseDefenderRawJsonString -Json $ReleaseManifestRaw -PropertyName 'buildTimestampUtc'
-    $expectedFields = @('schemaVersion','product','version','gitCommit','buildTimestampUtc','distribution','assets')
-    if (((($ReleaseManifest.PSObject.Properties.Name | Sort-Object) -join '|') -cne (($expectedFields | Sort-Object) -join '|')) -or
-        ($ReleaseManifest.schemaVersion -isnot [int] -and $ReleaseManifest.schemaVersion -isnot [long]) -or [int]$ReleaseManifest.schemaVersion -ne 2 -or
-        $ReleaseManifest.product -isnot [string] -or $ReleaseManifest.product -cne 'CodexRemote-fix' -or
-        $ReleaseManifest.version -isnot [string] -or $ReleaseManifest.version -cne $ExpectedVersion -or
-        $ReleaseManifest.gitCommit -isnot [string] -or $ReleaseManifest.gitCommit -cnotmatch '^[0-9a-f]{40}$' -or
-        $ReleaseManifest.distribution -isnot [string] -or $ReleaseManifest.distribution -cne 'portable-zip' -or
-        -not (Test-CcodReleaseDefenderCanonicalUtc $manifestTimestamp)) {
-        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Portable release manifest metadata does not have the required canonical shape' $ReleaseManifestFile
-    }
-    $contractNames = @(Get-CcodExpectedReleaseAssetNames -Version $ExpectedVersion)
-    $bundleName = $contractNames[0]
-    $checksumName = $contractNames[1]
-    $provenanceName = $contractNames[2]
-    $payloadManifestName = $contractNames[3]
-    $expectedNames = @($bundleName,$checksumName,$provenanceName,$payloadManifestName,'CodexRemote-fix.exe','CodexRemote-fix.exe.config')
-    $assetHashes = @{}
-    foreach ($asset in @($ReleaseManifest.assets)) {
-        if ($null -eq $asset -or (($asset.PSObject.Properties.Name | Sort-Object) -join '|') -cne 'name|sha256' -or
-            $asset.name -isnot [string] -or $asset.sha256 -isnot [string] -or $asset.name -cnotmatch '^[A-Za-z0-9._-]+$' -or
-            $asset.sha256 -cnotmatch '^[0-9a-f]{64}$' -or $assetHashes.ContainsKey([string]$asset.name)) {
-            Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Portable release asset records are malformed or duplicate' $ReleaseManifestFile
-        }
-        $assetHashes[[string]$asset.name] = [string]$asset.sha256
-    }
-    if ($assetHashes.Count -ne $expectedNames.Count -or (($assetHashes.Keys | Sort-Object) -join '|') -cne (($expectedNames | Sort-Object) -join '|')) {
-        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Portable release manifest does not bind the exact final asset set' $ReleaseManifestFile
-    }
-    foreach ($name in $expectedNames) {
-        if ($name -ceq 'CodexRemote-fix.exe' -or $name -ceq 'CodexRemote-fix.exe.config') { continue }
-        $assetPath = Assert-CcodReleaseDefenderRegularFile -Path (Join-Path $Directory $name) -Kind 'Portable release asset'
-        if ((Get-CcodReleaseDefenderHash -Path $assetPath) -cne $assetHashes[$name]) {
-            Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Portable release asset bytes do not match the release manifest' $name
-        }
-    }
-    $checksumText = [IO.File]::ReadAllText((Join-Path $Directory $checksumName)).TrimEnd([char]13,[char]10)
-    if ($checksumText -cne ("{0} *{1}" -f $assetHashes[$bundleName],$bundleName)) {
-        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Portable release checksum is not bound to the ZIP bytes' $checksumName
-    }
-    $provenanceRaw = [IO.File]::ReadAllText((Join-Path $Directory $provenanceName))
-    try { $provenance = $provenanceRaw | ConvertFrom-Json -ErrorAction Stop }
-    catch { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'TrayHost provenance is not valid JSON' $provenanceName }
-    $provenanceTimestamp = Get-CcodReleaseDefenderRawJsonString -Json $provenanceRaw -PropertyName 'buildTimestampUtc'
-    if ($null -eq $provenance.PSObject.Properties['version'] -or $null -eq $provenance.PSObject.Properties['gitCommit'] -or
-        $provenance.version -isnot [string] -or $provenance.version -cne $ExpectedVersion -or
-        $provenance.gitCommit -isnot [string] -or $provenance.gitCommit -cne $ReleaseManifest.gitCommit -or
-        -not (Test-CcodReleaseDefenderCanonicalUtc $provenanceTimestamp) -or $provenanceTimestamp -cne $manifestTimestamp) {
-        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'TrayHost provenance is not bound to the portable release version, source commit, and timestamp' $provenanceName
-    }
-
-    $payloadManifestPath = Join-Path $Directory $payloadManifestName
-    $payloadRaw = [IO.File]::ReadAllText($payloadManifestPath)
-    try { $payloadManifest = $payloadRaw | ConvertFrom-Json -ErrorAction Stop }
-    catch { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Portable payload manifest is not valid JSON' $payloadManifestName }
-    $payloadTimestamp = Get-CcodReleaseDefenderRawJsonString -Json $payloadRaw -PropertyName 'buildTimestampUtc'
-    $payloadFields = @('schemaVersion','product','version','gitCommit','buildTimestampUtc','files')
-    if (((($payloadManifest.PSObject.Properties.Name | Sort-Object) -join '|') -cne (($payloadFields | Sort-Object) -join '|')) -or
-        ($payloadManifest.schemaVersion -isnot [int] -and $payloadManifest.schemaVersion -isnot [long]) -or [int]$payloadManifest.schemaVersion -ne 1 -or
-        $payloadManifest.product -isnot [string] -or $payloadManifest.product -cne 'CodexRemote-fix' -or
-        $payloadManifest.version -isnot [string] -or $payloadManifest.version -cne $ExpectedVersion -or
-        $payloadManifest.gitCommit -isnot [string] -or $payloadManifest.gitCommit -cne $ReleaseManifest.gitCommit -or
-        -not (Test-CcodReleaseDefenderCanonicalUtc $payloadTimestamp) -or $payloadTimestamp -cne $manifestTimestamp) {
-        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Portable payload manifest metadata is not release-bound' $payloadManifestName
-    }
-    $expectedZipFiles = @{
-        'CodexRemote-fix.exe'=$null
-        'CodexRemote-fix.exe.config'=$null
-        'Install-CodexRemote-fix.ps1'=$null
-        'payload-manifest.json'=$null
-    }
-    $previousPath = $null
-    foreach ($record in @($payloadManifest.files)) {
-        if ($null -eq $record -or (($record.PSObject.Properties.Name | Sort-Object) -join '|') -cne 'length|path|sha256' -or
-            $record.path -isnot [string] -or $record.path -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$' -or
-            $record.path.Contains('//') -or $record.path.Contains('..') -or $record.path.Contains(':') -or
-            ($record.length -isnot [int] -and $record.length -isnot [long]) -or [int64]$record.length -lt 0 -or
-            $record.sha256 -isnot [string] -or $record.sha256 -cnotmatch '^[0-9a-f]{64}$' -or
-            ($null -ne $previousPath -and [StringComparer]::Ordinal.Compare($previousPath,[string]$record.path) -ge 0)) {
-            Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Portable payload file records are invalid, duplicate, or unordered' $payloadManifestName
-        }
-        $previousPath = [string]$record.path
-        $entryName = 'payload/' + $record.path
-        if ($expectedZipFiles.ContainsKey($entryName)) {
-            Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Portable payload manifest has duplicate ZIP entry names' $entryName
-        }
-        $expectedZipFiles[$entryName] = $record
-    }
-    if ($expectedZipFiles.Count -le 4) {
-        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Portable payload manifest is empty' $payloadManifestName
-    }
-
-    Add-Type -AssemblyName System.IO.Compression.FileSystem -ErrorAction Stop
-    $archive = $null
-    try {
-        $archive = [IO.Compression.ZipFile]::OpenRead((Join-Path $Directory $bundleName))
-        $seen = @{}
-        foreach ($entry in @($archive.Entries)) {
-            $name = [string]$entry.FullName
-            if ($name.Contains('\')) { $name = $name.Replace('\','/') }
-            if ([string]::IsNullOrWhiteSpace($name) -or $name.Contains(':') -or $name -match '(^|/)\.\.?(?:/|$)') {
-                Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Portable ZIP contains an unsafe entry path' $name
-            }
-            if ($name.EndsWith('/')) {
-                if ($name -cne 'payload/' -and -not $name.StartsWith('payload/',[StringComparison]::Ordinal)) {
-                    Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Portable ZIP contains an unexpected directory entry' $name
-                }
-                continue
-            }
-            if (-not $expectedZipFiles.ContainsKey($name) -or $seen.ContainsKey($name)) {
-                Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Portable ZIP file entries differ from the payload manifest' $name
-            }
-            $seen[$name] = $entry
-        }
-        if ($seen.Count -ne $expectedZipFiles.Count) {
-            Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Portable ZIP is missing an expected payload file' $bundleName
-        }
-        $manifestEntry = $seen['payload-manifest.json']
-        $manifestStream = $null
-        try {
-            $manifestStream = $manifestEntry.Open()
-            if ((Get-CcodReleaseDefenderStreamHash -Stream $manifestStream) -cne (Get-CcodReleaseDefenderHash -Path $payloadManifestPath)) {
-                Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Portable ZIP payload manifest differs from the separately released manifest.' $bundleName
-            }
-        } finally {
-            if ($null -ne $manifestStream) { $manifestStream.Dispose() }
-        }
-        foreach ($rootEntryName in @('CodexRemote-fix.exe','CodexRemote-fix.exe.config')) {
-            $rootEntry = $seen[$rootEntryName]
-            $rootStream = $null
-            try {
-                $rootStream = $rootEntry.Open()
-                if ((Get-CcodReleaseDefenderStreamHash -Stream $rootStream) -cne $assetHashes[$rootEntryName]) {
-                    Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Portable ZIP root launcher differs from the release manifest.' $rootEntryName
-                }
-            } finally {
-                if ($null -ne $rootStream) { $rootStream.Dispose() }
-            }
-        }
-        foreach ($entryName in @($expectedZipFiles.Keys | Where-Object { $_.StartsWith('payload/',[StringComparison]::Ordinal) })) {
-            $record = $expectedZipFiles[$entryName]
-            $entry = $seen[$entryName]
-            if ([int64]$entry.Length -ne [int64]$record.length) {
-                Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Portable ZIP payload length differs from its manifest.' $entryName
-            }
-            $entryStream = $null
-            try {
-                $entryStream = $entry.Open()
-                if ((Get-CcodReleaseDefenderStreamHash -Stream $entryStream) -cne [string]$record.sha256) {
-                    Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Portable ZIP payload hash differs from its manifest.' $entryName
-                }
-            } finally {
-                if ($null -ne $entryStream) { $entryStream.Dispose() }
-            }
-        }
-    } finally {
-        if ($null -ne $archive) { $archive.Dispose() }
-    }
-    return [pscustomobject][ordered]@{
-        Valid = $true
-        Version = $ExpectedVersion
-        GitCommit = [string]$ReleaseManifest.gitCommit
-        BuildTimestampUtc = $manifestTimestamp
-        InstallerSha256 = [string]$assetHashes[$bundleName]
-        InstallerName = $bundleName
-        Distribution = 'portable-zip'
-    }
-}
-
-function Test-CcodReleaseAssetManifest {
-    [CmdletBinding()]
-    param(
-        [Parameter(Mandatory)][string]$ManifestPath,
-        [Parameter(Mandatory)][string]$AssetDirectory,
-        [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion
-    )
-    $manifestFile = Assert-CcodReleaseDefenderRegularFile -Path $ManifestPath -Kind 'Release manifest'
-    $directory = Assert-CcodReleaseDefenderDirectory -Path $AssetDirectory -Kind 'Release asset directory'
-    $manifestRaw = [IO.File]::ReadAllText($manifestFile)
-    try { $manifest = $manifestRaw | ConvertFrom-Json -ErrorAction Stop }
-    catch { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Release manifest is not valid JSON' $manifestFile }
-    if (($manifest.schemaVersion -is [int] -or $manifest.schemaVersion -is [long]) -and [int]$manifest.schemaVersion -eq 2) {
-        return Test-CcodReleasePortablePayloadManifest -ReleaseManifest $manifest -ReleaseManifestRaw $manifestRaw -ReleaseManifestFile $manifestFile -Directory $directory -ExpectedVersion $ExpectedVersion
-    }
-    $manifestTimestamp = Get-CcodReleaseDefenderRawJsonString -Json $manifestRaw -PropertyName 'buildTimestampUtc'
-    $expectedFields = @('schemaVersion','product','version','gitCommit','buildTimestampUtc','assets')
-    if ($null -eq $manifest -or (($manifest.PSObject.Properties.Name | Sort-Object) -join '|') -cne (($expectedFields | Sort-Object) -join '|') -or
-        ($manifest.schemaVersion -isnot [int] -and $manifest.schemaVersion -isnot [long]) -or [int]$manifest.schemaVersion -ne 1 -or
-        $manifest.product -isnot [string] -or $manifest.product -cne 'CodexRemote-fix' -or
-        $manifest.version -isnot [string] -or $manifest.version -cne $ExpectedVersion -or
-        $manifest.gitCommit -isnot [string] -or $manifest.gitCommit -cnotmatch '^[0-9a-f]{40}$' -or
-        ($manifest.buildTimestampUtc -isnot [string] -and $manifest.buildTimestampUtc -isnot [datetime]) -or
-        -not (Test-CcodReleaseDefenderCanonicalUtc $manifestTimestamp)) {
-        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Release manifest metadata does not have the required canonical shape' $manifestFile
-    }
-    $assets = @($manifest.assets)
-    $contractNames = @(Get-CcodExpectedReleaseAssetNames -Version $ExpectedVersion)
-    $expectedNames = @($contractNames[5],$contractNames[6],$contractNames[2],$contractNames[7],$contractNames[8],$contractNames[9])
-    if ($assets.Count -ne $expectedNames.Count) { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Release manifest does not bind the exact required asset set' $manifestFile }
-    $assetHashes = @{}
-    foreach ($asset in $assets) {
-        if ($null -eq $asset -or (($asset.PSObject.Properties.Name | Sort-Object) -join '|') -cne 'name|sha256' -or
-            $asset.name -isnot [string] -or $asset.sha256 -isnot [string] -or $asset.name -cnotmatch '^[A-Za-z0-9._-]+$' -or $asset.sha256 -cnotmatch '^[0-9a-f]{64}$' -or
-            $assetHashes.ContainsKey([string]$asset.name)) {
-            Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Release manifest asset records are malformed or duplicate' $manifestFile
-        }
-        $assetHashes[[string]$asset.name] = [string]$asset.sha256
-    }
-    if ((@($assetHashes.Keys | Sort-Object) -join '|') -cne (@($expectedNames | Sort-Object) -join '|')) {
-        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Release manifest asset names are not the exact final candidate set' $manifestFile
-    }
-    foreach ($name in $expectedNames) {
-        $assetPath = Assert-CcodReleaseDefenderRegularFile -Path (Join-Path $directory $name) -Kind 'Release asset'
-        $actual = Get-CcodReleaseDefenderHash -Path $assetPath
-        if ($actual -cne $assetHashes[$name]) {
-            Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Release asset bytes do not match the signed manifest hash' $name
-        }
-    }
-    $installer = Join-Path $directory $expectedNames[0]
-    $checksum = Join-Path $directory $expectedNames[1]
-    $checksumText = [IO.File]::ReadAllText($checksum).TrimEnd("`r", "`n")
-    if ($checksumText -cne ("{0} *{1}" -f $assetHashes[$expectedNames[0]], $expectedNames[0])) {
-        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Release checksum file is not bound to the manifest installer hash' $checksum
-    }
-    $trayHostFile = Join-Path $directory $expectedNames[2]
-    $trayHostRaw = [IO.File]::ReadAllText($trayHostFile)
-    try { $trayHost = $trayHostRaw | ConvertFrom-Json -ErrorAction Stop }
-    catch { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'TrayHost provenance is not valid JSON' $expectedNames[2] }
-    $trayHostVersion = $trayHost.PSObject.Properties['version']
-    $trayHostCommit = $trayHost.PSObject.Properties['gitCommit']
-    $trayHostTimestamp = $trayHost.PSObject.Properties['buildTimestampUtc']
-    $trayHostTimestampText = Get-CcodReleaseDefenderRawJsonString -Json $trayHostRaw -PropertyName 'buildTimestampUtc'
-    if ($null -eq $trayHostVersion -or $null -eq $trayHostCommit -or $null -eq $trayHostTimestamp -or
-        $trayHostVersion.Value -isnot [string] -or $trayHostVersion.Value -cne $ExpectedVersion -or
-        $trayHostCommit.Value -isnot [string] -or $trayHostCommit.Value -cne $manifest.gitCommit -or
-        ($trayHostTimestamp.Value -isnot [string] -and $trayHostTimestamp.Value -isnot [datetime]) -or
-        -not (Test-CcodReleaseDefenderCanonicalUtc $trayHostTimestampText) -or
-        $trayHostTimestampText -cne $manifestTimestamp) {
-        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'TrayHost provenance is not bound to the release version, source commit, and timestamp' $expectedNames[2]
-    }
-    $setupProvenancePath = Join-Path $directory $expectedNames[3]
-    $setupArtifactModule = Join-Path (Split-Path $PSScriptRoot -Parent) 'build\SetupArtifact.psm1'
-    if (-not [IO.File]::Exists($setupArtifactModule)) {
-        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Setup artifact validator is missing' $setupArtifactModule
-    }
-    Import-Module $setupArtifactModule -Force
-    try {
-        $setupRaw = [IO.File]::ReadAllText($setupProvenancePath)
-        $setupRecord = $setupRaw | ConvertFrom-Json -ErrorAction Stop
-        $payloadHash = [string]$setupRecord.payloadManifest.sha256
-        if ($payloadHash -cnotmatch '^[0-9a-f]{64}$') { throw 'payload hash' }
-        $repositoryRoot = Split-Path $PSScriptRoot -Parent
-        $innoTemplatePath = Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss'
-        $compiler = @(
-            (Join-Path $env:LOCALAPPDATA 'Programs\Inno Setup 6\ISCC.exe'),
-            (Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'),
-            (Join-Path $env:ProgramFiles 'Inno Setup 6\ISCC.exe')
-        ) | Where-Object { -not [string]::IsNullOrWhiteSpace($_) -and [IO.File]::Exists($_) } | Select-Object -First 1
-        if ($null -eq $compiler) { throw 'canonical ISCC compiler missing' }
-        Test-CcodSetupBuildProvenance -ProvenancePath $setupProvenancePath -ExpectedVersion $ExpectedVersion -ExpectedGitCommit ([string]$manifest.gitCommit) -ExpectedPayloadManifestSha256 $payloadHash -ExpectedBuildTimestampUtc $manifestTimestamp -InnoTemplatePath $innoTemplatePath -DestinationInventoryPath (Join-Path $directory $expectedNames[5]) -CompilerPath $compiler -PayloadManifestPath (Join-Path $directory $expectedNames[4]) | Out-Null
-        Test-CcodSetupArtifact -SetupPath $installer -ExpectedVersion $ExpectedVersion -ExpectedGitCommit ([string]$manifest.gitCommit) -ExpectedPayloadManifestSha256 $payloadHash | Out-Null
-    } catch {
-        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' ('Setup provenance or final PE contract is invalid: ' + $_.Exception.Message) $setupProvenancePath
-    }
-    return [pscustomobject][ordered]@{
-        Valid = $true
-        Version = $ExpectedVersion
-        GitCommit = [string]$manifest.gitCommit
-        BuildTimestampUtc = $manifestTimestamp
-        InstallerSha256 = [string]$assetHashes[$expectedNames[0]]
-        InstallerName = $expectedNames[0]
-        PayloadManifestSha256 = $payloadHash
-        SetupProvenanceName = $expectedNames[3]
-        SetupPayloadInputName = $expectedNames[4]
-        SetupInventoryInputName = $expectedNames[5]
-    }
-}
-
-function Get-CcodReleaseDefenderDetectionKeys {
-    param($Records)
-    $keys = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
-    foreach ($record in @($Records)) {
-        if ($null -eq $record) { continue }
-        $threat = if ($null -ne $record.PSObject.Properties['ThreatID']) { [string]$record.ThreatID } else { '' }
-        $time = if ($null -ne $record.PSObject.Properties['InitialDetectionTime']) { [string]$record.InitialDetectionTime } else { '' }
-        $resources = if ($null -ne $record.PSObject.Properties['Resources']) { (@($record.Resources) -join '|') } else { '' }
-        if (-not [string]::IsNullOrWhiteSpace($threat) -or -not [string]::IsNullOrWhiteSpace($time) -or -not [string]::IsNullOrWhiteSpace($resources)) {
-            $null = $keys.Add("$threat|$time|$resources")
-        }
-    }
-    Write-Output -NoEnumerate $keys
-}
-
-function Test-CcodReleaseDefenderPositiveInteger {
-    param($Value)
-    if ($Value -is [bool] -or $Value -isnot [ValueType]) { return $false }
-    try { return [decimal]$Value -eq [decimal][uint64]$Value -and [uint64]$Value -gt 0 }
-    catch { return $false }
-}
-
-function Assert-CcodReleaseDefenderOrigin {
-    param([Parameter(Mandatory)][string]$Origin,$WorkflowArtifactIdentity,[Parameter(Mandatory)][string]$ExpectedGitCommit)
-    if ($Origin -ceq 'InternetDownload') {
-        if ($null -ne $WorkflowArtifactIdentity) { Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_ORIGIN_INVALID' 'Internet-download evidence cannot claim a workflow artifact identity.' $WorkflowArtifactIdentity }
-        return $null
-    }
-    if ($Origin -cne 'TrustedWorkflowArtifact' -or $null -eq $WorkflowArtifactIdentity -or $WorkflowArtifactIdentity -isnot [pscustomobject] -or
-        (@($WorkflowArtifactIdentity.PSObject.Properties.Name) -join ',') -cne 'provider,repository,runId,runAttempt,artifactId,artifactName,artifactDigest,gitCommit' -or
-        $WorkflowArtifactIdentity.provider -isnot [string] -or $WorkflowArtifactIdentity.provider -cne 'GitHubActions' -or
-        $WorkflowArtifactIdentity.repository -isnot [string] -or $WorkflowArtifactIdentity.repository -cne 'naipi11/CodexRemote-fix' -or
-        -not (Test-CcodReleaseDefenderPositiveInteger $WorkflowArtifactIdentity.runId) -or
-        -not (Test-CcodReleaseDefenderPositiveInteger $WorkflowArtifactIdentity.runAttempt) -or
-        -not (Test-CcodReleaseDefenderPositiveInteger $WorkflowArtifactIdentity.artifactId) -or
-        $WorkflowArtifactIdentity.artifactName -isnot [string] -or $WorkflowArtifactIdentity.artifactName -cne 'CodexRemote-fix portable bundle' -or
-        $WorkflowArtifactIdentity.artifactDigest -isnot [string] -or $WorkflowArtifactIdentity.artifactDigest -cnotmatch '^sha256:[0-9a-f]{64}$' -or
-        $WorkflowArtifactIdentity.gitCommit -isnot [string] -or $WorkflowArtifactIdentity.gitCommit -cne $ExpectedGitCommit) {
-        Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_ORIGIN_INVALID' 'Trusted workflow evidence requires one exact GitHub Actions artifact identity.' $WorkflowArtifactIdentity
-    }
-    return [pscustomobject][ordered]@{
-        provider=[string]$WorkflowArtifactIdentity.provider
-        repository=[string]$WorkflowArtifactIdentity.repository
-        runId=[uint64]$WorkflowArtifactIdentity.runId
-        runAttempt=[uint64]$WorkflowArtifactIdentity.runAttempt
-        artifactId=[uint64]$WorkflowArtifactIdentity.artifactId
-        artifactName=[string]$WorkflowArtifactIdentity.artifactName
-        artifactDigest=[string]$WorkflowArtifactIdentity.artifactDigest
-        gitCommit=[string]$WorkflowArtifactIdentity.gitCommit
-    }
-}
-
-function Get-CcodReleaseDefenderStatusEvidence {
-    param([Parameter(Mandatory)]$Status,[Parameter(Mandatory)][datetime]$ScanStarted)
-    if ($null -eq $Status -or
-        $null -eq $Status.PSObject.Properties['AMServiceEnabled'] -or $Status.AMServiceEnabled -isnot [bool] -or -not $Status.AMServiceEnabled -or
-        $null -eq $Status.PSObject.Properties['AntivirusEnabled'] -or $Status.AntivirusEnabled -isnot [bool] -or -not $Status.AntivirusEnabled -or
-        $null -eq $Status.PSObject.Properties['RealTimeProtectionEnabled'] -or $Status.RealTimeProtectionEnabled -isnot [bool] -or -not $Status.RealTimeProtectionEnabled -or
-        $null -eq $Status.PSObject.Properties['AMProductVersion'] -or $Status.AMProductVersion -isnot [string] -or [string]::IsNullOrWhiteSpace($Status.AMProductVersion) -or $Status.AMProductVersion.Length -gt 128 -or
-        $null -eq $Status.PSObject.Properties['AMEngineVersion'] -or $Status.AMEngineVersion -isnot [string] -or [string]::IsNullOrWhiteSpace($Status.AMEngineVersion) -or $Status.AMEngineVersion.Length -gt 128 -or
-        $null -eq $Status.PSObject.Properties['AntivirusSignatureVersion'] -or $Status.AntivirusSignatureVersion -isnot [string] -or [string]::IsNullOrWhiteSpace($Status.AntivirusSignatureVersion) -or $Status.AntivirusSignatureVersion.Length -gt 128 -or
-        $null -eq $Status.PSObject.Properties['AntivirusSignatureLastUpdated'] -or $Status.AntivirusSignatureLastUpdated -isnot [datetime]) {
-        Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_STATUS_INVALID' 'Defender service, AV, real-time, platform, engine, or signature state is incomplete.' $Status
-    }
-    $signature = ([datetime]$Status.AntivirusSignatureLastUpdated).ToUniversalTime()
-    if ($signature -lt $ScanStarted.AddHours(-72) -or $signature -gt $ScanStarted.AddMinutes(5)) {
-        Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_STATUS_INVALID' 'Defender signature timestamp is stale or future-dated.' $signature
-    }
-    return [pscustomobject][ordered]@{
-        ServiceEnabled=$true
-        AntivirusEnabled=$true
-        RealTimeProtectionEnabled=$true
-        PlatformVersion=[string]$Status.AMProductVersion
-        EngineVersion=[string]$Status.AMEngineVersion
-        SignatureVersion=[string]$Status.AntivirusSignatureVersion
-        SignatureUpdatedAtUtc=$signature.ToString('o',[Globalization.CultureInfo]::InvariantCulture)
-    }
-}
-
-function Invoke-CcodReleaseDefenderCheck {
-    [CmdletBinding()]
-    param(
-        [Parameter(Mandatory)][string]$CandidatePath,
-        [Parameter(Mandatory)][string]$ChecksumPath,
-        [Parameter(Mandatory)][string]$ManifestPath,
-        [Parameter(Mandatory)][string]$Origin,
-        $WorkflowArtifactIdentity,
-        [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion,
-        [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit,
-        [Parameter(Mandatory)][string]$EvidencePath,
-        [hashtable]$Adapters
-    )
-    $adapters = Resolve-CcodReleaseDefenderAdapters -Adapters $Adapters
-    $evidenceTarget = Assert-CcodReleaseDefenderEvidenceTarget -Path $EvidencePath
-    $candidate = Get-CcodReleaseDefenderChecksum -CandidatePath $CandidatePath -ChecksumPath $ChecksumPath -Adapters $adapters
-    $candidateDirectory = Split-Path $candidate.CandidatePath -Parent
-    if ((Split-Path $candidate.ChecksumPath -Parent) -cne $candidateDirectory) { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Candidate and checksum must be exact siblings.' $candidate.ChecksumPath }
-    $manifestFile = Assert-CcodReleaseDefenderRegularFile -Path $ManifestPath -Kind 'Matching release manifest'
-    if ((Split-Path $manifestFile -Parent) -cne $candidateDirectory) { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Candidate and manifest must be exact siblings.' $manifestFile }
-    $contractNames = @(Get-CcodExpectedReleaseAssetNames -Version $ExpectedVersion)
-    $candidateLeaf = [IO.Path]::GetFileName($candidate.CandidatePath)
-    $assetType = if ($candidateLeaf -ceq $contractNames[5]) { 'Setup' } elseif ($candidateLeaf -ceq $contractNames[0]) { 'PortableZip' } else { $null }
-    if ($null -eq $assetType) { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Candidate is not the exact versioned Setup or portable ZIP asset.' $candidateLeaf }
-    $expectedChecksumName = if ($assetType -ceq 'Setup') { $contractNames[6] } else { $contractNames[1] }
-    $expectedManifestName = if ($assetType -ceq 'Setup') { $contractNames[10] } else { $contractNames[4] }
-    if ([IO.Path]::GetFileName($candidate.ChecksumPath) -cne $expectedChecksumName -or [IO.Path]::GetFileName($manifestFile) -cne $expectedManifestName) {
-        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Checksum or manifest does not match the exact selected asset type.' $candidateLeaf
-    }
-    $manifest = Test-CcodReleaseAssetManifest -ManifestPath $manifestFile -AssetDirectory $candidateDirectory -ExpectedVersion $ExpectedVersion
-    if ($manifest.GitCommit -cne $ExpectedGitCommit -or $manifest.InstallerName -cne $candidateLeaf -or $manifest.InstallerSha256 -cne $candidate.Sha256) {
-        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Expected commit, release manifest, checksum, and candidate bytes do not bind one identity.' $candidateLeaf
-    }
-    $checksumSha256 = [string](& $adapters.GetFileSha256 $candidate.ChecksumPath)
-    $manifestSha256 = [string](& $adapters.GetFileSha256 $manifestFile)
-    if ($checksumSha256 -cnotmatch '^[0-9a-f]{64}$' -or $manifestSha256 -cnotmatch '^[0-9a-f]{64}$') { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Checksum or manifest hash adapter returned an invalid identity.' $candidateLeaf }
-    $workflowIdentity = Assert-CcodReleaseDefenderOrigin -Origin $Origin -WorkflowArtifactIdentity $WorkflowArtifactIdentity -ExpectedGitCommit $ExpectedGitCommit
-    $zone = $null
-    if ($Origin -ceq 'InternetDownload') {
-        $zone = & $adapters.GetZoneId $candidate.CandidatePath
-        if ($zone -isnot [int] -or [int]$zone -ne 3) { Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_ZONE_REQUIRED' 'The final downloaded candidate must retain actual Internet ZoneId 3 before scanning.' $zone }
-        $zone = [int]$zone
-    }
-    $started = & $adapters.GetUtcNow
-    if ($started -isnot [datetime]) { Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CLOCK_INVALID' 'Defender clock did not return a DateTime value' $started }
-    $started = ([datetime]$started).ToUniversalTime()
-    $status = Get-CcodReleaseDefenderStatusEvidence -Status (& $adapters.GetDefenderStatus) -ScanStarted $started
-    $before = Get-CcodReleaseDefenderDetectionKeys -Records (& $adapters.GetThreatDetections)
-    $scanError = $null
-    try { & $adapters.StartCustomScan $candidate.CandidatePath }
-    catch { $scanError = $_ }
-    $completed = & $adapters.GetUtcNow
-    if ($completed -isnot [datetime]) { Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CLOCK_INVALID' 'Defender completion clock did not return a DateTime value.' $completed }
-    $completed = ([datetime]$completed).ToUniversalTime()
-    if ($completed -lt $started -or $completed -gt $started.AddHours(2)) { Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CLOCK_INVALID' 'Defender scan timestamps are reversed or exceed the two-hour bound.' $completed }
-    $after = Get-CcodReleaseDefenderDetectionKeys -Records (& $adapters.GetThreatDetections)
-    $newDetections = @($after | Where-Object { -not $before.Contains($_) })
-    try {
-        $revalidatedCandidate = Get-CcodReleaseDefenderChecksum -CandidatePath $candidate.CandidatePath -ChecksumPath $candidate.ChecksumPath -Adapters $adapters
-        $revalidatedManifest = Test-CcodReleaseAssetManifest -ManifestPath $manifestFile -AssetDirectory $candidateDirectory -ExpectedVersion $ExpectedVersion
-        $revalidatedChecksumSha256 = [string](& $adapters.GetFileSha256 $candidate.ChecksumPath)
-        $revalidatedManifestSha256 = [string](& $adapters.GetFileSha256 $manifestFile)
-    } catch { Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Candidate, checksum, or manifest identity changed during Defender scanning.' $candidateLeaf }
-    if ($revalidatedCandidate.Sha256 -cne $candidate.Sha256 -or $revalidatedManifest.GitCommit -cne $ExpectedGitCommit -or
-        $revalidatedManifest.InstallerName -cne $candidateLeaf -or $revalidatedManifest.InstallerSha256 -cne $candidate.Sha256 -or
-        $revalidatedChecksumSha256 -cne $checksumSha256 -or $revalidatedManifestSha256 -cne $manifestSha256) {
-        Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Candidate, checksum, or manifest identity changed during Defender scanning.' $candidateLeaf
-    }
-    if ($Origin -ceq 'InternetDownload') {
-        $revalidatedZone = & $adapters.GetZoneId $candidate.CandidatePath
-        if ($revalidatedZone -isnot [int] -or [int]$revalidatedZone -ne 3) { Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_ZONE_REQUIRED' 'Internet ZoneId changed during Defender scanning.' $revalidatedZone }
-    }
-    $errorCode = $null
-    if ($null -ne $scanError) { $errorCode = 'CCOD_DEFENDER_SCAN_FAILED' }
-    elseif ($newDetections.Count -gt 0) { $errorCode = 'CCOD_DEFENDER_DETECTIONS_FOUND' }
-    $receipt = [pscustomobject][ordered]@{
-        schemaVersion = 2
-        assetType = $assetType
-        assetName = $candidateLeaf
-        assetSha256 = $candidate.Sha256
-        checksumName = $expectedChecksumName
-        checksumSha256 = $checksumSha256
-        manifestName = $expectedManifestName
-        manifestSha256 = $manifestSha256
-        version = $ExpectedVersion
-        gitCommit = $ExpectedGitCommit
-        origin = $Origin
-        workflowArtifactIdentity = $workflowIdentity
-        zoneId = $zone
-        defenderServiceEnabled = [bool]$status.ServiceEnabled
-        antivirusEnabled = [bool]$status.AntivirusEnabled
-        realTimeProtectionEnabled = [bool]$status.RealTimeProtectionEnabled
-        defenderPlatformVersion = [string]$status.PlatformVersion
-        defenderEngineVersion = [string]$status.EngineVersion
-        signatureVersion = [string]$status.SignatureVersion
-        signatureUpdatedAtUtc = [string]$status.SignatureUpdatedAtUtc
-        scanStartedAtUtc = $started.ToString('o', [Globalization.CultureInfo]::InvariantCulture)
-        scanCompletedAtUtc = $completed.ToString('o', [Globalization.CultureInfo]::InvariantCulture)
-        detectionCount = [int]$newDetections.Count
-        outcome = if ($null -eq $errorCode) { 'Completed' } else { 'Failed' }
-        errorCode = $errorCode
-    }
-    try { & $adapters.WriteReceipt $evidenceTarget $receipt | Out-Null }
-    catch {
-        $id = Get-CcodReleaseDefenderErrorId $_
-        if ($id -ceq 'CCOD_DEFENDER_EVIDENCE_INVALID') { throw }
-        Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED' 'Defender scan receipt could not be written.' $evidenceTarget
-    }
-    if ($null -ne $errorCode) { Throw-CcodReleaseDefenderError $errorCode 'The Defender final-asset gate did not complete cleanly.' $candidate.Sha256 }
-    return $receipt
-}
-
-if (-not $Library) {
-    try {
-        $receipt = Invoke-CcodReleaseDefenderCheck -CandidatePath $CandidatePath -ChecksumPath $ChecksumPath -ManifestPath $ManifestPath -Origin $Origin -WorkflowArtifactIdentity $WorkflowArtifactIdentity -ExpectedVersion $ExpectedVersion -ExpectedGitCommit $ExpectedGitCommit -EvidencePath $EvidencePath
-        $receipt | ConvertTo-Json -Depth 12
-    } catch {
-        Write-Error $_
-        exit 1
-    }
+try {
+    Import-Module $modulePath -Force -ErrorAction Stop
+    Invoke-CcodReleaseDefenderCheck -CandidatePath $CandidatePath -ChecksumPath $ChecksumPath -ManifestPath $ManifestPath -Origin $Origin -WorkflowArtifactIdentity $WorkflowArtifactIdentity -ExpectedVersion $ExpectedVersion -ExpectedGitCommit $ExpectedGitCommit -EvidencePath $EvidencePath | ConvertTo-Json -Depth 12
+} catch {
+    Write-Error $_
+    exit 1
 }

From bc4eda5a2c716d43a73ba90ad11f6a42653186c8 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 15:11:30 +0800
Subject: [PATCH 158/187] docs: record Defender authority fix evidence

Record the Task 5 fix-round implementation SHA, frozen verification, and remaining scoped re-review boundary without claiming Tasks 6-8 or release readiness.
---
 .../2026-08-29-v2522-immutable-generation/progress.md | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md
index 856b602..e9d9311 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md
@@ -383,3 +383,14 @@ was performed. Task 5 scoped review FAIL (1 Critical, 3 Important): the public D
 full-fact adapters; the central contract shallow-validates nested payload/provenance; asset identity is not
 handle-held across scan/promotion; and receipt writing lacks production read-back. Task 5 fix round 1 is in
 progress. Tasks 6–8 remain blocked.
+
+Task 5 fix round 1 implementation `9f8a9e7f4aa8ba6028941026cbca776cbd908610`
+closes the four scoped-review findings without changing the 11 public names,
+receipt schema, candidate docs, or Setup/portable ordering. Public Defender
+surfaces no longer accept adapters or a library bypass; nested portable/Setup
+payload and provenance are exact; scan and promotion hold asset/receipt
+identities through the decision; and receipts require production write/read-back.
+Frozen verification passed ReleaseWorkflow 63 declared cases, PortableRelease
+5/5, InstallLifecycle 151/151, parser 104/104, diff check, and all 39 aggregate
+suites. No real Defender/build/install/network/release action was performed.
+Task 5 scoped re-review of `fb163b7..9f8a9e7` is required. Tasks 6–8 remain blocked.

From 291a95300c334577a3cfd0321aaadc9dcacb1df0 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 3 Sep 2026 15:11:46 +0800
Subject: [PATCH 159/187] docs: add Defender authority fix report

Keep the Task 5 fix-round evidence report with the implementation SHA so scoped re-review can verify the four findings without claiming later tasks.
---
 .../task-5-fix1-report.md                     | 101 ++++++++++++++++++
 1 file changed, 101 insertions(+)
 create mode 100644 .superpowers/sdd/2026-08-29-v2522-immutable-generation/task-5-fix1-report.md

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-5-fix1-report.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-5-fix1-report.md
new file mode 100644
index 0000000..d01c54c
--- /dev/null
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-5-fix1-report.md
@@ -0,0 +1,101 @@
+# Task 5 fix round 1 report: non-synthesizable Defender authority
+
+## Status
+
+Implemented Task 5 fix round 1 in commit
+`9f8a9e7f4aa8ba6028941026cbca776cbd908610`
+(`fix: close Defender authority review gaps`). The previous Task 5
+implementation commit remains `fb163b7b6b594e302cf4dffe1dedd055b5f8d9d4`.
+The scoped review that failed Task 5 saw `1109854..fb163b7`. This round
+covers `fb163b7..9f8a9e7`.
+
+This remains candidate infrastructure only. It does not claim a live
+Defender scan, a production build, a published release, Windows
+acceptance, or completion of Tasks 6-8. Scoped re-review is still
+required.
+
+No real Defender command, official build, installation, uninstall,
+registry or shortcut mutation, network request, GitHub action, restart,
+reboot, signing, tag, push, upload, promotion, or publication was
+performed. Defender and activation tests used temporary files and
+module-scope adapters only.
+
+## Finding 1: public Defender surfaces cannot synthesize authority
+
+Public `Invoke-CcodReleaseDefenderCheck` and `tools/Test-ReleaseDefender.ps1`
+now accept only candidate, checksum, manifest, origin, optional workflow
+identity, version, commit, and evidence path. They expose neither
+`-Adapters` nor `-Library`. Production adapters resolve only real
+Defender cmdlets, the actual Zone stream, and the create-only receipt
+publisher. Adapter-taking logic lives in non-exported
+`Invoke-CcodReleaseDefenderCheckCore`; tests reach it only through
+module-scope invocation.
+
+RED: `fix1-public` enumerates public parameters/exports and attempts the
+old forged receipt path. Actual first-failure shape, before this round,
+was a public function that accepted `-Adapters` and a script `-Library`
+bypass.
+
+## Finding 2: nested payload and provenance are now exact
+
+`Test-CcodExactReleaseAssetSet` and promotion consume deep portable and
+Setup validation from `tools/ReleaseAssetContract.psm1`. Portable
+validation checks payload records, ZIP membership, root launcher hashes,
+and embedded payload-manifest identity. Setup validation checks nested
+package-manifest, provenance, inventory grammar, and PE binding. The
+Task 5 fixture now uses internally consistent nested bytes instead of
+placeholder hashes.
+
+RED: `fix1-deep` mutates nested payload length/hash, ZIP root launcher,
+ZIP extra entry, TrayHost nested schema, Setup package payload binding,
+Setup provenance nested schema/length, and inventory grammar while
+keeping outer hashes self-consistent. Each mutation fails closed with
+`CCOD_RELEASE_ASSET_SET_INVALID`.
+
+## Finding 3: scan and promotion hold identities through the decision
+
+Candidate, checksum, manifest, Zone, all 11 public assets, and both
+receipts are pinned with read-only no-write/no-delete handles. Shared
+final-path, file-id, reparse, ADS, and multilink checks revalidate
+identity through scan, receipt durable read-back, and promotion return.
+Promotion rechecks exact directory membership before return.
+
+RED: `fix1-handle-scan` same-byte ABA writes are denied; `fix1-handle-post`
+post-revalidation replacement is denied; `fix1-handle-promotion` cannot
+replace a held asset or receipt before return.
+
+## Finding 4: receipts require production write/read-back
+
+Receipt publication serializes one canonical UTF-8 byte sequence, writes
+create-only under the held evidence directory, flushes, publishes
+no-replace, reopens the final leaf, and compares regular/nonreparse
+identity, exact 25 fields, bytes, hash, and object. Failed scan receipts
+use the same read-back before the stable scan error is returned.
+
+RED: `fix1-receipt-NoOp`, `Corrupt`, `WrongTarget`, `StaleObject`,
+`ReplacedReadback`, and `FailedNoOp` all fail with
+`CCOD_DEFENDER_EVIDENCE_WRITE_FAILED`.
+
+## Frozen GREEN evidence
+
+The final source was frozen at pre-commit diff hash
+`be3fc4f1c194ccc4d64bae4609e86531a10cb1da2a8f9813ca0962ad58f387a2`.
+From that unchanged source:
+
+- `powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File tests\\persistence\\ReleaseWorkflow.SelfTest.ps1` exited `0`; 63 declared cases passed, including public-surface, deep nested, handle, receipt read-back, dual promotion, origins, status, clocks, Setup order, portable races, build wiring, and bilingual documentation.
+- `powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File tests\\persistence\\PortableRelease.SelfTest.ps1` exited `0`; `5/5`.
+- `powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File tests\\persistence\\InstallLifecycle.SelfTest.ps1` exited `0`; `151/151`. The existing cross-process observation still prints `exit=23 mutex=True authority=False product=False verified=False error=CCOD_PRODUCT_REGISTRATION_FAILED`.
+- PowerShell parser checks covered all 104 repository `.ps1`/`.psm1` files with `PARSER_FAILURES=0`.
+- `git diff --check` exited `0`; only checkout LF-to-CRLF notices appeared.
+- `powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File tests\\PersistenceSelfTest.ps1` exited `0`; all 39 registered persistence suites completed.
+
+## Implementation commit and review boundary
+
+- Implementation: `9f8a9e7f4aa8ba6028941026cbca776cbd908610`
+  (`fix: close Defender authority review gaps`).
+- Previous Task 5 implementation: `fb163b7b6b594e302cf4dffe1dedd055b5f8d9d4`.
+- Plan/brief baseline remains `1109854`; fix-round brief is
+  `task-5-fix1-brief.md`.
+- Tasks 6-8 remain blocked. Task 5 needs a scoped re-review of
+  `fb163b7..9f8a9e7` before it can be marked complete.
+

From 6d9bafa96c252ece692e8aff35e420285479b7b6 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 4 Sep 2026 09:08:28 +0800
Subject: [PATCH 160/187] fix: stage releases behind draft promotion gates

---
 .github/workflows/ci.yml                      |    4 +-
 .github/workflows/release.yml                 |  204 ++--
 tests/persistence/Bootstrap.SelfTest.ps1      |    8 +
 .../persistence/InstallLifecycle.SelfTest.ps1 |    5 +-
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 1073 ++++++++++++++++-
 tools/Invoke-GitHubDraftRelease.ps1           |  766 ++++++++++++
 tools/Test-CleanReleaseRunner.ps1             |  233 ++++
 7 files changed, 2183 insertions(+), 110 deletions(-)
 create mode 100644 tools/Invoke-GitHubDraftRelease.ps1
 create mode 100644 tools/Test-CleanReleaseRunner.ps1

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 27ef0a8..080ef97 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,10 +19,10 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: 22
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4db31d4..2aee3c3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,6 +11,10 @@ on:
         required: true
         type: string
 
+concurrency:
+  group: ccod-draft-${{ github.event.inputs.tag || github.ref_name }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 
@@ -19,6 +23,7 @@ jobs:
     runs-on: windows-latest
     outputs:
       tag: ${{ steps.release.outputs.tag }}
+      commit: ${{ steps.commit.outputs.commit }}
     steps:
       - name: Validate release tag
         id: release
@@ -27,25 +32,76 @@ jobs:
           CCOD_RELEASE_TAG_INPUT: ${{ inputs.tag }}
         run: |
           $tag = if ($env:GITHUB_EVENT_NAME -eq 'workflow_dispatch') { [string]$env:CCOD_RELEASE_TAG_INPUT } else { [string]$env:GITHUB_REF_NAME }
-          $tag = $tag.Trim()
-          if ($tag -cnotmatch '^v\d+\.\d+\.\d+$') {
+          if ($tag -cnotmatch '^v\d+\.\d+\.\d+\z') {
             throw "Release tag must be canonical vX.Y.Z; received '$tag'."
           }
           "tag=$tag" >> $env:GITHUB_OUTPUT
 
-  build:
+      - name: Check out the validated release tag
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          ref: ${{ steps.release.outputs.tag }}
+          fetch-depth: 1
+
+      - name: Resolve immutable release commit
+        id: commit
+        shell: pwsh
+        run: |
+          $commit = ([string](& git rev-parse HEAD)).Trim().ToLowerInvariant()
+          if ($LASTEXITCODE -ne 0 -or $commit -cnotmatch '^[0-9a-f]{40}$') {
+            throw "Release tag did not resolve to a canonical commit: '$commit'."
+          }
+          "commit=$commit" >> $env:GITHUB_OUTPUT
+
+  preflight:
     needs: prepare
     outputs:
       tag: ${{ needs.prepare.outputs.tag }}
+      commit: ${{ needs.prepare.outputs.commit }}
+    runs-on: windows-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          ref: ${{ needs.prepare.outputs.commit }}
+
+      - name: Run clean release runner
+        shell: pwsh
+        env:
+          CCOD_RELEASE_TAG: ${{ needs.prepare.outputs.tag }}
+        run: |
+          $tag = $env:CCOD_RELEASE_TAG
+          if ($tag -cnotmatch '^v\d+\.\d+\.\d+\z') {
+            throw "Release tag output is invalid: '$tag'."
+          }
+          $version = $tag.Substring(1)
+          Import-Module (Join-Path $PWD 'tools\Test-CleanReleaseRunner.psm1') -Force -DisableNameChecking
+          $result = Test-CcodCleanReleaseRunner -RepositoryRoot $PWD -ExpectedVersion $version
+          $artifact = Join-Path $PWD 'build\preflight\clean-preflight.json'
+          New-Item -ItemType Directory -Path (Split-Path $artifact -Parent) -Force | Out-Null
+          Copy-Item -LiteralPath $result.PreflightPath -Destination $artifact -Force
+
+      - name: Upload immutable clean preflight evidence
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: CodexRemote-fix clean preflight
+          path: build/preflight/clean-preflight.json
+          if-no-files-found: error
+
+  build:
+    needs: preflight
+    outputs:
+      tag: ${{ needs.preflight.outputs.tag }}
+      commit: ${{ needs.preflight.outputs.commit }}
     runs-on: windows-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
-          ref: ${{ needs.prepare.outputs.tag }}
+          ref: ${{ needs.preflight.outputs.commit }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: 22
 
@@ -72,148 +128,98 @@ jobs:
       - name: Build CodexRemote-fix portable bundle
         shell: pwsh
         env:
-          CCOD_RELEASE_TAG: ${{ needs.prepare.outputs.tag }}
+          CCOD_RELEASE_TAG: ${{ needs.preflight.outputs.tag }}
         run: |
           $version = $env:CCOD_RELEASE_TAG.Substring(1)
           ./build/build.ps1 -Version $version
 
       - name: Upload immutable CodexRemote-fix portable bundle
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: CodexRemote-fix portable bundle
-          path: build/dist/*
+          path: build/dist
           if-no-files-found: error
 
-  publish:
+  stage:
     needs: build
     runs-on: windows-latest
     permissions:
       contents: write
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
-          ref: ${{ needs.build.outputs.tag }}
+          ref: ${{ needs.build.outputs.commit }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: 22
 
       - name: Download immutable CodexRemote-fix portable bundle
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: CodexRemote-fix portable bundle
           path: build/dist
 
-      - name: Verify downloaded release candidate contract
+      - name: Download immutable clean preflight evidence
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: CodexRemote-fix clean preflight
+          path: build/preflight
+
+      - name: Materialize transferred clean preflight evidence
         shell: pwsh
         env:
           CCOD_RELEASE_TAG: ${{ needs.build.outputs.tag }}
         run: |
-          npm run test:release-contract
           $tag = $env:CCOD_RELEASE_TAG
-          if ($tag -cnotmatch '^v\d+\.\d+\.\d+$') {
-            throw "Release tag output is invalid: '$tag'."
-          }
           $version = $tag.Substring(1)
-          . ./tools/Test-ReleaseDefender.ps1 -Library
-          $manifestPath = Join-Path $PWD ("build\dist\CodexRemote-fix-$version-release-manifest.json")
-          Test-CcodReleaseAssetManifest -ManifestPath $manifestPath -AssetDirectory (Join-Path $PWD 'build\dist') -ExpectedVersion $version | Out-Null
-          $setupManifestPath = Join-Path $PWD ("build\dist\CodexRemote-fix-$version-setup-release-manifest.json")
-          Test-CcodReleaseAssetManifest -ManifestPath $setupManifestPath -AssetDirectory (Join-Path $PWD 'build\dist') -ExpectedVersion $version | Out-Null
+          $source = Join-Path $PWD 'build\preflight\clean-preflight.json'
+          $evidence = Join-Path $env:RUNNER_TEMP 'ccod-draft-evidence'
+          New-Item -ItemType Directory -Path $evidence -Force | Out-Null
+          Copy-Item -LiteralPath $source -Destination (Join-Path $evidence ("CodexRemote-fix-$version-clean-preflight.json")) -Force
 
-      - name: Publish GitHub release
+      - name: Verify downloaded release candidate contract
         shell: pwsh
         env:
-          GH_TOKEN: ${{ github.token }}
           CCOD_RELEASE_TAG: ${{ needs.build.outputs.tag }}
         run: |
+          npm run test:release-contract
           $tag = $env:CCOD_RELEASE_TAG
-          if ($tag -cnotmatch '^v\d+\.\d+\.\d+$') {
+          if ($tag -cnotmatch '^v\d+\.\d+\.\d+\z') {
             throw "Release tag output is invalid: '$tag'."
           }
           $version = $tag.Substring(1)
-          $notesPath = Join-Path $env:RUNNER_TEMP ("CodexRemote-fix-$tag-release-notes.md")
-          & (Join-Path $PWD 'tools\New-GitHubReleaseNotes.ps1') -ChangelogPath (Join-Path $PWD 'CHANGELOG.md') -Tag $tag -OutputPath $notesPath | Out-Null
-          & gh release view $tag --repo $env:GITHUB_REPOSITORY --json assets 2>$null | Out-Null
-          $exists = $LASTEXITCODE -eq 0
-          $existingAssets = @()
-          if ($exists) {
-            $existingAssets = @(& gh release view $tag --repo $env:GITHUB_REPOSITORY --json assets --jq '.assets[].name')
-            if ($LASTEXITCODE -ne 0) {
-              throw "Could not inspect existing release assets for $tag."
-            }
-          }
-          $assets = @(Get-ChildItem -LiteralPath (Join-Path $PWD 'build\dist') -File | Where-Object { $_.Extension -in @('.exe', '.zip', '.txt', '.json', '.iss') })
-          $assetNames = @($assets | ForEach-Object { $_.Name })
-          $unexpected = @($existingAssets | Where-Object { $assetNames -cnotcontains $_ })
-          if ($unexpected.Count -ne 0) {
-            throw "Existing release $tag contains unexpected assets and cannot be safely updated: $($unexpected -join ', ')"
-          }
-          foreach ($asset in $assets) {
-            if ($existingAssets -ccontains $asset.Name) {
-              $downloadRoot = Join-Path $env:RUNNER_TEMP ('ccod-existing-asset-' + [guid]::NewGuid().ToString('N'))
-              New-Item -ItemType Directory -Path $downloadRoot -Force | Out-Null
-              try {
-                & gh release download $tag --repo $env:GITHUB_REPOSITORY --pattern $asset.Name --dir $downloadRoot
-                if ($LASTEXITCODE -ne 0) {
-                  throw "Could not download existing release asset $($asset.Name)."
-                }
-                $existingAsset = Join-Path $downloadRoot $asset.Name
-                if (-not (Test-Path -LiteralPath $existingAsset -PathType Leaf) -or
-                    (Get-FileHash -LiteralPath $existingAsset -Algorithm SHA256).Hash.ToLowerInvariant() -cne (Get-FileHash -LiteralPath $asset.FullName -Algorithm SHA256).Hash.ToLowerInvariant()) {
-                  throw "Existing release asset $($asset.Name) differs from the immutable candidate."
-                }
-              } finally {
-                if (Test-Path -LiteralPath $downloadRoot) { Remove-Item -LiteralPath $downloadRoot -Recurse -Force -ErrorAction SilentlyContinue }
-              }
-            }
-          }
-          if (-not $exists) {
-            gh release create $tag --repo $env:GITHUB_REPOSITORY --title "CodexRemote-fix $version" --notes-file $notesPath
-          } else {
-            gh release edit $tag --repo $env:GITHUB_REPOSITORY --title "CodexRemote-fix $version" --notes-file $notesPath
-          }
-          foreach ($asset in $assets) {
-            if ($existingAssets -cnotcontains $asset.Name) {
-              & gh release upload $tag --repo $env:GITHUB_REPOSITORY $asset.FullName
-              if ($LASTEXITCODE -ne 0) {
-                throw "Could not upload release asset $($asset.Name)."
-              }
-            }
+          Import-Module (Join-Path $PWD 'tools\ReleaseAssetContract.psm1') -Force
+          $names = @(Get-CcodExpectedReleaseAssetNames -Version $version)
+          Test-CcodExactReleaseAssetSet -AssetDirectory (Join-Path $PWD 'build\dist') -Version $version | Out-Null
+          $manifestPath = Join-Path $PWD ('build\dist\CodexRemote-fix-' + $version + '-release-manifest.json')
+          Test-CcodReleaseAssetManifest -ManifestPath $manifestPath -AssetDirectory (Join-Path $PWD 'build\dist') -ExpectedVersion $version | Out-Null
+          $setupManifestPath = Join-Path $PWD ('build\dist\CodexRemote-fix-' + $version + '-setup-release-manifest.json')
+          Test-CcodReleaseAssetManifest -ManifestPath $setupManifestPath -AssetDirectory (Join-Path $PWD 'build\dist') -ExpectedVersion $version | Out-Null
+          if ($names.Count -ne 11) {
+            throw 'Release candidate does not expose the exact 11 public names.'
           }
 
-      - name: Read back published GitHub release assets
+      - name: Stage private GitHub draft
         shell: pwsh
         env:
           GH_TOKEN: ${{ github.token }}
           CCOD_RELEASE_TAG: ${{ needs.build.outputs.tag }}
         run: |
           $tag = $env:CCOD_RELEASE_TAG
-          if ($tag -cnotmatch '^v\d+\.\d+\.\d+$') {
+          if ($tag -cnotmatch '^v\d+\.\d+\.\d+\z') {
             throw "Release tag output is invalid: '$tag'."
           }
-          $assets = @(Get-ChildItem -LiteralPath (Join-Path $PWD 'build\dist') -File | Where-Object { $_.Extension -in @('.exe', '.zip', '.txt', '.json', '.iss') })
-          $assetNames = @($assets | ForEach-Object { $_.Name })
-          $publishedNames = @(& gh release view $tag --repo $env:GITHUB_REPOSITORY --json assets --jq '.assets[].name')
-          if ($LASTEXITCODE -ne 0 -or ((@($publishedNames | Sort-Object) -join '|') -cne (@($assetNames | Sort-Object) -join '|'))) {
-            throw "Published release $tag does not expose the exact expected asset set for read-back."
-          }
-          $readBackRoot = Join-Path $env:RUNNER_TEMP ('ccod-release-readback-' + [guid]::NewGuid().ToString('N'))
-          New-Item -ItemType Directory -Path $readBackRoot -Force | Out-Null
-          try {
-            foreach ($asset in $assets) {
-              & gh release download $tag --repo $env:GITHUB_REPOSITORY --pattern $asset.Name --dir $readBackRoot
-              if ($LASTEXITCODE -ne 0) {
-                throw "Could not read back published release asset $($asset.Name)."
-              }
-              $readBackAsset = Join-Path $readBackRoot $asset.Name
-              if (-not (Test-Path -LiteralPath $readBackAsset -PathType Leaf) -or
-                  (Get-FileHash -LiteralPath $readBackAsset -Algorithm SHA256).Hash.ToLowerInvariant() -cne (Get-FileHash -LiteralPath $asset.FullName -Algorithm SHA256).Hash.ToLowerInvariant()) {
-                throw "Published release asset $($asset.Name) does not match the immutable candidate bytes."
-              }
-            }
-          } finally {
-            if (Test-Path -LiteralPath $readBackRoot) { Remove-Item -LiteralPath $readBackRoot -Recurse -Force -ErrorAction SilentlyContinue }
+          $version = $tag.Substring(1)
+          $notesPath = Join-Path $env:RUNNER_TEMP ("CodexRemote-fix-$tag-release-notes.md")
+          & (Join-Path $PWD 'tools\New-GitHubReleaseNotes.ps1') -ChangelogPath (Join-Path $PWD 'CHANGELOG.md') -Tag $tag -OutputPath $notesPath | Out-Null
+          $evidence = Join-Path $env:RUNNER_TEMP 'ccod-draft-evidence'
+          $preflight = Join-Path $evidence ("CodexRemote-fix-$version-clean-preflight.json")
+          if (-not (Test-Path -LiteralPath $preflight -PathType Leaf)) {
+            throw "Transferred clean preflight evidence is missing: '$preflight'."
           }
+          Import-Module (Join-Path $PWD 'tools\Invoke-GitHubDraftRelease.psm1') -Force -DisableNameChecking
+          Invoke-CcodGitHubDraftRelease -Mode Stage -Tag $tag -AssetDirectory (Join-Path $PWD 'build\dist') -EvidenceDirectory $evidence -NotesPath $notesPath | Out-Null
+          Invoke-CcodGitHubDraftRelease -Mode Verify -Tag $tag -AssetDirectory (Join-Path $PWD 'build\dist') -EvidenceDirectory $evidence | Out-Null
diff --git a/tests/persistence/Bootstrap.SelfTest.ps1 b/tests/persistence/Bootstrap.SelfTest.ps1
index 045e3eb..0615b22 100644
--- a/tests/persistence/Bootstrap.SelfTest.ps1
+++ b/tests/persistence/Bootstrap.SelfTest.ps1
@@ -737,5 +737,13 @@ $results += Invoke-CcodTest 'prelaunch evaluates safe-exit policy before lease a
     Assert-CcodExactEqual $null $suppressed.LaunchLease 'suppressed startup owns no launch lease'
 }
 
+$results += Invoke-CcodTest 'clean release runner fail-closes contaminated product state without invoking bootstrap' {
+    $path = Join-Path $repositoryRoot 'tools\Test-CleanReleaseRunner.ps1'
+    Assert-CcodTrue (Test-Path -LiteralPath $path -PathType Leaf) 'clean release runner script exists'
+    $source = [IO.File]::ReadAllText($path, [Text.UTF8Encoding]::new($false))
+    Assert-CcodTrue ($source -cnotmatch 'bootstrap\.ps1') 'clean runner does not invoke bootstrap'
+    Assert-CcodTrue ($source -cmatch 'CCOD_CLEAN_RUNNER_CONTAMINATED') 'clean runner fail-closes contaminated product state'
+}
+
 $results | Format-Table -AutoSize
 Write-Host ("Bootstrap self-test passed: {0}" -f $results.Count)
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index 89a7146..310933b 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -4151,7 +4151,10 @@ $results += Invoke-CcodTest 'README and release workflow publish current portabl
     $workflow = Get-Content -LiteralPath (Join-Path $repositoryRoot '.github\workflows\release.yml') -Raw -Encoding UTF8
     Assert-CcodTrue ($workflow -cmatch '(?m)^name: CodexRemote-fix release\r?$') 'release workflow uses public product branding'
     Assert-CcodTrue ($workflow -cmatch '(?m)^\s+name: CodexRemote-fix portable bundle\r?$') 'uploaded artifact uses public portable bundle branding'
-    Assert-CcodTrue ($workflow -cmatch '--title "CodexRemote-fix \$version"') 'GitHub release title uses public product branding'
+    $draftTool = Join-Path $repositoryRoot 'tools\Invoke-GitHubDraftRelease.ps1'
+    $draftToolContent = Get-Content -LiteralPath $draftTool -Raw -Encoding UTF8
+    Assert-CcodTrue ($draftToolContent -cmatch '(?s)release.*create.*--draft' -and $draftToolContent -cmatch 'CodexRemote-fix \$version') 'draft tool creates a private release with public product branding'
+    Assert-CcodTrue ($workflow -cmatch 'Invoke-CcodGitHubDraftRelease -Mode Stage') 'release workflow stages through the draft-only production tool'
     Assert-CcodTrue ($workflow -cmatch 'tools\\New-GitHubReleaseNotes\.ps1''\) -ChangelogPath .*? -Tag \$tag -OutputPath \$notesPath') 'GitHub release notes use the behavior-tested target-English extractor'
     Assert-CcodTrue ($workflow -cnotmatch 'englishSection\s*=\s*\[regex\]::Match') 'release workflow does not retain a second inline English extractor'
     $notesTool = Join-Path $repositoryRoot 'tools\New-GitHubReleaseNotes.ps1'
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 4446065..e767b30 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -7,8 +7,9 @@ $releaseDefenderModulePath = Join-Path $repositoryRoot 'tools\ReleaseDefender.ps
 $assetContractPath = Join-Path $repositoryRoot 'tools\ReleaseAssetContract.psm1'
 
 $script:CcodReleaseBaseInvokeTest=${function:Invoke-CcodTest}
-function Invoke-CcodTest([string]$Name,[scriptblock]$Action){if(-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK5_RED_CASE)){return};&$script:CcodReleaseBaseInvokeTest $Name $Action}
-function Invoke-CcodTask5Test([string]$Id,[string]$Name,[scriptblock]$Action){if(-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK5_RED_CASE)-and$env:CCOD_TASK5_RED_CASE-cne$Id){return};&$script:CcodReleaseBaseInvokeTest $Name $Action}
+function Invoke-CcodTest([string]$Name,[scriptblock]$Action){if(-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK5_RED_CASE)-or-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK6_RED_CASE)){return};&$script:CcodReleaseBaseInvokeTest $Name $Action}
+function Invoke-CcodTask5Test([string]$Id,[string]$Name,[scriptblock]$Action){if(-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK6_RED_CASE)){return};if(-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK5_RED_CASE)-and$env:CCOD_TASK5_RED_CASE-cne$Id){return};&$script:CcodReleaseBaseInvokeTest $Name $Action}
+function Invoke-CcodTask6Test([string]$Id,[string]$Name,[scriptblock]$Action){if(-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK5_RED_CASE)){return};if(-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK6_RED_CASE)-and$env:CCOD_TASK6_RED_CASE-cne$Id){return};&$script:CcodReleaseBaseInvokeTest $Name $Action}
 
 function ConvertFrom-CcodWorkflowScalar {
     param([Parameter(Mandatory)][AllowEmptyString()][string]$Value)
@@ -62,11 +63,11 @@ function Get-CcodWorkflowStructure {
         }
         if (-not $inSteps) { continue }
         if ($line -cmatch '^      -(?:\s+(?<key>[A-Za-z][A-Za-z0-9_-]*):\s*(?<value>.*))?\s*$') {
-            $currentStep = [pscustomobject]@{ Name = ''; Shell = ''; Run = ''; If = ''; ContinueOnError = '' }
+            $currentStep = [pscustomobject]@{ Name = ''; Shell = ''; Run = ''; If = ''; ContinueOnError = ''; Uses = '' }
             $currentJob.Steps.Add($currentStep)
             $key = [string]$Matches.key
             $value = [string]$Matches.value
-            if ($key -in @('name', 'shell', 'run', 'if', 'continue-on-error')) {
+            if ($key -in @('name', 'shell', 'run', 'if', 'continue-on-error', 'uses')) {
                 if ($key -ceq 'run' -and $value.Trim() -in @('|', '|-', '|+')) {
                     $runBlock = $true
                     $runLines.Clear()
@@ -77,6 +78,7 @@ function Get-CcodWorkflowStructure {
                         'run' { 'Run' }
                         'if' { 'If' }
                         'continue-on-error' { 'ContinueOnError' }
+                        'uses' { 'Uses' }
                     }
                     $currentStep.$property = ConvertFrom-CcodWorkflowScalar $value
                 }
@@ -84,7 +86,7 @@ function Get-CcodWorkflowStructure {
             continue
         }
         if ($null -eq $currentStep) { continue }
-        if ($line -cmatch '^        (?<key>name|shell|run|if|continue-on-error):\s*(?<value>.*)$') {
+        if ($line -cmatch '^        (?<key>name|shell|run|if|continue-on-error|uses):\s*(?<value>.*)$') {
             $key = $Matches.key
             $value = $Matches.value.Trim()
             if ($key -ceq 'run' -and $value -in @('|', '|-', '|+')) {
@@ -97,6 +99,7 @@ function Get-CcodWorkflowStructure {
                     'run' { 'Run' }
                     'if' { 'If' }
                     'continue-on-error' { 'ContinueOnError' }
+                    'uses' { 'Uses' }
                 }
                 $currentStep.$property = ConvertFrom-CcodWorkflowScalar $value
             }
@@ -2770,11 +2773,11 @@ Invoke-CcodTest 'package scripts build provenance and workflows retain the relea
     Assert-CcodTrue ($release -match 'test:release-contract') 'release promotion checks the release contract'
     Assert-CcodTrue ($release -match 'release-manifest') 'release promotion uploads the bound release manifest'
     Assert-CcodTrue ($release -match 'New-GitHubReleaseNotes\.ps1') 'release publication uses the behavior-tested English notes extractor'
-    Assert-CcodTrue ($release -match 'gh release download') 'existing release assets are downloaded before any publication decision'
+    Assert-CcodTrue ((Get-Content -LiteralPath (Join-Path $repositoryRoot 'tools\Invoke-GitHubDraftRelease.ps1') -Raw) -match 'gh release download') 'draft promoter reads back staged assets through gh adapters'
     Assert-CcodTrue (-not ($release -match 'gh release upload[^\r\n]*--clobber')) 'release publication never overwrites an existing asset'
-    Assert-CcodTrue ($release -match 'Read back published GitHub release assets') 'release publication re-downloads every uploaded asset for hash read-back'
+    Assert-CcodTrue ($release -match 'Invoke-CcodGitHubDraftRelease -Mode Verify') 'release publication re-downloads every uploaded asset for hash read-back'
     Assert-CcodTrue ($release -cmatch '(?ms)^permissions:\r?\n\s+contents: read\s*$') 'candidate build starts with read-only repository permission'
-    Assert-CcodTrue ($release -cmatch '(?ms)^  publish:\r?\n    needs: build\r?\n    runs-on: windows-latest\r?\n    permissions:\r?\n      contents: write\s*$') 'only the publish job receives release-write permission'
+    Assert-CcodTrue ($release -cmatch '(?ms)^  stage:\r?\n    needs: build\r?\n    runs-on: windows-latest\r?\n    permissions:\r?\n      contents: write\s*$') 'only the stage job receives release-write permission'
 }
 
 $iss = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw
@@ -3119,4 +3122,1058 @@ Invoke-CcodTest 'actual portable entrypoint rejects the final File.Copy barrier
     }
 }
 
+function Import-CcodTask6ToolModule {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$Name)
+    $existing = Get-Module -Name $Name -ErrorAction SilentlyContinue
+    if ($null -ne $existing) { Remove-Module -Name $Name -Force }
+    $text = [IO.File]::ReadAllText([IO.Path]::GetFullPath($Path), [Text.UTF8Encoding]::new($false))
+    $created = New-Module -Name $Name -ScriptBlock ([scriptblock]::Create($text))
+    Import-Module $created -Force -DisableNameChecking | Out-Null
+    $loaded = Get-Module -Name $Name
+    if ($null -eq $loaded) { throw "CCOD_TASK6_TOOL_MODULE_MISSING $Name" }
+    return $loaded
+}
+
+function Assert-CcodDraftReleaseWorkflowContract {
+    param(
+        [Parameter(Mandatory)][string]$CiPath,
+        [Parameter(Mandatory)][string]$ReleasePath
+    )
+    $errorId = 'CCOD_RELEASE_WORKFLOW_INVALID'
+    $pins = [ordered]@{
+        'actions/checkout' = '11d5960a326750d5838078e36cf38b85af677262'
+        'actions/setup-node' = '49933ea5288caeca8642d1e84afbd3f7d6820020'
+        'actions/upload-artifact' = 'ea165f8d65b6e75b540449e92b4886f43607fa02'
+        'actions/download-artifact' = 'd3f86a106a0bac45b974a628896c90dbdf5c8093'
+    }
+    foreach ($target in @($CiPath, $ReleasePath)) {
+        $raw = [IO.File]::ReadAllText($target, [Text.UTF8Encoding]::new($false))
+        if ($raw -cmatch 'uses:\s*actions/[A-Za-z0-9_.-]+@v\d') { throw $errorId }
+        if ($raw -cmatch '(?m)^\s*continue-on-error:') { throw $errorId }
+        foreach ($use in @([regex]::Matches($raw, '(?m)^\s+uses:\s*(?<ref>\S+)\s*$'))) {
+            if ($use.Groups['ref'].Value -cnotmatch '^actions/[A-Za-z0-9_.-]+@[0-9a-f]{40}$') { throw $errorId }
+            $action = ($use.Groups['ref'].Value -split '@')[0]
+            $sha = ($use.Groups['ref'].Value -split '@')[1]
+            if (-not $pins.Contains($action) -or $pins[$action] -cne $sha) { throw $errorId }
+        }
+    }
+    $ci = [IO.File]::ReadAllText($CiPath, [Text.UTF8Encoding]::new($false))
+    $release = [IO.File]::ReadAllText($ReleasePath, [Text.UTF8Encoding]::new($false))
+    foreach ($action in @('actions/checkout','actions/setup-node')) {
+        if (-not $ci.Contains($action + '@' + $pins[$action])) { throw $errorId }
+    }
+    foreach ($action in @($pins.Keys)) {
+        if (-not $release.Contains($action + '@' + $pins[$action])) { throw $errorId }
+    }
+    if ($release -cmatch 'build/dist/\*' -or $release -cmatch '\.Extension\s+-in' -or $release -cmatch 'Test-ReleaseDefender\.ps1[^\r\n]*-Library') { throw $errorId }
+    if ($release -cnotmatch 'ReleaseAssetContract\.psm1' -or $release -cnotmatch 'Get-CcodExpectedReleaseAssetNames' -or $release -cnotmatch 'Test-CcodCleanReleaseRunner' -or $release -cnotmatch 'Invoke-CcodGitHubDraftRelease') { throw $errorId }
+    if ($release -cmatch '(?m)gh release create\b(?![^\r\n]*--draft)') { throw $errorId }
+    if ($release -cnotmatch '(?m)^concurrency:' -or $release -cnotmatch 'cancel-in-progress:\s*false') { throw $errorId }
+    $workflow = Get-CcodWorkflowStructure -Path $ReleasePath
+    $jobNames = @($workflow.Jobs | ForEach-Object { $_.Name })
+    $preflightIndex = [array]::IndexOf($jobNames, 'preflight')
+    $buildIndex = [array]::IndexOf($jobNames, 'build')
+    if ($preflightIndex -lt 0 -or $buildIndex -lt 0 -or $preflightIndex -ge $buildIndex) { throw $errorId }
+    $cleanSteps = @($workflow.Jobs[$preflightIndex].Steps | Where-Object { [string]$_.Run -cmatch 'Test-CcodCleanReleaseRunner' })
+    if ($cleanSteps.Count -lt 1) { throw $errorId }
+    foreach ($job in @($workflow.Jobs)) {
+        foreach ($step in @($job.Steps)) {
+            if (-not [string]::IsNullOrEmpty([string]$step.ContinueOnError)) { throw $errorId }
+            if ($job.Name -cne 'build' -and (Test-CcodWorkflowStepInvokesBuild $step)) { throw $errorId }
+            if (([string]$step.Run -cmatch 'Test-CcodCleanReleaseRunner|Invoke-CcodGitHubDraftRelease|test:release-contract|build\.ps1') -and -not [string]::IsNullOrEmpty([string]$step.If)) { throw $errorId }
+        }
+    }
+}
+
+function New-CcodTask6CleanAdapterFixture {
+    param(
+        [string]$Version = '2.5.22',
+        [string]$Commit = ('c' * 40),
+        [string]$Porcelain = '',
+        [switch]$Installed,
+        [switch]$MutexOccupied,
+        [switch]$TaskPresent,
+        [switch]$SupervisorPresent,
+        [switch]$TrayHostPresent
+    )
+    $state = [pscustomobject]@{ Calls = [Collections.Generic.List[string]]::new(); Preflight = $null; Cleanup = [Collections.Generic.List[string]]::new() }
+    $adapters = @{
+        GetPackageVersion = { param($Root) $state.Calls.Add('GetPackageVersion'); $Version }.GetNewClosure()
+        GetGitPorcelain = { param($Root) $state.Calls.Add('GetGitPorcelain'); $Porcelain }.GetNewClosure()
+        GetGitCommit = { param($Root) $state.Calls.Add('GetGitCommit'); $Commit }.GetNewClosure()
+        GetProductState = { param($Root) $state.Calls.Add('GetProductState'); [pscustomobject]@{ InstallRootPresent = [bool]$Installed; ScheduledTaskPresent = [bool]$TaskPresent; SupervisorPresent = [bool]$SupervisorPresent; TrayHostPresent = [bool]$TrayHostPresent } }.GetNewClosure()
+        ProbeMutex = { param($Kind) $state.Calls.Add('ProbeMutex:' + $Kind); [bool]$MutexOccupied }.GetNewClosure()
+        WritePreflightEvidence = { param($Path, $Record) $state.Calls.Add('WritePreflightEvidence'); $state.Preflight = [pscustomobject]@{ Path = $Path; Record = $Record }; $Path }.GetNewClosure()
+        CleanupProduct = { param($Root) $state.Cleanup.Add('CleanupProduct'); throw 'cleanup forbidden' }.GetNewClosure()
+    }
+    [pscustomobject]@{ Adapters = $adapters; State = $state }
+}
+
+function New-CcodTask6DraftAdapterFixture {
+    param([string]$AssetDirectory, [switch]$UploadFails, [switch]$ConcurrentStage)
+    $state = [pscustomobject]@{
+        Calls = [Collections.Generic.List[string]]::new()
+        DraftPrivate = $true
+        Created = $false
+        Uploaded = [Collections.Generic.List[string]]::new()
+        Promoted = $false
+        Rebuilt = $false
+        Assets = @{}
+        SourceDirectory = $AssetDirectory
+    }
+    $hashFile = {
+        param($Path)
+        $sha = [Security.Cryptography.SHA256]::Create()
+        try {
+            $stream = [IO.File]::OpenRead([IO.Path]::GetFullPath($Path))
+            try { return [BitConverter]::ToString($sha.ComputeHash($stream)).Replace('-', '').ToLowerInvariant() } finally { $stream.Dispose() }
+        } finally { $sha.Dispose() }
+    }.GetNewClosure()
+    $adapters = @{
+        TryStageLock = { param($Tag) $state.Calls.Add('TryStageLock'); if ($ConcurrentStage) { $false } else { $true } }.GetNewClosure()
+        CreateDraft = { param($Tag, $Title, $Notes) $state.Calls.Add('CreateDraft'); $state.Created = $true; $state.DraftPrivate = $true; [pscustomobject]@{ Tag = $Tag; Draft = $true } }.GetNewClosure()
+        GetTagCommit = { param($Tag, [bool]$ActionsOnly) $state.Calls.Add('GetTagCommit'); 'c' * 40 }.GetNewClosure()
+        UploadAsset = { param($Tag, $Name, $Path)
+            $state.Calls.Add('UploadAsset:' + $Name)
+            if ($UploadFails) { throw 'upload failed' }
+            $state.Uploaded.Add($Name)
+            $state.Assets[$Name] = & $hashFile $Path
+        }.GetNewClosure()
+        DownloadAsset = { param($Tag, $Name, $Destination)
+            $state.Calls.Add('DownloadAsset:' + $Name)
+            $source = Join-Path $state.SourceDirectory $Name
+            [IO.File]::Copy($source, $Destination, $true)
+        }.GetNewClosure()
+        ViewRelease = { param($Tag) $state.Calls.Add('ViewRelease'); [pscustomobject]@{ Tag = $Tag; Draft = [bool]$state.DraftPrivate; AssetNames = @($state.Uploaded) } }.GetNewClosure()
+        SetReleaseDraftState = { param($Tag, [bool]$Draft) $state.Calls.Add('SetReleaseDraftState:' + $Draft); $state.DraftPrivate = [bool]$Draft; if (-not $Draft) { $state.Promoted = $true } }.GetNewClosure()
+        InvokeBuild = { param($Version) $state.Calls.Add('InvokeBuild'); $state.Rebuilt = $true }.GetNewClosure()
+        InvokeGh = { param($Arguments) $state.Calls.Add('InvokeGh'); throw 'raw gh forbidden' }.GetNewClosure()
+    }
+    [pscustomobject]@{ Adapters = $adapters; State = $state }
+}
+
+function Invoke-CcodTask6CleanCore {
+    param([Parameter(Mandatory)]$Module,[Parameter(Mandatory)][string]$RepositoryRoot,[Parameter(Mandatory)][string]$ExpectedVersion,[Parameter(Mandatory)][hashtable]$Adapters)
+    &$Module { param($RepositoryRoot,$ExpectedVersion,$Adapters) Test-CcodCleanReleaseRunnerCore -RepositoryRoot $RepositoryRoot -ExpectedVersion $ExpectedVersion -Adapters $Adapters } $RepositoryRoot $ExpectedVersion $Adapters
+}
+
+function Invoke-CcodTask6DraftCore {
+    param([Parameter(Mandatory)]$Module,[Parameter(Mandatory)][string]$Mode,[Parameter(Mandatory)][string]$Tag,[Parameter(Mandatory)][string]$AssetDirectory,[Parameter(Mandatory)][string]$EvidenceDirectory,[Parameter(Mandatory)][hashtable]$Adapters)
+    &$Module { param($Mode,$Tag,$AssetDirectory,$EvidenceDirectory,$Adapters) Invoke-CcodGitHubDraftReleaseCore -Mode $Mode -Tag $Tag -AssetDirectory $AssetDirectory -EvidenceDirectory $EvidenceDirectory -Adapters $Adapters } $Mode $Tag $AssetDirectory $EvidenceDirectory $Adapters
+}
+
+Invoke-CcodTask6Test 'runner' 'clean release runner is exported from the production tool' {
+    $path = Join-Path $repositoryRoot 'tools\Test-CleanReleaseRunner.ps1'
+    Assert-CcodTrue (Test-Path -LiteralPath $path -PathType Leaf) 'clean release runner script exists'
+    $module = Import-CcodTask6ToolModule -Path $path -Name 'CcodCleanReleaseRunnerPublic'
+    try {
+        $command = Get-Command Test-CcodCleanReleaseRunner -Module $module.Name -ErrorAction Stop
+        Assert-CcodTrue ($command.Parameters.ContainsKey('RepositoryRoot')) 'clean runner requires RepositoryRoot'
+        Assert-CcodTrue ($command.Parameters.ContainsKey('ExpectedVersion')) 'clean runner requires ExpectedVersion'
+        Assert-CcodTrue (-not $command.Parameters.ContainsKey('Adapters')) 'public clean runner exposes no adapter injection parameter'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+    }
+}
+
+Invoke-CcodTask6Test 'draft' 'draft release promoter is exported from the production tool' {
+    $path = Join-Path $repositoryRoot 'tools\Invoke-GitHubDraftRelease.ps1'
+    Assert-CcodTrue (Test-Path -LiteralPath $path -PathType Leaf) 'draft release promoter script exists'
+    $module = Import-CcodTask6ToolModule -Path $path -Name 'CcodGitHubDraftReleasePublic'
+    try {
+        $command = Get-Command Invoke-CcodGitHubDraftRelease -Module $module.Name -ErrorAction Stop
+        foreach ($name in @('Mode','Tag','AssetDirectory','EvidenceDirectory')) {
+            Assert-CcodTrue ($command.Parameters.ContainsKey($name)) "draft promoter requires $name"
+        }
+        Assert-CcodTrue (-not $command.Parameters.ContainsKey('Adapters')) 'public draft promoter exposes no adapter injection parameter'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+    }
+}
+
+Invoke-CcodTask6Test 'pin' 'CI and release workflows pin checkout to the reviewed commit SHA' {
+    $expected = 'actions/checkout@11d5960a326750d5838078e36cf38b85af677262'
+    foreach ($name in @('ci.yml','release.yml')) {
+        $raw = [IO.File]::ReadAllText((Join-Path $repositoryRoot ('.github\workflows\' + $name)), [Text.UTF8Encoding]::new($false))
+        Assert-CcodTrue ($raw.Contains($expected)) "$name pins actions/checkout to the reviewed SHA"
+        Assert-CcodTrue ($raw -cnotmatch 'actions/checkout@v') "$name does not use a floating checkout tag"
+    }
+}
+
+Invoke-CcodTask6Test 'glob' 'release workflow never uploads by dist glob or dotsources Defender library mode' {
+    $raw = [IO.File]::ReadAllText((Join-Path $repositoryRoot '.github\workflows\release.yml'), [Text.UTF8Encoding]::new($false))
+    Assert-CcodTrue ($raw -cnotmatch 'build/dist/\*') 'release workflow does not upload by dist glob'
+    Assert-CcodTrue ($raw -cnotmatch 'Test-ReleaseDefender\.ps1[^\r\n]*-Library') 'release workflow does not restore Defender library mode'
+    Assert-CcodTrue ($raw.Contains('ReleaseAssetContract.psm1')) 'release workflow imports the central asset contract'
+}
+
+Invoke-CcodTask6Test 'draft-create' 'release workflow never public-first creates a GitHub release' {
+    $raw = [IO.File]::ReadAllText((Join-Path $repositoryRoot '.github\workflows\release.yml'), [Text.UTF8Encoding]::new($false))
+    Assert-CcodTrue ($raw -cnotmatch '(?m)gh release create\b(?![^\r\n]*--draft)') 'gh release create is never invoked without --draft'
+}
+
+Invoke-CcodTask6Test 'workflow' 'CI and release workflows satisfy the draft-only pinned contract' {
+    Assert-CcodDraftReleaseWorkflowContract `
+        -CiPath (Join-Path $repositoryRoot '.github\workflows\ci.yml') `
+        -ReleasePath (Join-Path $repositoryRoot '.github\workflows\release.yml')
+}
+
+Invoke-CcodTask6Test 'workflow-bypass' 'draft workflow contract rejects unpinned actions continue-on-error if-bypass rebuild and missing concurrency' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-workflow-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $ciPath = Join-Path $root 'ci.yml'
+        $releasePath = Join-Path $root 'release.yml'
+        $pinnedCi = @'
+name: fixture CI
+jobs:
+  validate:
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+'@
+        $pinnedRelease = @'
+name: fixture release
+concurrency:
+  group: ccod-draft-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  preflight:
+    steps:
+      - name: Clean runner
+        shell: pwsh
+        run: Test-CcodCleanReleaseRunner -RepositoryRoot $PWD -ExpectedVersion 2.5.22
+  build:
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - name: Build
+        shell: pwsh
+        run: ./build/build.ps1 -Version 2.5.22
+      - name: Upload
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+  stage:
+    steps:
+      - name: Download
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+      - name: Stage draft
+        shell: pwsh
+        run: |
+          Import-Module ./tools/ReleaseAssetContract.psm1
+          Get-CcodExpectedReleaseAssetNames -Version 2.5.22
+          Invoke-CcodGitHubDraftRelease -Mode Stage -Tag v2.5.22 -AssetDirectory $PWD -EvidenceDirectory $PWD
+'@
+        [IO.File]::WriteAllText($ciPath, $pinnedCi, [Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($releasePath, $pinnedRelease, [Text.UTF8Encoding]::new($false))
+        Assert-CcodDraftReleaseWorkflowContract -CiPath $ciPath -ReleasePath $releasePath
+        $invalid = @(
+            [pscustomobject]@{ Name = 'unpinned setup-node'; Release = $pinnedRelease.Replace('actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020','actions/setup-node@v4') },
+            [pscustomobject]@{ Name = 'continue-on-error'; Release = $pinnedRelease.Replace('      - name: Clean runner','      - name: Clean runner' + [Environment]::NewLine + '        continue-on-error: true') },
+            [pscustomobject]@{ Name = 'if bypass'; Release = $pinnedRelease.Replace('      - name: Clean runner','      - name: Clean runner' + [Environment]::NewLine + '        if: ${{ false }}') },
+            [pscustomobject]@{ Name = 'missing concurrency'; Release = $pinnedRelease.Replace(('concurrency:' + [Environment]::NewLine + '  group: ccod-draft-${{ github.ref }}' + [Environment]::NewLine + '  cancel-in-progress: false' + [Environment]::NewLine), '') },
+            [pscustomobject]@{ Name = 'rebuild in stage'; Release = $pinnedRelease + [Environment]::NewLine + "        run: ./build/build.ps1 -Version 2.5.22`n" },
+            [pscustomobject]@{ Name = 'extension glob'; Release = $pinnedRelease.Replace('Get-CcodExpectedReleaseAssetNames -Version 2.5.22','Get-ChildItem -File | Where-Object { $_.Extension -in @(''.exe'') }') }
+        )
+        foreach ($fixture in $invalid) {
+            [IO.File]::WriteAllText($releasePath, [string]$fixture.Release, [Text.UTF8Encoding]::new($false))
+            Assert-CcodThrows { Assert-CcodDraftReleaseWorkflowContract -CiPath $ciPath -ReleasePath $releasePath } 'CCOD_RELEASE_WORKFLOW_INVALID'
+        }
+    } finally {
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+Invoke-CcodTask6Test 'runner-core' 'clean runner core accepts module-scope adapters and public surface does not' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools\Test-CleanReleaseRunner.ps1') -Name 'CcodCleanReleaseRunner'
+    try {
+        $public = Get-Command Test-CcodCleanReleaseRunner -Module $module.Name -ErrorAction Stop
+        Assert-CcodTrue (-not $public.Parameters.ContainsKey('Adapters')) 'public clean runner exposes no adapter injection parameter'
+        $core = &$module { Get-Command Test-CcodCleanReleaseRunnerCore -ErrorAction SilentlyContinue }
+        Assert-CcodTrue ($null -ne $core) 'clean runner core exists for tests'
+        Assert-CcodTrue ($core.Parameters.ContainsKey('Adapters')) 'clean runner core accepts adapters'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+    }
+}
+
+Invoke-CcodTask6Test 'runner-reject' 'clean runner fail-closes contaminated dirty missing-preflight and version mismatches without cleanup' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools\Test-CleanReleaseRunner.ps1') -Name 'CcodCleanReleaseRunner'
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-clean-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        foreach ($case in @(
+            [pscustomobject]@{ Id = 'installed'; Error = 'CCOD_CLEAN_RUNNER_CONTAMINATED'; Fixture = { New-CcodTask6CleanAdapterFixture -Installed } },
+            [pscustomobject]@{ Id = 'mutex'; Error = 'CCOD_CLEAN_RUNNER_CONTAMINATED'; Fixture = { New-CcodTask6CleanAdapterFixture -MutexOccupied } },
+            [pscustomobject]@{ Id = 'task'; Error = 'CCOD_CLEAN_RUNNER_CONTAMINATED'; Fixture = { New-CcodTask6CleanAdapterFixture -TaskPresent } },
+            [pscustomobject]@{ Id = 'supervisor'; Error = 'CCOD_CLEAN_RUNNER_CONTAMINATED'; Fixture = { New-CcodTask6CleanAdapterFixture -SupervisorPresent } },
+            [pscustomobject]@{ Id = 'trayhost'; Error = 'CCOD_CLEAN_RUNNER_CONTAMINATED'; Fixture = { New-CcodTask6CleanAdapterFixture -TrayHostPresent } },
+            [pscustomobject]@{ Id = 'dirty'; Error = 'CCOD_CLEAN_RUNNER_DIRTY'; Fixture = { New-CcodTask6CleanAdapterFixture -Porcelain ' M README.md' } },
+            [pscustomobject]@{ Id = 'version'; Error = 'CCOD_CLEAN_RUNNER_VERSION_INVALID'; Fixture = { New-CcodTask6CleanAdapterFixture -Version '2.5.21' } }
+        )) {
+            $fixture = & $case.Fixture
+            Assert-CcodThrows { Invoke-CcodTask6CleanCore -Module $module -RepositoryRoot $root -ExpectedVersion '2.5.22' -Adapters $fixture.Adapters | Out-Null } $case.Error
+            Assert-CcodEqual 0 $fixture.State.Cleanup.Count "clean runner does not cleanup after $($case.Id)"
+        }
+        $ok = New-CcodTask6CleanAdapterFixture
+        $result = Invoke-CcodTask6CleanCore -Module $module -RepositoryRoot $root -ExpectedVersion '2.5.22' -Adapters $ok.Adapters
+        Assert-CcodTrue ([bool]$result.Valid) 'clean runner accepts a clean checkout'
+        Assert-CcodEqual '2.5.22' ([string]$result.Version) 'clean runner returns the expected version'
+        Assert-CcodTrue ($ok.State.Calls -contains 'WritePreflightEvidence') 'clean runner writes preflight evidence'
+        Assert-CcodEqual 0 $ok.State.Cleanup.Count 'successful clean runner still performs no cleanup'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+Invoke-CcodTask6Test 'draft-core' 'draft promoter core accepts module-scope adapters and public surface does not' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools\Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftRelease'
+    try {
+        $public = Get-Command Invoke-CcodGitHubDraftRelease -Module $module.Name -ErrorAction Stop
+        Assert-CcodTrue (-not $public.Parameters.ContainsKey('Adapters')) 'public draft promoter exposes no adapter injection parameter'
+        $core = &$module { Get-Command Invoke-CcodGitHubDraftReleaseCore -ErrorAction SilentlyContinue }
+        Assert-CcodTrue ($null -ne $core) 'draft promoter core exists for tests'
+        Assert-CcodTrue ($core.Parameters.ContainsKey('Adapters')) 'draft promoter core accepts adapters'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-public-module-boundary' 'release workflow imports only the public draft command and does not dot-source injectable internals' {
+    $releasePath = Join-Path $repositoryRoot '.github/workflows/release.yml'
+    $workflow = [IO.File]::ReadAllText($releasePath, [Text.UTF8Encoding]::new($false))
+    foreach ($spec in @(
+        [pscustomobject]@{ Name = 'draft'; Script = 'Invoke-GitHubDraftRelease.psm1'; Public = 'Invoke-CcodGitHubDraftRelease'; Private = 'Invoke-CcodGitHubDraftReleaseCore' },
+        [pscustomobject]@{ Name = 'clean runner'; Script = 'Test-CleanReleaseRunner.psm1'; Public = 'Test-CcodCleanReleaseRunner'; Private = 'Test-CcodCleanReleaseRunnerCore' }
+    )) {
+        $scriptPath = Join-Path $repositoryRoot ('tools/' + $spec.Script)
+        Assert-CcodTrue (Test-Path -LiteralPath $scriptPath -PathType Leaf) "$($spec.Name) tool has a real module wrapper"
+        Assert-CcodTrue ($workflow -cmatch ('Import-Module.*' + [regex]::Escape($spec.Script))) "$($spec.Name) workflow import uses the module wrapper"
+        Assert-CcodTrue ($workflow -cnotmatch ('(?m)^\s*\.\s+\.?/?\.?[/\\]tools[/\\]' + [regex]::Escape($spec.Script))) "$($spec.Name) workflow does not dot-source the module wrapper"
+        $module = Import-Module $scriptPath -Force -PassThru -DisableNameChecking
+        try {
+            Assert-CcodTrue ($null -ne (Get-Command $spec.Public -Module $module.Name -ErrorAction SilentlyContinue)) "$($spec.Name) public command is exported"
+            Assert-CcodTrue ($null -eq (Get-Command $spec.Private -Module $module.Name -ErrorAction SilentlyContinue)) "$($spec.Name) private core is not exported"
+        } finally {
+            Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        }
+    }
+}
+
+Invoke-CcodTask6Test 'draft-stage' 'Stage fail-closes missing preflight extra assets upload failure concurrent stage and never promotes' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools\Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftRelease'
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-draft-' + [guid]::NewGuid().ToString('N'))
+    $assetFixture = $null
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $evidence = Join-Path $root 'evidence'
+        [IO.Directory]::CreateDirectory($evidence) | Out-Null
+        $emptyAssets = Join-Path $root 'assets'
+        [IO.Directory]::CreateDirectory($emptyAssets) | Out-Null
+        $fixture = New-CcodTask6DraftAdapterFixture -AssetDirectory $emptyAssets
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $emptyAssets -EvidenceDirectory $evidence -Adapters $fixture.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_PREFLIGHT_MISSING'
+        Assert-CcodTrue (-not $fixture.State.Promoted) 'missing preflight never promotes'
+        Assert-CcodTrue (-not $fixture.State.Rebuilt) 'missing preflight never rebuilds'
+        [IO.File]::WriteAllText((Join-Path $evidence 'CodexRemote-fix-2.5.22-clean-preflight.json'), '{"valid":true}', [Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText((Join-Path $emptyAssets 'unexpected.txt'), 'x', [Text.UTF8Encoding]::new($false))
+        $extra = New-CcodTask6DraftAdapterFixture -AssetDirectory $emptyAssets
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $emptyAssets -EvidenceDirectory $evidence -Adapters $extra.Adapters | Out-Null } 'CCOD_RELEASE_ASSET_SET_INVALID'
+        Assert-CcodTrue (-not $extra.State.Promoted) 'extra asset never promotes'
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $preflight = Join-Path $assetFixture.Outside 'CodexRemote-fix-2.5.22-clean-preflight.json'
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText($preflight, (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $upload = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root -UploadFails
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $assetFixture.Outside -Adapters $upload.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_UPLOAD_FAILED'
+        Assert-CcodTrue $upload.State.Created 'upload failure still created a draft'
+        Assert-CcodTrue $upload.State.DraftPrivate 'upload failure leaves the draft private'
+        Assert-CcodTrue (-not $upload.State.Promoted) 'upload failure never promotes'
+        $busy = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root -ConcurrentStage
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $assetFixture.Outside -Adapters $busy.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_CONCURRENT'
+        Assert-CcodTrue (-not $busy.State.Created) 'concurrent stage does not create a second draft'
+        Assert-CcodTrue (-not $busy.State.Promoted) 'concurrent stage never promotes'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+Invoke-CcodTask6Test 'draft-verify-promote' 'Verify and Promote cannot rebuild and Promote fail-closes missing dual receipt or acceptance' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools\Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftRelease'
+    $assetFixture = $null
+    $promotion = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $evidence = $assetFixture.Outside
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $evidence 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $verify = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $verify.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_NOT_STAGED'
+        Assert-CcodTrue (-not $verify.State.Rebuilt) 'Verify never rebuilds'
+        Assert-CcodTrue (-not $verify.State.Created) 'Verify never creates a release'
+        Assert-CcodTrue (-not $verify.State.Promoted) 'Verify never promotes'
+        $promote = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Promote -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $promote.Adapters | Out-Null } 'CCOD_RELEASE_PROMOTION_EVIDENCE_INVALID'
+        Assert-CcodTrue (-not $promote.State.Promoted) 'missing dual receipt never promotes'
+        Assert-CcodTrue (-not $promote.State.Rebuilt) 'Promote never rebuilds'
+        $promotion = New-CcodTask5PromotionFixture $assetFixture
+        $promoteEvidence = $promotion.Root
+        $defender = Join-Path $promoteEvidence 'defender'
+        [IO.Directory]::CreateDirectory($defender) | Out-Null
+        foreach ($name in @($promotion.Names)) { Move-Item -LiteralPath (Join-Path $promoteEvidence $name) -Destination (Join-Path $defender $name) }
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $promoteEvidence 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $missingAcceptance = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Promote -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promoteEvidence -Adapters $missingAcceptance.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_ACCEPTANCE_MISSING'
+        Assert-CcodTrue (-not $missingAcceptance.State.Promoted) 'missing acceptance never promotes'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $promotion -and (Test-Path -LiteralPath $promotion.Root)) { Remove-Item -LiteralPath $promotion.Root -Recurse -Force }
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-runner-inspection' 'clean runner converts inspection failures into stable fail-closed errors' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Test-CleanReleaseRunner.ps1') -Name 'CcodCleanReleaseRunnerFix1Inspection'
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-runner-inspection-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $fixture = New-CcodTask6CleanAdapterFixture
+        $fixture.Adapters.GetGitPorcelain = { param($Root) throw 'git inspection unavailable' }.GetNewClosure()
+        Assert-CcodThrows { Invoke-CcodTask6CleanCore -Module $module -RepositoryRoot $root -ExpectedVersion '2.5.22' -Adapters $fixture.Adapters | Out-Null } 'CCOD_CLEAN_RUNNER_INSPECTION_FAILED'
+        Assert-CcodEqual 0 $fixture.State.Cleanup.Count 'git inspection failure does not invoke cleanup'
+        $fixture = New-CcodTask6CleanAdapterFixture
+        $fixture.Adapters.GetProductState = { param($Root) throw 'product inspection denied' }.GetNewClosure()
+        Assert-CcodThrows { Invoke-CcodTask6CleanCore -Module $module -RepositoryRoot $root -ExpectedVersion '2.5.22' -Adapters $fixture.Adapters | Out-Null } 'CCOD_CLEAN_RUNNER_INSPECTION_FAILED'
+        Assert-CcodEqual 0 $fixture.State.Cleanup.Count 'product inspection failure does not invoke cleanup'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-preflight-binding' 'Stage rejects an unbound or malformed transferred clean preflight before creating a draft' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1Preflight'
+    $assetFixture = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $evidence = $assetFixture.Outside
+        $preflight = Join-Path $evidence 'CodexRemote-fix-2.5.22-clean-preflight.json'
+        $record = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.21'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText($preflight, (($record | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $fixture = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $fixture.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_PREFLIGHT_INVALID'
+        Assert-CcodTrue (-not $fixture.State.Created) 'invalid preflight does not create a draft'
+        Assert-CcodTrue (-not $fixture.State.Promoted) 'invalid preflight does not promote'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-preflight-all-modes' 'Verify and Promote require the transferred clean preflight before accepting or publishing evidence' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1PreflightAllModes'
+    $assetFixture = $null
+    $promotion = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $evidence = Join-Path $assetFixture.Outside 'verify-without-preflight'
+        [IO.Directory]::CreateDirectory($evidence) | Out-Null
+        $expected = [string[]]$assetFixture.Names
+        $verify = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        $verify.State.Uploaded.AddRange($expected)
+        Assert-CcodThrows {
+            Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $verify.Adapters | Out-Null
+        } 'CCOD_GITHUB_DRAFT_PREFLIGHT_MISSING'
+        Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $evidence 'verification') -PathType Container)) 'Verify without preflight writes no verification evidence'
+
+        $promotion = New-CcodTask5PromotionFixture $assetFixture
+        $defender = Join-Path $promotion.Root 'defender'
+        $verificationDirectory = Join-Path $promotion.Root 'verification'
+        $acceptanceDirectory = Join-Path $promotion.Root 'acceptance'
+        [IO.Directory]::CreateDirectory($defender) | Out-Null
+        foreach ($name in @($promotion.Names)) { Move-Item -LiteralPath (Join-Path $promotion.Root $name) -Destination (Join-Path $defender $name) }
+        $preflightPath = Join-Path $promotion.Root 'CodexRemote-fix-2.5.22-clean-preflight.json'
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText($preflightPath, (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $promote = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        $promote.State.Uploaded.AddRange($expected)
+        Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $promote.Adapters | Out-Null
+        Remove-Item -LiteralPath $preflightPath -Force
+        $acceptanceRecord = [ordered]@{ schemaVersion = 1; kind = 'official-draft-acceptance'; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; candidateManifestSha256 = Get-CcodTestFileSha256 (Join-Path $assetFixture.Root $assetFixture.Names[4]); phase = 'Complete'; completedAtUtc = '2030-02-03T04:05:07.0000000Z' }
+        [IO.Directory]::CreateDirectory($acceptanceDirectory) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $acceptanceDirectory 'CodexRemote-fix-2.5.22-official-draft.complete.json'), (($acceptanceRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows {
+            Invoke-CcodTask6DraftCore -Module $module -Mode Promote -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $promote.Adapters | Out-Null
+        } 'CCOD_GITHUB_DRAFT_PREFLIGHT_MISSING'
+        Assert-CcodTrue (-not $promote.State.Promoted) 'Promote without preflight never changes visibility'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $promotion -and (Test-Path -LiteralPath $promotion.Root)) { Remove-Item -LiteralPath $promotion.Root -Recurse -Force -ErrorAction SilentlyContinue }
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-remote-contract' 'Verify rejects null, public, and non-exact remote draft responses' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1Remote'
+    $assetFixture = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $evidence = $assetFixture.Outside
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $evidence 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $expected = @(Get-CcodTask5ExpectedAssetNames '2.5.22')
+        $nullView = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        $nullView.Adapters.ViewRelease = { param($Tag) $null }.GetNewClosure()
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $nullView.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_NOT_STAGED'
+        $publicView = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        $publicView.State.Uploaded.AddRange([string[]]$expected)
+        $publicView.State.DraftPrivate = $false
+        $publicView.Adapters.ViewRelease = { param($Tag) [pscustomobject]@{ Tag = $Tag; Draft = $false; AssetNames = @($expected) } }.GetNewClosure()
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $publicView.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_NOT_STAGED'
+        $wrongNames = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        $wrong = @($expected)
+        $wrong[0] = 'unexpected-release-asset.zip'
+        $wrongNames.State.Uploaded.AddRange([string[]]$wrong)
+        $wrongNames.Adapters.ViewRelease = { param($Tag) [pscustomobject]@{ Tag = $Tag; Draft = $true; AssetNames = @($wrong) } }.GetNewClosure()
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $wrongNames.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_ASSET_SET_INVALID'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-github-boundary' 'draft release operations are bound to the official Actions repository without an environment bypass' {
+    $draftPath = Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1'
+    $releasePath = Join-Path $repositoryRoot '.github/workflows/release.yml'
+    $draftRaw = [IO.File]::ReadAllText($draftPath, [Text.UTF8Encoding]::new($false))
+    $releaseRaw = [IO.File]::ReadAllText($releasePath, [Text.UTF8Encoding]::new($false))
+    Assert-CcodTrue (-not ($draftRaw + $releaseRaw).Contains('CCOD_ALLOW_GITHUB_RELEASE')) 'live GitHub operations have no caller-controlled override'
+    Assert-CcodTrue ($draftRaw.Contains('naipi11/CodexRemote-fix')) 'GitHub target repository is explicit'
+    Assert-CcodTrue ($draftRaw.Contains('GITHUB_SERVER_URL') -and $draftRaw.Contains('GITHUB_RUN_ID') -and $draftRaw.Contains('GH_TOKEN')) 'default GitHub adapter checks the Actions context'
+    Assert-CcodTrue ($draftRaw.Contains('$value.isDraft -isnot [bool]')) 'default GitHub adapter rejects non-boolean draft state'
+    Assert-CcodTrue ($draftRaw.Contains('$json -join [Environment]::NewLine')) 'default GitHub adapter parses the complete multi-line JSON response'
+    $ghLines = @($draftRaw -split "`r?`n" | Where-Object { $_ -match '& gh ' })
+    Assert-CcodTrue ($ghLines.Count -gt 0) 'default adapter has explicit GitHub operations'
+    foreach ($line in $ghLines) {
+        if ($line -match '& gh api') {
+            Assert-CcodTrue ($draftRaw.Contains('repos/naipi11/CodexRemote-fix/')) 'GitHub API operation pins the repository in its endpoint'
+        } elseif ($line -notmatch '& gh auth status') {
+            Assert-CcodTrue ($line.Contains('--repo')) 'every GitHub release operation pins the repository'
+        }
+        if ($line -notmatch '\$json\s*=\s*& gh ' -and $line -notmatch '& gh api ') { Assert-CcodTrue ($line.Contains('| Out-Null')) 'non-query GitHub operations do not leak CLI output into the state result' }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-local-promote-context' 'authenticated local draft readback does not require the GitHub Actions environment' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1LocalContext'
+    $fakeRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-local-gh-' + [guid]::NewGuid().ToString('N'))
+    $fakeGh = Join-Path $fakeRoot 'gh.cmd'
+    $saved = @{}
+    try {
+        [IO.Directory]::CreateDirectory($fakeRoot) | Out-Null
+        [IO.File]::WriteAllText($fakeGh, "@echo off`r`nif `"%1`"==`"release`" if `"%2`"==`"view`" (`r`n  echo {`"isDraft`":true,`"assets`":[]}`r`n)`r`nexit /b 0`r`n", [Text.UTF8Encoding]::new($false))
+        foreach ($name in @('GITHUB_ACTIONS','GITHUB_SERVER_URL','GITHUB_REPOSITORY','GITHUB_RUN_ID','GH_TOKEN','Path')) { $saved[$name] = [Environment]::GetEnvironmentVariable($name, 'Process') }
+        Remove-Item Env:GITHUB_ACTIONS,Env:GITHUB_SERVER_URL,Env:GITHUB_REPOSITORY,Env:GITHUB_RUN_ID -ErrorAction SilentlyContinue
+        $env:GH_TOKEN = 'x'
+        $env:Path = $fakeRoot + ';' + $saved.Path
+        $view = &$module { $adapters = Get-CcodGitHubDraftReleaseDefaultAdapters; & $adapters.ViewRelease 'v2.5.22' }
+        Assert-CcodTrue ($view.Draft -is [bool] -and $view.Draft) 'local authenticated draft readback is allowed without Actions context'
+    } finally {
+        foreach ($name in @('GITHUB_ACTIONS','GITHUB_SERVER_URL','GITHUB_REPOSITORY','GITHUB_RUN_ID','GH_TOKEN','Path')) {
+            if ($null -eq $saved[$name]) { Remove-Item ("Env:" + $name) -ErrorAction SilentlyContinue } else { Set-Item ("Env:" + $name) $saved[$name] }
+        }
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if (Test-Path -LiteralPath $fakeRoot) { Remove-Item -LiteralPath $fakeRoot -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-pwsh-schema-version' 'preflight schemaVersion accepts the Int64 representation emitted by PowerShell Core' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1PwshSchema'
+    $path = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-pwsh-schema-' + [guid]::NewGuid().ToString('N') + '.json')
+    try {
+        [IO.File]::WriteAllText($path, '{}', [Text.UTF8Encoding]::new($false))
+        $record = [pscustomobject][ordered]@{
+            schemaVersion = [int64]1
+            valid = $true
+            version = '2.5.22'
+            gitCommit = 'c' * 40
+            repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot)
+        }
+        &$module { param($Value) Set-Item Function:Read-CcodGitHubDraftContractJson -Value { param($JsonPath,$ErrorId) [pscustomobject]@{ Raw = '{}'; Value = $Value } }.GetNewClosure() } $record
+        $result = &$module { param($Path,$Version,$Commit) Read-CcodGitHubDraftPreflight -Path $Path -Version $Version -GitCommit $Commit } $path '2.5.22' ('c' * 40)
+        Assert-CcodEqual 1 ([long]$result.schemaVersion) 'PowerShell Core Int64 schemaVersion is accepted'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-preflight-root-canonical' 'preflight rejects drive-relative repository roots' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1PreflightRoot'
+    $path = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-preflight-root-' + [guid]::NewGuid().ToString('N') + '.json')
+    try {
+        [IO.File]::WriteAllText($path, '{}', [Text.UTF8Encoding]::new($false))
+        $record = [pscustomobject][ordered]@{
+            schemaVersion = 1
+            valid = $true
+            version = '2.5.22'
+            gitCommit = 'c' * 40
+            repositoryRoot = 'C:relative-root'
+        }
+        &$module { param($Value) Set-Item Function:Read-CcodGitHubDraftContractJson -Value { param($JsonPath,$ErrorId) [pscustomobject]@{ Raw = '{}'; Value = $Value } }.GetNewClosure() } $record
+        Assert-CcodThrows {
+            &$module { param($Path,$Version,$Commit) Read-CcodGitHubDraftPreflight -Path $Path -Version $Version -GitCommit $Commit } $path '2.5.22' ('c' * 40)
+        } 'CCOD_GITHUB_DRAFT_PREFLIGHT_INVALID'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-install-root-probe' 'clean runner treats a file at the install root as product state and distinguishes absence' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Test-CleanReleaseRunner.ps1') -Name 'CcodCleanReleaseRunnerFix1InstallRoot'
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-install-root-' + [guid]::NewGuid().ToString('N'))
+    $file = Join-Path $root 'malformed-install-root'
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        [IO.File]::WriteAllText($file, 'not-a-directory', [Text.UTF8Encoding]::new($false))
+        $present = &$module { param($Path) Get-CcodCleanReleaseRunnerInstallRootPresent -InstallRoot $Path } $file
+        $missing = &$module { param($Path) Get-CcodCleanReleaseRunnerInstallRootPresent -InstallRoot $Path } (Join-Path $root 'missing')
+        Assert-CcodTrue ([bool]$present) 'existing file at install root is treated as present'
+        Assert-CcodEqual $false ([bool]$missing) 'missing install root is treated as absent'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-ignored-clean-runner' 'clean runner includes ignored files in the contamination check' {
+    $raw = [IO.File]::ReadAllText((Join-Path $repositoryRoot 'tools/Test-CleanReleaseRunner.ps1'), [Text.UTF8Encoding]::new($false))
+    Assert-CcodTrue ($raw.Contains('--ignored=matching')) 'clean runner asks git status to report ignored contamination'
+}
+
+Invoke-CcodTask6Test 'fix1-mode-normalization' 'case-insensitive mode binding dispatches lowercase verify to Verify rather than Stage' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1Mode'
+    $assetFixture = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $evidence = $assetFixture.Outside
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $evidence 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        foreach ($name in @($assetFixture.Names)) { $draft.State.Uploaded.Add($name) }
+        $result = Invoke-CcodTask6DraftCore -Module $module -Mode 'verify' -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $draft.Adapters
+        Assert-CcodEqual 'Verify' ([string]$result.Mode) 'lowercase verify dispatches to the Verify mode'
+        Assert-CcodEqual 0 (@($draft.State.Calls | Where-Object { $_ -eq 'CreateDraft' }).Count) 'lowercase verify does not create a release'
+        Assert-CcodEqual 0 (@($draft.State.Calls | Where-Object { [string]$_ -like 'UploadAsset:*' }).Count) 'lowercase verify does not upload assets'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-tag-commit-binding' 'release operations bind the remote tag to the immutable candidate commit' {
+    $draft = [IO.File]::ReadAllText((Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1'), [Text.UTF8Encoding]::new($false))
+    Assert-CcodTrue ($draft.Contains('GetTagCommit')) 'draft tool resolves the remote tag commit'
+    Assert-CcodTrue ($draft.Contains('repos/naipi11/CodexRemote-fix/commits/')) 'tag resolution is bound to the official repository'
+    Assert-CcodTrue ($draft.Contains("'--verify-tag'")) 'draft creation verifies the existing remote tag'
+}
+
+Invoke-CcodTask6Test 'fix1-create-private-readback' 'Stage confirms the newly created release is still private before uploading the first asset' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1CreatePrivate'
+    $assetFixture = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $evidence = $assetFixture.Outside
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $evidence 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $draft.Adapters | Out-Null
+        $firstUpload = @($draft.State.Calls | Where-Object { [string]$_ -like 'UploadAsset:*' })[0]
+        $firstUploadIndex = [array]::IndexOf([string[]]$draft.State.Calls, [string]$firstUpload)
+        $firstViewIndex = [array]::IndexOf([string[]]$draft.State.Calls, 'ViewRelease')
+        Assert-CcodTrue ($firstViewIndex -ge 0 -and $firstViewIndex -lt $firstUploadIndex) 'private release state is read before the first asset upload'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-post-promote-readback' 'Promote re-downloads and re-hashes public assets after changing draft visibility' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1PostPromote'
+    $assetFixture = $null
+    $promotion = $null
+    $remoteRoot = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $promotion = New-CcodTask5PromotionFixture $assetFixture
+        $defender = Join-Path $promotion.Root 'defender'
+        $acceptanceDirectory = Join-Path $promotion.Root 'acceptance'
+        [IO.Directory]::CreateDirectory($defender) | Out-Null
+        foreach ($name in @($promotion.Names)) { Move-Item -LiteralPath (Join-Path $promotion.Root $name) -Destination (Join-Path $defender $name) }
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $promotion.Root 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $expected = [string[]]$assetFixture.Names
+        $remoteRoot = Join-Path $assetFixture.Outside 'remote-assets'
+        [IO.Directory]::CreateDirectory($remoteRoot) | Out-Null
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        $state = $draft.State
+        $draft.Adapters.UploadAsset = {
+            param($Tag, $Name, $Path)
+            [IO.File]::Copy($Path, (Join-Path $remoteRoot $Name), $true)
+            $state.Uploaded.Add($Name)
+        }.GetNewClosure()
+        $draft.Adapters.DownloadAsset = {
+            param($Tag, $Name, $Destination)
+            [IO.File]::Copy((Join-Path $remoteRoot $Name), $Destination, $true)
+        }.GetNewClosure()
+        Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        $acceptanceRecord = [ordered]@{ schemaVersion = 1; kind = 'official-draft-acceptance'; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; candidateManifestSha256 = Get-CcodTestFileSha256 (Join-Path $assetFixture.Root $assetFixture.Names[4]); phase = 'Complete'; completedAtUtc = '2030-02-03T04:05:07.0000000Z' }
+        [IO.Directory]::CreateDirectory($acceptanceDirectory) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $acceptanceDirectory 'CodexRemote-fix-2.5.22-official-draft.complete.json'), (($acceptanceRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $draft.Adapters.SetReleaseDraftState = {
+            param($Tag, [bool]$Draft)
+            $state.DraftPrivate = $Draft
+            $state.Promoted = -not $Draft
+            if (-not $Draft) { [IO.File]::WriteAllText((Join-Path $remoteRoot $expected[0]), 'post-promotion-mutated', [Text.UTF8Encoding]::new($false)) }
+        }.GetNewClosure()
+        Assert-CcodThrows {
+            Invoke-CcodTask6DraftCore -Module $module -Mode Promote -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        } 'CCOD_GITHUB_DRAFT_PROMOTE_READBACK_FAILED'
+        Assert-CcodTrue $state.Promoted 'post-promotion byte mismatch is detected after visibility changed'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $promotion -and (Test-Path -LiteralPath $promotion.Root)) { Remove-Item -LiteralPath $promotion.Root -Recurse -Force -ErrorAction SilentlyContinue }
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-stage-lock' 'default Stage lock serializes same-tag processes and releases after the operation' {
+    $scriptPath = Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1'
+    $ready = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-lock-ready-' + [guid]::NewGuid().ToString('N'))
+    $release = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-lock-release-' + [guid]::NewGuid().ToString('N'))
+    $job = $null
+    $secondModule = $null
+    try {
+        $job = Start-Job -ArgumentList $scriptPath, $ready, $release -ScriptBlock {
+            param($Path, $ReadyPath, $ReleasePath)
+            $text = [IO.File]::ReadAllText($Path, [Text.UTF8Encoding]::new($false))
+            $module = New-Module -Name ('CcodLockHolder-' + [guid]::NewGuid().ToString('N')) -ScriptBlock ([scriptblock]::Create($text))
+            Import-Module $module -Force -DisableNameChecking | Out-Null
+            $held = [bool](&$module { $adapters = Get-CcodGitHubDraftReleaseDefaultAdapters; & $adapters.AcquireStageLock 'v2.5.22' })
+            if (-not $held) { throw 'CCOD_TEST_LOCK_HOLDER_FAILED' }
+            [IO.File]::WriteAllText($ReadyPath, 'held', [Text.UTF8Encoding]::new($false))
+            while (-not [IO.File]::Exists($ReleasePath)) { Start-Sleep -Milliseconds 25 }
+            &$module { $adapters = Get-CcodGitHubDraftReleaseDefaultAdapters; & $adapters.ReleaseStageLock 'v2.5.22' }
+            Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        }
+        $deadline = [DateTime]::UtcNow.AddSeconds(20)
+        while (-not [IO.File]::Exists($ready) -and [DateTime]::UtcNow -lt $deadline) { Start-Sleep -Milliseconds 50 }
+        Assert-CcodTrue ([IO.File]::Exists($ready)) 'separate lock-holder process acquired the same-tag lock'
+        $secondModule = Import-CcodTask6ToolModule -Path $scriptPath -Name 'CcodGitHubDraftReleaseFix1LockSecond'
+        $second = [bool](&$secondModule { $adapters = Get-CcodGitHubDraftReleaseDefaultAdapters; & $adapters.AcquireStageLock 'v2.5.22' })
+        Assert-CcodTrue (-not $second) 'second same-tag process is rejected by the default lock'
+        [IO.File]::WriteAllText($release, 'release', [Text.UTF8Encoding]::new($false))
+        $completed = Wait-Job -Job $job -Timeout 20
+        Assert-CcodTrue ($null -ne $completed) 'lock-holder process releases before timeout'
+        Receive-Job -Job $job -ErrorAction Stop | Out-Null
+        $afterModule = Import-CcodTask6ToolModule -Path $scriptPath -Name 'CcodGitHubDraftReleaseFix1LockAfter'
+        try {
+            $after = [bool](&$afterModule { $adapters = Get-CcodGitHubDraftReleaseDefaultAdapters; & $adapters.AcquireStageLock 'v2.5.22' })
+            Assert-CcodTrue $after 'same-tag lock can be reacquired after the holder releases'
+            &$afterModule { $adapters = Get-CcodGitHubDraftReleaseDefaultAdapters; & $adapters.ReleaseStageLock 'v2.5.22' }
+        } finally {
+            Remove-Module -Name $afterModule.Name -Force -ErrorAction SilentlyContinue
+        }
+    } finally {
+        if ($null -ne $secondModule) { Remove-Module -Name $secondModule.Name -Force -ErrorAction SilentlyContinue }
+        if ($null -ne $job) { Stop-Job -Job $job -ErrorAction SilentlyContinue | Out-Null; Remove-Job -Job $job -Force -ErrorAction SilentlyContinue }
+        if (Test-Path -LiteralPath $ready) { Remove-Item -LiteralPath $ready -Force -ErrorAction SilentlyContinue }
+        if (Test-Path -LiteralPath $release) { Remove-Item -LiteralPath $release -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-evidence-layout' 'Promote accepts separate Defender receipts, verification, and acceptance evidence and reads the final draft state back' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1Evidence'
+    $assetFixture = $null
+    $promotion = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $promotion = New-CcodTask5PromotionFixture $assetFixture
+        $defender = Join-Path $promotion.Root 'defender'
+        $verification = Join-Path $promotion.Root 'verification'
+        $acceptance = Join-Path $promotion.Root 'acceptance'
+        [IO.Directory]::CreateDirectory($defender) | Out-Null
+        [IO.Directory]::CreateDirectory($verification) | Out-Null
+        [IO.Directory]::CreateDirectory($acceptance) | Out-Null
+        foreach ($name in @($promotion.Names)) {
+            Move-Item -LiteralPath (Join-Path $promotion.Root $name) -Destination (Join-Path $defender $name)
+        }
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $promotion.Root 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        $acceptanceRecord = [ordered]@{ schemaVersion = 1; kind = 'official-draft-acceptance'; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; candidateManifestSha256 = Get-CcodTestFileSha256 (Join-Path $assetFixture.Root $assetFixture.Names[4]); phase = 'Complete'; completedAtUtc = '2030-02-03T04:05:07.0000000Z' }
+        [IO.File]::WriteAllText((Join-Path $acceptance 'CodexRemote-fix-2.5.22-official-draft.complete.json'), (($acceptanceRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $result = Invoke-CcodTask6DraftCore -Module $module -Mode Promote -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters
+        Assert-CcodTrue ([bool]$result.Promoted) 'promotion succeeds with separated evidence planes'
+        Assert-CcodTrue (-not $draft.State.DraftPrivate) 'promotion changes the already verified draft to public'
+        Assert-CcodTrue (-not $draft.State.Rebuilt) 'promotion never rebuilds the candidate'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $promotion -and (Test-Path -LiteralPath $promotion.Root)) { Remove-Item -LiteralPath $promotion.Root -Recurse -Force -ErrorAction SilentlyContinue }
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-workflow-transfer' 'release workflow transfers one immutable commit and the clean preflight as artifacts without rerunning the runner in Stage' {
+    $workflowPath = Join-Path $repositoryRoot '.github/workflows/release.yml'
+    $raw = [IO.File]::ReadAllText($workflowPath, [Text.UTF8Encoding]::new($false))
+    Assert-CcodTrue ($raw.Contains('commit:')) 'preflight publishes an immutable commit output'
+    Assert-CcodTrue ($raw.Contains('ref: ${{ needs.preflight.outputs.commit }}')) 'build and stage use the immutable preflight commit'
+    Assert-CcodTrue ($raw.Contains('-NotesPath $notesPath')) 'generated release notes are passed to draft creation'
+    Assert-CcodTrue ([regex]::Matches($raw, 'actions/upload-artifact@').Count -ge 2) 'preflight and candidate are transferred as separate artifacts'
+    Assert-CcodTrue ([regex]::Matches($raw, 'actions/download-artifact@').Count -ge 2) 'stage downloads both immutable artifacts'
+    Assert-CcodEqual 1 ([regex]::Matches($raw, 'Test-CcodCleanReleaseRunner').Count) 'Stage does not rerun clean runner as a substitute for transferred evidence'
+}
+
+Invoke-CcodTask6Test 'fix1-runner-defaults' 'default clean runner adapters fail closed on git failure and preflight evidence is create-only with readback' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Test-CleanReleaseRunner.ps1') -Name 'CcodCleanReleaseRunnerFix1Defaults'
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-runner-defaults-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $adapters = &$module { Get-CcodCleanReleaseRunnerDefaultAdapters }
+        Assert-CcodThrows { & $adapters.GetGitPorcelain $root | Out-Null } 'CCOD_CLEAN_RUNNER_INSPECTION_FAILED'
+        $evidence = Join-Path $root 'preflight.json'
+        $record = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = ('c' * 40); repositoryRoot = $root }
+        & $adapters.WritePreflightEvidence $evidence $record | Out-Null
+        Assert-CcodTrue (Test-Path -LiteralPath $evidence -PathType Leaf) 'default preflight writer creates its evidence file'
+        Assert-CcodThrows { & $adapters.WritePreflightEvidence $evidence $record | Out-Null } 'CCOD_CLEAN_RUNNER_PREFLIGHT_WRITE_FAILED'
+        $written = [IO.File]::ReadAllText($evidence, [Text.UTF8Encoding]::new($false)) | ConvertFrom-Json
+        Assert-CcodEqual $record.gitCommit ([string]$written.gitCommit) 'preflight writer readback retains the exact commit'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-evidence-types' 'persisted Verify and acceptance records reject scalar fields encoded as single-element arrays' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1EvidenceTypes'
+    $assetFixture = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $evidence = Join-Path $assetFixture.Outside 'typed-evidence'
+        $acceptanceDirectory = Join-Path $evidence 'acceptance'
+        $verificationDirectory = Join-Path $evidence 'verification'
+        [IO.Directory]::CreateDirectory($acceptanceDirectory) | Out-Null
+        [IO.Directory]::CreateDirectory($verificationDirectory) | Out-Null
+        $manifestHash = Get-CcodTestFileSha256 (Join-Path $assetFixture.Root $assetFixture.Names[4])
+        $acceptanceRecord = [ordered]@{
+            schemaVersion = 1
+            kind = 'official-draft-acceptance'
+            version = @('2.5.22')
+            gitCommit = [string]$assetFixture.GitCommit
+            candidateManifestSha256 = $manifestHash
+            phase = 'Complete'
+            completedAtUtc = '2030-02-03T04:05:07.0000000Z'
+        }
+        [IO.File]::WriteAllText((Join-Path $acceptanceDirectory 'CodexRemote-fix-2.5.22-official-draft.complete.json'), (($acceptanceRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows {
+            &$module { param($Evidence,$Assets,$Version,$Commit) Read-CcodGitHubDraftAcceptance -EvidenceDirectory $Evidence -AssetDirectory $Assets -Version $Version -GitCommit $Commit } $evidence $assetFixture.Root '2.5.22' $assetFixture.GitCommit | Out-Null
+        } 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID'
+        $names = [string[]]$assetFixture.Names
+        $hashes = [Collections.Generic.List[string]]::new()
+        foreach ($name in $names) { $hashes.Add((Get-CcodTestFileSha256 (Join-Path $assetFixture.Root $name))) }
+        $verificationRecord = [ordered]@{
+            schemaVersion = 1
+            kind = 'github-draft-verification'
+            tag = @('v2.5.22')
+            version = '2.5.22'
+            gitCommit = [string]$assetFixture.GitCommit
+            draft = $true
+            verified = $true
+            assetNames = $names
+            assetSha256 = [string[]]$hashes
+            candidateManifestSha256 = $manifestHash
+        }
+        [IO.File]::WriteAllText((Join-Path $verificationDirectory 'CodexRemote-fix-2.5.22-draft-verified.json'), (($verificationRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows {
+            &$module { param($Evidence,$Assets,$Tag,$Version,$Commit) Read-CcodGitHubDraftVerification -EvidenceDirectory $Evidence -AssetDirectory $Assets -Tag $Tag -Version $Version -GitCommit $Commit } $evidence $assetFixture.Root 'v2.5.22' '2.5.22' $assetFixture.GitCommit | Out-Null
+        } 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID'
+        $verificationRecord.tag = 'v2.5.22'
+        $malformedNames = New-Object object[] $names.Count
+        $nestedName = New-Object object[] 1
+        $nestedName[0] = $names[0]
+        $malformedNames[0] = $nestedName
+        for ($index = 1; $index -lt $names.Count; $index++) { $malformedNames[$index] = $names[$index] }
+        $malformedRecord = [pscustomobject][ordered]@{
+            schemaVersion = 1
+            kind = 'github-draft-verification'
+            tag = 'v2.5.22'
+            version = '2.5.22'
+            gitCommit = [string]$assetFixture.GitCommit
+            draft = $true
+            verified = $true
+            assetNames = $malformedNames
+            assetSha256 = [string[]]$hashes
+            candidateManifestSha256 = $manifestHash
+        }
+        &$module { param($Value) Set-Item Function:Read-CcodGitHubDraftContractJson -Value { param($JsonPath,$ErrorId) [pscustomobject]@{ Raw = '{}'; Value = $Value } }.GetNewClosure() } $malformedRecord
+        Assert-CcodThrows {
+            &$module { param($Evidence,$Assets,$Tag,$Version,$Commit) Read-CcodGitHubDraftVerification -EvidenceDirectory $Evidence -AssetDirectory $Assets -Tag $Tag -Version $Version -GitCommit $Commit } $evidence $assetFixture.Root 'v2.5.22' '2.5.22' $assetFixture.GitCommit | Out-Null
+        } 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-freeze-assets' 'Stage uploads the exact candidate bytes even when a source asset changes after validation' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1FreezeAssets'
+    $assetFixture = $null
+    $uploadedRoot = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $evidence = Join-Path $assetFixture.Outside 'freeze-assets'
+        [IO.Directory]::CreateDirectory($evidence) | Out-Null
+        $expected = [string[]]$assetFixture.Names
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $evidence 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $originalHash = Get-CcodTestFileSha256 (Join-Path $assetFixture.Root $expected[0])
+        $uploadedRoot = Join-Path $assetFixture.Outside 'uploaded'
+        [IO.Directory]::CreateDirectory($uploadedRoot) | Out-Null
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        $state = $draft.State
+        $sourceRoot = $assetFixture.Root
+        $hashFile = {
+            param($Path)
+            $sha = [Security.Cryptography.SHA256]::Create()
+            try {
+                $stream = [IO.File]::OpenRead($Path)
+                try { return [BitConverter]::ToString($sha.ComputeHash($stream)).Replace('-', '').ToLowerInvariant() } finally { $stream.Dispose() }
+            } finally { $sha.Dispose() }
+        }.GetNewClosure()
+        $draft.Adapters.CreateDraft = {
+            param($Tag, $Title, $Notes)
+            [IO.File]::WriteAllText((Join-Path $sourceRoot $expected[0]), 'mutated-after-exact-set', [Text.UTF8Encoding]::new($false))
+            $state.Created = $true
+            $state.DraftPrivate = $true
+            [pscustomobject]@{ Tag = $Tag; Draft = $true }
+        }.GetNewClosure()
+        $draft.Adapters.UploadAsset = {
+            param($Tag, $Name, $Path)
+            $destination = Join-Path $uploadedRoot $Name
+            [IO.File]::Copy($Path, $destination, $true)
+            $state.Uploaded.Add($Name)
+            $state.Assets[$Name] = & $hashFile $destination
+        }.GetNewClosure()
+        $draft.Adapters.DownloadAsset = {
+            param($Tag, $Name, $Destination)
+            [IO.File]::Copy((Join-Path $uploadedRoot $Name), $Destination, $true)
+        }.GetNewClosure()
+        Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $draft.Adapters | Out-Null
+        Assert-CcodEqual $originalHash ([string]$state.Assets[$expected[0]]) 'Stage uploads the pre-validation bytes rather than the raced source bytes'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-promote-lock' 'Promote refuses an occupied same-tag lock before changing draft visibility' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1PromoteLock'
+    $assetFixture = $null
+    $promotion = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $promotion = New-CcodTask5PromotionFixture $assetFixture
+        $defender = Join-Path $promotion.Root 'defender'
+        $acceptanceDirectory = Join-Path $promotion.Root 'acceptance'
+        [IO.Directory]::CreateDirectory($defender) | Out-Null
+        foreach ($name in @($promotion.Names)) { Move-Item -LiteralPath (Join-Path $promotion.Root $name) -Destination (Join-Path $defender $name) }
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $promotion.Root 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $expected = [string[]]$assetFixture.Names
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        $draft.State.Uploaded.AddRange($expected)
+        Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        $acceptanceRecord = [ordered]@{ schemaVersion = 1; kind = 'official-draft-acceptance'; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; candidateManifestSha256 = Get-CcodTestFileSha256 (Join-Path $assetFixture.Root $assetFixture.Names[4]); phase = 'Complete'; completedAtUtc = '2030-02-03T04:05:07.0000000Z' }
+        [IO.Directory]::CreateDirectory($acceptanceDirectory) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $acceptanceDirectory 'CodexRemote-fix-2.5.22-official-draft.complete.json'), (($acceptanceRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $draft.Adapters.TryStageLock = { param($Tag) $false }.GetNewClosure()
+        Assert-CcodThrows {
+            Invoke-CcodTask6DraftCore -Module $module -Mode Promote -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        } 'CCOD_GITHUB_DRAFT_CONCURRENT'
+        Assert-CcodTrue (-not $draft.State.Promoted) 'occupied Promote lock never changes visibility'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $promotion -and (Test-Path -LiteralPath $promotion.Root)) { Remove-Item -LiteralPath $promotion.Root -Recurse -Force -ErrorAction SilentlyContinue }
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-evidence-paths' 'verification and acceptance evidence reject junction ancestry outside the evidence root' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1EvidencePaths'
+    $assetFixture = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $evidence = Join-Path $assetFixture.Outside 'evidence-paths'
+        $verificationOutside = Join-Path $assetFixture.Outside 'verification-outside'
+        $acceptanceOutside = Join-Path $assetFixture.Outside 'acceptance-outside'
+        [IO.Directory]::CreateDirectory($evidence) | Out-Null
+        [IO.Directory]::CreateDirectory($verificationOutside) | Out-Null
+        [IO.Directory]::CreateDirectory($acceptanceOutside) | Out-Null
+        $verificationLink = Join-Path $evidence 'verification'
+        $acceptanceLink = Join-Path $evidence 'acceptance'
+        $previous = $ErrorActionPreference
+        try {
+            $ErrorActionPreference = 'Continue'
+            & cmd.exe /d /c mklink /J $verificationLink $verificationOutside 2>&1 | Out-Null
+            $verificationCode = $LASTEXITCODE
+            & cmd.exe /d /c mklink /J $acceptanceLink $acceptanceOutside 2>&1 | Out-Null
+            $acceptanceCode = $LASTEXITCODE
+        } finally { $ErrorActionPreference = $previous }
+        if ($verificationCode -ne 0 -or $acceptanceCode -ne 0) { throw 'evidence path junction fixture failed' }
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $evidence 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $expected = [string[]]$assetFixture.Names
+        $verify = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        $verify.State.Uploaded.AddRange($expected)
+        Assert-CcodThrows {
+            Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $verify.Adapters | Out-Null
+        } 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID'
+        Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $verificationOutside 'CodexRemote-fix-2.5.22-draft-verified.json') -PathType Leaf)) 'Verify does not write through an external verification junction'
+        $acceptanceRecord = [ordered]@{ schemaVersion = 1; kind = 'official-draft-acceptance'; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; candidateManifestSha256 = Get-CcodTestFileSha256 (Join-Path $assetFixture.Root $assetFixture.Names[4]); phase = 'Complete'; completedAtUtc = '2030-02-03T04:05:07.0000000Z' }
+        [IO.File]::WriteAllText((Join-Path $acceptanceOutside 'CodexRemote-fix-2.5.22-official-draft.complete.json'), (($acceptanceRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows {
+            &$module { param($Evidence,$Assets,$Version,$Commit) Read-CcodGitHubDraftAcceptance -EvidenceDirectory $Evidence -AssetDirectory $Assets -Version $Version -GitCommit $Commit } $evidence $assetFixture.Root '2.5.22' $assetFixture.GitCommit | Out-Null
+        } 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-concurrency-canonical' 'workflow dispatch rejects whitespace tag variants instead of normalizing them after concurrency grouping' {
+    $releasePath = Join-Path $repositoryRoot '.github/workflows/release.yml'
+    $raw = [IO.File]::ReadAllText($releasePath, [Text.UTF8Encoding]::new($false))
+    Assert-CcodTrue ($raw -cnotmatch '\$tag\s*=\s*\$tag\.Trim\(\)') 'dispatch tag is validated without post-group normalization'
+}
+
+Invoke-CcodTask6Test 'fix1-absolute-tag-anchor' 'release tag and version validators reject trailing newline variants' {
+    $release = [IO.File]::ReadAllText((Join-Path $repositoryRoot '.github/workflows/release.yml'), [Text.UTF8Encoding]::new($false))
+    $draft = [IO.File]::ReadAllText((Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1'), [Text.UTF8Encoding]::new($false))
+    $clean = [IO.File]::ReadAllText((Join-Path $repositoryRoot 'tools/Test-CleanReleaseRunner.ps1'), [Text.UTF8Encoding]::new($false))
+    Assert-CcodTrue ($release.Contains('^v\d+\.\d+\.\d+\z')) 'release workflow uses an absolute tag end anchor'
+    Assert-CcodTrue ($draft.Contains('^v\d+\.\d+\.\d+\z')) 'draft command uses an absolute tag end anchor'
+    Assert-CcodTrue ($clean.Contains('^\d+\.\d+\.\d+\z')) 'clean runner uses an absolute version end anchor'
+}
+
 Write-Host 'Release workflow self-tests passed.'
diff --git a/tools/Invoke-GitHubDraftRelease.ps1 b/tools/Invoke-GitHubDraftRelease.ps1
new file mode 100644
index 0000000..8663145
--- /dev/null
+++ b/tools/Invoke-GitHubDraftRelease.ps1
@@ -0,0 +1,766 @@
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+$script:CcodDraftReleaseAssetContractModule = $null
+
+function Throw-CcodGitHubDraftError {
+    param([Parameter(Mandatory)][string]$Id,[Parameter(Mandatory)][string]$Message,$Target)
+    throw [Management.Automation.ErrorRecord]::new(
+        [InvalidOperationException]::new($Message),
+        $Id,
+        [Management.Automation.ErrorCategory]::InvalidData,
+        $Target)
+}
+
+function Test-CcodGitHubDraftSchemaVersion($Value) {
+    return ($Value -is [int] -or $Value -is [long]) -and [long]$Value -eq 1
+}
+
+function Test-CcodGitHubDraftCanonicalAbsolutePath($Path) {
+    if ([string]::IsNullOrWhiteSpace([string]$Path)) { return $false }
+    try {
+        if (-not [IO.Path]::IsPathRooted([string]$Path)) { return $false }
+        $full = [IO.Path]::GetFullPath([string]$Path)
+        return [string]::Equals($full, [string]$Path, [StringComparison]::OrdinalIgnoreCase)
+    } catch {
+        return $false
+    }
+}
+
+function Import-CcodDraftReleaseAssetContract {
+    $candidates = [Collections.Generic.List[string]]::new()
+    if (-not [string]::IsNullOrWhiteSpace($PSScriptRoot)) { $candidates.Add((Join-Path $PSScriptRoot 'ReleaseAssetContract.psm1')) }
+    $candidates.Add((Join-Path (Get-Location) 'tools\ReleaseAssetContract.psm1'))
+    foreach ($path in $candidates) {
+        if ([IO.File]::Exists($path)) {
+            $script:CcodDraftReleaseAssetContractModule = Import-Module $path -Force -DisableNameChecking -PassThru
+            return
+        }
+    }
+    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CONTRACT_MISSING' 'Release asset contract module is missing.' $null
+}
+
+function Read-CcodGitHubDraftContractJson {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$ErrorId)
+    if ($null -eq $script:CcodDraftReleaseAssetContractModule) { Import-CcodDraftReleaseAssetContract }
+    try {
+        return & $script:CcodDraftReleaseAssetContractModule { param($JsonPath,$ContractErrorId) Read-CcodReleaseContractJson -Path $JsonPath -ErrorId $ContractErrorId } $Path $ErrorId
+    } catch {
+        Throw-CcodGitHubDraftError $ErrorId 'Draft evidence JSON is malformed or outside its contract.' $Path
+    }
+}
+
+function Read-CcodGitHubDraftPreflight {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$Version,[Parameter(Mandatory)][string]$GitCommit)
+    if (-not [IO.File]::Exists($Path)) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PREFLIGHT_MISSING' 'Stage requires transferred clean-runner preflight evidence.' $Path
+    }
+    $Path = Assert-CcodGitHubDraftPlainPath -Path $Path -Directory $false
+    $parsed = Read-CcodGitHubDraftContractJson -Path $Path -ErrorId 'CCOD_GITHUB_DRAFT_PREFLIGHT_INVALID'
+    $record = $parsed.Value
+    $fields = @($record.PSObject.Properties.Name)
+    if (($fields -join ',') -cne 'schemaVersion,valid,version,gitCommit,repositoryRoot' -or
+        -not (Test-CcodGitHubDraftSchemaVersion $record.schemaVersion) -or
+        $record.valid -isnot [bool] -or -not [bool]$record.valid -or
+        $record.version -isnot [string] -or $record.version -cne $Version -or
+        $record.gitCommit -isnot [string] -or $record.gitCommit -cne $GitCommit -or
+        $record.gitCommit -cnotmatch '^[0-9a-f]{40}$' -or
+        $record.repositoryRoot -isnot [string] -or [string]::IsNullOrWhiteSpace($record.repositoryRoot) -or
+        -not (Test-CcodGitHubDraftCanonicalAbsolutePath $record.repositoryRoot)) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PREFLIGHT_INVALID' 'Transferred clean-runner preflight is not bound to this candidate.' $Path
+    }
+    return $record
+}
+
+function Assert-CcodGitHubDraftRemoteView {
+    param([Parameter(Mandatory)][string]$Tag,[Parameter(Mandatory)][string]$Version,$View,[switch]$AfterPromotion)
+    $notStagedId = if ($AfterPromotion) { 'CCOD_GITHUB_DRAFT_PROMOTE_READBACK_FAILED' } else { 'CCOD_GITHUB_DRAFT_NOT_STAGED' }
+    if ($null -eq $View -or $View -isnot [pscustomobject]) {
+        Throw-CcodGitHubDraftError $notStagedId 'GitHub returned no structured release state.' $Tag
+    }
+    $fields = @($View.PSObject.Properties.Name)
+    if (($fields -join ',') -cne 'Tag,Draft,AssetNames' -or $View.Tag -isnot [string] -or $View.Tag -cne $Tag -or $View.Draft -isnot [bool]) {
+        Throw-CcodGitHubDraftError $notStagedId 'GitHub release state has an invalid schema.' $Tag
+    }
+    if ((-not $AfterPromotion -and -not [bool]$View.Draft) -or ($AfterPromotion -and [bool]$View.Draft)) {
+        Throw-CcodGitHubDraftError $notStagedId 'The GitHub release has an invalid draft visibility state.' $Tag
+    }
+    $expected = @(Get-CcodExpectedReleaseAssetNames -Version $Version)
+    $actual = @($View.AssetNames)
+    if ($actual.Count -ne $expected.Count) {
+        Throw-CcodGitHubDraftError $notStagedId 'GitHub draft does not contain the complete release asset set.' $Tag
+    }
+    if ((($actual | ForEach-Object { [string]$_ }) -join "`n") -cne ($expected -join "`n")) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ASSET_SET_INVALID' 'GitHub draft assets are not the exact ordered release set.' $Tag
+    }
+    return [string[]]$actual
+}
+
+function Assert-CcodGitHubDraftPrivateView {
+    param([Parameter(Mandatory)][string]$Tag,[Parameter(Mandatory)][string]$Version,$View)
+    if ($null -eq $View -or $View -isnot [pscustomobject]) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CREATE_FAILED' 'GitHub returned no structured private draft state.' $Tag
+    }
+    $fields = @($View.PSObject.Properties.Name)
+    if (($fields -join ',') -cne 'Tag,Draft,AssetNames' -or $View.Tag -isnot [string] -or $View.Tag -cne $Tag -or $View.Draft -isnot [bool] -or -not [bool]$View.Draft -or $null -eq $View.AssetNames) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CREATE_FAILED' 'GitHub returned an invalid or non-private draft state.' $Tag
+    }
+    $expected = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    foreach ($name in @(Get-CcodExpectedReleaseAssetNames -Version $Version)) { [void]$expected.Add($name) }
+    $seen = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    foreach ($name in @($View.AssetNames)) {
+        if ($name -isnot [string] -or -not $expected.Contains([string]$name) -or -not $seen.Add([string]$name)) {
+            Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ASSET_SET_INVALID' 'Private draft contains an unexpected or duplicate asset.' $Tag
+        }
+    }
+    [string[]]$seen
+}
+
+$script:CcodGitHubDraftStageLocks = @{}
+
+function Get-CcodGitHubDraftStageLockName([string]$Tag) {
+    "Local\CodexRemoteFix.Release.Stage.$Tag"
+}
+
+function Acquire-CcodGitHubDraftStageLock {
+    param([Parameter(Mandatory)][string]$Tag)
+    if ($script:CcodGitHubDraftStageLocks.ContainsKey($Tag)) { return $false }
+    $mutex = $null
+    try {
+        $mutex = [Threading.Mutex]::new($false, (Get-CcodGitHubDraftStageLockName $Tag))
+        try {
+            $acquired = $mutex.WaitOne(0)
+        } catch [Threading.AbandonedMutexException] {
+            $acquired = $true
+        }
+        if (-not $acquired) {
+            $mutex.Dispose()
+            return $false
+        }
+        $script:CcodGitHubDraftStageLocks[$Tag] = $mutex
+        return $true
+    } catch {
+        if ($null -ne $mutex) { $mutex.Dispose() }
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_LOCK_FAILED' 'Could not inspect or acquire the same-tag draft lock.' $Tag
+    }
+}
+
+function Release-CcodGitHubDraftStageLock {
+    param([Parameter(Mandatory)][string]$Tag)
+    if (-not $script:CcodGitHubDraftStageLocks.ContainsKey($Tag)) { return }
+    $mutex = $script:CcodGitHubDraftStageLocks[$Tag]
+    $script:CcodGitHubDraftStageLocks.Remove($Tag)
+    try {
+        $mutex.ReleaseMutex()
+    } finally {
+        $mutex.Dispose()
+    }
+}
+
+function Assert-CcodGitHubDraftActionsContext {
+    param([Parameter(Mandatory)][string]$Tag)
+    $repository = 'naipi11/CodexRemote-fix'
+    if ($env:GITHUB_ACTIONS -cne 'true' -or $env:GITHUB_SERVER_URL -cne 'https://github.com' -or $env:GITHUB_REPOSITORY -cne $repository -or $env:GITHUB_RUN_ID -notmatch '^[1-9][0-9]*$' -or [string]::IsNullOrWhiteSpace($env:GH_TOKEN)) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_GH_FORBIDDEN' 'GitHub draft adapters require the official CodexRemote-fix Actions context.' $Tag
+    }
+}
+
+function Assert-CcodGitHubDraftAuthenticatedContext {
+    param([Parameter(Mandatory)][string]$Tag)
+    if (-not [string]::IsNullOrWhiteSpace($env:GH_TOKEN)) { return }
+    try {
+        & gh auth status '--hostname' 'github.com' 2>$null | Out-Null
+        if ($LASTEXITCODE -ne 0) { throw 'gh auth status failed' }
+    } catch {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_GH_FORBIDDEN' 'Draft readback requires an authenticated GitHub CLI context.' $Tag
+    }
+}
+
+function Get-CcodGitHubDraftTagCommit {
+    param([Parameter(Mandatory)][string]$Tag,[Parameter(Mandatory)][bool]$ActionsOnly)
+    if ($ActionsOnly) { Assert-CcodGitHubDraftActionsContext $Tag } else { Assert-CcodGitHubDraftAuthenticatedContext $Tag }
+    $endpoint = 'repos/naipi11/CodexRemote-fix/commits/' + $Tag
+    $lines = @(& gh api $endpoint '--jq' '.sha')
+    if ($LASTEXITCODE -ne 0) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_TAG_COMMIT_FAILED' 'Could not resolve the official remote tag commit.' $Tag
+    }
+    $commit = (($lines | ForEach-Object { [string]$_ }) -join '').Trim().ToLowerInvariant()
+    if ($commit -notmatch '^[0-9a-f]{40}\z') {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_TAG_COMMIT_FAILED' 'GitHub returned an invalid remote tag commit.' $Tag
+    }
+    $commit
+}
+
+function Assert-CcodGitHubDraftTagCommit {
+    param([Parameter(Mandatory)][string]$Tag,[Parameter(Mandatory)][string]$ExpectedCommit,[Parameter(Mandatory)]$Adapters,[Parameter(Mandatory)][bool]$ActionsOnly)
+    if ($ExpectedCommit -notmatch '^[0-9a-f]{40}\z') {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_TAG_COMMIT_INVALID' 'Candidate commit is not canonical.' $ExpectedCommit
+    }
+    try {
+        $actualCommit = ([string](& $Adapters.GetTagCommit $Tag $ActionsOnly)).Trim().ToLowerInvariant()
+    } catch {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_TAG_COMMIT_FAILED' 'Could not read the remote tag commit.' $Tag
+    }
+    if ($actualCommit -cne $ExpectedCommit.ToLowerInvariant()) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_TAG_COMMIT_MISMATCH' 'Remote tag does not resolve to the immutable candidate commit.' $Tag
+    }
+}
+
+function Get-CcodGitHubDraftReleaseDefaultAdapters {
+    @{
+        TryStageLock = {
+            param($Tag)
+            Acquire-CcodGitHubDraftStageLock $Tag
+        }
+        AcquireStageLock = {
+            param($Tag)
+            Acquire-CcodGitHubDraftStageLock $Tag
+        }
+        ReleaseStageLock = {
+            param($Tag)
+            Release-CcodGitHubDraftStageLock $Tag
+        }
+        CreateDraft = {
+            param($Tag, $Title, $Notes)
+            Assert-CcodGitHubDraftActionsContext $Tag
+            & gh release create $Tag '--repo' 'naipi11/CodexRemote-fix' '--draft' '--verify-tag' '--title' $Title '--notes' $Notes | Out-Null
+            if ($LASTEXITCODE -ne 0) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CREATE_FAILED' 'Could not create a private draft.' $Tag }
+            [pscustomobject]@{ Tag = $Tag; Draft = $true }
+        }
+        UploadAsset = {
+            param($Tag, $Name, $Path)
+            Assert-CcodGitHubDraftActionsContext $Tag
+            & gh release upload $Tag '--repo' 'naipi11/CodexRemote-fix' $Path | Out-Null
+            if ($LASTEXITCODE -ne 0) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_UPLOAD_FAILED' 'Could not upload a draft asset.' $Name }
+        }
+        GetTagCommit = {
+            param($Tag, [bool]$ActionsOnly)
+            Get-CcodGitHubDraftTagCommit -Tag $Tag -ActionsOnly $ActionsOnly
+        }
+        DownloadAsset = {
+            param($Tag, $Name, $Destination)
+            Assert-CcodGitHubDraftAuthenticatedContext $Tag
+            $dir = [IO.Path]::GetDirectoryName($Destination)
+            & gh release download $Tag '--repo' 'naipi11/CodexRemote-fix' '--pattern' $Name '--dir' $dir | Out-Null
+            if ($LASTEXITCODE -ne 0) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_READBACK_FAILED' 'Could not read back a staged draft asset.' $Name }
+        }
+        ViewRelease = {
+            param($Tag)
+            Assert-CcodGitHubDraftAuthenticatedContext $Tag
+            $json = & gh release view $Tag '--repo' 'naipi11/CodexRemote-fix' '--json' 'isDraft,assets'
+            if ($LASTEXITCODE -ne 0) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_NOT_STAGED' 'Could not read the GitHub draft state.' $Tag }
+            try {
+                $value = ($json -join [Environment]::NewLine) | ConvertFrom-Json -ErrorAction Stop
+                $fields = @($value.PSObject.Properties.Name)
+                if ($null -eq $value -or $fields.Count -ne 2 -or $fields -notcontains 'isDraft' -or $fields -notcontains 'assets' -or $value.isDraft -isnot [bool] -or $null -eq $value.assets) { throw 'schema' }
+                $assetNames = [Collections.Generic.List[string]]::new()
+                foreach ($asset in @($value.assets)) {
+                    if ($null -eq $asset -or $null -eq $asset.PSObject.Properties['name'] -or $asset.name -isnot [string] -or [string]::IsNullOrWhiteSpace($asset.name)) { throw 'asset schema' }
+                    $assetNames.Add([string]$asset.name)
+                }
+                [pscustomobject]@{ Tag = $Tag; Draft = $value.isDraft; AssetNames = [string[]]$assetNames }
+            } catch {
+                Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_NOT_STAGED' 'GitHub returned malformed release state.' $Tag
+            }
+        }
+        SetReleaseDraftState = {
+            param($Tag, [bool]$Draft)
+            Assert-CcodGitHubDraftAuthenticatedContext $Tag
+            if ($Draft) { & gh release edit $Tag '--repo' 'naipi11/CodexRemote-fix' '--draft' | Out-Null } else { & gh release edit $Tag '--repo' 'naipi11/CodexRemote-fix' '--draft=false' | Out-Null }
+            if ($LASTEXITCODE -ne 0) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PROMOTE_FAILED' 'Could not change draft visibility.' $Tag }
+        }
+        InvokeBuild = {
+            param($Version)
+            Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_REBUILD' 'Draft promotion cannot rebuild a candidate.' $Version
+        }
+        InvokeGh = {
+            param($Arguments)
+            Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_GH_FORBIDDEN' 'Raw gh invocation is not part of the draft contract.' $Arguments
+        }
+    }
+}
+
+function Resolve-CcodGitHubDraftReleaseAdapters {
+    param([hashtable]$Adapters)
+    $resolved = Get-CcodGitHubDraftReleaseDefaultAdapters
+    if ($null -eq $Adapters) { return $resolved }
+    foreach ($name in @($Adapters.Keys)) {
+        if (-not $resolved.ContainsKey([string]$name) -or $Adapters[$name] -isnot [scriptblock]) {
+            Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ADAPTER_INVALID' 'Private draft adapters must replace known scriptblock operations only.' $name
+        }
+        $resolved[[string]$name] = $Adapters[$name]
+    }
+    return $resolved
+}
+
+function Get-CcodGitHubDraftFileSha256 {
+    param([Parameter(Mandatory)][string]$Path)
+    $sha = [Security.Cryptography.SHA256]::Create()
+    try {
+        $stream = [IO.File]::OpenRead([IO.Path]::GetFullPath($Path))
+        try {
+            return [BitConverter]::ToString($sha.ComputeHash($stream)).Replace('-', '').ToLowerInvariant()
+        } finally {
+            $stream.Dispose()
+        }
+    } finally {
+        $sha.Dispose()
+    }
+}
+
+function New-CcodGitHubDraftFrozenAssetSet {
+    param([Parameter(Mandatory)][string]$AssetDirectory,[Parameter(Mandatory)][string]$Version,[Parameter(Mandatory)]$Contract)
+    $frozenDirectory = Join-Path ([IO.Path]::GetTempPath()) ('ccod-draft-frozen-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($frozenDirectory) | Out-Null
+        $expected = @(Get-CcodExpectedReleaseAssetNames -Version $Version)
+        $contractAssets = @($Contract.Assets)
+        if ($contractAssets.Count -ne $expected.Count) { throw 'candidate contract asset count' }
+        for ($index = 0; $index -lt $expected.Count; $index++) {
+            $name = $expected[$index]
+            if ($contractAssets[$index].name -isnot [string] -or [string]$contractAssets[$index].name -cne $name -or $contractAssets[$index].sha256 -isnot [string] -or [string]$contractAssets[$index].sha256 -cnotmatch '^[0-9a-f]{64}$') { throw 'candidate contract asset identity' }
+            $source = Join-Path $AssetDirectory $name
+            $destination = Join-Path $frozenDirectory $name
+            [IO.File]::Copy($source, $destination, $false)
+            if ((Get-CcodGitHubDraftFileSha256 $destination) -cne [string]$contractAssets[$index].sha256) { throw 'candidate changed during freeze' }
+        }
+        return [pscustomobject][ordered]@{ Directory = $frozenDirectory; Names = [string[]]$expected; GitCommit = [string]$Contract.GitCommit }
+    } catch {
+        if ([IO.Directory]::Exists($frozenDirectory)) { Remove-Item -LiteralPath $frozenDirectory -Recurse -Force -ErrorAction SilentlyContinue }
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ASSET_FREEZE_FAILED' 'The release candidate changed or could not be frozen.' $AssetDirectory
+    }
+}
+
+function Remove-CcodGitHubDraftFrozenAssetSet {
+    param($Frozen)
+    if ($null -ne $Frozen -and [string]::IsNullOrWhiteSpace([string]$Frozen.Directory) -eq $false -and [IO.Directory]::Exists([string]$Frozen.Directory)) {
+        Remove-Item -LiteralPath ([string]$Frozen.Directory) -Recurse -Force -ErrorAction SilentlyContinue
+    }
+}
+
+function Invoke-CcodGitHubDraftDownloadAsset {
+    param([Parameter(Mandatory)][hashtable]$Adapters,[Parameter(Mandatory)][string]$Tag,[Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string]$Destination,[Parameter(Mandatory)][string]$ErrorId)
+    try {
+        & $Adapters.DownloadAsset $Tag $Name $Destination
+        if (-not [IO.File]::Exists($Destination)) { throw 'download did not create destination' }
+    } catch {
+        Throw-CcodGitHubDraftError $ErrorId 'GitHub asset readback failed.' $Name
+    }
+}
+
+function Get-CcodGitHubDraftPreflightName([string]$Version) {
+    "CodexRemote-fix-$Version-clean-preflight.json"
+}
+
+function Get-CcodGitHubDraftAcceptanceName([string]$Version) {
+    "CodexRemote-fix-$Version-official-draft.complete.json"
+}
+
+function Get-CcodGitHubDraftVerificationName([string]$Version) {
+    "CodexRemote-fix-$Version-draft-verified.json"
+}
+
+function Get-CcodGitHubDraftDefenderEvidenceDirectory([string]$EvidenceDirectory) {
+    $dedicated = Join-Path $EvidenceDirectory 'defender'
+    if ([IO.File]::Exists($dedicated)) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'The Defender evidence plane is not a directory.' $dedicated
+    }
+    if ([IO.Directory]::Exists($dedicated)) {
+        return Assert-CcodGitHubDraftPlainPath -Path $dedicated -Directory $true
+    }
+    return Assert-CcodGitHubDraftPlainPath -Path $EvidenceDirectory -Directory $true
+}
+
+function Assert-CcodGitHubDraftPlainPath {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][bool]$Directory)
+    if ($null -eq $script:CcodDraftReleaseAssetContractModule) { Import-CcodDraftReleaseAssetContract }
+    try {
+        return & $script:CcodDraftReleaseAssetContractModule { param($Value,$IsDirectory) Assert-CcodReleaseContractPlainPath -Path $Value -Directory $IsDirectory -ErrorId 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' } $Path $Directory
+    } catch {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'Draft evidence path is missing, noncanonical, or has unsafe reparse ancestry.' $Path
+    }
+}
+
+function Get-CcodGitHubDraftEvidencePlanePath {
+    param([Parameter(Mandatory)][string]$EvidenceDirectory,[Parameter(Mandatory)][ValidateSet('verification','acceptance')][string]$Plane,[switch]$Create)
+    $root = Assert-CcodGitHubDraftPlainPath -Path $EvidenceDirectory -Directory $true
+    $path = Join-Path $root $Plane
+    if ([IO.File]::Exists($path)) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'Draft evidence plane is a file, not a directory.' $path
+    }
+    if (-not [IO.Directory]::Exists($path)) {
+        if (-not $Create) { return $path }
+        try { [IO.Directory]::CreateDirectory($path) | Out-Null } catch { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'Draft evidence plane could not be created safely.' $path }
+    }
+    return Assert-CcodGitHubDraftPlainPath -Path $path -Directory $true
+}
+
+function Get-CcodGitHubDraftEvidenceFilePath {
+    param([Parameter(Mandatory)][string]$EvidenceDirectory,[Parameter(Mandatory)][ValidateSet('verification','acceptance')][string]$Plane,[Parameter(Mandatory)][string]$Leaf,[switch]$CreatePlane)
+    $planePath = Get-CcodGitHubDraftEvidencePlanePath -EvidenceDirectory $EvidenceDirectory -Plane $Plane -Create:$CreatePlane
+    $path = Join-Path $planePath $Leaf
+    if ([IO.Directory]::Exists($path)) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'Draft evidence target is a directory, not a file.' $path
+    }
+    if ([IO.File]::Exists($path)) { return Assert-CcodGitHubDraftPlainPath -Path $path -Directory $false }
+    if ([IO.Path]::GetFullPath($path) -cne $path) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'Draft evidence target is not canonical.' $path
+    }
+    return $path
+}
+
+function Get-CcodGitHubDraftRootEvidenceFilePath([string]$EvidenceDirectory,[string]$Leaf) {
+    $root = Assert-CcodGitHubDraftPlainPath -Path $EvidenceDirectory -Directory $true
+    $path = Join-Path $root $Leaf
+    if ([IO.Directory]::Exists($path)) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'Draft evidence target is a directory, not a file.' $path
+    }
+    if ([IO.File]::Exists($path)) { return Assert-CcodGitHubDraftPlainPath -Path $path -Directory $false }
+    return $path
+}
+
+function Get-CcodGitHubDraftVerificationPath([string]$EvidenceDirectory,[string]$Version,[switch]$CreatePlane) {
+    Get-CcodGitHubDraftEvidenceFilePath -EvidenceDirectory $EvidenceDirectory -Plane verification -Leaf (Get-CcodGitHubDraftVerificationName $Version) -CreatePlane:$CreatePlane
+}
+
+function Get-CcodGitHubDraftAcceptancePath([string]$EvidenceDirectory,[string]$Version) {
+    Get-CcodGitHubDraftEvidenceFilePath -EvidenceDirectory $EvidenceDirectory -Plane acceptance -Leaf (Get-CcodGitHubDraftAcceptanceName $Version)
+}
+
+function Write-CcodGitHubDraftJsonCreateOnly {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)]$Record,[Parameter(Mandatory)][string]$ErrorId)
+    $Path = [IO.Path]::GetFullPath($Path)
+    $directory = [IO.Path]::GetDirectoryName($Path)
+    [void](Assert-CcodGitHubDraftPlainPath -Path $directory -Directory $true)
+    if ([IO.Directory]::Exists($Path)) { Throw-CcodGitHubDraftError $ErrorId 'Draft evidence target is a directory, not a file.' $Path }
+    if ([IO.File]::Exists($Path)) { [void](Assert-CcodGitHubDraftPlainPath -Path $Path -Directory $false) }
+    $json = (($Record | ConvertTo-Json -Depth 12) + [Environment]::NewLine)
+    $encoding = [Text.UTF8Encoding]::new($false)
+    $bytes = $encoding.GetBytes($json)
+    $stream = $null
+    try {
+        $stream = [IO.File]::Open($Path, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::None)
+        $stream.Write($bytes, 0, $bytes.Length)
+        $stream.Flush($true)
+    } catch {
+        Throw-CcodGitHubDraftError $ErrorId 'Draft evidence is not create-only or could not be published.' $Path
+    } finally {
+        if ($null -ne $stream) { $stream.Dispose() }
+    }
+    if (-not [IO.File]::Exists($Path)) { Throw-CcodGitHubDraftError $ErrorId 'Draft evidence write did not produce a file.' $Path }
+}
+
+function Read-CcodGitHubDraftVerification {
+    param([Parameter(Mandatory)][string]$EvidenceDirectory,[Parameter(Mandatory)][string]$AssetDirectory,[Parameter(Mandatory)][string]$Tag,[Parameter(Mandatory)][string]$Version,[Parameter(Mandatory)][string]$GitCommit)
+    $path = Get-CcodGitHubDraftVerificationPath $EvidenceDirectory $Version
+    if (-not [IO.File]::Exists($path)) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_MISSING' 'Promote requires a persisted successful Verify record.' $path }
+    $record = (Read-CcodGitHubDraftContractJson -Path $path -ErrorId 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID').Value
+    $expected = @(Get-CcodExpectedReleaseAssetNames -Version $Version)
+    $fields = @($record.PSObject.Properties.Name)
+    $hashes = @($record.assetSha256)
+    $names = @($record.assetNames)
+    $localManifest = Join-Path $AssetDirectory (Get-CcodGitHubDraftManifestName $Version)
+    if ($record -isnot [pscustomobject] -or ($fields -join ',') -cne 'schemaVersion,kind,tag,version,gitCommit,draft,verified,assetNames,assetSha256,candidateManifestSha256' -or
+        -not (Test-CcodGitHubDraftSchemaVersion $record.schemaVersion) -or
+        $record.kind -isnot [string] -or $record.kind -cne 'github-draft-verification' -or $record.tag -isnot [string] -or $record.tag -cne $Tag -or
+        $record.version -isnot [string] -or $record.version -cne $Version -or $record.gitCommit -isnot [string] -or $record.gitCommit -cne $GitCommit -or
+        $record.draft -isnot [bool] -or -not [bool]$record.draft -or
+        $record.verified -isnot [bool] -or -not [bool]$record.verified -or
+        $names.Count -ne $expected.Count -or (@($names | Where-Object { $_ -isnot [string] }).Count -ne 0) -or (($names | ForEach-Object { [string]$_ }) -join "`n") -cne ($expected -join "`n") -or
+        $hashes.Count -ne $expected.Count -or (@($hashes | Where-Object { $_ -isnot [string] -or $_ -cnotmatch '^[0-9a-f]{64}$' }).Count -ne 0) -or
+        $record.candidateManifestSha256 -isnot [string] -or $record.candidateManifestSha256 -cne (Get-CcodGitHubDraftFileSha256 $localManifest)) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID' 'Persisted Verify evidence is not bound to the exact candidate.' $path
+    }
+    for ($index = 0; $index -lt $expected.Count; $index++) {
+        if ([string]$hashes[$index] -cne (Get-CcodGitHubDraftFileSha256 (Join-Path $AssetDirectory $expected[$index]))) {
+            Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID' 'Persisted Verify asset hashes do not match the candidate.' $path
+        }
+    }
+    return $record
+}
+
+function Get-CcodGitHubDraftManifestName([string]$Version) {
+    "CodexRemote-fix-$Version-release-manifest.json"
+}
+
+function Read-CcodGitHubDraftAcceptance {
+    param([Parameter(Mandatory)][string]$EvidenceDirectory,[Parameter(Mandatory)][string]$AssetDirectory,[Parameter(Mandatory)][string]$Version,[Parameter(Mandatory)][string]$GitCommit)
+    $path = Get-CcodGitHubDraftAcceptancePath $EvidenceDirectory $Version
+    if (-not [IO.File]::Exists($path)) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_MISSING' 'Promotion requires Task 8/9 official-draft acceptance evidence.' $path }
+    $record = (Read-CcodGitHubDraftContractJson -Path $path -ErrorId 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID').Value
+    $fields = @($record.PSObject.Properties.Name)
+    $manifestPath = Join-Path $AssetDirectory (Get-CcodGitHubDraftManifestName $Version)
+    $canonicalCompletedAtUtc = $null
+    try {
+        $parsedCompletedAtUtc = [DateTimeOffset]::ParseExact([string]$record.completedAtUtc, "yyyy-MM-dd'T'HH:mm:ss.fffffff'Z'", [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AssumeUniversal)
+        $canonicalCompletedAtUtc = $parsedCompletedAtUtc.ToUniversalTime().ToString("yyyy-MM-dd'T'HH:mm:ss.fffffff'Z'", [Globalization.CultureInfo]::InvariantCulture)
+    } catch { }
+    if ($record -isnot [pscustomobject] -or ($fields -join ',') -cne 'schemaVersion,kind,version,gitCommit,candidateManifestSha256,phase,completedAtUtc' -or
+        -not (Test-CcodGitHubDraftSchemaVersion $record.schemaVersion) -or $record.kind -isnot [string] -or $record.kind -cne 'official-draft-acceptance' -or
+        $record.version -isnot [string] -or $record.version -cne $Version -or $record.gitCommit -isnot [string] -or $record.gitCommit -cne $GitCommit -or $record.gitCommit -cnotmatch '^[0-9a-f]{40}$' -or
+        $record.candidateManifestSha256 -isnot [string] -or $record.candidateManifestSha256 -cnotmatch '^[0-9a-f]{64}$' -or $record.candidateManifestSha256 -cne (Get-CcodGitHubDraftFileSha256 $manifestPath) -or
+        $record.phase -isnot [string] -or $record.phase -cne 'Complete' -or $record.completedAtUtc -isnot [string] -or [string]$record.completedAtUtc -cne $canonicalCompletedAtUtc) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID' 'Official-draft acceptance evidence is malformed or not bound to this candidate.' $path
+    }
+    return $record
+}
+
+function Invoke-CcodGitHubDraftReleaseCore {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][ValidateSet('Stage','Verify','Promote')][string]$Mode,
+        [Parameter(Mandatory)][ValidatePattern('^v\d+\.\d+\.\d+\z')][string]$Tag,
+        [Parameter(Mandatory)][string]$AssetDirectory,
+        [Parameter(Mandatory)][string]$EvidenceDirectory,
+        [string]$NotesPath,
+        [hashtable]$Adapters
+    )
+    $Mode = if ($Mode -ieq 'Stage') { 'Stage' } elseif ($Mode -ieq 'Verify') { 'Verify' } elseif ($Mode -ieq 'Promote') { 'Promote' } else { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_MODE_INVALID' 'Release mode is invalid.' $Mode }
+    $adapters = Resolve-CcodGitHubDraftReleaseAdapters $Adapters
+    $version = $Tag.Substring(1)
+    $assetDir = [IO.Path]::GetFullPath($AssetDirectory)
+    $evidenceDir = [IO.Path]::GetFullPath($EvidenceDirectory)
+    Import-CcodDraftReleaseAssetContract
+    $evidenceDir = Assert-CcodGitHubDraftPlainPath -Path $evidenceDir -Directory $true
+    if ($Mode -ceq 'Promote') {
+        $promoteLockHeld = $false
+        try {
+            if ($null -eq $Adapters) {
+                $promoteLockHeld = [bool](& $adapters.AcquireStageLock $Tag)
+            } else {
+                $promoteLockHeld = [bool](& $adapters.TryStageLock $Tag)
+            }
+            if (-not $promoteLockHeld) {
+                Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CONCURRENT' 'Same-tag release operation is already running.' $Tag
+            }
+            $assets = Test-CcodExactReleaseAssetSet -AssetDirectory $assetDir -Version $version
+            Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit ([string]$assets.GitCommit) -Adapters $adapters -ActionsOnly $false
+            $preflight = Join-Path $evidenceDir (Get-CcodGitHubDraftPreflightName $version)
+            Read-CcodGitHubDraftPreflight -Path $preflight -Version $version -GitCommit ([string]$assets.GitCommit) | Out-Null
+            $frozen = New-CcodGitHubDraftFrozenAssetSet -AssetDirectory $assetDir -Version $version -Contract $assets
+            try {
+                $frozenDirectory = [string]$frozen.Directory
+                $defenderEvidence = Get-CcodGitHubDraftDefenderEvidenceDirectory $evidenceDir
+                try {
+                    Test-CcodReleasePromotionEvidence -EvidenceDirectory $defenderEvidence -AssetDirectory $frozenDirectory -Version $version -ExpectedGitCommit $assets.GitCommit | Out-Null
+                } catch {
+                    $id = ([string]$_.FullyQualifiedErrorId -split '[,:]')[0]
+                    if ($id -ceq 'CCOD_RELEASE_PROMOTION_EVIDENCE_INVALID' -or $id -ceq 'CCOD_RELEASE_ASSET_SET_INVALID') { throw }
+                    Throw-CcodGitHubDraftError 'CCOD_RELEASE_PROMOTION_EVIDENCE_INVALID' 'Promotion requires Task 5 dual InternetDownload receipts.' $defenderEvidence
+                }
+                Read-CcodGitHubDraftAcceptance -EvidenceDirectory $evidenceDir -AssetDirectory $frozenDirectory -Version $version -GitCommit ([string]$assets.GitCommit) | Out-Null
+                $verification = Read-CcodGitHubDraftVerification -EvidenceDirectory $evidenceDir -AssetDirectory $frozenDirectory -Tag $Tag -Version $version -GitCommit ([string]$assets.GitCommit)
+                try {
+                    $view = & $adapters.ViewRelease $Tag
+                } catch {
+                    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_NOT_STAGED' 'Could not read the already verified GitHub draft state.' $Tag
+                }
+                $expected = @(Assert-CcodGitHubDraftRemoteView -Tag $Tag -Version $version -View $view)
+                $readRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-draft-promote-' + [guid]::NewGuid().ToString('N'))
+                [IO.Directory]::CreateDirectory($readRoot) | Out-Null
+                try {
+                    for ($index = 0; $index -lt $expected.Count; $index++) {
+                        $name = $expected[$index]
+                        $destination = Join-Path $readRoot $name
+                        Invoke-CcodGitHubDraftDownloadAsset -Adapters $adapters -Tag $Tag -Name $name -Destination $destination -ErrorId 'CCOD_GITHUB_DRAFT_READBACK_FAILED'
+                        $actualHash = Get-CcodGitHubDraftFileSha256 $destination
+                        if ($actualHash -cne [string]$verification.assetSha256[$index] -or $actualHash -cne (Get-CcodGitHubDraftFileSha256 (Join-Path $frozenDirectory $name))) {
+                            Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PROMOTE_READBACK_FAILED' 'Verified draft asset changed before promotion.' $name
+                        }
+                    }
+                } finally {
+                    if ([IO.Directory]::Exists($readRoot)) { Remove-Item -LiteralPath $readRoot -Recurse -Force -ErrorAction SilentlyContinue }
+                }
+                try {
+                    $beforePublishView = & $adapters.ViewRelease $Tag
+                } catch {
+                    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PROMOTE_READBACK_FAILED' 'Could not re-read the private draft before promotion.' $Tag
+                }
+                [void](Assert-CcodGitHubDraftRemoteView -Tag $Tag -Version $version -View $beforePublishView)
+                Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit ([string]$assets.GitCommit) -Adapters $adapters -ActionsOnly $false
+                try {
+                    & $adapters.SetReleaseDraftState $Tag $false
+                } catch {
+                    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PROMOTE_FAILED' 'Could not change draft visibility.' $Tag
+                }
+                try {
+                    $postView = & $adapters.ViewRelease $Tag
+                } catch {
+                    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PROMOTE_READBACK_FAILED' 'Could not read the final GitHub release state.' $Tag
+                }
+                [void](Assert-CcodGitHubDraftRemoteView -Tag $Tag -Version $version -View $postView -AfterPromotion)
+                Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit ([string]$assets.GitCommit) -Adapters $adapters -ActionsOnly $false
+                $postReadRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-draft-post-promote-' + [guid]::NewGuid().ToString('N'))
+                [IO.Directory]::CreateDirectory($postReadRoot) | Out-Null
+                try {
+                    for ($index = 0; $index -lt $expected.Count; $index++) {
+                        $name = $expected[$index]
+                        $destination = Join-Path $postReadRoot $name
+                        Invoke-CcodGitHubDraftDownloadAsset -Adapters $adapters -Tag $Tag -Name $name -Destination $destination -ErrorId 'CCOD_GITHUB_DRAFT_PROMOTE_READBACK_FAILED'
+                        $actualHash = Get-CcodGitHubDraftFileSha256 $destination
+                        if ($actualHash -cne [string]$verification.assetSha256[$index] -or $actualHash -cne (Get-CcodGitHubDraftFileSha256 (Join-Path $frozenDirectory $name))) {
+                            Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PROMOTE_READBACK_FAILED' 'Public release asset changed after promotion.' $name
+                        }
+                    }
+                } finally {
+                    if ([IO.Directory]::Exists($postReadRoot)) { Remove-Item -LiteralPath $postReadRoot -Recurse -Force -ErrorAction SilentlyContinue }
+                }
+                return [pscustomobject][ordered]@{ Mode = $Mode; Tag = $Tag; Draft = $false; Promoted = $true }
+            } finally {
+                Remove-CcodGitHubDraftFrozenAssetSet $frozen
+            }
+        } finally {
+            if ($promoteLockHeld) {
+                & $adapters.ReleaseStageLock $Tag
+            }
+        }
+    }
+    $defaultLockHeld = $false
+    try {
+        if ($null -eq $Adapters) {
+            $defaultLockHeld = [bool](& $adapters.AcquireStageLock $Tag)
+        } else {
+            $defaultLockHeld = [bool](& $adapters.TryStageLock $Tag)
+        }
+        if (-not $defaultLockHeld) {
+            Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CONCURRENT' 'Same-tag Stage is already running.' $Tag
+        }
+        $preflight = Join-Path $evidenceDir (Get-CcodGitHubDraftPreflightName $version)
+    $assets = $null
+    if ($Mode -ceq 'Stage') {
+        if (-not [IO.File]::Exists($preflight)) {
+            Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PREFLIGHT_MISSING' 'Stage requires transferred clean-runner preflight evidence.' $preflight
+        }
+        $assets = Test-CcodExactReleaseAssetSet -AssetDirectory $assetDir -Version $version
+        Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit ([string]$assets.GitCommit) -Adapters $adapters -ActionsOnly $true
+        Read-CcodGitHubDraftPreflight -Path $preflight -Version $version -GitCommit ([string]$assets.GitCommit) | Out-Null
+    }
+    if ($Mode -ceq 'Verify') {
+        $assets = Test-CcodExactReleaseAssetSet -AssetDirectory $assetDir -Version $version
+        Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit ([string]$assets.GitCommit) -Adapters $adapters -ActionsOnly $false
+        Read-CcodGitHubDraftPreflight -Path $preflight -Version $version -GitCommit ([string]$assets.GitCommit) | Out-Null
+        $frozen = New-CcodGitHubDraftFrozenAssetSet -AssetDirectory $assetDir -Version $version -Contract $assets
+        try {
+            $frozenDirectory = [string]$frozen.Directory
+            try {
+                $view = & $adapters.ViewRelease $Tag
+            } catch {
+                Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_NOT_STAGED' 'Could not read the staged GitHub draft state.' $Tag
+            }
+            $expected = @(Assert-CcodGitHubDraftRemoteView -Tag $Tag -Version $version -View $view)
+            $readRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-draft-verify-' + [guid]::NewGuid().ToString('N'))
+            [IO.Directory]::CreateDirectory($readRoot) | Out-Null
+            try {
+                foreach ($name in $expected) {
+                    $destination = Join-Path $readRoot $name
+                    Invoke-CcodGitHubDraftDownloadAsset -Adapters $adapters -Tag $Tag -Name $name -Destination $destination -ErrorId 'CCOD_GITHUB_DRAFT_READBACK_FAILED'
+                    $expectedHash = Get-CcodGitHubDraftFileSha256 (Join-Path $frozenDirectory $name)
+                    $actualHash = Get-CcodGitHubDraftFileSha256 $destination
+                    if ($expectedHash -cne $actualHash) {
+                        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_READBACK_FAILED' 'Verified draft asset hash does not match the frozen candidate.' $name
+                    }
+                }
+            } finally {
+                if ([IO.Directory]::Exists($readRoot)) { Remove-Item -LiteralPath $readRoot -Recurse -Force -ErrorAction SilentlyContinue }
+            }
+            $verificationHashes = [Collections.Generic.List[string]]::new()
+            foreach ($name in $expected) { $verificationHashes.Add((Get-CcodGitHubDraftFileSha256 (Join-Path $frozenDirectory $name))) }
+            $verificationRecord = [ordered]@{
+                schemaVersion = 1
+                kind = 'github-draft-verification'
+                tag = $Tag
+                version = $version
+                gitCommit = [string]$assets.GitCommit
+                draft = $true
+                verified = $true
+                assetNames = [string[]]$expected
+                assetSha256 = [string[]]$verificationHashes
+                candidateManifestSha256 = Get-CcodGitHubDraftFileSha256 (Join-Path $frozenDirectory (Get-CcodGitHubDraftManifestName $version))
+            }
+            $verificationPath = Get-CcodGitHubDraftVerificationPath $evidenceDir $version -CreatePlane
+            Write-CcodGitHubDraftJsonCreateOnly -Path $verificationPath -Record $verificationRecord -ErrorId 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID'
+            Read-CcodGitHubDraftVerification -EvidenceDirectory $evidenceDir -AssetDirectory $frozenDirectory -Tag $Tag -Version $version -GitCommit ([string]$assets.GitCommit) | Out-Null
+            return [pscustomobject][ordered]@{ Mode = $Mode; Tag = $Tag; Draft = $true; Verified = $true; VerificationPath = $verificationPath }
+        } finally {
+            Remove-CcodGitHubDraftFrozenAssetSet $frozen
+        }
+    }
+    $assets = Test-CcodExactReleaseAssetSet -AssetDirectory $assetDir -Version $version
+    $frozen = New-CcodGitHubDraftFrozenAssetSet -AssetDirectory $assetDir -Version $version -Contract $assets
+    try {
+        $frozenDirectory = [string]$frozen.Directory
+        $notes = ''
+        if (-not [string]::IsNullOrWhiteSpace($NotesPath)) {
+            $notesFile = [IO.Path]::GetFullPath($NotesPath)
+            try {
+                $notesItem = Get-Item -LiteralPath $notesFile -Force -ErrorAction Stop
+                if (-not $notesItem.PSIsContainer -and $notesItem.Length -le 1048576) {
+                    $notes = [IO.File]::ReadAllText($notesFile, [Text.UTF8Encoding]::new($false, $true))
+                } else { throw 'notes bounds' }
+            } catch {
+                Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_NOTES_INVALID' 'Release notes are missing, invalid, or too large.' $notesFile
+            }
+        }
+        $expected = [string[]]$frozen.Names
+        $created = $false
+        try {
+            $createdResult = & $adapters.CreateDraft $Tag ("CodexRemote-fix $version") $notes
+            if ($null -eq $createdResult -or $createdResult -isnot [pscustomobject] -or @($createdResult.PSObject.Properties.Name) -join ',' -cne 'Tag,Draft' -or $createdResult.Tag -cne $Tag -or $createdResult.Draft -isnot [bool] -or -not [bool]$createdResult.Draft) {
+                Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CREATE_FAILED' 'Draft creation did not return a private draft state.' $Tag
+            }
+            $created = $true
+            Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit ([string]$assets.GitCommit) -Adapters $adapters -ActionsOnly $true
+            $createdView = & $adapters.ViewRelease $Tag
+            [void](Assert-CcodGitHubDraftPrivateView -Tag $Tag -Version $version -View $createdView)
+            foreach ($name in $expected) {
+                Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit ([string]$assets.GitCommit) -Adapters $adapters -ActionsOnly $true
+                $beforeUploadView = & $adapters.ViewRelease $Tag
+                [void](Assert-CcodGitHubDraftPrivateView -Tag $Tag -Version $version -View $beforeUploadView)
+                & $adapters.UploadAsset $Tag $name (Join-Path $frozenDirectory $name)
+            }
+            $stageView = & $adapters.ViewRelease $Tag
+            [void](Assert-CcodGitHubDraftRemoteView -Tag $Tag -Version $version -View $stageView)
+        } catch {
+            if ($created) {
+                Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_UPLOAD_FAILED' 'Draft upload failed; the draft remains private.' $Tag
+            }
+            throw
+        }
+        $readRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-draft-stage-' + [guid]::NewGuid().ToString('N'))
+        [IO.Directory]::CreateDirectory($readRoot) | Out-Null
+        try {
+            foreach ($name in $expected) {
+                $destination = Join-Path $readRoot $name
+                Invoke-CcodGitHubDraftDownloadAsset -Adapters $adapters -Tag $Tag -Name $name -Destination $destination -ErrorId 'CCOD_GITHUB_DRAFT_READBACK_FAILED'
+                $expectedHash = Get-CcodGitHubDraftFileSha256 (Join-Path $frozenDirectory $name)
+                $actualHash = Get-CcodGitHubDraftFileSha256 $destination
+                if ($expectedHash -cne $actualHash) {
+                    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_READBACK_FAILED' 'Staged draft asset hash does not match the frozen candidate.' $name
+                }
+            }
+        } finally {
+            if ([IO.Directory]::Exists($readRoot)) { Remove-Item -LiteralPath $readRoot -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+        return [pscustomobject][ordered]@{ Mode = $Mode; Tag = $Tag; Draft = $true; Uploaded = $expected }
+    } finally {
+        Remove-CcodGitHubDraftFrozenAssetSet $frozen
+    }
+    } finally {
+        if ($null -eq $Adapters -and $defaultLockHeld) {
+            & $adapters.ReleaseStageLock $Tag
+        }
+    }
+}
+
+function Invoke-CcodGitHubDraftRelease {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][ValidateSet('Stage','Verify','Promote')][string]$Mode,
+        [Parameter(Mandatory)][ValidatePattern('^v\d+\.\d+\.\d+\z')][string]$Tag,
+        [Parameter(Mandatory)][string]$AssetDirectory,
+        [Parameter(Mandatory)][string]$EvidenceDirectory,
+        [string]$NotesPath
+    )
+    Invoke-CcodGitHubDraftReleaseCore -Mode $Mode -Tag $Tag -AssetDirectory $AssetDirectory -EvidenceDirectory $EvidenceDirectory -NotesPath $NotesPath
+}
+
+Export-ModuleMember -Function Invoke-CcodGitHubDraftRelease
diff --git a/tools/Test-CleanReleaseRunner.ps1 b/tools/Test-CleanReleaseRunner.ps1
new file mode 100644
index 0000000..f74765a
--- /dev/null
+++ b/tools/Test-CleanReleaseRunner.ps1
@@ -0,0 +1,233 @@
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+function Throw-CcodCleanReleaseRunnerError {
+    param([Parameter(Mandatory)][string]$Id,[Parameter(Mandatory)][string]$Message,$Target)
+    throw [Management.Automation.ErrorRecord]::new(
+        [InvalidOperationException]::new($Message),
+        $Id,
+        [Management.Automation.ErrorCategory]::InvalidData,
+        $Target)
+}
+
+function Get-CcodCleanReleaseRunnerInstallRootPresent {
+    param([Parameter(Mandatory)][string]$InstallRoot)
+    try {
+        Get-Item -LiteralPath $InstallRoot -Force -ErrorAction Stop | Out-Null
+        return $true
+    } catch {
+        if ($_.CategoryInfo.Category -eq [Management.Automation.ErrorCategory]::ObjectNotFound) {
+            return $false
+        }
+        Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_INSPECTION_FAILED' 'Clean runner could not inspect the installation root.' $InstallRoot
+    }
+}
+
+function Get-CcodCleanReleaseRunnerDefaultAdapters {
+    @{
+        GetPackageVersion = {
+            param($Root)
+            $package = Join-Path $Root 'package.json'
+            $json = [IO.File]::ReadAllText($package, [Text.UTF8Encoding]::new($false)) | ConvertFrom-Json
+            [string]$json.version
+        }
+        GetGitPorcelain = {
+            param($Root)
+            try {
+                $status = @(& git -C $Root status --porcelain --untracked-files=all --ignored=matching 2>$null)
+                if ($LASTEXITCODE -ne 0) { throw 'git status failed' }
+                @($status | ForEach-Object { [string]$_ }) -join "`n"
+            } catch {
+                Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_INSPECTION_FAILED' 'Clean runner could not inspect the repository status.' $Root
+            }
+        }
+        GetGitCommit = {
+            param($Root)
+            try {
+                $commit = ([string](& git -C $Root rev-parse HEAD 2>$null)).Trim().ToLowerInvariant()
+                if ($LASTEXITCODE -ne 0 -or $commit -notmatch '^[0-9a-f]{40}$') { throw 'git commit failed' }
+                $commit
+            } catch {
+                Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_INSPECTION_FAILED' 'Clean runner could not inspect the repository commit.' $Root
+            }
+        }
+        GetProductState = {
+            param($Root)
+            $installRoot = Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)) 'CodexControlOtherDevices'
+            $installPresent = Get-CcodCleanReleaseRunnerInstallRootPresent -InstallRoot $installRoot
+            $taskPresent = $false
+            try {
+                $task = Get-ScheduledTask -TaskName 'Codex Control Other Devices Supervisor' -ErrorAction Stop
+                $taskPresent = $null -ne $task
+            } catch {
+                if ($_.CategoryInfo.Category -eq [Management.Automation.ErrorCategory]::ObjectNotFound) {
+                    $taskPresent = $false
+                } else {
+                    Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_INSPECTION_FAILED' 'Clean runner could not inspect scheduled tasks.' $Root
+                }
+            }
+            $names = @('CodexRemote.fix.TrayHost','CodexRemote.TrayHost','CodexRemote-fix','CodexControlOtherDevices')
+            try {
+                $running = @(Get-Process -ErrorAction Stop | Where-Object { $names -contains $_.ProcessName })
+            } catch {
+                Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_INSPECTION_FAILED' 'Clean runner could not inspect running product processes.' $Root
+            }
+            [pscustomobject]@{
+                InstallRootPresent = [bool]$installPresent
+                ScheduledTaskPresent = [bool]$taskPresent
+                SupervisorPresent = [bool](@($running | Where-Object { $_.ProcessName -cne 'CodexRemote.fix.TrayHost' -and $_.ProcessName -cne 'CodexRemote.TrayHost' }).Count -gt 0)
+                TrayHostPresent = [bool](@($running | Where-Object { $_.ProcessName -ceq 'CodexRemote.fix.TrayHost' -or $_.ProcessName -ceq 'CodexRemote.TrayHost' }).Count -gt 0)
+            }
+        }
+        ProbeMutex = {
+            param($Kind)
+            $mutex = $null
+            try {
+                $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+                try {
+                    $sid = $identity.User.Value
+                } finally {
+                    $identity.Dispose()
+                }
+                $name = "Global\CodexControlOtherDevices.$Kind.$sid"
+                $opened = [Threading.Mutex]::TryOpenExisting($name, [ref]$mutex)
+                return [bool]$opened
+            } catch {
+                Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_INSPECTION_FAILED' "Clean runner could not inspect the $Kind mutex." $Kind
+            } finally {
+                if ($null -ne $mutex) { $mutex.Dispose() }
+            }
+        }
+        WritePreflightEvidence = {
+            param($Path, $Record)
+            $json = (($Record | ConvertTo-Json -Depth 8) + [Environment]::NewLine)
+            $encoding = [Text.UTF8Encoding]::new($false)
+            $bytes = $encoding.GetBytes($json)
+            $stream = $null
+            try {
+                $stream = [IO.File]::Open($Path, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::None)
+                $stream.Write($bytes, 0, $bytes.Length)
+                $stream.Flush($true)
+            } catch {
+                Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_PREFLIGHT_WRITE_FAILED' 'Clean preflight evidence is create-only and could not be written.' $Path
+            } finally {
+                if ($null -ne $stream) { $stream.Dispose() }
+            }
+            try {
+                $readback = [IO.File]::ReadAllText($Path, [Text.UTF8Encoding]::new($false, $true))
+                if ($readback -cne $json) { throw 'preflight readback mismatch' }
+            } catch {
+                Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_PREFLIGHT_WRITE_FAILED' 'Clean preflight evidence failed strict readback.' $Path
+            }
+            $Path
+        }
+        CleanupProduct = {
+            param($Root)
+            Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_CONTAMINATED' 'Clean runner never cleans product state.' $Root
+        }
+    }
+}
+
+function Resolve-CcodCleanReleaseRunnerAdapters {
+    param([hashtable]$Adapters)
+    $resolved = Get-CcodCleanReleaseRunnerDefaultAdapters
+    if ($null -eq $Adapters) { return $resolved }
+    foreach ($name in @($Adapters.Keys)) {
+        if (-not $resolved.ContainsKey([string]$name) -or $Adapters[$name] -isnot [scriptblock]) {
+            Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_ADAPTER_INVALID' 'Private clean runner adapters must replace known scriptblock operations only.' $name
+        }
+        $resolved[[string]$name] = $Adapters[$name]
+    }
+    return $resolved
+}
+
+function Test-CcodCleanReleaseRunnerCore {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string]$RepositoryRoot,
+        [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+\z')][string]$ExpectedVersion,
+        [hashtable]$Adapters
+    )
+    $adapters = Resolve-CcodCleanReleaseRunnerAdapters $Adapters
+    try {
+        $root = [IO.Path]::GetFullPath($RepositoryRoot)
+        $rootItem = Get-Item -LiteralPath $root -Force -ErrorAction Stop
+        if (-not $rootItem.PSIsContainer -or ($rootItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'unsafe root' }
+    } catch {
+        Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_ROOT_INVALID' 'Clean runner requires an existing non-reparse repository directory.' $RepositoryRoot
+    }
+    try {
+        $version = [string](& $adapters.GetPackageVersion $root)
+    } catch {
+        Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_INSPECTION_FAILED' 'Clean runner could not inspect package metadata.' $root
+    }
+    if ([string]::IsNullOrWhiteSpace($version) -or $version -cne $ExpectedVersion) {
+        Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_VERSION_INVALID' 'Repository version does not match the expected clean-runner version.' $version
+    }
+    try {
+        $porcelain = [string](& $adapters.GetGitPorcelain $root)
+    } catch {
+        Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_INSPECTION_FAILED' 'Clean runner could not inspect the repository status.' $root
+    }
+    if (-not [string]::IsNullOrWhiteSpace($porcelain)) {
+        Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_DIRTY' 'Clean runner requires an empty git status.' $porcelain
+    }
+    try {
+        $product = & $adapters.GetProductState $root
+    } catch {
+        Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_INSPECTION_FAILED' 'Clean runner could not inspect installed product state.' $root
+    }
+    if ([bool]$product.InstallRootPresent -or [bool]$product.ScheduledTaskPresent -or [bool]$product.SupervisorPresent -or [bool]$product.TrayHostPresent) {
+        Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_CONTAMINATED' 'Installed product state is present; clean runner performs no cleanup.' $root
+    }
+    foreach ($kind in @('AccountTransition','AccountSupervisor')) {
+        try {
+            $occupied = [bool](& $adapters.ProbeMutex $kind)
+        } catch {
+            Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_INSPECTION_FAILED' "Clean runner could not inspect the $kind mutex." $kind
+        }
+        if ($occupied) {
+            Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_CONTAMINATED' "Occupied $kind mutex; clean runner performs no cleanup." $kind
+        }
+    }
+    try {
+        $commit = [string](& $adapters.GetGitCommit $root)
+    } catch {
+        Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_INSPECTION_FAILED' 'Clean runner could not inspect the repository commit.' $root
+    }
+    if ($commit -notmatch '^[0-9a-fA-F]{40}$') {
+        Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_COMMIT_INVALID' 'Clean runner received an invalid repository commit.' $commit
+    }
+    $commit = $commit.ToLowerInvariant()
+    $record = [ordered]@{
+        schemaVersion = 1
+        valid = $true
+        version = $ExpectedVersion
+        gitCommit = $commit
+        repositoryRoot = $root
+    }
+    $evidencePath = Join-Path $root ("CodexRemote-fix-$ExpectedVersion-clean-preflight.json")
+    try {
+        $path = & $adapters.WritePreflightEvidence $evidencePath $record
+    } catch {
+        Throw-CcodCleanReleaseRunnerError 'CCOD_CLEAN_RUNNER_PREFLIGHT_WRITE_FAILED' 'Clean preflight evidence could not be published.' $evidencePath
+    }
+    return [pscustomobject][ordered]@{
+        Valid = $true
+        Version = $ExpectedVersion
+        GitCommit = $commit
+        RepositoryRoot = $root
+        PreflightPath = $path
+    }
+}
+
+function Test-CcodCleanReleaseRunner {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string]$RepositoryRoot,
+        [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+\z')][string]$ExpectedVersion
+    )
+    Test-CcodCleanReleaseRunnerCore -RepositoryRoot $RepositoryRoot -ExpectedVersion $ExpectedVersion
+}
+
+Export-ModuleMember -Function Test-CcodCleanReleaseRunner

From db0cd798f02cbb74aa0d555784036eacd92554a9 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 4 Sep 2026 09:09:57 +0800
Subject: [PATCH 161/187] docs: record Task 6 release gate verification

---
 .../progress.md                               | 19 +++++-
 .../task-6-fix-round-verification.md          | 65 +++++++++++++++++++
 2 files changed, 83 insertions(+), 1 deletion(-)
 create mode 100644 .superpowers/sdd/2026-08-29-v2522-immutable-generation/task-6-fix-round-verification.md

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md
index e9d9311..03f2262 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md
@@ -393,4 +393,21 @@ identities through the decision; and receipts require production write/read-back
 Frozen verification passed ReleaseWorkflow 63 declared cases, PortableRelease
 5/5, InstallLifecycle 151/151, parser 104/104, diff check, and all 39 aggregate
 suites. No real Defender/build/install/network/release action was performed.
-Task 5 scoped re-review of `fb163b7..9f8a9e7` is required. Tasks 6–8 remain blocked.
+Task 5 scoped re-review of `fb163b7..9f8a9e7` is PASS (Spec Compliance PASS,
+Task Quality PASS, 0 Critical, 0 Important). Original findings 1-4 are closed.
+Task 5 is complete. Task 6 is in progress; Tasks 7-8 remain blocked.
+
+Task 6 fix round is implemented in the current worktree after the first scoped review
+returned 4 Critical and 7 Important findings. The fix adds fail-closed clean-runner
+inspection and create-only preflight evidence; binds prepare/preflight/build/stage to
+one resolved 40-hex commit and transfers preflight as a pinned artifact; removes the
+GitHub environment bypass and pins every gh call to `naipi11/CodexRemote-fix`; uses a
+real same-tag named mutex; separates `defender/`, `verification/`, and `acceptance/`
+evidence; persists and revalidates Verify hashes; and requires exact remote asset/state
+read-back before and after promotion. No live GitHub, Defender, network, publication,
+installation, or reboot action was performed.
+Focused Task 6 slices, full ReleaseWorkflow, Bootstrap 27/27, PowerShell/YAML parsing,
+static security checks, and the formal `npm test` validation all passed. The old
+InstallLifecycle branding assertion was updated to the new draft-tool ownership and
+its standalone suite passed 151. A constrained independent re-review inspected the exact staged Task 6 diff and returned PASS with no findings. The implementation was committed as `6d9bafa96c252ece692e8aff35e420285479b7b6`; the verification report is committed separately. No live GitHub, Defender, network, publication, installation, or reboot action was performed.
+Task 6 fix-round implementation and independent acceptance are complete. Task 7/8 official draft acceptance remains blocked until its own gates are implemented.
diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-6-fix-round-verification.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-6-fix-round-verification.md
new file mode 100644
index 0000000..caeaccf
--- /dev/null
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-6-fix-round-verification.md
@@ -0,0 +1,65 @@
+# Task 6 Fix Round Verification Report
+
+Date: 2026-09-04
+Worktree: `C:\Users\33384\Documents\Codex-Control-other-devices-Windows\.worktrees\codex-v2522-install-runtime-reliability`
+Branch: `codex/v2522-install-runtime-reliability`
+Implementation commit: `6d9bafa96c252ece692e8aff35e420285479b7b6`
+
+## Scope
+
+Task 6 adds a fail-closed clean release runner and a draft-only GitHub release flow. The implementation does not perform a live release. It transfers one immutable commit and clean-runner preflight record, validates the exact eleven-asset contract, creates only a private draft, persists strict verification evidence, and requires separated Defender, verification, and acceptance evidence before promotion.
+
+## TDD evidence
+
+### RED
+
+Command:
+
+```powershell
+powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command '$env:CCOD_TASK6_RED_CASE="fix1-evidence-types"; & (Join-Path (Get-Location) "tests/persistence/ReleaseWorkflow.SelfTest.ps1")'
+```
+
+Observed result: exit code `1`, with `CCOD_SELFTEST_FAILED` and `ASSERT_THROWS: expected CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID`. The failing case proved that a single-element JSON array in a scalar acceptance field was accepted before the fix.
+
+### GREEN
+
+Command:
+
+```powershell
+powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command '$env:CCOD_TASK6_RED_CASE="fix1-evidence-types"; & (Join-Path (Get-Location) "tests/persistence/ReleaseWorkflow.SelfTest.ps1")'
+```
+
+Observed result: exit code `0`; the focused case reported `True` and `Release workflow self-tests passed.`
+
+## Verification results
+
+All commands were run from the exact worktree above.
+
+- `powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File tests/persistence/ReleaseWorkflow.SelfTest.ps1` — exit `0`.
+- `powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File tests/persistence/Bootstrap.SelfTest.ps1` — exit `0`, `27/27`.
+- `powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File tests/persistence/InstallLifecycle.SelfTest.ps1` — exit `0`, `151` passed.
+- `npm test` — exit `0`; `Validation passed: PowerShell, JavaScript, clean-room runtime, package checker, persistence tests, repository files, and package preflight.`
+- PowerShell AST parsing of all changed `.ps1` files — passed.
+- YAML parsing of `ci.yml` and `release.yml` — passed.
+- `git diff --cached --check` and `git diff --check` — passed.
+- Added-line security scan — no hardcoded secret pattern, dangerous eval/shell pattern, floating action reference, or production release bypass.
+- No test, build, GitHub, Defender, installation, reboot, tag, push, or publication action was performed.
+
+## Independent review
+
+A constrained independent reviewer inspected the exact staged Task 6 implementation diff in read-only mode and returned:
+
+```json
+{"verdict":"PASS","findings":[]}
+```
+
+The reviewer reported no file modifications and no external operations. Earlier review attempts that ended with reviewer API HTTP 404 were not counted as acceptance.
+
+## Commit separation
+
+- Implementation commit: `6d9bafa96c252ece692e8aff35e420285479b7b6`.
+- This report and the progress ledger are evidence only and are committed separately after the implementation commit.
+
+## Remaining gates
+
+Task 7/8 official draft acceptance and the real downloaded-asset Defender receipt gate remain blocked. No public release is claimed by this report.

From 325985d691dd7947675c6c9ccdc400446b2e9070 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 4 Sep 2026 09:59:03 +0800
Subject: [PATCH 162/187] fix: restore public release tool module wrappers

---
 tools/Invoke-GitHubDraftRelease.psm1 | 4 ++++
 tools/Test-CleanReleaseRunner.psm1   | 4 ++++
 2 files changed, 8 insertions(+)
 create mode 100644 tools/Invoke-GitHubDraftRelease.psm1
 create mode 100644 tools/Test-CleanReleaseRunner.psm1

diff --git a/tools/Invoke-GitHubDraftRelease.psm1 b/tools/Invoke-GitHubDraftRelease.psm1
new file mode 100644
index 0000000..c71b2cd
--- /dev/null
+++ b/tools/Invoke-GitHubDraftRelease.psm1
@@ -0,0 +1,4 @@
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'Invoke-GitHubDraftRelease.ps1')
+Export-ModuleMember -Function Invoke-CcodGitHubDraftRelease
diff --git a/tools/Test-CleanReleaseRunner.psm1 b/tools/Test-CleanReleaseRunner.psm1
new file mode 100644
index 0000000..9a7ef55
--- /dev/null
+++ b/tools/Test-CleanReleaseRunner.psm1
@@ -0,0 +1,4 @@
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'Test-CleanReleaseRunner.ps1')
+Export-ModuleMember -Function Test-CcodCleanReleaseRunner

From 94994afd7bc7db2d6774ebad77a6cfc61b4c4552 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Fri, 4 Sep 2026 10:00:15 +0800
Subject: [PATCH 163/187] docs: record Task 6 module-boundary correction

---
 .../sdd/2026-08-29-v2522-immutable-generation/progress.md  | 2 +-
 .../task-6-fix-round-verification.md                       | 7 ++++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md
index 03f2262..c36cf5a 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/progress.md
@@ -409,5 +409,5 @@ installation, or reboot action was performed.
 Focused Task 6 slices, full ReleaseWorkflow, Bootstrap 27/27, PowerShell/YAML parsing,
 static security checks, and the formal `npm test` validation all passed. The old
 InstallLifecycle branding assertion was updated to the new draft-tool ownership and
-its standalone suite passed 151. A constrained independent re-review inspected the exact staged Task 6 diff and returned PASS with no findings. The implementation was committed as `6d9bafa96c252ece692e8aff35e420285479b7b6`; the verification report is committed separately. No live GitHub, Defender, network, publication, installation, or reboot action was performed.
+its standalone suite passed 151. A constrained independent re-review inspected the exact staged Task 6 diff and returned PASS with no findings. The implementation was committed as `6d9bafa96c252ece692e8aff35e420285479b7b6`, and the required public module wrappers were restored and verified in corrective commit `325985d9a56bc222be1eb6a73dfb60b6326706da`; the verification report is committed separately. No live GitHub, Defender, network, publication, installation, or reboot action was performed.
 Task 6 fix-round implementation and independent acceptance are complete. Task 7/8 official draft acceptance remains blocked until its own gates are implemented.
diff --git a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-6-fix-round-verification.md b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-6-fix-round-verification.md
index caeaccf..091b69c 100644
--- a/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-6-fix-round-verification.md
+++ b/.superpowers/sdd/2026-08-29-v2522-immutable-generation/task-6-fix-round-verification.md
@@ -4,6 +4,7 @@ Date: 2026-09-04
 Worktree: `C:\Users\33384\Documents\Codex-Control-other-devices-Windows\.worktrees\codex-v2522-install-runtime-reliability`
 Branch: `codex/v2522-install-runtime-reliability`
 Implementation commit: `6d9bafa96c252ece692e8aff35e420285479b7b6`
+Corrective module-boundary commit: `325985d9a56bc222be1eb6a73dfb60b6326706da`
 
 ## Scope
 
@@ -35,7 +36,7 @@ Observed result: exit code `0`; the focused case reported `True` and `Release wo
 
 All commands were run from the exact worktree above.
 
-- `powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File tests/persistence/ReleaseWorkflow.SelfTest.ps1` — exit `0`.
+- `powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File tests/persistence/ReleaseWorkflow.SelfTest.ps1` — exit `0`, including the public-module-boundary and strict evidence-type cases after the corrective module-boundary commit.
 - `powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File tests/persistence/Bootstrap.SelfTest.ps1` — exit `0`, `27/27`.
 - `powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File tests/persistence/InstallLifecycle.SelfTest.ps1` — exit `0`, `151` passed.
 - `npm test` — exit `0`; `Validation passed: PowerShell, JavaScript, clean-room runtime, package checker, persistence tests, repository files, and package preflight.`
@@ -57,8 +58,8 @@ The reviewer reported no file modifications and no external operations. Earlier
 
 ## Commit separation
 
-- Implementation commit: `6d9bafa96c252ece692e8aff35e420285479b7b6`.
-- This report and the progress ledger are evidence only and are committed separately after the implementation commit.
+- Implementation commits: `6d9bafa96c252ece692e8aff35e420285479b7b6` and corrective module-boundary commit `325985d9a56bc222be1eb6a73dfb60b6326706da`.
+- This report and the progress ledger are evidence only and are committed separately after the implementation commits.
 
 ## Remaining gates
 

From 19c8962fd585389009fc55ccab61860bb50604e2 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Thu, 10 Sep 2026 17:04:52 +0800
Subject: [PATCH 164/187] [verified] Harden Windows runtime lifecycle
 reliability

---
 .github/workflows/release.yml                 |    6 +-
 CHANGELOG.md                                  |    8 +-
 Uninstall-CodexControlOtherDevices.ps1        |   53 +-
 .../InstalledUninstallFinalizer.ps1           |  143 +-
 src/persistence/StaticProbeWorker.ps1         |    2 +-
 src/persistence/Supervisor.ps1                |  195 +-
 src/persistence/UninstallBootstrap.ps1        |  104 +-
 src/persistence/bootstrap.ps1                 |    2 +-
 .../modules/GenerationReclamation.psm1        |  396 +-
 src/persistence/modules/RuntimeManifest.psm1  |  157 +-
 tests/Validate.ps1                            |   29 +
 .../Invoke-InstalledLifecycleIntegration.ps1  | 1643 +++++++-
 .../Invoke-OfficialDraftAcceptance.ps1        |  227 +
 tests/installed/OfficialDraftAcceptance.psm1  | 3680 +++++++++++++++++
 tests/persistence/Bootstrap.SelfTest.ps1      |   10 +
 .../persistence/InstallLifecycle.SelfTest.ps1 |   16 +-
 .../InstalledLifecycleHarness.SelfTest.ps1    | 2022 ++++++++-
 tests/persistence/LegacyReleaseFixture.ps1    |   35 +
 tests/persistence/ManualWrappers.SelfTest.ps1 |    2 +-
 ...fficialDraftAcceptanceHarness.SelfTest.ps1 | 3491 ++++++++++++++++
 .../ProductResidueCleanup.SelfTest.ps1        |  348 ++
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 2691 +++++++++++-
 .../persistence/RuntimeManifest.SelfTest.ps1  |  184 +-
 .../StaticProbeWorker.SelfTest.ps1            |   12 +-
 tests/persistence/Supervisor.SelfTest.ps1     |  345 +-
 .../TrustedModuleImport.SelfTest.ps1          |  549 +++
 .../UninstallBootstrap.SelfTest.ps1           |   43 +-
 tools/Invoke-GitHubDraftRelease.ps1           | 1045 ++++-
 tools/Invoke-GitHubDraftRelease.psm1          |  156 +-
 tools/ReleaseAssetContract.psm1               |  290 +-
 tools/ReleaseDefender.psm1                    |  248 +-
 tools/Test-ReleaseDefender.ps1                |  158 +-
 32 files changed, 17689 insertions(+), 601 deletions(-)
 create mode 100644 tests/installed/Invoke-OfficialDraftAcceptance.ps1
 create mode 100644 tests/installed/OfficialDraftAcceptance.psm1
 create mode 100644 tests/persistence/LegacyReleaseFixture.ps1
 create mode 100644 tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1
 create mode 100644 tests/persistence/ProductResidueCleanup.SelfTest.ps1
 create mode 100644 tests/persistence/TrustedModuleImport.SelfTest.ps1

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2aee3c3..41a3509 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -184,6 +184,7 @@ jobs:
         shell: pwsh
         env:
           CCOD_RELEASE_TAG: ${{ needs.build.outputs.tag }}
+          CCOD_RELEASE_COMMIT: ${{ needs.build.outputs.commit }}
         run: |
           npm run test:release-contract
           $tag = $env:CCOD_RELEASE_TAG
@@ -193,7 +194,10 @@ jobs:
           $version = $tag.Substring(1)
           Import-Module (Join-Path $PWD 'tools\ReleaseAssetContract.psm1') -Force
           $names = @(Get-CcodExpectedReleaseAssetNames -Version $version)
-          Test-CcodExactReleaseAssetSet -AssetDirectory (Join-Path $PWD 'build\dist') -Version $version | Out-Null
+          $candidate = Test-CcodExactReleaseAssetSet -AssetDirectory (Join-Path $PWD 'build/dist') -Version $version
+          if ($env:CCOD_RELEASE_COMMIT -cnotmatch '^[0-9a-f]{40}\z' -or $candidate.GitCommit -cne $env:CCOD_RELEASE_COMMIT) {
+            throw 'CCOD_RELEASE_BUILD_COMMIT_MISMATCH'
+          }
           $manifestPath = Join-Path $PWD ('build\dist\CodexRemote-fix-' + $version + '-release-manifest.json')
           Test-CcodReleaseAssetManifest -ManifestPath $manifestPath -AssetDirectory (Join-Path $PWD 'build\dist') -ExpectedVersion $version | Out-Null
           $setupManifestPath = Join-Path $PWD ('build\dist\CodexRemote-fix-' + $version + '-setup-release-manifest.json')
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 81dec8a..ca61f20 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,19 +10,19 @@ No unreleased changes.
 
 ### English
 
-- Bound Setup activation to the exact verified manifest, installer, and module bytes across child launch, then revalidated the selected runtime before reporting Ready.
-- Rejected hard-linked install leaves before writes and added independent Setup PE/provenance validation for version, commit, and the activation payload-manifest hash.
+- Bound Setup activation and Ready reporting to verified manifest, installer, and module bytes; rejected hard-linked install leaves and independently checked Setup PE/provenance against the version, commit, and payload-manifest hash.
 - Added bounded same-root process-tree rereads while preserving strict root and per-process identity checks during close and remote rebind.
 - Correlated native tray actions with the acknowledged presentation revision and durable, bounded terminal diagnostics; stale actions now produce a sanitized support code.
 - Made v2.5.22 candidate promotion require two distinct InternetDownload Defender receipts for the exact Setup and portable ZIP identities; workflow-artifact evidence cannot substitute.
+- Added manifest- and state-verified uninstall residue cleanup with durable retry after partial deletion; unknown files, protected user data, and unavailable process observations block completion instead of being silently ignored.
 
 ### 简体中文
 
-- 将 Setup 激活绑定到跨子进程启动仍保持不变的 manifest、installer 与 module 精确字节，并在报告 Ready 前重新校验所选 runtime。
-- 在写入前拒绝安装目录中的硬链接叶子，并独立校验 Setup PE/构建 provenance 所绑定的版本、commit 与激活 payload-manifest 哈希。
+- 将 Setup 激活与 Ready 报告绑定到已验证的 manifest、installer 和 module 字节；写入前拒绝硬链接叶子，并独立核对 Setup PE/构建 provenance 的版本、commit 与 payload-manifest 哈希。
 - 为同一根进程加入有界 process-tree 重读，同时在关闭和远程重绑定时继续严格校验根进程与每个成员的身份。
 - 将原生托盘操作绑定到已确认的 presentation revision 和持久、有界的终态诊断；过期操作会记录清理后的支持代码。
 - v2.5.22 候选版本只有在精确 Setup 与便携 ZIP 分别具备不同的 InternetDownload Defender 收据后才能提升；工作流产物证据不能替代它们。
+- 新增基于清单与状态核验的卸载残留清理，部分删除后可持久化重试；遇到未知文件、受保护用户数据或无法确认的进程状态时停止，不再静默忽略并报告完成。
 
 ## v2.5.21
 
diff --git a/Uninstall-CodexControlOtherDevices.ps1 b/Uninstall-CodexControlOtherDevices.ps1
index b47a356..2e56ce0 100644
--- a/Uninstall-CodexControlOtherDevices.ps1
+++ b/Uninstall-CodexControlOtherDevices.ps1
@@ -15,6 +15,47 @@ function Throw-CcodPublicUninstallError {
         [InvalidOperationException]::new($Message),$Id,[Management.Automation.ErrorCategory]::InvalidOperation,$Target)
 }
 
+function Invoke-CcodPublicUninstallPrepare {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$Runtime,[Parameter(Mandatory)][string]$Root,[Parameter(Mandatory)][string]$PrepareMode,$Identity)
+    # Dot-source only definitions, then call the function. The script's CLI tail
+    # deliberately exits instead of returning a receipt to a PowerShell caller.
+    . $Path
+    Invoke-CcodUninstallBootstrap -InstallerRoot $Runtime -InstallRoot $Root -Mode $PrepareMode -WrapperIdentity $Identity
+}
+
+function Start-CcodPublicInstalledFinalizer {
+    param([Parameter(Mandatory)][string]$SourceBootstrap,[Parameter(Mandatory)][string]$PayloadRoot,[Parameter(Mandatory)][object[]]$PayloadRecords,[Parameter(Mandatory)][string]$PowerShellPath,[Parameter(Mandatory)][string]$Arguments,[Parameter(Mandatory)][string]$TransactionDirectory)
+    $payloadAuthority=$null;$readyPipe=$null;$child=$null;$handedOff=$false
+    try {
+        . $SourceBootstrap
+        $payloadAuthority=Open-CcodUninstallBootstrapPayloadAuthority -PayloadRoot $PayloadRoot -Records $PayloadRecords
+        $readyPipe=[IO.Pipes.AnonymousPipeServerStream]::new([IO.Pipes.PipeDirection]::In,[IO.HandleInheritability]::Inheritable)
+        $readyHandle=$readyPipe.GetClientHandleAsString()
+        $child=Start-Process -FilePath $PowerShellPath -ArgumentList ($Arguments+' -AuthorityReadyHandle '+$readyHandle) -WindowStyle Hidden -RedirectStandardOutput (Join-Path $TransactionDirectory 'installed-finalizer.stdout.log') -RedirectStandardError (Join-Path $TransactionDirectory 'installed-finalizer.stderr.log') -PassThru -ErrorAction Stop
+        [void]$child.Handle
+        $readyPipe.DisposeLocalCopyOfClientHandle()
+        $buffer=[byte[]]::new(4);$received=0;$clock=[Diagnostics.Stopwatch]::StartNew()
+        while ($received -lt $buffer.Length) {
+            $remaining=15000-[int]$clock.ElapsedMilliseconds
+            if ($remaining -le 0) { throw 'finalizer authority timeout' }
+            $pending=$readyPipe.ReadAsync($buffer,$received,$buffer.Length-$received)
+            if (-not $pending.Wait($remaining) -or $pending.Result -le 0) { throw 'finalizer authority unavailable' }
+            $received+=$pending.Result
+        }
+        if ([BitConverter]::ToInt32($buffer,0) -ne $child.Id) { throw 'finalizer authority identity' }
+        # The exact native child now owns its complete staged payload closure.
+        # These external holds may close; installed holds close before wrapper exit.
+        $handedOff=$true
+        return $child
+    } finally {
+        if ($null -ne $readyPipe) { $readyPipe.Dispose() }
+        if (-not $handedOff -and $null -ne $child) {
+            try { if (-not $child.HasExited) { $child.Kill();$child.WaitForExit() } } finally { $child.Dispose() }
+        }
+        if ($null -ne $payloadAuthority) { $payloadAuthority.Dispose() }
+    }
+}
+
 if ($KeepCurrentSpecialSession -or $BackupDeviceKeyStore -or $RemoveDeviceKeyStore) {
     Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_OPTION_REMOVED' 'Legacy session and device-key uninstall options were removed. The device key remains in place.' $PSBoundParameters
 }
@@ -39,7 +80,7 @@ if ($null -ne $installedRuntimeId -and $installedRuntimeId -cmatch '^2\.5\.22-[0
     if ($bootstrapItem.PSIsContainer -or (($bootstrapItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) { Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_INVALID' 'The sealed generation uninstall bootstrap is unsafe.' $bootstrapPath }
     if (-not $PSCmdlet.ShouldProcess($expectedInstallRoot,'Run manifest-bound cleanup from the selected sealed generation')) { return [pscustomobject][ordered]@{Outcome='WhatIf';KeptDeviceKeyStore=$true} }
     $current=[Diagnostics.Process]::GetCurrentProcess();$windowsIdentity=[Security.Principal.WindowsIdentity]::GetCurrent();try{$wrapperId=[int]$current.Id;$wrapperCreated=$current.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture);$wrapperIdentity=[pscustomobject]@{pid=$wrapperId;creationTimeUtc=$wrapperCreated;sessionId=[int]$current.SessionId;userSid=[string]$windowsIdentity.User.Value}}finally{$current.Dispose();$windowsIdentity.Dispose()}
-    try { $prepared=& $bootstrapPath -InstallerRoot $installerRoot -InstallRoot $expectedInstallRoot -Mode PrepareInstalled -WrapperIdentity $wrapperIdentity }
+    try { $prepared=Invoke-CcodPublicUninstallPrepare -Path $bootstrapPath -Runtime $installerRoot -Root $expectedInstallRoot -PrepareMode PrepareInstalled -Identity $wrapperIdentity }
     catch { Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_PREPARE_FAILED' 'Sealed generation cleanup did not reach its external finalization boundary.' $_ }
     if($null-eq$prepared-or$prepared.transactionId-isnot[string]-or$prepared.transactionId-cnotmatch'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'-or$prepared.phase-cne'TaskRemoved'-or$prepared.runtimeId-cne$installedRuntimeId){Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_PREPARE_FAILED' 'Sealed generation cleanup returned an invalid receipt.' $prepared}
     $transactionRoot=[IO.Path]::GetFullPath((Join-Path $localAppData 'CodexRemote-fix-uninstall'))
@@ -48,10 +89,12 @@ if ($null -ne $installedRuntimeId -and $installedRuntimeId -cmatch '^2\.5\.22-[0
     if(-not[IO.File]::Exists($finalizer)){Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_FINALIZER_MISSING' 'The verified external installed finalizer is missing.' $finalizer}
     $powershellPath=Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'WindowsPowerShell\v1.0\powershell.exe'
     if(-not[IO.File]::Exists($powershellPath)){Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_FINALIZER_MISSING' 'The Windows PowerShell host is unavailable.' $powershellPath}
-    function ConvertTo-CcodInstalledUninstallLiteral([string]$Value){"'"+$Value.Replace("'","''")+"'"}
+    function ConvertTo-CcodInstalledUninstallLiteral([string]$Value){
+        return '"' + ($Value -replace '(\\*)"', '$1$1\"' -replace '(\\+)\z', '$1$1') + '"'
+    }
     $historical=$prepared.installedBinding;$resumeExisting=$null-ne$historical-and([int]$historical.wrapperPid-ne$wrapperId-or[string]$historical.wrapperCreationTimeUtc-cne$wrapperCreated-or[int]$historical.wrapperSessionId-ne[int]$wrapperIdentity.sessionId-or[string]$historical.wrapperUserSid-cne[string]$wrapperIdentity.userSid)
     $arguments=if($resumeExisting){'-NoProfile -NonInteractive -ExecutionPolicy Bypass -File {0} -WrapperResume -TransactionId {1} -RuntimeRoot {2} -InstallRoot {3} -WrapperProcessId {4} -WrapperCreationTimeUtc {5}'-f(ConvertTo-CcodInstalledUninstallLiteral $finalizer),(ConvertTo-CcodInstalledUninstallLiteral $prepared.transactionId),(ConvertTo-CcodInstalledUninstallLiteral $installerRoot),(ConvertTo-CcodInstalledUninstallLiteral $expectedInstallRoot),$wrapperId,(ConvertTo-CcodInstalledUninstallLiteral $wrapperCreated)}else{'-NoProfile -NonInteractive -ExecutionPolicy Bypass -File {0} -TransactionId {1} -RuntimeRoot {2} -InstallRoot {3} -WrapperProcessId {4} -WrapperCreationTimeUtc {5}'-f(ConvertTo-CcodInstalledUninstallLiteral $finalizer),(ConvertTo-CcodInstalledUninstallLiteral $prepared.transactionId),(ConvertTo-CcodInstalledUninstallLiteral $installerRoot),(ConvertTo-CcodInstalledUninstallLiteral $expectedInstallRoot),$wrapperId,(ConvertTo-CcodInstalledUninstallLiteral $wrapperCreated)}
-    try{$process=Start-Process -FilePath $powershellPath -ArgumentList $arguments -WindowStyle Hidden -RedirectStandardOutput (Join-Path $transactionDirectory 'installed-finalizer.stdout.log') -RedirectStandardError (Join-Path $transactionDirectory 'installed-finalizer.stderr.log') -PassThru -ErrorAction Stop}catch{Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_FINALIZER_START_FAILED' 'The external installed finalizer could not be started; application state was retained.' $_}
+    try{$process=Start-CcodPublicInstalledFinalizer -SourceBootstrap $bootstrapPath -PayloadRoot (Join-Path $transactionDirectory 'payload') -PayloadRecords @($prepared.installedBinding.payloadRecords) -PowerShellPath $powershellPath -Arguments $arguments -TransactionDirectory $transactionDirectory}catch{Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_INSTALLED_FINALIZER_START_FAILED' 'The external installed finalizer could not acquire its verified payload; application state was retained.' $_}
     return [pscustomobject][ordered]@{Outcome='InstalledFinalizationStarted';TransactionId=[string]$prepared.transactionId;FinalizerProcessId=[int]$process.Id;KeptDeviceKeyStore=$true}
 }
 $portableMarkerPath = Join-Path $installerRoot 'portable-release.json'
@@ -76,7 +119,7 @@ if ([IO.File]::Exists($portableMarkerPath) -or [IO.Directory]::Exists($portableM
         return [pscustomobject][ordered]@{ Outcome='WhatIf'; KeptDeviceKeyStore=$true }
     }
     try {
-        $prepared = & $bootstrapPath -InstallerRoot $installerRoot -InstallRoot $expectedInstallRoot -Mode Prepare
+        $prepared = Invoke-CcodPublicUninstallPrepare -Path $bootstrapPath -Runtime $installerRoot -Root $expectedInstallRoot -PrepareMode Prepare -Identity $null
     } catch {
         Throw-CcodPublicUninstallError 'CCOD_UNINSTALL_PORTABLE_PREPARE_FAILED' 'Protected portable uninstall cleanup did not reach its finalization boundary.' $_
     }
@@ -100,7 +143,7 @@ if ([IO.File]::Exists($portableMarkerPath) -or [IO.Directory]::Exists($portableM
     }
     function ConvertTo-CcodPublicUninstallPowerShellLiteral {
         param([Parameter(Mandatory)][string]$Value)
-        return "'" + $Value.Replace("'","''") + "'"
+        return '"' + ($Value -replace '(\\*)"', '$1$1\"' -replace '(\\+)\z', '$1$1') + '"'
     }
     $stdoutPath = Join-Path $transactionDirectory 'portable-finalizer.stdout.log'
     $stderrPath = Join-Path $transactionDirectory 'portable-finalizer.stderr.log'
diff --git a/src/persistence/InstalledUninstallFinalizer.ps1 b/src/persistence/InstalledUninstallFinalizer.ps1
index f73aefc..ccae596 100644
--- a/src/persistence/InstalledUninstallFinalizer.ps1
+++ b/src/persistence/InstalledUninstallFinalizer.ps1
@@ -6,13 +6,83 @@ param(
     [Parameter(ParameterSetName='Initial')][Parameter(ParameterSetName='WrapperResume')][int]$WrapperProcessId,
     [Parameter(ParameterSetName='Initial')][Parameter(ParameterSetName='WrapperResume')][string]$WrapperCreationTimeUtc,
     [Parameter(ParameterSetName='WrapperResume')][switch]$WrapperResume,
-    [Parameter(ParameterSetName='Resume')][switch]$Resume
+    [Parameter(ParameterSetName='Resume')][switch]$Resume,
+    [Parameter(ParameterSetName='Initial')][Parameter(ParameterSetName='WrapperResume')][string]$AuthorityReadyHandle
 )
 
 Set-StrictMode -Version Latest
 $ErrorActionPreference='Stop'
 $script:CcodInstalledFinalizerPayloadEntries=@('src/persistence/UninstallBootstrap.ps1','src/persistence/PortableUninstallFinalizer.ps1','src/persistence/InstalledUninstallFinalizer.ps1','src/persistence/modules/GenerationReclamation.psm1','src/persistence/modules/InstallLifecycle.psm1','src/persistence/modules/ProductRegistration.psm1','src/persistence/modules/PortableRelease.psm1','src/persistence/modules/PersistenceIO.psm1','src/persistence/modules/RuntimeManifest.psm1','src/persistence/modules/LifecycleEpoch.psm1','src/persistence/modules/StateStore.psm1','src/persistence/modules/TrustedLogonIdentity.psm1','src/persistence/modules/ScheduledTask.psm1','src/persistence/modules/KernelObjects.psm1','src/persistence/modules/CompatibilityProbe.psm1','src/persistence/modules/UiPreferences.psm1','src/persistence/modules/LifecycleTransaction.psm1')
 
+function Initialize-CcodUninstallPayloadAuthority {
+    if ($null -ne ('CcodUninstallPayloadAuthorityV1' -as [type])) { return }
+    Add-Type -ErrorAction Stop -TypeDefinition @'
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+public sealed class CcodUninstallPayloadAuthorityV1 : IDisposable
+{
+    [StructLayout(LayoutKind.Sequential)] private struct Info
+    {
+        public uint Attributes;
+        public System.Runtime.InteropServices.ComTypes.FILETIME Creation, Access, Write;
+        public uint Volume, SizeHigh, SizeLow, Links, IndexHigh, IndexLow;
+    }
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern SafeFileHandle CreateFileW(string path,uint access,uint share,IntPtr security,uint creation,uint flags,IntPtr template);
+    [DllImport("kernel32.dll", SetLastError=true)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle handle,out Info info);
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern uint GetFinalPathNameByHandleW(SafeFileHandle handle,StringBuilder value,uint length,uint flags);
+    private readonly List<SafeFileHandle> handles = new List<SafeFileHandle>();
+    private readonly HashSet<string> paths = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+    private bool disposed;
+    public void Add(string path)
+    {
+        if(disposed)throw new ObjectDisposedException("uninstall payload authority");
+        if(String.IsNullOrWhiteSpace(path)||!Path.IsPathRooted(path)||path.StartsWith(@"\\?\")||path.StartsWith(@"\\.\"))throw new IOException("Payload path");
+        string full=Path.GetFullPath(path),root=Path.GetPathRoot(full);
+        if(!String.Equals(full,path,StringComparison.OrdinalIgnoreCase)||full.Substring(root.Length).IndexOf(':')>=0)throw new IOException("Payload canonical path");
+        var parents=new List<string>();
+        for(DirectoryInfo parent=Directory.GetParent(full);parent!=null;parent=parent.Parent)parents.Add(parent.FullName);
+        parents.Reverse();
+        foreach(string parent in parents)Open(parent,true);
+        Open(full,false);
+    }
+    private void Open(string path,bool directory)
+    {
+        if(paths.Contains(path))return;
+        uint access=directory?0x00100081U:0x80100080U;
+        uint flags=0x00200000U|(directory?0x02000000U:0U);
+        SafeFileHandle handle=CreateFileW(path,access,1U,IntPtr.Zero,3U,flags,IntPtr.Zero);
+        if(handle.IsInvalid){int error=Marshal.GetLastWin32Error();handle.Dispose();throw new Win32Exception(error);}
+        try{
+            Info info;if(!GetFileInformationByHandle(handle,out info))throw new Win32Exception(Marshal.GetLastWin32Error());
+            if((info.Attributes&0x400U)!=0||((info.Attributes&0x10U)!=0)!=directory||(!directory&&info.Links!=1))throw new IOException("Payload file kind");
+            var value=new StringBuilder(512);uint length=GetFinalPathNameByHandleW(handle,value,(uint)value.Capacity,0);
+            if(length>=value.Capacity){value.Capacity=checked((int)length+1);length=GetFinalPathNameByHandleW(handle,value,(uint)value.Capacity,0);}
+            if(length==0||length>=value.Capacity)throw new IOException("Payload final path unavailable");
+            string final=value.ToString();
+            if(final.StartsWith(@"\\?\UNC\",StringComparison.OrdinalIgnoreCase))final=@"\\"+final.Substring(8);
+            else if(final.StartsWith(@"\\?\",StringComparison.OrdinalIgnoreCase))final=final.Substring(4);
+            if(!String.Equals(final.TrimEnd('\\'),path.TrimEnd('\\'),StringComparison.OrdinalIgnoreCase))throw new IOException("Payload final path mismatch");
+            handles.Add(handle);paths.Add(path);
+        }catch{handle.Dispose();throw;}
+    }
+    public void Dispose()
+    {
+        if(disposed)return;disposed=true;
+        for(int index=handles.Count-1;index>=0;index--)handles[index].Dispose();
+        handles.Clear();paths.Clear();
+    }
+}
+'@
+}
+
 function Throw-CcodInstalledFinalizerError {
     param([string]$Id,[string]$Message,$Target)
     throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new($Message),$Id,[Management.Automation.ErrorCategory]::InvalidData,$Target)
@@ -83,18 +153,51 @@ function Get-CcodInstalledFinalizerAdapters {
         ExitAccountTransition={param($Lease)Import-Module $kernelModule -Force -DisableNameChecking -ErrorAction Stop;[void](Exit-CcodMutex -Lease $Lease)}.GetNewClosure()
         EnterTransactionLock={param($UserSid);. $bootstrap;Enter-CcodUninstallBootstrapTransactionLock -UserSid $UserSid}.GetNewClosure()
         ExitTransactionLock={param($Lock);. $bootstrap;Exit-CcodUninstallBootstrapTransactionLock -Lock $Lock}.GetNewClosure()
-        WaitWrapperExit={param($Identity,$Timeout);$process=Get-Process -Id $Identity.pid -ErrorAction SilentlyContinue;if($null-eq$process){return [pscustomobject]@{verifiedAtStart=$true;exited=$true}};try{if($process.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)-cne$Identity.creationTimeUtc-or[int]$process.SessionId-ne[int]$Identity.sessionId){return [pscustomobject]@{verifiedAtStart=$true;exited=$true}}}finally{$process.Dispose()};$owner=$null;try{$owner=(Get-CimInstance Win32_Process -Filter ('ProcessId='+$Identity.pid)-ErrorAction Stop|Invoke-CimMethod -MethodName GetOwnerSid -ErrorAction Stop)}catch{};if($null-eq$owner-or[int]$owner.ReturnValue-ne0-or[string]$owner.Sid-cne[string]$Identity.userSid){return [pscustomobject]@{verifiedAtStart=$false;exited=$false}};$stopwatch=[Diagnostics.Stopwatch]::StartNew();while($stopwatch.ElapsedMilliseconds-lt$Timeout){$current=Get-Process -Id $Identity.pid -ErrorAction SilentlyContinue;if($null-eq$current){return [pscustomobject]@{verifiedAtStart=$true;exited=$true}};try{if($current.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)-cne$Identity.creationTimeUtc){return [pscustomobject]@{verifiedAtStart=$true;exited=$true}}}finally{$current.Dispose()};Start-Sleep -Milliseconds 100};[pscustomobject]@{verifiedAtStart=$true;exited=$false}}
+        WaitWrapperExit={
+            param($Identity,$Timeout)
+            $observeProcess={
+                param([int]$ProcessId)
+                try {
+                    $observed=@(Get-Process -Id $ProcessId -ErrorAction Stop)
+                } catch {
+                    if($_.CategoryInfo.Category-eq[Management.Automation.ErrorCategory]::ObjectNotFound-and
+                       ([string]$_.FullyQualifiedErrorId-split',')[0]-ceq'NoProcessFoundForGivenId'){return $null}
+                    throw
+                }
+                if($observed.Count-ne1-or$observed[0]-isnot[Diagnostics.Process]){throw 'wrapper process observation is unavailable'}
+                return $observed[0]
+            }
+            $process=&$observeProcess $Identity.pid
+            if($null-eq$process){return [pscustomobject]@{verifiedAtStart=$true;exited=$true}}
+            try {
+                if($process.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)-cne$Identity.creationTimeUtc-or[int]$process.SessionId-ne[int]$Identity.sessionId){return [pscustomobject]@{verifiedAtStart=$true;exited=$true}}
+            } finally {$process.Dispose()}
+            $owner=$null
+            try {$owner=Get-CimInstance Win32_Process -Filter ('ProcessId='+$Identity.pid) -ErrorAction Stop|Invoke-CimMethod -MethodName GetOwnerSid -ErrorAction Stop} catch {}
+            if($null-eq$owner-or[int]$owner.ReturnValue-ne0-or[string]$owner.Sid-cne[string]$Identity.userSid){return [pscustomobject]@{verifiedAtStart=$false;exited=$false}}
+            $stopwatch=[Diagnostics.Stopwatch]::StartNew()
+            while($stopwatch.ElapsedMilliseconds-lt$Timeout){
+                $current=&$observeProcess $Identity.pid
+                if($null-eq$current){return [pscustomobject]@{verifiedAtStart=$true;exited=$true}}
+                try {
+                    if($current.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)-cne$Identity.creationTimeUtc){return [pscustomobject]@{verifiedAtStart=$true;exited=$true}}
+                } finally {$current.Dispose()}
+                Start-Sleep -Milliseconds 100
+            }
+            [pscustomobject]@{verifiedAtStart=$true;exited=$false}
+        }
         ReadPreparedTransaction={param($Id,$ExpectedInstallRoot);. $bootstrap;$identity=Get-CcodUninstallBootstrapCurrentIdentity;$value=Read-CcodUninstallBootstrapStoredTransaction -TransactionRoot $TransactionRoot -ExpectedUserSid $identity.userSid -IncludeCompleted -ExpectedInstallRoot $ExpectedInstallRoot;if($null-eq$value-or$value.transactionId-cne$Id){return $null};$value}.GetNewClosure()
         ValidateStagedPayload={param($Transaction,$Root)Test-CcodInstalledFinalizerStagedPayload -Transaction $Transaction -PayloadRoot $Root}
         ValidateSelectedGeneration={param($SelectedRuntime,$Root,$Transaction);. $bootstrap;$context=Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $SelectedRuntime -InstallRoot $Root -InvocationPath (Join-Path $SelectedRuntime 'src\persistence\UninstallBootstrap.ps1');$manifest=Get-CcodUninstallBootstrapFileFingerprint -Path (Join-Path $SelectedRuntime 'manifest.json');$context.runtimeId-ceq$Transaction.runtimeId-and[uint64]$context.runtimeGeneration-eq[uint64]$Transaction.runtimeGeneration-and$manifest.sha256-ceq$Transaction.installedBinding.runtimeManifestSha256}.GetNewClosure()
-        ReadCurrentEpoch={param($Root);. $bootstrap;$record=Read-CcodUninstallBootstrapJson -Path (Join-Path $Root 'state\lifecycle-epoch.json') -Kind 'Lifecycle epoch';[uint64]$record.epoch}.GetNewClosure()
+        ReadCurrentEpoch={param($Root);$epochPath=Join-Path $Root 'state\lifecycle-epoch.json';try{Get-Item -LiteralPath $epochPath -Force -ErrorAction Stop|Out-Null}catch [Management.Automation.ItemNotFoundException]{return $null};. $bootstrap;$record=Read-CcodUninstallBootstrapJson -Path $epochPath -Kind 'Lifecycle epoch';[uint64]$record.epoch}.GetNewClosure()
         GetSelectedRootState={param($Root)try{$item=Get-Item -LiteralPath $Root -Force -ErrorAction Stop;if($item.PSIsContainer-and($item.Attributes-band[IO.FileAttributes]::ReparsePoint)-eq0){'Present'}else{'Invalid'}}catch [Management.Automation.ItemNotFoundException]{'Absent'}catch{throw}}
         InstallResumeProductRegistration={param($Transaction)Import-Module $productModule -Force -DisableNameChecking -ErrorAction Stop;Set-CcodInstalledUninstallResumeRegistration -Transaction $Transaction|Out-Null}.GetNewClosure()
         GetResumeProductRegistrationState={param($Transaction)Import-Module $productModule -Force -DisableNameChecking -ErrorAction Stop;Get-CcodInstalledUninstallResumeRegistrationState -Transaction $Transaction}.GetNewClosure()
         ReclaimSelectedGeneration={param($SelectedRuntime,$Transaction);$expected=[IO.Path]::GetFullPath([string]$Transaction.installedBinding.selectedRuntimeRoot);if([IO.Path]::GetFullPath($SelectedRuntime)-cne$expected){throw 'selected root changed'};$modulePath=Join-Path $PayloadRoot 'src\persistence\modules\GenerationReclamation.psm1';if(-not[IO.File]::Exists($modulePath)){throw 'generation reclamation module missing'};Import-Module $modulePath -Force -DisableNameChecking -ErrorAction Stop;$reclaimed=Remove-CcodVerifiedGenerationTree -InstallRoot $Transaction.readyEvidence.installRoot -RuntimeRoot $expected -RuntimeId $Transaction.runtimeId -ExpectedManifestSha256 $Transaction.installedBinding.runtimeManifestSha256;if($null-eq$reclaimed-or$reclaimed.phase-cne'Completed'-or$reclaimed.result-cne'Reclaimed'-or$reclaimed.runtimeId-cne$Transaction.runtimeId){throw 'generation reclamation proof invalid'};$reclaimed}.GetNewClosure()
         WriteReadyForInno={param($Transaction);. $bootstrap;$Transaction.phase='ReadyForInno';$Transaction.resumePhase='ReadyForInno';$Transaction.updatedAtUtc=[DateTime]::UtcNow.ToString('o',[Globalization.CultureInfo]::InvariantCulture);$Transaction.errorCode=$null;Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory (Join-Path $TransactionRoot $Transaction.transactionId) -Transaction $Transaction;$Transaction}.GetNewClosure()
         RemoveMatchedProductShortcuts={param($Transaction)Import-Module $productModule -Force -DisableNameChecking -ErrorAction Stop;Remove-CcodInstalledUninstallProductShortcuts -Transaction $Transaction|Out-Null}.GetNewClosure()
-        FinalizeReceipt={param($Transaction);$runtimeForReceipt=$finalizerRuntimeRoot;$installForReceipt=$finalizerInstallRoot;$bootstrapForReceipt=$stagedBootstrapPath;. $bootstrapForReceipt;$validation={param($Root,$Value,$Identity)Assert-CcodUninstallBootstrapFinalizationInvocation -TransactionRoot $Root -Transaction $Value -Identity $Identity -InvocationPath $bootstrapForReceipt};$absence={param($Root)try{$item=Get-Item -LiteralPath $Root -Force -ErrorAction Stop;return $false}catch [Management.Automation.ItemNotFoundException]{return $true}catch{throw}};Invoke-CcodUninstallBootstrap -InstallerRoot $runtimeForReceipt -InstallRoot $installForReceipt -Mode FinalizeReceipt -Adapters @{ValidateFinalizationInvocation=$validation;TestInstallRootAbsent=$absence}}.GetNewClosure()
+        CleanupProductResidue={param($Transaction);Import-Module (Join-Path $PayloadRoot 'src\persistence\modules\GenerationReclamation.psm1') -Force -DisableNameChecking -ErrorAction Stop;Remove-CcodVerifiedProductResidue -InstallRoot $finalizerInstallRoot -SelectedRuntimeId $Transaction.runtimeId -ExpectedEpoch ([uint64]$Transaction.leaseEpoch) -TransactionDirectory (Join-Path $TransactionRoot $Transaction.transactionId) -TransactionId $Transaction.transactionId}.GetNewClosure()
+        FinalizeReceipt={param($Transaction);$installForReceipt=$finalizerInstallRoot;$bootstrapForReceipt=$stagedBootstrapPath;. $bootstrapForReceipt;$validation={param($Root,$Value,$Identity)Assert-CcodUninstallBootstrapFinalizationInvocation -TransactionRoot $Root -Transaction $Value -Identity $Identity -InvocationPath $bootstrapForReceipt};$absence={param($Root)try{Get-Item -LiteralPath $Root -Force -ErrorAction Stop|Out-Null;return $false}catch [Management.Automation.ItemNotFoundException]{return $true}catch{throw}};Invoke-CcodUninstallBootstrap -InstallerRoot $installForReceipt -InstallRoot $installForReceipt -Mode FinalizeReceipt -Adapters @{ValidateFinalizationInvocation=$validation;TestInstallRootAbsent=$absence}}.GetNewClosure()
         TestCompletedReceipt={param($Transaction);. $bootstrap;$identity=Get-CcodUninstallBootstrapCurrentIdentity;Test-CcodUninstallBootstrapStoredCompletedReceipt -TransactionRoot $TransactionRoot -Transaction $Transaction -ExpectedUserSid $identity.userSid}.GetNewClosure()
         RemoveResumeProductRegistration={param($Transaction)Import-Module $productModule -Force -DisableNameChecking -ErrorAction Stop;Remove-CcodInstalledUninstallResumeRegistration -Transaction $Transaction -CompletedReceiptProven}.GetNewClosure()
     }
@@ -120,10 +223,28 @@ function Assert-CcodInstalledFinalizerTransactionBinding {
 }
 
 function Invoke-CcodInstalledUninstallFinalizer {
-    param([Parameter(Mandatory)][string]$TransactionId,[Parameter(Mandatory)][string]$RuntimeRoot,[Parameter(Mandatory)][string]$InstallRoot,[AllowNull()]$WrapperIdentity,[switch]$Resume,[switch]$WrapperResume,[hashtable]$Adapters)
+    param([Parameter(Mandatory)][string]$TransactionId,[Parameter(Mandatory)][string]$RuntimeRoot,[Parameter(Mandatory)][string]$InstallRoot,[AllowNull()]$WrapperIdentity,[switch]$Resume,[switch]$WrapperResume,[hashtable]$Adapters,[string]$AuthorityReadyHandle)
     if(($Resume-and$WrapperResume)-or$TransactionId-cnotmatch'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'-or-not[IO.Path]::IsPathRooted($RuntimeRoot)-or-not[IO.Path]::IsPathRooted($InstallRoot)-or(-not$Resume-and-not(Test-CcodInstalledFinalizerIdentity $WrapperIdentity))){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer inputs are invalid' $TransactionId}
     $runtime=[IO.Path]::GetFullPath($RuntimeRoot);$install=[IO.Path]::GetFullPath($InstallRoot);$local=Get-CcodInstalledFinalizerLocalAppData;$transactionRoot=[IO.Path]::GetFullPath((Join-Path $local 'CodexRemote-fix-uninstall'));$payloadRoot=[IO.Path]::GetFullPath((Join-Path (Join-Path $transactionRoot $TransactionId) 'payload'))
-    if($null-eq$Adapters){$expectedSelf=[IO.Path]::GetFullPath((Join-Path $payloadRoot 'src\persistence\InstalledUninstallFinalizer.ps1'));if([string]::IsNullOrWhiteSpace($PSCommandPath)-or[IO.Path]::GetFullPath($PSCommandPath)-cne$expectedSelf){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer is outside the durable staged payload' $PSCommandPath};[void](Read-CcodInstalledFinalizerEnvelope -TransactionRoot $transactionRoot -TransactionId $TransactionId -PayloadRoot $payloadRoot -RuntimeRoot $runtime -InstallRoot $install)}
+    $payloadAuthority=$null
+    try {
+    if($null-eq$Adapters){
+        $expectedSelf=[IO.Path]::GetFullPath((Join-Path $payloadRoot 'src\persistence\InstalledUninstallFinalizer.ps1'))
+        if([string]::IsNullOrWhiteSpace($PSCommandPath)-or[IO.Path]::GetFullPath($PSCommandPath)-cne$expectedSelf){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed finalizer is outside the durable staged payload' $PSCommandPath}
+        # Bootstrap independently: no pathname-loaded dependency may establish
+        # its own authority. Retain the complete external closure through cleanup.
+        try {
+            Initialize-CcodUninstallPayloadAuthority
+            $payloadAuthority=[CcodUninstallPayloadAuthorityV1]::new()
+            foreach($relative in $script:CcodInstalledFinalizerPayloadEntries){$payloadAuthority.Add([IO.Path]::GetFullPath((Join-Path $payloadRoot $relative)))}
+        } catch { Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Staged finalizer payload could not be pinned before validation.' $null }
+        [void](Read-CcodInstalledFinalizerEnvelope -TransactionRoot $transactionRoot -TransactionId $TransactionId -PayloadRoot $payloadRoot -RuntimeRoot $runtime -InstallRoot $install)
+        if(-not[string]::IsNullOrEmpty($AuthorityReadyHandle)){
+            if($Resume-or$AuthorityReadyHandle-cnotmatch'^[1-9][0-9]{0,18}\z'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Finalizer authority handle is invalid.' $null}
+            $readyPipe=[IO.Pipes.AnonymousPipeClientStream]::new([IO.Pipes.PipeDirection]::Out,$AuthorityReadyHandle)
+            try{$bytes=[BitConverter]::GetBytes([int]$PID);$readyPipe.Write($bytes,0,$bytes.Length);$readyPipe.Flush()}finally{$readyPipe.Dispose()}
+        }
+    }
     $adapter=Get-CcodInstalledFinalizerAdapters -Adapters $Adapters -TransactionRoot $transactionRoot -PayloadRoot $payloadRoot -RuntimeRoot $runtime -InstallRoot $install;$caller=&$adapter.GetCurrentIdentity
     if($null-eq$caller-or$caller.userSid-isnot[string]-or$caller.userSid-cnotmatch'^S-1-'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Current resume caller identity is invalid' $caller}
     $accountLease=$null;$lock=$null
@@ -135,7 +256,8 @@ function Invoke-CcodInstalledUninstallFinalizer {
         $transaction=&$adapter.ReadPreparedTransaction $TransactionId $install
         $phase=Assert-CcodInstalledFinalizerTransactionBinding -Transaction $transaction -TransactionId $TransactionId -RuntimeRoot $runtime -InstallRoot $install -CallerIdentity $caller -WrapperIdentity $WrapperIdentity -IsResume ([bool]$Resume) -IsWrapperResume ([bool]$WrapperResume) -PayloadRoot $payloadRoot
         if(-not(&$adapter.ValidateStagedPayload $transaction $payloadRoot)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Durable staged uninstall payload is invalid' $payloadRoot}
-        if([uint64](&$adapter.ReadCurrentEpoch $install)-ne[uint64]$transaction.leaseEpoch){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Lifecycle epoch no longer matches the uninstall transaction' $install}
+        $observedEpoch=&$adapter.ReadCurrentEpoch $install
+        if(($null-eq$observedEpoch-and$phase-ceq'TaskRemoved')-or($null-ne$observedEpoch-and[uint64]$observedEpoch-ne[uint64]$transaction.leaseEpoch)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Lifecycle epoch no longer matches the uninstall transaction' $install}
 
         if(-not$Resume){$wrapperExit=&$adapter.WaitWrapperExit $WrapperIdentity 15000;if($null-eq$wrapperExit-or$wrapperExit.verifiedAtStart-isnot[bool]-or-not$wrapperExit.verifiedAtStart-or$wrapperExit.exited-isnot[bool]-or-not$wrapperExit.exited){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed wrapper was not verified before its exact exit' $WrapperIdentity}}
         $resumeAnchorState=if($Resume){[string](&$adapter.GetResumeProductRegistrationState $transaction)}else{'Invalid'}
@@ -157,6 +279,8 @@ function Invoke-CcodInstalledUninstallFinalizer {
         }
         if($phase-ceq'ReadyForInno'){
             if([string](&$adapter.GetResumeProductRegistrationState $transaction)-cne'Exact'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Product tail lacks its durable public resume entry' $TransactionId}
+            $cleanup=&$adapter.CleanupProductResidue $transaction
+            if($null-eq$cleanup-or$cleanup.phase-cne'Completed'-or$cleanup.result-cne'Removed'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Bounded product residue cleanup was not proven' $TransactionId}
             &$adapter.RemoveMatchedProductShortcuts $transaction
             if([string](&$adapter.GetResumeProductRegistrationState $transaction)-cne'Exact'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Public resume entry disappeared before completion receipt' $TransactionId}
             [void](&$adapter.FinalizeReceipt $transaction)
@@ -164,14 +288,17 @@ function Invoke-CcodInstalledUninstallFinalizer {
             $phase=Assert-CcodInstalledFinalizerTransactionBinding -Transaction $transaction -TransactionId $TransactionId -RuntimeRoot $runtime -InstallRoot $install -CallerIdentity $caller -WrapperIdentity $WrapperIdentity -IsResume $true -IsWrapperResume $false -PayloadRoot $payloadRoot
         }
         if($phase-cne'Completed'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Installed uninstall tail did not reach Completed' $TransactionId}
+        $cleanup=&$adapter.CleanupProductResidue $transaction
+        if($null-eq$cleanup-or$cleanup.phase-cne'Completed'-or$cleanup.result-cne'Removed'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Completed uninstall product root is not absent' $TransactionId}
         if(-not(&$adapter.TestCompletedReceipt $transaction)){[void](&$adapter.FinalizeReceipt $transaction);$transaction=&$adapter.ReadPreparedTransaction $TransactionId $install;if(-not(&$adapter.TestCompletedReceipt $transaction)){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Completed receipt is not durable' $TransactionId}}
         $completedAnchor=[string](&$adapter.GetResumeProductRegistrationState $transaction);if($completedAnchor-ceq'Exact'){[void](&$adapter.RemoveResumeProductRegistration $transaction)}elseif($completedAnchor-cne'Absent'){Throw-CcodInstalledFinalizerError 'CCOD_INSTALLED_FINALIZER_INVALID' 'Completed uninstall has an invalid final public anchor' $TransactionId}
         return $transaction
     }finally{if($null-ne$accountLease){&$adapter.ExitAccountTransition $accountLease};if($null-ne$lock){&$adapter.ExitTransactionLock $lock}}
+    } finally { if($null-ne$payloadAuthority){$payloadAuthority.Dispose()} }
 }
 
 if($MyInvocation.InvocationName-ne'.'){
     $identity=$null
     if(-not$Resume){$currentIdentity=[Security.Principal.WindowsIdentity]::GetCurrent();$process=[Diagnostics.Process]::GetCurrentProcess();try{$identity=[pscustomobject]@{pid=[int]$WrapperProcessId;creationTimeUtc=$WrapperCreationTimeUtc;sessionId=[int]$process.SessionId;userSid=[string]$currentIdentity.User.Value}}finally{$process.Dispose();$currentIdentity.Dispose()}}
-    try{Invoke-CcodInstalledUninstallFinalizer -TransactionId $TransactionId -RuntimeRoot $RuntimeRoot -InstallRoot $InstallRoot -WrapperIdentity $identity -Resume:$Resume -WrapperResume:$WrapperResume|Out-Null;exit 0}catch{[Console]::Error.WriteLine([string]$_.FullyQualifiedErrorId);exit 3}
+    try{Invoke-CcodInstalledUninstallFinalizer -TransactionId $TransactionId -RuntimeRoot $RuntimeRoot -InstallRoot $InstallRoot -WrapperIdentity $identity -Resume:$Resume -WrapperResume:$WrapperResume -AuthorityReadyHandle $AuthorityReadyHandle|Out-Null;exit 0}catch{[Console]::Error.WriteLine([string]$_.FullyQualifiedErrorId);exit 3}
 }
diff --git a/src/persistence/StaticProbeWorker.ps1 b/src/persistence/StaticProbeWorker.ps1
index a976c32..7adb9b7 100644
--- a/src/persistence/StaticProbeWorker.ps1
+++ b/src/persistence/StaticProbeWorker.ps1
@@ -432,7 +432,7 @@ function Test-CcodStaticManifestPath {
 function Get-CcodStaticRuntimeIdFromRecords {
     param([string]$ProjectVersion,[object[]]$Files,[string]$ExpectedRuntimeId)
     $lines=[Collections.Generic.List[string]]::new()
-    foreach($file in $Files){$lines.Add(('{0}`t{1}`t{2}' -f [string]$file.path,[int64]$file.length,[string]$file.sha256))}
+    foreach($file in $Files){$lines.Add(("{0}`t{1}`t{2}" -f [string]$file.path,[int64]$file.length,[string]$file.sha256))}
     $canonical=$lines -join "`n";$sha=[Security.Cryptography.SHA256]::Create()
     try{$digest=[BitConverter]::ToString($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes($canonical))).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()}
     $match=[regex]::Match($ExpectedRuntimeId,'^(?<version>[A-Za-z0-9][A-Za-z0-9._-]{0,45})-(?<digest>[0-9a-f]{16})-(?<nonce>[0-9a-f]{32})$');if(-not$match.Success-or$match.Groups['version'].Value-cne$ProjectVersion){Throw-CcodStaticProbeError 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Runtime identity format is invalid' $ExpectedRuntimeId}
diff --git a/src/persistence/Supervisor.ps1 b/src/persistence/Supervisor.ps1
index 47219a1..1e8c725 100644
--- a/src/persistence/Supervisor.ps1
+++ b/src/persistence/Supervisor.ps1
@@ -9,7 +9,7 @@ Set-StrictMode -Version 2.0
 $script:CcodSupervisorScriptPath=if([string]::IsNullOrWhiteSpace($PSCommandPath)){$null}else{[IO.Path]::GetFullPath($PSCommandPath)}
 $script:CcodSupervisorLogPath=$null
 $script:CcodSupervisorAdapterNames=@(
-    'GetIdentity','ResolveLayout','StartClock','GetElapsedMilliseconds','GetUtcNow','Delay',
+    'GetIdentity','GetTrayHostIdentity','ResolveLayout','StartClock','GetElapsedMilliseconds','GetUtcNow','Delay',
     'EnterLease','ExitLease','OpenReadyEvent','OpenShutdownEvent','IsEventSignaled','SignalEvent','CloseEvent',
     'ReadActiveRuntime','GetTrustedLogonIdentity','WriteSafeExitIntent','ClearSafeExitIntent','EnterLifecycleOwnership','AssertLifecycleFence','SuspendLifecycleOwnership','ResumeLifecycleOwnership','ExitLifecycleOwnership','OpenLifecycleWakeEvent','ResetLifecycleWakeEvent',
     'ReadLifecycleRequest','ReceiveLifecycleSubmissions','WriteLifecycleSubmissionReceipt','NewLifecycleRequest','WriteLifecycleRequest','MoveLifecyclePhase','CompleteLifecycleRequest','GetLifecycleStep','ReduceLifecycleWorkerResult','NewLifecycleWorkerRequest','AssertLifecycleWorkerResult',
@@ -31,8 +31,18 @@ $script:CcodSupervisorCleanupAllowlist=@(
     'CCOD_SUPERVISOR_WORKER_TERMINATE_FAILED','CCOD_SUPERVISOR_WORKER_DISPOSE_FAILED','CCOD_SUPERVISOR_WORKER_FILE_DELETE_FAILED',
     'CCOD_SUPERVISOR_WORKER_SURVIVED',
     'CCOD_SUPERVISOR_WATCHER_STOP_FAILED','CCOD_SUPERVISOR_QUEUE_DRAIN_FAILED','CCOD_SUPERVISOR_TRAY_CLOSE_FAILED',
-    'CCOD_SUPERVISOR_READY_CLOSE_FAILED','CCOD_SUPERVISOR_SHUTDOWN_CLOSE_FAILED','CCOD_SUPERVISOR_LOCAL_RELEASE_FAILED',
-    'CCOD_SUPERVISOR_LIFECYCLE_WAKE_CLOSE_FAILED','CCOD_SUPERVISOR_LIFECYCLE_RELEASE_FAILED','CCOD_SUPERVISOR_ACCOUNT_RELEASE_FAILED'
+    'CCOD_SUPERVISOR_READY_CLOSE_FAILED','CCOD_SUPERVISOR_SHUTDOWN_CLOSE_FAILED','CCOD_SUPERVISOR_LOCAL_RELEASE_FAILED','CCOD_SUPERVISOR_TRAY_READY_LOG_FAILED',
+    'CCOD_SUPERVISOR_LIFECYCLE_WAKE_CLOSE_FAILED','CCOD_SUPERVISOR_LIFECYCLE_RELEASE_FAILED','CCOD_SUPERVISOR_ACCOUNT_RELEASE_FAILED','CCOD_SUPERVISOR_SAFE_EXIT_RECOVERY_PERSIST_FAILED'
+)
+$script:CcodSupervisorTrayCleanupAllowlist=@(
+    'CCOD_TRAY_CLEANUP_ICON_HIDE_FAILED','CCOD_TRAY_CLEANUP_TIMER_STOP_FAILED','CCOD_TRAY_CLEANUP_TIMER_DISPOSE_FAILED',
+    'CCOD_TRAY_CLEANUP_ICON_DISPOSE_FAILED','CCOD_TRAY_CLEANUP_MENU_DISPOSE_FAILED','CCOD_TRAY_CLEANUP_ICON_CLONE_DISPOSE_FAILED',
+    'CCOD_TRAY_CLEANUP_CONTROL_DISPOSE_FAILED','CCOD_TRAY_CLEANUP_CALLBACK_DETACH_FAILED','CCOD_TRAY_CLEANUP_CONTEXT_EXIT_FAILED','CCOD_TRAY_CLEANUP_CONTEXT_DISPOSE_FAILED',
+    'CCOD_TRAY_CLEANUP_NATIVE_MENU_END_FAILED','CCOD_TRAY_CLEANUP_NATIVE_MENU_OWNER_DISPOSE_FAILED'
+)
+$script:CcodSupervisorWatcherCleanupAllowlist=@(
+    'CCOD_WATCHER_CLEANUP_ATTEMPT_FAILED','CCOD_WATCHER_CLEANUP_CALLBACK_DETACH_FAILED','CCOD_WATCHER_CLEANUP_UNREGISTER_FAILED',
+    'CCOD_WATCHER_CLEANUP_JOB_REMOVE_FAILED','CCOD_WATCHER_CLEANUP_RESOURCE_DISPOSE_FAILED','CCOD_WATCHER_CLEANUP_QUEUE_DRAIN_FAILED','CCOD_WATCHER_CLEANUP_QUEUE_DRAIN_LIMIT'
 )
 
 function Get-CcodSupervisorAdapterNames {
@@ -42,11 +52,11 @@ function Get-CcodSupervisorAdapterNames {
 function Test-CcodSupervisorExactProperties {
     param($Value,[string[]]$Names)
     try{
-        if($null -eq $Value -or $Value -isnot [pscustomobject]){return $false}
+        if($null -eq $Value -or $Value -is [Collections.IDictionary] -or $Value -is [array]){return $false}
         $actual=@($Value.PSObject.Properties.Name)
         if($actual.Count -ne $Names.Count){return $false}
         for($index=0;$index -lt $Names.Count;$index++){
-            if($actual[$index] -cne $Names[$index] -or $Value.PSObject.Properties[$actual[$index]].MemberType -ne [Management.Automation.PSMemberTypes]::NoteProperty){return $false}
+            if($actual[$index] -cne $Names[$index] -or $Value.PSObject.Properties[$actual[$index]].MemberType -notin @([Management.Automation.PSMemberTypes]::NoteProperty,[Management.Automation.PSMemberTypes]::Property)){return $false}
         }
         return $true
     }catch{return $false}
@@ -85,7 +95,7 @@ function Test-CcodSupervisorStaticProbeResult {
             if($probe.$name -isnot [string] -or [string]::IsNullOrWhiteSpace($probe.$name) -or $probe.$name -match '[\r\n]'){return $false}
         }
         foreach($name in $signatureFields){if($probe.signatures.$name -isnot [bool]){return $false}}
-        if($probe.appAsarSha256 -cnotmatch '^[0-9a-f]{64}$' -or $probe.nodeVersion -cnotmatch '^v(?<major>[0-9]+)\.[0-9]+\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$' -or [int]$Matches.major -ne $probe.nodeMajor){return $false}
+        if($probe.appAsarSha256 -cnotmatch '^[0-9a-f]{64}\z' -or $probe.nodeVersion -cnotmatch '^v(?<major>[0-9]+)\.[0-9]+\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?\z' -or [int]$Matches.major -ne $probe.nodeMajor){return $false}
         $allSentinels=@($signatureFields|Where-Object{-not $probe.signatures.$_}).Count -eq 0
         return ($probe.staticClassification -ceq 'CandidateCompatible' -and $probe.ready -and $probe.affectedBuildDetected -and $allSentinels) -or
                ($probe.staticClassification -ceq 'NativeModulePresent' -and -not $probe.ready -and -not $probe.affectedBuildDetected -and $probe.nativeModulePresent -and -not $allSentinels) -or
@@ -95,7 +105,7 @@ function Test-CcodSupervisorStaticProbeResult {
 
 function Test-CcodSupervisorCanonicalUtc {
     param($Value)
-    if($Value -isnot [string] -or $Value -cnotmatch '^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{7}Z$'){return $false}
+    if($Value -isnot [string] -or $Value -cnotmatch '^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{7}Z\z'){return $false}
     $parsed=[DateTime]::MinValue
     return [DateTime]::TryParseExact($Value,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind,[ref]$parsed) -and
         $parsed.Kind -eq [DateTimeKind]::Utc -and $parsed.ToString('o',[Globalization.CultureInfo]::InvariantCulture) -ceq $Value
@@ -220,7 +230,7 @@ function Resolve-CcodSupervisorLayout {
 
 function New-CcodSupervisorLifecycleWakeEvent {
     param([string]$UserSid,[int]$SessionId)
-    if($UserSid -cnotmatch '^S-\d-\d+(?:-\d+)+$' -or $SessionId -lt 0){throw 'lifecycle wake identity is invalid'}
+    if($UserSid -cnotmatch '^S-\d-\d+(?:-\d+)+\z' -or $SessionId -lt 0){throw 'lifecycle wake identity is invalid'}
     $name="Local\CodexControlOtherDevices.LifecycleWake.$UserSid.$SessionId"
     $created=$false;$handle=$null
     try{
@@ -244,6 +254,7 @@ function Get-CcodSupervisorDefaultAdapters {
             [pscustomobject][ordered]@{UserSid=$windowsIdentity.User.Value;SessionId=[int]$process.SessionId;Pid=[int]$process.Id;CreationTimeUtc=$process.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)}
         }finally{if($null -ne $process){$process.Dispose()};if($null -ne $windowsIdentity){$windowsIdentity.Dispose()}}
     }
+    $defaults.GetTrayHostIdentity={param($ProcessId,$ExpectedCreationTimeUtc)Get-CcodProcessIdentityObservation -ProcessId ([int]$ProcessId) -ExpectedCreationTimeUtc ([string]$ExpectedCreationTimeUtc)}
     $defaults.ResolveLayout={Resolve-CcodSupervisorLayout}
     $defaults.StartClock={[Diagnostics.Stopwatch]::StartNew()}
     $defaults.GetElapsedMilliseconds={param($Clock)[long]$Clock.ElapsedMilliseconds}
@@ -413,7 +424,7 @@ function Get-CcodSupervisorAdapters {
 function Test-CcodSupervisorIdentity {
     param($Identity)
     return (Test-CcodSupervisorExactProperties $Identity @('UserSid','SessionId','Pid','CreationTimeUtc')) -and
-        $Identity.UserSid -is [string] -and $Identity.UserSid -cmatch '^S-1-(?:\d+-){1,14}\d+$' -and
+        $Identity.UserSid -is [string] -and $Identity.UserSid -cmatch '^S-1-(?:\d+-){1,14}\d+\z' -and
         $Identity.SessionId -is [int] -and $Identity.SessionId -ge 0 -and $Identity.Pid -is [int] -and $Identity.Pid -gt 0 -and
         (Test-CcodSupervisorCanonicalUtc $Identity.CreationTimeUtc)
 }
@@ -421,7 +432,7 @@ function Test-CcodSupervisorIdentity {
 function Test-CcodSupervisorLayout {
     param($Layout)
     $names=@('InstallRoot','RuntimeRoot','RuntimeId','StateRoot','WorkersRoot','ControllerPath','StaticWorkerPath','LifecycleWorkerPath','PowerShellPath','LogDirectory','TransitionPath')
-    if(-not (Test-CcodSupervisorExactProperties $Layout $names) -or $Layout.RuntimeId -isnot [string] -or $Layout.RuntimeId -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$'){return $false}
+    if(-not (Test-CcodSupervisorExactProperties $Layout $names) -or $Layout.RuntimeId -isnot [string] -or $Layout.RuntimeId -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,127}\z'){return $false}
     foreach($name in $names|Where-Object{$_ -ne 'RuntimeId'}){
         $value=$Layout.$name;$full=$null
         if($value -isnot [string]){return $false}
@@ -464,6 +475,28 @@ function Invoke-CcodSupervisorCleanupStage {
     try{& $Action}catch{Add-CcodSupervisorCleanupCode $Codes $Code}
 }
 
+function Add-CcodSupervisorNestedCleanupReceipt {
+    param([Collections.Generic.List[string]]$Codes,$Receipt,[ValidateSet('Tray','Watcher')][string]$Kind)
+    if($null -eq $Receipt){throw 'nested cleanup receipt is missing'}
+    $nestedCodes=@();$hasFailure=$false
+    if($Kind -ceq 'Tray' -and (Test-CcodSupervisorExactProperties $Receipt @('Closed','ErrorCode'))){
+        if($Receipt.Closed -isnot [bool] -or -not $Receipt.Closed -or
+           ($null -ne $Receipt.ErrorCode -and ($Receipt.ErrorCode -isnot [string] -or $Receipt.ErrorCode -cnotmatch '^CCOD_[A-Z0-9_]{1,91}\z'))){throw 'tray host close receipt is invalid'}
+        $hasFailure=$null -ne $Receipt.ErrorCode
+    }elseif($Kind -ceq 'Tray' -and (Test-CcodSupervisorExactProperties $Receipt @('SchemaVersion','Closed','CleanupCodes'))){
+        if($Receipt.SchemaVersion -isnot [int] -or $Receipt.SchemaVersion -ne 1 -or $Receipt.Closed -isnot [bool] -or -not $Receipt.Closed -or $Receipt.CleanupCodes -isnot [array]){throw 'tray close receipt is invalid'}
+        $nestedCodes=@($Receipt.CleanupCodes)
+        foreach($code in $nestedCodes){if($code -isnot [string] -or $script:CcodSupervisorTrayCleanupAllowlist -cnotcontains $code){throw 'tray close cleanup code is invalid'}}
+        $hasFailure=$nestedCodes.Count -gt 0
+    }elseif($Kind -ceq 'Watcher' -and (Test-CcodSupervisorExactProperties $Receipt @('SchemaVersion','Stopped','CleanupCodes'))){
+        if($Receipt.SchemaVersion -isnot [int] -or $Receipt.SchemaVersion -ne 1 -or $Receipt.Stopped -isnot [bool] -or -not $Receipt.Stopped -or $Receipt.CleanupCodes -isnot [array]){throw 'watcher stop receipt is invalid'}
+        $nestedCodes=@($Receipt.CleanupCodes)
+        foreach($code in $nestedCodes){if($code -isnot [string] -or $script:CcodSupervisorWatcherCleanupAllowlist -cnotcontains $code){throw 'watcher cleanup code is invalid'}}
+        $hasFailure=$nestedCodes.Count -gt 0
+    }else{throw 'nested cleanup receipt schema is invalid'}
+    if($hasFailure){$supervisorCode=if($Kind -ceq 'Tray'){'CCOD_SUPERVISOR_TRAY_CLOSE_FAILED'}else{'CCOD_SUPERVISOR_WATCHER_STOP_FAILED'};Add-CcodSupervisorCleanupCode $Codes $supervisorCode}
+}
+
 function Get-CcodSupervisorRemainingBudget {
     param($Clock,[hashtable]$Adapters)
     $elapsed=Invoke-CcodSupervisorAdapter $Adapters.GetElapsedMilliseconds @($Clock) 1
@@ -517,8 +550,8 @@ function Get-CcodSupervisorNowUtc {
 function Test-CcodSupervisorActiveRuntime {
     param($Pointer,[string]$RuntimeId)
     return (Test-CcodSupervisorExactProperties $Pointer @('schemaVersion','activeRuntime','previousRuntime','generation','updatedAtUtc')) -and
-        ($Pointer.schemaVersion -is [int] -or $Pointer.schemaVersion -is [int64] -or $Pointer.schemaVersion -is [long]) -and [int]$Pointer.schemaVersion -eq 2 -and $Pointer.activeRuntime -is [string] -and $Pointer.activeRuntime -cmatch '^[A-Za-z0-9._-]{1,96}$' -and $Pointer.activeRuntime -ceq $RuntimeId -and
-        ($null -eq $Pointer.previousRuntime -or ($Pointer.previousRuntime -is [string] -and $Pointer.previousRuntime -cmatch '^[A-Za-z0-9._-]{1,96}$')) -and
+        ($Pointer.schemaVersion -is [int] -or $Pointer.schemaVersion -is [int64] -or $Pointer.schemaVersion -is [long]) -and [int]$Pointer.schemaVersion -eq 2 -and $Pointer.activeRuntime -is [string] -and $Pointer.activeRuntime -cmatch '^[A-Za-z0-9._-]{1,96}\z' -and $Pointer.activeRuntime -ceq $RuntimeId -and
+        ($null -eq $Pointer.previousRuntime -or ($Pointer.previousRuntime -is [string] -and $Pointer.previousRuntime -cmatch '^[A-Za-z0-9._-]{1,96}\z')) -and
         (Test-CcodSupervisorCanonicalUtc $Pointer.updatedAtUtc) -and
         ($Pointer.generation -is [int] -or $Pointer.generation -is [long] -or $Pointer.generation -is [uint64] -or $Pointer.generation -is [decimal]) -and [decimal]$Pointer.generation -ge 1 -and [decimal]$Pointer.generation -le [decimal][UInt64]::MaxValue -and [decimal]::Truncate([decimal]$Pointer.generation) -eq [decimal]$Pointer.generation
 }
@@ -535,17 +568,18 @@ function Test-CcodSupervisorLifecycleOwnership {
 function Test-CcodSupervisorLogonIdentity {
     param($Value,$Identity)
     return (Test-CcodSupervisorExactProperties $Value @('authenticationId','userSid','sessionId')) -and
-        $Value.authenticationId -is [string] -and $Value.authenticationId -cmatch '^[0-9A-F]{8}:[0-9A-F]{8}$' -and
+        $Value.authenticationId -is [string] -and $Value.authenticationId -cmatch '^[0-9A-F]{8}:[0-9A-F]{8}\z' -and
         $Value.userSid -is [string] -and $Value.userSid -ceq $Identity.UserSid -and $Value.sessionId -is [int] -and $Value.sessionId -eq $Identity.SessionId
 }
 
 function Test-CcodSupervisorLifecycleSubmission {
     param($Value)
     if(-not (Test-CcodSupervisorExactProperties $Value @('schemaVersion','submissionId','kind','origin','runtimeId','runtimeGeneration','createdAtUtc')) -or
-       $Value.schemaVersion -isnot [int] -or $Value.schemaVersion -ne 1 -or $Value.submissionId -isnot [string] -or $Value.submissionId -cnotmatch '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$' -or
+       $Value.schemaVersion -isnot [int] -or $Value.schemaVersion -ne 1 -or $Value.submissionId -isnot [string] -or $Value.submissionId -cnotmatch '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z' -or
        $Value.kind -isnot [string] -or @('RestartAndRepair','CheckAndRepair','SafeExit') -cnotcontains $Value.kind -or $Value.origin -isnot [string] -or @('Installer','Tray','ExplicitStart','Guardian') -cnotcontains $Value.origin -or
-       $Value.runtimeId -isnot [string] -or $Value.runtimeId -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$' -or -not(Test-CcodSupervisorCanonicalUtc $Value.createdAtUtc)){return $false}
-    try{return [UInt64]$Value.runtimeGeneration -gt 0 -and [decimal]::Truncate([decimal]$Value.runtimeGeneration) -eq [decimal]$Value.runtimeGeneration}catch{return $false}
+       $Value.runtimeId -isnot [string] -or $Value.runtimeId -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z' -or -not(Test-CcodSupervisorCanonicalUtc $Value.createdAtUtc) -or
+       ($Value.runtimeGeneration -isnot [int] -and $Value.runtimeGeneration -isnot [long] -and $Value.runtimeGeneration -isnot [uint64])){return $false}
+    try{return [UInt64]$Value.runtimeGeneration -gt 0}catch{return $false}
 }
 
 function ConvertTo-CcodSupervisorLifecycleObservation {
@@ -614,7 +648,7 @@ function Receive-CcodSupervisorLifecycleSubmission {
 
 function New-CcodSupervisorLifecycleWorkerPaths {
     param($HostState,[string]$TransactionId)
-    if($TransactionId -cnotmatch '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'){throw 'lifecycle transaction identity is invalid'}
+    if($TransactionId -cnotmatch '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z'){throw 'lifecycle transaction identity is invalid'}
     $root=$HostState.Layout.WorkersRoot
     return [pscustomobject][ordered]@{
         RequestPath=[IO.Path]::GetFullPath((Join-Path $root ("lifecycle-$TransactionId.request.json")))
@@ -773,7 +807,7 @@ function Complete-CcodSupervisorLifecycleTerminal {
     param($HostState,[hashtable]$Adapters)
     $request=$HostState.LifecycleRequest
     if($null-eq$request -or -not(Test-CcodSupervisorLifecycleTerminal $request.phase)){throw 'lifecycle completion is not terminal'}
-    $successful=$request.phase-ceq'Completed' -or ($request.phase-ceq'CancelledBeforeClose' -and $null-eq$request.error)
+    $successful=(@('Completed','CancelledBeforeClose') -ccontains $request.phase) -and $null-eq$request.error
     if($request.kind-ceq'SafeExit' -and $successful){
         $markerWritten=$false
         try{
@@ -795,24 +829,44 @@ function Complete-CcodSupervisorLifecycleTerminal {
         }catch{
             $HostState.ProtectionState='Running'
             $request.error='SAFE_EXIT_RECOVERY_FAILED'
-            try{Invoke-CcodSupervisorAdapter $Adapters.WriteLifecycleRequest @($HostState.Layout.StateRoot,$request) 0}catch{}
+            try{
+                Invoke-CcodSupervisorAdapter $Adapters.AssertLifecycleFence @($HostState.Layout.InstallRoot,$HostState.LifecycleOwnership) 1|Out-Null
+                Invoke-CcodSupervisorAdapter $Adapters.WriteLifecycleRequest @($HostState.Layout.StateRoot,$request) 0
+            }catch{
+                Add-CcodSupervisorCleanupCode $HostState.RuntimeCleanupCodes 'CCOD_SUPERVISOR_SAFE_EXIT_RECOVERY_PERSIST_FAILED'
+                $HostState.SessionState='Error';$HostState.BlockAutomaticActions=$true;$HostState.Reason='SafeExitRecoveryFailed';$HostState.ConnectionState='Error'
+                try{
+                    $record=[pscustomobject][ordered]@{schemaVersion=1;timestampUtc=(Get-CcodSupervisorNowUtc $Adapters);component='Supervisor';stage='SafeExitRecovery';code='CCOD_SUPERVISOR_SAFE_EXIT_RECOVERY_PERSIST_FAILED';outcome='Failed'}
+                    Invoke-CcodSupervisorAdapter $Adapters.WriteLog @($record) 0
+                }catch{Add-CcodSupervisorCleanupCode $HostState.RuntimeCleanupCodes 'CCOD_SUPERVISOR_LOG_FAILED'}
+            }
             return
         }
     }
-    Invoke-CcodSupervisorAdapter $Adapters.AssertLifecycleFence @($HostState.Layout.InstallRoot,$HostState.LifecycleOwnership) 1|Out-Null
-    Invoke-CcodSupervisorAdapter $Adapters.CompleteLifecycleRequest @($HostState.Layout.StateRoot,$request) 0
     $failureCode='CCOD_LIFECYCLE_ACTION_FAILED'
     if($request.error -is [string] -and $request.error -cmatch '^CCOD_[A-Z0-9_]{1,91}\z'){$failureCode=$request.error}
-    [void](Complete-CcodSupervisorLifecycleTrayAction $HostState $Adapters $request $successful $failureCode)
+    Invoke-CcodSupervisorAdapter $Adapters.AssertLifecycleFence @($HostState.Layout.InstallRoot,$HostState.LifecycleOwnership) 1|Out-Null
+    if(-not (Complete-CcodSupervisorLifecycleTrayAction $HostState $Adapters $request $successful $failureCode)){
+        $HostState.ConnectionState='Error'
+        return $false
+    }
+    Invoke-CcodSupervisorAdapter $Adapters.AssertLifecycleFence @($HostState.Layout.InstallRoot,$HostState.LifecycleOwnership) 1|Out-Null
+    Invoke-CcodSupervisorAdapter $Adapters.CompleteLifecycleRequest @($HostState.Layout.StateRoot,$request) 0
     if(-not$successful){$HostState.ConnectionState=$(if($null-ne$HostState.FailedSpecialProofKey){'RepairNeeded'}else{'Error'})}
     $HostState.ProtectionState='Running';$HostState.LifecycleRequest=$null
+    return $true
 }
 
 function Invoke-CcodSupervisorPollLifecycleSlot {
     param($HostState,[hashtable]$Adapters)
     $slot=$HostState.LifecycleWorkerSlot
     $poll=Invoke-CcodSupervisorAdapter $Adapters.PollWorker @($slot) 1
-    if(-not(Test-CcodSupervisorExactProperties $poll @('Completed','ExitCode','StdoutText','StdoutByteCount','StdoutOverflow','StderrByteCount','StderrOverflow')) -or $poll.Completed-isnot[bool] -or $poll.StdoutText-isnot[string] -or $poll.StdoutByteCount-isnot[int] -or $poll.StderrByteCount-isnot[int]){Clear-CcodSupervisorLifecycleWorkerSlot $HostState $Adapters;throw 'lifecycle worker poll is invalid'}
+    if(-not(Test-CcodSupervisorExactProperties $poll @('Completed','ExitCode','StdoutText','StdoutByteCount','StdoutOverflow','StderrByteCount','StderrOverflow')) -or $poll.Completed-isnot[bool] -or $poll.StdoutText-isnot[string] -or
+       $poll.StdoutByteCount-isnot[int] -or $poll.StdoutByteCount-lt0 -or $poll.StdoutOverflow-isnot[bool] -or
+       $poll.StderrByteCount-isnot[int] -or $poll.StderrByteCount-lt0 -or $poll.StderrOverflow-isnot[bool]){
+        if(-not (Stop-CcodSupervisorOwnedWorkerForShutdown $HostState $Adapters -PropertyName LifecycleWorkerSlot -Codes $HostState.RuntimeCleanupCodes)){$HostState.ConnectionState='Error';$HostState.ProtectionState='Running';$HostState.SessionState='Error';$HostState.BlockAutomaticActions=$true;$HostState.Reason='WorkerFramingFailed'}
+        throw 'lifecycle worker poll is invalid'
+    }
     if(-not$poll.Completed){return}
     try{
         if($poll.ExitCode-isnot[int] -or @([int]0,[int]1)-cnotcontains$poll.ExitCode -or [string]::IsNullOrEmpty($poll.StdoutText) -or $poll.StdoutOverflow -or $poll.StderrOverflow -or $poll.StdoutByteCount-gt1048576 -or $poll.StderrByteCount-gt65536){throw 'lifecycle worker frame is invalid'}
@@ -849,7 +903,7 @@ function Invoke-CcodSupervisorPollLifecycleSlot {
         $HostState.LifecycleRequest=$reduced;$HostState.LifecycleObservation=[string]$result.observation;$HostState.ConnectionState=ConvertTo-CcodSupervisorLifecycleObservation $HostState.LifecycleObservation
     }catch{$HostState.ConnectionState='Error';$HostState.ProtectionState='Running';throw}
     finally{Clear-CcodSupervisorLifecycleWorkerSlot $HostState $Adapters}
-    if(Test-CcodSupervisorLifecycleTerminal $HostState.LifecycleRequest.phase){Complete-CcodSupervisorLifecycleTerminal $HostState $Adapters}
+    if(Test-CcodSupervisorLifecycleTerminal $HostState.LifecycleRequest.phase){[void](Complete-CcodSupervisorLifecycleTerminal $HostState $Adapters)}
 }
 
 function Invoke-CcodSupervisorDriveLifecycle {
@@ -857,7 +911,7 @@ function Invoke-CcodSupervisorDriveLifecycle {
     if($null-eq$HostState.LifecycleRequest){return $false}
     if($HostState.LifecycleObservation-cne'Unknown'){$HostState.ConnectionState=ConvertTo-CcodSupervisorLifecycleObservation $HostState.LifecycleObservation}
     if($null-ne$HostState.LifecycleWorkerSlot){Invoke-CcodSupervisorPollLifecycleSlot $HostState $Adapters;return $true}
-    if(Test-CcodSupervisorLifecycleTerminal $HostState.LifecycleRequest.phase){Complete-CcodSupervisorLifecycleTerminal $HostState $Adapters;return $true}
+    if(Test-CcodSupervisorLifecycleTerminal $HostState.LifecycleRequest.phase){[void](Complete-CcodSupervisorLifecycleTerminal $HostState $Adapters);return $true}
     $now=Get-CcodSupervisorNowUtc $Adapters
     $step=Invoke-CcodSupervisorAdapter $Adapters.GetLifecycleStep @($HostState.LifecycleRequest,$HostState.LifecycleObservation,$now) 1
     if(-not(Test-CcodSupervisorExactProperties $step @('kind','nextPhase','workerAction','deadlineUtc','errorCode')) -or $step.kind-isnot[string] -or $step.workerAction-isnot[string]){throw 'lifecycle step is invalid'}
@@ -867,7 +921,7 @@ function Invoke-CcodSupervisorDriveLifecycle {
         if($null-ne$step.errorCode){$moved.error=[string]$step.errorCode}
         Invoke-CcodSupervisorAdapter $Adapters.WriteLifecycleRequest @($HostState.Layout.StateRoot,$moved) 0
         $HostState.LifecycleRequest=$moved
-        if(Test-CcodSupervisorLifecycleTerminal $moved.phase){Complete-CcodSupervisorLifecycleTerminal $HostState $Adapters;return $true}
+        if(Test-CcodSupervisorLifecycleTerminal $moved.phase){[void](Complete-CcodSupervisorLifecycleTerminal $HostState $Adapters);return $true}
     }
     if($step.workerAction-cne'None'){Start-CcodSupervisorLifecycleWorkerSlot $HostState $Adapters $step.workerAction $step.deadlineUtc|Out-Null}
     return $true
@@ -875,7 +929,7 @@ function Invoke-CcodSupervisorDriveLifecycle {
 
 function Test-CcodSupervisorWorkerPaths {
     param($Paths,$WorkersRoot,[string]$Kind,[string]$RequestId)
-    if(-not (Test-CcodSupervisorExactProperties $Paths @('RequestPath','ResultPath','StderrPath')) -or $RequestId -cnotmatch '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'){return $false}
+    if(-not (Test-CcodSupervisorExactProperties $Paths @('RequestPath','ResultPath','StderrPath')) -or $RequestId -cnotmatch '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z'){return $false}
     $prefix=if($Kind -ceq 'Controller'){'controller'}elseif($Kind -ceq 'StaticProbe'){'static-probe'}else{return $false}
     $expected=@(
         "$prefix-$RequestId.request.json",
@@ -908,7 +962,7 @@ function New-CcodSupervisorWorkerPaths {
 function New-CcodSupervisorControllerRequest {
     param($HostState,[ValidateSet('Inspect','Apply','RepairStale','RepairRenderer','Recover')][string]$Action,$Target)
     $transactionId=if($Action -ceq 'Recover' -and $null -ne $HostState.Journal){$HostState.Journal.transactionId}else{[guid]::NewGuid().ToString('D')}
-    if($transactionId -isnot [string] -or $transactionId -cnotmatch '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'){throw 'transaction identity is invalid'}
+    if($transactionId -isnot [string] -or $transactionId -cnotmatch '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z'){throw 'transaction identity is invalid'}
     $source=$null
     if($Action -ceq 'Apply' -or $Action -ceq 'RepairStale'){
         if($null -eq $Target){
@@ -1003,6 +1057,30 @@ function Write-CcodSupervisorRendererHandoffFailure {
     if($null -ne $HostState -and $HostState.SessionState -ceq 'Active'){$HostState.Reason='RendererHandoff'}
 }
 
+function Test-CcodSupervisorRendererHandoffReceipt {
+    param($Receipt)
+    if(-not (Test-CcodSupervisorExactProperties $Receipt @('Outcome','Code','ProcessId')) -or
+       $Receipt.Outcome -isnot [string] -or @('Started','Skipped','Failed') -cnotcontains $Receipt.Outcome -or
+       $Receipt.Code -isnot [string]){return $false}
+    $processValid=$false
+    $codeValid=$false
+    switch($Receipt.Outcome){
+        'Started' {
+            $processValid=($Receipt.ProcessId -is [int] -or $Receipt.ProcessId -is [long]) -and $Receipt.ProcessId -gt 0 -and $Receipt.ProcessId -le [int]::MaxValue
+            $codeValid=$Receipt.Code -ceq 'CCOD_RENDERER_HANDOFF_STARTED'
+        }
+        'Skipped' {
+            $processValid=$null -eq $Receipt.ProcessId
+            $codeValid=@('CCOD_RENDERER_NOT_INSTALLED','CCOD_RENDERER_PAUSED','CCOD_RENDERER_STATE_UNAVAILABLE','CCOD_RENDERER_IDENTITY_UNAVAILABLE','CCOD_RENDERER_ALREADY_ATTACHED') -ccontains $Receipt.Code
+        }
+        'Failed' {
+            $processValid=$null -eq $Receipt.ProcessId
+            $codeValid=@('CCOD_RENDERER_STATE_INVALID','CCOD_RENDERER_PORT_UNAVAILABLE','CCOD_RENDERER_HANDOFF_FAILED') -ccontains $Receipt.Code
+        }
+    }
+    return [bool]($processValid -and $codeValid)
+}
+
 function Invoke-CcodSupervisorRendererHandoff {
     param($HostState,$Slot,$Result,[hashtable]$Adapters)
     try{
@@ -1014,9 +1092,7 @@ function Invoke-CcodSupervisorRendererHandoff {
         $rendererPort=$Result.special.rendererPort
         if(($rendererPort -isnot [int] -and $rendererPort -isnot [long]) -or $rendererPort -lt 1 -or $rendererPort -gt 65535){return}
         $receipt=Invoke-CcodSupervisorAdapter $Adapters.HandoffRenderer @($Result,[int]$rendererPort) 1
-        if(-not (Test-CcodSupervisorExactProperties $receipt @('Outcome','Code','ProcessId')) -or $receipt.Outcome -isnot [string] -or
-           $receipt.Code -isnot [string] -or @('Started','Skipped','Failed') -cnotcontains $receipt.Outcome -or
-           ($receipt.Outcome -ceq 'Failed')){Write-CcodSupervisorRendererHandoffFailure $HostState $Adapters}
+        if($receipt.Outcome -ceq 'Failed' -or -not (Test-CcodSupervisorRendererHandoffReceipt $receipt)){Write-CcodSupervisorRendererHandoffFailure $HostState $Adapters}
     }catch{Write-CcodSupervisorRendererHandoffFailure $HostState $Adapters}
 }
 
@@ -1042,18 +1118,23 @@ function Invoke-CcodSupervisorPollSlot {
        $poll.StdoutByteCount -isnot [int] -or $poll.StdoutByteCount -lt 0 -or $poll.StdoutOverflow -isnot [bool] -or
        $poll.StderrByteCount -isnot [int] -or $poll.StderrByteCount -lt 0 -or $poll.StderrOverflow -isnot [bool]){
         if($slot.Kind-ceq'StaticProbe'){Set-CcodSupervisorStaticProbeFramingFailure $HostState $staticAttemptKey}
-        Clear-CcodSupervisorWorkerSlot $HostState $Adapters;return
+        if(-not (Stop-CcodSupervisorOwnedWorkerForShutdown $HostState $Adapters -PropertyName WorkerSlot -Codes $HostState.RuntimeCleanupCodes)){$HostState.ConnectionState='Error';$HostState.SessionState='Error';$HostState.BlockAutomaticActions=$true;$HostState.Reason='WorkerFramingFailed'}
+        return
     }
     if(-not $poll.Completed){return}
     try{
-        if($poll.ExitCode -isnot [int] -or $poll.StdoutByteCount -gt 1048576 -or $poll.StderrByteCount -gt 65536 -or $poll.StdoutOverflow -or $poll.StderrOverflow){throw 'worker framing failed'}
+        if($poll.ExitCode -isnot [int] -or @([int]0,[int]1) -notcontains $poll.ExitCode -or $poll.StdoutByteCount -gt 1048576 -or $poll.StderrByteCount -gt 65536 -or $poll.StdoutOverflow -or $poll.StderrOverflow){throw 'worker framing failed'}
+        $exited=Invoke-CcodSupervisorAdapter $Adapters.WaitWorker @($slot,[int]2000) 1
+        if($exited-isnot[bool]-or-not$exited){throw 'worker exit is not proven'}
         if($slot.Kind-ceq'StaticProbe'-and[string]::IsNullOrEmpty($poll.StdoutText)){throw 'static probe result is missing'}
+        if($slot.Kind-ceq'Controller'-and[string]::IsNullOrEmpty($poll.StdoutText)){throw 'controller result is missing'}
         if(-not [string]::IsNullOrEmpty($poll.StdoutText)){
             $result=Invoke-CcodSupervisorNullableAdapter $Adapters.ReadWorkerResult @($slot.ResultPath)
             if($null -eq $result){throw 'worker result is missing'}
             $fromStdout=$poll.StdoutText|ConvertFrom-Json -ErrorAction Stop
             if(($fromStdout|ConvertTo-Json -Depth 20 -Compress) -cne ($result|ConvertTo-Json -Depth 20 -Compress)){throw 'worker frames differ'}
             if($slot.Kind -ceq 'Controller'){
+                if($result.ok -isnot [bool] -or ($result.ok -and $poll.ExitCode -ne 0) -or (-not $result.ok -and $poll.ExitCode -ne 1)){throw 'controller exit code does not match result'}
                 $expectedSource=if($slot.Action -ceq 'RepairStale'){$slot.Request.source}else{$null}
                 $reduced=Invoke-CcodSupervisorAdapter $Adapters.CompleteControllerRun @($result,$slot.Request.transactionId,$slot.Action,$slot.RuntimeId,$expectedSource) 1
                 if($null -ne $reduced){
@@ -1098,7 +1179,7 @@ function Invoke-CcodSupervisorPollSlot {
         else{$HostState.SessionState='Error';$HostState.BlockAutomaticActions=$true;$HostState.Reason='WorkerFramingFailed'}
         if($null -ne $staleRepairKey){$HostState.FailedStaleRepairKey=$staleRepairKey}
     }
-    finally{Clear-CcodSupervisorWorkerSlot $HostState $Adapters}
+    finally{if($null-ne$HostState.WorkerSlot){[void](Stop-CcodSupervisorOwnedWorkerForShutdown $HostState $Adapters -PropertyName WorkerSlot -Codes $HostState.RuntimeCleanupCodes)}}
 }
 
 function Get-CcodSupervisorResourcesRoot {
@@ -1154,6 +1235,39 @@ function Throw-CcodSupervisorCommandError {
     throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new($Message),$Code,[Management.Automation.ErrorCategory]::InvalidData,$Target)
 }
 
+function Write-CcodSupervisorTrayHostReady {
+    param($HostState,[hashtable]$Adapters)
+    try{
+        if($null -eq $HostState -or $null -eq $HostState.Tray -or $null -eq $HostState.Tray.Client -or $null -eq $HostState.Tray.Client.Receipt){throw 'tray receipt missing'}
+        $receipt=$HostState.Tray.Client.Receipt
+        if(-not (Test-CcodSupervisorExactProperties $receipt @('HostPid','HostCreationFileTimeUtc','RuntimeId','ProtocolMajor','Capabilities'))){throw 'tray receipt schema invalid'}
+        if($receipt.HostPid -isnot [int] -or $receipt.HostPid -le 0 -or
+           $receipt.HostCreationFileTimeUtc -isnot [long] -or $receipt.HostCreationFileTimeUtc -le 0 -or
+           $receipt.RuntimeId -isnot [string] -or $receipt.RuntimeId -cne [string]$HostState.Layout.RuntimeId -or
+           ($receipt.ProtocolMajor -isnot [int] -and $receipt.ProtocolMajor -isnot [UInt16]) -or $receipt.ProtocolMajor -ne 2 -or
+           $receipt.Capabilities -isnot [UInt64] -or $receipt.Capabilities -eq 0){throw 'tray receipt invalid'}
+        $now=Invoke-CcodSupervisorAdapter $Adapters.GetUtcNow @() 1
+        if($now -is [DateTimeOffset]){$timestamp=$now.UtcDateTime.ToString('o',[Globalization.CultureInfo]::InvariantCulture)}
+        elseif($now -is [DateTime]){$timestamp=$now.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)}
+        else{throw 'tray ready clock invalid'}
+        $hostTime=[DateTime]::FromFileTimeUtc([Int64]$receipt.HostCreationFileTimeUtc).ToString('o',[Globalization.CultureInfo]::InvariantCulture)
+        $hostIdentity=Invoke-CcodSupervisorAdapter $Adapters.GetTrayHostIdentity @([int]$receipt.HostPid,[string]$hostTime) 1
+        if(-not (Test-CcodSupervisorExactProperties $hostIdentity @('Outcome','Pid','CreationTimeUtc')) -or
+           $hostIdentity.Outcome -isnot [string] -or $hostIdentity.Outcome -cne 'SameIdentity' -or
+           $hostIdentity.Pid -isnot [int] -or $hostIdentity.Pid -ne [int]$receipt.HostPid -or
+           $hostIdentity.CreationTimeUtc -isnot [string] -or $hostIdentity.CreationTimeUtc -cne $hostTime){throw 'tray process identity invalid'}
+        $record=[pscustomobject][ordered]@{
+            schemaVersion=1;timestampUtc=$timestamp;component='Supervisor';stage='TrayHostReady';code='CCOD_TRAYHOST_READY';outcome='Completed'
+            runtimeId=[string]$receipt.RuntimeId;hostPid=[int]$receipt.HostPid;hostCreationTimeUtc=$hostTime;protocolMajor=[int]$receipt.ProtocolMajor;capabilities=[UInt64]$receipt.Capabilities
+        }
+        Invoke-CcodSupervisorAdapter $Adapters.WriteLog @($record) 0
+        return $true
+    }catch{
+        Add-CcodSupervisorCleanupCode $HostState.RuntimeCleanupCodes 'CCOD_SUPERVISOR_TRAY_READY_LOG_FAILED'
+        return $false
+    }
+}
+
 function Write-CcodSupervisorTrayActionTerminal {
     param($HostState,[hashtable]$Adapters,$Action,[ValidateSet('Completed','Rejected','Failed')][string]$Status,[AllowNull()][string]$ErrorCode)
     $code=if($Status-ceq'Completed'){'CCOD_TRAY_ACTION_COMPLETED'}elseif($ErrorCode-is[string]-and$ErrorCode-cmatch'^CCOD_[A-Z0-9_]{1,91}\z'){$ErrorCode}else{'CCOD_TRAY_ACTION_FAILED'}
@@ -1220,7 +1334,7 @@ function Complete-CcodSupervisorLifecycleTrayAction {
             $delivery=Send-CcodSupervisorTrayActionResult $HostState $Adapters $entry.Action $status $code $entry.TransactionId
             if(-not$delivery.Delivered){return $false}
             $entry.TerminalSent=$true
-        }catch{Write-CcodSupervisorUiFailure $HostState $Adapters 'ErrorDialog' 'CCOD_TRAY_ACTION_RESULT_FAILED'}
+        }catch{Write-CcodSupervisorUiFailure $HostState $Adapters 'ErrorDialog' 'CCOD_TRAY_ACTION_RESULT_FAILED';return $false}
     }
     return $true
 }
@@ -1289,7 +1403,7 @@ function Invoke-CcodSupervisorCommand {
         'ShowAbout' {
             try{
                 $about=Invoke-CcodSupervisorAdapter $Adapters.VerifyActiveRuntimeForAbout @($HostState.Layout.InstallRoot,$HostState.Layout.RuntimeId) 1
-                if(-not(Test-CcodSupervisorExactProperties $about @('RuntimeId','Version'))-or$about.RuntimeId-cne$HostState.Layout.RuntimeId-or$about.Version-isnot[string]-or$about.Version-cnotmatch'^\d+\.\d+\.\d+$'){throw 'about runtime is invalid'}
+                if(-not(Test-CcodSupervisorExactProperties $about @('RuntimeId','Version'))-or$about.RuntimeId-cne$HostState.Layout.RuntimeId-or$about.Version-isnot[string]-or$about.Version-cnotmatch'^\d+\.\d+\.\d+\z'){throw 'about runtime is invalid'}
                 Set-CcodSupervisorCurrentTrayPresentation $HostState $Adapters $null -WaitForAcknowledgement
                 return Send-CcodSupervisorTrayActionResult $HostState $Adapters $Command Completed $null $null
             }catch{return Send-CcodSupervisorTrayActionResult $HostState $Adapters $Command Failed 'CCOD_TRAY_ACTION_FAILED' $null}
@@ -1376,7 +1490,7 @@ function Get-CcodSupervisorStaleReconciliationCandidate {
         $codex=$State.Status.session.codex
         if($codex.pid -isnot [int] -or $codex.pid -lt 1 -or -not(Test-CcodSupervisorCanonicalUtc $codex.creationTimeUtc) -or
            $codex.packageFullName -isnot [string] -or [string]::IsNullOrWhiteSpace($codex.packageFullName) -or $codex.packageVersion -isnot [string] -or [string]::IsNullOrWhiteSpace($codex.packageVersion) -or
-           $codex.appAsarSha256 -isnot [string] -or $codex.appAsarSha256 -cnotmatch '^[0-9a-f]{64}$' -or $codex.mainPort -isnot [int] -or $codex.rendererPort -isnot [int] -or
+           $codex.appAsarSha256 -isnot [string] -or $codex.appAsarSha256 -cnotmatch '^[0-9a-f]{64}\z' -or $codex.mainPort -isnot [int] -or $codex.rendererPort -isnot [int] -or
            $codex.mainPort -lt 1 -or $codex.mainPort -gt 65535 -or $codex.rendererPort -lt 1 -or $codex.rendererPort -gt 65535 -or $codex.mainPort -eq $codex.rendererPort -or
            $codex.mainProbe -cne 'Closed' -or $codex.rendererProbe -cne 'BridgeValid'){return $null}
         if($LivePackage.Found -isnot [bool] -or -not $LivePackage.Found -or $LivePackage.FullName -isnot [string] -or [string]::IsNullOrWhiteSpace($LivePackage.FullName) -or
@@ -1559,7 +1673,7 @@ function Invoke-CcodSupervisorTick {
 function Invoke-CcodSupervisorHost {
     [CmdletBinding()]
     param([Parameter(Mandatory)][AllowEmptyString()][string]$ReadyToken,[hashtable]$Adapters)
-    if($ReadyToken -cnotmatch '^[0-9a-f]{64}$'){return New-CcodSupervisorReceipt 'StartupRejected' 2 @()}
+    if($ReadyToken -cnotmatch '^[0-9a-f]{64}\z'){return New-CcodSupervisorReceipt 'StartupRejected' 2 @()}
     $adapter=Get-CcodSupervisorAdapters $Adapters
     if($null -eq $adapter){return New-CcodSupervisorReceipt 'StartupRejected' 2 @()}
     $codes=[Collections.Generic.List[string]]::new();$outcome='Failed';$exitCode=1
@@ -1631,6 +1745,7 @@ function Invoke-CcodSupervisorHost {
             $tray=Invoke-CcodSupervisorAdapter $adapter.NewTray $trayArguments 1
             if($null -eq $tray){throw 'tray contract is invalid'}
             $hostState.Tray=$tray
+            if(-not (Write-CcodSupervisorTrayHostReady $hostState $adapter)){throw 'TrayHost readiness evidence could not be written'}
             $onFull={}.GetNewClosure()
             $watcherArguments=[object[]]::new(2);$watcherArguments[0]=$eventQueue;$watcherArguments[1]=$onFull
             $watcher=Invoke-CcodSupervisorAdapter $adapter.NewWatcher $watcherArguments 1
@@ -1647,10 +1762,10 @@ function Invoke-CcodSupervisorHost {
         if($null -ne $hostState){$hostState.ShutdownRequested=$true}
         if($null-ne$hostState){if(-not(Stop-CcodSupervisorOwnedWorkerForShutdown $hostState $adapter LifecycleWorkerSlot $codes)){$workerCleanupSafe=$false};if(-not(Stop-CcodSupervisorOwnedWorkerForShutdown $hostState $adapter WorkerSlot $codes)){$workerCleanupSafe=$false}}
         if($null -ne $tray){Invoke-CcodSupervisorCleanupStage {Invoke-CcodSupervisorAdapter $adapter.StopTrayTimer @($tray) 0} $codes 'CCOD_SUPERVISOR_TIMER_STOP_FAILED'}
-        if($null -ne $watcher){Invoke-CcodSupervisorCleanupStage {Invoke-CcodSupervisorAdapter $adapter.StopWatcher @($watcher) 1|Out-Null} $codes 'CCOD_SUPERVISOR_WATCHER_STOP_FAILED'}
+        if($null -ne $watcher){Invoke-CcodSupervisorCleanupStage {$cleanupReceipt=Invoke-CcodSupervisorAdapter $adapter.StopWatcher @($watcher) 1;Add-CcodSupervisorNestedCleanupReceipt -Codes $codes -Receipt $cleanupReceipt -Kind Watcher} $codes 'CCOD_SUPERVISOR_WATCHER_STOP_FAILED'}
         if($null -ne $eventQueue){Invoke-CcodSupervisorCleanupStage {Invoke-CcodSupervisorDrainQueue $eventQueue $adapter} $codes 'CCOD_SUPERVISOR_QUEUE_DRAIN_FAILED'}
         if($null -ne $commandQueue){Invoke-CcodSupervisorCleanupStage {Invoke-CcodSupervisorDrainQueue $commandQueue $adapter} $codes 'CCOD_SUPERVISOR_QUEUE_DRAIN_FAILED'}
-        if($null -ne $tray){Invoke-CcodSupervisorCleanupStage {Invoke-CcodSupervisorAdapter $adapter.CloseTray @($tray) 1|Out-Null} $codes 'CCOD_SUPERVISOR_TRAY_CLOSE_FAILED'}
+        if($null -ne $tray){Invoke-CcodSupervisorCleanupStage {$cleanupReceipt=Invoke-CcodSupervisorAdapter $adapter.CloseTray @($tray) 1;Add-CcodSupervisorNestedCleanupReceipt -Codes $codes -Receipt $cleanupReceipt -Kind Tray} $codes 'CCOD_SUPERVISOR_TRAY_CLOSE_FAILED'}
         if($null -ne $readyEvent){Invoke-CcodSupervisorCleanupStage {Invoke-CcodSupervisorAdapter $adapter.CloseEvent @($readyEvent) 0} $codes 'CCOD_SUPERVISOR_READY_CLOSE_FAILED'}
         if($null -ne $shutdownEvent){Invoke-CcodSupervisorCleanupStage {Invoke-CcodSupervisorAdapter $adapter.CloseEvent @($shutdownEvent) 0} $codes 'CCOD_SUPERVISOR_SHUTDOWN_CLOSE_FAILED'}
         if($null-ne$lifecycleWakeEvent){Invoke-CcodSupervisorCleanupStage {Invoke-CcodSupervisorAdapter $adapter.CloseEvent @($lifecycleWakeEvent) 0} $codes 'CCOD_SUPERVISOR_LIFECYCLE_WAKE_CLOSE_FAILED'}
diff --git a/src/persistence/UninstallBootstrap.ps1 b/src/persistence/UninstallBootstrap.ps1
index 9ad7209..10a00c5 100644
--- a/src/persistence/UninstallBootstrap.ps1
+++ b/src/persistence/UninstallBootstrap.ps1
@@ -271,7 +271,7 @@ function Get-CcodUninstallBootstrapRuntimeId {
         Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_RUNTIME_INVALID' 'The runtime manifest version is invalid' $ProjectVersion
     }
     $lines = [Collections.Generic.List[string]]::new()
-    foreach ($record in $Records) { $lines.Add(('{0}`t{1}`t{2}' -f $record.path,[int64]$record.length,$record.sha256)) }
+    foreach ($record in $Records) { $lines.Add(("{0}`t{1}`t{2}" -f $record.path,[int64]$record.length,$record.sha256)) }
     $sha = [Security.Cryptography.SHA256]::Create()
     try {
         $digest = [BitConverter]::ToString($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes(($lines -join "`n")))).Replace('-','').ToLowerInvariant()
@@ -974,6 +974,100 @@ function Assert-CcodUninstallBootstrapTransactionMatchesContext {
     }
 }
 
+function Initialize-CcodUninstallPayloadAuthority {
+    if ($null -ne ('CcodUninstallPayloadAuthorityV1' -as [type])) { return }
+    Add-Type -ErrorAction Stop -TypeDefinition @'
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+public sealed class CcodUninstallPayloadAuthorityV1 : IDisposable
+{
+    [StructLayout(LayoutKind.Sequential)] private struct Info
+    {
+        public uint Attributes;
+        public System.Runtime.InteropServices.ComTypes.FILETIME Creation, Access, Write;
+        public uint Volume, SizeHigh, SizeLow, Links, IndexHigh, IndexLow;
+    }
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern SafeFileHandle CreateFileW(string path,uint access,uint share,IntPtr security,uint creation,uint flags,IntPtr template);
+    [DllImport("kernel32.dll", SetLastError=true)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle handle,out Info info);
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern uint GetFinalPathNameByHandleW(SafeFileHandle handle,StringBuilder value,uint length,uint flags);
+    private readonly List<SafeFileHandle> handles = new List<SafeFileHandle>();
+    private readonly HashSet<string> paths = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+    private bool disposed;
+    public void Add(string path)
+    {
+        if(disposed)throw new ObjectDisposedException("uninstall payload authority");
+        if(String.IsNullOrWhiteSpace(path)||!Path.IsPathRooted(path)||path.StartsWith(@"\\?\")||path.StartsWith(@"\\.\"))throw new IOException("Payload path");
+        string full=Path.GetFullPath(path),root=Path.GetPathRoot(full);
+        if(!String.Equals(full,path,StringComparison.OrdinalIgnoreCase)||full.Substring(root.Length).IndexOf(':')>=0)throw new IOException("Payload canonical path");
+        var parents=new List<string>();
+        for(DirectoryInfo parent=Directory.GetParent(full);parent!=null;parent=parent.Parent)parents.Add(parent.FullName);
+        parents.Reverse();
+        foreach(string parent in parents)Open(parent,true);
+        Open(full,false);
+    }
+    private void Open(string path,bool directory)
+    {
+        if(paths.Contains(path))return;
+        uint access=directory?0x00100081U:0x80100080U;
+        uint flags=0x00200000U|(directory?0x02000000U:0U);
+        SafeFileHandle handle=CreateFileW(path,access,1U,IntPtr.Zero,3U,flags,IntPtr.Zero);
+        if(handle.IsInvalid){int error=Marshal.GetLastWin32Error();handle.Dispose();throw new Win32Exception(error);}
+        try{
+            Info info;if(!GetFileInformationByHandle(handle,out info))throw new Win32Exception(Marshal.GetLastWin32Error());
+            if((info.Attributes&0x400U)!=0||((info.Attributes&0x10U)!=0)!=directory||(!directory&&info.Links!=1))throw new IOException("Payload file kind");
+            var value=new StringBuilder(512);uint length=GetFinalPathNameByHandleW(handle,value,(uint)value.Capacity,0);
+            if(length>=value.Capacity){value.Capacity=checked((int)length+1);length=GetFinalPathNameByHandleW(handle,value,(uint)value.Capacity,0);}
+            if(length==0||length>=value.Capacity)throw new IOException("Payload final path unavailable");
+            string final=value.ToString();
+            if(final.StartsWith(@"\\?\UNC\",StringComparison.OrdinalIgnoreCase))final=@"\\"+final.Substring(8);
+            else if(final.StartsWith(@"\\?\",StringComparison.OrdinalIgnoreCase))final=final.Substring(4);
+            if(!String.Equals(final.TrimEnd('\\'),path.TrimEnd('\\'),StringComparison.OrdinalIgnoreCase))throw new IOException("Payload final path mismatch");
+            handles.Add(handle);paths.Add(path);
+        }catch{handle.Dispose();throw;}
+    }
+    public void Dispose()
+    {
+        if(disposed)return;disposed=true;
+        for(int index=handles.Count-1;index>=0;index--)handles[index].Dispose();
+        handles.Clear();paths.Clear();
+    }
+}
+'@
+}
+
+function Open-CcodUninstallBootstrapPayloadAuthority {
+    param([Parameter(Mandatory)][string]$PayloadRoot,[Parameter(Mandatory)][object[]]$Records)
+    $lease=$null
+    try {
+        Initialize-CcodUninstallPayloadAuthority
+        $lease=[CcodUninstallPayloadAuthorityV1]::new()
+        if ($Records.Count -lt 1) { throw 'payload records missing' }
+        $seen=[Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+        foreach ($record in $Records) {
+            [void](Assert-CcodUninstallBootstrapManifestRecord $record)
+            if (-not $seen.Add($record.path)) { throw 'duplicate payload path' }
+            $path=Resolve-CcodUninstallBootstrapChildPath -Root $PayloadRoot -RelativePath $record.path -RequireLeafFile
+            $lease.Add($path)
+            $streams=@(Get-Item -LiteralPath $path -Stream * -ErrorAction Stop)
+            $fingerprint=Get-CcodUninstallBootstrapFileFingerprint $path
+            if ($streams.Count -ne 1 -or $streams[0].Stream -cne ':$DATA' -or
+                $fingerprint.length -ne $record.length -or $fingerprint.sha256 -cne $record.sha256) { throw 'staged payload changed' }
+        }
+        return $lease
+    } catch {
+        if ($null -ne $lease) { $lease.Dispose() }
+        Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PAYLOAD_HASH_MISMATCH' 'Staged cleanup authority could not be acquired before consumption.' $PayloadRoot
+    }
+}
+
 function Get-CcodUninstallBootstrapAdapters {
     param([hashtable]$Adapters)
     $defaults = @{
@@ -1030,8 +1124,11 @@ function Get-CcodUninstallBootstrapAdapters {
             Read-CcodUninstallBootstrapStoredReceipt -TransactionDirectory $TransactionRoot
         }
         RunCleanup = {
-            param($InstallerRoot,$InstallRoot,$TransactionRoot,$Transaction,$WriteTransaction,$Mode)
+            param($InstallerRoot,$InstallRoot,$TransactionRoot,$Transaction,$WriteTransaction,$Mode,$PayloadRecords)
             $payloadRoot = Resolve-CcodUninstallBootstrapChildPath -Root $TransactionRoot -RelativePath 'payload'
+            $records=if($null-ne$Transaction.installedBinding){@($Transaction.installedBinding.payloadRecords)}else{@($PayloadRecords)}
+            $payloadAuthority=Open-CcodUninstallBootstrapPayloadAuthority -PayloadRoot $payloadRoot -Records $records
+            try {
             $modulePath = Resolve-CcodUninstallBootstrapChildPath -Root $payloadRoot -RelativePath 'src\persistence\modules\InstallLifecycle.psm1' -RequireLeafFile
             $module = Import-Module -Name $modulePath -Force -PassThru -ErrorAction Stop
             $writer = {
@@ -1042,6 +1139,7 @@ function Get-CcodUninstallBootstrapAdapters {
                 param($Root,$Value,$Writer,$DeferRemoval)
                 Invoke-CcodUninstallCleanup -InstallRoot $Root -Transaction $Value -WriteTransaction $Writer -StopAfterTaskRemoval:([bool]$DeferRemoval)
             } $InstallRoot $Transaction $writer ($Mode -ceq 'PrepareInstalled'))
+            } finally { $payloadAuthority.Dispose() }
         }
         RemoveProductRegistration = {
             param($Context)
@@ -1236,7 +1334,7 @@ function Invoke-CcodUninstallBootstrap {
         }
         if ($stagePayload) { & $adapter.StagePayload $InstallerRoot $InstallRoot $context $stageRoot }
         if($returnExistingInstalledTaskRemoved){&$adapter.WriteReceipt $stageRoot $transaction;$receipt=&$adapter.ReadReceipt $stageRoot;if(-not(Test-CcodUninstallBootstrapReceiptMatchesTransaction -Receipt $receipt -Transaction $transaction)){Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_TRANSACTION_WRITE_FAILED' 'Replacement wrapper receipt read-back did not match.' $transaction.transactionId};return $transaction}
-        $result = & $adapter.RunCleanup $InstallerRoot $InstallRoot $stageRoot $transaction $adapter.WriteTransaction $Mode
+        $result = & $adapter.RunCleanup $InstallerRoot $InstallRoot $stageRoot $transaction $adapter.WriteTransaction $Mode $context.payloadRecords
         if ($null -eq $result) { Throw-CcodUninstallBootstrapError 'CCOD_UNINSTALL_PREPARE_FAILED' 'The staged cleanup returned no transaction receipt' $stageRoot }
         Assert-CcodUninstallBootstrapTransactionMatchesContext $result $context $InstallRoot
         $expectedPhase=if($Mode-ceq'PrepareInstalled'){'TaskRemoved'}else{'ReadyForInno'}
diff --git a/src/persistence/bootstrap.ps1 b/src/persistence/bootstrap.ps1
index 83eef5e..2405ece 100644
--- a/src/persistence/bootstrap.ps1
+++ b/src/persistence/bootstrap.ps1
@@ -299,7 +299,7 @@ function Get-CcodBootstrapRuntimeId {
 
     $lines = [Collections.Generic.List[string]]::new()
     foreach ($file in $Files) {
-        $lines.Add(('{0}`t{1}`t{2}' -f [string]$file.path, [int64]$file.length, [string]$file.sha256))
+        $lines.Add(("{0}`t{1}`t{2}" -f [string]$file.path, [int64]$file.length, [string]$file.sha256))
     }
     $canonical = $lines -join "`n"
     $sha256 = [Security.Cryptography.SHA256]::Create()
diff --git a/src/persistence/modules/GenerationReclamation.psm1 b/src/persistence/modules/GenerationReclamation.psm1
index b62a5e1..eeab32a 100644
--- a/src/persistence/modules/GenerationReclamation.psm1
+++ b/src/persistence/modules/GenerationReclamation.psm1
@@ -3,6 +3,7 @@ Set-StrictMode -Version Latest
 $script:CcodGenerationReclamationBeforeArmForTest = $null
 $script:CcodGenerationReclamationFailFileArmAtForTest = -1
 $script:CcodGenerationReclamationFailCommitAtForTest = -1
+$script:CcodProductResidueFailCommitAtForTest = -1
 
 function Throw-CcodGenerationReclamationError {
     param([Parameter(Mandatory)][string]$Id,[Parameter(Mandatory)][string]$Message,$Target)
@@ -129,6 +130,7 @@ internal sealed class CcodGenerationReclamationRuntimeV1 : IDisposable
     private Pin installRoot,runtimeParent,selectedRoot,manifest;
     private readonly List<Pin> files=new List<Pin>();
     private readonly List<Pin> directories=new List<Pin>();
+    private readonly List<Pin> residueAncestors=new List<Pin>();
     private bool disposed,completed;
 
     private CcodGenerationReclamationRuntimeV1(string installPath,string runtimeParentPath,string selectedPath)
@@ -141,6 +143,75 @@ internal sealed class CcodGenerationReclamationRuntimeV1 : IDisposable
         catch { runtime.Dispose();throw; }
     }
 
+    internal static CcodGenerationReclamationRuntimeV1 OpenResidue(string path)
+    {
+        string parentPath=Directory.GetParent(path).FullName;
+        var runtime=new CcodGenerationReclamationRuntimeV1(parentPath,parentPath,path);
+        try
+        {
+            var ancestors=new List<string>();
+            for(DirectoryInfo cursor=new DirectoryInfo(parentPath);cursor!=null;cursor=cursor.Parent)ancestors.Add(cursor.FullName);
+            ancestors.Reverse();Pin parent=null;
+            foreach(string ancestor in ancestors)
+            {
+                SafeFileHandle handle=parent==null?OpenAbsoluteDirectory(ancestor):OpenRelative(parent.Native,Path.GetFileName(ancestor),LIST_DIRECTORY|READ_ATTRIBUTES|SYNCHRONIZE,SHARE_READ|SHARE_WRITE,DIRECTORY|BACKUP_INTENT);
+                try { parent=CreateDirectoryPin(parent,Path.GetFileName(ancestor),ancestor,"",handle,new string[0]);handle=null;runtime.residueAncestors.Add(parent); }
+                finally { if(handle!=null)handle.Dispose(); }
+            }
+            runtime.installRoot=parent;
+            SafeFileHandle selected=OpenRelative(parent.Native,Path.GetFileName(path),DELETE|LIST_DIRECTORY|READ_ATTRIBUTES|SYNCHRONIZE,SHARE_READ,DIRECTORY|BACKUP_INTENT);
+            try { runtime.selectedRoot=CreateDirectoryPin(parent,Path.GetFileName(path),path,"",selected,null);selected=null;runtime.directories.Add(runtime.selectedRoot);runtime.OpenChildren(runtime.selectedRoot); }
+            finally { if(selected!=null)selected.Dispose(); }
+            runtime.Revalidate();return runtime;
+        }
+        catch { runtime.Dispose();throw; }
+    }
+
+    internal string ReadFileText(string relative)
+    {
+        if(disposed)throw new ObjectDisposedException("product residue");
+        foreach(Pin file in files)if(String.Equals(file.RelativePath,relative,StringComparison.Ordinal))return ReadText(file.Stream);
+        throw new InvalidDataException("required product state is missing");
+    }
+
+    internal string RootIdentity()
+    {
+        Revalidate();return selectedRoot.Volume.ToString(System.Globalization.CultureInfo.InvariantCulture)+"-"+selectedRoot.FileId.ToString(System.Globalization.CultureInfo.InvariantCulture);
+    }
+
+    internal sealed class Journal : IDisposable
+    {
+        private readonly List<SafeFileHandle> handles=new List<SafeFileHandle>();
+        public FileStream Stream;
+        public bool Created;
+        internal Journal(string directory,string leaf)
+        {
+            try
+            {
+                var ancestors=new List<string>();
+                for(DirectoryInfo cursor=new DirectoryInfo(directory);cursor!=null;cursor=cursor.Parent)ancestors.Add(cursor.FullName);
+                ancestors.Reverse();SafeFileHandle parent=null;
+                foreach(string path in ancestors)
+                {
+                    SafeFileHandle handle=parent==null?OpenAbsoluteDirectory(path):OpenRelative(parent,Path.GetFileName(path),LIST_DIRECTORY|READ_ATTRIBUTES|SYNCHRONIZE,SHARE_READ|SHARE_WRITE,DIRECTORY|BACKUP_INTENT);
+                    handles.Add(handle);ValidateDirectoryIdentity(Info(handle),handle,path);parent=handle;
+                }
+                string target=Path.Combine(directory,leaf);
+                try { Stream=new FileStream(target,FileMode.CreateNew,FileAccess.ReadWrite,FileShare.Read,4096,FileOptions.WriteThrough);Created=true; }
+                catch(IOException exception)
+                {
+                    int error=exception.HResult&65535;if(error!=80&&error!=183)throw;
+                    Stream=new FileStream(target,FileMode.Open,FileAccess.Read,FileShare.Read);
+                }
+                ValidateFileIdentity(Info(Stream.SafeFileHandle),Stream.SafeFileHandle,target,Info(parent).VolumeSerialNumber);
+            }
+            catch { Dispose();throw; }
+        }
+        public void Dispose(){if(Stream!=null){Stream.Dispose();Stream=null;}for(int index=handles.Count-1;index>=0;index--)handles[index].Dispose();handles.Clear();}
+    }
+
+    internal static Journal OpenJournal(string directory){return new Journal(directory,"product-residue-plan.json");}
+
     private void OpenTree(string runtimeId)
     {
         SafeFileHandle absolute=OpenAbsoluteDirectory(installPath);
@@ -163,11 +234,13 @@ internal sealed class CcodGenerationReclamationRuntimeV1 : IDisposable
 
     private void OpenChildren(Pin directory)
     {
+        if(Depth(directory.RelativePath)>32||directories.Count>4096||files.Count>16384)throw new InvalidDataException("bounded tree limit");
         string[] leaves=Enumerate(directory.Native);
         for(int index=0;index<leaves.Length;index++)
         {
             string leaf=leaves[index];
             if(String.IsNullOrEmpty(leaf)||leaf=="."||leaf==".."||leaf.IndexOfAny(new[]{'\\','/',':'})>=0||leaf.EndsWith(".",StringComparison.Ordinal)||leaf.EndsWith(" ",StringComparison.Ordinal))throw new InvalidDataException("unsafe enumerated leaf");
+            if(runtimeParent==null&&(String.Equals(leaf,"device-key",StringComparison.OrdinalIgnoreCase)||String.Equals(leaf,".codex",StringComparison.OrdinalIgnoreCase)||String.Equals(leaf,".env",StringComparison.OrdinalIgnoreCase)||String.Equals(leaf,"credentials",StringComparison.OrdinalIgnoreCase)))throw new InvalidDataException("protected user data");
             string path=Path.Combine(directory.Path,leaf),relative=String.IsNullOrEmpty(directory.RelativePath)?leaf:directory.RelativePath+"/"+leaf;
             SafeFileHandle handle=OpenRelative(directory.Native,leaf,DELETE|READ_DATA|READ_ATTRIBUTES|SYNCHRONIZE,SHARE_READ,BACKUP_INTENT);
             try
@@ -204,7 +277,7 @@ internal sealed class CcodGenerationReclamationRuntimeV1 : IDisposable
         fileRecords.Sort(delegate(CcodGenerationReclamationSnapshotV1.FileRecord left,CcodGenerationReclamationSnapshotV1.FileRecord right){return StringComparer.Ordinal.Compare(left.Path,right.Path);});
         List<string> directoryPaths=new List<string>();foreach(Pin directory in directories)if(!Object.ReferenceEquals(directory,selectedRoot))directoryPaths.Add(directory.RelativePath);
         directoryPaths.Sort(StringComparer.Ordinal);
-        return new CcodGenerationReclamationSnapshotV1(ReadText(manifest.Stream),fileRecords.ToArray(),directoryPaths.ToArray());
+        return new CcodGenerationReclamationSnapshotV1(manifest==null?null:ReadText(manifest.Stream),fileRecords.ToArray(),directoryPaths.ToArray());
     }
 
     internal void Reclaim(int failFileArmAt,int failCommitAt)
@@ -270,9 +343,10 @@ internal sealed class CcodGenerationReclamationRuntimeV1 : IDisposable
     private void Revalidate()
     {
         ValidateDirectoryIdentity(installRoot,installPath);
-        ValidateDirectoryIdentity(runtimeParent,runtimeParentPath);
+        if(runtimeParent!=null)ValidateDirectoryIdentity(runtimeParent,runtimeParentPath);
+        foreach(Pin ancestor in residueAncestors)ValidateDirectoryIdentity(ancestor,ancestor.Path);
         ValidateDirectoryIdentity(selectedRoot,selectedPath);
-        if(installRoot.Volume!=runtimeParent.Volume||runtimeParent.Volume!=selectedRoot.Volume)throw new InvalidDataException("selected root volume ancestry changed");
+        if(installRoot.Volume!=selectedRoot.Volume||(runtimeParent!=null&&runtimeParent.Volume!=selectedRoot.Volume))throw new InvalidDataException("selected root volume ancestry changed");
         foreach(Pin directory in directories)
         {
             ValidateDirectoryIdentity(directory,directory.Path);
@@ -399,6 +473,7 @@ internal sealed class CcodGenerationReclamationRuntimeV1 : IDisposable
         for(int index=directories.Count-1;index>=0;index--){try{directories[index].Dispose();}catch{}}
         try{if(runtimeParent!=null)runtimeParent.Dispose();}catch{}
         try{if(installRoot!=null)installRoot.Dispose();}catch{}
+        for(int index=residueAncestors.Count-1;index>=0;index--){try{residueAncestors[index].Dispose();}catch{}}
     }
 }
 '@
@@ -447,17 +522,22 @@ function ConvertTo-CcodGenerationReclamationRecord {
 }
 
 function Get-CcodGenerationReclamationRuntimeId {
-    param([Parameter(Mandatory)][string]$ProjectVersion,[Parameter(Mandatory)][object[]]$Records,[Parameter(Mandatory)][string]$Nonce)
-    if($ProjectVersion-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,45}$'-or$Nonce-cnotmatch'^[0-9a-f]{32}$'){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned manifest identity components are invalid' $ProjectVersion};$lines=[Collections.Generic.List[string]]::new();foreach($record in $Records){$lines.Add(('{0}`t{1}`t{2}'-f$record.path,[int64]$record.length,$record.sha256))};$sha=[Security.Cryptography.SHA256]::Create();try{$digest=[BitConverter]::ToString($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes(($lines-join"`n")))).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()};'{0}-{1}-{2}'-f$ProjectVersion,$digest.Substring(0,16),$Nonce
+    param([Parameter(Mandatory)][string]$ProjectVersion,[Parameter(Mandatory)][object[]]$Records,[Parameter(Mandatory)][string]$Nonce,[switch]$LegacyLiteralSeparators)
+    if($ProjectVersion-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,45}$'-or$Nonce-cnotmatch'^[0-9a-f]{32}$'){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned manifest identity components are invalid' $ProjectVersion};$lines=[Collections.Generic.List[string]]::new();foreach($record in $Records){$line=if($LegacyLiteralSeparators){'{0}`t{1}`t{2}'-f$record.path,[int64]$record.length,$record.sha256}else{"{0}`t{1}`t{2}"-f$record.path,[int64]$record.length,$record.sha256};$lines.Add($line)};$sha=[Security.Cryptography.SHA256]::Create();try{$digest=[BitConverter]::ToString($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes(($lines-join"`n")))).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()};'{0}-{1}-{2}'-f$ProjectVersion,$digest.Substring(0,16),$Nonce
 }
 
 function Assert-CcodGenerationReclamationSnapshot {
-    param([Parameter(Mandatory)]$Snapshot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)][string]$ExpectedManifestSha256)
+    param([Parameter(Mandatory)]$Snapshot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)][string]$ExpectedManifestSha256,[switch]$AllowLegacy2521)
     $files=@($Snapshot.Files);$manifestFile=@($files|Where-Object{$_.Path-ceq'manifest.json'});if($manifestFile.Count-ne1-or[string]$manifestFile[0].Sha256-cne$ExpectedManifestSha256){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned manifest hash does not match the durable binding' $RuntimeId}
     try{$json=[string]$Snapshot.ManifestText;if(-not(Test-CcodGenerationReclamationJsonHasNoDuplicateProperties $json)){throw 'duplicate properties'};$manifest=$json|ConvertFrom-Json -ErrorAction Stop}catch{Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned manifest JSON is malformed or ambiguous' $RuntimeId}
     if(-not(Test-CcodGenerationReclamationExactProperties $manifest @('schemaVersion','projectVersion','runtimeId','files'))-or$manifest.schemaVersion-isnot[int]-or$manifest.schemaVersion-ne1-or$manifest.projectVersion-isnot[string]-or$manifest.runtimeId-isnot[string]-or$manifest.runtimeId-cne$RuntimeId-or$null-eq$manifest.files){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned manifest header is invalid' $RuntimeId}
     $records=[Collections.Generic.List[object]]::new();$previous=$null;foreach($record in @($manifest.files)){$validated=ConvertTo-CcodGenerationReclamationRecord $record;if($null-ne$previous-and[StringComparer]::Ordinal.Compare($previous,$validated.path)-ge0){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned manifest records are not strictly ordered' $RuntimeId};$previous=$validated.path;$records.Add($validated)}
-    $match=[regex]::Match($RuntimeId,'^(?<version>[A-Za-z0-9][A-Za-z0-9._-]{0,45})-(?<digest>[0-9a-f]{16})-(?<nonce>[0-9a-f]{32})$');if(-not$match.Success-or$match.Groups['version'].Value-cne$manifest.projectVersion-or(Get-CcodGenerationReclamationRuntimeId -ProjectVersion $manifest.projectVersion -Records $records.ToArray() -Nonce $match.Groups['nonce'].Value)-cne$RuntimeId){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned manifest is not bound to the selected runtime ID' $RuntimeId}
+    $match=[regex]::Match($RuntimeId,'^(?<version>[A-Za-z0-9][A-Za-z0-9._-]{0,45})-(?<digest>[0-9a-f]{16})-(?<nonce>[0-9a-f]{32})$')
+    $legacy=$AllowLegacy2521-and$manifest.projectVersion-ceq'2.5.21'-and$RuntimeId-cmatch'^2\.5\.21-[0-9a-f]{16}\z'
+    if($legacy){
+        $suffix='-'+('0'*32);$canonical=Get-CcodGenerationReclamationRuntimeId -ProjectVersion '2.5.21' -Records $records.ToArray() -Nonce ('0'*32) -LegacyLiteralSeparators
+        if($canonical.Substring(0,$canonical.Length-$suffix.Length)-cne$RuntimeId){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Legacy manifest digest does not match its exact runtime ID' $RuntimeId}
+    }elseif(-not$match.Success-or$match.Groups['version'].Value-cne$manifest.projectVersion-or(Get-CcodGenerationReclamationRuntimeId -ProjectVersion $manifest.projectVersion -Records $records.ToArray() -Nonce $match.Groups['nonce'].Value)-cne$RuntimeId){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned manifest is not bound to the selected runtime ID' $RuntimeId}
     $expectedFiles=[Collections.Generic.List[object]]::new();foreach($record in $records){$expectedFiles.Add($record)};$expectedFiles.Add([pscustomobject]@{path='manifest.json';length=[int64]$manifestFile[0].Length;sha256=[string]$manifestFile[0].Sha256});$expectedFiles.Sort([Comparison[object]]{param($left,$right)[StringComparer]::Ordinal.Compare([string]$left.path,[string]$right.path)})
     if($files.Count-ne$expectedFiles.Count){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned tree contains an unexpected or missing file' $RuntimeId};for($index=0;$index-lt$files.Count;$index++){$actual=$files[$index];$expected=$expectedFiles[$index];if([string]$actual.Path-cne[string]$expected.path-or[int64]$actual.Length-ne[int64]$expected.length-or[string]$actual.Sha256-cne[string]$expected.sha256){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned tree differs from its sealed manifest' $actual.Path}}
     $expectedDirectories=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal);foreach($record in $records){$segments=[string]$record.path-split'/';for($count=1;$count-lt$segments.Count;$count++){[void]$expectedDirectories.Add(($segments[0..($count-1)]-join'/'))}};$expectedDirectoryList=@($expectedDirectories);[Array]::Sort($expectedDirectoryList,[StringComparer]::Ordinal);$actualDirectories=@($Snapshot.Directories);if($actualDirectories.Count-ne$expectedDirectoryList.Count){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned tree contains an unexpected or missing directory' $RuntimeId};for($index=0;$index-lt$actualDirectories.Count;$index++){if([string]$actualDirectories[$index]-cne[string]$expectedDirectoryList[$index]){Throw-CcodGenerationReclamationError 'CCOD_GENERATION_RECLAMATION_INVALID' 'Pinned directory set differs from the sealed manifest' $actualDirectories[$index]}}
@@ -490,4 +570,304 @@ function Remove-CcodVerifiedGenerationTree {
     }finally{if($null-ne$native){try{$native.Dispose()}catch{}}}
 }
 
-Export-ModuleMember -Function Remove-CcodVerifiedGenerationTree
+function Read-CcodProductResidueText {
+    param([Parameter(Mandatory)]$Native,[Parameter(Mandatory)][string]$Path)
+    if($Native-is[Collections.IDictionary]){
+        if(-not$Native.Contains($Path)-or$Native[$Path]-isnot[string]){throw 'cleanup evidence text is missing'}
+        return [string]$Native[$Path]
+    }
+    return Invoke-CcodGenerationReclamationMethod -Runtime $Native -Name ReadFileText -Arguments @($Path)
+}
+
+function Read-CcodProductResidueJson {
+    param([Parameter(Mandatory)]$Native,[Parameter(Mandatory)][string]$Path)
+    $text=Read-CcodProductResidueText -Native $Native -Path $Path
+    if(-not(Test-CcodGenerationReclamationJsonHasNoDuplicateProperties $text)){throw 'ambiguous product state'}
+    $value=$text|ConvertFrom-Json -ErrorAction Stop
+    if($value-isnot[pscustomobject]-or$null-eq$value.PSObject.Properties['schemaVersion']-or
+       ($value.schemaVersion-isnot[int]-and$value.schemaVersion-isnot[long])-or$value.schemaVersion-lt1-or$value.schemaVersion-gt3){throw 'unknown product state format'}
+    return $value
+}
+
+function Assert-CcodProductResidueSnapshot {
+    param([Parameter(Mandatory)]$Native,[Parameter(Mandatory)]$Snapshot,[Parameter(Mandatory)][string]$SelectedRuntimeId,[Parameter(Mandatory)][uint64]$ExpectedEpoch)
+    $epoch=Read-CcodProductResidueJson -Native $Native -Path 'state/lifecycle-epoch.json'
+    if(-not(Test-CcodGenerationReclamationExactProperties $epoch @('schemaVersion','epoch'))-or
+       ($epoch.epoch-isnot[int]-and$epoch.epoch-isnot[long])-or$epoch.epoch-lt0-or[uint64]$epoch.epoch-ne$ExpectedEpoch){throw 'product residue epoch changed'}
+    $knownFiles=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    $expectedDirectories=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    [void]$knownFiles.Add('state/lifecycle-epoch.json')
+    foreach($directory in @('runtime','state','logs','state/active-generation','state/lifecycle','state/lifecycle/receipts','state/lifecycle/inbox','state/workers')){[void]$expectedDirectories.Add($directory)}
+    $pointers=[Collections.Generic.List[object]]::new()
+    foreach($file in $Snapshot.Files){
+        $path=[string]$file.Path
+        if($path-cmatch'^state/active-generation/([0-9]{20})\.json\z'){
+            $number=[uint64]$matches[1];$pointer=Read-CcodProductResidueJson -Native $Native -Path $path
+            if(-not(Test-CcodGenerationReclamationExactProperties $pointer @('schemaVersion','generation','activeRuntime','previousGeneration'))-or
+               $pointer.schemaVersion-ne1-or$number-ne[uint64]($pointers.Count+1)-or
+               ($pointer.generation-isnot[int]-and$pointer.generation-isnot[long])-or$pointer.generation-ne$number-or
+               ($pointer.previousGeneration-isnot[int]-and$pointer.previousGeneration-isnot[long])-or$pointer.previousGeneration-ne($number-1)-or
+               $pointer.activeRuntime-isnot[string]-or$pointer.activeRuntime-cnotmatch'^2\.[0-9]+\.[0-9]+-[0-9a-f]{16}(?:-[0-9a-f]{32})?\z'){throw 'product selector invalid'}
+            $pointers.Add($pointer);[void]$knownFiles.Add($path)
+        }
+    }
+    if($pointers.Count-eq0-or$pointers[$pointers.Count-1].activeRuntime-cne$SelectedRuntimeId){throw 'product residue selector changed'}
+    $retainedIds=@($Snapshot.Directories|Where-Object {$_-cmatch'^runtime/[^/]+\z'}|ForEach-Object {$_.Substring(8)})
+    foreach($runtimeId in $retainedIds){
+        if($runtimeId-ceq$SelectedRuntimeId){throw 'selected generation was not reclaimed'}
+        $prefix='runtime/'+$runtimeId+'/'
+        $manifestFile=@($Snapshot.Files|Where-Object {$_.Path-ceq($prefix+'manifest.json')})
+        if($manifestFile.Count-ne1){throw 'retained generation manifest is missing'}
+        $manifestText=Read-CcodProductResidueText -Native $Native -Path ($prefix+'manifest.json')
+        $relativeFiles=@($Snapshot.Files|Where-Object {$_.Path.StartsWith($prefix,[StringComparison]::Ordinal)}|ForEach-Object {[pscustomobject]@{Path=$_.Path.Substring($prefix.Length);Length=$_.Length;Sha256=$_.Sha256}})
+        $relativeDirectories=@($Snapshot.Directories|Where-Object {$_.StartsWith($prefix,[StringComparison]::Ordinal)}|ForEach-Object {$_.Substring($prefix.Length)})
+        [void](Assert-CcodGenerationReclamationSnapshot -Snapshot ([pscustomobject]@{Files=$relativeFiles;Directories=$relativeDirectories;ManifestText=$manifestText}) -RuntimeId $runtimeId -ExpectedManifestSha256 $manifestFile[0].Sha256 -AllowLegacy2521)
+        [void]$expectedDirectories.Add('runtime/'+$runtimeId)
+        foreach($file in $relativeFiles){[void]$knownFiles.Add($prefix+$file.Path)}
+        foreach($directory in $relativeDirectories){[void]$expectedDirectories.Add($prefix+$directory)}
+    }
+    $stateFields=@{
+        'settings.json'=@('schemaVersion','automationEnabled','candidateCompatibleOptIn','nodeCandidates','updatedAtUtc')
+        'status.json'=@('schemaVersion','session')
+        'verified-packages.json'=@('schemaVersion','packages')
+        'transition.json'=@('schemaVersion','activeTransaction')
+        'ui-preferences.json'=@('schemaVersion','languageMode','updatedAtUtc')
+    }
+    $transactionFields=@('schemaVersion','transactionId','oldRuntimeId','oldGeneration','oldManifestSha256','newRuntimeId','newGeneration','newManifestSha256','sealedPackageSha256','ownedObjectNames','phase','errorCode')
+    $installPhases=@('Prepared','PackageVerified','RuntimeStaged','PreviousProtectionStopped','RuntimePromoted','PointerCommitted','StableShellCommitted','ProtectionReady','Ready')
+    $activationFields=@('schemaVersion','activationId','phase','runtimeId','previousRuntimeId','startedAtUtc','updatedAtUtc','ready','errorCode')
+    $activationPhases=@('StoppingPreviousRuntime','InstallingRuntime','ActivatingRuntime','StartingProtection','Ready','Failed')
+    $readyRecords=@{}
+    foreach($file in $Snapshot.Files|Where-Object {$_.Path-cmatch'^state/install-transactions/[0-9]{20}\.08\.Ready\.[0-9a-f-]{36}\.json\z'}){
+        $record=Read-CcodProductResidueJson -Native $Native -Path $file.Path
+        if(-not(Test-CcodGenerationReclamationExactProperties $record $transactionFields)-or$record.phase-cne'Ready'-or$record.newRuntimeId-isnot[string]){throw 'invalid Ready transaction'}
+        $readyRecords[$record.transactionId]=$record
+    }
+    foreach($file in $Snapshot.Files){
+        $path=[string]$file.Path
+        if($knownFiles.Contains($path)){continue}
+        if($path-cmatch'^logs/(install|session)\.log(?:\.(?:[1-9]|10))?\z'){
+            $kind=$matches[1]
+            if($file.Length-gt2097152){throw 'product diagnostic exceeds its writer limit'}
+            $text=Read-CcodProductResidueText -Native $Native -Path $path
+            foreach($line in @($text-split'\r?\n'|Where-Object {$_-cne''})){
+                if(-not(Test-CcodGenerationReclamationJsonHasNoDuplicateProperties $line)){throw 'ambiguous product diagnostic'}
+                $record=$line|ConvertFrom-Json -ErrorAction Stop
+                $fields=if($kind-ceq'install'){@('schemaVersion','timestampUtc','component','stage','code','outcome')}else{@('schemaVersion','timestampUtc','action','transactionId','stage','code')}
+                if($kind-ceq'session'-and$record.schemaVersion-eq2){$fields+=@('reason')}
+                if(-not(Test-CcodGenerationReclamationExactProperties $record $fields)-or$record.schemaVersion-isnot[int]-or$record.schemaVersion-notin@(1,2)-or
+                   $record.stage-isnot[string]-or$record.code-isnot[string]-or$record.code-cnotmatch'^CCOD_[A-Z0-9_]+\z'-or$record.timestampUtc-isnot[string]){throw 'unknown product diagnostic contract'}
+                if($kind-ceq'install'-and($record.schemaVersion-ne1-or$record.component-cne'Install'-or$record.outcome-isnot[string])){throw 'unknown install diagnostic contract'}
+                if($kind-ceq'session'-and$null-ne$record.action-and@('Inspect','Close','Apply','RepairRenderer','Recover')-cnotcontains$record.action){throw 'unknown session diagnostic action'}
+                [void][DateTime]::ParseExact($record.timestampUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
+            }
+            [void]$knownFiles.Add($path);continue
+        }
+        if($path-cmatch'^state/lifecycle/receipts/([0-9a-f-]{36})\.json\z'){
+            $id=$matches[1];$value=Read-CcodProductResidueJson -Native $Native -Path $path
+            $fields=@('schemaVersion','transactionId','kind','origin','runtimeId','runtimeGeneration','leaseEpoch','ownerIdentity','logonIdentity','phase','createdAtUtc','updatedAtUtc','launchRequestedAtUtc','manualLaunchExpiresAtUtc','automaticLaunchAttempts','error')
+            if(-not(Test-CcodGenerationReclamationExactProperties $value $fields)-or$value.schemaVersion-ne1-or$value.transactionId-cne$id-or
+               @('Completed','CloseFailed','OrdinaryLaunchFailed','OrdinaryObservationTimedOut','LaunchWindowExpired','RepairFailed','VerificationFailed','CancelledBeforeClose','SupersededByUpgrade')-cnotcontains$value.phase-or
+               @($pointers|Where-Object {$_.activeRuntime-ceq$value.runtimeId}).Count-eq0){throw 'lifecycle receipt is not a completed installed operation'}
+            [void]$knownFiles.Add($path);continue
+        }
+        if($path-cmatch'^state/lifecycle/inbox/([0-9a-f-]{36})\.receipt\.json\z'){
+            $id=$matches[1];$value=Read-CcodProductResidueJson -Native $Native -Path $path
+            if(-not(Test-CcodGenerationReclamationExactProperties $value @('schemaVersion','submissionId','accepted','transactionId','errorCode','completedAtUtc'))-or$value.schemaVersion-ne1-or$value.submissionId-cne$id-or$value.accepted-isnot[bool]-or
+               ($value.accepted-and($value.transactionId-isnot[string]-or$value.transactionId-cnotmatch'^[0-9a-f-]{36}\z'-or$null-ne$value.errorCode))){throw 'submission receipt is not exact'}
+            [void]$knownFiles.Add($path);continue
+        }
+        if($path-ceq'state/lifecycle/safe-exit-intent.json'){
+            $value=Read-CcodProductResidueJson -Native $Native -Path $path
+            if(-not(Test-CcodGenerationReclamationExactProperties $value @('schemaVersion','logonIdentity','runtimeId','recoveryTransactionId','createdAtUtc'))-or$value.schemaVersion-ne1-or
+               @($pointers|Where-Object {$_.activeRuntime-ceq$value.runtimeId}).Count-eq0-or$value.recoveryTransactionId-isnot[string]-or$value.recoveryTransactionId-cnotmatch'^[0-9a-f-]{36}\z'-or
+               -not(Test-CcodGenerationReclamationExactProperties $value.logonIdentity @('authenticationId','userSid','sessionId'))){throw 'safe-exit marker is not an installed lifecycle record'}
+            [void]$knownFiles.Add($path);continue
+        }
+        if($path-ceq'state/transaction-completion.receipt.json'){
+            $value=Read-CcodProductResidueJson -Native $Native -Path $path
+            if(-not(Test-CcodGenerationReclamationExactProperties $value @('schemaVersion','transactionId','disposition','terminalStage','completedAtUtc','state','archiveErrorId'))-or$value.schemaVersion-ne1-or
+               @('Archived','ArchiveFailed')-cnotcontains$value.state-or@('Cancelled','Activated','Recovered','Closed')-cnotcontains$value.disposition){throw 'transition completion is not terminal'}
+            [void]$knownFiles.Add($path);continue
+        }
+        if($path-cmatch'^logs/transactions\.log(?:\.(?:[1-9]|10))?\z'){
+            if($file.Length-gt2097152){throw 'transaction log exceeds its writer limit'}
+            $text=Read-CcodProductResidueText -Native $Native -Path $path
+            foreach($line in @($text-split'\r?\n'|Where-Object {$_-cne''})){
+                if(-not(Test-CcodGenerationReclamationJsonHasNoDuplicateProperties $line)){throw 'ambiguous transaction diagnostic'}
+                $record=$line|ConvertFrom-Json -ErrorAction Stop
+                $fields=@('schemaVersion','transactionId','disposition','terminalStage','sourcePid','sourceCreationTimeUtc','specialPid','specialCreationTimeUtc','recoveryPid','recoveryCreationTimeUtc','appAsarSha256','runtimeId','completedAtUtc','archiveState')
+                if(-not(Test-CcodGenerationReclamationExactProperties $record $fields)-or$record.schemaVersion-isnot[int]-or$record.schemaVersion-ne1-or$record.archiveState-cne'Archived'-or
+                   @('Cancelled','Activated','Recovered','Closed')-cnotcontains$record.disposition-or@($pointers|Where-Object {$_.activeRuntime-ceq$record.runtimeId}).Count-eq0){throw 'unknown transaction archive contract'}
+            }
+            [void]$knownFiles.Add($path);continue
+        }
+        if($path-ceq'active.json'){
+            $value=Read-CcodProductResidueJson -Native $Native -Path $path
+            if(-not(Test-CcodGenerationReclamationExactProperties $value @('schemaVersion','activeRuntime','previousRuntime','generation','updatedAtUtc'))-or
+               $value.schemaVersion-ne2-or$value.activeRuntime-cnotmatch'^2\.5\.21-[0-9a-f]{16}\z'-or$pointers[0].activeRuntime-cne$value.activeRuntime-or
+               @($retainedIds|Where-Object {$_-ceq$value.activeRuntime}).Count-ne1){throw 'legacy pointer is not bound to a retained installed generation'}
+            [void]$knownFiles.Add($path);continue
+        }
+        if($path-ceq'state/post-install-activation.json'){
+            $value=Read-CcodProductResidueJson -Native $Native -Path $path
+            if(-not(Test-CcodGenerationReclamationExactProperties $value $activationFields)-or$value.schemaVersion-ne1-or$value.phase-cne'Ready'-or$value.ready-isnot[bool]-or-not$value.ready-or
+               $value.runtimeId-cnotmatch'^2\.5\.21-[0-9a-f]{16}\z'-or$pointers[0].activeRuntime-cne$value.runtimeId-or$null-ne$value.errorCode){throw 'legacy activation record is not an exact Ready record'}
+            [void]$knownFiles.Add($path);continue
+        }
+        if(@('bootstrap.ps1','Uninstall-CodexControlOtherDevices.ps1')-ccontains$path){
+            $relative=if($path-ceq'bootstrap.ps1'){'src/persistence/bootstrap.ps1'}else{$path}
+            $matching=@($Snapshot.Files|Where-Object {$_.Path-ceq('runtime/'+$pointers[0].activeRuntime+'/'+$relative)-and$_.Length-eq$file.Length-and$_.Sha256-ceq$file.Sha256})
+            if($pointers[0].activeRuntime-cnotmatch'^2\.5\.21-[0-9a-f]{16}\z'-or$matching.Count-ne1){throw 'stable legacy shell differs from verified generation'}
+            [void]$knownFiles.Add($path);continue
+        }
+        if($path-ceq'state/lifecycle-epoch.initialized.json'){
+            $value=Read-CcodProductResidueJson -Native $Native -Path $path
+            if($value.schemaVersion-ne1-or-not(Test-CcodGenerationReclamationExactProperties $value @('schemaVersion'))){throw 'epoch initialization record is not exact'}
+            [void]$knownFiles.Add($path);continue
+        }
+        if($path-cmatch'^logs/supervisor\.log(?:\.(?:[1-9]|10))?\z'){
+            if($file.Length-gt2097152){throw 'product log exceeds its writer limit'}
+            $text=Read-CcodProductResidueText -Native $Native -Path $path
+            foreach($line in @($text-split'\r?\n'|Where-Object {$_-cne''})){
+                if(-not(Test-CcodGenerationReclamationJsonHasNoDuplicateProperties $line)){throw 'ambiguous supervisor diagnostic'}
+                $record=$line|ConvertFrom-Json -ErrorAction Stop
+                $fields=@('schemaVersion','timestampUtc','component','stage','code','outcome')
+                if($record.stage-ceq'TrayAction'){$fields+=@('command','revision','status')}
+                elseif($record.stage-ceq'TrayHostReady'){$fields+=@('runtimeId','hostPid','hostCreationTimeUtc','protocolMajor','capabilities')}
+                $abandonedWarning=$record.stage-ceq'LeaseAcquire'-and$record.code-ceq'CCOD_SUPERVISOR_LEASE_ABANDONED'-and$record.outcome-ceq'Warning'
+                if(-not(Test-CcodGenerationReclamationExactProperties $record $fields)-or$record.schemaVersion-isnot[int]-or$record.schemaVersion-ne1-or
+                   $record.component-cne'Supervisor'-or$record.stage-isnot[string]-or$record.code-isnot[string]-or$record.code-cnotmatch'^CCOD_[A-Z0-9_]+\z'-or
+                   $record.outcome-isnot[string]-or(@('Completed','Rejected','Failed','Ready')-cnotcontains$record.outcome-and-not$abandonedWarning)-or$record.timestampUtc-isnot[string]){throw 'unknown supervisor diagnostic contract'}
+                [void][DateTime]::ParseExact($record.timestampUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
+            }
+            [void]$knownFiles.Add($path);continue
+        }
+        if($path-cmatch'^state/install-initializations/(2\.5\.22-[0-9a-f]{16}-[0-9a-f]{32})/([^/]+)\z'){
+            $runtimeId=$matches[1];$leaf=$matches[2]
+            if(-not$stateFields.ContainsKey($leaf)-or@($pointers|Where-Object {$_.activeRuntime-ceq$runtimeId}).Count-eq0){throw 'initialization baseline is not an installed generation'}
+            $value=Read-CcodProductResidueJson -Native $Native -Path $path
+            if($value.schemaVersion-ne1-or-not(Test-CcodGenerationReclamationExactProperties $value $stateFields[$leaf])){throw 'initialization state members changed'}
+            [void]$expectedDirectories.Add('state/install-initializations');[void]$expectedDirectories.Add('state/install-initializations/'+$runtimeId)
+            [void]$knownFiles.Add($path);continue
+        }
+        if($path-cmatch'^state/install-transactions/([0-9]{20})\.([0-9]{2})\.([A-Za-z]+)\.([0-9a-f-]{36})\.json\z'){
+            $generation=[uint64]$matches[1];$phaseIndex=[int]$matches[2];$phase=$matches[3];$id=$matches[4]
+            $value=Read-CcodProductResidueJson -Native $Native -Path $path
+            if(-not(Test-CcodGenerationReclamationExactProperties $value $transactionFields)-or$value.newGeneration-ne$generation-or$value.phase-cne$phase-or$value.transactionId-cne$id-or
+               $phaseIndex-ge$installPhases.Count-or$installPhases[$phaseIndex]-cne$phase-or-not$readyRecords.ContainsKey($id)-or$value.newRuntimeId-cne$readyRecords[$id].newRuntimeId){throw 'install transaction identity mismatch'}
+            [void]$expectedDirectories.Add('state/install-transactions');[void]$knownFiles.Add($path);continue
+        }
+        if($path-cmatch'^state/activation-receipts/([0-9a-f-]{36})\.([A-Za-z]+)\.json\z'){
+            $id=$matches[1];$phase=$matches[2];$value=Read-CcodProductResidueJson -Native $Native -Path $path
+            if(-not(Test-CcodGenerationReclamationExactProperties $value $activationFields)-or$value.activationId-cne$id-or$value.phase-cne$phase-or$activationPhases-cnotcontains$phase-or
+               $value.ready-isnot[bool]-or$value.ready-ne($phase-ceq'Ready')-or($null-ne$value.runtimeId-and@($pointers|Where-Object {$_.activeRuntime-ceq$value.runtimeId}).Count-eq0)){throw 'activation receipt identity mismatch'}
+            [void]$expectedDirectories.Add('state/activation-receipts');[void]$knownFiles.Add($path);continue
+        }
+        if($path-cmatch'^state/install-logs/([0-9]{1,19})\.([A-Za-z]+)\.[0-9a-f]{32}\.json\z'){
+            $ticks=$matches[1];$stage=$matches[2];$value=Read-CcodProductResidueJson -Native $Native -Path $path
+            if(-not(Test-CcodGenerationReclamationExactProperties $value @('schemaVersion','timestampUtc','component','stage','code','outcome'))-or
+               $value.component-cne'Install'-or$value.stage-cne$stage-or$value.code-cnotmatch'^CCOD_[A-Z0-9_]+\z'-or
+               [DateTime]::Parse($value.timestampUtc).Ticks.ToString()-cne$ticks){throw 'install log identity mismatch'}
+            [void]$expectedDirectories.Add('state/install-logs');[void]$knownFiles.Add($path);continue
+        }
+        if($path-cmatch'^state/product-cleanup-fences/([0-9]{20})\.(Pending|Completed)\.([0-9a-f-]{36})\.json\z'){
+            $attempt=$matches[1];$state=$matches[2];$id=$matches[3];$value=Read-CcodProductResidueJson -Native $Native -Path $path
+            if(-not(Test-CcodGenerationReclamationExactProperties $value @('schemaVersion','transactionId','runtimeId','runtimeGeneration','manifestSha256','packageSha256','ownerPid','ownerCreationTimeUtc','ownerSid','state'))-or
+               $value.transactionId-cne$id-or$value.state-cne$state-or-not$readyRecords.ContainsKey($id)-or$value.runtimeId-cne$readyRecords[$id].newRuntimeId-or$value.manifestSha256-cne$readyRecords[$id].newManifestSha256-or
+               @($Snapshot.Files|Where-Object {$_.Path-ceq('state/product-cleanup-fences/'+$attempt+'.Completed.'+$id+'.json')}).Count-ne1){throw 'product cleanup fence is incomplete or changed'}
+            [void]$expectedDirectories.Add('state/product-cleanup-fences');[void]$knownFiles.Add($path);continue
+        }
+        if($path-cmatch'^state/legacy-registration-migrations/([0-9]{20})\.([0-9a-f-]{36})\.json\z'){
+            $generation=[uint64]$matches[1];$id=$matches[2];$value=Read-CcodProductResidueJson -Native $Native -Path $path
+            if(-not(Test-CcodGenerationReclamationExactProperties $value @('schemaVersion','transactionId','runtimeId','runtimeGeneration','manifestSha256','packageSha256','readyTransaction','appId','expectedInstallRoot','legacyPresent','legacyRegistration','profile','snapshot','expectedCurrentProof'))-or
+               $value.transactionId-cne$id-or$value.runtimeGeneration-ne$generation-or-not$readyRecords.ContainsKey($id)-or$value.runtimeId-cne$readyRecords[$id].newRuntimeId-or
+               $value.manifestSha256-cne$readyRecords[$id].newManifestSha256-or($value.readyTransaction|ConvertTo-Json -Depth 8 -Compress)-cne($readyRecords[$id]|ConvertTo-Json -Depth 8 -Compress)-or
+               $value.appId-cne'{2B9E9F2E-7A32-4A7E-9C1D-9F5B5C6D7E8F}'){throw 'legacy migration record identity mismatch'}
+            [void]$expectedDirectories.Add('state/legacy-registration-migrations');[void]$knownFiles.Add($path);continue
+        }
+        if($path-cmatch'^state/([^/]+)\z'-and$stateFields.ContainsKey($matches[1])){
+            $leaf=$matches[1];$value=Read-CcodProductResidueJson -Native $Native -Path $path
+            if(-not(Test-CcodGenerationReclamationExactProperties $value $stateFields[$leaf])){throw 'unrecognized product state members'}
+            if($leaf-ceq'settings.json'-and$value.automationEnabled-cne$false){throw 'automation must be stopped'}
+            if($leaf-ceq'status.json'-and$null-ne$value.session){throw 'active session remains'}
+            if($leaf-ceq'transition.json'-and$null-ne$value.activeTransaction){throw 'active transition remains'}
+            [void]$knownFiles.Add($path);continue
+        }
+        throw ('unrecognized product residue: '+$path)
+    }
+    foreach($directory in $Snapshot.Directories){if(-not$expectedDirectories.Contains([string]$directory)){throw ('unrecognized product directory: '+$directory)}}
+}
+
+function Remove-CcodVerifiedProductResidue {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$SelectedRuntimeId,[Parameter(Mandatory)][uint64]$ExpectedEpoch,[string]$TransactionDirectory,[string]$TransactionId)
+    $native=$null;$journal=$null
+    try {
+        $root=[IO.Path]::GetFullPath($InstallRoot)
+        if($root-cne$InstallRoot-or[IO.Path]::GetFileName($root)-cne'CodexControlOtherDevices'-or
+           $SelectedRuntimeId-cnotmatch'^2\.5\.22-[0-9a-f]{16}-[0-9a-f]{32}\z'){throw 'product residue root or runtime identity'}
+        Initialize-CcodGenerationReclamationRuntime
+        $hasJournal=-not[string]::IsNullOrEmpty($TransactionDirectory)
+        $planPath=$null;$planPresent=$false;$rootPresent=$false
+        if($hasJournal){
+            if($TransactionId-cnotmatch'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z'){throw 'product cleanup transaction ID'}
+            $expectedDirectory=Join-Path (Split-Path $root -Parent) ('CodexRemote-fix-uninstall/'+$TransactionId)
+            if([IO.Path]::GetFullPath($TransactionDirectory)-cne[IO.Path]::GetFullPath($expectedDirectory)){throw 'product cleanup journal escaped its transaction'}
+            $planPath=Join-Path $TransactionDirectory 'product-residue-plan.json'
+            try {Get-Item -LiteralPath $planPath -Force -ErrorAction Stop|Out-Null;$planPresent=$true}catch [Management.Automation.ItemNotFoundException]{}
+        }
+        try {Get-Item -LiteralPath $root -Force -ErrorAction Stop|Out-Null;$rootPresent=$true}catch [Management.Automation.ItemNotFoundException]{}
+        if($rootPresent){
+            $native=Invoke-CcodGenerationReclamationStatic -Name OpenResidue -Arguments @($root)
+            $snapshot=Invoke-CcodGenerationReclamationMethod -Runtime $native -Name Snapshot -Arguments @()
+        }elseif(-not$planPresent){throw 'missing product root has no prior cleanup authority'}
+        if(-not$planPresent){Assert-CcodProductResidueSnapshot -Native $native -Snapshot $snapshot -SelectedRuntimeId $SelectedRuntimeId -ExpectedEpoch $ExpectedEpoch}
+        if($hasJournal){
+            $journal=Invoke-CcodGenerationReclamationStatic -Name OpenJournal -Arguments @([IO.Path]::GetFullPath($TransactionDirectory))
+            if($journal.Created){
+                if($planPresent-or-not$rootPresent){throw 'cleanup journal changed at acquisition'}
+                $evidence=@($snapshot.Files|Where-Object {$_.Path-ceq'active.json'-or$_.Path.StartsWith('state/',[StringComparison]::Ordinal)-or$_.Path.StartsWith('logs/',[StringComparison]::Ordinal)-or$_.Path.EndsWith('/manifest.json',[StringComparison]::Ordinal)}|ForEach-Object {[pscustomobject][ordered]@{path=[string]$_.Path;text=(Read-CcodProductResidueText -Native $native -Path $_.Path)}})
+                $plan=[pscustomobject][ordered]@{schemaVersion=1;transactionId=$TransactionId;installRoot=$root;runtimeId=$SelectedRuntimeId;epoch=$ExpectedEpoch;rootIdentity=(Invoke-CcodGenerationReclamationMethod -Runtime $native -Name RootIdentity -Arguments @());files=@($snapshot.Files|ForEach-Object {[pscustomobject][ordered]@{path=[string]$_.Path;length=[long]$_.Length;sha256=[string]$_.Sha256}});directories=@($snapshot.Directories);evidence=$evidence}
+                $bytes=[Text.UTF8Encoding]::new($false).GetBytes(($plan|ConvertTo-Json -Depth 8 -Compress))
+                if($bytes.Length-gt4194304){throw 'cleanup journal bounds'}
+                $journal.Stream.Write($bytes,0,$bytes.Length);$journal.Stream.Flush($true)
+            }
+            if($journal.Stream.Length-lt1-or$journal.Stream.Length-gt4194304){throw 'invalid cleanup journal length'}
+            $journal.Stream.Position=0;$bytes=[byte[]]::new([int]$journal.Stream.Length);$read=0
+            while($read-lt$bytes.Length){$count=$journal.Stream.Read($bytes,$read,$bytes.Length-$read);if($count-le0){throw 'incomplete cleanup journal'};$read+=$count}
+            $text=[Text.UTF8Encoding]::new($false,$true).GetString($bytes)
+            if(-not(Test-CcodGenerationReclamationJsonHasNoDuplicateProperties $text)){throw 'ambiguous cleanup journal'}
+            $plan=$text|ConvertFrom-Json -ErrorAction Stop
+            if(-not(Test-CcodGenerationReclamationExactProperties $plan @('schemaVersion','transactionId','installRoot','runtimeId','epoch','rootIdentity','files','directories','evidence'))-or
+               $plan.schemaVersion-isnot[int]-or$plan.schemaVersion-ne1-or$plan.transactionId-isnot[string]-or$plan.transactionId-cne$TransactionId-or$plan.installRoot-isnot[string]-or$plan.installRoot-cne$root-or$plan.runtimeId-isnot[string]-or$plan.runtimeId-cne$SelectedRuntimeId-or
+               ($plan.epoch-isnot[int]-and$plan.epoch-isnot[long])-or$plan.epoch-ne$ExpectedEpoch-or
+               $plan.rootIdentity-isnot[string]-or$plan.rootIdentity-cnotmatch'^[0-9]+-[0-9]+\z'-or$plan.files-isnot[array]-or$plan.directories-isnot[array]-or$plan.evidence-isnot[array]){throw 'cleanup journal binding changed'}
+            $expected=@{};foreach($file in $plan.files){
+                if(-not(Test-CcodGenerationReclamationExactProperties $file @('path','length','sha256'))-or$file.path-isnot[string]-or$expected.ContainsKey($file.path)-or$file.sha256-isnot[string]-or$file.sha256-cnotmatch'^[0-9a-f]{64}\z'-or
+                   ($file.length-isnot[int]-and$file.length-isnot[long])-or$file.length-lt0){throw 'cleanup journal file identity'}
+                $expected[$file.path]=$file
+            }
+            $texts=[ordered]@{};$sha=[Security.Cryptography.SHA256]::Create()
+            try {foreach($entry in $plan.evidence){
+                if(-not(Test-CcodGenerationReclamationExactProperties $entry @('path','text'))-or$entry.path-isnot[string]-or$entry.text-isnot[string]-or$texts.Contains($entry.path)-or-not$expected.ContainsKey($entry.path)){throw 'cleanup journal evidence identity'}
+                $bytes=[Text.UTF8Encoding]::new($false,$true).GetBytes($entry.text);$hash=[BitConverter]::ToString($sha.ComputeHash($bytes)).Replace('-','').ToLowerInvariant()
+                if($bytes.LongLength-ne$expected[$entry.path].length-or$hash-cne$expected[$entry.path].sha256){throw 'cleanup journal evidence bytes changed'}
+                $texts[$entry.path]=$entry.text
+            }}finally{$sha.Dispose()}
+            $savedSnapshot=[pscustomobject]@{Files=@($plan.files|ForEach-Object {[pscustomobject]@{Path=$_.path;Length=$_.length;Sha256=$_.sha256}});Directories=$plan.directories}
+            Assert-CcodProductResidueSnapshot -Native $texts -Snapshot $savedSnapshot -SelectedRuntimeId $SelectedRuntimeId -ExpectedEpoch $ExpectedEpoch
+            if(-not$rootPresent){return [pscustomobject][ordered]@{phase='Completed';result='Removed';fileCount=0}}
+            if($plan.rootIdentity-cne(Invoke-CcodGenerationReclamationMethod -Runtime $native -Name RootIdentity -Arguments @())){throw 'product root identity changed after cleanup began'}
+            foreach($file in $snapshot.Files){if(-not$expected.ContainsKey($file.Path)-or$expected[$file.Path].length-ne$file.Length-or$expected[$file.Path].sha256-cne$file.Sha256){throw 'product residue changed during retry'}}
+            foreach($directory in $snapshot.Directories){if($plan.directories-cnotcontains$directory){throw 'product residue directory changed during retry'}}
+        }
+        [void](Invoke-CcodGenerationReclamationMethod -Runtime $native -Name Reclaim -Arguments @(-1,[int]$script:CcodProductResidueFailCommitAtForTest))
+        try {Get-Item -LiteralPath $root -Force -ErrorAction Stop|Out-Null;throw 'product root remains'}catch [Management.Automation.ItemNotFoundException]{}
+        return [pscustomobject][ordered]@{phase='Completed';result='Removed';fileCount=[int]$snapshot.Files.Count}
+    } catch {
+        Throw-CcodGenerationReclamationError 'CCOD_PRODUCT_RESIDUE_INVALID' ('Bounded product cleanup rejected: '+$_.Exception.Message) $InstallRoot
+    } finally {if($null-ne$journal){$journal.Dispose()};if($null-ne$native){$native.Dispose()}}
+}
+
+Export-ModuleMember -Function Remove-CcodVerifiedGenerationTree,Remove-CcodVerifiedProductResidue
diff --git a/src/persistence/modules/RuntimeManifest.psm1 b/src/persistence/modules/RuntimeManifest.psm1
index 974eee0..61340f5 100644
--- a/src/persistence/modules/RuntimeManifest.psm1
+++ b/src/persistence/modules/RuntimeManifest.psm1
@@ -27,7 +27,7 @@ function Get-CcodErrorId {
 function Assert-CcodRuntimeId {
     param([Parameter(Mandatory)][string]$RuntimeId)
 
-    if ($RuntimeId -notmatch '^[A-Za-z0-9._-]{1,96}$') {
+    if ($RuntimeId -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z') {
         Throw-CcodRuntimeError 'CCOD_RUNTIME_ID_INVALID' 'Runtime ID must be a safe relative directory name' $RuntimeId
     }
     return $RuntimeId
@@ -68,16 +68,16 @@ function Get-CcodRuntimeAdapters {
 }
 
 function ConvertTo-CcodRuntimeGeneration {
-    param([Parameter(Mandatory)]$Value, [Parameter(Mandatory)][string]$Path)
+    param([Parameter(Mandatory)]$Value, [Parameter(Mandatory)][string]$Path, [switch]$AllowZero)
 
     if ($Value -is [decimal]) {
-        if ($Value -lt 1 -or [decimal]::Truncate($Value) -ne $Value) {
+        if ($Value -lt $(if ($AllowZero) { 0 } else { 1 }) -or [decimal]::Truncate($Value) -ne $Value) {
             Throw-CcodRuntimeError 'CCOD_RUNTIME_GENERATION_INVALID' 'Active runtime generation must be a positive unsigned integer' $Path
         }
         try { return [UInt64]$Value } catch { Throw-CcodRuntimeError 'CCOD_RUNTIME_GENERATION_INVALID' 'Active runtime generation is outside the unsigned 64-bit range' $Path }
     }
     if ($Value -isnot [byte] -and $Value -isnot [uint16] -and $Value -isnot [uint32] -and $Value -isnot [uint64] -and
-        $Value -isnot [int16] -and $Value -isnot [int32] -and $Value -isnot [int64] -or $Value -lt 1) {
+        $Value -isnot [int16] -and $Value -isnot [int32] -and $Value -isnot [int64] -or $Value -lt $(if ($AllowZero) { 0 } else { 1 })) {
         Throw-CcodRuntimeError 'CCOD_RUNTIME_GENERATION_INVALID' 'Active runtime generation must be a positive unsigned integer' $Path
     }
     return [UInt64]$Value
@@ -87,14 +87,34 @@ function Get-CcodRuntimeRoot {
     param([Parameter(Mandatory)][string]$RuntimeDirectory)
 
     $root = [IO.Path]::GetFullPath($RuntimeDirectory)
-    if (-not [IO.Directory]::Exists($root)) {
+    if (-not [string]::Equals($root, $RuntimeDirectory, [StringComparison]::OrdinalIgnoreCase)) {
+        Throw-CcodRuntimeError 'CCOD_RUNTIME_PATH_INVALID' 'Runtime directory must use a canonical absolute path' $RuntimeDirectory
+    }
+    try {
+        $item = Get-Item -LiteralPath $root -Force -ErrorAction Stop
+    } catch [Management.Automation.ItemNotFoundException] {
+        return $null
+    } catch [IO.FileNotFoundException] {
+        return $null
+    } catch [IO.DirectoryNotFoundException] {
+        return $null
+    }
+    if (-not $item.PSIsContainer) {
         return $null
     }
-
-    $item = Get-Item -LiteralPath $root -Force -ErrorAction Stop
     if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) {
         Throw-CcodRuntimeError 'CCOD_REPARSE_PATH' 'Runtime root is a reparse point' $root
     }
+    $current = [IO.Directory]::GetParent($root)
+    while ($null -ne $current) {
+        $ancestor = Get-Item -LiteralPath $current.FullName -Force -ErrorAction Stop
+        if (($ancestor.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) {
+            Throw-CcodRuntimeError 'CCOD_REPARSE_PATH' 'Runtime root has a reparse-point ancestor' $current.FullName
+        }
+        $pathRoot = [IO.Path]::GetPathRoot($current.FullName)
+        if ($current.FullName.TrimEnd('\\') -ceq $pathRoot.TrimEnd('\\')) { break }
+        $current = [IO.Directory]::GetParent($current.FullName)
+    }
     return $root
 }
 
@@ -156,7 +176,7 @@ function Get-CcodRuntimeFileRecords {
         if (-not $item.PSIsContainer) {
             $relative = ConvertTo-CcodRuntimeRelativePath -Root $root -FullName $item.FullName
             if (-not $relative.Equals('manifest.json', [StringComparison]::OrdinalIgnoreCase)) {
-                $records.Add([pscustomobject]@{
+                $records.Add([pscustomobject][ordered]@{
                     path = $relative
                     length = [int64]$item.Length
                     sha256 = Get-CcodRuntimeFileSha256 -Path $item.FullName
@@ -181,13 +201,13 @@ function Get-CcodRuntimeId {
         [string]$Nonce = ([guid]::NewGuid().ToString('N'))
     )
 
-    if($ProjectVersion-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,45}$'-or$Nonce-cnotmatch'^[0-9a-f]{32}$'){
+    if($ProjectVersion-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,45}\z'-or$Nonce-cnotmatch'^[0-9a-f]{32}\z'){
         Throw-CcodRuntimeError 'CCOD_RUNTIME_ID_INVALID' 'Runtime identity components are invalid' $ProjectVersion
     }
 
     $lines = [System.Collections.Generic.List[string]]::new()
     foreach ($file in $Files) {
-        $lines.Add(('{0}`t{1}`t{2}' -f [string]$file.path, [int64]$file.length, [string]$file.sha256))
+        $lines.Add(("{0}`t{1}`t{2}" -f [string]$file.path, [int64]$file.length, [string]$file.sha256))
     }
     $canonical = $lines -join "`n"
     $sha256 = [Security.Cryptography.SHA256]::Create()
@@ -201,7 +221,7 @@ function Get-CcodRuntimeId {
 
 function Test-CcodRuntimeIdBinding {
     param([Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)][string]$ProjectVersion,[Parameter(Mandatory)][object[]]$Files)
-    if($RuntimeId-cnotmatch'^(?<version>[A-Za-z0-9][A-Za-z0-9._-]{0,45})-(?<digest>[0-9a-f]{16})-(?<nonce>[0-9a-f]{32})$'-or$Matches.version-cne$ProjectVersion){return $false}
+    if($RuntimeId-cnotmatch'^(?<version>[A-Za-z0-9][A-Za-z0-9._-]{0,45})-(?<digest>[0-9a-f]{16})-(?<nonce>[0-9a-f]{32})\z'-or$Matches.version-cne$ProjectVersion){return $false}
     return (Get-CcodRuntimeId -ProjectVersion $ProjectVersion -Files $Files -Nonce $Matches.nonce)-ceq$RuntimeId
 }
 
@@ -253,11 +273,23 @@ function Test-CcodRuntimeManifest {
     }
 
     $manifestPath = Resolve-CcodContainedPath -Root $root -RelativePath 'manifest.json' -AllowMissingLeaf
-    if (-not [IO.File]::Exists($manifestPath)) {
+    $manifestItem = $null
+    try {
+        $manifestItem = Get-Item -LiteralPath $manifestPath -Force -ErrorAction Stop
+    } catch [Management.Automation.ItemNotFoundException] {
         return New-CcodRuntimeValidationResult -Valid $false -Code 'CCOD_RUNTIME_MANIFEST_MISSING' -RuntimeId $ExpectedRuntimeId -Manifest $null
+    } catch [IO.FileNotFoundException] {
+        return New-CcodRuntimeValidationResult -Valid $false -Code 'CCOD_RUNTIME_MANIFEST_MISSING' -RuntimeId $ExpectedRuntimeId -Manifest $null
+    } catch [IO.DirectoryNotFoundException] {
+        return New-CcodRuntimeValidationResult -Valid $false -Code 'CCOD_RUNTIME_MANIFEST_MISSING' -RuntimeId $ExpectedRuntimeId -Manifest $null
+    } catch {
+        return New-CcodRuntimeValidationResult -Valid $false -Code 'CCOD_RUNTIME_MANIFEST_UNAVAILABLE' -RuntimeId $ExpectedRuntimeId -Manifest $null
+    }
+    if ($null -eq $manifestItem -or $manifestItem.PSIsContainer -or (($manifestItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) {
+        return New-CcodRuntimeValidationResult -Valid $false -Code 'CCOD_RUNTIME_MANIFEST_INVALID' -RuntimeId $ExpectedRuntimeId -Manifest $null
     }
     if(-not[string]::IsNullOrWhiteSpace($ExpectedManifestSha256)){
-        if($ExpectedManifestSha256-cnotmatch'^[0-9a-f]{64}$'-or(Get-CcodRuntimeFileSha256 -Path $manifestPath)-cne$ExpectedManifestSha256){return New-CcodRuntimeValidationResult -Valid $false -Code 'CCOD_RUNTIME_MANIFEST_HASH_MISMATCH' -RuntimeId $ExpectedRuntimeId -Manifest $null}
+        if($ExpectedManifestSha256-cnotmatch'^[0-9a-f]{64}\z'-or(Get-CcodRuntimeFileSha256 -Path $manifestPath)-cne$ExpectedManifestSha256){return New-CcodRuntimeValidationResult -Valid $false -Code 'CCOD_RUNTIME_MANIFEST_HASH_MISMATCH' -RuntimeId $ExpectedRuntimeId -Manifest $null}
     }
 
     try {
@@ -266,43 +298,51 @@ function Test-CcodRuntimeManifest {
         return New-CcodRuntimeValidationResult -Valid $false -Code (Get-CcodErrorId -ErrorRecord $_) -RuntimeId $ExpectedRuntimeId -Manifest $null
     }
 
+    $schemaVersionProperty = $manifest.PSObject.Properties['schemaVersion']
+    $schemaIntegerTypes = @([byte],[uint16],[uint32],[uint64],[sbyte],[int16],[int32],[int64])
+    $schemaVersionIsInteger = $false
+    foreach ($type in $schemaIntegerTypes) { if ($null -ne $schemaVersionProperty -and $schemaVersionProperty.Value -is $type) { $schemaVersionIsInteger = $true; break } }
     $runtimeIdProperty = $manifest.PSObject.Properties['runtimeId']
     $projectVersionProperty = $manifest.PSObject.Properties['projectVersion']
     $filesProperty = $manifest.PSObject.Properties['files']
-    if ($null -eq $runtimeIdProperty -or $null -eq $projectVersionProperty -or $null -eq $filesProperty -or
-        $runtimeIdProperty.Value -isnot [string] -or $projectVersionProperty.Value -isnot [string] -or $null -eq $filesProperty.Value) {
+    $propertyNames = (@($manifest.PSObject.Properties.Name) -join ',')
+    $filesIsArray = $false
+    if ($null -ne $filesProperty -and $null -ne $filesProperty.Value) { $filesIsArray = $filesProperty.Value.GetType().IsArray }
+    if ($propertyNames -cne 'schemaVersion,projectVersion,runtimeId,files' -or
+        -not $schemaVersionIsInteger -or $null -eq $schemaVersionProperty -or $schemaVersionProperty.Value -ne 1 -or
+        $null -eq $runtimeIdProperty -or $null -eq $projectVersionProperty -or $null -eq $filesProperty -or
+        $runtimeIdProperty.Value -isnot [string] -or $projectVersionProperty.Value -isnot [string] -or -not $filesIsArray) {
         return New-CcodRuntimeValidationResult -Valid $false -Code 'CCOD_RUNTIME_MANIFEST_INVALID' -RuntimeId $ExpectedRuntimeId -Manifest $manifest
     }
 
     $manifestRuntimeId = [string]$runtimeIdProperty.Value
-    if ($manifestRuntimeId -notmatch '^[A-Za-z0-9._-]{1,96}$' -or $manifestRuntimeId -cne $ExpectedRuntimeId) {
+    if ($manifestRuntimeId -notmatch '^[A-Za-z0-9._-]{1,96}\z' -or $manifestRuntimeId -cne $ExpectedRuntimeId) {
         return New-CcodRuntimeValidationResult -Valid $false -Code 'CCOD_RUNTIME_ID_MISMATCH' -RuntimeId $manifestRuntimeId -Manifest $manifest
     }
 
-    $manifestFiles = @($filesProperty.Value)
     $previousPath = $null
+    $seenPaths = [Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+    $integerTypes = @([byte],[uint16],[uint32],[uint64],[sbyte],[int16],[int32],[int64])
     $manifestRecords = [System.Collections.Generic.List[object]]::new()
-    foreach ($file in $manifestFiles) {
-        if ($file -isnot [pscustomobject] -or
-            $null -eq $file.PSObject.Properties['path'] -or
-            $null -eq $file.PSObject.Properties['length'] -or
-            $null -eq $file.PSObject.Properties['sha256'] -or
-            $file.path -isnot [string] -or
-            $file.sha256 -isnot [string]) {
+    foreach ($file in @($filesProperty.Value)) {
+        if ($file -isnot [pscustomobject] -or (@($file.PSObject.Properties.Name) -join ',' -cne 'path,length,sha256')) {
             return New-CcodRuntimeValidationResult -Valid $false -Code 'CCOD_RUNTIME_MANIFEST_INVALID' -RuntimeId $manifestRuntimeId -Manifest $manifest
         }
-
-        Assert-CcodManifestRelativePath -Path $file.path | Out-Null
-        if ($file.path.Equals('manifest.json', [StringComparison]::OrdinalIgnoreCase) -or
-            $file.sha256 -cnotmatch '^[0-9a-f]{64}$') {
+        $lengthTypeIsValid = $false
+        foreach ($type in $integerTypes) { if ($file.length -is $type) { $lengthTypeIsValid = $true; break } }
+        if (-not $lengthTypeIsValid -or $file.length -is [bool] -or
+            $file.path -isnot [string] -or [string]::IsNullOrWhiteSpace($file.path) -or
+            $file.sha256 -isnot [string] -or $file.sha256 -cnotmatch '^[0-9a-f]{64}\z') {
             return New-CcodRuntimeValidationResult -Valid $false -Code 'CCOD_RUNTIME_MANIFEST_INVALID' -RuntimeId $manifestRuntimeId -Manifest $manifest
         }
-        try {
-            $length = [Convert]::ToInt64($file.length, [Globalization.CultureInfo]::InvariantCulture)
-        } catch {
+        Assert-CcodManifestRelativePath -Path $file.path | Out-Null
+        try { $length = [int64]$file.length } catch {
             return New-CcodRuntimeValidationResult -Valid $false -Code 'CCOD_RUNTIME_MANIFEST_INVALID' -RuntimeId $manifestRuntimeId -Manifest $manifest
         }
-        if ($length -lt 0 -or ($null -ne $previousPath -and [StringComparer]::Ordinal.Compare($previousPath, [string]$file.path) -ge 0)) {
+        if ($length -lt 0 -or [IO.Path]::IsPathRooted($file.path) -or $file.path.Contains(':') -or
+            $file.path.Equals('manifest.json', [StringComparison]::OrdinalIgnoreCase) -or
+            -not $seenPaths.Add([string]$file.path) -or
+            ($null -ne $previousPath -and [StringComparer]::Ordinal.Compare($previousPath, [string]$file.path) -ge 0)) {
             return New-CcodRuntimeValidationResult -Valid $false -Code 'CCOD_RUNTIME_MANIFEST_INVALID' -RuntimeId $manifestRuntimeId -Manifest $manifest
         }
         $previousPath = [string]$file.path
@@ -343,6 +383,20 @@ function Get-CcodRuntimeDirectoryForId {
     return Resolve-CcodContainedPath -Root $InstallRoot -RelativePath (Join-Path 'runtime' $RuntimeId) -AllowMissingLeaf
 }
 
+function Test-CcodRuntimeSchemaVersion {
+    param($Value,[Parameter(Mandatory)][int]$Expected)
+    $integerTypes=@([byte],[uint16],[uint32],[uint64],[sbyte],[int16],[int32],[int64])
+    $typed=$false
+    foreach($type in $integerTypes){if($Value-is$type){$typed=$true;break}}
+    return $typed -and [int64]$Value -eq [int64]$Expected
+}
+
+function Test-CcodRuntimeCanonicalUtcTimestamp {
+    param($Value)
+    if($Value-isnot[string]-or$Value-cnotmatch'^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{7}Z\z'){return $false}
+    try{$parsed=[DateTime]::ParseExact($Value,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind);return $parsed.Kind-eq[DateTimeKind]::Utc}catch{return $false}
+}
+
 function Assert-CcodRuntimePointerFile {
     param([Parameter(Mandatory)][string]$Path)
     try{
@@ -357,7 +411,7 @@ public static class CcodRuntimePointerIdentity { [StructLayout(LayoutKind.Sequen
     }catch{Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation selector is not a plain single-link file' $Path}
 }
 
-function Read-CcodActiveRuntime {
+function Read-CcodActiveRuntimeCore {
     [CmdletBinding()]
     param([Parameter(Mandatory)][string]$InstallRoot,[hashtable]$Adapters)
 
@@ -373,13 +427,12 @@ function Read-CcodActiveRuntime {
         if($entries.Count-eq 0){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation store is empty' $pointerRoot}
         $records=[Collections.Generic.List[object]]::new()
         foreach($entry in $entries){
-            if($entry.PSIsContainer-or($entry.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0-or$entry.Name-cnotmatch'^\d{20}\.json$'){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation store contains an unknown object' $entry.FullName}
+            if($entry.PSIsContainer-or($entry.Attributes-band[IO.FileAttributes]::ReparsePoint)-ne0-or$entry.Name-cnotmatch'^\d{20}\.json\z'){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation store contains an unknown object' $entry.FullName}
             Assert-CcodRuntimePointerFile -Path $entry.FullName
             $record=Read-CcodStrictJson -Path $entry.FullName -ExpectedSchema 1 -Kind 'active generation'
-            $names=@($record.PSObject.Properties.Name);if(($names-join',')-cne'schemaVersion,generation,activeRuntime,previousGeneration'-or$record.activeRuntime-isnot[string]){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation record fields are invalid' $entry.FullName}
+            $names=@($record.PSObject.Properties.Name);if(($names-join',')-cne'schemaVersion,generation,activeRuntime,previousGeneration'-or$record.activeRuntime-isnot[string]-or-not(Test-CcodRuntimeSchemaVersion $record.schemaVersion 1)){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation record fields are invalid' $entry.FullName}
             $generation=ConvertTo-CcodRuntimeGeneration $record.generation $entry.FullName
-            $integerTypes=@([byte],[uint16],[uint32],[uint64],[int16],[int32],[int64]);$typed=$false;foreach($t in $integerTypes){if($record.previousGeneration-is$t){$typed=$true;break}};if(-not$typed){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Previous generation is not an integer' $entry.FullName}
-            [uint64]$previous=$record.previousGeneration;if($generation-ne($previous+1)-or$entry.Name-cne('{0:D20}.json'-f$generation)){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation record is not canonical' $entry.FullName}
+            try{$previous=ConvertTo-CcodRuntimeGeneration -Value $record.previousGeneration -Path $entry.FullName -AllowZero}catch{Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Previous generation is not a nonnegative integer' $entry.FullName};if($generation-ne($previous+1)-or$entry.Name-cne('{0:D20}.json'-f$generation)){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation record is not canonical' $entry.FullName}
             Assert-CcodRuntimeId $record.activeRuntime|Out-Null;$records.Add([pscustomobject]@{generation=$generation;previousGeneration=$previous;activeRuntime=[string]$record.activeRuntime})
         }
         $ordered=@($records|Sort-Object generation);for($i=0;$i-lt$ordered.Count;$i++){if([uint64]$ordered[$i].generation-ne[uint64]($i+1)-or[uint64]$ordered[$i].previousGeneration-ne[uint64]$i){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active generation chain has a gap' $pointerRoot}}
@@ -389,6 +442,10 @@ function Read-CcodActiveRuntime {
     $path = Resolve-CcodContainedPath -Root $InstallRoot -RelativePath 'active.json' -AllowMissingLeaf
     $active = $null
     $legacy = $false
+    $legacyItem = $null
+    try { $legacyItem = Get-Item -LiteralPath $path -Force -ErrorAction Stop } catch { if ($_.CategoryInfo.Category -eq 'ObjectNotFound' -or $_.Exception -is [IO.FileNotFoundException] -or $_.Exception -is [IO.DirectoryNotFoundException] -or $_.Exception -is [Management.Automation.ItemNotFoundException]) { Throw-CcodRuntimeError 'CCOD_PATH_MISSING' 'Active runtime pointer is not present' $path }; throw }
+    if ($null -eq $legacyItem) { Throw-CcodRuntimeError 'CCOD_PATH_MISSING' 'Active runtime pointer is not present' $path }
+    Assert-CcodRuntimePointerFile -Path $legacyItem.FullName
     try {
         $active = Read-CcodStrictJson -Path $path -ExpectedSchema 2 -Kind 'active runtime'
     } catch {
@@ -410,6 +467,10 @@ function Read-CcodActiveRuntime {
         Throw-CcodRuntimeError 'CCOD_RUNTIME_ID_INVALID' 'Active runtime ID must be a string' $path
     }
     Assert-CcodRuntimeId -RuntimeId $active.activeRuntime | Out-Null
+    $expectedSchemaVersion = if ($legacy) { 1 } else { 2 }
+    if (-not (Test-CcodRuntimeSchemaVersion $active.schemaVersion $expectedSchemaVersion) -or -not (Test-CcodRuntimeCanonicalUtcTimestamp $active.updatedAtUtc)) {
+        Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Active runtime pointer schema or UTC timestamp is invalid' $path
+    }
     if ($null -ne $active.previousRuntime) {
         if ($active.previousRuntime -isnot [string]) {
             Throw-CcodRuntimeError 'CCOD_RUNTIME_ID_INVALID' 'Previous runtime ID must be null or a string' $path
@@ -456,7 +517,7 @@ function Resolve-CcodActiveRuntimeContext {
     }
 }
 
-function Set-CcodActiveRuntime {
+function Set-CcodActiveRuntimeCore {
     [CmdletBinding()]
     param(
         [Parameter(Mandatory)][string]$InstallRoot,
@@ -474,7 +535,7 @@ function Set-CcodActiveRuntime {
     if($null-ne$FileTransaction-or$null-ne$TargetGeneration){
         if($null-eq(Get-Command Commit-CcodInstallActivePointer -ErrorAction SilentlyContinue)){Import-Module (Join-Path $PSScriptRoot 'InstallFileTransaction.psm1') -ErrorAction Stop}
         if($null-eq$FileTransaction-or$null-eq$TargetGeneration){Throw-CcodRuntimeError 'CCOD_RUNTIME_POINTER_INVALID' 'Pointer commit requires target and transaction' $InstallRoot}
-        $current=$null;try{$current=Read-CcodActiveRuntime -InstallRoot $InstallRoot -Adapters @{GetSelectorRootItem=$Adapters.GetSelectorRootItem}}catch{if((Get-CcodErrorId $_)-notin@('CCOD_STATE_MISSING','CCOD_PATH_MISSING')){throw}}
+        $current=$null;try{$current=Read-CcodActiveRuntimeCore -InstallRoot $InstallRoot -Adapters @{GetSelectorRootItem=$Adapters.GetSelectorRootItem}}catch{if((Get-CcodErrorId $_)-notin@('CCOD_STATE_MISSING','CCOD_PATH_MISSING')){throw}}
         [uint64]$previous=if($null-eq$current){0}else{$current.generation}
         try{[void](& $Adapters.AssertLifecycleFence $InstallRoot $Ownership ($null-ne$current) $NewRuntimeId)}catch{Throw-CcodRuntimeError 'CCOD_RUNTIME_FENCE_STALE' 'Active runtime mutation lifecycle fence is stale' $InstallRoot}
         $committed=Commit-CcodInstallActivePointer -InstallRoot $InstallRoot -TargetGeneration $TargetGeneration -ExpectedPreviousGeneration $previous -FileTransaction $FileTransaction
@@ -518,4 +579,22 @@ function Set-CcodActiveRuntime {
     return [pscustomobject]$pointer
 }
 
+function Set-CcodActiveRuntime {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string]$InstallRoot,
+        [string]$NewRuntimeId,
+        $TargetGeneration,
+        $FileTransaction,
+        $Ownership
+    )
+    return Set-CcodActiveRuntimeCore -InstallRoot $InstallRoot -NewRuntimeId $NewRuntimeId -TargetGeneration $TargetGeneration -FileTransaction $FileTransaction -Ownership $Ownership
+}
+
+function Read-CcodActiveRuntime {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][string]$InstallRoot)
+    return Read-CcodActiveRuntimeCore -InstallRoot $InstallRoot
+}
+
 Export-ModuleMember -Function Get-CcodRuntimeId, New-CcodRuntimeManifest, Test-CcodRuntimeManifest, Read-CcodActiveRuntime, Resolve-CcodActiveRuntimeContext, Set-CcodActiveRuntime
diff --git a/tests/Validate.ps1 b/tests/Validate.ps1
index dd43a7b..b69a12a 100644
--- a/tests/Validate.ps1
+++ b/tests/Validate.ps1
@@ -25,6 +25,7 @@ $cleanRoomSelfTest = Join-Path $PSScriptRoot 'CleanroomSelfTest.js'
 $packageCheckerSelfTest = Join-Path $PSScriptRoot 'PackageCheckerSelfTest.mjs'
 $persistenceSelfTest = Join-Path $PSScriptRoot 'PersistenceSelfTest.ps1'
 $installFileTransactionSelfTest = Join-Path $PSScriptRoot 'persistence\InstallFileTransaction.SelfTest.ps1'
+$officialDraftAcceptanceSelfTest = Join-Path $PSScriptRoot 'persistence\OfficialDraftAcceptanceHarness.SelfTest.ps1'
 
 function Get-CcodValidationSafeChildMarkers {
     param($Output)
@@ -117,6 +118,30 @@ if ($failures.Count -eq 0) {
     }
 }
 
+if (-not (Test-Path -LiteralPath $officialDraftAcceptanceSelfTest -PathType Leaf)) {
+    $failures.Add("Official draft acceptance self-test is missing: $officialDraftAcceptanceSelfTest")
+} elseif ($failures.Count -eq 0) {
+    $powershellExecutable = (Get-Command powershell.exe -ErrorAction Stop).Source
+    $previousErrorActionPreference = $ErrorActionPreference
+    $hadChildExecutionPolicy = Test-Path -LiteralPath 'Env:PSExecutionPolicyPreference'
+    $previousChildExecutionPolicy = $env:PSExecutionPolicyPreference
+    try {
+        $ErrorActionPreference = 'Continue'
+        Remove-Item -LiteralPath 'Env:PSExecutionPolicyPreference' -ErrorAction SilentlyContinue
+        # Omit the policy switch: Windows PowerShell 5.1 maps an explicit
+        # Undefined argument to Restricted instead of inheriting normal policy.
+        $officialDraftAcceptanceOutput = & $powershellExecutable -NoProfile -File $officialDraftAcceptanceSelfTest 2>&1
+        $officialDraftAcceptanceExitCode = $LASTEXITCODE
+    } finally {
+        if ($hadChildExecutionPolicy) { $env:PSExecutionPolicyPreference = $previousChildExecutionPolicy }
+        else { Remove-Item -LiteralPath 'Env:PSExecutionPolicyPreference' -ErrorAction SilentlyContinue }
+        $ErrorActionPreference = $previousErrorActionPreference
+    }
+    if ($officialDraftAcceptanceExitCode -ne 0) {
+        $failures.Add("Official draft acceptance self-test failed with exit code $officialDraftAcceptanceExitCode; $(Get-CcodValidationSafeChildMarkers $officialDraftAcceptanceOutput)")
+    }
+}
+
 foreach ($required in @(
     'README.md',
     'README.zh-CN.md',
@@ -148,6 +173,10 @@ foreach ($required in @(
     'tests\persistence\UninstallBootstrap.SelfTest.ps1',
     'tests\persistence\InstalledLifecycleHarness.SelfTest.ps1',
     'tests\persistence\ReleaseWorkflow.SelfTest.ps1',
+    'tests\persistence\TrustedModuleImport.SelfTest.ps1',
+    'tests\installed\OfficialDraftAcceptance.psm1',
+    'tests\installed\Invoke-OfficialDraftAcceptance.ps1',
+    'tests\persistence\OfficialDraftAcceptanceHarness.SelfTest.ps1',
     'tools\ReleaseAssetContract.psm1',
     'tools\ReleaseDefender.psm1',
     'tools\Test-ReleaseDefender.ps1',
diff --git a/tests/installed/Invoke-InstalledLifecycleIntegration.ps1 b/tests/installed/Invoke-InstalledLifecycleIntegration.ps1
index 6856431..4db8ded 100644
--- a/tests/installed/Invoke-InstalledLifecycleIntegration.ps1
+++ b/tests/installed/Invoke-InstalledLifecycleIntegration.ps1
@@ -2,25 +2,190 @@
 param(
     [Parameter(Mandatory, ParameterSetName = 'Run')][string]$InstallerPath,
     [Parameter(ParameterSetName = 'Run')][string]$PreviousInstallerPath,
-    [Parameter(Mandatory, ParameterSetName = 'Run')][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion,
+    [Parameter(ParameterSetName = 'Run')][ValidatePattern('^\d+\.\d+\.\d+\z')][string]$PreviousExpectedVersion,
+    [Parameter(ParameterSetName = 'Run')][ValidatePattern('^[0-9a-f]{64}\z')][string]$PreviousInstallerSha256,
+    [Parameter(ParameterSetName = 'Run')][ValidatePattern('^[0-9a-f]{64}\z')][string]$PreviousManifestSha256,
+    [Parameter(Mandatory, ParameterSetName = 'Run')][ValidatePattern('^\d+\.\d+\.\d+\z')][string]$ExpectedVersion,
     [Parameter(Mandatory, ParameterSetName = 'Run')][string]$EvidenceRoot,
-    [Parameter(ParameterSetName = 'Run')][switch]$AllowMachineMutation,
-    [Parameter(ParameterSetName = 'Run')][switch]$AllowCodexRestart,
-    [Parameter(Mandatory, ParameterSetName = 'Run')][ValidateSet('FreshLater','FreshRestart','Upgrade','SlowLaunch','ManualLaunchResume','LanguageStress','RepairStates','SafeExit','SettingsUninstall','DirectUninstall')][string]$Scenario,
-    [Parameter(Mandatory, ParameterSetName = 'Library')][switch]$Library
+    [Parameter(ParameterSetName = 'Run')][Parameter(ParameterSetName = 'VerifiedUninstall')][switch]$AllowMachineMutation,
+    [Parameter(ParameterSetName = 'Run')][Parameter(ParameterSetName = 'VerifiedUninstall')][switch]$AllowCodexRestart,
+    [Parameter(Mandatory, ParameterSetName = 'Run')][ValidateSet('FreshInstall','FreshLater','FreshRestart','Upgrade','SlowLaunch','ManualLaunchResume','LanguageStress','RepairStates','SafeExit','SettingsUninstall','DirectUninstall')][string]$Scenario,
+    [Parameter(Mandatory, ParameterSetName = 'Library')][switch]$Library,
+    [Parameter(Mandatory, ParameterSetName = 'VerifiedUninstall')][switch]$VerifiedUninstallChild
 )
 
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
+# BEGIN CCOD TRUSTED IMPORT BOOTSTRAP
+# Embedded in each independently trusted entrypoint; an unheld helper import
+# cannot bootstrap its own protection. Keep copies identical (self-test enforced).
+function Initialize-CcodTrustedImportLease {
+    if ($null -ne ('CcodTrustedImportLeaseV1' -as [type])) { return }
+    Add-Type -ErrorAction Stop -TypeDefinition @'
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+
+public sealed class CcodTrustedImportLeaseV1 : IDisposable
+{
+    [StructLayout(LayoutKind.Sequential)] private struct NativeTime { public uint Low, High; }
+    [StructLayout(LayoutKind.Sequential)] private struct NativeInfo
+    {
+        public uint Attributes;
+        public NativeTime Creation, Access, Write;
+        public uint Volume, SizeHigh, SizeLow, Links, IndexHigh, IndexLow;
+    }
+    private sealed class Entry
+    {
+        public SafeFileHandle Handle;
+        public string Path;
+        public bool Directory;
+        public uint Volume;
+        public ulong FileId;
+    }
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern SafeFileHandle CreateFileW(string path, uint access, uint share, IntPtr security, uint creation, uint flags, IntPtr template);
+    [DllImport("kernel32.dll", SetLastError=true)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle handle, out NativeInfo info);
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern uint GetFinalPathNameByHandleW(SafeFileHandle handle, StringBuilder value, uint length, uint flags);
+
+    private readonly List<Entry> entries = new List<Entry>();
+    private bool disposed;
+    public string Path { get; private set; }
+    private CcodTrustedImportLeaseV1(string path) { Path = path; }
+
+    public static CcodTrustedImportLeaseV1 Acquire(string path)
+    {
+        if (String.IsNullOrWhiteSpace(path) || !System.IO.Path.IsPathRooted(path) ||
+            path.StartsWith(@"\\?\", StringComparison.Ordinal) || path.StartsWith(@"\\.\", StringComparison.Ordinal))
+            throw new ArgumentException("Unsupported module path");
+        string full = System.IO.Path.GetFullPath(path);
+        string root = System.IO.Path.GetPathRoot(full);
+        string extension = System.IO.Path.GetExtension(full);
+        if (!String.Equals(full, path, StringComparison.OrdinalIgnoreCase) || String.IsNullOrEmpty(root) ||
+            full.Substring(root.Length).IndexOf(':') >= 0 ||
+            (!String.Equals(extension, ".psm1", StringComparison.OrdinalIgnoreCase) && !String.Equals(extension, ".ps1", StringComparison.OrdinalIgnoreCase)))
+            throw new ArgumentException("Noncanonical module path");
+        var lease = new CcodTrustedImportLeaseV1(full);
+        try
+        {
+            var parents = new List<string>();
+            for (DirectoryInfo parent = Directory.GetParent(full); parent != null; parent = parent.Parent)
+                parents.Add(parent.FullName);
+            parents.Reverse();
+            if (parents.Count == 0 || !SamePath(parents[0], root)) throw new IOException("Missing module root");
+            // Retain root-to-leaf authority before traversing the next component.
+            foreach (string parent in parents) lease.Open(parent, true);
+            lease.Open(full, false);
+            lease.Revalidate();
+            return lease;
+        }
+        catch { lease.Dispose(); throw; }
+    }
+
+    private void Open(string path, bool directory)
+    {
+        uint access = directory ? 0x00100081U : 0x80100080U;
+        uint flags = 0x00200000U | (directory ? 0x02000000U : 0U);
+        // FILE_SHARE_READ only: preexisting writers/deleters must fail closed.
+        SafeFileHandle handle = CreateFileW(path, access, 1U, IntPtr.Zero, 3U, flags, IntPtr.Zero);
+        if (handle.IsInvalid) { int error = Marshal.GetLastWin32Error(); handle.Dispose(); throw new Win32Exception(error); }
+        try
+        {
+            NativeInfo info = Inspect(handle, path, directory);
+            entries.Add(new Entry { Handle = handle, Path = path, Directory = directory, Volume = info.Volume, FileId = FileId(info) });
+        }
+        catch { handle.Dispose(); throw; }
+    }
+
+    private static ulong FileId(NativeInfo info) { return ((ulong)info.IndexHigh << 32) | info.IndexLow; }
+    private static bool SamePath(string left, string right)
+    {
+        return String.Equals(left.TrimEnd('\\'), right.TrimEnd('\\'), StringComparison.OrdinalIgnoreCase);
+    }
+    private static NativeInfo Inspect(SafeFileHandle handle, string expected, bool directory)
+    {
+        NativeInfo info;
+        if (!GetFileInformationByHandle(handle, out info)) throw new Win32Exception(Marshal.GetLastWin32Error());
+        if ((info.Attributes & 0x400U) != 0 || ((info.Attributes & 0x10U) != 0) != directory)
+            throw new IOException("Unsafe module path kind");
+        var value = new StringBuilder(512);
+        uint length = GetFinalPathNameByHandleW(handle, value, (uint)value.Capacity, 0);
+        if (length == 0) throw new Win32Exception(Marshal.GetLastWin32Error());
+        if (length >= value.Capacity)
+        {
+            value.Capacity = checked((int)length + 1);
+            length = GetFinalPathNameByHandleW(handle, value, (uint)value.Capacity, 0);
+            if (length == 0 || length >= value.Capacity) throw new IOException("Module final path unavailable");
+        }
+        string final = value.ToString();
+        if (final.StartsWith(@"\\?\UNC\", StringComparison.OrdinalIgnoreCase)) final = @"\\" + final.Substring(8);
+        else if (final.StartsWith(@"\\?\", StringComparison.OrdinalIgnoreCase)) final = final.Substring(4);
+        if (!SamePath(final, expected)) throw new IOException("Module final path mismatch");
+        return info;
+    }
+
+    public void Revalidate()
+    {
+        if (disposed) throw new ObjectDisposedException("trusted module import lease");
+        foreach (Entry entry in entries)
+        {
+            NativeInfo info = Inspect(entry.Handle, entry.Path, entry.Directory);
+            if (info.Volume != entry.Volume || FileId(info) != entry.FileId) throw new IOException("Module identity changed");
+        }
+    }
+    public void Dispose()
+    {
+        if (disposed) return;
+        disposed = true;
+        for (int index = entries.Count - 1; index >= 0; index--) entries[index].Handle.Dispose();
+        entries.Clear();
+    }
+}
+'@
+}
+
+function Open-CcodTrustedImportLease {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$ErrorId)
+    try {
+        Initialize-CcodTrustedImportLease
+        return [CcodTrustedImportLeaseV1]::Acquire($Path)
+    } catch {
+        throw [Management.Automation.ErrorRecord]::new(
+            [InvalidOperationException]::new('Trusted module import authority could not be acquired.'),
+            $ErrorId,[Management.Automation.ErrorCategory]::InvalidData,$Path)
+    }
+}
+# END CCOD TRUSTED IMPORT BOOTSTRAP
+
 $script:CcodInstalledLifecycleRestartScenarios = @(
-    'FreshRestart','Upgrade','SlowLaunch','ManualLaunchResume','LanguageStress','RepairStates','SafeExit','SettingsUninstall','DirectUninstall'
+    'FreshInstall','FreshRestart','Upgrade','SlowLaunch','ManualLaunchResume','LanguageStress','RepairStates','SafeExit','SettingsUninstall','DirectUninstall'
 )
 $script:CcodInstalledLifecycleTaskName = 'Codex Control Other Devices Supervisor'
 $script:CcodInstalledLifecycleRepositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
-$script:CcodInstalledLifecyclePersistenceIoModule = Import-Module (Join-Path $script:CcodInstalledLifecycleRepositoryRoot 'src\persistence\modules\PersistenceIO.psm1') -Force -PassThru
-$script:CcodInstalledLifecycleStateStoreModule = Import-Module (Join-Path $script:CcodInstalledLifecycleRepositoryRoot 'src\persistence\modules\StateStore.psm1') -Force -PassThru
-$script:CcodInstalledLifecycleTransactionModule = Import-Module (Join-Path $script:CcodInstalledLifecycleRepositoryRoot 'src\persistence\modules\LifecycleTransaction.psm1') -Force -PassThru
+# Pin the complete eager import closure, including StateStore's nested identity
+# dependency, before any initializer runs. Imports remain in their original scope.
+$importClosure = @('PersistenceIO.psm1','StateStore.psm1','TrustedLogonIdentity.psm1','LifecycleTransaction.psm1')
+$importLeases = [Collections.Generic.List[IDisposable]]::new()
+try {
+    foreach ($leaf in $importClosure) {
+        $path = Join-Path (Join-Path $script:CcodInstalledLifecycleRepositoryRoot 'src\persistence\modules') $leaf
+        $importLeases.Add((Open-CcodTrustedImportLease -Path $path -ErrorId 'CCOD_INTEGRATION_MODULE_MISSING'))
+    }
+    foreach ($lease in $importLeases) { $lease.Revalidate() }
+    $script:CcodInstalledLifecyclePersistenceIoModule = Import-Module (Join-Path $script:CcodInstalledLifecycleRepositoryRoot 'src\persistence\modules\PersistenceIO.psm1') -Force -PassThru
+    $script:CcodInstalledLifecycleStateStoreModule = Import-Module (Join-Path $script:CcodInstalledLifecycleRepositoryRoot 'src\persistence\modules\StateStore.psm1') -Force -PassThru
+    $script:CcodInstalledLifecycleTransactionModule = Import-Module (Join-Path $script:CcodInstalledLifecycleRepositoryRoot 'src\persistence\modules\LifecycleTransaction.psm1') -Force -PassThru
+    foreach ($lease in $importLeases) { $lease.Revalidate() }
+} finally {
+    for ($index = $importLeases.Count - 1; $index -ge 0; $index--) { $importLeases[$index].Dispose() }
+}
 
 function Throw-CcodInstalledLifecycleError {
     param(
@@ -43,6 +208,20 @@ function Get-CcodInstalledLifecycleErrorId {
     return ($id -split ',')[0]
 }
 
+function Assert-CcodInstalledLifecycleCanonicalAbsolutePath {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$Kind)
+    if ([string]::IsNullOrWhiteSpace($Path) -or -not [IO.Path]::IsPathRooted($Path)) {
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' "$Kind must be an absolute canonical path" $Path
+    }
+    try { $full = [IO.Path]::GetFullPath($Path) } catch {
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' "$Kind path could not be canonicalized safely" $Path
+    }
+    if (-not [string]::Equals($full, $Path, [StringComparison]::OrdinalIgnoreCase)) {
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' "$Kind must use a canonical path" $Path
+    }
+    return $full
+}
+
 function Get-CcodInstalledLifecycleHash {
     param([Parameter(Mandatory)][string]$Path)
     $sha = [Security.Cryptography.SHA256]::Create()
@@ -61,6 +240,12 @@ function Test-CcodInstalledLifecycleCanonicalUtc {
     return $parsed.ToUniversalTime().ToString('o', [Globalization.CultureInfo]::InvariantCulture) -ceq $Value
 }
 
+function Test-CcodInstalledLifecycleValidUtcClock {
+    param($Value)
+    return $Value -is [datetime] -and $Value.Kind -eq [DateTimeKind]::Utc -and
+        $Value -ne [datetime]::MinValue -and $Value -ne [datetime]::MaxValue
+}
+
 function ConvertTo-CcodInstalledLifecycleCreationTimeUtc {
     param($Value)
     $created = $null
@@ -70,7 +255,7 @@ function ConvertTo-CcodInstalledLifecycleCreationTimeUtc {
         }
         $created = $Value
     } elseif ($Value -is [string]) {
-        if ($Value -cnotmatch '^\d{14}\.\d{6}[+-]\d{3}$') {
+        if ($Value -cnotmatch '^\d{14}\.\d{6}[+-]\d{3}\z') {
             Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_FACTS_INVALID' 'An enumerated ChatGPT process has invalid creation-time evidence' $null
         }
         try {
@@ -88,74 +273,245 @@ function ConvertTo-CcodInstalledLifecycleCreationTimeUtc {
     return $canonical
 }
 
+function Get-CcodInstalledLifecycleNativeProcessCreationTimeUtc {
+    param([Parameter(Mandatory)][int]$ProcessId)
+    $process=$null
+    try {
+        $process=Get-Process -Id $ProcessId -ErrorAction Stop
+        if($null-eq$process-or$process.Id-ne$ProcessId-or$process.HasExited){throw 'process not current'}
+        $created=$process.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)
+        if(-not(Test-CcodInstalledLifecycleCanonicalUtc $created)){throw 'native timestamp'}
+        return $created
+    } finally {if($null-ne$process){$process.Dispose()}}
+}
+
+function Get-CcodInstalledLifecycleCorrelatedCreationTimeUtc {
+    param([Parameter(Mandatory)]$Process)
+    try {
+        if(-not(Test-CcodInstalledLifecyclePositiveInteger $Process.ProcessId)-or[decimal]$Process.ProcessId-gt[int]::MaxValue){throw 'process id'}
+        $cim=ConvertTo-CcodInstalledLifecycleCreationTimeUtc -Value $Process.CreationDate
+        $native=Get-CcodInstalledLifecycleNativeProcessCreationTimeUtc -ProcessId ([int]$Process.ProcessId)
+        if($native-isnot[string]-or-not(Test-CcodInstalledLifecycleCanonicalUtc $native)){throw 'native timestamp'}
+        $style=[Globalization.DateTimeStyles]::RoundtripKind;$culture=[Globalization.CultureInfo]::InvariantCulture
+        $cimTicks=[datetime]::ParseExact($cim,'o',$culture,$style).Ticks
+        $nativeTicks=[datetime]::ParseExact($native,'o',$culture,$style).Ticks
+        if(($cimTicks%10)-eq0){if($nativeTicks-lt$cimTicks-or($nativeTicks-$cimTicks)-gt9){throw 'CIM identity mismatch'}}
+        elseif($nativeTicks-ne$cimTicks){throw 'precise identity mismatch'}
+        return $native
+    } catch {
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'The native process creation identity does not match the enumerated CIM process.' $null
+    }
+}
+
+function Test-CcodInstalledLifecycleMissingError {
+    param([Parameter(Mandatory)]$ErrorRecord)
+    return $ErrorRecord.CategoryInfo.Category -eq 'ObjectNotFound' -or
+        $ErrorRecord.Exception -is [IO.FileNotFoundException] -or $ErrorRecord.Exception -is [IO.DirectoryNotFoundException]
+}
+
+function Assert-CcodInstalledLifecycleNoReparseAncestors {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][scriptblock]$GetItem)
+    $full = [IO.Path]::GetFullPath($Path)
+    $root = [IO.Path]::GetPathRoot($full)
+    $parent = [IO.Directory]::GetParent($full)
+    $current = if ($null -eq $parent) { $null } else { $parent.FullName }
+    while (-not [string]::IsNullOrWhiteSpace($current)) {
+        try {
+            $items = @(& $GetItem $current)
+            if ($items.Count -eq 1 -and $null -ne $items[0] -and (-not $items[0].PSIsContainer -or (($items[0].Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0))) { throw 'unsafe ancestry' }
+        } catch {
+            if (-not (Test-CcodInstalledLifecycleMissingError -ErrorRecord $_)) { throw }
+        }
+        if ($current.TrimEnd('\') -ceq $root.TrimEnd('\')) { break }
+        $nextParent = [IO.Directory]::GetParent($current)
+        if ($null -eq $nextParent) { break }
+        $next = if ($nextParent.FullName.Length -gt $root.Length) { $nextParent.FullName.TrimEnd('\') } else { $nextParent.FullName }
+        if ($next -ceq $current) { break }
+        $current = $next
+    }
+}
+
 function Assert-CcodInstalledLifecycleRegularFile {
     param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$Kind)
     if ([string]::IsNullOrWhiteSpace($Path) -or -not [IO.Path]::IsPathRooted($Path)) {
         Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_CANDIDATE_INVALID' "$Kind must be an absolute path" $Path
     }
     $full = [IO.Path]::GetFullPath($Path)
-    if (-not [IO.File]::Exists($full)) {
-        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_CANDIDATE_INVALID' "$Kind is missing" $full
+    if (-not [string]::Equals($full, $Path, [StringComparison]::OrdinalIgnoreCase)) {
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_CANDIDATE_INVALID' "$Kind must use a canonical path" $Path
+    }
+    try { $item = Get-Item -LiteralPath $full -Force -ErrorAction Stop } catch {
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_CANDIDATE_INVALID' "$Kind is missing or cannot be inspected" $full
     }
-    $item = Get-Item -LiteralPath $full -Force -ErrorAction Stop
     if ($item.PSIsContainer -or (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) {
         Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_CANDIDATE_INVALID' "$Kind must be a regular non-reparse file" $full
     }
+    Assert-CcodInstalledLifecycleNoReparseAncestors -Path $full -GetItem { param($CandidatePath) Get-Item -LiteralPath $CandidatePath -Force -ErrorAction Stop }
     return $full
 }
 
+function Assert-CcodInstalledLifecycleReadableProcessText {
+    param([AllowNull()]$Value, [Parameter(Mandatory)][string]$Kind)
+    if ($Value -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$Value)) {
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' "$Kind could not be read safely." $null
+    }
+    return [string]$Value
+}
+
 function Assert-CcodInstalledLifecycleSafeDirectory {
     param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$Kind)
+    if ([string]::IsNullOrWhiteSpace($Path) -or -not [IO.Path]::IsPathRooted($Path)) {
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_EVIDENCE_ROOT_INVALID' "$Kind must be an absolute path" $Path
+    }
     $full = [IO.Path]::GetFullPath($Path)
-    if (-not [IO.Directory]::Exists($full)) { [IO.Directory]::CreateDirectory($full) | Out-Null }
-    $item = Get-Item -LiteralPath $full -Force -ErrorAction Stop
-    if (-not $item.PSIsContainer -or (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) {
+    if (-not [string]::Equals($full, $Path, [StringComparison]::OrdinalIgnoreCase)) {
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_EVIDENCE_ROOT_INVALID' "$Kind must use a canonical path" $Path
+    }
+    $probe = { param($CandidatePath) Get-Item -LiteralPath $CandidatePath -Force -ErrorAction Stop }
+    $item = $null
+    try { $item = & $probe $full } catch {
+        if (-not (Test-CcodInstalledLifecycleMissingError -ErrorRecord $_)) {
+            Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_EVIDENCE_ROOT_INVALID' "$Kind could not be inspected safely" $full
+        }
+        try {
+            Assert-CcodInstalledLifecycleNoReparseAncestors -Path $full -GetItem $probe
+            [IO.Directory]::CreateDirectory($full) | Out-Null
+            $item = & $probe $full
+        } catch {
+            Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_EVIDENCE_ROOT_INVALID' "$Kind could not be created or inspected safely" $full
+        }
+    }
+    Assert-CcodInstalledLifecycleNoReparseAncestors -Path $full -GetItem $probe
+    if ($null -eq $item -or -not $item.PSIsContainer -or (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) {
         Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_EVIDENCE_ROOT_INVALID' "$Kind must be a non-reparse directory" $full
     }
     return $full
 }
 
+function Get-CcodInstalledLifecycleOptionalDirectoryState {
+    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][scriptblock]$GetItem)
+    $full = Assert-CcodInstalledLifecycleCanonicalAbsolutePath -Path $Path -Kind 'Installed product directory'
+    $present = $false
+    try {
+        $items = @(& $GetItem $full)
+        if ($items.Count -eq 1 -and $null -ne $items[0] -and $items[0].PSIsContainer -and
+            ($items[0].Attributes -band [IO.FileAttributes]::ReparsePoint) -eq 0) { $present = $true }
+        else { throw 'directory observation' }
+    } catch {
+        if (-not (Test-CcodInstalledLifecycleMissingError -ErrorRecord $_)) {
+            Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'An installed product directory could not be inspected safely.' $full
+        }
+    }
+    try { Assert-CcodInstalledLifecycleNoReparseAncestors -Path $full -GetItem $GetItem }
+    catch { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'An installed product directory ancestry could not be inspected safely.' $full }
+    return $present
+}
+
+function Get-CcodInstalledLifecycleOptionalRegularFileState {
+    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][scriptblock]$GetItem)
+    $full = Assert-CcodInstalledLifecycleCanonicalAbsolutePath -Path $Path -Kind 'Installed product file'
+    $item = $null
+    try {
+        $items = @(& $GetItem $full)
+        if ($items.Count -eq 1 -and $null -ne $items[0] -and -not $items[0].PSIsContainer -and
+            ($items[0].Attributes -band [IO.FileAttributes]::ReparsePoint) -eq 0) { $item = $items[0] }
+        else { throw 'file observation' }
+    } catch {
+        if (-not (Test-CcodInstalledLifecycleMissingError -ErrorRecord $_)) {
+            Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'An installed product file could not be inspected safely.' $full
+        }
+    }
+    try { Assert-CcodInstalledLifecycleNoReparseAncestors -Path $full -GetItem $GetItem }
+    catch { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'An installed product file ancestry could not be inspected safely.' $full }
+    return $item
+}
+
+function Write-CcodInstalledLifecycleEvidenceFile {
+    param([Parameter(Mandatory)][string]$EvidenceDirectory,[Parameter(Mandatory)]$Receipt,[scriptblock]$ReadbackVerifier)
+    $directory = Assert-CcodInstalledLifecycleSafeDirectory -Path $EvidenceDirectory -Kind 'Evidence directory'
+    $target = [IO.Path]::GetFullPath((Join-Path $directory 'receipt.json'))
+    $temporary = "$target.$([guid]::NewGuid().ToString('N')).tmp"
+    $published = $false
+    try {
+        $bytes = [Text.UTF8Encoding]::new($false).GetBytes(($Receipt | ConvertTo-Json -Depth 16))
+        $sha = [Security.Cryptography.SHA256]::Create()
+        try { $expected = ([BitConverter]::ToString($sha.ComputeHash($bytes))).Replace('-', '').ToLowerInvariant() } finally { $sha.Dispose() }
+        [IO.File]::WriteAllBytes($temporary, $bytes)
+        [IO.File]::Move($temporary, $target)
+        $published = $true
+        $targetItem = Get-Item -LiteralPath $target -Force -ErrorAction Stop
+        if ($targetItem.PSIsContainer -or (($targetItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) { throw 'evidence target' }
+        if ($null -ne $ReadbackVerifier -and -not [bool](& $ReadbackVerifier $target)) { throw 'evidence readback' }
+        $parsed = [IO.File]::ReadAllText($targetItem.FullName, [Text.UTF8Encoding]::new($false, $true)) | ConvertFrom-Json -ErrorAction Stop
+        if ($null -eq $parsed -or (Get-CcodInstalledLifecycleHash -Path $targetItem.FullName) -cne $expected) { throw 'evidence hash readback' }
+        return $target
+    } catch {
+        $failure = $_
+        if ($published) {
+            try {
+                $item = $null
+                try { $item = Get-Item -LiteralPath $target -Force -ErrorAction Stop } catch { if (-not (Test-CcodInstalledLifecycleMissingError -ErrorRecord $_)) { throw } }
+                if ($null -ne $item) {
+                    if ($item.PSIsContainer -or (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) -or (Get-CcodInstalledLifecycleHash -Path $target) -cne $expected) { throw 'evidence cleanup target' }
+                    Remove-Item -LiteralPath $target -Force -ErrorAction Stop
+                }
+                $residual = $null
+                try { $residual = Get-Item -LiteralPath $target -Force -ErrorAction Stop } catch { if (-not (Test-CcodInstalledLifecycleMissingError -ErrorRecord $_)) { throw } }
+                if ($null -ne $residual) { throw 'evidence cleanup residue' }
+            } catch {
+                Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_EVIDENCE_CLEANUP_FAILED' 'Failed evidence cleanup left an unverifiable destination.' $target
+            }
+        }
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_EVIDENCE_WRITE_FAILED' 'Installed lifecycle evidence could not be written and read back safely.' $target
+    } finally {
+        try { $tempItem = Get-Item -LiteralPath $temporary -Force -ErrorAction Stop; if ($null -ne $tempItem) { Remove-Item -LiteralPath $temporary -Force -ErrorAction Stop } } catch { if (-not (Test-CcodInstalledLifecycleMissingError -ErrorRecord $_)) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_EVIDENCE_CLEANUP_FAILED' 'Temporary evidence cleanup could not be verified.' $temporary } }
+    }
+}
+
 function Get-CcodInstalledLifecycleDefaultAdapters {
+    $safeDirectory = ${function:Assert-CcodInstalledLifecycleSafeDirectory}
+    $hashFunction = ${function:Get-CcodInstalledLifecycleHash}
+    $factsFunction = ${function:Get-CcodInstalledLifecycleFacts}
+    $writeEvidenceFunction = ${function:Write-CcodInstalledLifecycleEvidenceFile}
+    $scenarioFunction = ${function:Invoke-CcodInstalledLifecycleOperatorScenario}
+    $verifyScenarioFunction = ${function:Test-CcodInstalledLifecycleScenario}
+    $rollbackFunction = ${function:Invoke-CcodInstalledLifecycleRollback}
+    $missingFunction = ${function:Test-CcodInstalledLifecycleMissingError}
     $defaults = @{}
     $defaults.GetGitStatus = {
         param($RepositoryRoot)
-        $status = & git -C $RepositoryRoot status --porcelain --untracked-files=all 2>$null
+        $status = & git -C $RepositoryRoot status --porcelain --untracked-files=all --ignored=matching 2>$null
         if ($LASTEXITCODE -ne 0) { throw [InvalidOperationException]::new('git status could not determine checkout cleanliness') }
         return @($status | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) })
     }.GetNewClosure()
-    $defaults.GetFileSha256 = { param($Path) Get-CcodInstalledLifecycleHash -Path $Path }.GetNewClosure()
+    $defaults.GetFileSha256 = { param($Path) & $hashFunction -Path $Path }.GetNewClosure()
     $defaults.ReadText = { param($Path) [IO.File]::ReadAllText($Path) }.GetNewClosure()
     $defaults.NewEvidenceDirectory = {
         param($Root, $TransactionId)
-        $safeRoot = Assert-CcodInstalledLifecycleSafeDirectory -Path $Root -Kind 'Evidence root'
+        $safeRoot = & $safeDirectory -Path $Root -Kind 'Evidence root'
         $directory = [IO.Path]::GetFullPath((Join-Path $safeRoot ('installed-lifecycle-' + $TransactionId)))
-        if ([IO.Directory]::Exists($directory) -or [IO.File]::Exists($directory)) {
-            Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_EVIDENCE_EXISTS' 'The generated evidence directory already exists' $directory
+        $probe = { param($CandidatePath) Get-Item -LiteralPath $CandidatePath -Force -ErrorAction Stop }
+        try {
+            $existing = & $probe $directory
+            if ($null -ne $existing) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_EVIDENCE_EXISTS' 'The generated evidence directory already exists' $directory }
+        } catch {
+            if (-not (& $missingFunction -ErrorRecord $_)) { throw }
         }
         [IO.Directory]::CreateDirectory($directory) | Out-Null
-        return Assert-CcodInstalledLifecycleSafeDirectory -Path $directory -Kind 'Evidence directory'
+        return & $safeDirectory -Path $directory -Kind 'Evidence directory'
     }.GetNewClosure()
     $defaults.WriteEvidence = {
-        param($EvidenceDirectory, $Receipt)
-        $directory = Assert-CcodInstalledLifecycleSafeDirectory -Path $EvidenceDirectory -Kind 'Evidence directory'
-        $target = [IO.Path]::GetFullPath((Join-Path $directory 'receipt.json'))
-        $temporary = "$target.$([guid]::NewGuid().ToString('N')).tmp"
-        try {
-            [IO.File]::WriteAllText($temporary, ($Receipt | ConvertTo-Json -Depth 16), [Text.UTF8Encoding]::new($false))
-            [IO.File]::Move($temporary, $target)
-            return $target
-        } finally {
-            if ([IO.File]::Exists($temporary)) { Remove-Item -LiteralPath $temporary -Force -ErrorAction SilentlyContinue }
-        }
+        param($EvidenceDirectory, $Receipt, $ReadbackVerifier)
+        & $writeEvidenceFunction -EvidenceDirectory $EvidenceDirectory -Receipt $Receipt -ReadbackVerifier $ReadbackVerifier
     }.GetNewClosure()
-    $defaults.CaptureFacts = { param($InstallRoot) Get-CcodInstalledLifecycleFacts -InstallRoot $InstallRoot }.GetNewClosure()
+    $defaults.CaptureFacts = { param($InstallRoot,$ExpectedVersion) & $factsFunction -InstallRoot $InstallRoot -ExpectedVersion $ExpectedVersion }.GetNewClosure()
     $defaults.CreateRollbackSnapshot = {
         param($Context, $Facts)
         return [pscustomobject][ordered]@{ kind = 'observation'; transactionId = $Context.transactionId; beforeFacts = $Facts }
     }.GetNewClosure()
-    $defaults.RunScenario = { param($Context) Invoke-CcodInstalledLifecycleOperatorScenario -Context $Context }.GetNewClosure()
-    $defaults.VerifyScenario = { param($Context, $BeforeFacts, $RunResult) Test-CcodInstalledLifecycleScenario -Context $Context -BeforeFacts $BeforeFacts -RunResult $RunResult }.GetNewClosure()
-    $defaults.Rollback = { param($Context, $Snapshot) Invoke-CcodInstalledLifecycleRollback -Context $Context -Snapshot $Snapshot }.GetNewClosure()
+    $defaults.RunScenario = { param($Context) & $scenarioFunction -Context $Context }.GetNewClosure()
+        $defaults.VerifyScenario = { param($Context, $BeforeFacts, $RunResult) & $verifyScenarioFunction -Context $Context -BeforeFacts $BeforeFacts -RunResult $RunResult }.GetNewClosure()
+        $defaults.Rollback = { param($Context, $Snapshot) & $rollbackFunction -Context $Context -Snapshot $Snapshot }.GetNewClosure()
     $defaults.CleanupRollback = { param($Context, $Snapshot) return $true }.GetNewClosure()
     $defaults.GetUtcNow = { [datetime]::UtcNow }.GetNewClosure()
     return $defaults
@@ -174,20 +530,106 @@ function Resolve-CcodInstalledLifecycleAdapters {
     return $resolved
 }
 
+function Get-CcodInstalledLifecycleExecutionAssetModule {
+    $path = Join-Path $script:CcodInstalledLifecycleRepositoryRoot 'tools\ReleaseAssetContract.psm1'
+    $lease = Open-CcodTrustedImportLease -Path $path -ErrorId 'CCOD_INTEGRATION_MODULE_MISSING'
+    try {
+        $lease.Revalidate()
+        $module = Import-Module $path -PassThru -DisableNameChecking -ErrorAction Stop
+        $lease.Revalidate()
+        return $module
+    } finally { $lease.Dispose() }
+}
+
+function Close-CcodInstalledLifecycleExecutionLease {
+    param($Lease)
+    if ($null -eq $Lease -or $Lease.Closed) { return }
+    for ($index = $Lease.Files.Count - 1; $index -ge 0; $index--) { $Lease.Files[$index].Stream.Dispose() }
+    for ($index = $Lease.Parents.Count - 1; $index -ge 0; $index--) { $Lease.Parents[$index].Handle.Dispose() }
+    $Lease.Closed = $true
+}
+
+function Assert-CcodInstalledLifecycleExecutionLease {
+    param([Parameter(Mandatory)]$Lease)
+    try {
+        if ($Lease.Closed) { throw 'closed execution authority' }
+        foreach ($entry in @($Lease.Parents) + @($Lease.Files)) {
+            $handle = if ($entry.Directory) { $entry.Handle } else { $entry.Stream.SafeFileHandle }
+            $current = [CcodReleaseFileAuthorityV1]::Identity($handle)
+            if ([CcodReleaseFileAuthorityV1]::IsReparse($current) -or [CcodReleaseFileAuthorityV1]::IsDirectory($current) -ne $entry.Directory -or
+                $current.Volume -ne $entry.Identity.Volume -or $current.FileId -ne $entry.Identity.FileId -or
+                -not $current.FinalPath.TrimEnd('\').Equals($entry.Path.TrimEnd('\'),[StringComparison]::OrdinalIgnoreCase)) { throw 'execution identity changed' }
+            if (-not $entry.Directory) {
+                if ($current.Links -ne 1 -or $current.Attributes -ne $entry.Identity.Attributes -or $entry.Stream.Length -ne $entry.Length -or
+                    -not (& $Lease.Module {param($Value) Test-CcodReleaseAuthorityStreams -Identity $Value -AllowZone} $current) -or
+                    (& $Lease.Module {param($Stream) Get-CcodReleaseAuthorityStreamSha256 -Stream $Stream} $entry.Stream) -cne $entry.Sha256) { throw 'execution bytes changed' }
+            }
+        }
+    } catch { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_CANDIDATE_INVALID' 'Held execution files changed or became unavailable.' $null }
+}
+
+function Open-CcodInstalledLifecycleExecutionLease {
+    param([Parameter(Mandatory)][string[]]$Paths)
+    $lease = [pscustomobject]@{ Module = (Get-CcodInstalledLifecycleExecutionAssetModule); Files = [Collections.Generic.List[object]]::new(); Parents = [Collections.Generic.List[object]]::new(); Closed = $false }
+    try {
+        if ($Paths.Count -eq 0) { throw 'execution paths empty' }
+        $seenParents = [Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+        $seenFiles = [Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+        foreach ($path in $Paths) {
+            $full = Assert-CcodInstalledLifecycleCanonicalAbsolutePath -Path $path -Kind 'Execution file'
+            if (-not $seenFiles.Add($full)) { throw 'duplicate execution file' }
+            $parents = [Collections.Generic.List[string]]::new()
+            for ($parent = [IO.Directory]::GetParent($full); $null -ne $parent; $parent = $parent.Parent) { $parents.Insert(0,$parent.FullName) }
+            foreach ($directory in $parents) {
+                if (-not $seenParents.Add($directory)) { continue }
+                $handle = [CcodReleaseFileAuthorityV1]::OpenDirectory($directory,$true)
+                $entry = [pscustomobject]@{ Directory = $true; Path = $directory; Handle = $handle; Identity = $null }
+                $lease.Parents.Add($entry)
+                $entry.Identity = [CcodReleaseFileAuthorityV1]::Identity($handle)
+                if ([CcodReleaseFileAuthorityV1]::IsReparse($entry.Identity) -or -not [CcodReleaseFileAuthorityV1]::IsDirectory($entry.Identity) -or
+                    -not $entry.Identity.FinalPath.TrimEnd('\').Equals($directory.TrimEnd('\'),[StringComparison]::OrdinalIgnoreCase)) { throw 'execution ancestor' }
+            }
+            $stream = [CcodReleaseFileAuthorityV1]::OpenReadFile($full,$false)
+            $entry = [pscustomobject]@{ Directory = $false; Path = $full; Stream = $stream; Identity = $null; Length = $stream.Length; Sha256 = $null }
+            $lease.Files.Add($entry)
+            $entry.Identity = [CcodReleaseFileAuthorityV1]::Identity($stream.SafeFileHandle)
+            if ($entry.Length -lt 1 -or $entry.Length -gt 536870912) { throw 'execution bounds' }
+            $entry.Sha256 = & $lease.Module {param($Stream) Get-CcodReleaseAuthorityStreamSha256 -Stream $Stream} $stream
+        }
+        Assert-CcodInstalledLifecycleExecutionLease $lease
+        return $lease
+    } catch {
+        Close-CcodInstalledLifecycleExecutionLease $lease
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_CANDIDATE_INVALID' 'Execution file authority could not be acquired safely.' $null
+    }
+}
+
 function Get-CcodInstalledLifecycleCandidate {
     param(
         [Parameter(Mandatory)][string]$Path,
         [string]$ExpectedVersion,
         [Parameter(Mandatory)][hashtable]$Adapters,
         [Parameter(Mandatory)][string]$Kind,
-        [switch]$AllowAnyVersion
+        [switch]$AllowAnyVersion,
+        [ref]$ExecutionLease
     )
     $installer = Assert-CcodInstalledLifecycleRegularFile -Path $Path -Kind $Kind
     $leaf = [IO.Path]::GetFileName($installer)
-    $versionMatch = [regex]::Match($leaf, '^CodexRemote-fix-(\d+\.\d+\.\d+)-setup\.exe$')
+    $versionMatch = [regex]::Match($leaf, '^CodexRemote-fix-(\d+\.\d+\.\d+)-setup\.exe\z')
     if (-not $versionMatch.Success -or (-not $AllowAnyVersion -and ([string]::IsNullOrWhiteSpace($ExpectedVersion) -or $versionMatch.Groups[1].Value -cne $ExpectedVersion))) {
         Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_CANDIDATE_INVALID' "$Kind filename does not bind the expected version" $installer
     }
+    $executionPaths = @($installer,"$installer.sha256.txt")
+    if ($Kind -ceq 'Installer') {
+        if ([version]$versionMatch.Groups[1].Value -ge [version]'2.5.22') {
+            $executionModule = Get-CcodInstalledLifecycleExecutionAssetModule
+            $executionNames = @(& $executionModule {param($Version) Get-CcodExpectedReleaseAssetNames -Version $Version} $versionMatch.Groups[1].Value)
+            $executionPaths = @($executionNames | ForEach-Object { Join-Path (Split-Path $installer -Parent) $_ })
+        } else { $executionPaths += Join-Path (Split-Path $installer -Parent) ("CodexRemote-fix-{0}-setup-payload-manifest.json" -f $versionMatch.Groups[1].Value) }
+    }
+    $heldExecution = Open-CcodInstalledLifecycleExecutionLease -Paths $executionPaths
+    $transferred = $false
+    try {
     $checksum = Assert-CcodInstalledLifecycleRegularFile -Path "$installer.sha256.txt" -Kind "$Kind checksum"
     $text = & $Adapters.ReadText $checksum
     if ($text -isnot [string]) {
@@ -199,10 +641,221 @@ function Get-CcodInstalledLifecycleCandidate {
         Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_CHECKSUM_INVALID' "$Kind checksum is malformed or names a different asset" $checksum
     }
     $actualHash = [string](& $Adapters.GetFileSha256 $installer)
-    if ($actualHash -cnotmatch '^[0-9a-f]{64}$' -or $actualHash -cne $match.Groups[1].Value) {
+    if ($actualHash -cnotmatch '^[0-9a-f]{64}\z' -or $actualHash -cne $match.Groups[1].Value) {
         Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_CHECKSUM_INVALID' "$Kind checksum does not match the exact installer bytes" $installer
     }
-    return [pscustomobject][ordered]@{ Path = $installer; Version = $versionMatch.Groups[1].Value; Sha256 = $actualHash; ChecksumPath = $checksum }
+    $payloadManifestPath = $null
+    $payloadManifestHash = $null
+    $payloadFiles = @()
+    $candidateCommit = $null
+    $candidateAssets = @()
+    if ($Kind -ceq 'Installer') {
+        $payloadManifestPath = Assert-CcodInstalledLifecycleRegularFile -Path (Join-Path (Split-Path $installer -Parent) ("CodexRemote-fix-{0}-setup-payload-manifest.json" -f $versionMatch.Groups[1].Value)) -Kind "$Kind payload manifest"
+        if ([version]$versionMatch.Groups[1].Value -ge [version]'2.5.22') {
+            $lease=$null;$authority=$null;$contractModule=$null
+            try {
+                $contractPath=Join-Path $script:CcodInstalledLifecycleRepositoryRoot 'tools\ReleaseAssetContract.psm1'
+                $lease=Open-CcodTrustedImportLease -Path $contractPath -ErrorId 'CCOD_INTEGRATION_MODULE_MISSING'
+                $lease.Revalidate();$contractModule=Import-Module $contractPath -PassThru -ErrorAction Stop;$lease.Revalidate()
+                $directory=Split-Path $installer -Parent
+                $authority=&$contractModule {param($Directory,$Version)Open-CcodExactReleaseAssetAuthority -AssetDirectory $Directory -Version $Version -ErrorId 'CCOD_INTEGRATION_CANDIDATE_INVALID'} $directory $versionMatch.Groups[1].Value
+                $contract=&$contractModule {param($Directory,$Version)Test-CcodExactReleaseAssetSet -AssetDirectory $Directory -Version $Version} $directory $versionMatch.Groups[1].Value
+                if($contract.Valid-isnot[bool]-or-not$contract.Valid-or$authority.Files[5].Sha256-cne$actualHash){throw 'sealed installer binding'}
+                $package=&$contractModule {param($File)(Read-CcodReleaseContractPinnedJson -Authority $File -ErrorId 'CCOD_INTEGRATION_CANDIDATE_INVALID').Value} $authority.Files[8]
+                $payloadFiles=@($package.files)
+                if($payloadFiles.Count-eq0-or-not(Test-CcodInstalledLifecycleFileRecordSet -Actual $payloadFiles -Expected $payloadFiles)){throw 'sealed payload records'}
+                $payloadManifestHash=[string]$authority.Files[8].Sha256
+                $candidateCommit=$contract.GitCommit
+                $candidateAssets=@($authority.Files | ForEach-Object { [pscustomobject][ordered]@{ name=$_.Leaf; sha256=$_.Sha256 } })
+                &$contractModule {param($Authority)Assert-CcodExactReleaseAssetAuthorityCurrent -Authority $Authority -ErrorId 'CCOD_INTEGRATION_CANDIDATE_INVALID'|Out-Null} $authority
+                $lease.Revalidate()
+            } catch {
+                Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_CANDIDATE_INVALID' 'The sealed installer payload is not bound to the complete release asset contract.' $payloadManifestPath
+            } finally {
+                if($null-ne$authority){&$contractModule {param($Authority)Close-CcodExactReleaseAssetAuthority $Authority} $authority}
+                if($null-ne$lease){$lease.Dispose()}
+            }
+        } else {
+        $payloadText = & $Adapters.ReadText $payloadManifestPath
+        try {
+            $payloadUnique = & $script:CcodInstalledLifecyclePersistenceIoModule { param($Json) Test-CcodJsonHasNoDuplicateProperties -Json $Json } $payloadText
+            $payloadManifest = $payloadText | ConvertFrom-Json -ErrorAction Stop
+        } catch { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_CANDIDATE_INVALID' 'Installer payload manifest is malformed.' $payloadManifestPath }
+        if ($payloadText -isnot [string] -or -not $payloadUnique -or -not (Test-CcodInstalledLifecycleExactProperties -Value $payloadManifest -Expected @('schemaVersion','projectVersion','files')) -or
+            $payloadManifest.schemaVersion -isnot [int] -or $payloadManifest.schemaVersion -ne 1 -or $payloadManifest.projectVersion -isnot [string] -or $payloadManifest.projectVersion -cne $versionMatch.Groups[1].Value) {
+            Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_CANDIDATE_INVALID' 'Installer payload manifest is not bound to the candidate version.' $payloadManifestPath
+        }
+        $payloadFiles = @($payloadManifest.files)
+        if ($payloadFiles.Count -eq 0 -or -not (Test-CcodInstalledLifecycleFileRecordSet -Actual $payloadFiles -Expected $payloadFiles)) {
+            Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_CANDIDATE_INVALID' 'Installer payload manifest file records are not canonical.' $payloadManifestPath
+        }
+        $payloadManifestHash = [string](& $Adapters.GetFileSha256 $payloadManifestPath)
+        if ($payloadManifestHash -cnotmatch '^[0-9a-f]{64}\z') { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_CANDIDATE_INVALID' 'Installer payload manifest hash is invalid.' $payloadManifestPath }
+        }
+    }
+    Assert-CcodInstalledLifecycleExecutionLease $heldExecution
+    if ($null -ne $ExecutionLease) { $ExecutionLease.Value = $heldExecution; $transferred = $true }
+    return [pscustomobject][ordered]@{ Path = $installer; Version = $versionMatch.Groups[1].Value; Sha256 = $actualHash; ChecksumPath = $checksum; PayloadManifestPath = $payloadManifestPath; PayloadManifestSha256 = $payloadManifestHash; PayloadFiles = @($payloadFiles); GitCommit = $candidateCommit; AssetHashes = @($candidateAssets) }
+    } finally { if (-not $transferred) { Close-CcodInstalledLifecycleExecutionLease $heldExecution } }
+}
+
+function Assert-CcodInstalledLifecycleExpectedCandidate {
+    param([Parameter(Mandatory)]$Candidate,$Expected)
+    try {
+        if (-not (Test-CcodInstalledLifecycleExactProperties $Expected @('version','gitCommit','assetHashes','manifestHashes')) -or
+            $Expected.version -isnot [string] -or $Expected.version -cne $Candidate.Version -or
+            $Expected.gitCommit -isnot [string] -or $Expected.gitCommit -cnotmatch '^[0-9a-f]{40}\z' -or
+            $Expected.gitCommit -cne $Candidate.GitCommit -or $Expected.assetHashes -isnot [array] -or
+            $Expected.assetHashes.Count -ne 11 -or $Candidate.AssetHashes.Count -ne 11) { throw 'candidate metadata' }
+        for ($index=0; $index -lt 11; $index++) {
+            $asset=$Expected.assetHashes[$index];$actual=$Candidate.AssetHashes[$index]
+            if (-not (Test-CcodInstalledLifecycleExactProperties $asset @('name','sha256')) -or
+                $asset.name -isnot [string] -or $asset.name -cne $actual.name -or
+                $asset.sha256 -isnot [string] -or $asset.sha256 -cnotmatch '^[0-9a-f]{64}\z' -or $asset.sha256 -cne $actual.sha256) { throw 'candidate asset' }
+        }
+        if (-not (Test-CcodInstalledLifecycleExactProperties $Expected.manifestHashes @('portable','setup')) -or
+            $Expected.manifestHashes.portable -isnot [string] -or $Expected.manifestHashes.portable -cne $Candidate.AssetHashes[4].sha256 -or
+            $Expected.manifestHashes.setup -isnot [string] -or $Expected.manifestHashes.setup -cne $Candidate.AssetHashes[10].sha256 -or
+            $Candidate.Sha256 -cne $Expected.assetHashes[5].sha256) { throw 'candidate manifest' }
+    } catch { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_CANDIDATE_MISMATCH' 'The held installer does not match the original acceptance candidate.' $null }
+}
+
+function Get-CcodInstalledLifecycleLegacyTrayReadyProof {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)]$Supervisor,[Parameter(Mandatory)]$TrayHost)
+    $lease=$null;$event=$null
+    try {
+        if($RuntimeId-cnotmatch '^2\.5\.21-[0-9a-f]{16}\z'-or@($Supervisor).Count-ne1-or@($TrayHost).Count-ne1){throw 'legacy identity profile'}
+        $root=Assert-CcodInstalledLifecycleCanonicalAbsolutePath -Path $InstallRoot -Kind 'Legacy install root'
+        $runtimeRoot=Join-Path (Join-Path $root 'runtime') $RuntimeId
+        $scriptPath=[IO.Path]::GetFullPath((Join-Path $runtimeRoot 'src\persistence\Supervisor.ps1'))
+        $hostPath=[IO.Path]::GetFullPath((Join-Path $runtimeRoot 'bin\CodexRemote.TrayHost.exe'))
+        $powershellPath=[IO.Path]::GetFullPath((Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'))
+        $current=[Diagnostics.Process]::GetCurrentProcess();try{$sessionId=$current.SessionId}finally{$current.Dispose()}
+        $windowsIdentity=[Security.Principal.WindowsIdentity]::GetCurrent();try{$sid=$windowsIdentity.User.Value}finally{$windowsIdentity.Dispose()}
+        $parentIdentity=@(ConvertTo-CcodInstalledLifecycleIdentities -Records $Supervisor -Kind 'Legacy supervisor')[0]
+        $hostIdentity=@(ConvertTo-CcodInstalledLifecycleIdentities -Records $TrayHost -Kind 'Legacy tray')[0]
+        $readSnapshot={
+            $parents=@(Get-CimInstance -ClassName Win32_Process -Filter ('ProcessId = '+$parentIdentity.pid) -ErrorAction Stop)
+            $hosts=@(Get-CimInstance -ClassName Win32_Process -Filter ('ProcessId = '+$hostIdentity.pid) -ErrorAction Stop)
+            if($parents.Count-ne1-or$hosts.Count-ne1){throw 'legacy process count'}
+            $parent=$parents[0];$child=$hosts[0]
+            foreach($entry in @(@($parent,$parentIdentity,'powershell.exe',$powershellPath),@($child,$hostIdentity,'CodexRemote.TrayHost.exe',$hostPath))){
+                $process=$entry[0];$expected=$entry[1]
+                if($process.Name-isnot[string]-or$process.Name-cne$entry[2]-or
+                    -not(Test-CcodInstalledLifecyclePositiveInteger $process.ProcessId)-or[long]$process.ProcessId-ne$expected.pid-or
+                    (Get-CcodInstalledLifecycleCorrelatedCreationTimeUtc -Process $process)-cne$expected.creationTimeUtc-or
+                    -not(Test-CcodInstalledLifecyclePositiveInteger $process.SessionId -AllowZero)-or[long]$process.SessionId-ne$sessionId-or
+                    $process.ExecutablePath-isnot[string]-or$process.ExecutablePath-ine$entry[3]-or
+                    $process.CommandLine-isnot[string]-or[string]::IsNullOrWhiteSpace($process.CommandLine)){throw 'legacy process identity'}
+            }
+            if(-not(Test-CcodInstalledLifecyclePositiveInteger $child.ParentProcessId)-or[long]$child.ParentProcessId-ne$parentIdentity.pid){throw 'legacy parent pid'}
+            Initialize-CcodInstalledLifecycleCommandLineParser
+            $parentArgs=@([CcodInstalledLifecycleCommandLine]::Parse($parent.CommandLine))
+            $childArgs=@([CcodInstalledLifecycleCommandLine]::Parse($child.CommandLine))
+            if($parentArgs.Count-ne9-or$parentArgs[0]-ine$powershellPath-or
+                ($parentArgs[1..5]-join',')-cne'-NoProfile,-ExecutionPolicy,Bypass,-STA,-File'-or
+                $parentArgs[6]-ine$scriptPath-or$parentArgs[7]-cne'-ReadyToken'-or$parentArgs[8]-cnotmatch'^[0-9a-f]{64}\z'){throw 'legacy supervisor argv'}
+            $parentCreated=[datetime]::ParseExact($parentIdentity.creationTimeUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
+            $expectedChild=@($hostPath,'--child','--parent-pid',$parentIdentity.pid.ToString([Globalization.CultureInfo]::InvariantCulture),'--parent-created',$parentCreated.ToFileTimeUtc().ToString([Globalization.CultureInfo]::InvariantCulture),'--runtime-id',$RuntimeId)
+            if($childArgs.Count-ne$expectedChild.Count-or$childArgs[0]-ine$hostPath-or($childArgs[1..7]-join[char]0)-cne($expectedChild[1..7]-join[char]0)){throw 'legacy host argv'}
+            $status=Read-CcodInstalledLifecycleStatusFact -StateRoot (Join-Path $root 'state')
+            $active=Read-CcodInstalledLifecycleActiveFact -InstallRoot $root
+            if($null-eq$active-or$active.activeRuntime-cne$RuntimeId-or$null-eq$status-or$null-eq$status.session-or$status.session.supervisorPid-ne$parentIdentity.pid-or
+                $status.session.supervisorCreationTimeUtc-cne$parentIdentity.creationTimeUtc-or$status.session.runtimeId-cne$RuntimeId-or
+                $status.session.sessionId-cne$sessionId.ToString([Globalization.CultureInfo]::InvariantCulture)-or$status.session.sessionState-cne'Active'){throw 'legacy status identity'}
+            return [string]$parentArgs[8]
+        }
+        $token=&$readSnapshot
+        $manifestPath=Assert-CcodInstalledLifecycleRegularFile -Path (Join-Path $runtimeRoot 'manifest.json') -Kind 'Legacy runtime manifest'
+        $manifestHash=Get-CcodInstalledLifecycleHash $manifestPath
+        $manifest=Read-CcodInstalledLifecycleStrictJson -Path $manifestPath -ExpectedSchema 1 -Kind 'Legacy runtime manifest'
+        [void](Assert-CcodInstalledLifecycleRuntimeManifest -Manifest $manifest -ExpectedVersion '2.5.21' -ExpectedRuntimeId $RuntimeId -RuntimeRoot $runtimeRoot)
+        foreach($required in @('bin/CodexRemote.TrayHost.exe','src/persistence/Supervisor.ps1')){if(@($manifest.files|Where-Object {$_.path-ceq$required}).Count-ne1){throw 'legacy required runtime file'}}
+        $kernelPath=Join-Path $script:CcodInstalledLifecycleRepositoryRoot 'src\persistence\modules\KernelObjects.psm1'
+        $lease=Open-CcodTrustedImportLease -Path $kernelPath -ErrorId 'CCOD_INTEGRATION_MODULE_MISSING'
+        $lease.Revalidate();$kernel=Import-Module $kernelPath -PassThru -ErrorAction Stop;$lease.Revalidate()
+        $event=&$kernel {param($Sid,$Session,$Token)Open-CcodEvent -Kind Ready -UserSid $Sid -SessionId $Session -ReadyToken $Token} $sid $sessionId $token
+        if($event.Handle-isnot[Threading.EventWaitHandle]-or$event.CreatedNew-isnot[bool]-or$event.CreatedNew){throw 'legacy existing event'}
+        $ready=$event.Handle.WaitOne(0)
+        if((&$readSnapshot)-cne$token-or(Get-CcodInstalledLifecycleHash $manifestPath)-cne$manifestHash){throw 'legacy observation drift'}
+        $lease.Revalidate()
+        return [bool]$ready
+    } catch {
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'Legacy readiness is not bound to the current runtime, parent, host and protected startup event.' $RuntimeId
+    } finally {
+        if($null-ne$event-and$null-ne$event.Handle){$event.Handle.Dispose()}
+        if($null-ne$lease){$lease.Dispose()}
+    }
+}
+
+function Get-CcodInstalledLifecycleTrayHostReadyProof {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$RuntimeId,[Parameter(Mandatory)]$TrayHost)
+    if (@($TrayHost).Count -ne 1) { return $false }
+    if ($RuntimeId -cmatch '^2\.5\.21-[0-9a-f]{16}\z') {
+        $status=Read-CcodInstalledLifecycleStatusFact -StateRoot (Join-Path $InstallRoot 'state')
+        if($null-eq$status-or$null-eq$status.session){return $false}
+        $parent=@([pscustomobject]@{Pid=$status.session.supervisorPid;CreationTimeUtc=$status.session.supervisorCreationTimeUtc})
+        return Get-CcodInstalledLifecycleLegacyTrayReadyProof -InstallRoot $InstallRoot -RuntimeId $RuntimeId -Supervisor $parent -TrayHost $TrayHost
+    }
+    $logPath = Join-Path $InstallRoot 'logs\supervisor.log'
+    $logItem = Get-CcodInstalledLifecycleOptionalRegularFileState -Path $logPath -GetItem { param($CandidatePath) Get-Item -LiteralPath $CandidatePath -Force -ErrorAction Stop }
+    if ($null -eq $logItem) { return $false }
+    try {
+        $text = [IO.File]::ReadAllText($logItem.FullName,[Text.UTF8Encoding]::new($false,$true))
+        $matches = [Collections.Generic.List[object]]::new()
+        foreach ($line in @($text -split "`r?`n")) {
+            if ([string]::IsNullOrWhiteSpace($line)) { continue }
+            $unique = & $script:CcodInstalledLifecyclePersistenceIoModule { param($Json) Test-CcodJsonHasNoDuplicateProperties -Json $Json } $line
+            if (-not $unique) { throw 'ready log duplicate properties' }
+            $record = $line | ConvertFrom-Json -ErrorAction Stop
+            if ($record.stage -isnot [string]) { throw 'supervisor log stage' }
+            if ($record.stage -cne 'TrayHostReady') {
+                $fields = @('schemaVersion','timestampUtc','component','stage','code','outcome')
+                if ($record.stage -ceq 'TrayAction') {
+                    $fields += @('command','revision','status')
+                    if ($record.command -isnot [string] -or [string]::IsNullOrWhiteSpace($record.command) -or
+                        -not (Test-CcodInstalledLifecyclePositiveInteger $record.revision) -or
+                        $record.status -isnot [string] -or @('Completed','Rejected','Failed') -cnotcontains $record.status -or
+                        $record.outcome -cne $record.status -or
+                        ($record.status -ceq 'Completed' -and $record.code -cne 'CCOD_TRAY_ACTION_COMPLETED')) { throw 'tray action log shape' }
+                } elseif (@('LeaseAcquire','RendererHandoff','SafeExitRecovery','LanguageChange','ErrorDialog','TrayCallback') -ccontains $record.stage) {
+                    $expectedEvent = switch -CaseSensitive ($record.stage) {
+                        'LeaseAcquire' { @('CCOD_SUPERVISOR_LEASE_ABANDONED','Warning') }
+                        'RendererHandoff' { @('CCOD_RENDERER_HANDOFF_FAILED','Failed') }
+                        'SafeExitRecovery' { @('CCOD_SUPERVISOR_SAFE_EXIT_RECOVERY_PERSIST_FAILED','Failed') }
+                        'LanguageChange' { @('CCOD_LANGUAGE_CHANGE_ROLLED_BACK','Failed') }
+                        'ErrorDialog' { @('CCOD_TRAY_ACTION_RESULT_FAILED','Failed') }
+                        'TrayCallback' { @('CCOD_TRAY_CALLBACK_FAILED','Failed') }
+                    }
+                    if ($record.code -cne $expectedEvent[0] -or $record.outcome -cne $expectedEvent[1]) { throw 'supervisor event log shape' }
+                } else { throw 'unsupported supervisor log stage' }
+                if (-not (Test-CcodInstalledLifecycleExactProperties -Value $record -Expected $fields) -or
+                    $record.schemaVersion -isnot [int] -or $record.schemaVersion -ne 1 -or
+                    $record.timestampUtc -isnot [string] -or -not (Test-CcodInstalledLifecycleCanonicalUtc $record.timestampUtc) -or
+                    $record.component -isnot [string] -or $record.component -cne 'Supervisor' -or
+                    $record.code -isnot [string] -or -not [regex]::IsMatch($record.code,'^CCOD_[A-Z0-9_]{1,91}\z') -or
+                    $record.outcome -isnot [string]) { throw 'supervisor log frame' }
+                continue
+            }
+            if (-not (Test-CcodInstalledLifecycleExactProperties -Value $record -Expected @('schemaVersion','timestampUtc','component','stage','code','outcome','runtimeId','hostPid','hostCreationTimeUtc','protocolMajor','capabilities')) -or
+                $record.schemaVersion -isnot [int] -or $record.schemaVersion -ne 1 -or
+                $record.timestampUtc -isnot [string] -or -not (Test-CcodInstalledLifecycleCanonicalUtc $record.timestampUtc) -or
+                $record.component -isnot [string] -or $record.component -cne 'Supervisor' -or
+                $record.stage -isnot [string] -or $record.stage -cne 'TrayHostReady' -or
+                $record.code -isnot [string] -or $record.code -cne 'CCOD_TRAYHOST_READY' -or
+                $record.outcome -isnot [string] -or $record.outcome -cne 'Completed' -or
+                $record.runtimeId -isnot [string] -or [string]::IsNullOrWhiteSpace($record.runtimeId) -or
+                $record.hostPid -isnot [int] -or $record.hostPid -le 0 -or
+                $record.hostCreationTimeUtc -isnot [string] -or -not (Test-CcodInstalledLifecycleCanonicalUtc $record.hostCreationTimeUtc) -or
+                (($record.protocolMajor -isnot [int]) -and ($record.protocolMajor -isnot [uint16])) -or $record.protocolMajor -ne 2 -or
+                (($record.capabilities -isnot [int]) -and ($record.capabilities -isnot [long]) -and ($record.capabilities -isnot [uint64])) -or [uint64]$record.capabilities -eq 0) { throw 'ready log shape' }
+            if ($record.runtimeId -ceq $RuntimeId -and $record.hostPid -eq [int]$TrayHost[0].Pid -and $record.hostCreationTimeUtc -ceq [string]$TrayHost[0].CreationTimeUtc) { $matches.Add($record) }
+        }
+        return $matches.Count -gt 0
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_INTEGRATION_*') { throw }
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'TrayHost readiness evidence could not be read safely.' $logPath
+    }
 }
 
 function ConvertTo-CcodInstalledLifecycleIdentities {
@@ -221,10 +874,80 @@ function ConvertTo-CcodInstalledLifecycleIdentities {
 function Test-CcodInstalledLifecycleExactProperties {
     param($Value, [Parameter(Mandatory)][string[]]$Expected)
     if ($null -eq $Value -or ($Value -isnot [pscustomobject] -and $Value -isnot [Collections.IDictionary])) { return $false }
-    $actual = if ($Value -is [Collections.IDictionary]) { @($Value.Keys | ForEach-Object { [string]$_ }) } else { @($Value.PSObject.Properties.Name) }
+    if ($Value -is [Collections.IDictionary]) { $actual = @($Value.Keys | ForEach-Object { [string]$_ }) }
+    else { $actual = @($Value.PSObject.Properties.Name) }
     return $actual.Count -eq $Expected.Count -and ($actual -join "`0") -ceq ($Expected -join "`0")
 }
 
+function Get-CcodInstalledLifecycleProductState {
+    param([Parameter(Mandatory)][string]$RuntimeId)
+    $lease=$null
+    try {
+        $path=Join-Path $script:CcodInstalledLifecycleRepositoryRoot 'src\persistence\modules\ProductRegistration.psm1'
+        $lease=Open-CcodTrustedImportLease -Path $path -ErrorId 'CCOD_INTEGRATION_MODULE_MISSING'
+        $lease.Revalidate();$module=Import-Module $path -PassThru -DisableNameChecking -ErrorAction Stop;$lease.Revalidate()
+        $values=@(&$module {param($Id)Read-CcodCurrentProductState -ExpectedRuntimeId $Id} $RuntimeId)
+        $lease.Revalidate()
+        if($values.Count-ne1){throw 'product state count'}
+        return $values[0]
+    } finally {if($null-ne$lease){$lease.Dispose()}}
+}
+
+function Test-CcodInstalledLifecycleCandidateFileSet {
+    param($Actual,$Expected,[string]$InstallRoot,[string]$RuntimeId,$Generation,[string]$ManifestSha256)
+    try {
+        if($RuntimeId-cnotmatch'^2\.5\.22-[0-9a-f]{16}-[0-9a-f]{32}\z'){return Test-CcodInstalledLifecycleFileRecordSet -Actual $Actual -Expected $Expected}
+        if(-not(Test-CcodInstalledLifecycleFileRecordSet -Actual $Actual -Expected $Actual)-or
+            -not(Test-CcodInstalledLifecycleFileRecordSet -Actual $Expected -Expected $Expected)-or
+            -not(Test-CcodInstalledLifecyclePositiveInteger $Generation)-or$ManifestSha256-cnotmatch'^[0-9a-f]{64}\z'){return $false}
+        $root=Assert-CcodInstalledLifecycleCanonicalAbsolutePath -Path $InstallRoot -Kind 'Product root'
+        $state=Get-CcodInstalledLifecycleProductState -RuntimeId $RuntimeId
+        if($state.valid-isnot[bool]-or-not$state.valid-or@($state.entries).Count-ne3-or$null-eq$state.readyEvidence){return $false}
+        $proof=$state.readyEvidence
+        $fields=@('phase','installRoot','runtimeId','runtimeGeneration','packageSha256','manifestSha256','startMenuSha256','desktopSha256','targetPath','arguments')
+        if(-not(Test-CcodInstalledLifecycleExactProperties -Value $proof -Expected $fields)-or$proof.phase-cne'Ready'-or
+            $proof.installRoot-isnot[string]-or$proof.installRoot-cne$root-or$proof.runtimeId-isnot[string]-or$proof.runtimeId-cne$RuntimeId-or
+            -not(Test-CcodInstalledLifecyclePositiveInteger $proof.runtimeGeneration)-or[uint64]$proof.runtimeGeneration-ne[uint64]$Generation-or
+            $proof.manifestSha256-isnot[string]-or$proof.manifestSha256-cne$ManifestSha256-or$proof.packageSha256-isnot[string]-or$proof.packageSha256-cnotmatch'^[0-9a-f]{64}\z'-or
+            $proof.targetPath-isnot[string]-or$proof.targetPath-cne[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'schtasks.exe'))-or
+            $proof.arguments-isnot[string]-or$proof.arguments-cne'/Run /TN "Codex Control Other Devices Supervisor"'){return $false}
+        $generated=@('registration/Desktop.CodexRemote-fix.lnk','registration/StartMenu.CodexRemote-fix.lnk')
+        foreach($pair in @(@($generated[0],'desktopSha256','Desktop'),@($generated[1],'startMenuSha256','StartMenu'))){
+            $file=@($Actual|Where-Object {$_.path-ceq$pair[0]});$entry=@($state.entries|Where-Object {$_.kind-ceq$pair[2]})
+            if($file.Count-ne1-or$entry.Count-ne1-or$proof.($pair[1])-isnot[string]-or$proof.($pair[1])-cnotmatch'^[0-9a-f]{64}\z'-or
+                $file[0].length-le0-or$file[0].length-gt262144-or$file[0].sha256-cne$proof.($pair[1])-or$entry[0].sha256-cne$file[0].sha256){return $false}
+        }
+        if(@($state.entries|Where-Object {$_.kind-ceq'Registry'}).Count-ne1-or@($Expected|Where-Object {$generated-ccontains$_.path}).Count-ne0){return $false}
+        $payload=@($Actual|Where-Object {$generated-cnotcontains$_.path})
+        return Test-CcodInstalledLifecycleFileRecordSet -Actual $payload -Expected $Expected
+    } catch {return $false}
+}
+
+function Test-CcodInstalledLifecycleFileRecordSet {
+    param($Actual,$Expected)
+    $actualRecords = @($Actual)
+    $expectedRecords = @($Expected)
+    if ($actualRecords.Count -ne $expectedRecords.Count) { return $false }
+    for ($index = 0; $index -lt $expectedRecords.Count; $index++) {
+        $actualRecord = $actualRecords[$index]
+        $expectedRecord = $expectedRecords[$index]
+        if (-not (Test-CcodInstalledLifecycleExactProperties -Value $actualRecord -Expected @('path','length','sha256')) -or
+            -not (Test-CcodInstalledLifecycleExactProperties -Value $expectedRecord -Expected @('path','length','sha256')) -or
+            $actualRecord.path -isnot [string] -or $expectedRecord.path -isnot [string] -or
+            $actualRecord.path -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}\z' -or $expectedRecord.path -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}\z' -or
+            $actualRecord.path.Contains('//') -or $expectedRecord.path.Contains('//') -or $actualRecord.path.Contains('..') -or $expectedRecord.path.Contains('..') -or
+            $actualRecord.path.Contains(':') -or $expectedRecord.path.Contains(':') -or $actualRecord.path.Contains('\') -or $expectedRecord.path.Contains('\') -or
+            $actualRecord.length -isnot [ValueType] -or $actualRecord.length -is [bool] -or $expectedRecord.length -isnot [ValueType] -or $expectedRecord.length -is [bool] -or
+            [decimal]$actualRecord.length -ne [decimal][int64]$actualRecord.length -or [decimal]$expectedRecord.length -ne [decimal][int64]$expectedRecord.length -or
+            [int64]$actualRecord.length -lt 0 -or [int64]$expectedRecord.length -lt 0 -or
+            $actualRecord.sha256 -isnot [string] -or $expectedRecord.sha256 -isnot [string] -or
+            $actualRecord.sha256 -cnotmatch '^[0-9a-f]{64}\z' -or $expectedRecord.sha256 -cnotmatch '^[0-9a-f]{64}\z' -or
+            $actualRecord.path -cne $expectedRecord.path -or [int64]$actualRecord.length -ne [int64]$expectedRecord.length -or $actualRecord.sha256 -cne $expectedRecord.sha256) { return $false }
+        if ($index -gt 0 -and [StringComparer]::Ordinal.Compare([string]$actualRecords[$index - 1].path,[string]$actualRecord.path) -ge 0) { return $false }
+    }
+    return $true
+}
+
 function Test-CcodInstalledLifecyclePositiveInteger {
     param($Value, [switch]$AllowZero)
     if ($Value -isnot [byte] -and $Value -isnot [uint16] -and $Value -isnot [uint32] -and $Value -isnot [uint64] -and
@@ -247,7 +970,7 @@ function ConvertTo-CcodInstalledLifecycleReceiptFact {
     if (-not (Test-CcodInstalledLifecycleExactProperties -Value $Receipt -Expected $fields) -or
         $Receipt.kind -isnot [string] -or @('RestartAndRepair','CheckAndRepair','SafeExit') -cnotcontains $Receipt.kind -or
         $Receipt.origin -isnot [string] -or @('Installer','Tray','ExplicitStart','Guardian') -cnotcontains $Receipt.origin -or
-        $Receipt.runtimeId -isnot [string] -or $Receipt.runtimeId -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$' -or
+        $Receipt.runtimeId -isnot [string] -or $Receipt.runtimeId -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z' -or
         -not (Test-CcodInstalledLifecyclePositiveInteger -Value $Receipt.runtimeGeneration) -or
         $Receipt.phase -isnot [string] -or @('Completed','CloseFailed','OrdinaryLaunchFailed','OrdinaryObservationTimedOut','LaunchWindowExpired','RepairFailed','VerificationFailed','CancelledBeforeClose','SupersededByUpgrade') -cnotcontains $Receipt.phase) {
         Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_FACTS_INVALID' 'Lifecycle receipt fact is malformed' $Receipt
@@ -263,7 +986,7 @@ function ConvertTo-CcodInstalledLifecycleReceiptFact {
 
 function ConvertTo-CcodInstalledLifecycleFacts {
     param($Facts)
-    $expected = @('appPresent','activeRuntimeId','activeGeneration','runtimeManifestSha256','supervisor','trayHost','codex','taskState','statusPhase','statusRuntimeId','statusCodex','transitionStage','lifecycleReceipt','aboutVersion','deviceKeyPresent','deviceKeySha256','shortcuts')
+    $expected = @('installRootPresent','appPresent','runtimeRootPresent','activePointerPresent','installReady','activeRuntimeId','activeGeneration','runtimeManifestSha256','runtimeManifestFiles','supervisor','trayHost','trayHostIdentity','trayAuthenticated','codex','taskState','statusPhase','statusRuntimeId','statusCodex','transitionStage','protectionReady','lifecycleReceipt','aboutVersion','deviceKeyPresent','deviceKeySha256','shortcuts','debugPorts','debugEndpoints')
     if ($null -eq $Facts -or ($Facts -isnot [pscustomobject] -and $Facts -isnot [Collections.IDictionary])) {
         Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_FACTS_INVALID' 'Machine facts are unavailable' $Facts
     }
@@ -271,37 +994,78 @@ function ConvertTo-CcodInstalledLifecycleFacts {
         $property = if ($Facts -is [Collections.IDictionary]) { $Facts.Contains($name) } else { $null -ne $Facts.PSObject.Properties[$name] }
         if (-not $property) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_FACTS_INVALID' "Machine facts omit $name" $Facts }
     }
-    if ($Facts.appPresent -isnot [bool] -or $Facts.deviceKeyPresent -isnot [bool] -or
-        ($null -ne $Facts.activeRuntimeId -and ($Facts.activeRuntimeId -isnot [string] -or $Facts.activeRuntimeId -cnotmatch '^[A-Za-z0-9._-]{1,96}$')) -or
-        ($null -ne $Facts.activeGeneration -and $Facts.activeGeneration -isnot [UInt64]) -or
-        ($null -ne $Facts.runtimeManifestSha256 -and ($Facts.runtimeManifestSha256 -isnot [string] -or $Facts.runtimeManifestSha256 -cnotmatch '^[0-9a-f]{64}$')) -or
-        ($null -ne $Facts.aboutVersion -and ($Facts.aboutVersion -isnot [string] -or $Facts.aboutVersion -cnotmatch '^\d+\.\d+\.\d+$')) -or
-        ($null -ne $Facts.statusRuntimeId -and ($Facts.statusRuntimeId -isnot [string] -or $Facts.statusRuntimeId -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$')) -or
-        ($null -ne $Facts.deviceKeySha256 -and ($Facts.deviceKeySha256 -isnot [string] -or $Facts.deviceKeySha256 -cnotmatch '^[0-9a-f]{64}$')) -or
+    if ($Facts.installRootPresent -isnot [bool] -or $Facts.appPresent -isnot [bool] -or $Facts.runtimeRootPresent -isnot [bool] -or $Facts.activePointerPresent -isnot [bool] -or
+        $Facts.installReady -isnot [bool] -or $Facts.trayAuthenticated -isnot [bool] -or $Facts.protectionReady -isnot [bool] -or $Facts.deviceKeyPresent -isnot [bool] -or
+        ($null -ne $Facts.activeRuntimeId -and ($Facts.activeRuntimeId -isnot [string] -or $Facts.activeRuntimeId -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z')) -or
+        ($null -ne $Facts.activeRuntimeId -and ($Facts.activeGeneration -isnot [UInt64] -or [UInt64]$Facts.activeGeneration -lt 1)) -or
+        ($null -eq $Facts.activeRuntimeId -and $null -ne $Facts.activeGeneration) -or
+        ($null -ne $Facts.runtimeManifestSha256 -and ($Facts.runtimeManifestSha256 -isnot [string] -or $Facts.runtimeManifestSha256 -cnotmatch '^[0-9a-f]{64}\z')) -or
+        -not (Test-CcodInstalledLifecycleFileRecordSet -Actual $Facts.runtimeManifestFiles -Expected $Facts.runtimeManifestFiles) -or
+        ($null -ne $Facts.aboutVersion -and ($Facts.aboutVersion -isnot [string] -or $Facts.aboutVersion -cnotmatch '^\d+\.\d+\.\d+\z')) -or
+        ($null -ne $Facts.statusRuntimeId -and ($Facts.statusRuntimeId -isnot [string] -or $Facts.statusRuntimeId -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z')) -or
+        ($null -ne $Facts.deviceKeySha256 -and ($Facts.deviceKeySha256 -isnot [string] -or $Facts.deviceKeySha256 -cnotmatch '^[0-9a-f]{64}\z')) -or
         ($Facts.deviceKeyPresent -and $null -eq $Facts.deviceKeySha256) -or
         (-not $Facts.deviceKeyPresent -and $null -ne $Facts.deviceKeySha256) -or
         $Facts.taskState -isnot [string] -or $Facts.statusPhase -isnot [string] -or $Facts.transitionStage -isnot [string] -or $Facts.statusPhase.Length -gt 64 -or $Facts.transitionStage.Length -gt 64 -or
         $null -eq $Facts.shortcuts -or $Facts.shortcuts.startMenu -isnot [bool] -or $Facts.shortcuts.desktop -isnot [bool]) {
         Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_FACTS_INVALID' 'Machine facts have an invalid public shape' $Facts
     }
+    $debugPorts = @()
+    if ($null -ne $Facts.debugPorts) { $debugPorts = @($Facts.debugPorts) }
+    foreach ($port in $debugPorts) { if ($port -isnot [int] -or $port -lt 1 -or $port -gt 65535) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_FACTS_INVALID' 'Debug port facts are malformed' $port } }
+    if (@($debugPorts | Sort-Object -Unique).Count -ne $debugPorts.Count) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_FACTS_INVALID' 'Debug port facts contain duplicates' $debugPorts }
+    $codexIdentities = @(ConvertTo-CcodInstalledLifecycleIdentities -Records $Facts.codex -Kind 'Codex')
+    $trayIdentities = @(ConvertTo-CcodInstalledLifecycleIdentities -Records $Facts.trayHost -Kind 'TrayHost')
+    $trayHostIdentity = ConvertTo-CcodInstalledLifecycleNullableIdentity -Identity $Facts.trayHostIdentity -Kind 'TrayHost'
+    if ($trayIdentities.Count -eq 1) {
+        if ($null -eq $trayHostIdentity -or $trayHostIdentity.pid -ne $trayIdentities[0].pid -or $trayHostIdentity.creationTimeUtc -cne $trayIdentities[0].creationTimeUtc) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_FACTS_INVALID' 'TrayHost identity is detached from the observed TrayHost process' $Facts.trayHostIdentity }
+    } elseif ($null -ne $trayHostIdentity -or $Facts.trayAuthenticated) {
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_FACTS_INVALID' 'TrayHost authentication requires exactly one matching TrayHost identity' $Facts.trayHostIdentity
+    }
+    $debugNormalized = @()
+    if ($null -ne $Facts.debugEndpoints) {
+        foreach ($endpoint in @($Facts.debugEndpoints)) {
+            if (-not (Test-CcodInstalledLifecycleExactProperties -Value $endpoint -Expected @('localAddress','localPort','owningProcess','owningProcessCreationTimeUtc')) -or
+                $endpoint.localAddress -isnot [string] -or $endpoint.localAddress -cne '127.0.0.1' -or
+                $endpoint.localPort -isnot [int] -or $endpoint.localPort -lt 1 -or $endpoint.localPort -gt 65535 -or
+                $endpoint.owningProcess -isnot [int] -or $endpoint.owningProcess -lt 1 -or
+                $endpoint.owningProcessCreationTimeUtc -isnot [string] -or [string]::IsNullOrWhiteSpace($endpoint.owningProcessCreationTimeUtc)) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_FACTS_INVALID' 'Debug endpoint identity is malformed' $endpoint }
+            if ($codexIdentities.Count -ne 1 -or $endpoint.owningProcess -ne $codexIdentities[0].Pid -or $endpoint.owningProcessCreationTimeUtc -cne $codexIdentities[0].CreationTimeUtc) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_FACTS_INVALID' 'Debug endpoint is not owned by the verified Codex identity' $endpoint }
+            $debugNormalized += [pscustomobject][ordered]@{ localAddress = [string]$endpoint.localAddress; localPort = [int]$endpoint.localPort; owningProcess = [int]$endpoint.owningProcess; owningProcessCreationTimeUtc = [string]$endpoint.owningProcessCreationTimeUtc }
+        }
+    }
+    if ($debugNormalized.Count -gt 0) {
+        if ($codexIdentities.Count -ne 1 -or @($debugNormalized.owningProcess | Sort-Object -Unique).Count -ne 1 -or [int]$debugNormalized[0].owningProcess -ne [int]$codexIdentities[0].Pid) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_FACTS_INVALID' 'Debug endpoints are not owned by the verified Codex process' $debugNormalized }
+    }
     return [pscustomobject][ordered]@{
+        installRootPresent = [bool]$Facts.installRootPresent
         appPresent = [bool]$Facts.appPresent
+        runtimeRootPresent = [bool]$Facts.runtimeRootPresent
+        activePointerPresent = [bool]$Facts.activePointerPresent
+        installReady = [bool]$Facts.installReady
         activeRuntimeId = $Facts.activeRuntimeId
         activeGeneration = $Facts.activeGeneration
         runtimeManifestSha256 = $Facts.runtimeManifestSha256
+        runtimeManifestFiles = @($Facts.runtimeManifestFiles)
         supervisor = @(ConvertTo-CcodInstalledLifecycleIdentities -Records $Facts.supervisor -Kind 'Supervisor')
-        trayHost = @(ConvertTo-CcodInstalledLifecycleIdentities -Records $Facts.trayHost -Kind 'TrayHost')
+        trayHost = @($trayIdentities)
+        trayHostIdentity = $trayHostIdentity
+        trayAuthenticated = [bool]$Facts.trayAuthenticated
         codex = @(ConvertTo-CcodInstalledLifecycleIdentities -Records $Facts.codex -Kind 'Codex')
+        codexCount = [int]$codexIdentities.Count
         taskState = [string]$Facts.taskState
         statusPhase = [string]$Facts.statusPhase
         statusRuntimeId = $Facts.statusRuntimeId
         statusCodex = ConvertTo-CcodInstalledLifecycleNullableIdentity -Identity $Facts.statusCodex -Kind 'Status Codex'
         transitionStage = [string]$Facts.transitionStage
+        protectionReady = [bool]$Facts.protectionReady
         lifecycleReceipt = ConvertTo-CcodInstalledLifecycleReceiptFact -Receipt $Facts.lifecycleReceipt
         aboutVersion = $Facts.aboutVersion
         deviceKeyPresent = [bool]$Facts.deviceKeyPresent
         deviceKeySha256 = $Facts.deviceKeySha256
         shortcuts = [pscustomobject][ordered]@{ startMenu = [bool]$Facts.shortcuts.startMenu; desktop = [bool]$Facts.shortcuts.desktop }
+        debugPorts = [int[]]$debugPorts
+        debugEndpoints = @($debugNormalized)
     }
 }
 
@@ -322,15 +1086,96 @@ function Read-CcodInstalledLifecycleStrictJson {
     } $Path $ExpectedSchema $Kind
 }
 
+function Get-CcodInstalledLifecycleFileLinkCount {
+    param([Parameter(Mandatory)][string]$Path)
+    if ($null -eq ('CcodInstalledLifecycleFileIdentity' -as [type])) {
+        Add-Type -TypeDefinition @'
+using System;
+using System.ComponentModel;
+using System.IO;
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+public static class CcodInstalledLifecycleFileIdentity {
+    [StructLayout(LayoutKind.Sequential)] private struct Info { public uint Attributes; public System.Runtime.InteropServices.ComTypes.FILETIME Creation; public System.Runtime.InteropServices.ComTypes.FILETIME Access; public System.Runtime.InteropServices.ComTypes.FILETIME Write; public uint Volume; public uint FileIndexHigh; public uint FileIndexLow; public uint Links; public uint SizeHigh; public uint SizeLow; }
+    [DllImport("kernel32.dll", SetLastError=true)] private static extern bool GetFileInformationByHandle(SafeFileHandle handle, out Info info);
+    public static uint Links(string path) { using (FileStream stream = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.Read)) { Info info; if (!GetFileInformationByHandle(stream.SafeFileHandle, out info)) throw new Win32Exception(Marshal.GetLastWin32Error()); return info.Links; } }
+}
+'@
+    }
+    return [CcodInstalledLifecycleFileIdentity]::Links($Path)
+}
+
+function Assert-CcodInstalledLifecyclePlainSelectorFile {
+    param([Parameter(Mandatory)][string]$Path)
+    $item = Get-Item -LiteralPath $Path -Force -ErrorAction Stop
+    if ($item.PSIsContainer -or (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) -or (Get-CcodInstalledLifecycleFileLinkCount -Path $Path) -ne 1) { throw 'selector file identity' }
+    $streams = @(Get-Item -LiteralPath $Path -Stream * -ErrorAction Stop)
+    if ($streams.Count -ne 1 -or [string]$streams[0].Stream -cne ':$DATA') { throw 'selector file streams' }
+}
+
 function Read-CcodInstalledLifecycleActiveFact {
     param([Parameter(Mandatory)][string]$InstallRoot)
+    $probe = { param($CandidatePath) Get-Item -LiteralPath $CandidatePath -Force -ErrorAction Stop }
+    $selectorRoot = Join-Path (Join-Path $InstallRoot 'state') 'active-generation'
+    $selectorPresent = Get-CcodInstalledLifecycleOptionalDirectoryState -Path $selectorRoot -GetItem $probe
+    if ($selectorPresent) {
+        try {
+            $selectorItem = & $probe $selectorRoot
+            if (-not $selectorItem.PSIsContainer -or (($selectorItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) { throw 'selector root' }
+            $entries = @(Get-ChildItem -LiteralPath $selectorRoot -Force -ErrorAction Stop)
+            if ($entries.Count -eq 0) { throw 'selector empty' }
+            $records = [Collections.Generic.List[object]]::new()
+            foreach ($entry in $entries) {
+                if ($entry.PSIsContainer -or $entry -isnot [IO.FileInfo] -or (($entry.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) -or $entry.Name -notmatch '^\d{20}\.json\z') { throw 'selector entry' }
+                Assert-CcodInstalledLifecyclePlainSelectorFile -Path $entry.FullName
+                $record = Read-CcodInstalledLifecycleStrictJson -Path $entry.FullName -ExpectedSchema 1 -Kind 'installed active-generation selector'
+                if ($record.activeRuntime -isnot [string] -or -not [regex]::IsMatch([string]$record.activeRuntime, '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z', [Text.RegularExpressions.RegexOptions]::CultureInvariant)) { throw 'selector active runtime' }
+                if (-not (Test-CcodInstalledLifecycleExactProperties -Value $record -Expected @('schemaVersion','generation','activeRuntime','previousGeneration')) -or
+                    $record.schemaVersion -isnot [int] -or $record.schemaVersion -ne 1 -or
+                    $record.activeRuntime -isnot [string] -or $record.activeRuntime -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z' -or
+                    -not (Test-CcodInstalledLifecyclePositiveInteger -Value $record.generation) -or
+                    $record.previousGeneration -isnot [ValueType] -or $record.previousGeneration -is [bool] -or
+                    $record.previousGeneration -isnot [byte] -and $record.previousGeneration -isnot [uint16] -and $record.previousGeneration -isnot [uint32] -and $record.previousGeneration -isnot [uint64] -and
+                    $record.previousGeneration -isnot [int16] -and $record.previousGeneration -isnot [int32] -and $record.previousGeneration -isnot [int64]) { throw 'selector record' }
+                [UInt64]$generation = $record.generation
+                [UInt64]$previous = $record.previousGeneration
+                if ($entry.Name -cne ('{0:D20}.json' -f $generation) -or $generation -eq 0 -or $previous -ne ($generation - 1)) { throw 'selector canonical record' }
+                $records.Add([pscustomobject][ordered]@{ generation = $generation; activeRuntime = [string]$record.activeRuntime; previousGeneration = $previous })
+            }
+            $ordered = @($records | Sort-Object generation)
+            for ($index = 0; $index -lt $ordered.Count; $index++) {
+                if ([UInt64]$ordered[$index].generation -ne [UInt64]($index + 1) -or [UInt64]$ordered[$index].previousGeneration -ne [UInt64]$index) { throw 'selector chain' }
+            }
+            $latest = $ordered[-1]
+            return [pscustomobject][ordered]@{ schemaVersion = 2; activeRuntime = [string]$latest.activeRuntime; previousRuntime = $null; generation = [UInt64]$latest.generation; updatedAtUtc = '1970-01-01T00:00:00.0000000Z' }
+        } catch {
+            Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_FACTS_INVALID' 'Append-only active-generation selector is malformed' $selectorRoot
+        }
+    }
     $path = Join-Path $InstallRoot 'active.json'
-    if (-not [IO.File]::Exists($path)) { return $null }
-    $active = Read-CcodInstalledLifecycleStrictJson -Path $path -ExpectedSchema 2 -Kind 'installed active runtime'
+    $item = Get-CcodInstalledLifecycleOptionalRegularFileState -Path $path -GetItem $probe
+    if ($null -eq $item) { return $null }
+    Assert-CcodInstalledLifecyclePlainSelectorFile -Path $item.FullName
+    $active = $null
+    $legacy = $false
+    try { $active = Read-CcodInstalledLifecycleStrictJson -Path $item.FullName -ExpectedSchema 2 -Kind 'installed active runtime' } catch {
+        if ($_.FullyQualifiedErrorId -notlike '*CCOD_SCHEMA_UNSUPPORTED*') { throw }
+        $active = Read-CcodInstalledLifecycleStrictJson -Path $item.FullName -ExpectedSchema 1 -Kind 'installed legacy active runtime'
+        $legacy = $true
+    }
+    if ($legacy) {
+        if (-not (Test-CcodInstalledLifecycleExactProperties -Value $active -Expected @('schemaVersion','activeRuntime','previousRuntime','updatedAtUtc')) -or
+            $active.schemaVersion -isnot [int] -or $active.schemaVersion -ne 1 -or $active.activeRuntime -isnot [string] -or $active.activeRuntime -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z' -or
+            ($null -ne $active.previousRuntime -and ($active.previousRuntime -isnot [string] -or $active.previousRuntime -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z')) -or
+            -not (Test-CcodInstalledLifecycleCanonicalUtc -Value $active.updatedAtUtc)) {
+            Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_FACTS_INVALID' 'Active runtime schema 1 is malformed' $path
+        }
+        return [pscustomobject][ordered]@{ schemaVersion = 2; activeRuntime = [string]$active.activeRuntime; previousRuntime = $active.previousRuntime; generation = [UInt64]1; updatedAtUtc = [string]$active.updatedAtUtc }
+    }
     if (-not (Test-CcodInstalledLifecycleExactProperties -Value $active -Expected @('schemaVersion','activeRuntime','previousRuntime','generation','updatedAtUtc')) -or
         $active.schemaVersion -isnot [int] -or $active.schemaVersion -ne 2 -or
-        $active.activeRuntime -isnot [string] -or $active.activeRuntime -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$' -or
-        ($null -ne $active.previousRuntime -and ($active.previousRuntime -isnot [string] -or $active.previousRuntime -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$')) -or
+        $active.activeRuntime -isnot [string] -or $active.activeRuntime -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z' -or
+        ($null -ne $active.previousRuntime -and ($active.previousRuntime -isnot [string] -or $active.previousRuntime -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z')) -or
         -not (Test-CcodInstalledLifecyclePositiveInteger -Value $active.generation) -or
         -not (Test-CcodInstalledLifecycleCanonicalUtc -Value $active.updatedAtUtc)) {
         Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_FACTS_INVALID' 'Active runtime schema 2 is malformed' $path
@@ -341,8 +1186,10 @@ function Read-CcodInstalledLifecycleActiveFact {
 function Read-CcodInstalledLifecycleStatusFact {
     param([Parameter(Mandatory)][string]$StateRoot)
     $path = Join-Path $StateRoot 'status.json'
-    if (-not [IO.File]::Exists($path)) { return $null }
-    $status = Read-CcodInstalledLifecycleStrictJson -Path $path -ExpectedSchema 1 -Kind 'installed status'
+    $probe = { param($CandidatePath) Get-Item -LiteralPath $CandidatePath -Force -ErrorAction Stop }
+    $item = Get-CcodInstalledLifecycleOptionalRegularFileState -Path $path -GetItem $probe
+    if ($null -eq $item) { return $null }
+    $status = Read-CcodInstalledLifecycleStrictJson -Path $item.FullName -ExpectedSchema 1 -Kind 'installed status'
     try {
         & $script:CcodInstalledLifecycleStateStoreModule { param($Value) Assert-CcodStatusShape -Status $Value } $status
     } catch {
@@ -354,8 +1201,10 @@ function Read-CcodInstalledLifecycleStatusFact {
 function Read-CcodInstalledLifecycleTransitionFact {
     param([Parameter(Mandatory)][string]$StateRoot)
     $path = Join-Path $StateRoot 'transition.json'
-    if (-not [IO.File]::Exists($path)) { return $null }
-    $transition = Read-CcodInstalledLifecycleStrictJson -Path $path -ExpectedSchema 1 -Kind 'installed transition'
+    $probe = { param($CandidatePath) Get-Item -LiteralPath $CandidatePath -Force -ErrorAction Stop }
+    $item = Get-CcodInstalledLifecycleOptionalRegularFileState -Path $path -GetItem $probe
+    if ($null -eq $item) { return $null }
+    $transition = Read-CcodInstalledLifecycleStrictJson -Path $item.FullName -ExpectedSchema 1 -Kind 'installed transition'
     try {
         & $script:CcodInstalledLifecycleStateStoreModule { param($Value) Assert-CcodTransitionShape -Transition $Value } $transition
     } catch {
@@ -370,18 +1219,23 @@ function Get-CcodInstalledLifecycleReceiptFact {
         [AllowNull()][string]$ActiveRuntimeId,
         [UInt64]$ActiveGeneration
     )
-    $directory = Join-Path $StateRoot 'lifecycle\receipts'
-    if (-not [IO.Directory]::Exists($directory)) { return $null }
-    $directoryItem = Get-Item -LiteralPath $directory -Force -ErrorAction Stop
+    $directory = Join-Path (Join-Path $StateRoot 'lifecycle') 'receipts'
+    $probe = { param($CandidatePath) Get-Item -LiteralPath $CandidatePath -Force -ErrorAction Stop }
+    $directoryPresent = Get-CcodInstalledLifecycleOptionalDirectoryState -Path $directory -GetItem $probe
+    if (-not $directoryPresent) { return $null }
+    $directoryItem = & $probe $directory
     if (-not $directoryItem.PSIsContainer -or (($directoryItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) {
         Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_FACTS_INVALID' 'Lifecycle receipt root is malformed' $directory
     }
     $seen = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
     $candidates = [Collections.Generic.List[object]]::new()
-    foreach ($item in @(Get-ChildItem -LiteralPath $directory -Force -ErrorAction Stop | Where-Object { $_.Name -like '*.json' })) {
-        if ($item.PSIsContainer -or $item -isnot [IO.FileInfo] -or (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) {
+    foreach ($item in @(Get-ChildItem -LiteralPath $directory -Force -ErrorAction Stop)) {
+        if ($item.PSIsContainer -or $item -isnot [IO.FileInfo] -or (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) -or
+            $item.Name -cnotmatch '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.json\z') {
             Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_FACTS_INVALID' 'Lifecycle receipt entry is malformed' $item.FullName
         }
+        try { Assert-CcodInstalledLifecyclePlainSelectorFile -Path $item.FullName }
+        catch { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_FACTS_INVALID' 'Lifecycle receipt entry does not have plain-file identity.' $item.FullName }
         $receipt = Read-CcodInstalledLifecycleStrictJson -Path $item.FullName -ExpectedSchema 1 -Kind 'installed lifecycle receipt'
         try {
             & $script:CcodInstalledLifecycleTransactionModule { param($Value) Assert-CcodLifecycleRequest -Request $Value } $receipt
@@ -509,18 +1363,94 @@ function Get-CcodInstalledLifecycleChatGptIdentities {
         }
         $created = ConvertTo-CcodInstalledLifecycleCreationTimeUtc -Value $process.CreationDate
         $classification=Get-CcodInstalledLifecycleChatGptClassification -Process $process
-        if($classification -ceq 'Root'){$records.Add([pscustomobject][ordered]@{Pid=[int]$process.ProcessId;CreationTimeUtc=$created})}
+        if($classification -ceq 'Root'){$created=Get-CcodInstalledLifecycleCorrelatedCreationTimeUtc -Process $process;$records.Add([pscustomobject][ordered]@{Pid=[int]$process.ProcessId;CreationTimeUtc=$created})}
     }
     return @($records)
 }
 
+function Assert-CcodInstalledLifecycleRuntimeManifest {
+    param([Parameter(Mandatory)]$Manifest,[Parameter(Mandatory)][string]$ExpectedVersion,[Parameter(Mandatory)][string]$ExpectedRuntimeId,[string]$RuntimeRoot)
+    try {
+        if (-not (Test-CcodInstalledLifecycleExactProperties -Value $Manifest -Expected @('schemaVersion','projectVersion','runtimeId','files')) -or
+            $Manifest.files -isnot [Array] -or -not (Test-CcodInstalledLifecyclePositiveInteger $Manifest.schemaVersion -AllowZero) -or $Manifest.schemaVersion -ne 1) { throw 'manifest frame' }
+        $newRuntimeMatch = [regex]::Match($ExpectedRuntimeId, '^(?<version>[A-Za-z0-9][A-Za-z0-9._-]{0,45})-(?<digest>[0-9a-f]{16})-(?<nonce>[0-9a-f]{32})\z')
+        $legacyRuntimeMatch = [regex]::Match($ExpectedRuntimeId, '^(?<version>[A-Za-z0-9][A-Za-z0-9._-]{0,45})-(?<digest>[0-9a-f]{16})\z')
+        $expectedManifestVersion = if ($newRuntimeMatch.Success) { $newRuntimeMatch.Groups['version'].Value } else { $legacyRuntimeMatch.Groups['version'].Value }
+        if ((-not $newRuntimeMatch.Success -and -not $legacyRuntimeMatch.Success) -or ($legacyRuntimeMatch.Success -and $legacyRuntimeMatch.Groups['version'].Value -cne '2.5.21') -or
+            $expectedManifestVersion -cne $ExpectedVersion -or
+            $Manifest.runtimeId -isnot [string] -or $Manifest.runtimeId -cne $ExpectedRuntimeId -or $Manifest.projectVersion -isnot [string] -or $Manifest.projectVersion -cne $ExpectedVersion) { throw 'manifest frame' }
+        $previousPath = $null
+        $seenPaths = [Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+        foreach ($file in @($Manifest.files)) {
+            if (-not (Test-CcodInstalledLifecycleExactProperties -Value $file -Expected @('path','length','sha256')) -or
+                $file.path -isnot [string] -or [string]::IsNullOrWhiteSpace($file.path) -or
+                [IO.Path]::IsPathRooted($file.path) -or $file.path.Contains('..') -or $file.path.Contains(':') -or
+                -not (Test-CcodInstalledLifecyclePositiveInteger $file.length -AllowZero) -or
+                $file.sha256 -isnot [string] -or $file.sha256 -cnotmatch '^[0-9a-f]{64}\z' -or
+                -not $seenPaths.Add([string]$file.path)) { throw 'manifest file' }
+            if ($null -ne $previousPath -and [StringComparer]::Ordinal.Compare([string]$previousPath,[string]$file.path) -ge 0) { throw 'manifest order' }
+            $previousPath = [string]$file.path
+        }
+        if (-not [string]::IsNullOrWhiteSpace($RuntimeRoot)) {
+            $runtimePath = [IO.Path]::GetFullPath($RuntimeRoot)
+            $runtimeItem = Get-Item -LiteralPath $runtimePath -Force -ErrorAction Stop
+            if ($runtimeItem.PSIsContainer -ne $true -or ($runtimeItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'runtime root' }
+            $actualFiles = [Collections.Generic.List[object]]::new()
+            $prefix = $runtimePath.TrimEnd('\') + '\'
+            foreach ($item in @(Get-ChildItem -LiteralPath $runtimePath -Force -Recurse -ErrorAction Stop)) {
+                if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'runtime reparse' }
+                if (-not $item.PSIsContainer) {
+                    $relative = $item.FullName.Substring($prefix.Length).Replace('\','/')
+                    if (-not $relative.Equals('manifest.json',[StringComparison]::OrdinalIgnoreCase)) {
+                        $actualFiles.Add([pscustomobject][ordered]@{ path = $relative; length = [int64]$item.Length; sha256 = Get-CcodInstalledLifecycleHash -Path $item.FullName })
+                    }
+                }
+            }
+            $actualFiles.Sort([Comparison[object]]{param($left,$right) [StringComparer]::Ordinal.Compare([string]$left.path,[string]$right.path)})
+            $actual = @($actualFiles)
+            $declared = @($Manifest.files)
+            if ($actual.Count -ne $declared.Count) { throw 'runtime files count' }
+            for ($index = 0; $index -lt $actual.Count; $index++) {
+                if ($actual[$index].path -cne [string]$declared[$index].path -or [int64]$actual[$index].length -ne [int64]$declared[$index].length -or $actual[$index].sha256 -cne [string]$declared[$index].sha256) { throw 'runtime file binding' }
+            }
+            $canonical = if ($newRuntimeMatch.Success) {
+                @($declared | ForEach-Object { "{0}`t{1}`t{2}" -f [string]$_.path,[int64]$_.length,[string]$_.sha256 }) -join "`n"
+            } else {
+                @($declared | ForEach-Object { '{0}`t{1}`t{2}' -f [string]$_.path,[int64]$_.length,[string]$_.sha256 }) -join "`n"
+            }
+            $sha = [Security.Cryptography.SHA256]::Create()
+            try { $digest = ([BitConverter]::ToString($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes($canonical)))).Replace('-','').ToLowerInvariant() } finally { $sha.Dispose() }
+            if ($newRuntimeMatch.Success) {
+                if ($newRuntimeMatch.Groups['digest'].Value -cne $digest.Substring(0,16)) { throw 'runtime id binding' }
+            } elseif ($legacyRuntimeMatch.Groups['digest'].Value -cne $digest.Substring(0,16)) { throw 'legacy runtime id binding' }
+        }
+        return $Manifest
+    } catch {
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'The active runtime manifest is missing, malformed, or detached from the installed candidate.' $ExpectedRuntimeId
+    }
+}
+
 function Get-CcodInstalledLifecycleFacts {
-    param([Parameter(Mandatory)][string]$InstallRoot)
-    $root = [IO.Path]::GetFullPath($InstallRoot)
+    param([Parameter(Mandatory)][string]$InstallRoot,[string]$ExpectedVersion,[object]$ExpectedDebugPorts,[object[]]$ExpectedPayloadFiles)
+    $root = Assert-CcodInstalledLifecycleCanonicalAbsolutePath -Path $InstallRoot -Kind 'Install root'
     $appRoot = Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)) 'CodexControlOtherDevices-installer'
+    $pathProbe = { param($Path) Get-Item -LiteralPath $Path -Force -ErrorAction Stop }.GetNewClosure()
+    $installRootPresent = Get-CcodInstalledLifecycleOptionalDirectoryState -Path $root -GetItem $pathProbe
+    if ($installRootPresent) { [void](Assert-CcodInstalledLifecycleSafeDirectory -Path $root -Kind 'Install root') }
+    $runtimeRootPath = Join-Path $root 'runtime'
+    $selectorRootPath = Join-Path (Join-Path $root 'state') 'active-generation'
+    $activePointerPath = Join-Path $root 'active.json'
+    $runtimeRootPresent = Get-CcodInstalledLifecycleOptionalDirectoryState -Path $runtimeRootPath -GetItem $pathProbe
+    $selectorPresent = Get-CcodInstalledLifecycleOptionalDirectoryState -Path $selectorRootPath -GetItem $pathProbe
+    $activePointerItem = Get-CcodInstalledLifecycleOptionalRegularFileState -Path $activePointerPath -GetItem $pathProbe
+    $activePointerPresent = $selectorPresent -or ($null -ne $activePointerItem)
+    $appRootPresent = Get-CcodInstalledLifecycleOptionalDirectoryState -Path $appRoot -GetItem $pathProbe
     $activeRuntimeId = $null
     [UInt64]$activeGeneration = 0
     $runtimeManifestSha256 = $null
+    $runtimeManifestFiles = @()
+    $activeManifestObject = $null
+    $manifestExpectedVersion = $ExpectedVersion
     $statusPhase = 'Unavailable'
     $statusRuntimeId = $null
     $statusCodex = $null
@@ -530,7 +1460,14 @@ function Get-CcodInstalledLifecycleFacts {
         $activeRuntimeId = [string]$active.activeRuntime
         $activeGeneration = [UInt64]$active.generation
         $manifest = Join-Path (Join-Path (Join-Path $root 'runtime') $activeRuntimeId) 'manifest.json'
-        if ([IO.File]::Exists($manifest)) { $runtimeManifestSha256 = Get-CcodInstalledLifecycleHash -Path $manifest }
+        $manifestItem = Get-CcodInstalledLifecycleOptionalRegularFileState -Path $manifest -GetItem $pathProbe
+        if ($null -eq $manifestItem) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'The active runtime manifest is missing.' $manifest }
+        $runtimeManifestSha256 = Get-CcodInstalledLifecycleHash -Path $manifestItem.FullName
+        try { $activeManifestObject = Read-CcodInstalledLifecycleStrictJson -Path $manifestItem.FullName -ExpectedSchema 1 -Kind 'installed runtime manifest' } catch { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'The active runtime manifest could not be read safely.' $manifest }
+        if ([string]::IsNullOrWhiteSpace($manifestExpectedVersion)) {
+            if ($activeRuntimeId -notmatch '^(?<version>[A-Za-z0-9][A-Za-z0-9._-]{0,45})-(?<digest>[0-9a-f]{16})(?:-(?<nonce>[0-9a-f]{32}))?\z') { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'The active runtime version binding could not be proven.' $activeRuntimeId }
+            $manifestExpectedVersion = [string]$Matches.version
+        }
     }
     $stateRoot = Join-Path $root 'state'
     $status = Read-CcodInstalledLifecycleStatusFact -StateRoot $stateRoot
@@ -554,7 +1491,9 @@ function Get-CcodInstalledLifecycleFacts {
         $matches = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskName -ceq $script:CcodInstalledLifecycleTaskName })
         if ($matches.Count -eq 0) { $taskState = 'Absent' }
         elseif ($matches.Count -eq 1) { $taskState = [string]$matches[0].State }
-    } catch { $taskState = 'Unknown' }
+    } catch {
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'The Supervisor scheduled task could not be inspected safely.' $null
+    }
     $makeIdentities = {
         param([string[]]$Names, [scriptblock]$Predicate)
         $records = [Collections.Generic.List[object]]::new()
@@ -562,57 +1501,158 @@ function Get-CcodInstalledLifecycleFacts {
             try {
                 foreach ($process in @(Get-CimInstance -ClassName Win32_Process -Filter ("Name = '{0}'" -f $name) -ErrorAction Stop)) {
                     if (-not (& $Predicate $process)) { continue }
-                    $created = [Management.ManagementDateTimeConverter]::ToDateTime([string]$process.CreationDate).ToUniversalTime().ToString('o', [Globalization.CultureInfo]::InvariantCulture)
+                    $created = Get-CcodInstalledLifecycleCorrelatedCreationTimeUtc -Process $process
                     $records.Add([pscustomobject][ordered]@{ Pid = [int]$process.ProcessId; CreationTimeUtc = $created })
                 }
-            } catch { }
+            } catch {
+                Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'Process identities could not be inspected safely.' $null
+            }
         }
         return @($records)
-    }.GetNewClosure()
+    }
     $supervisor = & $makeIdentities @('powershell.exe','pwsh.exe') {
         param($Process)
-        ([string]$Process.CommandLine).IndexOf('Supervisor.ps1', [StringComparison]::OrdinalIgnoreCase) -ge 0 -and
-        ([string]$Process.CommandLine).IndexOf($root, [StringComparison]::OrdinalIgnoreCase) -ge 0
+        $commandLine = Assert-CcodInstalledLifecycleReadableProcessText -Value $Process.CommandLine -Kind 'Supervisor CommandLine'
+        $commandLine.IndexOf('Supervisor.ps1', [StringComparison]::OrdinalIgnoreCase) -ge 0 -and
+        $commandLine.IndexOf($root, [StringComparison]::OrdinalIgnoreCase) -ge 0
     }
-    $trayHostPath = [IO.Path]::GetFullPath((Join-Path $root 'bin\CodexRemote.TrayHost.exe'))
+    $trayRuntimeRoot = if ($null -ne $activeRuntimeId) { Join-Path (Join-Path $root 'runtime') $activeRuntimeId } else { $root }
+    $trayHostPath = [IO.Path]::GetFullPath((Join-Path $trayRuntimeRoot 'bin\CodexRemote.TrayHost.exe'))
     $trayHost = & $makeIdentities @('CodexRemote.TrayHost.exe') {
         param($Process)
-        [string]$Process.ExecutablePath -ieq $trayHostPath
+        $executablePath = Assert-CcodInstalledLifecycleReadableProcessText -Value $Process.ExecutablePath -Kind 'TrayHost ExecutablePath'
+        $executablePath -ieq $trayHostPath
+    }
+    $trayHostIdentity = $null
+    $trayAuthenticated = $false
+    if (@($trayHost).Count -eq 1) {
+        $trayHostIdentity = [pscustomobject][ordered]@{ pid = [int]$trayHost[0].Pid; creationTimeUtc = [string]$trayHost[0].CreationTimeUtc }
+        if ($null -ne $activeRuntimeId) { $trayAuthenticated = [bool](Get-CcodInstalledLifecycleTrayHostReadyProof -InstallRoot $root -RuntimeId $activeRuntimeId -TrayHost $trayHost) }
     }
     $codex = @(Get-CcodInstalledLifecycleChatGptIdentities)
     $aboutVersion = $null
-    $packagePath = Join-Path $appRoot 'package.json'
-    if ([IO.File]::Exists($packagePath)) {
+    $sealedRuntime = $null -ne $activeRuntimeId -and $activeRuntimeId -cmatch '^2\.5\.22-[0-9a-f]{16}-[0-9a-f]{32}\z'
+    $packagePath = if ($sealedRuntime) { Join-Path $trayRuntimeRoot 'package.json' } else { Join-Path $appRoot 'package.json' }
+    $packageItem = Get-CcodInstalledLifecycleOptionalRegularFileState -Path $packagePath -GetItem $pathProbe
+    if ($sealedRuntime) { $appRootPresent = $null -ne $packageItem }
+    if ($null -ne $packageItem) {
         try {
-            $package = [IO.File]::ReadAllText($packagePath) | ConvertFrom-Json -ErrorAction Stop
-            if ($package.version -is [string] -and $package.version -cmatch '^\d+\.\d+\.\d+$') { $aboutVersion = [string]$package.version }
-        } catch { }
+            $packageText = [IO.File]::ReadAllText($packageItem.FullName, [Text.UTF8Encoding]::new($false,$true))
+            $packageUnique = & $script:CcodInstalledLifecyclePersistenceIoModule { param($Json) Test-CcodJsonHasNoDuplicateProperties -Json $Json } $packageText
+            if (-not $packageUnique) { throw 'package duplicate properties' }
+            $package = $packageText | ConvertFrom-Json -ErrorAction Stop
+            if ($package.version -is [string] -and $package.version -cmatch '^\d+\.\d+\.\d+\z') { $aboutVersion = [string]$package.version }
+        } catch {
+            Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'The installed package metadata could not be read safely.' $packagePath
+        }
+    }
+    if ($null -ne $activeRuntimeId) {
+        if ([string]::IsNullOrWhiteSpace($manifestExpectedVersion) -or $null -eq $activeManifestObject) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'The active runtime version binding could not be proven.' $activeRuntimeId }
+        if (-not [string]::IsNullOrWhiteSpace($ExpectedVersion) -and ($aboutVersion -isnot [string] -or $aboutVersion -cne $ExpectedVersion)) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'The installed package version is detached from the expected candidate.' $ExpectedVersion }
+        [void](Assert-CcodInstalledLifecycleRuntimeManifest -Manifest $activeManifestObject -ExpectedVersion $manifestExpectedVersion -ExpectedRuntimeId $activeRuntimeId -RuntimeRoot (Join-Path (Join-Path $root 'runtime') $activeRuntimeId))
+        $runtimeManifestFiles = @($activeManifestObject.files)
+        if ($null -ne $ExpectedPayloadFiles -and -not (Test-CcodInstalledLifecycleCandidateFileSet -Actual $runtimeManifestFiles -Expected $ExpectedPayloadFiles -InstallRoot $root -RuntimeId $activeRuntimeId -Generation $activeGeneration -ManifestSha256 $runtimeManifestSha256)) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'The active runtime file set is detached from the candidate payload manifest.' $activeRuntimeId }
     }
     $codexHome = [Environment]::GetEnvironmentVariable('CODEX_HOME', 'Process')
     if ([string]::IsNullOrWhiteSpace($codexHome)) { $codexHome = Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::UserProfile)) '.codex' }
     $deviceKey = if ([IO.Path]::IsPathRooted($codexHome)) { Join-Path $codexHome 'remote-control-device-keys.windows.json' } else { $null }
-    $deviceKeyPresent = $null -ne $deviceKey -and [IO.File]::Exists($deviceKey)
-    $deviceKeySha256 = if ($deviceKeyPresent) { Get-CcodInstalledLifecycleHash -Path $deviceKey } else { $null }
+    $deviceKeyItem = if ($null -eq $deviceKey) { $null } else { Get-CcodInstalledLifecycleOptionalRegularFileState -Path $deviceKey -GetItem $pathProbe }
+    $deviceKeyPresent = $null -ne $deviceKeyItem
+    $deviceKeySha256 = if ($deviceKeyPresent) { Get-CcodInstalledLifecycleHash -Path $deviceKeyItem.FullName } else { $null }
+    $includeDebug = -not [string]::IsNullOrWhiteSpace($ExpectedVersion) -or $null -ne $ExpectedDebugPorts
+    $debugPorts = [Collections.Generic.List[int]]::new()
+    if ($includeDebug -and $null -ne $status -and $null -ne $status.session -and $null -ne $status.session.codex) {
+        foreach ($name in @('mainPort','rendererPort')) {
+            $property = $status.session.codex.PSObject.Properties[$name]
+            if ($null -eq $property) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'Debug port facts could not be read safely.' $name }
+            $portValue = $property.Value
+            if (($portValue -isnot [int] -and $portValue -isnot [long]) -or $portValue -lt 1 -or $portValue -gt 65535) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'Debug port facts could not be read safely.' $name }
+            [void]$debugPorts.Add([int]$portValue)
+        }
+    }
+    $requestedDebugPorts = $null
+    if ($null -ne $ExpectedDebugPorts) {
+        if ($ExpectedDebugPorts -isnot [array]) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'Expected debug ports must be an array of integers.' $ExpectedDebugPorts }
+        $requestedDebugPorts = @($ExpectedDebugPorts)
+        $requestedPortValues = [Collections.Generic.List[int]]::new()
+        foreach ($port in $requestedDebugPorts) {
+            if (($port -isnot [int] -and $port -isnot [long]) -or $port -is [bool] -or $port -lt 1 -or $port -gt 65535) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'Expected debug port is invalid.' $port }
+            [void]$requestedPortValues.Add([int]$port)
+        }
+        $requestedDebugPorts = @($requestedPortValues)
+        if ($requestedDebugPorts.Count -gt 0) {
+            $requestedPortKey = (@($requestedDebugPorts | Sort-Object) -join ',')
+            $declaredPortKey = (@($debugPorts | ForEach-Object { [int]$_ } | Sort-Object) -join ',')
+            if ($requestedDebugPorts.Count -ne @($requestedDebugPorts | Sort-Object -Unique).Count -or
+                $debugPorts.Count -ne $requestedDebugPorts.Count -or $declaredPortKey -cne $requestedPortKey) {
+                Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'Expected debug ports are detached from the current runtime declaration.' $ExpectedDebugPorts
+            }
+        }
+    }
+    $debugEndpoints = [Collections.Generic.List[object]]::new()
+    if ($debugPorts.Count -gt 0) {
+        try {
+            foreach ($listener in @(Get-NetTCPConnection -State Listen -ErrorAction Stop)) {
+                if ($null -eq $listener -or $listener.PSObject.Properties['LocalPort'] -eq $null) { throw 'listener port' }
+                $listenerPort = $listener.LocalPort
+                if (($listenerPort -isnot [uint16] -and $listenerPort -isnot [int] -and $listenerPort -isnot [long]) -or
+                    [decimal]$listenerPort -lt 1 -or [decimal]$listenerPort -gt 65535) { throw 'listener port' }
+                if ($debugPorts -notcontains [int]$listenerPort) { continue }
+                if ($listener.PSObject.Properties['LocalAddress'] -eq $null -or $listener.PSObject.Properties['OwningProcess'] -eq $null -or
+                    $listener.LocalAddress -isnot [string] -or $listener.LocalAddress -cne '127.0.0.1') { throw 'listener address' }
+                $listenerOwner = $listener.OwningProcess
+                if (($listenerOwner -isnot [uint32] -and $listenerOwner -isnot [int] -and $listenerOwner -isnot [long]) -or
+                    [decimal]$listenerOwner -lt 1 -or [decimal]$listenerOwner -gt [int]::MaxValue) { throw 'listener scalar' }
+                $owner = @($codex | Where-Object { $_.Pid -eq [int]$listenerOwner })
+                if ($owner.Count -ne 1) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'Debug endpoint owner is not a unique verified Codex process.' $listener.OwningProcess }
+                $debugEndpoints.Add([pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = [int]$listenerPort; owningProcess = [int]$listenerOwner; owningProcessCreationTimeUtc = [string]$owner[0].CreationTimeUtc })
+            }
+        } catch { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'Debug endpoints could not be inspected safely.' $null }
+    }
     $startMenu = Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::Programs)) 'CodexRemote-fix\CodexRemote-fix.lnk'
     $desktop = Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::Desktop)) 'CodexRemote-fix.lnk'
+    $startMenuItem = Get-CcodInstalledLifecycleOptionalRegularFileState -Path $startMenu -GetItem $pathProbe
+    $desktopItem = Get-CcodInstalledLifecycleOptionalRegularFileState -Path $desktop -GetItem $pathProbe
+    $publicDebugPorts = [int[]]@()
+    $publicDebugEndpoints = @()
+    if ($includeDebug) { $publicDebugPorts = [int[]]$debugPorts; $publicDebugEndpoints = @($debugEndpoints) }
+    $installReady = [bool]($installRootPresent -and $appRootPresent -and $runtimeRootPresent -and $activePointerPresent -and
+        $null -ne $activeRuntimeId -and $activeGeneration -gt 0 -and $null -ne $activeManifestObject -and
+        ($null -eq $ExpectedVersion -or $aboutVersion -ceq $ExpectedVersion))
+    $protectionReady = [bool]($installReady -and $taskState -in @('Ready','Running') -and $statusPhase -ceq 'Active' -and
+        $statusRuntimeId -ceq $activeRuntimeId -and $transitionStage -ceq 'Idle' -and $trayAuthenticated -and
+        @($supervisor).Count -eq 1 -and @($trayHost).Count -eq 1 -and @($codex).Count -eq 1 -and $null -ne $statusCodex -and
+        $statusCodex.pid -eq $codex[0].Pid -and $statusCodex.creationTimeUtc -ceq $codex[0].CreationTimeUtc -and
+        $null -ne $lifecycleReceipt -and $lifecycleReceipt.phase -ceq 'Completed' -and $lifecycleReceipt.runtimeId -ceq $activeRuntimeId -and
+        [UInt64]$lifecycleReceipt.runtimeGeneration -eq [UInt64]$activeGeneration)
     return [pscustomobject][ordered]@{
-        appPresent = [IO.Directory]::Exists($appRoot)
+        installRootPresent = [bool]$installRootPresent
+        appPresent = [bool]$appRootPresent
+        runtimeRootPresent = [bool]$runtimeRootPresent
+        activePointerPresent = [bool]$activePointerPresent
+        installReady = $installReady
         activeRuntimeId = $activeRuntimeId
         activeGeneration = if ($null -eq $activeRuntimeId) { $null } else { [UInt64]$activeGeneration }
         runtimeManifestSha256 = $runtimeManifestSha256
+        runtimeManifestFiles = @($runtimeManifestFiles)
         supervisor = @($supervisor)
         trayHost = @($trayHost)
+        trayHostIdentity = $trayHostIdentity
+        trayAuthenticated = $trayAuthenticated
         codex = @($codex)
         taskState = $taskState
         statusPhase = $statusPhase
         statusRuntimeId = $statusRuntimeId
         statusCodex = $statusCodex
         transitionStage = $transitionStage
+        protectionReady = $protectionReady
         lifecycleReceipt = $lifecycleReceipt
         aboutVersion = $aboutVersion
         deviceKeyPresent = [bool]$deviceKeyPresent
         deviceKeySha256 = $deviceKeySha256
-        shortcuts = [pscustomobject][ordered]@{ startMenu = [IO.File]::Exists($startMenu); desktop = [IO.File]::Exists($desktop) }
+        shortcuts = [pscustomobject][ordered]@{ startMenu = $null -ne $startMenuItem; desktop = $null -ne $desktopItem }
+        debugPorts = [int[]]$publicDebugPorts
+        debugEndpoints = @($publicDebugEndpoints)
     }
 }
 
@@ -628,6 +1668,117 @@ function Read-CcodInstalledLifecycleOperatorAck {
     }
 }
 
+function Get-CcodInstalledLifecycleUninstallCommand {
+    param([Parameter(Mandatory)][string]$InstallRoot,[Parameter(Mandatory)][string]$ExpectedVersion,[Parameter(Mandatory)][object[]]$ExpectedPayloadFiles)
+    try {
+        if($ExpectedVersion-cne'2.5.22'){throw 'sealed uninstall version'}
+        $root=Assert-CcodInstalledLifecycleCanonicalAbsolutePath -Path $InstallRoot -Kind 'Uninstall root'
+        $facts=Get-CcodInstalledLifecycleFacts -InstallRoot $root -ExpectedVersion $ExpectedVersion -ExpectedPayloadFiles $ExpectedPayloadFiles
+        if($facts.activeRuntimeId-isnot[string]-or$facts.activeRuntimeId-cnotmatch'^2\.5\.22-[0-9a-f]{16}-[0-9a-f]{32}\z'-or
+            $facts.installReady-isnot[bool]-or-not$facts.installReady-or$facts.protectionReady-isnot[bool]-or-not$facts.protectionReady){throw 'sealed uninstall readiness'}
+        $runtime=Join-Path (Join-Path $root 'runtime') $facts.activeRuntimeId
+        $path=Assert-CcodInstalledLifecycleRegularFile -Path (Join-Path $runtime 'Uninstall-CodexControlOtherDevices.ps1') -Kind 'Sealed uninstaller'
+        $records=@($facts.runtimeManifestFiles|Where-Object {$_.path-ceq'Uninstall-CodexControlOtherDevices.ps1'})
+        if($records.Count-ne1-or(Get-CcodInstalledLifecycleHash $path)-cne$records[0].sha256-or[long](Get-Item -LiteralPath $path -ErrorAction Stop).Length-ne[long]$records[0].length){throw 'sealed uninstaller bytes'}
+        $active=Read-CcodInstalledLifecycleActiveFact -InstallRoot $root
+        if($null-eq$active-or$active.activeRuntime-cne$facts.activeRuntimeId-or[uint64]$active.generation-ne[uint64]$facts.activeGeneration){throw 'uninstall active identity changed'}
+        $spec=[pscustomobject][ordered]@{schemaVersion=1;installRoot=$root;expectedVersion=$ExpectedVersion;runtimeId=$facts.activeRuntimeId;generation=$facts.activeGeneration;manifestSha256=$facts.runtimeManifestSha256;runtimeFiles=@($facts.runtimeManifestFiles);candidatePayloadFiles=@($ExpectedPayloadFiles)}
+        # Copy the original identity as data, not a mutable view of captured facts.
+        return [pscustomobject]@{Spec=($spec|ConvertTo-Json -Depth 8 -Compress|ConvertFrom-Json)}
+    } catch {
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'The direct uninstaller is not bound to the active sealed candidate.' $InstallRoot
+    }
+}
+
+function Invoke-CcodInstalledLifecycleVerifiedUninstall {
+    param([Parameter(Mandatory)]$Spec)
+    $lease=$null
+    try {
+        if (-not(Test-CcodInstalledLifecycleExactProperties $Spec @('schemaVersion','installRoot','expectedVersion','runtimeId','generation','manifestSha256','runtimeFiles','candidatePayloadFiles')) -or
+            $Spec.schemaVersion -isnot [int] -or $Spec.schemaVersion -ne 1 -or $Spec.installRoot -isnot [string] -or
+            $Spec.expectedVersion -isnot [string] -or $Spec.expectedVersion -cne '2.5.22' -or
+            $Spec.runtimeId -isnot [string] -or $Spec.runtimeId -cnotmatch '^2\.5\.22-[0-9a-f]{16}-[0-9a-f]{32}\z' -or
+            -not(Test-CcodInstalledLifecyclePositiveInteger $Spec.generation) -or
+            $Spec.manifestSha256 -isnot [string] -or $Spec.manifestSha256 -cnotmatch '^[0-9a-f]{64}\z' -or
+            $Spec.runtimeFiles -isnot [array] -or $Spec.runtimeFiles.Count -lt 1 -or
+            $Spec.candidatePayloadFiles -isnot [array] -or $Spec.candidatePayloadFiles.Count -lt 1 -or
+            -not(Test-CcodInstalledLifecycleFileRecordSet $Spec.runtimeFiles $Spec.runtimeFiles) -or
+            -not(Test-CcodInstalledLifecycleFileRecordSet $Spec.candidatePayloadFiles $Spec.candidatePayloadFiles)) { throw 'uninstall specification' }
+        $root=Assert-CcodInstalledLifecycleCanonicalAbsolutePath $Spec.installRoot 'Uninstall root'
+        $runtime=Join-Path (Join-Path $root 'runtime') $Spec.runtimeId
+        $manifest=Join-Path $runtime 'manifest.json'
+        $paths=@($manifest)+@($Spec.runtimeFiles|ForEach-Object {Join-Path $runtime $_.path})
+        $lease=Open-CcodInstalledLifecycleExecutionLease -Paths $paths
+        if ($lease.Files[0].Sha256 -cne $Spec.manifestSha256) { throw 'original manifest replaced' }
+        for ($index=0; $index -lt $Spec.runtimeFiles.Count; $index++) {
+            $record=$Spec.runtimeFiles[$index];$held=$lease.Files[$index+1]
+            if ($held.Length -ne $record.length -or $held.Sha256 -cne $record.sha256) { throw 'original runtime replaced' }
+        }
+        $facts=Get-CcodInstalledLifecycleFacts -InstallRoot $root -ExpectedVersion $Spec.expectedVersion -ExpectedPayloadFiles $Spec.candidatePayloadFiles
+        if ($facts.activeRuntimeId -cne $Spec.runtimeId -or $facts.activeGeneration -ne $Spec.generation -or
+            $facts.runtimeManifestSha256 -cne $Spec.manifestSha256 -or $facts.installReady -isnot [bool] -or -not $facts.installReady -or
+            $facts.protectionReady -isnot [bool] -or -not $facts.protectionReady -or
+            -not(Test-CcodInstalledLifecycleFileRecordSet $facts.runtimeManifestFiles $Spec.runtimeFiles)) { throw 'uninstall original state' }
+        $wrapperRecords=@($Spec.runtimeFiles|Where-Object {$_.path -ceq 'Uninstall-CodexControlOtherDevices.ps1'})
+        if ($wrapperRecords.Count -ne 1) { throw 'uninstall wrapper missing' }
+        $active=Read-CcodInstalledLifecycleActiveFact -InstallRoot $root
+        if ($null -eq $active -or $active.activeRuntime -cne $Spec.runtimeId -or $active.generation -ne $Spec.generation) { throw 'active selector changed' }
+        Assert-CcodInstalledLifecycleExecutionLease $lease
+        $values=@(& (Join-Path $runtime 'Uninstall-CodexControlOtherDevices.ps1') -Confirm:$false)
+        if ($values.Count -ne 1 -or -not(Test-CcodInstalledLifecycleExactProperties $values[0] @('Outcome','TransactionId','FinalizerProcessId','KeptDeviceKeyStore')) -or
+            $values[0].Outcome -isnot [string] -or $values[0].Outcome -cne 'InstalledFinalizationStarted' -or
+            $values[0].TransactionId -isnot [string] -or $values[0].TransactionId -cnotmatch '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z' -or
+            $values[0].FinalizerProcessId -isnot [int] -or $values[0].FinalizerProcessId -lt 1 -or
+            $values[0].KeptDeviceKeyStore -isnot [bool] -or -not $values[0].KeptDeviceKeyStore) { throw 'uninstall wrapper completion' }
+        Assert-CcodInstalledLifecycleExecutionLease $lease
+        return $values[0]
+    } catch {
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'The direct uninstaller changed before or during verified consumption.' $null
+    } finally {
+        # This executes in the wrapper process, before its exit releases the
+        # detached finalizer's existing exact-wrapper-exit barrier.
+        Close-CcodInstalledLifecycleExecutionLease $lease
+    }
+}
+
+function Start-CcodInstalledLifecycleVerifiedUninstall {
+    param([Parameter(Mandatory)]$Spec)
+    $sourceLease=$null;$process=$null
+    try {
+        $entry=Join-Path $script:CcodInstalledLifecycleRepositoryRoot 'tests\installed\Invoke-InstalledLifecycleIntegration.ps1'
+        $sourcePaths=@($entry,(Join-Path $script:CcodInstalledLifecycleRepositoryRoot 'tools\ReleaseAssetContract.psm1'))
+        foreach($leaf in @('PersistenceIO.psm1','StateStore.psm1','TrustedLogonIdentity.psm1','LifecycleTransaction.psm1','KernelObjects.psm1','ProductRegistration.psm1')) {
+            $sourcePaths+=Join-Path $script:CcodInstalledLifecycleRepositoryRoot ('src\persistence\modules\'+$leaf)
+        }
+        $sourceLease=Open-CcodInstalledLifecycleExecutionLease -Paths $sourcePaths
+        $inputJson=$Spec|ConvertTo-Json -Depth 8 -Compress
+        if ($inputJson.Length -lt 1 -or $inputJson.Length -gt 1048576) { throw 'uninstall input bounds' }
+        $start=[Diagnostics.ProcessStartInfo]::new()
+        $start.FileName=Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'WindowsPowerShell\v1.0\powershell.exe'
+        $start.Arguments='-NoLogo -NoProfile -NonInteractive -File "'+$entry+'" -VerifiedUninstallChild -AllowMachineMutation -AllowCodexRestart'
+        $start.UseShellExecute=$false;$start.CreateNoWindow=$true
+        $start.RedirectStandardInput=$true;$start.RedirectStandardOutput=$true;$start.RedirectStandardError=$true
+        $start.StandardOutputEncoding=[Text.UTF8Encoding]::new($false)
+        $start.StandardErrorEncoding=[Text.UTF8Encoding]::new($false)
+        [void]$start.EnvironmentVariables.Remove('PSExecutionPolicyPreference')
+        Assert-CcodInstalledLifecycleExecutionLease $sourceLease
+        $process=[Diagnostics.Process]::Start($start)
+        $stdout=$process.StandardOutput.ReadToEndAsync();$stderr=$process.StandardError.ReadToEndAsync()
+        $process.StandardInput.Write($inputJson);$process.StandardInput.Close()
+        if (-not $process.WaitForExit(600000)) { throw 'verified uninstall child timeout' }
+        $output=$stdout.GetAwaiter().GetResult();$errorOutput=$stderr.GetAwaiter().GetResult()
+        if ($process.ExitCode -ne 0 -or $output -cne ('CCOD_UNINSTALL_WRAPPER_COMPLETED'+[Environment]::NewLine) -or $errorOutput.Length -ne 0) { throw 'verified uninstall child result' }
+        Assert-CcodInstalledLifecycleExecutionLease $sourceLease
+        return [pscustomobject]@{ExitCode=0}
+    } catch { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_INSTALLER_FAILED' 'The verified uninstall child did not complete its wrapper handoff.' $null }
+    finally {
+        if ($null -ne $process) {
+            try { if (-not $process.HasExited) { $process.Kill();$process.WaitForExit() } } finally { $process.Dispose() }
+        }
+        Close-CcodInstalledLifecycleExecutionLease $sourceLease
+    }
+}
+
 function Invoke-CcodInstalledLifecycleOperatorScenario {
     param([Parameter(Mandatory)]$Context)
     $launchInstaller = {
@@ -637,6 +1788,10 @@ function Invoke-CcodInstalledLifecycleOperatorScenario {
         }
     }.GetNewClosure()
     switch ($Context.scenario) {
+        'FreshInstall' {
+            & $launchInstaller
+            Read-CcodInstalledLifecycleOperatorAck -Scenario $Context.scenario -Instructions 'Complete the fresh install, choose Later, and wait for the new controlled Codex session and tray to become ready.'
+        }
         'FreshLater' {
             & $launchInstaller
             Read-CcodInstalledLifecycleOperatorAck -Scenario $Context.scenario -Instructions 'Complete the installer and choose Later. Confirm that the pre-existing Codex session was left untouched.'
@@ -654,8 +1809,13 @@ function Invoke-CcodInstalledLifecycleOperatorScenario {
             Read-CcodInstalledLifecycleOperatorAck -Scenario $Context.scenario -Instructions 'Use Windows Settings to uninstall CodexRemote-fix. Wait for the uninstaller to complete successfully.'
         }
         'DirectUninstall' {
-            $uninstaller = Assert-CcodInstalledLifecycleRegularFile -Path (Join-Path $Context.installerApplicationRoot 'unins000.exe') -Kind 'Installed uninstaller'
-            $process = Start-Process -FilePath $uninstaller -PassThru -Wait -ErrorAction Stop
+            if($Context.expectedVersion-ceq'2.5.22'){
+                $command=Get-CcodInstalledLifecycleUninstallCommand -InstallRoot $Context.installRoot -ExpectedVersion $Context.expectedVersion -ExpectedPayloadFiles $Context.candidatePayloadFiles
+                $process=Start-CcodInstalledLifecycleVerifiedUninstall -Spec $command.Spec
+            } else {
+                $uninstaller = Assert-CcodInstalledLifecycleRegularFile -Path (Join-Path $Context.installerApplicationRoot 'unins000.exe') -Kind 'Installed uninstaller'
+                $process = Start-Process -FilePath $uninstaller -PassThru -Wait -ErrorAction Stop
+            }
             if ($process.ExitCode -ne 0) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_INSTALLER_FAILED' 'The installed uninstaller returned a nonzero exit code' $process.ExitCode }
             Read-CcodInstalledLifecycleOperatorAck -Scenario $Context.scenario -Instructions 'Confirm that the direct uninstaller completed and did not remove the device-key store.'
         }
@@ -663,7 +1823,26 @@ function Invoke-CcodInstalledLifecycleOperatorScenario {
             Read-CcodInstalledLifecycleOperatorAck -Scenario $Context.scenario -Instructions 'Perform the named scenario through the visible CodexRemote-fix UI and wait for its observable state to settle.'
         }
     }
-    return [pscustomobject][ordered]@{ code = 'CCOD_INTEGRATION_OPERATOR_COMPLETED' }
+    $runtimeManifestSha256 = $null
+    if ($Context.scenario -in @('FreshInstall','FreshLater','FreshRestart','Upgrade','SlowLaunch','ManualLaunchResume','LanguageStress','RepairStates')) {
+        try {
+            $postOperationFacts = Get-CcodInstalledLifecycleFacts -InstallRoot $Context.installRoot -ExpectedVersion $Context.expectedVersion -ExpectedPayloadFiles $Context.candidatePayloadFiles
+            if ($postOperationFacts.runtimeManifestSha256 -isnot [string] -or $postOperationFacts.runtimeManifestSha256 -cnotmatch '^[0-9a-f]{64}\z') { throw 'runtime manifest attestation' }
+            $runtimeManifestSha256 = [string]$postOperationFacts.runtimeManifestSha256
+        } catch {
+            if ($_.FullyQualifiedErrorId -like 'CCOD_INTEGRATION_*') { throw }
+            Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'The operator completion did not produce a candidate-bound runtime manifest attestation.' $Context.scenario
+        }
+    }
+    return [pscustomobject][ordered]@{
+        code = 'CCOD_INTEGRATION_OPERATOR_COMPLETED'
+        scenario = [string]$Context.scenario
+        transactionId = [string]$Context.transactionId
+        completed = $true
+        operatorAttestation = 'OperatorConfirmed'
+        installerSha256 = [string](Get-CcodInstalledLifecycleHash -Path $Context.installerPath)
+        runtimeManifestSha256 = $runtimeManifestSha256
+    }
 }
 
 function Test-CcodInstalledLifecycleSameIdentitySet {
@@ -673,22 +1852,133 @@ function Test-CcodInstalledLifecycleSameIdentitySet {
     return (($expectedKeys -join ';') -ceq ($actualKeys -join ';'))
 }
 
+function Test-CcodInstalledLifecycleRunResult {
+    param([Parameter(Mandatory)]$Context,[Parameter(Mandatory)]$RunResult)
+    if (-not (Test-CcodInstalledLifecycleExactProperties -Value $RunResult -Expected @('code','scenario','transactionId','completed','operatorAttestation','installerSha256','runtimeManifestSha256'))) { return $false }
+    $parsedTransactionId = [guid]::Empty
+    if ($RunResult.code -isnot [string] -or $RunResult.code -cne 'CCOD_INTEGRATION_OPERATOR_COMPLETED' -or
+        $RunResult.scenario -isnot [string] -or $RunResult.scenario -cne [string]$Context.scenario -or
+        $RunResult.transactionId -isnot [string] -or -not [guid]::TryParse($RunResult.transactionId,[ref]$parsedTransactionId) -or
+        $RunResult.completed -isnot [bool] -or -not $RunResult.completed -or
+        $RunResult.operatorAttestation -isnot [string] -or $RunResult.operatorAttestation -cne 'OperatorConfirmed' -or
+        $RunResult.installerSha256 -isnot [string] -or $RunResult.installerSha256 -cnotmatch '^[0-9a-f]{64}\z' -or
+        $Context.installerSha256 -isnot [string] -or $RunResult.installerSha256 -cne [string]$Context.installerSha256) { return $false }
+    $requiresRuntimeManifest = $Context.scenario -in @('FreshInstall','FreshLater','FreshRestart','Upgrade','SlowLaunch','ManualLaunchResume','LanguageStress','RepairStates')
+    if ($requiresRuntimeManifest) { return $RunResult.runtimeManifestSha256 -is [string] -and $RunResult.runtimeManifestSha256 -cmatch '^[0-9a-f]{64}\z' }
+    return $null -eq $RunResult.runtimeManifestSha256
+}
+
+function Test-CcodInstalledLifecycleDebugPortsClosed {
+    param($Ports)
+    try {
+        if ($Ports -isnot [array]) { throw 'captured ports array' }
+        $captured = [Collections.Generic.HashSet[int]]::new()
+        foreach ($port in $Ports) {
+            if (($port -isnot [int] -and $port -isnot [long]) -or $port -lt 1 -or $port -gt 65535 -or
+                -not $captured.Add([int]$port)) { throw 'captured port' }
+        }
+        if ($captured.Count -eq 0) { return $true }
+        foreach ($listener in @(Get-NetTCPConnection -State Listen -ErrorAction Stop)) {
+            if ($null -eq $listener -or $null -eq $listener.PSObject.Properties['LocalPort']) { throw 'listener port unavailable' }
+            $port = $listener.LocalPort
+            if (($port -isnot [uint16] -and $port -isnot [int] -and $port -isnot [long]) -or
+                $port -lt 1 -or $port -gt 65535) { throw 'listener port shape' }
+            if ($captured.Contains([int]$port)) { return $false }
+        }
+        return $true
+    } catch {
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE' 'Previously declared debug ports could not be inspected safely.' $null
+    }
+}
+
 function Test-CcodInstalledLifecycleScenario {
     param([Parameter(Mandatory)]$Context, [Parameter(Mandatory)]$BeforeFacts, [Parameter(Mandatory)]$RunResult)
-    $afterFacts = ConvertTo-CcodInstalledLifecycleFacts -Facts (Get-CcodInstalledLifecycleFacts -InstallRoot $Context.installRoot)
+    if (-not (Test-CcodInstalledLifecycleRunResult -Context $Context -RunResult $RunResult)) {
+        return [pscustomobject][ordered]@{ verified = $false; code = 'CCOD_INTEGRATION_OBSERVATION_UNPROVEN'; facts = $null }
+    }
+    $expectedDebugPorts = @()
+    if ($Context.PSObject.Properties['expectedDebugPorts'] -and $null -ne $Context.expectedDebugPorts) { $expectedDebugPorts = @($Context.expectedDebugPorts) }
+    elseif ($BeforeFacts.PSObject.Properties['debugPorts'] -and $null -ne $BeforeFacts.debugPorts) { $expectedDebugPorts = @($BeforeFacts.debugPorts) }
+    elseif ($BeforeFacts.PSObject.Properties['debugEndpoints']) { foreach ($endpoint in @($BeforeFacts.debugEndpoints)) { if ($endpoint.PSObject.Properties['localPort'] -and $endpoint.localPort -is [ValueType]) { $expectedDebugPorts += [int]$endpoint.localPort } } }
+    $expectedPayloadFiles = $null
+    if ($Context.PSObject.Properties['candidatePayloadFiles']) { $expectedPayloadFiles = @($Context.candidatePayloadFiles) }
+    $requiresDebugEvidence = $Context.scenario -notin @('SafeExit','SettingsUninstall','DirectUninstall')
+    $afterFacts = if ($requiresDebugEvidence -and $expectedDebugPorts.Count -gt 0) {
+        ConvertTo-CcodInstalledLifecycleFacts -Facts (Get-CcodInstalledLifecycleFacts -InstallRoot $Context.installRoot -ExpectedVersion $Context.expectedVersion -ExpectedDebugPorts $expectedDebugPorts -ExpectedPayloadFiles $expectedPayloadFiles)
+    } else {
+        ConvertTo-CcodInstalledLifecycleFacts -Facts (Get-CcodInstalledLifecycleFacts -InstallRoot $Context.installRoot -ExpectedVersion $Context.expectedVersion -ExpectedPayloadFiles $expectedPayloadFiles)
+    }
+    $payloadEvidenceValid = $true
+    if ($null -ne $expectedPayloadFiles) { $payloadEvidenceValid = Test-CcodInstalledLifecycleCandidateFileSet -Actual $afterFacts.runtimeManifestFiles -Expected $expectedPayloadFiles -InstallRoot $Context.installRoot -RuntimeId $afterFacts.activeRuntimeId -Generation $afterFacts.activeGeneration -ManifestSha256 $afterFacts.runtimeManifestSha256 }
+    if ($Context.scenario -in @('FreshInstall','FreshRestart') -and $expectedDebugPorts.Count -eq 0) { $expectedDebugPorts = @($afterFacts.debugPorts) }
+    $debugEvidenceValid = $true
+    if ($Context.scenario -in @('FreshInstall','FreshLater','FreshRestart','Upgrade')) {
+        $afterPorts = @($afterFacts.debugPorts)
+        $afterEndpoints = @($afterFacts.debugEndpoints)
+        $codexIdentities = @($afterFacts.codex)
+        $expectedPortKey = (@($expectedDebugPorts | ForEach-Object { [int]$_ } | Sort-Object) -join ',')
+        $afterPortKey = (@($afterPorts | ForEach-Object { [int]$_ } | Sort-Object) -join ',')
+        $expectedPortCount = @($expectedDebugPorts | Sort-Object -Unique).Count
+        if ($expectedDebugPorts.Count -ne 2 -or $expectedPortCount -ne 2 -or
+            $afterPorts.Count -ne $expectedDebugPorts.Count -or $afterPortKey -cne $expectedPortKey -or
+            $afterEndpoints.Count -ne $expectedDebugPorts.Count -or $codexIdentities.Count -ne 1) {
+            $debugEvidenceValid = $false
+        } else {
+            $owner = $codexIdentities[0]
+            foreach ($port in $expectedDebugPorts) {
+                $matches = @($afterEndpoints | Where-Object {
+                    $_.localAddress -is [string] -and $_.localAddress -ceq '127.0.0.1' -and
+                    $_.localPort -is [ValueType] -and $_.localPort -isnot [bool] -and [int]($_.localPort) -eq [int]$port -and
+                    $_.owningProcess -is [ValueType] -and $_.owningProcess -isnot [bool] -and [uint64]($_.owningProcess) -eq [uint64]$owner.pid -and
+                    $_.owningProcessCreationTimeUtc -is [string] -and $_.owningProcessCreationTimeUtc -ceq [string]$owner.creationTimeUtc
+                })
+                if ($matches.Count -ne 1) { $debugEvidenceValid = $false }
+            }
+        }
+    }
     $verified = $true
     $code = 'CCOD_INTEGRATION_VERIFIED'
     if ($Context.scenario -in @('SettingsUninstall','DirectUninstall')) {
-        $verified = -not $afterFacts.appPresent -and $afterFacts.taskState -ceq 'Absent'
+        $portsClosed = Test-CcodInstalledLifecycleDebugPortsClosed -Ports $BeforeFacts.debugPorts
+        $verified = $portsClosed -and -not $afterFacts.installRootPresent -and -not $afterFacts.appPresent -and -not $afterFacts.runtimeRootPresent -and -not $afterFacts.activePointerPresent -and
+            $afterFacts.taskState -ceq 'Absent' -and $afterFacts.statusCodex -eq $null -and $afterFacts.statusRuntimeId -eq $null -and
+            $afterFacts.statusPhase -in @('Unavailable','Stopped','Closed') -and $afterFacts.transitionStage -in @('Unavailable','Idle','Completed','Failed','Cancelled') -and
+            $afterFacts.supervisor.Count -eq 0 -and $afterFacts.trayHost.Count -eq 0 -and $afterFacts.codex.Count -eq 0 -and
+            $afterFacts.shortcuts.startMenu -eq $false -and $afterFacts.shortcuts.desktop -eq $false -and $afterFacts.debugEndpoints.Count -eq 0 -and $null -eq $afterFacts.lifecycleReceipt
         if ($BeforeFacts.deviceKeyPresent) { $verified = $verified -and $afterFacts.deviceKeyPresent -and $afterFacts.deviceKeySha256 -ceq $BeforeFacts.deviceKeySha256 }
+        else { $verified = $verified -and -not $afterFacts.deviceKeyPresent -and $null -eq $afterFacts.deviceKeySha256 }
     } elseif ($Context.scenario -eq 'SafeExit') {
         $verified = $afterFacts.appPresent -and $afterFacts.supervisor.Count -eq 0 -and $afterFacts.trayHost.Count -eq 0
     } else {
-        $verified = $afterFacts.appPresent -and $afterFacts.aboutVersion -ceq $Context.expectedVersion -and $null -ne $afterFacts.activeRuntimeId -and $afterFacts.taskState -in @('Ready','Running')
+        $verified = $afterFacts.installRootPresent -and $afterFacts.appPresent -and $afterFacts.aboutVersion -ceq $Context.expectedVersion -and $null -ne $afterFacts.activeRuntimeId -and $afterFacts.taskState -in @('Ready','Running') -and $debugEvidenceValid -and $payloadEvidenceValid -and
+            $afterFacts.installReady -is [bool] -and $afterFacts.installReady -and $afterFacts.protectionReady -is [bool] -and $afterFacts.protectionReady -and
+            $afterFacts.trayAuthenticated -is [bool] -and $afterFacts.trayAuthenticated -and $null -ne $afterFacts.trayHostIdentity -and
+            $RunResult.runtimeManifestSha256 -ceq [string]$afterFacts.runtimeManifestSha256
+        if ($Context.scenario -in @('FreshInstall','FreshLater','Upgrade')) {
+            $verified = $verified -and $afterFacts.supervisor.Count -eq 1 -and $afterFacts.trayHost.Count -eq 1 -and $afterFacts.codex.Count -eq 1 -and
+                $afterFacts.statusPhase -ceq 'Active' -and $afterFacts.statusRuntimeId -ceq $afterFacts.activeRuntimeId -and $null -ne $afterFacts.statusCodex -and
+                $afterFacts.statusCodex.pid -eq $afterFacts.codex[0].Pid -and $afterFacts.statusCodex.creationTimeUtc -ceq $afterFacts.codex[0].CreationTimeUtc -and
+                $afterFacts.transitionStage -ceq 'Idle' -and $null -ne $afterFacts.lifecycleReceipt -and
+                $afterFacts.lifecycleReceipt.kind -ceq 'RestartAndRepair' -and $afterFacts.lifecycleReceipt.origin -ceq 'Installer' -and
+                $afterFacts.lifecycleReceipt.runtimeId -ceq $afterFacts.activeRuntimeId -and
+                [UInt64]$afterFacts.lifecycleReceipt.runtimeGeneration -eq [UInt64]$afterFacts.activeGeneration -and
+                $afterFacts.lifecycleReceipt.phase -ceq 'Completed'
+        }
         if ($BeforeFacts.deviceKeyPresent) { $verified = $verified -and $afterFacts.deviceKeyPresent -and $afterFacts.deviceKeySha256 -ceq $BeforeFacts.deviceKeySha256 }
-        if ($Context.scenario -eq 'FreshLater' -and $BeforeFacts.codex.Count -gt 0) {
+        if ($Context.scenario -eq 'FreshLater' -and $BeforeFacts.codex.Count -eq 1) {
             $verified = $verified -and (Test-CcodInstalledLifecycleSameIdentitySet -Expected $BeforeFacts.codex -Actual $afterFacts.codex)
         }
+        if ($Context.scenario -eq 'FreshLater' -and $BeforeFacts.codex.Count -ne 1) { $verified = $false }
+        if ($Context.scenario -eq 'FreshInstall') {
+            $verified = $verified -and $BeforeFacts.codex.Count -eq 0 -and
+                -not $BeforeFacts.installRootPresent -and -not $BeforeFacts.appPresent -and -not $BeforeFacts.runtimeRootPresent -and
+                -not $BeforeFacts.activePointerPresent -and $BeforeFacts.taskState -ceq 'Absent' -and
+                $BeforeFacts.supervisor.Count -eq 0 -and $BeforeFacts.trayHost.Count -eq 0 -and
+                $BeforeFacts.statusPhase -in @('Unavailable','Stopped','Closed') -and $null -eq $BeforeFacts.statusRuntimeId -and
+                $null -eq $BeforeFacts.statusCodex -and $BeforeFacts.transitionStage -in @('Unavailable','Idle') -and
+                $null -eq $BeforeFacts.lifecycleReceipt -and -not $BeforeFacts.shortcuts.startMenu -and -not $BeforeFacts.shortcuts.desktop -and
+                $BeforeFacts.debugPorts.Count -eq 0 -and $BeforeFacts.debugEndpoints.Count -eq 0
+        }
         if ($Context.scenario -eq 'FreshRestart') {
             $rootIdentityReplaced = $true
             if ($BeforeFacts.codex.Count -gt 0) {
@@ -720,7 +2010,23 @@ function Test-CcodInstalledLifecycleScenario {
 function Invoke-CcodInstalledLifecycleRollback {
     param([Parameter(Mandatory)]$Context, [Parameter(Mandatory)]$Snapshot)
     if (-not [string]::IsNullOrWhiteSpace([string]$Context.previousInstallerPath)) {
-        $process = Start-Process -FilePath $Context.previousInstallerPath -PassThru -Wait -ErrorAction Stop
+        try {
+            $expectedVersion = if ($Context.PSObject.Properties['previousExpectedVersion']) { [string]$Context.previousExpectedVersion } else { $null }
+            $expectedInstallerHash = if ($Context.PSObject.Properties['previousInstallerSha256']) { [string]$Context.previousInstallerSha256 } else { $null }
+            $expectedManifestHash = if ($Context.PSObject.Properties['previousManifestSha256']) { [string]$Context.previousManifestSha256 } else { $null }
+            $installer = Assert-CcodInstalledLifecycleRegularFile -Path ([string]$Context.previousInstallerPath) -Kind 'Frozen previous installer'
+            $installerName = [IO.Path]::GetFileName($installer)
+            $versionMatch = [regex]::Match($installerName, '^CodexRemote-fix-(?<version>\d+\.\d+\.\d+)-setup\.exe\z')
+            if (-not $versionMatch.Success -or $versionMatch.Groups['version'].Value -cne $expectedVersion -or
+                $expectedInstallerHash -notmatch '^[0-9a-f]{64}\z' -or (Get-CcodInstalledLifecycleHash -Path $installer) -cne $expectedInstallerHash) { throw 'rollback installer identity' }
+            $manifestName = 'CodexRemote-fix-{0}-setup-release-manifest.json' -f $expectedVersion
+            $manifest = Assert-CcodInstalledLifecycleRegularFile -Path (Join-Path (Split-Path -Parent $installer) $manifestName) -Kind 'Frozen previous installer release manifest'
+            if ($expectedManifestHash -notmatch '^[0-9a-f]{64}\z' -or (Get-CcodInstalledLifecycleHash -Path $manifest) -cne $expectedManifestHash) { throw 'rollback manifest identity' }
+        } catch {
+            if ($_.FullyQualifiedErrorId -like 'CCOD_INTEGRATION_ROLLBACK_FAILED*') { throw }
+            Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_ROLLBACK_FAILED' 'The frozen prior installer identity could not be revalidated before rollback.' $Context.previousInstallerPath
+        }
+        $process = Start-Process -FilePath $installer -PassThru -Wait -ErrorAction Stop
         if ($process.ExitCode -ne 0) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_ROLLBACK_FAILED' 'The prior installer did not complete during rollback' $process.ExitCode }
         Read-CcodInstalledLifecycleOperatorAck -Scenario 'ROLLBACK' -Instructions 'Verify that the prior installer restored the pre-test application state.'
         return [pscustomobject][ordered]@{ restored = $true; code = 'CCOD_INTEGRATION_ROLLBACK_COMPLETED' }
@@ -728,27 +2034,58 @@ function Invoke-CcodInstalledLifecycleRollback {
     Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_ROLLBACK_UNAVAILABLE' 'No prior installer was supplied for an observable rollback path' $Context.scenario
 }
 
+function Remove-CcodInstalledLifecycleFrozenRoot {
+    param([Parameter(Mandatory)][string]$Path)
+    try {
+        $root = Assert-CcodInstalledLifecycleCanonicalAbsolutePath -Path $Path -Kind 'Frozen rollback root'
+        $rootItem = Get-Item -LiteralPath $root -Force -ErrorAction Stop
+        if ($rootItem -isnot [IO.DirectoryInfo] -or ($rootItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'frozen root identity' }
+        Assert-CcodInstalledLifecycleNoReparseAncestors -Path $root -GetItem { param($CandidatePath) Get-Item -LiteralPath $CandidatePath -Force -ErrorAction Stop }
+        $pendingDirectories = [Collections.Generic.Stack[string]]::new()
+        $pendingDirectories.Push($root)
+        while ($pendingDirectories.Count -gt 0) {
+            $current = $pendingDirectories.Pop()
+            foreach ($child in @(Get-ChildItem -LiteralPath $current -Force -ErrorAction Stop)) {
+                if (($child.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'frozen descendant reparse' }
+                if ($child -is [IO.DirectoryInfo]) { $pendingDirectories.Push($child.FullName) }
+                elseif ($child -isnot [IO.FileInfo]) { throw 'frozen descendant identity' }
+            }
+        }
+        Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction Stop
+        if (Test-Path -LiteralPath $root) { throw 'frozen root residue' }
+        return $true
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_INTEGRATION_ROLLBACK_CLEANUP_FAILED*') { throw }
+        Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_ROLLBACK_CLEANUP_FAILED' 'The frozen rollback root or one of its descendants was unsafe to remove.' $Path
+    }
+}
+
 function Invoke-CcodInstalledLifecycleIntegration {
     [CmdletBinding()]
     param(
         [Parameter(Mandatory)][string]$InstallerPath,
         [string]$PreviousInstallerPath,
-        [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion,
+        [string]$PreviousExpectedVersion,
+        [string]$PreviousInstallerSha256,
+        [string]$PreviousManifestSha256,
+        [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+\z')][string]$ExpectedVersion,
         [Parameter(Mandatory)][string]$EvidenceRoot,
         [switch]$AllowMachineMutation,
         [switch]$AllowCodexRestart,
-        [Parameter(Mandatory)][ValidateSet('FreshLater','FreshRestart','Upgrade','SlowLaunch','ManualLaunchResume','LanguageStress','RepairStates','SafeExit','SettingsUninstall','DirectUninstall')][string]$Scenario,
+        [Parameter(Mandatory)][ValidateSet('FreshInstall','FreshLater','FreshRestart','Upgrade','SlowLaunch','ManualLaunchResume','LanguageStress','RepairStates','SafeExit','SettingsUninstall','DirectUninstall')][string]$Scenario,
+        $ExpectedCandidate,
         [hashtable]$Adapters
     )
     if (-not $AllowMachineMutation) {
         Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_MUTATION_NOT_ALLOWED' 'Live installed lifecycle scenarios require -AllowMachineMutation before any candidate, checkout, or machine operation.' $Scenario
     }
-    if ($script:CcodInstalledLifecycleRestartScenarios -ccontains $Scenario -and -not $AllowCodexRestart) {
+    if ($script:CcodInstalledLifecycleRestartScenarios -icontains $Scenario -and -not $AllowCodexRestart) {
         Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_CODEX_RESTART_NOT_ALLOWED' 'This scenario can stop or restart Codex and requires -AllowCodexRestart before any operation.' $Scenario
     }
     $adapters = Resolve-CcodInstalledLifecycleAdapters -Adapters $Adapters
-    $startedAt = & $adapters.GetUtcNow
-    if ($startedAt -isnot [datetime]) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_CLOCK_INVALID' 'The integration clock did not return a DateTime value' $startedAt }
+    $startedAtValues = @(& $adapters.GetUtcNow)
+    if ($startedAtValues.Count -ne 1 -or -not (Test-CcodInstalledLifecycleValidUtcClock -Value $startedAtValues[0])) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_CLOCK_INVALID' 'The integration clock did not return one valid UTC DateTime value' $startedAtValues }
+    $startedAt = $startedAtValues[0]
     $transactionId = [guid]::NewGuid().ToString('D')
     $phases = [Collections.Generic.List[object]]::new()
     $evidenceDirectory = $null
@@ -757,15 +2094,44 @@ function Invoke-CcodInstalledLifecycleIntegration {
     $failureCode = $null
     $rollback = [pscustomobject][ordered]@{ attempted = $false; completed = $false; code = $null }
     $candidate = $null
+    $candidateExecutionLease = $null
+    $previousExecutionLease = $null
     $previousCandidate = $null
+    $frozenPreviousRoot = $null
+    $frozenPreviousInstallerPath = $null
+    $frozenPreviousManifestPath = $null
     $beforeFacts = $null
     $verification = $null
     try {
-        $candidate = Get-CcodInstalledLifecycleCandidate -Path $InstallerPath -ExpectedVersion $ExpectedVersion -Adapters $adapters -Kind 'Installer'
+        $candidate = Get-CcodInstalledLifecycleCandidate -Path $InstallerPath -ExpectedVersion $ExpectedVersion -Adapters $adapters -Kind 'Installer' -ExecutionLease ([ref]$candidateExecutionLease)
+        if ($PSBoundParameters.ContainsKey('ExpectedCandidate')) { Assert-CcodInstalledLifecycleExpectedCandidate -Candidate $candidate -Expected $ExpectedCandidate }
         if ($Scenario -ceq 'Upgrade') {
             if ([string]::IsNullOrWhiteSpace($PreviousInstallerPath)) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_PREVIOUS_INSTALLER_REQUIRED' 'Upgrade scenarios require a checksum-bound previous installer for rollback.' $Scenario }
-            $previousCandidate = Get-CcodInstalledLifecycleCandidate -Path $PreviousInstallerPath -Adapters $adapters -Kind 'Previous installer' -AllowAnyVersion
-            if ([version]$previousCandidate.Version -ge [version]$ExpectedVersion) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_PREVIOUS_INSTALLER_INVALID' 'Upgrade rollback installer must be a checksum-bound prior version.' $previousCandidate.Path }
+            if ([string]::IsNullOrWhiteSpace($PreviousExpectedVersion) -or [string]::IsNullOrWhiteSpace($PreviousInstallerSha256) -or [string]::IsNullOrWhiteSpace($PreviousManifestSha256)) {
+                Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_PREVIOUS_INSTALLER_REQUIRED' 'Upgrade scenarios require the exact validated previous version and manifest-bound installer hashes.' $Scenario
+            }
+            try {
+                $previousCandidate = Get-CcodInstalledLifecycleCandidate -Path $PreviousInstallerPath -ExpectedVersion $PreviousExpectedVersion -Adapters $adapters -Kind 'Previous installer'
+                if ([version]$previousCandidate.Version -ge [version]$ExpectedVersion -or $previousCandidate.Version -cne $PreviousExpectedVersion -or $previousCandidate.Sha256 -cne $PreviousInstallerSha256) { throw 'previous installer identity' }
+                $previousManifestName = 'CodexRemote-fix-{0}-setup-release-manifest.json' -f $previousCandidate.Version
+                $previousManifestPath = Assert-CcodInstalledLifecycleRegularFile -Path (Join-Path (Split-Path -Parent $previousCandidate.Path) $previousManifestName) -Kind 'Previous installer release manifest'
+                $previousManifestActualHash = [string](& $adapters.GetFileSha256 $previousManifestPath)
+                if ($previousManifestActualHash -cnotmatch '^[0-9a-f]{64}\z' -or $previousManifestActualHash -cne $PreviousManifestSha256) { throw 'previous manifest identity' }
+                $temporaryRoot = [IO.Path]::GetFullPath([IO.Path]::GetTempPath())
+                [void](Assert-CcodInstalledLifecycleSafeDirectory -Path $temporaryRoot -Kind 'System temporary root')
+                $frozenPreviousRoot = [IO.Path]::GetFullPath((Join-Path $temporaryRoot ('ccod-frozen-previous-' + [guid]::NewGuid().ToString('N'))))
+                [void](Assert-CcodInstalledLifecycleSafeDirectory -Path $frozenPreviousRoot -Kind 'Frozen previous root')
+                $frozenPreviousInstallerPath = Join-Path $frozenPreviousRoot ([IO.Path]::GetFileName($previousCandidate.Path))
+                $frozenPreviousManifestPath = Join-Path $frozenPreviousRoot $previousManifestName
+                [IO.File]::Copy($previousCandidate.Path, $frozenPreviousInstallerPath, $false)
+                [IO.File]::Copy($previousManifestPath, $frozenPreviousManifestPath, $false)
+                [void](Assert-CcodInstalledLifecycleRegularFile -Path $frozenPreviousInstallerPath -Kind 'Frozen previous installer')
+                [void](Assert-CcodInstalledLifecycleRegularFile -Path $frozenPreviousManifestPath -Kind 'Frozen previous installer release manifest')
+                $previousExecutionLease = Open-CcodInstalledLifecycleExecutionLease -Paths @($frozenPreviousInstallerPath,$frozenPreviousManifestPath)
+                if ((Get-CcodInstalledLifecycleHash -Path $frozenPreviousInstallerPath) -cne $PreviousInstallerSha256 -or (Get-CcodInstalledLifecycleHash -Path $frozenPreviousManifestPath) -cne $PreviousManifestSha256) { throw 'frozen previous identity' }
+            } catch {
+                Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_PREVIOUS_INSTALLER_INVALID' 'Upgrade rollback installer and manifest are not the exact validated prior identity.' $PreviousInstallerPath
+            }
         } elseif (-not [string]::IsNullOrWhiteSpace($PreviousInstallerPath)) {
             Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_PREVIOUS_INSTALLER_UNEXPECTED' 'A previous installer is allowed only for the Upgrade scenario.' $Scenario
         }
@@ -780,21 +2146,33 @@ function Invoke-CcodInstalledLifecycleIntegration {
             transactionId = $transactionId
             scenario = $Scenario
             installerPath = $candidate.Path
-            previousInstallerPath = if ($null -eq $previousCandidate) { $null } else { $previousCandidate.Path }
+            previousInstallerPath = if ($null -eq $previousCandidate) { $null } else { $frozenPreviousInstallerPath }
+            previousExpectedVersion = if ($null -eq $previousCandidate) { $null } else { $PreviousExpectedVersion }
+            previousInstallerSha256 = if ($null -eq $previousCandidate) { $null } else { $PreviousInstallerSha256 }
+            previousManifestSha256 = if ($null -eq $previousCandidate) { $null } else { $PreviousManifestSha256 }
+            previousManifestPath = if ($null -eq $previousCandidate) { $null } else { $frozenPreviousManifestPath }
             expectedVersion = $ExpectedVersion
             installRoot = [IO.Path]::GetFullPath($installRoot)
             installerApplicationRoot = [IO.Path]::GetFullPath($installerApplicationRoot)
+            installerSha256 = [string]$candidate.Sha256
+            candidatePayloadManifestSha256 = [string]$candidate.PayloadManifestSha256
+            candidatePayloadFiles = @($candidate.PayloadFiles)
         }
-        $beforeFacts = ConvertTo-CcodInstalledLifecycleFacts -Facts (& $adapters.CaptureFacts $context.installRoot)
+        $beforeObservationVersion = if ($Scenario -ceq 'Upgrade') { $PreviousExpectedVersion } else { $ExpectedVersion }
+        $beforeFactsRaw = & $adapters.CaptureFacts $context.installRoot $beforeObservationVersion
+        $context | Add-Member -NotePropertyName expectedDebugPorts -NotePropertyValue @($beforeFactsRaw.debugPorts)
+        $beforeFacts = ConvertTo-CcodInstalledLifecycleFacts -Facts $beforeFactsRaw
         $snapshot = & $adapters.CreateRollbackSnapshot $context $beforeFacts
         if ($null -eq $snapshot) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_SNAPSHOT_FAILED' 'Rollback snapshot adapter returned no snapshot.' $null }
         $phases.Add((New-CcodInstalledLifecyclePhase -Name 'CaptureRollback' -Outcome 'Completed'))
         try {
+            Assert-CcodInstalledLifecycleExecutionLease $candidateExecutionLease
             $runResult = & $adapters.RunScenario $context
+            Assert-CcodInstalledLifecycleExecutionLease $candidateExecutionLease
         } catch {
             Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_SCENARIO_FAILED' 'The live scenario failed before verification.' (Get-CcodInstalledLifecycleErrorId $_)
         }
-        if ($null -eq $runResult) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_SCENARIO_FAILED' 'The live scenario returned no result.' $null }
+        if ($null -eq $runResult -or -not (Test-CcodInstalledLifecycleRunResult -Context $context -RunResult $runResult)) { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_SCENARIO_FAILED' 'The live scenario did not return a complete candidate-bound attestation.' $runResult }
         $phases.Add((New-CcodInstalledLifecyclePhase -Name 'RunScenario' -Outcome 'Completed'))
         try {
             $verification = & $adapters.VerifyScenario $context $beforeFacts $runResult
@@ -804,10 +2182,18 @@ function Invoke-CcodInstalledLifecycleIntegration {
         if ($null -eq $verification -or $verification.verified -isnot [bool] -or -not [bool]$verification.verified -or $verification.code -isnot [string]) {
             Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_VERIFICATION_FAILED' 'The live scenario did not produce a proven verification result.' $verification
         }
+        $verificationFacts = ConvertTo-CcodInstalledLifecycleFacts -Facts $verification.facts
+        $installedProofScenario = $Scenario -in @('FreshInstall','FreshLater','FreshRestart','Upgrade','SlowLaunch','ManualLaunchResume','LanguageStress','RepairStates')
+        if ($installedProofScenario -and
+            (-not $verificationFacts.installReady -or -not $verificationFacts.protectionReady -or -not $verificationFacts.trayAuthenticated -or $null -eq $verificationFacts.trayHostIdentity -or
+             -not (Test-CcodInstalledLifecycleCandidateFileSet -Actual $verificationFacts.runtimeManifestFiles -Expected $context.candidatePayloadFiles -InstallRoot $context.installRoot -RuntimeId $verificationFacts.activeRuntimeId -Generation $verificationFacts.activeGeneration -ManifestSha256 $verificationFacts.runtimeManifestSha256) -or
+             $runResult.runtimeManifestSha256 -cne [string]$verificationFacts.runtimeManifestSha256)) {
+            Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_VERIFICATION_FAILED' 'The returned verification facts are not bound to the candidate and authenticated Ready proof.' $verificationFacts
+        }
         $verification = [pscustomobject][ordered]@{
             verified = $true
             code = [string]$verification.code
-            facts = ConvertTo-CcodInstalledLifecycleFacts -Facts $verification.facts
+            facts = $verificationFacts
         }
         $phases.Add((New-CcodInstalledLifecyclePhase -Name 'VerifyScenario' -Outcome 'Completed'))
     } catch {
@@ -817,7 +2203,9 @@ function Invoke-CcodInstalledLifecycleIntegration {
         if ($null -ne $snapshot) {
             $rollback.attempted = $true
             try {
+                if ($null -ne $previousExecutionLease) { Assert-CcodInstalledLifecycleExecutionLease $previousExecutionLease }
                 $rollbackResult = & $adapters.Rollback $context $snapshot
+                if ($null -ne $previousExecutionLease) { Assert-CcodInstalledLifecycleExecutionLease $previousExecutionLease }
                 if ($null -eq $rollbackResult -or $rollbackResult.restored -isnot [bool] -or -not [bool]$rollbackResult.restored -or $rollbackResult.code -isnot [string]) {
                     Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_ROLLBACK_FAILED' 'Rollback did not return a proven completion result.' $rollbackResult
                 }
@@ -831,6 +2219,8 @@ function Invoke-CcodInstalledLifecycleIntegration {
         }
         $phases.Add((New-CcodInstalledLifecyclePhase -Name 'Failed' -Outcome $failureCode))
     } finally {
+        Close-CcodInstalledLifecycleExecutionLease $candidateExecutionLease
+        Close-CcodInstalledLifecycleExecutionLease $previousExecutionLease
         if ($null -ne $snapshot) {
             try {
                 $cleaned = & $adapters.CleanupRollback $context $snapshot
@@ -845,9 +2235,22 @@ function Invoke-CcodInstalledLifecycleIntegration {
                 $rollback.code = 'CCOD_INTEGRATION_ROLLBACK_CLEANUP_FAILED'
             }
         }
+        if ($null -ne $frozenPreviousRoot) {
+            try {
+                [void](Remove-CcodInstalledLifecycleFrozenRoot -Path $frozenPreviousRoot)
+            } catch {
+                if ($null -eq $failure) { $failureCode = 'CCOD_INTEGRATION_ROLLBACK_CLEANUP_FAILED' }
+                $rollback.completed = $false
+                $rollback.code = 'CCOD_INTEGRATION_ROLLBACK_CLEANUP_FAILED'
+            }
+        }
         if ($null -ne $evidenceDirectory) {
-            $completedAt = & $adapters.GetUtcNow
-            if ($completedAt -isnot [datetime]) { $completedAt = [datetime]::UtcNow }
+            $completedAtValues = @()
+            try { $completedAtValues = @(& $adapters.GetUtcNow) } catch { $completedAtValues = @() }
+            if ($completedAtValues.Count -ne 1 -or -not (Test-CcodInstalledLifecycleValidUtcClock -Value $completedAtValues[0])) {
+                if ($null -eq $failure) { $failureCode = 'CCOD_INTEGRATION_CLOCK_INVALID' }
+                $completedAt = $startedAt
+            } else { $completedAt = $completedAtValues[0] }
             $receipt = [pscustomobject][ordered]@{
                 schemaVersion = 1
                 transactionId = $transactionId
@@ -877,9 +2280,29 @@ function Invoke-CcodInstalledLifecycleIntegration {
     return $receipt
 }
 
-if (-not $Library) {
+if ($VerifiedUninstallChild) {
+    try {
+        if (-not $AllowMachineMutation -or -not $AllowCodexRestart) {
+            Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_MUTATION_NOT_ALLOWED' 'The uninstall child requires both explicit mutation and restart authorization.' $null
+        }
+        [Console]::OutputEncoding=[Text.UTF8Encoding]::new($false)
+        $text=[Text.StringBuilder]::new();$buffer=[char[]]::new(4096)
+        while (($length=[Console]::In.Read($buffer,0,$buffer.Length)) -gt 0) {
+            if ($text.Length+$length -gt 1048576) { throw 'uninstall input bounds' }
+            [void]$text.Append($buffer,0,$length)
+        }
+        $json=$text.ToString()
+        if (-not (& $script:CcodInstalledLifecyclePersistenceIoModule {param($Json) Test-CcodJsonHasNoDuplicateProperties -Json $Json} $json)) { throw 'duplicate uninstall input' }
+        $spec=$json|ConvertFrom-Json -ErrorAction Stop
+        $expectedRoot=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)) 'CodexControlOtherDevices'))
+        if ($spec.installRoot -isnot [string] -or $spec.installRoot -cne $expectedRoot) { throw 'uninstall current-user root' }
+        Invoke-CcodInstalledLifecycleVerifiedUninstall -Spec $spec|Out-Null
+        [Console]::Out.WriteLine('CCOD_UNINSTALL_WRAPPER_COMPLETED')
+        exit 0
+    } catch { [Console]::Error.WriteLine('CCOD_INTEGRATION_UNINSTALL_CHILD_FAILED');exit 1 }
+} elseif (-not $Library) {
     try {
-        $receipt = Invoke-CcodInstalledLifecycleIntegration -InstallerPath $InstallerPath -PreviousInstallerPath $PreviousInstallerPath -ExpectedVersion $ExpectedVersion -EvidenceRoot $EvidenceRoot -AllowMachineMutation:$AllowMachineMutation -AllowCodexRestart:$AllowCodexRestart -Scenario $Scenario
+        $receipt = Invoke-CcodInstalledLifecycleIntegration -InstallerPath $InstallerPath -PreviousInstallerPath $PreviousInstallerPath -PreviousExpectedVersion $PreviousExpectedVersion -PreviousInstallerSha256 $PreviousInstallerSha256 -PreviousManifestSha256 $PreviousManifestSha256 -ExpectedVersion $ExpectedVersion -EvidenceRoot $EvidenceRoot -AllowMachineMutation:$AllowMachineMutation -AllowCodexRestart:$AllowCodexRestart -Scenario $Scenario
         $receipt | ConvertTo-Json -Depth 16
     } catch {
         Write-Error $_
diff --git a/tests/installed/Invoke-OfficialDraftAcceptance.ps1 b/tests/installed/Invoke-OfficialDraftAcceptance.ps1
new file mode 100644
index 0000000..1df85a1
--- /dev/null
+++ b/tests/installed/Invoke-OfficialDraftAcceptance.ps1
@@ -0,0 +1,227 @@
+[CmdletBinding()]
+param(
+    [string]$Phase,
+    [string]$AssetDirectory,
+    [string]$PreviousAssetDirectory,
+    [string]$EvidenceRoot,
+    [string]$DraftId,
+    [switch]$AllowMachineMutation,
+    [switch]$AllowCodexRestart,
+    [switch]$AllowWindowsReboot,
+    [string]$TrayOperation,
+    [string]$RemoteOperation,
+    [string]$ScreenshotPath,
+    [string]$RedactedLogPath,
+    [string]$ReviewState
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+# BEGIN CCOD TRUSTED IMPORT BOOTSTRAP
+# Embedded in each independently trusted entrypoint; an unheld helper import
+# cannot bootstrap its own protection. Keep copies identical (self-test enforced).
+function Initialize-CcodTrustedImportLease {
+    if ($null -ne ('CcodTrustedImportLeaseV1' -as [type])) { return }
+    Add-Type -ErrorAction Stop -TypeDefinition @'
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+
+public sealed class CcodTrustedImportLeaseV1 : IDisposable
+{
+    [StructLayout(LayoutKind.Sequential)] private struct NativeTime { public uint Low, High; }
+    [StructLayout(LayoutKind.Sequential)] private struct NativeInfo
+    {
+        public uint Attributes;
+        public NativeTime Creation, Access, Write;
+        public uint Volume, SizeHigh, SizeLow, Links, IndexHigh, IndexLow;
+    }
+    private sealed class Entry
+    {
+        public SafeFileHandle Handle;
+        public string Path;
+        public bool Directory;
+        public uint Volume;
+        public ulong FileId;
+    }
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern SafeFileHandle CreateFileW(string path, uint access, uint share, IntPtr security, uint creation, uint flags, IntPtr template);
+    [DllImport("kernel32.dll", SetLastError=true)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle handle, out NativeInfo info);
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern uint GetFinalPathNameByHandleW(SafeFileHandle handle, StringBuilder value, uint length, uint flags);
+
+    private readonly List<Entry> entries = new List<Entry>();
+    private bool disposed;
+    public string Path { get; private set; }
+    private CcodTrustedImportLeaseV1(string path) { Path = path; }
+
+    public static CcodTrustedImportLeaseV1 Acquire(string path)
+    {
+        if (String.IsNullOrWhiteSpace(path) || !System.IO.Path.IsPathRooted(path) ||
+            path.StartsWith(@"\\?\", StringComparison.Ordinal) || path.StartsWith(@"\\.\", StringComparison.Ordinal))
+            throw new ArgumentException("Unsupported module path");
+        string full = System.IO.Path.GetFullPath(path);
+        string root = System.IO.Path.GetPathRoot(full);
+        string extension = System.IO.Path.GetExtension(full);
+        if (!String.Equals(full, path, StringComparison.OrdinalIgnoreCase) || String.IsNullOrEmpty(root) ||
+            full.Substring(root.Length).IndexOf(':') >= 0 ||
+            (!String.Equals(extension, ".psm1", StringComparison.OrdinalIgnoreCase) && !String.Equals(extension, ".ps1", StringComparison.OrdinalIgnoreCase)))
+            throw new ArgumentException("Noncanonical module path");
+        var lease = new CcodTrustedImportLeaseV1(full);
+        try
+        {
+            var parents = new List<string>();
+            for (DirectoryInfo parent = Directory.GetParent(full); parent != null; parent = parent.Parent)
+                parents.Add(parent.FullName);
+            parents.Reverse();
+            if (parents.Count == 0 || !SamePath(parents[0], root)) throw new IOException("Missing module root");
+            // Retain root-to-leaf authority before traversing the next component.
+            foreach (string parent in parents) lease.Open(parent, true);
+            lease.Open(full, false);
+            lease.Revalidate();
+            return lease;
+        }
+        catch { lease.Dispose(); throw; }
+    }
+
+    private void Open(string path, bool directory)
+    {
+        uint access = directory ? 0x00100081U : 0x80100080U;
+        uint flags = 0x00200000U | (directory ? 0x02000000U : 0U);
+        // FILE_SHARE_READ only: preexisting writers/deleters must fail closed.
+        SafeFileHandle handle = CreateFileW(path, access, 1U, IntPtr.Zero, 3U, flags, IntPtr.Zero);
+        if (handle.IsInvalid) { int error = Marshal.GetLastWin32Error(); handle.Dispose(); throw new Win32Exception(error); }
+        try
+        {
+            NativeInfo info = Inspect(handle, path, directory);
+            entries.Add(new Entry { Handle = handle, Path = path, Directory = directory, Volume = info.Volume, FileId = FileId(info) });
+        }
+        catch { handle.Dispose(); throw; }
+    }
+
+    private static ulong FileId(NativeInfo info) { return ((ulong)info.IndexHigh << 32) | info.IndexLow; }
+    private static bool SamePath(string left, string right)
+    {
+        return String.Equals(left.TrimEnd('\\'), right.TrimEnd('\\'), StringComparison.OrdinalIgnoreCase);
+    }
+    private static NativeInfo Inspect(SafeFileHandle handle, string expected, bool directory)
+    {
+        NativeInfo info;
+        if (!GetFileInformationByHandle(handle, out info)) throw new Win32Exception(Marshal.GetLastWin32Error());
+        if ((info.Attributes & 0x400U) != 0 || ((info.Attributes & 0x10U) != 0) != directory)
+            throw new IOException("Unsafe module path kind");
+        var value = new StringBuilder(512);
+        uint length = GetFinalPathNameByHandleW(handle, value, (uint)value.Capacity, 0);
+        if (length == 0) throw new Win32Exception(Marshal.GetLastWin32Error());
+        if (length >= value.Capacity)
+        {
+            value.Capacity = checked((int)length + 1);
+            length = GetFinalPathNameByHandleW(handle, value, (uint)value.Capacity, 0);
+            if (length == 0 || length >= value.Capacity) throw new IOException("Module final path unavailable");
+        }
+        string final = value.ToString();
+        if (final.StartsWith(@"\\?\UNC\", StringComparison.OrdinalIgnoreCase)) final = @"\\" + final.Substring(8);
+        else if (final.StartsWith(@"\\?\", StringComparison.OrdinalIgnoreCase)) final = final.Substring(4);
+        if (!SamePath(final, expected)) throw new IOException("Module final path mismatch");
+        return info;
+    }
+
+    public void Revalidate()
+    {
+        if (disposed) throw new ObjectDisposedException("trusted module import lease");
+        foreach (Entry entry in entries)
+        {
+            NativeInfo info = Inspect(entry.Handle, entry.Path, entry.Directory);
+            if (info.Volume != entry.Volume || FileId(info) != entry.FileId) throw new IOException("Module identity changed");
+        }
+    }
+    public void Dispose()
+    {
+        if (disposed) return;
+        disposed = true;
+        for (int index = entries.Count - 1; index >= 0; index--) entries[index].Handle.Dispose();
+        entries.Clear();
+    }
+}
+'@
+}
+
+function Open-CcodTrustedImportLease {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$ErrorId)
+    try {
+        Initialize-CcodTrustedImportLease
+        return [CcodTrustedImportLeaseV1]::Acquire($Path)
+    } catch {
+        throw [Management.Automation.ErrorRecord]::new(
+            [InvalidOperationException]::new('Trusted module import authority could not be acquired.'),
+            $ErrorId,[Management.Automation.ErrorCategory]::InvalidData,$Path)
+    }
+}
+# END CCOD TRUSTED IMPORT BOOTSTRAP
+$modulePath = Join-Path $PSScriptRoot 'OfficialDraftAcceptance.psm1'
+function Throw-CcodOfficialDraftWrapperError {
+    param([Parameter(Mandatory)][string]$ErrorId,[Parameter(Mandatory)][string]$Message)
+    throw [Management.Automation.ErrorRecord]::new(
+        [InvalidOperationException]::new($Message),
+        $ErrorId,
+        [Management.Automation.ErrorCategory]::InvalidArgument,
+        $null
+    )
+}
+try {
+    $phaseNames = [string[]]@('Preflight','LegacyUpgrade','Uninstall','FreshInstall','PreReboot','PostReboot','ReadyForManualEvidence','TrayEvidence','RemoteEvidence','Complete')
+    $phaseMatch = @($phaseNames | Where-Object { $_ -ieq [string]$Phase })
+    if ($phaseMatch.Count -ne 1) { Throw-CcodOfficialDraftWrapperError 'CCOD_ACCEPTANCE_PHASE_INVALID' 'The official-draft acceptance phase is unsupported.' }
+    $Phase = [string]$phaseMatch[0]
+    if ([string]::IsNullOrWhiteSpace($AssetDirectory) -or [string]::IsNullOrWhiteSpace($PreviousAssetDirectory) -or [string]::IsNullOrWhiteSpace($EvidenceRoot)) {
+        Throw-CcodOfficialDraftWrapperError 'CCOD_ACCEPTANCE_ARGUMENT_INVALID' 'Required acceptance paths are missing.'
+    }
+    $trayNames = [string[]]@('About','Language','OpenLogs','Repair')
+    if (-not [string]::IsNullOrWhiteSpace($TrayOperation)) {
+        $trayMatch = @($trayNames | Where-Object { $_ -ieq [string]$TrayOperation })
+        if ($trayMatch.Count -ne 1) { Throw-CcodOfficialDraftWrapperError 'CCOD_ACCEPTANCE_TRAY_OPERATION_INVALID' 'The tray operation is unsupported.' }
+        $TrayOperation = [string]$trayMatch[0]
+    }
+    if (-not [string]::IsNullOrWhiteSpace($RemoteOperation)) {
+        if ($RemoteOperation -ine 'SecondDeviceControl') { Throw-CcodOfficialDraftWrapperError 'CCOD_ACCEPTANCE_REMOTE_OPERATION_INVALID' 'The remote operation is unsupported.' }
+        $RemoteOperation = 'SecondDeviceControl'
+    }
+    if (-not [string]::IsNullOrWhiteSpace($ReviewState)) {
+        if ($ReviewState -ine 'Reviewed') { Throw-CcodOfficialDraftWrapperError 'CCOD_ACCEPTANCE_REVIEW_STATE_INVALID' 'The manual evidence review state is unsupported.' }
+        $ReviewState = 'Reviewed'
+    }
+    $moduleLease = Open-CcodTrustedImportLease -Path $modulePath -ErrorId 'CCOD_ACCEPTANCE_MODULE_MISSING'
+    try {
+        $moduleLease.Revalidate()
+        Import-Module $modulePath -Force -ErrorAction Stop
+        $moduleLease.Revalidate()
+    } finally { $moduleLease.Dispose() }
+    $invokeParameters = @{
+        Phase = $Phase
+        AssetDirectory = $AssetDirectory
+        PreviousAssetDirectory = $PreviousAssetDirectory
+        EvidenceRoot = $EvidenceRoot
+        DraftId = $DraftId
+        AllowMachineMutation = [bool]$AllowMachineMutation
+        AllowCodexRestart = [bool]$AllowCodexRestart
+        AllowWindowsReboot = [bool]$AllowWindowsReboot
+    }
+    if (-not [string]::IsNullOrWhiteSpace($TrayOperation)) { $invokeParameters.TrayOperation = $TrayOperation }
+    if (-not [string]::IsNullOrWhiteSpace($RemoteOperation)) { $invokeParameters.RemoteOperation = $RemoteOperation }
+    if (-not [string]::IsNullOrWhiteSpace($ScreenshotPath)) { $invokeParameters.ScreenshotPath = $ScreenshotPath }
+    if (-not [string]::IsNullOrWhiteSpace($RedactedLogPath)) { $invokeParameters.RedactedLogPath = $RedactedLogPath }
+    if (-not [string]::IsNullOrWhiteSpace($ReviewState)) { $invokeParameters.ReviewState = $ReviewState }
+    Invoke-CcodOfficialDraftAcceptance @invokeParameters |
+        ConvertTo-Json -Depth 16
+} catch {
+    $errorId = [string]$_.FullyQualifiedErrorId
+    if ($errorId -notmatch '^CCOD_ACCEPTANCE_[A-Z0-9_]+\z') { $errorId = 'CCOD_ACCEPTANCE_WRAPPER_FAILED' }
+    [Console]::Error.WriteLine($errorId)
+    exit 1
+}
diff --git a/tests/installed/OfficialDraftAcceptance.psm1 b/tests/installed/OfficialDraftAcceptance.psm1
new file mode 100644
index 0000000..a890033
--- /dev/null
+++ b/tests/installed/OfficialDraftAcceptance.psm1
@@ -0,0 +1,3680 @@
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+# BEGIN CCOD TRUSTED IMPORT BOOTSTRAP
+# Embedded in each independently trusted entrypoint; an unheld helper import
+# cannot bootstrap its own protection. Keep copies identical (self-test enforced).
+function Initialize-CcodTrustedImportLease {
+    if ($null -ne ('CcodTrustedImportLeaseV1' -as [type])) { return }
+    Add-Type -ErrorAction Stop -TypeDefinition @'
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+
+public sealed class CcodTrustedImportLeaseV1 : IDisposable
+{
+    [StructLayout(LayoutKind.Sequential)] private struct NativeTime { public uint Low, High; }
+    [StructLayout(LayoutKind.Sequential)] private struct NativeInfo
+    {
+        public uint Attributes;
+        public NativeTime Creation, Access, Write;
+        public uint Volume, SizeHigh, SizeLow, Links, IndexHigh, IndexLow;
+    }
+    private sealed class Entry
+    {
+        public SafeFileHandle Handle;
+        public string Path;
+        public bool Directory;
+        public uint Volume;
+        public ulong FileId;
+    }
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern SafeFileHandle CreateFileW(string path, uint access, uint share, IntPtr security, uint creation, uint flags, IntPtr template);
+    [DllImport("kernel32.dll", SetLastError=true)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle handle, out NativeInfo info);
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern uint GetFinalPathNameByHandleW(SafeFileHandle handle, StringBuilder value, uint length, uint flags);
+
+    private readonly List<Entry> entries = new List<Entry>();
+    private bool disposed;
+    public string Path { get; private set; }
+    private CcodTrustedImportLeaseV1(string path) { Path = path; }
+
+    public static CcodTrustedImportLeaseV1 Acquire(string path)
+    {
+        if (String.IsNullOrWhiteSpace(path) || !System.IO.Path.IsPathRooted(path) ||
+            path.StartsWith(@"\\?\", StringComparison.Ordinal) || path.StartsWith(@"\\.\", StringComparison.Ordinal))
+            throw new ArgumentException("Unsupported module path");
+        string full = System.IO.Path.GetFullPath(path);
+        string root = System.IO.Path.GetPathRoot(full);
+        string extension = System.IO.Path.GetExtension(full);
+        if (!String.Equals(full, path, StringComparison.OrdinalIgnoreCase) || String.IsNullOrEmpty(root) ||
+            full.Substring(root.Length).IndexOf(':') >= 0 ||
+            (!String.Equals(extension, ".psm1", StringComparison.OrdinalIgnoreCase) && !String.Equals(extension, ".ps1", StringComparison.OrdinalIgnoreCase)))
+            throw new ArgumentException("Noncanonical module path");
+        var lease = new CcodTrustedImportLeaseV1(full);
+        try
+        {
+            var parents = new List<string>();
+            for (DirectoryInfo parent = Directory.GetParent(full); parent != null; parent = parent.Parent)
+                parents.Add(parent.FullName);
+            parents.Reverse();
+            if (parents.Count == 0 || !SamePath(parents[0], root)) throw new IOException("Missing module root");
+            // Retain root-to-leaf authority before traversing the next component.
+            foreach (string parent in parents) lease.Open(parent, true);
+            lease.Open(full, false);
+            lease.Revalidate();
+            return lease;
+        }
+        catch { lease.Dispose(); throw; }
+    }
+
+    private void Open(string path, bool directory)
+    {
+        uint access = directory ? 0x00100081U : 0x80100080U;
+        uint flags = 0x00200000U | (directory ? 0x02000000U : 0U);
+        // FILE_SHARE_READ only: preexisting writers/deleters must fail closed.
+        SafeFileHandle handle = CreateFileW(path, access, 1U, IntPtr.Zero, 3U, flags, IntPtr.Zero);
+        if (handle.IsInvalid) { int error = Marshal.GetLastWin32Error(); handle.Dispose(); throw new Win32Exception(error); }
+        try
+        {
+            NativeInfo info = Inspect(handle, path, directory);
+            entries.Add(new Entry { Handle = handle, Path = path, Directory = directory, Volume = info.Volume, FileId = FileId(info) });
+        }
+        catch { handle.Dispose(); throw; }
+    }
+
+    private static ulong FileId(NativeInfo info) { return ((ulong)info.IndexHigh << 32) | info.IndexLow; }
+    private static bool SamePath(string left, string right)
+    {
+        return String.Equals(left.TrimEnd('\\'), right.TrimEnd('\\'), StringComparison.OrdinalIgnoreCase);
+    }
+    private static NativeInfo Inspect(SafeFileHandle handle, string expected, bool directory)
+    {
+        NativeInfo info;
+        if (!GetFileInformationByHandle(handle, out info)) throw new Win32Exception(Marshal.GetLastWin32Error());
+        if ((info.Attributes & 0x400U) != 0 || ((info.Attributes & 0x10U) != 0) != directory)
+            throw new IOException("Unsafe module path kind");
+        var value = new StringBuilder(512);
+        uint length = GetFinalPathNameByHandleW(handle, value, (uint)value.Capacity, 0);
+        if (length == 0) throw new Win32Exception(Marshal.GetLastWin32Error());
+        if (length >= value.Capacity)
+        {
+            value.Capacity = checked((int)length + 1);
+            length = GetFinalPathNameByHandleW(handle, value, (uint)value.Capacity, 0);
+            if (length == 0 || length >= value.Capacity) throw new IOException("Module final path unavailable");
+        }
+        string final = value.ToString();
+        if (final.StartsWith(@"\\?\UNC\", StringComparison.OrdinalIgnoreCase)) final = @"\\" + final.Substring(8);
+        else if (final.StartsWith(@"\\?\", StringComparison.OrdinalIgnoreCase)) final = final.Substring(4);
+        if (!SamePath(final, expected)) throw new IOException("Module final path mismatch");
+        return info;
+    }
+
+    public void Revalidate()
+    {
+        if (disposed) throw new ObjectDisposedException("trusted module import lease");
+        foreach (Entry entry in entries)
+        {
+            NativeInfo info = Inspect(entry.Handle, entry.Path, entry.Directory);
+            if (info.Volume != entry.Volume || FileId(info) != entry.FileId) throw new IOException("Module identity changed");
+        }
+    }
+    public void Dispose()
+    {
+        if (disposed) return;
+        disposed = true;
+        for (int index = entries.Count - 1; index >= 0; index--) entries[index].Handle.Dispose();
+        entries.Clear();
+    }
+}
+'@
+}
+
+function Open-CcodTrustedImportLease {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$ErrorId)
+    try {
+        Initialize-CcodTrustedImportLease
+        return [CcodTrustedImportLeaseV1]::Acquire($Path)
+    } catch {
+        throw [Management.Automation.ErrorRecord]::new(
+            [InvalidOperationException]::new('Trusted module import authority could not be acquired.'),
+            $ErrorId,[Management.Automation.ErrorCategory]::InvalidData,$Path)
+    }
+}
+# END CCOD TRUSTED IMPORT BOOTSTRAP
+
+$script:CcodOfficialDraftExpectedVersion = '2.5.22'
+$script:CcodOfficialDraftPhases = @(
+    'Preflight',
+    'LegacyUpgrade',
+    'Uninstall',
+    'FreshInstall',
+    'PreReboot',
+    'PostReboot',
+    'ReadyForManualEvidence'
+)
+$script:CcodOfficialDraftPhaseFiles = @{
+    Preflight = '01-Preflight.json'
+    LegacyUpgrade = '02-LegacyUpgrade.json'
+    Uninstall = '03-Uninstall.json'
+    FreshInstall = '04-FreshInstall.json'
+    PreReboot = '05-PreReboot.json'
+    PostReboot = '06-PostReboot.json'
+    ReadyForManualEvidence = '07-ReadyForManualEvidence.json'
+}
+$script:CcodOfficialDraftReceiptFields = @('schemaVersion','phase','candidate','draft','facts')
+$script:CcodOfficialDraftDefenderReceiptFields = @(
+    'schemaVersion','assetType','assetName','assetSha256','checksumName','checksumSha256',
+    'manifestName','manifestSha256','version','gitCommit','origin','workflowArtifactIdentity',
+    'zoneId','defenderServiceEnabled','antivirusEnabled','realTimeProtectionEnabled',
+    'defenderPlatformVersion','defenderEngineVersion','signatureVersion','signatureUpdatedAtUtc',
+    'scanStartedAtUtc','scanCompletedAtUtc','detectionCount','outcome','errorCode'
+)
+$script:CcodOfficialDraftAssetModule = $null
+$script:CcodOfficialDraftDefenderModule = $null
+$script:CcodOfficialDraftIntegrationModule = $null
+$script:CcodOfficialDraftInstallRoot = $null
+$script:CcodOfficialDraftManualAcknowledgement = $null
+$script:CcodOfficialDraftLifecycleLoaded = $false
+$script:CcodOfficialDraftCompletionFile = '08-Complete.json'
+$script:CcodOfficialDraftManualDirectoryName = 'manual-evidence'
+$script:CcodOfficialDraftManualArtifactRootName = 'official-draft-artifacts'
+$script:CcodOfficialDraftManualOperations = @('About','Language','OpenLogs','Repair','SecondDeviceControl')
+$script:CcodOfficialDraftManualFiles = @{
+    About = 'TrayEvidence-About.json'
+    Language = 'TrayEvidence-Language.json'
+    OpenLogs = 'TrayEvidence-OpenLogs.json'
+    Repair = 'TrayEvidence-Repair.json'
+    SecondDeviceControl = 'RemoteEvidence-SecondDeviceControl.json'
+}
+$script:CcodOfficialDraftManualTerminalStates = @{
+    About = 'AboutVisible'
+    Language = 'LanguageChanged'
+    OpenLogs = 'LogsOpened'
+    Repair = 'RepairCompleted'
+    SecondDeviceControl = 'SecondDeviceControlled'
+}
+$script:CcodOfficialDraftManualResultCodes = @{
+    About = 'CCOD_TRAYABOUT_COMPLETED'
+    Language = 'CCOD_TRAYLANGUAGE_COMPLETED'
+    OpenLogs = 'CCOD_TRAYOPENLOGS_COMPLETED'
+    Repair = 'CCOD_TRAYREPAIR_COMPLETED'
+    SecondDeviceControl = 'CCOD_SECONDDEVICE_COMPLETED'
+}
+$script:CcodOfficialDraftManualRecordFields = @(
+    'schemaVersion','kind','phase','operation','terminalState','result','proof','reviewState',
+    'version','gitCommit','candidateManifestSha256','screenshotSha256','redactedLogSha256'
+)
+
+function Throw-CcodOfficialDraftError {
+    param(
+        [Parameter(Mandatory)][string]$Id,
+        [Parameter(Mandatory)][string]$Message,
+        $Target
+    )
+    throw [Management.Automation.ErrorRecord]::new(
+        [InvalidOperationException]::new($Message),
+        $Id,
+        [Management.Automation.ErrorCategory]::InvalidOperation,
+        $Target
+    )
+}
+
+function Get-CcodOfficialDraftAssetModule {
+    if ($null -eq $script:CcodOfficialDraftAssetModule) {
+        $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+        $path = Join-Path $repositoryRoot 'tools\ReleaseAssetContract.psm1'
+        if (-not [IO.File]::Exists($path)) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_ASSET_CONTRACT_MISSING' 'The exact release asset contract module is missing.' $null
+        }
+        try {
+            $lease = Open-CcodTrustedImportLease -Path $path -ErrorId 'CCOD_ACCEPTANCE_ASSET_CONTRACT_MISSING'
+            try {
+                $lease.Revalidate()
+                $script:CcodOfficialDraftAssetModule = Import-Module $path -Force -PassThru -DisableNameChecking -ErrorAction Stop
+                $lease.Revalidate()
+            } finally { $lease.Dispose() }
+        } catch {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_ASSET_CONTRACT_MISSING' 'The exact release asset contract module could not be loaded.' $null
+        }
+    }
+    return $script:CcodOfficialDraftAssetModule
+}
+
+function Get-CcodOfficialDraftDefenderModule {
+    if ($null -eq $script:CcodOfficialDraftDefenderModule) {
+        $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+        $path = Join-Path $repositoryRoot 'tools\ReleaseDefender.psm1'
+        if (-not [IO.File]::Exists($path)) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_DEFENDER_MODULE_MISSING' 'The release Defender module is missing.' $null
+        }
+        try {
+            $lease = Open-CcodTrustedImportLease -Path $path -ErrorId 'CCOD_ACCEPTANCE_DEFENDER_MODULE_MISSING'
+            try {
+                $lease.Revalidate()
+                $script:CcodOfficialDraftDefenderModule = Import-Module $path -Force -PassThru -DisableNameChecking -ErrorAction Stop
+                $lease.Revalidate()
+            } finally { $lease.Dispose() }
+        } catch {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_DEFENDER_MODULE_MISSING' 'The release Defender module could not be loaded.' $null
+        }
+    }
+    return $script:CcodOfficialDraftDefenderModule
+}
+
+function Get-CcodOfficialDraftIntegrationModule {
+    if ($null -eq $script:CcodOfficialDraftIntegrationModule) {
+        $path = Join-Path $PSScriptRoot 'Invoke-InstalledLifecycleIntegration.ps1'
+        if (-not [IO.File]::Exists($path)) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_INTEGRATION_MISSING' 'The installed-lifecycle integration entry point is missing.' $null
+        }
+        try {
+            $lease = Open-CcodTrustedImportLease -Path $path -ErrorId 'CCOD_ACCEPTANCE_INTEGRATION_MISSING'
+            try {
+                $lease.Revalidate()
+                $script:CcodOfficialDraftIntegrationModule = New-Module -Name ('CcodOfficialDraftIntegration-' + [guid]::NewGuid().ToString('N')) -ArgumentList $path -ScriptBlock {
+                    param($IntegrationPath)
+                    . $IntegrationPath -Library
+                } -ErrorAction Stop
+                $lease.Revalidate()
+            } finally { $lease.Dispose() }
+        } catch {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_INTEGRATION_MISSING' 'The installed-lifecycle integration entry point could not be loaded safely.' $null
+        }
+    }
+    return $script:CcodOfficialDraftIntegrationModule
+}
+
+function Assert-CcodOfficialDraftSafeDirectory {
+    param(
+        [Parameter(Mandatory)][string]$Path,
+        [Parameter(Mandatory)][string]$ErrorId,
+        [switch]$AllowMissing
+    )
+    try {
+        if ([string]::IsNullOrWhiteSpace($Path) -or -not [IO.Path]::IsPathRooted($Path)) { throw 'absolute' }
+        $full = [IO.Path]::GetFullPath($Path)
+        $root = [IO.Path]::GetPathRoot($full)
+        if ([string]::IsNullOrWhiteSpace($root)) { throw 'root' }
+        $canonical = if ($full.Length -gt $root.Length) { $full.TrimEnd('\') } else { $full }
+        $presented = if ($Path.Length -gt $root.Length) { $Path.TrimEnd('\') } else { $Path }
+        if ($canonical -cne $presented) { throw 'noncanonical' }
+        if ([IO.File]::Exists($canonical)) { throw 'file' }
+        if (-not [IO.Directory]::Exists($canonical)) {
+            if (-not $AllowMissing) { throw 'missing' }
+            $parent = [IO.Directory]::GetParent($canonical)
+            if ($null -eq $parent) { throw 'parent' }
+            [void](Assert-CcodOfficialDraftSafeDirectory -Path $parent.FullName -ErrorId $ErrorId)
+            [IO.Directory]::CreateDirectory($canonical) | Out-Null
+        }
+        $current = $canonical
+        while (-not [string]::IsNullOrWhiteSpace($current)) {
+            $item = Get-Item -LiteralPath $current -Force -ErrorAction Stop
+            if (-not $item.PSIsContainer -or (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) { throw 'unsafe' }
+            $currentRoot = [IO.Path]::GetPathRoot($current)
+            if ($current.TrimEnd('\') -ceq $currentRoot.TrimEnd('\')) { break }
+            $parent = [IO.Directory]::GetParent($current)
+            if ($null -eq $parent) { throw 'parent' }
+            $next = if ($parent.FullName.Length -gt $currentRoot.Length) { $parent.FullName.TrimEnd('\') } else { $parent.FullName }
+            if ($next -ceq $current) { break }
+            $current = $next
+        }
+        return $canonical
+    } catch {
+        Throw-CcodOfficialDraftError $ErrorId 'Official-draft evidence root is missing, noncanonical, or unsafe.' $null
+    }
+}
+
+function Assert-CcodOfficialDraftRegularFile {
+    param(
+        [Parameter(Mandatory)][string]$Path,
+        [Parameter(Mandatory)][string]$ErrorId
+    )
+    try {
+        if ([string]::IsNullOrWhiteSpace($Path) -or -not [IO.Path]::IsPathRooted($Path)) { throw 'absolute' }
+        $full = [IO.Path]::GetFullPath($Path)
+        $root = [IO.Path]::GetPathRoot($full)
+        if ([string]::IsNullOrWhiteSpace($root) -or $full.TrimEnd('\') -cne $Path.TrimEnd('\')) { throw 'canonical' }
+        if ([IO.File]::Exists($full) -eq $false) { throw 'missing' }
+        $item = Get-Item -LiteralPath $full -Force -ErrorAction Stop
+        if ($item.PSIsContainer -or (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) { throw 'unsafe' }
+        $parent = [IO.Directory]::GetParent($full)
+        if ($null -eq $parent) { throw 'parent' }
+        [void](Assert-CcodOfficialDraftSafeDirectory -Path $parent.FullName -ErrorId $ErrorId)
+        return $full
+    } catch {
+        Throw-CcodOfficialDraftError $ErrorId 'Official-draft asset is missing or unsafe.' $null
+    }
+}
+
+function Test-CcodOfficialDraftCanonicalUtc {
+    param($Value)
+    if ($Value -isnot [string] -or [string]::IsNullOrWhiteSpace($Value)) { return $false }
+    $parsed = [datetime]::MinValue
+    return [datetime]::TryParseExact(
+        $Value,
+        'o',
+        [Globalization.CultureInfo]::InvariantCulture,
+        [Globalization.DateTimeStyles]::RoundtripKind,
+        [ref]$parsed
+    ) -and $parsed.Kind -eq [DateTimeKind]::Utc -and
+        $parsed.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture) -ceq $Value
+}
+
+function Test-CcodOfficialDraftExactProperties {
+    param($Value, [Parameter(Mandatory)][string[]]$Expected)
+    if ($null -eq $Value -or ($Value -isnot [pscustomobject] -and $Value -isnot [Collections.IDictionary])) { return $false }
+    $actual = @(
+        if ($Value -is [Collections.IDictionary]) {
+            $Value.Keys | ForEach-Object { [string]$_ }
+        } else {
+            $Value.PSObject.Properties.Name
+        }
+    )
+    return $actual.Count -eq $Expected.Count -and ($actual -join "`0") -ceq ($Expected -join "`0")
+}
+
+function Test-CcodOfficialDraftHash {
+    param($Value)
+    return $Value -is [string] -and $Value -cmatch '^[0-9a-f]{64}\z'
+}
+
+function Test-CcodOfficialDraftInt32 {
+    param($Value)
+    if ($null -eq $Value -or $Value -is [bool]) { return $false }
+    if ($Value.GetType() -notin @([sbyte],[byte],[int16],[uint16],[int32],[uint32],[int64],[uint64])) { return $false }
+    try {
+        $number = [int64]$Value
+        return $number -ge [int32]::MinValue -and $number -le [int32]::MaxValue
+    } catch { return $false }
+}
+
+function Test-CcodOfficialDraftCommit {
+    param($Value)
+    return $Value -is [string] -and $Value -cmatch '^[0-9a-f]{40}\z'
+}
+
+function Get-CcodOfficialDraftExpectedAssetNames {
+    $module = Get-CcodOfficialDraftAssetModule
+    return @(&$module { param($Version) Get-CcodExpectedReleaseAssetNames -Version $Version } $script:CcodOfficialDraftExpectedVersion)
+}
+
+function Get-CcodOfficialDraftAssetHash {
+    param([Parameter(Mandatory)]$Candidate, [Parameter(Mandatory)][string]$Name)
+    foreach ($asset in @($Candidate.assetHashes)) {
+        if ($asset.name -ceq $Name) { return [string]$asset.sha256 }
+    }
+    return $null
+}
+
+function ConvertTo-CcodOfficialDraftCandidate {
+    param([Parameter(Mandatory)]$Value)
+    try {
+        if ($null -eq $Value -or $Value.Valid -isnot [bool] -or -not [bool]$Value.Valid -or
+            $Value.Version -isnot [string] -or $Value.Version -cne $script:CcodOfficialDraftExpectedVersion -or
+            -not (Test-CcodOfficialDraftCommit $Value.GitCommit)) { throw 'metadata' }
+        $expected = @(Get-CcodOfficialDraftExpectedAssetNames)
+        $assets = @($Value.Assets)
+        if ($assets.Count -ne $expected.Count) { throw 'asset count' }
+        $records = [Collections.Generic.List[object]]::new()
+        for ($index = 0; $index -lt $expected.Count; $index++) {
+            $asset = $assets[$index]
+            if ($null -eq $asset -or
+                -not (Test-CcodOfficialDraftExactProperties -Value $asset -Expected @('name','sha256')) -or
+                $asset.name -isnot [string] -or $asset.name -cne $expected[$index] -or
+                -not (Test-CcodOfficialDraftHash $asset.sha256)) { throw 'asset record' }
+            $records.Add([pscustomobject][ordered]@{ name = [string]$asset.name; sha256 = [string]$asset.sha256 })
+        }
+        return [pscustomobject][ordered]@{
+            version = [string]$Value.Version
+            gitCommit = [string]$Value.GitCommit
+            assetHashes = @($records)
+            manifestHashes = [pscustomobject][ordered]@{
+                portable = [string]$records[4].sha256
+                setup = [string]$records[10].sha256
+            }
+        }
+    } catch {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_ASSET_CONTRACT_INVALID' 'The official draft does not satisfy the exact eleven-asset manifest contract.' $null
+    }
+}
+
+function ConvertTo-CcodOfficialDraftPersistedCandidate {
+    param([Parameter(Mandatory)]$Value)
+    try {
+        if (-not (Test-CcodOfficialDraftExactProperties -Value $Value -Expected @('version','gitCommit','assetHashes','manifestHashes')) -or
+            $Value.version -isnot [string] -or $Value.version -cne $script:CcodOfficialDraftExpectedVersion -or
+            -not (Test-CcodOfficialDraftCommit $Value.gitCommit)) { throw 'metadata' }
+        $expected = @(Get-CcodOfficialDraftExpectedAssetNames)
+        $assets = @($Value.assetHashes)
+        if ($assets.Count -ne $expected.Count) { throw 'asset count' }
+        $records = [Collections.Generic.List[object]]::new()
+        for ($index = 0; $index -lt $expected.Count; $index++) {
+            $asset = $assets[$index]
+            if (-not (Test-CcodOfficialDraftExactProperties -Value $asset -Expected @('name','sha256')) -or
+                $asset.name -isnot [string] -or $asset.name -cne $expected[$index] -or
+                -not (Test-CcodOfficialDraftHash $asset.sha256)) { throw 'asset record' }
+            $records.Add([pscustomobject][ordered]@{ name = [string]$asset.name; sha256 = [string]$asset.sha256 })
+        }
+        if (-not (Test-CcodOfficialDraftExactProperties -Value $Value.manifestHashes -Expected @('portable','setup')) -or
+            -not (Test-CcodOfficialDraftHash $Value.manifestHashes.portable) -or
+            -not (Test-CcodOfficialDraftHash $Value.manifestHashes.setup) -or
+            [string]$Value.manifestHashes.portable -cne [string]$records[4].sha256 -or
+            [string]$Value.manifestHashes.setup -cne [string]$records[10].sha256) { throw 'manifest hashes' }
+        return [pscustomobject][ordered]@{
+            version = [string]$Value.version
+            gitCommit = [string]$Value.gitCommit
+            assetHashes = @($records)
+            manifestHashes = [pscustomobject][ordered]@{
+                portable = [string]$records[4].sha256
+                setup = [string]$records[10].sha256
+            }
+        }
+    } catch {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'The persisted official-draft candidate identity is malformed.' $null
+    }
+}
+
+function ConvertTo-CcodOfficialDraftIdentity {
+    param($Value)
+    try {
+        if ($null -eq $Value) { throw 'draft' }
+        if (-not (Test-CcodOfficialDraftExactProperties -Value $Value -Expected @('tag','id')) -or
+            $Value.tag -isnot [string] -or $Value.tag -cne 'v2.5.22') { throw 'draft' }
+        if ($Value.id -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$Value.id) -or
+            [string]$Value.id -notmatch '^[1-9][0-9]*\z') { throw 'id' }
+        return [pscustomobject][ordered]@{
+            tag = [string]$Value.tag
+            id = [string]$Value.id
+        }
+    } catch {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_DRAFT_IDENTITY_INVALID' 'The official draft tag or identifier is malformed.' $null
+    }
+}
+
+function Test-CcodOfficialDraftCandidateEqual {
+    param([Parameter(Mandatory)]$Left, [Parameter(Mandatory)]$Right)
+    if ($Left.version -cne $Right.version -or $Left.gitCommit -cne $Right.gitCommit) { return $false }
+    $leftAssets = @($Left.assetHashes); $rightAssets = @($Right.assetHashes)
+    if ($leftAssets.Count -ne $rightAssets.Count) { return $false }
+    for ($index = 0; $index -lt $leftAssets.Count; $index++) {
+        if ($leftAssets[$index].name -cne $rightAssets[$index].name -or $leftAssets[$index].sha256 -cne $rightAssets[$index].sha256) { return $false }
+    }
+    if ($Left.manifestHashes.portable -cne $Right.manifestHashes.portable -or
+        $Left.manifestHashes.setup -cne $Right.manifestHashes.setup) { return $false }
+    return $true
+}
+
+function Test-CcodOfficialDraftDraftEqual {
+    param([AllowNull()]$Left,[AllowNull()]$Right)
+    if ($null -eq $Left -or $null -eq $Right) { return $false }
+    $leftTag = $Left.PSObject.Properties['tag']; $rightTag = $Right.PSObject.Properties['tag']
+    $leftId = $Left.PSObject.Properties['id']; $rightId = $Right.PSObject.Properties['id']
+    if (@($leftTag).Count -ne 1 -or @($rightTag).Count -ne 1 -or @($leftId).Count -ne 1 -or @($rightId).Count -ne 1) { return $false }
+    return [string]$leftTag.Value -ceq [string]$rightTag.Value -and [string]$leftId.Value -ceq [string]$rightId.Value
+}
+
+function Close-CcodOfficialDraftOperationLease {
+    param($Lease)
+    if ($null -eq $Lease -or $Lease.Closed) { return }
+    $failed = $false
+    if ($null -ne $Lease.Stream) { try { $Lease.Stream.Dispose() } catch { $failed = $true } }
+    for ($index = $Lease.Parents.Count - 1; $index -ge 0; $index--) {
+        try { $Lease.Parents[$index].Handle.Dispose() } catch { $failed = $true }
+    }
+    $Lease.Closed = $true
+    if ($failed) { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_OPERATION_LOCK_FAILED' 'Acceptance operation authority could not be released.' $null }
+}
+
+function Open-CcodOfficialDraftOperationLease {
+    param([Parameter(Mandatory)][string]$EvidenceRoot)
+    $root = Assert-CcodOfficialDraftSafeDirectory -Path $EvidenceRoot -ErrorId 'CCOD_ACCEPTANCE_EVIDENCE_ROOT_INVALID'
+    $assetModule = Get-CcodOfficialDraftAssetModule
+    $lease = [pscustomobject]@{ Stream = $null; Parents = [Collections.Generic.List[object]]::new(); Closed = $false }
+    try {
+        $directories = [Collections.Generic.List[string]]::new()
+        for ($directory = [IO.DirectoryInfo]::new($root); $null -ne $directory; $directory = $directory.Parent) { $directories.Insert(0,$directory.FullName) }
+        foreach ($path in $directories) {
+            $handle = [CcodReleaseFileAuthorityV1]::OpenDirectory($path,$true)
+            $entry = [pscustomobject]@{ Path = $path; Handle = $handle }
+            $lease.Parents.Add($entry)
+            $identity = [CcodReleaseFileAuthorityV1]::Identity($handle)
+            if ([CcodReleaseFileAuthorityV1]::IsReparse($identity) -or -not [CcodReleaseFileAuthorityV1]::IsDirectory($identity) -or
+                -not $identity.FinalPath.TrimEnd('\').Equals($path.TrimEnd('\'),[StringComparison]::OrdinalIgnoreCase)) { throw 'operation ancestry' }
+        }
+        $lockPath = Join-Path $root '.ccod-official-draft-operation.lock'
+        try { $lease.Stream = [CcodReleaseFileAuthorityV1]::OpenExclusiveOperationFile($lockPath) }
+        catch {
+            $exception = $_.Exception
+            while ($null -ne $exception -and $exception -isnot [ComponentModel.Win32Exception]) { $exception = $exception.InnerException }
+            if ($null -ne $exception -and $exception.NativeErrorCode -in @(32,33)) {
+                Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_OPERATION_BUSY' 'Another acceptance operation owns this evidence root.' $null
+            }
+            throw
+        }
+        $identity = [CcodReleaseFileAuthorityV1]::Identity($lease.Stream.SafeFileHandle)
+        if ([CcodReleaseFileAuthorityV1]::IsDirectory($identity) -or [CcodReleaseFileAuthorityV1]::IsReparse($identity) -or
+            $identity.Links -ne 1 -or $lease.Stream.Length -ne 0 -or
+            -not $identity.FinalPath.Equals($lockPath,[StringComparison]::OrdinalIgnoreCase) -or
+            -not (& $assetModule {param($Value) Test-CcodReleaseAuthorityStreams -Identity $Value} $identity)) { throw 'operation lock identity' }
+        # The empty lock leaf is retained. Deleting it on release would race the next opener.
+        return $lease
+    } catch {
+        $failure = $_
+        Close-CcodOfficialDraftOperationLease $lease
+        if ($failure.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw $failure }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_OPERATION_LOCK_FAILED' 'Acceptance operation authority could not be acquired safely.' $null
+    }
+}
+
+function Get-CcodOfficialDraftStateDirectory {
+    param([Parameter(Mandatory)][string]$EvidenceRoot)
+    $root = Assert-CcodOfficialDraftSafeDirectory -Path $EvidenceRoot -ErrorId 'CCOD_ACCEPTANCE_EVIDENCE_ROOT_INVALID'
+    $state = [IO.Path]::GetFullPath((Join-Path $root 'official-draft-acceptance'))
+    if ([IO.File]::Exists($state)) {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_EVIDENCE_ROOT_INVALID' 'The official-draft state directory is not a directory.' $null
+    }
+    if (-not [IO.Directory]::Exists($state)) {
+        try { [IO.Directory]::CreateDirectory($state) | Out-Null } catch { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_EVIDENCE_ROOT_INVALID' 'The official-draft state directory could not be created safely.' $null }
+    }
+    return (Assert-CcodOfficialDraftSafeDirectory -Path $state -ErrorId 'CCOD_ACCEPTANCE_EVIDENCE_ROOT_INVALID')
+}
+
+function Get-CcodOfficialDraftManualDirectory {
+    param([Parameter(Mandatory)][string]$StateDirectory)
+    $path = Join-Path $StateDirectory $script:CcodOfficialDraftManualDirectoryName
+    if ([IO.File]::Exists($path)) {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_EVIDENCE_ROOT_INVALID' 'The manual-evidence state path is a file.' $null
+    }
+    if (-not [IO.Directory]::Exists($path)) {
+        try { [IO.Directory]::CreateDirectory($path) | Out-Null }
+        catch { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_EVIDENCE_ROOT_INVALID' 'The manual-evidence state directory could not be created safely.' $null }
+    }
+    return (Assert-CcodOfficialDraftSafeDirectory -Path $path -ErrorId 'CCOD_ACCEPTANCE_EVIDENCE_ROOT_INVALID')
+}
+
+function Get-CcodOfficialDraftManualEvidencePath {
+    param([Parameter(Mandatory)][string]$StateDirectory,[Parameter(Mandatory)][string]$Operation)
+    if (-not $script:CcodOfficialDraftManualFiles.ContainsKey($Operation)) {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_OPERATION_INVALID' 'The manual evidence operation is unsupported.' $null
+    }
+    $directory = Get-CcodOfficialDraftManualDirectory -StateDirectory $StateDirectory
+    $path = Join-Path $directory $script:CcodOfficialDraftManualFiles[$Operation]
+    if ([IO.Directory]::Exists($path)) {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_PHASE_REUSED' 'The manual evidence operation already has a receipt.' $null
+    }
+    if ([IO.File]::Exists($path)) {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_PHASE_REUSED' 'The manual evidence operation already has a receipt.' $null
+    }
+    return $path
+}
+
+function Get-CcodOfficialDraftCompleteAcceptancePath {
+    param([Parameter(Mandatory)][string]$EvidenceRoot)
+    $root = Assert-CcodOfficialDraftSafeDirectory -Path $EvidenceRoot -ErrorId 'CCOD_ACCEPTANCE_EVIDENCE_ROOT_INVALID'
+    $directory = Join-Path $root 'acceptance'
+    if ([IO.File]::Exists($directory)) {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_EVIDENCE_ROOT_INVALID' 'The acceptance evidence path is a file.' $null
+    }
+    if (-not [IO.Directory]::Exists($directory)) {
+        try { [IO.Directory]::CreateDirectory($directory) | Out-Null }
+        catch { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_EVIDENCE_ROOT_INVALID' 'The acceptance evidence directory could not be created safely.' $null }
+    }
+    $directory = Assert-CcodOfficialDraftSafeDirectory -Path $directory -ErrorId 'CCOD_ACCEPTANCE_EVIDENCE_ROOT_INVALID'
+    $path = Join-Path $directory 'CodexRemote-fix-2.5.22-official-draft.complete.json'
+    if ([IO.File]::Exists($path) -or [IO.Directory]::Exists($path)) {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_PHASE_REUSED' 'The complete acceptance receipt already exists.' $null
+    }
+    return $path
+}
+
+function Read-CcodOfficialDraftJson {
+    param([Parameter(Mandatory)][string]$Path)
+    $module = Get-CcodOfficialDraftAssetModule
+    try {
+        return & $module { param($JsonPath) Read-CcodReleaseContractJson -Path $JsonPath -ErrorId 'CCOD_ACCEPTANCE_RECEIPT_INVALID' -MaximumBytes 1048576 } $Path
+    } catch {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'An official-draft receipt is malformed or unreadable.' $null
+    }
+}
+
+function Assert-CcodOfficialDraftDefenderReceipt {
+    param(
+        [Parameter(Mandatory)]$Receipt,
+        [Parameter(Mandatory)]$Candidate,
+        [Parameter(Mandatory)][ValidateSet('Setup','PortableZip')][string]$AssetType
+    )
+    try {
+        if (-not (Test-CcodOfficialDraftExactProperties -Value $Receipt -Expected $script:CcodOfficialDraftDefenderReceiptFields) -or
+            -not (Test-CcodOfficialDraftInt32 $Receipt.schemaVersion) -or $Receipt.schemaVersion -ne 2 -or
+            $Receipt.assetType -isnot [string] -or $Receipt.assetType -cne $AssetType) { throw 'receipt frame' }
+        $expected = @(Get-CcodOfficialDraftExpectedAssetNames)
+        $assetIndex = if ($AssetType -ceq 'Setup') { 5 } else { 0 }
+        $checksumIndex = if ($AssetType -ceq 'Setup') { 6 } else { 1 }
+        $manifestIndex = if ($AssetType -ceq 'Setup') { 10 } else { 4 }
+        if ($Receipt.assetName -isnot [string] -or $Receipt.checksumName -isnot [string] -or $Receipt.manifestName -isnot [string] -or
+            $Receipt.assetSha256 -isnot [string] -or $Receipt.checksumSha256 -isnot [string] -or $Receipt.manifestSha256 -isnot [string] -or
+            $Receipt.version -isnot [string] -or $Receipt.gitCommit -isnot [string] -or $Receipt.origin -isnot [string]) { throw 'receipt scalar types' }
+        if ($Receipt.assetName -cne $expected[$assetIndex] -or $Receipt.checksumName -cne $expected[$checksumIndex] -or
+            $Receipt.manifestName -cne $expected[$manifestIndex] -or
+            $Receipt.assetSha256 -cne (Get-CcodOfficialDraftAssetHash $Candidate $expected[$assetIndex]) -or
+            $Receipt.checksumSha256 -cne (Get-CcodOfficialDraftAssetHash $Candidate $expected[$checksumIndex]) -or
+            $Receipt.manifestSha256 -cne (Get-CcodOfficialDraftAssetHash $Candidate $expected[$manifestIndex]) -or
+            $Receipt.version -cne $Candidate.version -or $Receipt.gitCommit -cne $Candidate.gitCommit -or
+            $Receipt.origin -cne 'InternetDownload' -or $null -ne $Receipt.workflowArtifactIdentity -or
+            -not (Test-CcodOfficialDraftInt32 $Receipt.zoneId) -or $Receipt.zoneId -ne 3 -or
+            $Receipt.defenderServiceEnabled -isnot [bool] -or -not $Receipt.defenderServiceEnabled -or
+            $Receipt.antivirusEnabled -isnot [bool] -or -not $Receipt.antivirusEnabled -or
+            $Receipt.realTimeProtectionEnabled -isnot [bool] -or -not $Receipt.realTimeProtectionEnabled -or
+            $Receipt.defenderPlatformVersion -isnot [string] -or [string]::IsNullOrWhiteSpace($Receipt.defenderPlatformVersion) -or $Receipt.defenderPlatformVersion.Length -gt 128 -or
+            $Receipt.defenderEngineVersion -isnot [string] -or [string]::IsNullOrWhiteSpace($Receipt.defenderEngineVersion) -or $Receipt.defenderEngineVersion.Length -gt 128 -or
+            $Receipt.signatureVersion -isnot [string] -or [string]::IsNullOrWhiteSpace($Receipt.signatureVersion) -or $Receipt.signatureVersion.Length -gt 128 -or
+            -not (Test-CcodOfficialDraftCanonicalUtc $Receipt.signatureUpdatedAtUtc) -or
+            -not (Test-CcodOfficialDraftCanonicalUtc $Receipt.scanStartedAtUtc) -or
+            -not (Test-CcodOfficialDraftCanonicalUtc $Receipt.scanCompletedAtUtc) -or
+            -not (Test-CcodOfficialDraftInt32 $Receipt.detectionCount) -or $Receipt.detectionCount -ne 0 -or
+            $Receipt.outcome -isnot [string] -or $Receipt.outcome -cne 'Completed' -or $null -ne $Receipt.errorCode) { throw 'receipt binding' }
+        $started = [datetime]::ParseExact($Receipt.scanStartedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
+        $completed = [datetime]::ParseExact($Receipt.scanCompletedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
+        $signature = [datetime]::ParseExact($Receipt.signatureUpdatedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
+        if ($completed -lt $started -or $completed -gt $started.AddHours(2) -or $signature -lt $started.AddHours(-72) -or $signature -gt $started.AddMinutes(5)) { throw 'receipt time' }
+        return [pscustomobject][ordered]@{
+            schemaVersion = 2
+            assetType = [string]$Receipt.assetType
+            assetName = [string]$Receipt.assetName
+            assetSha256 = [string]$Receipt.assetSha256
+            checksumName = [string]$Receipt.checksumName
+            checksumSha256 = [string]$Receipt.checksumSha256
+            manifestName = [string]$Receipt.manifestName
+            manifestSha256 = [string]$Receipt.manifestSha256
+            version = [string]$Receipt.version
+            gitCommit = [string]$Receipt.gitCommit
+            origin = 'InternetDownload'
+            workflowArtifactIdentity = $null
+            zoneId = 3
+            defenderServiceEnabled = $true
+            antivirusEnabled = $true
+            realTimeProtectionEnabled = $true
+            defenderPlatformVersion = [string]$Receipt.defenderPlatformVersion
+            defenderEngineVersion = [string]$Receipt.defenderEngineVersion
+            signatureVersion = [string]$Receipt.signatureVersion
+            signatureUpdatedAtUtc = [string]$Receipt.signatureUpdatedAtUtc
+            scanStartedAtUtc = [string]$Receipt.scanStartedAtUtc
+            scanCompletedAtUtc = [string]$Receipt.scanCompletedAtUtc
+            detectionCount = 0
+            outcome = 'Completed'
+            errorCode = $null
+        }
+    } catch {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_DEFENDER_RECEIPT_INVALID' 'The official downloaded-asset Defender receipt is missing, mismatched, or incomplete.' $null
+    }
+}
+
+function ConvertTo-CcodOfficialDraftDefenderReceipt {
+    param([Parameter(Mandatory)]$Receipt, [Parameter(Mandatory)]$Candidate, [Parameter(Mandatory)][string]$AssetType)
+    $normalized = Assert-CcodOfficialDraftDefenderReceipt -Receipt $Receipt -Candidate $Candidate -AssetType $AssetType
+    return $normalized
+}
+
+function Test-CcodOfficialDraftPositiveInteger {
+    param($Value)
+    if (-not (Test-CcodOfficialDraftIntegerValue $Value)) { return $false }
+    try { return [UInt64]$Value -gt 0 } catch { return $false }
+}
+
+function ConvertTo-CcodOfficialDraftTrayHostIdentity {
+    param([Parameter(Mandatory)]$Value)
+    try {
+        if (-not (Test-CcodOfficialDraftExactProperties -Value $Value -Expected @('pid','creationTimeUtc')) -or
+            -not (Test-CcodOfficialDraftIntegerValue $Value.pid) -or [UInt64]$Value.pid -le 0 -or [UInt64]$Value.pid -gt [UInt64][int]::MaxValue -or
+            $Value.creationTimeUtc -isnot [string] -or -not (Test-CcodOfficialDraftCanonicalUtc $Value.creationTimeUtc)) { throw 'tray host identity' }
+        return [pscustomobject][ordered]@{ pid = [int]$Value.pid; creationTimeUtc = [string]$Value.creationTimeUtc }
+    } catch {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'TrayHost identity is missing or malformed.' $null
+    }
+}
+
+function ConvertTo-CcodOfficialDraftSafeProcessIdentity {
+    param([Parameter(Mandatory)]$Value,[Parameter(Mandatory)][string]$Label)
+    if ($null -eq $Value -or -not (Test-CcodOfficialDraftExactProperties -Value $Value -Expected @('pid','creationTimeUtc')) -or
+        -not (Test-CcodOfficialDraftPositiveInteger $Value.pid) -or [UInt64]$Value.pid -gt [UInt64][int]::MaxValue -or
+        $Value.creationTimeUtc -isnot [string] -or -not (Test-CcodOfficialDraftCanonicalUtc $Value.creationTimeUtc)) { throw "$Label identity" }
+    return [pscustomobject][ordered]@{ pid = [int]$Value.pid; creationTimeUtc = [string]$Value.creationTimeUtc }
+}
+
+function ConvertTo-CcodOfficialDraftLegacyObservation {
+    param([Parameter(Mandatory)]$Facts,[Parameter(Mandatory)][string]$ExpectedVersion)
+    try {
+        $required = @('installRootPresent','installReady','appRootPresent','runtimeRootPresent','activePointerPresent','activeRuntimeId','activeGeneration','runtimeManifestSha256','supervisor','trayHost','codex','trayHostIdentity','trayAuthenticated','taskState','statusPhase','statusRuntimeId','statusCodex','transitionStage','lifecycleReceipt','aboutVersion','deviceKeyPresent','deviceKeySha256','shortcuts','debugPorts','debugEndpoints','protectionReady','bootId')
+        foreach ($name in $required) {
+            if (-not (Test-CcodOfficialDraftHasFact -Facts $Facts -Name $name)) { throw 'legacy observation shape' }
+        }
+        foreach ($name in @('installRootPresent','installReady','appRootPresent','runtimeRootPresent','activePointerPresent','trayAuthenticated','deviceKeyPresent','protectionReady')) {
+            $value = Get-CcodOfficialDraftFactValue -Facts $Facts -Name $name
+            if ($value -isnot [bool] -or -not [bool]$value) { throw 'legacy observation readiness' }
+        }
+        $activeRuntimeId = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'activeRuntimeId'
+        $activeGeneration = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'activeGeneration'
+        $manifestHash = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'runtimeManifestSha256'
+        if ($activeRuntimeId -isnot [string] -or $activeRuntimeId -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z' -or
+            -not (Test-CcodOfficialDraftPositiveInteger $activeGeneration) -or
+            -not (Test-CcodOfficialDraftHash $manifestHash)) { throw 'legacy observation runtime' }
+        $aboutVersion = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'aboutVersion'
+        $statusPhase = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'statusPhase'
+        $statusRuntimeId = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'statusRuntimeId'
+        $taskState = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'taskState'
+        $transitionStage = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'transitionStage'
+        $bootId = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'bootId'
+        if ($aboutVersion -isnot [string] -or $aboutVersion -cne $ExpectedVersion -or
+            $statusPhase -isnot [string] -or $statusPhase -cne 'Active' -or
+            $statusRuntimeId -isnot [string] -or $statusRuntimeId -cne $activeRuntimeId -or
+            $taskState -isnot [string] -or $taskState -notin @('Ready','Running') -or
+            $transitionStage -isnot [string] -or $transitionStage -cne 'Idle' -or
+            $bootId -isnot [string] -or $bootId -notmatch '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}\z') { throw 'legacy observation status' }
+        $supervisor = [Collections.Generic.List[object]]::new()
+        foreach ($record in @((Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'supervisor'))) { [void]$supervisor.Add((ConvertTo-CcodOfficialDraftSafeProcessIdentity -Value $record -Label 'supervisor')) }
+        $trayHost = [Collections.Generic.List[object]]::new()
+        foreach ($record in @((Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'trayHost'))) { [void]$trayHost.Add((ConvertTo-CcodOfficialDraftSafeProcessIdentity -Value $record -Label 'tray host')) }
+        $codex = [Collections.Generic.List[object]]::new()
+        foreach ($record in @((Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'codex'))) { [void]$codex.Add((ConvertTo-CcodOfficialDraftSafeProcessIdentity -Value $record -Label 'codex')) }
+        if ($supervisor.Count -ne 1 -or $trayHost.Count -ne 1 -or $codex.Count -ne 1) { throw 'legacy observation process count' }
+        $trayIdentity = ConvertTo-CcodOfficialDraftTrayHostIdentity -Value (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'trayHostIdentity')
+        if ($trayIdentity.pid -ne $trayHost[0].pid -or $trayIdentity.creationTimeUtc -cne $trayHost[0].creationTimeUtc) { throw 'legacy observation tray identity' }
+        $statusCodex = ConvertTo-CcodOfficialDraftSafeProcessIdentity -Value (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'statusCodex') -Label 'status codex'
+        if ($statusCodex.pid -ne $codex[0].pid -or $statusCodex.creationTimeUtc -cne $codex[0].creationTimeUtc) { throw 'legacy observation codex identity' }
+        $terminal = ConvertTo-CcodOfficialDraftTerminalReceipt -Receipt (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'lifecycleReceipt')
+        if ($terminal.runtimeId -cne $activeRuntimeId -or [UInt64]$terminal.runtimeGeneration -ne [UInt64]$activeGeneration) { throw 'legacy observation receipt' }
+        $shortcuts = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'shortcuts'
+        if (-not (Test-CcodOfficialDraftExactProperties -Value $shortcuts -Expected @('startMenu','desktop')) -or
+            $shortcuts.startMenu -isnot [bool] -or -not [bool]$shortcuts.startMenu -or
+            $shortcuts.desktop -isnot [bool] -or -not [bool]$shortcuts.desktop) { throw 'legacy observation shortcuts' }
+        $debugPorts = @((Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'debugPorts'))
+        if ($debugPorts.Count -ne 2 -or @($debugPorts | Sort-Object -Unique).Count -ne 2) { throw 'legacy observation debug ports' }
+        foreach ($port in $debugPorts) {
+            if (-not (Test-CcodOfficialDraftPositiveInteger $port) -or [UInt64]$port -gt 65535) { throw 'legacy observation debug port' }
+        }
+        $debugEndpoints = @((Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'debugEndpoints'))
+        [void](Assert-CcodOfficialDraftDebugEndpointOwnership -Endpoints $debugEndpoints -ExpectedPorts ([int[]]$debugPorts) -ExpectedPid $codex[0].pid -ExpectedCreationTimeUtc $codex[0].creationTimeUtc)
+        $keyHash = Get-CcodOfficialDraftObservedKeyHash -Facts $Facts
+        if (-not (Test-CcodOfficialDraftHash $keyHash)) { throw 'legacy observation key' }
+        return [pscustomobject][ordered]@{
+            version = $ExpectedVersion
+            bootId = [string]$bootId
+            installRootPresent = $true
+            installReady = $true
+            appRootPresent = $true
+            runtimeRootPresent = $true
+            activePointerPresent = $true
+            activeRuntimeId = [string]$activeRuntimeId
+            activeGeneration = [UInt64]$activeGeneration
+            runtimeManifestSha256 = [string]$manifestHash
+            supervisor = @($supervisor)
+            trayHost = @($trayHost)
+            codex = @($codex)
+            trayHostIdentity = $trayIdentity
+            trayAuthenticated = $true
+            taskState = [string]$taskState
+            statusPhase = 'Active'
+            statusRuntimeId = [string]$statusRuntimeId
+            statusCodex = $statusCodex
+            transitionStage = 'Idle'
+            lifecycleReceipt = $terminal
+            aboutVersion = $ExpectedVersion
+            deviceKeyPresent = $true
+            deviceKeySha256 = [string]$keyHash
+            shortcuts = [pscustomobject][ordered]@{ startMenu = $true; desktop = $true }
+            debugPorts = [int[]]$debugPorts
+            debugEndpoints = @($debugEndpoints)
+            protectionReady = $true
+        }
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE' 'Installed lifecycle readiness could not be proven for the legacy upgrade boundary.' $null
+    }
+}
+
+function Assert-CcodOfficialDraftPersistedPhaseFacts {
+    param([Parameter(Mandatory)][string]$Phase,[Parameter(Mandatory)]$Facts)
+    try {
+        switch ($Phase) {
+            'LegacyUpgrade' {
+                if (-not (Test-CcodOfficialDraftExactProperties -Value $Facts -Expected @('previousSetup','before','after','deviceKeySha256Before','deviceKeySha256After','keyHashPreserved','operationOutcome')) -or
+                    -not (Test-CcodOfficialDraftExactProperties -Value $Facts.previousSetup -Expected @('version','gitCommit','assetSha256','manifestSha256')) -or
+                    $Facts.previousSetup.version -cne '2.5.21' -or -not (Test-CcodOfficialDraftCommit $Facts.previousSetup.gitCommit) -or
+                    -not (Test-CcodOfficialDraftHash $Facts.previousSetup.assetSha256) -or -not (Test-CcodOfficialDraftHash $Facts.previousSetup.manifestSha256) -or
+                    -not (Test-CcodOfficialDraftHash $Facts.deviceKeySha256Before) -or -not (Test-CcodOfficialDraftHash $Facts.deviceKeySha256After) -or
+                    $Facts.deviceKeySha256Before -cne $Facts.deviceKeySha256After -or $Facts.keyHashPreserved -isnot [bool] -or
+                    -not [bool]$Facts.keyHashPreserved -or $Facts.operationOutcome -isnot [string] -or $Facts.operationOutcome -cne 'Completed') { throw 'legacy facts' }
+                $before = ConvertTo-CcodOfficialDraftLegacyObservation -Facts $Facts.before -ExpectedVersion '2.5.21'
+                $after = ConvertTo-CcodOfficialDraftLegacyObservation -Facts $Facts.after -ExpectedVersion $script:CcodOfficialDraftExpectedVersion
+                if ($before.deviceKeySha256 -cne [string]$Facts.deviceKeySha256Before -or $after.deviceKeySha256 -cne [string]$Facts.deviceKeySha256After) { throw 'legacy observation key binding' }
+                return [pscustomobject][ordered]@{
+                    previousSetup = $Facts.previousSetup
+                    before = $before
+                    after = $after
+                    deviceKeySha256Before = [string]$Facts.deviceKeySha256Before
+                    deviceKeySha256After = [string]$Facts.deviceKeySha256After
+                    keyHashPreserved = $true
+                    operationOutcome = 'Completed'
+                }
+            }
+            'Uninstall' {
+                if (-not (Test-CcodOfficialDraftExactProperties -Value $Facts -Expected @('stateRemoved','installRootPresent','appRootPresent','runtimeRootPresent','activePointerPresent','taskState','supervisorCount','trayHostCount','codexCount','shortcuts','debugEndpointsGone','deviceKeySha256Before','deviceKeySha256After','keyHashPreserved','operationOutcome')) -or
+                    $Facts.stateRemoved -isnot [bool] -or -not $Facts.stateRemoved -or
+                    $Facts.installRootPresent -isnot [bool] -or $Facts.installRootPresent -or
+                    $Facts.appRootPresent -isnot [bool] -or $Facts.appRootPresent -or $Facts.runtimeRootPresent -isnot [bool] -or $Facts.runtimeRootPresent -or
+                    $Facts.activePointerPresent -isnot [bool] -or $Facts.activePointerPresent -or $Facts.taskState -isnot [string] -or $Facts.taskState -cne 'Absent' -or
+                    -not (Test-CcodOfficialDraftInt32 $Facts.supervisorCount) -or $Facts.supervisorCount -ne 0 -or -not (Test-CcodOfficialDraftInt32 $Facts.trayHostCount) -or $Facts.trayHostCount -ne 0 -or
+                    -not (Test-CcodOfficialDraftInt32 $Facts.codexCount) -or $Facts.codexCount -ne 0 -or
+                    $Facts.debugEndpointsGone -isnot [bool] -or -not $Facts.debugEndpointsGone -or
+                    -not (Test-CcodOfficialDraftExactProperties -Value $Facts.shortcuts -Expected @('startMenu','desktop')) -or
+                    $Facts.shortcuts.startMenu -isnot [bool] -or $Facts.shortcuts.startMenu -or $Facts.shortcuts.desktop -isnot [bool] -or $Facts.shortcuts.desktop -or
+                    -not (Test-CcodOfficialDraftHash $Facts.deviceKeySha256Before) -or -not (Test-CcodOfficialDraftHash $Facts.deviceKeySha256After) -or
+                    $Facts.deviceKeySha256Before -cne $Facts.deviceKeySha256After -or $Facts.keyHashPreserved -isnot [bool] -or -not $Facts.keyHashPreserved -or
+                    $Facts.operationOutcome -isnot [string] -or $Facts.operationOutcome -cne 'Completed') { throw 'uninstall facts' }
+            }
+            'FreshInstall' {
+                if (-not (Test-CcodOfficialDraftExactProperties -Value $Facts -Expected @('installRootPresent','installReady','activePointerPresent','activeRuntimeId','activeGeneration','runtimeManifestSha256','supervisorCount','trayHostCount','codexCount','trayHostIdentity','trayAuthenticated','taskState','terminalReceipt','protectionReady','deviceKeySha256','operationOutcome')) -or
+                    $Facts.installRootPresent -isnot [bool] -or -not $Facts.installRootPresent -or
+                    $Facts.installReady -isnot [bool] -or -not $Facts.installReady -or $Facts.activePointerPresent -isnot [bool] -or -not $Facts.activePointerPresent -or
+                    $Facts.activeRuntimeId -isnot [string] -or $Facts.activeRuntimeId -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z' -or
+                    -not (Test-CcodOfficialDraftPositiveInteger $Facts.activeGeneration) -or -not (Test-CcodOfficialDraftHash $Facts.runtimeManifestSha256) -or
+                    -not (Test-CcodOfficialDraftInt32 $Facts.supervisorCount) -or $Facts.supervisorCount -ne 1 -or -not (Test-CcodOfficialDraftInt32 $Facts.trayHostCount) -or $Facts.trayHostCount -ne 1 -or
+                    -not (Test-CcodOfficialDraftInt32 $Facts.codexCount) -or $Facts.codexCount -ne 1 -or
+                    $Facts.trayAuthenticated -isnot [bool] -or -not $Facts.trayAuthenticated -or $Facts.taskState -notin @('Ready','Running') -or
+                    $Facts.protectionReady -isnot [bool] -or -not $Facts.protectionReady -or -not (Test-CcodOfficialDraftHash $Facts.deviceKeySha256)) { throw 'fresh facts' }
+                $trayIdentity = ConvertTo-CcodOfficialDraftTrayHostIdentity -Value $Facts.trayHostIdentity
+                $terminal = ConvertTo-CcodOfficialDraftTerminalReceipt -Receipt $Facts.terminalReceipt
+                if ($terminal.runtimeId -cne $Facts.activeRuntimeId -or [UInt64]$terminal.runtimeGeneration -ne [UInt64]$Facts.activeGeneration -or
+                    $Facts.operationOutcome -isnot [string] -or $Facts.operationOutcome -cne 'Completed') { throw 'fresh receipt binding' }
+            }
+            'PreReboot' {
+                if (-not (Test-CcodOfficialDraftExactProperties -Value $Facts -Expected @('rebootRequested','bootIdBefore','freshInstallReceiptSha256','activeRuntimeId','activeGeneration','runtimeManifestSha256','deviceKeySha256','operationOutcome','observation')) -or
+                    $Facts.rebootRequested -isnot [bool] -or -not $Facts.rebootRequested -or
+                    $Facts.bootIdBefore -isnot [string] -or $Facts.bootIdBefore -notmatch '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}\z' -or
+                    -not (Test-CcodOfficialDraftHash $Facts.freshInstallReceiptSha256) -or $Facts.activeRuntimeId -isnot [string] -or
+                    $Facts.activeRuntimeId -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z' -or -not (Test-CcodOfficialDraftPositiveInteger $Facts.activeGeneration) -or
+                    -not (Test-CcodOfficialDraftHash $Facts.runtimeManifestSha256) -or
+                    -not (Test-CcodOfficialDraftHash $Facts.deviceKeySha256) -or $Facts.operationOutcome -isnot [string] -or $Facts.operationOutcome -cne 'Completed') { throw 'pre facts' }
+                $observation = ConvertTo-CcodOfficialDraftLegacyObservation -Facts $Facts.observation -ExpectedVersion $script:CcodOfficialDraftExpectedVersion
+                if ($observation.bootId -cne $Facts.bootIdBefore -or $observation.activeRuntimeId -cne $Facts.activeRuntimeId -or
+                    [UInt64]$observation.activeGeneration -ne [UInt64]$Facts.activeGeneration -or
+                    $observation.runtimeManifestSha256 -cne $Facts.runtimeManifestSha256 -or
+                    $observation.deviceKeySha256 -cne $Facts.deviceKeySha256) { throw 'pre observation continuity' }
+                $Facts.observation = $observation
+            }
+            'PostReboot' {
+                if (-not (Test-CcodOfficialDraftExactProperties -Value $Facts -Expected @('observation','installRootPresent','activePointerPresent','bootIdBefore','bootIdAfter','bootChanged','receiptContinuity','activeRuntimeId','activeGeneration','runtimeManifestSha256','transitionStage','protectionRecovered','protectionReady','taskState','supervisorCount','trayHostCount','codexCount','trayHostIdentity','trayAuthenticated','terminalReceipt','deviceKeySha256','keyHashPreserved','operationOutcome')) -or
+                    $Facts.installRootPresent -isnot [bool] -or -not $Facts.installRootPresent -or $Facts.activePointerPresent -isnot [bool] -or -not $Facts.activePointerPresent -or
+                    $Facts.bootIdBefore -isnot [string] -or $Facts.bootIdBefore -notmatch '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}\z' -or
+                    $Facts.bootIdAfter -isnot [string] -or $Facts.bootIdAfter -notmatch '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}\z' -or $Facts.bootIdAfter -ceq $Facts.bootIdBefore -or
+                    $Facts.bootChanged -isnot [bool] -or -not $Facts.bootChanged -or $Facts.receiptContinuity -isnot [bool] -or -not $Facts.receiptContinuity -or
+                    $Facts.activeRuntimeId -isnot [string] -or $Facts.activeRuntimeId -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z' -or
+                    -not (Test-CcodOfficialDraftPositiveInteger $Facts.activeGeneration) -or -not (Test-CcodOfficialDraftHash $Facts.runtimeManifestSha256) -or $Facts.transitionStage -isnot [string] -or $Facts.transitionStage -cne 'Idle' -or
+                    $Facts.protectionRecovered -isnot [bool] -or -not $Facts.protectionRecovered -or $Facts.protectionReady -isnot [bool] -or -not $Facts.protectionReady -or
+                    $Facts.taskState -notin @('Ready','Running') -or -not (Test-CcodOfficialDraftInt32 $Facts.supervisorCount) -or $Facts.supervisorCount -ne 1 -or
+                    -not (Test-CcodOfficialDraftInt32 $Facts.trayHostCount) -or $Facts.trayHostCount -ne 1 -or -not (Test-CcodOfficialDraftInt32 $Facts.codexCount) -or $Facts.codexCount -ne 1 -or $Facts.trayAuthenticated -isnot [bool] -or -not $Facts.trayAuthenticated -or
+                    -not (Test-CcodOfficialDraftHash $Facts.deviceKeySha256) -or $Facts.keyHashPreserved -isnot [bool] -or -not $Facts.keyHashPreserved -or
+                    $Facts.operationOutcome -isnot [string] -or $Facts.operationOutcome -cne 'Completed') { throw 'post facts' }
+                $trayIdentity = ConvertTo-CcodOfficialDraftTrayHostIdentity -Value $Facts.trayHostIdentity
+                $null = ConvertTo-CcodOfficialDraftTerminalReceipt -Receipt $Facts.terminalReceipt
+                $observation = ConvertTo-CcodOfficialDraftLegacyObservation -Facts $Facts.observation -ExpectedVersion $script:CcodOfficialDraftExpectedVersion
+                $observationTrayIdentity = ConvertTo-CcodOfficialDraftTrayHostIdentity -Value $observation.trayHostIdentity
+                if ($trayIdentity.pid -ne $observationTrayIdentity.pid -or $trayIdentity.creationTimeUtc -cne $observationTrayIdentity.creationTimeUtc) { throw 'post tray identity binding' }
+                if ($observation.bootId -cne $Facts.bootIdAfter -or $observation.activeRuntimeId -cne $Facts.activeRuntimeId -or
+                    [UInt64]$observation.activeGeneration -ne [UInt64]$Facts.activeGeneration -or
+                    $observation.runtimeManifestSha256 -cne $Facts.runtimeManifestSha256 -or
+                    $observation.deviceKeySha256 -cne $Facts.deviceKeySha256) { throw 'post observation continuity' }
+                $Facts.observation = $observation
+            }
+            'ReadyForManualEvidence' {
+                if (-not (Test-CcodOfficialDraftExactProperties -Value $Facts -Expected @('automatedPhases','status','manualEvidencePending','complete','manualChallenge')) -or
+                    (@($Facts.automatedPhases).Count -ne 6) -or
+                    ((@($Facts.automatedPhases) -join "`0") -cne (@('Preflight','LegacyUpgrade','Uninstall','FreshInstall','PreReboot','PostReboot') -join "`0")) -or
+                    $Facts.status -isnot [string] -or $Facts.status -cne 'ReadyForManualEvidence' -or
+                    $Facts.manualEvidencePending -isnot [bool] -or -not $Facts.manualEvidencePending -or $Facts.complete -isnot [bool] -or $Facts.complete -or
+                    $Facts.manualChallenge -isnot [string] -or $Facts.manualChallenge -cnotmatch '^[0-9a-f]{32}\z') { throw 'ready facts' }
+            }
+            default { throw 'phase facts' }
+        }
+        return $Facts
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'An official-draft phase receipt contains invalid bounded facts.' $null
+    }
+}
+
+function Assert-CcodOfficialDraftReceiptShape {
+    param([Parameter(Mandatory)]$Receipt, [Parameter(Mandatory)][string]$ExpectedPhase)
+    try {
+        if (-not (Test-CcodOfficialDraftExactProperties -Value $Receipt -Expected $script:CcodOfficialDraftReceiptFields) -or
+            -not (Test-CcodOfficialDraftInt32 $Receipt.schemaVersion) -or $Receipt.schemaVersion -ne 1 -or
+            $Receipt.phase -isnot [string] -or $Receipt.phase -cne $ExpectedPhase) { throw 'frame' }
+        $candidate = ConvertTo-CcodOfficialDraftPersistedCandidate -Value $Receipt.candidate
+        if (-not (Test-CcodOfficialDraftExactProperties -Value $Receipt.draft -Expected @('tag','id'))) { throw 'draft' }
+        $draft = ConvertTo-CcodOfficialDraftIdentity -Value $Receipt.draft
+        if ($null -eq $Receipt.facts -or $Receipt.facts -isnot [pscustomobject]) { throw 'facts' }
+        if ($ExpectedPhase -ceq 'Preflight') {
+            if (-not (Test-CcodOfficialDraftExactProperties -Value $Receipt.facts -Expected @('defenderReceipts'))) { throw 'preflight facts' }
+            $defenders = @($Receipt.facts.defenderReceipts)
+            if ($defenders.Count -ne 2) { throw 'defender count' }
+            $first = Assert-CcodOfficialDraftDefenderReceipt -Receipt $defenders[0] -Candidate $candidate -AssetType Setup
+            $second = Assert-CcodOfficialDraftDefenderReceipt -Receipt $defenders[1] -Candidate $candidate -AssetType PortableZip
+            return [pscustomobject][ordered]@{
+                schemaVersion = 1
+                phase = $ExpectedPhase
+                candidate = $candidate
+                draft = $draft
+                facts = [pscustomobject][ordered]@{ defenderReceipts = @($first,$second) }
+            }
+        }
+        if ($ExpectedPhase -ceq 'Complete') {
+            if (-not (Test-CcodOfficialDraftExactProperties -Value $Receipt.facts -Expected @('manualEvidence','status','complete')) -or
+                $Receipt.facts.status -isnot [string] -or $Receipt.facts.status -cne 'Complete' -or
+                $Receipt.facts.complete -isnot [bool] -or -not [bool]$Receipt.facts.complete) { throw 'complete facts' }
+            $manual = Assert-CcodOfficialDraftManualEvidenceSet -Records $Receipt.facts.manualEvidence -Candidate $candidate
+            return [pscustomobject][ordered]@{
+                schemaVersion = 1
+                phase = $ExpectedPhase
+                candidate = $candidate
+                draft = $draft
+                facts = [pscustomobject][ordered]@{ manualEvidence = @($manual); status = 'Complete'; complete = $true }
+            }
+        }
+        $normalizedFacts = Assert-CcodOfficialDraftPersistedPhaseFacts -Phase $ExpectedPhase -Facts $Receipt.facts
+        return [pscustomobject][ordered]@{ schemaVersion = 1; phase = $ExpectedPhase; candidate = $candidate; draft = $draft; facts = $normalizedFacts }
+    } catch {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'An official-draft acceptance receipt is malformed or tampered.' $null
+    }
+}
+
+function ConvertTo-CcodOfficialDraftTrayProof {
+    param([Parameter(Mandatory)]$Proof,[Parameter(Mandatory)][string]$Operation)
+    try {
+        $allowed = @{
+            About = @('ShowAbout')
+            Language = @('SetLanguageSystem','SetLanguageChinese','SetLanguageEnglish')
+            OpenLogs = @('OpenLogs')
+            Repair = @('CheckAndRepair')
+        }
+        if ($null -eq $Proof -or -not (Test-CcodOfficialDraftExactProperties -Value $Proof -Expected @('timestampUtc','command','revision','code','status')) -or
+            $Proof.timestampUtc -isnot [string] -or $Proof.command -isnot [string] -or
+            -not $allowed.ContainsKey($Operation) -or $allowed[$Operation] -cnotcontains [string]$Proof.command -or
+            -not (Test-CcodOfficialDraftPositiveInteger $Proof.revision) -or
+            $Proof.code -isnot [string] -or $Proof.code -cne 'CCOD_TRAY_ACTION_COMPLETED' -or
+            $Proof.status -isnot [string] -or $Proof.status -cne 'Completed') { throw 'tray proof' }
+        if (-not (Test-CcodOfficialDraftCanonicalUtc $Proof.timestampUtc)) { throw 'tray timestamp' }
+        return [pscustomobject][ordered]@{
+            timestampUtc = [string]$Proof.timestampUtc
+            command = [string]$Proof.command
+            revision = [UInt64]$Proof.revision
+            code = 'CCOD_TRAY_ACTION_COMPLETED'
+            status = 'Completed'
+        }
+    } catch {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'Tray operation proof is malformed or not bound to the requested operation.' $null
+    }
+}
+
+function ConvertTo-CcodOfficialDraftRemoteProof {
+    param([Parameter(Mandatory)]$Proof)
+    try {
+        $expected = @('schemaVersion','timestampUtc','kind','operation','deviceRole','challenge','candidateVersion','runtimeId','runtimeGeneration','runtimeManifestSha256','attestation','connection','control','outcome','code')
+        if ($null -eq $Proof -or -not (Test-CcodOfficialDraftExactProperties -Value $Proof -Expected $expected) -or
+            -not (Test-CcodOfficialDraftIntegerValue $Proof.schemaVersion) -or [int64]$Proof.schemaVersion -ne 1 -or
+            $Proof.timestampUtc -isnot [string] -or
+            $Proof.kind -isnot [string] -or $Proof.kind -cne 'remote-control-manual-proof' -or
+            $Proof.operation -isnot [string] -or $Proof.operation -cne 'SecondDeviceControl' -or
+            $Proof.deviceRole -isnot [string] -or $Proof.deviceRole -cne 'SecondDevice' -or
+            $Proof.challenge -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$Proof.challenge) -or
+            $Proof.candidateVersion -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$Proof.candidateVersion) -or
+            $Proof.runtimeId -isnot [string] -or $Proof.runtimeId -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z' -or
+            -not (Test-CcodOfficialDraftPositiveInteger $Proof.runtimeGeneration) -or
+            $Proof.runtimeManifestSha256 -isnot [string] -or -not (Test-CcodOfficialDraftHash $Proof.runtimeManifestSha256) -or
+            $Proof.attestation -isnot [string] -or $Proof.attestation -cne 'HumanReviewedStructuredAttestation' -or
+            $Proof.connection -isnot [string] -or $Proof.connection -cne 'Connected' -or
+            $Proof.control -isnot [string] -or $Proof.control -cne 'Completed' -or
+            $Proof.outcome -isnot [string] -or $Proof.outcome -cne 'Completed' -or
+            $Proof.code -isnot [string] -or $Proof.code -cne 'CCOD_REMOTE_ACTION_COMPLETED') { throw 'remote proof' }
+        if (-not (Test-CcodOfficialDraftCanonicalUtc $Proof.timestampUtc)) { throw 'remote timestamp' }
+        return [pscustomobject][ordered]@{
+            schemaVersion = 1
+            timestampUtc = [string]$Proof.timestampUtc
+            kind = 'remote-control-manual-proof'
+            operation = 'SecondDeviceControl'
+            deviceRole = 'SecondDevice'
+            challenge = [string]$Proof.challenge
+            candidateVersion = [string]$Proof.candidateVersion
+            runtimeId = [string]$Proof.runtimeId
+            runtimeGeneration = [UInt64]$Proof.runtimeGeneration
+            runtimeManifestSha256 = [string]$Proof.runtimeManifestSha256
+            attestation = 'HumanReviewedStructuredAttestation'
+            connection = 'Connected'
+            control = 'Completed'
+            outcome = 'Completed'
+            code = 'CCOD_REMOTE_ACTION_COMPLETED'
+        }
+    } catch {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_REMOTE_UNPROVEN' 'Second-device proof is malformed or does not prove a completed connection and control.' $null
+    }
+}
+
+function Assert-CcodOfficialDraftManualRecordShape {
+    param([Parameter(Mandatory)]$Record)
+    try {
+        if (-not (Test-CcodOfficialDraftExactProperties -Value $Record -Expected $script:CcodOfficialDraftManualRecordFields) -or
+            -not (Test-CcodOfficialDraftInt32 $Record.schemaVersion) -or $Record.schemaVersion -ne 1 -or
+            $Record.kind -isnot [string] -or $Record.kind -cne 'manual-evidence' -or
+            $Record.phase -isnot [string] -or $Record.phase -cnotin @('TrayEvidence','RemoteEvidence') -or
+            $Record.operation -isnot [string] -or -not $script:CcodOfficialDraftManualFiles.ContainsKey($Record.operation) -or
+            $Record.terminalState -isnot [string] -or $Record.terminalState -cne [string]$script:CcodOfficialDraftManualTerminalStates[$Record.operation] -or
+            $Record.result -isnot [string] -or $Record.result -cne [string]$script:CcodOfficialDraftManualResultCodes[$Record.operation] -or
+            $Record.reviewState -isnot [string] -or $Record.reviewState -cne 'Reviewed' -or
+            $Record.version -isnot [string] -or $Record.version -cne $script:CcodOfficialDraftExpectedVersion -or
+            -not (Test-CcodOfficialDraftCommit $Record.gitCommit) -or
+            -not (Test-CcodOfficialDraftHash $Record.candidateManifestSha256) -or
+            -not (Test-CcodOfficialDraftHash $Record.screenshotSha256) -or
+            -not (Test-CcodOfficialDraftHash $Record.redactedLogSha256) -or
+            $Record.screenshotSha256 -ceq $Record.redactedLogSha256) { throw 'manual record' }
+        if (($Record.phase -ceq 'TrayEvidence' -and $Record.operation -ceq 'SecondDeviceControl') -or
+            ($Record.phase -ceq 'RemoteEvidence' -and $Record.operation -cne 'SecondDeviceControl')) { throw 'manual phase' }
+        $proof = $null
+        if ($Record.operation -ceq 'SecondDeviceControl') { $proof = ConvertTo-CcodOfficialDraftRemoteProof -Proof $Record.proof } else { $proof = ConvertTo-CcodOfficialDraftTrayProof -Proof $Record.proof -Operation ([string]$Record.operation) }
+        return [pscustomobject][ordered]@{
+            schemaVersion = 1
+            kind = 'manual-evidence'
+            phase = [string]$Record.phase
+            operation = [string]$Record.operation
+            terminalState = [string]$Record.terminalState
+            result = [string]$Record.result
+            proof = $proof
+            reviewState = 'Reviewed'
+            version = [string]$Record.version
+            gitCommit = [string]$Record.gitCommit
+            candidateManifestSha256 = [string]$Record.candidateManifestSha256
+            screenshotSha256 = [string]$Record.screenshotSha256
+            redactedLogSha256 = [string]$Record.redactedLogSha256
+        }
+    } catch {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'Manual evidence is malformed, unreviewed, or not operation-bound.' $null
+    }
+}
+
+function Assert-CcodOfficialDraftManualEvidenceSet {
+    param([Parameter(Mandatory)]$Records, [Parameter(Mandatory)]$Candidate)
+    try {
+        $values = if ($Records -is [Collections.IDictionary]) { @($Records.Values) } else { @($Records) }
+        $expectedOperations = @('About','Language','OpenLogs','Repair','SecondDeviceControl')
+        if ($values.Count -ne $expectedOperations.Count) { throw 'manual count' }
+        $normalized = [Collections.Generic.List[object]]::new()
+        $seenOperations = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+        $seenHashes = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+        foreach ($operation in $expectedOperations) {
+            $matches = @($values | Where-Object { $_.operation -ceq $operation })
+            if ($matches.Count -ne 1) { throw 'manual operation' }
+            $record = Assert-CcodOfficialDraftManualRecordShape -Record $matches[0]
+            if (-not $seenOperations.Add($record.operation) -or
+                $record.version -cne $Candidate.version -or $record.gitCommit -cne $Candidate.gitCommit -or
+                $record.candidateManifestSha256 -cne $Candidate.manifestHashes.portable -or
+                ($record.operation -ceq 'SecondDeviceControl' -and ($record.proof.candidateVersion -isnot [string] -or $record.proof.candidateVersion -cne $Candidate.version)) -or
+                -not $seenHashes.Add($record.screenshotSha256) -or -not $seenHashes.Add($record.redactedLogSha256)) { throw 'manual binding' }
+            $normalized.Add($record)
+        }
+        return @($normalized)
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INCOMPLETE' 'All four tray records and the distinct second-device record are required.' $null
+    }
+}
+
+function Read-CcodOfficialDraftState {
+    param([Parameter(Mandatory)][string]$StateDirectory,[string]$PreviousAssetDirectory)
+    [void](Assert-CcodOfficialDraftSafeDirectory -Path $StateDirectory -ErrorId 'CCOD_ACCEPTANCE_RECEIPT_INVALID')
+    [void](Repair-CcodOfficialDraftOrphanTemporaryFiles -StateDirectory $StateDirectory)
+    $records = @{}
+    try { $children = @(Get-ChildItem -LiteralPath $StateDirectory -Force -ErrorAction Stop) } catch { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'Official-draft acceptance state could not be enumerated safely.' $null }
+    $allowed = @($script:CcodOfficialDraftPhaseFiles.Values) + @($script:CcodOfficialDraftCompletionFile,$script:CcodOfficialDraftManualDirectoryName)
+    foreach ($child in $children) {
+        if (($child.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0 -or
+            $allowed -cnotcontains [string]$child.Name -or
+            ([string]$child.Name -ceq $script:CcodOfficialDraftManualDirectoryName -and -not $child.PSIsContainer) -or
+            ([string]$child.Name -cne $script:CcodOfficialDraftManualDirectoryName -and $child.PSIsContainer)) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'Official-draft acceptance state contains an unexpected entry.' $null
+        }
+    }
+    foreach ($phase in $script:CcodOfficialDraftPhases) {
+        $path = Join-Path $StateDirectory $script:CcodOfficialDraftPhaseFiles[$phase]
+        if (-not (Get-CcodOfficialDraftOptionalPathState -Path $path -ExpectDirectory $false -GetItem { param($CandidatePath) Get-Item -LiteralPath $CandidatePath -Force -ErrorAction Stop } -ErrorId 'CCOD_ACCEPTANCE_RECEIPT_INVALID')) { continue }
+        $json = Read-CcodOfficialDraftJson -Path $path
+        $records[$phase] = Assert-CcodOfficialDraftReceiptShape -Receipt $json.Value -ExpectedPhase $phase
+    }
+    $completePath = Join-Path $StateDirectory $script:CcodOfficialDraftCompletionFile
+    if (Get-CcodOfficialDraftOptionalPathState -Path $completePath -ExpectDirectory $false -GetItem { param($CandidatePath) Get-Item -LiteralPath $CandidatePath -Force -ErrorAction Stop } -ErrorId 'CCOD_ACCEPTANCE_RECEIPT_INVALID') {
+        $json = Read-CcodOfficialDraftJson -Path $completePath
+        $records['Complete'] = Assert-CcodOfficialDraftReceiptShape -Receipt $json.Value -ExpectedPhase 'Complete'
+    }
+    $manual = @{}
+    $manualDirectory = Join-Path $StateDirectory $script:CcodOfficialDraftManualDirectoryName
+    if (Get-CcodOfficialDraftOptionalPathState -Path $manualDirectory -ExpectDirectory $true -GetItem { param($CandidatePath) Get-Item -LiteralPath $CandidatePath -Force -ErrorAction Stop } -ErrorId 'CCOD_ACCEPTANCE_RECEIPT_INVALID') {
+        [void](Assert-CcodOfficialDraftSafeDirectory -Path $manualDirectory -ErrorId 'CCOD_ACCEPTANCE_RECEIPT_INVALID')
+        try { $manualChildren = @(Get-ChildItem -LiteralPath $manualDirectory -Force -ErrorAction Stop) }
+        catch { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'Manual evidence state could not be enumerated safely.' $null }
+        foreach ($child in $manualChildren) {
+            if ($child.PSIsContainer -or ($child.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0 -or
+                @($script:CcodOfficialDraftManualFiles.Values) -cnotcontains [string]$child.Name) {
+                Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'Manual evidence state contains an unexpected entry.' $null
+            }
+            $fileOperation = @($script:CcodOfficialDraftManualFiles.GetEnumerator() | Where-Object { [string]$_.Value -ceq [string]$child.Name } | ForEach-Object { [string]$_.Key })
+            if ($fileOperation.Count -ne 1) { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'Manual evidence filename is not recognized.' $child.FullName }
+            $record = Assert-CcodOfficialDraftManualRecordShape -Record (Read-CcodOfficialDraftJson -Path $child.FullName).Value
+            if ([string]$record.operation -cne [string]$fileOperation[0]) { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'Manual evidence filename is detached from its operation.' $child.FullName }
+            if ($manual.ContainsKey([string]$record.operation)) {
+                Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'Manual evidence contains a duplicate operation.' $null
+            }
+            $manual[[string]$record.operation] = $record
+        }
+    }
+    $records['ManualEvidence'] = $manual
+    if ($records.ContainsKey('LegacyUpgrade') -and -not [string]::IsNullOrWhiteSpace($PreviousAssetDirectory)) {
+        [void](Assert-CcodOfficialDraftPreviousSetupBinding -PreviousSetup $records['LegacyUpgrade'].facts.previousSetup -PreviousAssetDirectory $PreviousAssetDirectory)
+    }
+    if (@($script:CcodOfficialDraftPhases | Where-Object { -not $records.ContainsKey($_) }).Count -eq 0) {
+        [void](Assert-CcodOfficialDraftAutomatedReceiptChain -Records $records -StateDirectory $StateDirectory)
+    }
+    return $records
+}
+
+function Repair-CcodOfficialDraftOrphanTemporaryFiles {
+    param([Parameter(Mandatory)][string]$StateDirectory)
+    try {
+        $temporaryEntries = @(Get-ChildItem -LiteralPath $StateDirectory -Force -ErrorAction Stop | Where-Object { [string]$_.Name -cmatch '^\.(acceptance|manual)-[0-9a-f]{32}\.tmp\z' })
+        foreach ($entry in $temporaryEntries) {
+            if ($entry -isnot [IO.FileInfo] -or ($entry.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'orphan temporary identity' }
+            $stream = [IO.File]::Open($entry.FullName,[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::None)
+            try { $stream.Flush() } finally { $stream.Dispose() }
+            Remove-Item -LiteralPath $entry.FullName -Force -ErrorAction Stop
+            if (Test-Path -LiteralPath $entry.FullName) { throw 'orphan temporary residue' }
+        }
+        return $true
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'An orphan acceptance temporary could not be proven safe to remove.' $StateDirectory
+    }
+}
+
+function Get-CcodOfficialDraftPreviousSetupContract {
+    param([Parameter(Mandatory)][string]$Directory,[Parameter(Mandatory)][string]$Version)
+    $assetModule=Get-CcodOfficialDraftAssetModule
+    $directoryAuthority=$null
+    $files=[Collections.Generic.Dictionary[string,object]]::new([StringComparer]::Ordinal)
+    $errorId='CCOD_ACCEPTANCE_PREVIOUS_ASSET_INVALID'
+    try {
+        if($Version-cne'2.5.21'){throw 'unsupported previous version'}
+        $names=@('CodexRemote-fix-2.5.21-windows-x64.zip','CodexRemote-fix-2.5.21-windows-x64.zip.sha256.txt','CodexRemote-fix-2.5.21-trayhost-provenance.json','CodexRemote-fix-2.5.21-payload-manifest.json','CodexRemote-fix-2.5.21-release-manifest.json','CodexRemote-fix-2.5.21-setup.exe','CodexRemote-fix-2.5.21-setup.exe.sha256.txt','CodexRemote-fix-2.5.21-setup-release-manifest.json')
+        $directoryAuthority=&$assetModule {param($Path,$ErrorId)Open-CcodReleaseDirectoryAuthority -Path $Path -ErrorId $ErrorId} $Directory $errorId
+        if(@($directoryAuthority.Children).Count-ne$names.Count-or@($directoryAuthority.Children|Where-Object {$names-cnotcontains$_}).Count-ne0){throw 'previous asset membership'}
+        foreach($name in $names){
+            $file=&$assetModule {param($Leaf,$Directory,$ErrorId)Open-CcodReleaseFileAuthority -Directory $Directory -Leaf $Leaf -ErrorId $ErrorId -AllowZone} $name $directoryAuthority $errorId
+            $files.Add($name,$file)
+        }
+        $setup=&$assetModule {param($File,$ErrorId)(Read-CcodReleaseContractPinnedJson -Authority $File -ErrorId $ErrorId).Value} $files[$names[7]] $errorId
+        if((@($setup.PSObject.Properties.Name)-join',')-cne'schemaVersion,product,version,gitCommit,buildTimestampUtc,assets'-or
+            -not(Test-CcodOfficialDraftIntegerValue $setup.schemaVersion)-or[long]$setup.schemaVersion-ne1-or
+            $setup.product-isnot[string]-or$setup.product-cne'CodexRemote-fix'-or
+            $setup.version-isnot[string]-or$setup.version-cne$Version-or
+            -not(Test-CcodOfficialDraftCommit $setup.gitCommit)-or-not(Test-CcodOfficialDraftCanonicalUtc $setup.buildTimestampUtc)){throw 'legacy setup manifest schema'}
+        $map=&$assetModule {param($Manifest,$Names,$ErrorId,$Target)Get-CcodReleaseContractManifestMap -Manifest $Manifest -ExpectedNames $Names -ErrorId $ErrorId -Target $Target} $setup @($names[5],$names[6],$names[2]) $errorId $files[$names[7]].Path
+        foreach($name in @($names[5],$names[6],$names[2])){if($files[$name].Sha256-cne$map[$name]){throw 'legacy setup asset hash'}}
+        $checksum=&$assetModule {param($File)$bytes=Get-CcodReleaseAuthorityStreamBytes -Stream $File.Stream -MaximumBytes 16384;[Text.UTF8Encoding]::new($false,$true).GetString($bytes)} $files[$names[6]]
+        if($checksum.TrimEnd([char]13,[char]10)-cne($map[$names[5]]+' *'+$names[5])){throw 'legacy setup checksum'}
+        $portable=&$assetModule {
+            param($File,$Directory,$Version,$ErrorId)
+            $loaded=Read-CcodReleaseContractPinnedJson -Authority $File -ErrorId $ErrorId
+            Test-CcodReleasePortableManifestDeep -Manifest $loaded.Value -ManifestRaw $loaded.Raw -ManifestPath $File.Path -Directory $Directory -Version $Version -ErrorId $ErrorId
+        } $files[$names[4]] $directoryAuthority.Path $Version $errorId
+        if($portable.Valid-isnot[bool]-or-not$portable.Valid-or$portable.GitCommit-cne$setup.gitCommit-or$portable.BuildTimestampUtc-cne$setup.buildTimestampUtc){throw 'legacy distribution binding'}
+        foreach($file in $files.Values){&$assetModule {param($File,$ErrorId)Assert-CcodReleaseAuthorityCurrent -Authority $File -ErrorId $ErrorId -CheckBytes|Out-Null} $file $errorId}
+        &$assetModule {param($Directory,$ErrorId)Assert-CcodReleaseAuthorityCurrent -Authority $Directory -ErrorId $ErrorId|Out-Null} $directoryAuthority $errorId
+        return [pscustomobject][ordered]@{Valid=$true;Version=$Version;GitCommit=[string]$setup.gitCommit;InstallerName=$names[5];InstallerSha256=[string]$files[$names[5]].Sha256;ManifestSha256=[string]$files[$names[7]].Sha256}
+    } catch {
+        Throw-CcodOfficialDraftError $errorId 'The previous v2.5.21 assets do not satisfy their original eight-file contract.' $Directory
+    } finally {
+        foreach($file in $files.Values){&$assetModule {param($File)Close-CcodReleaseAuthority $File} $file}
+        if($null-ne$directoryAuthority){&$assetModule {param($Directory)Close-CcodReleaseAuthority $Directory} $directoryAuthority}
+    }
+}
+
+function Assert-CcodOfficialDraftPreviousSetupBinding {
+    param([Parameter(Mandatory)]$PreviousSetup,[Parameter(Mandatory)][string]$PreviousAssetDirectory)
+    try {
+        if (-not (Test-CcodOfficialDraftExactProperties -Value $PreviousSetup -Expected @('version','gitCommit','assetSha256','manifestSha256')) -or
+            $PreviousSetup.version -isnot [string] -or $PreviousSetup.version -cne '2.5.21' -or
+            -not (Test-CcodOfficialDraftCommit $PreviousSetup.gitCommit) -or
+            -not (Test-CcodOfficialDraftHash $PreviousSetup.assetSha256) -or
+            -not (Test-CcodOfficialDraftHash $PreviousSetup.manifestSha256)) { throw 'previous setup shape' }
+        $contract=Get-CcodOfficialDraftPreviousSetupContract -Directory $PreviousAssetDirectory -Version '2.5.21'
+        if($contract.GitCommit-cne$PreviousSetup.gitCommit-or$contract.InstallerSha256-cne$PreviousSetup.assetSha256-or$contract.ManifestSha256-cne$PreviousSetup.manifestSha256){throw 'previous setup binding'}
+        return $true
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_RECEIPT_INVALID*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'Persisted v2.5.21 setup evidence is detached from the validated previous asset files.' $PreviousAssetDirectory
+    }
+}
+
+function Assert-CcodOfficialDraftRemoteProofRuntimeContinuity {
+    param([Parameter(Mandatory)]$ManualEvidence,[Parameter(Mandatory)]$FreshFacts,[Parameter(Mandatory)]$PostFacts)
+    try {
+        $remote = @($ManualEvidence | Where-Object { $_.operation -ceq 'SecondDeviceControl' })
+        if ($remote.Count -ne 1) { throw 'remote proof count' }
+        $proof = $remote[0].proof
+        $freshRuntimeId = Get-CcodOfficialDraftFactValue -Facts $FreshFacts -Name 'activeRuntimeId'
+        $postRuntimeId = Get-CcodOfficialDraftFactValue -Facts $PostFacts -Name 'activeRuntimeId'
+        $freshGeneration = Get-CcodOfficialDraftFactValue -Facts $FreshFacts -Name 'activeGeneration'
+        $postGeneration = Get-CcodOfficialDraftFactValue -Facts $PostFacts -Name 'activeGeneration'
+        $freshManifestHash = Get-CcodOfficialDraftFactValue -Facts $FreshFacts -Name 'runtimeManifestSha256'
+        $postManifestHash = Get-CcodOfficialDraftFactValue -Facts $PostFacts -Name 'runtimeManifestSha256'
+        if ($proof.runtimeId -isnot [string] -or $proof.runtimeId -cne [string]$freshRuntimeId -or $proof.runtimeId -cne [string]$postRuntimeId -or
+            -not (Test-CcodOfficialDraftPositiveInteger $proof.runtimeGeneration) -or -not (Test-CcodOfficialDraftPositiveInteger $freshGeneration) -or
+            -not (Test-CcodOfficialDraftPositiveInteger $postGeneration) -or [UInt64]$proof.runtimeGeneration -ne [UInt64]$freshGeneration -or [UInt64]$proof.runtimeGeneration -ne [UInt64]$postGeneration -or
+            -not (Test-CcodOfficialDraftHash $proof.runtimeManifestSha256) -or $proof.runtimeManifestSha256 -cne [string]$freshManifestHash -or $proof.runtimeManifestSha256 -cne [string]$postManifestHash) { throw 'remote runtime continuity' }
+        return $true
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'Second-device proof is not bound to the current installed runtime.' $null
+    }
+}
+
+function Assert-CcodOfficialDraftAutomatedReceiptChain {
+    param([Parameter(Mandatory)]$Records,[Parameter(Mandatory)][string]$StateDirectory)
+    try {
+        foreach ($phase in $script:CcodOfficialDraftPhases) {
+            if (-not $Records.ContainsKey($phase)) { throw 'automated phase missing' }
+        }
+        $candidate = $Records['Preflight'].candidate
+        $draftIdentity = $Records['Preflight'].draft
+        if ($draftIdentity.tag -isnot [string] -or $draftIdentity.tag -cne 'v2.5.22' -or
+            $draftIdentity.id -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$draftIdentity.id)) { throw 'draft identity chain' }
+        foreach ($phase in $script:CcodOfficialDraftPhases) {
+            $receipt = $Records[$phase]
+            if (-not (Test-CcodOfficialDraftCandidateEqual -Left $candidate -Right $receipt.candidate) -or
+                $receipt.draft.tag -isnot [string] -or $receipt.draft.tag -cne 'v2.5.22' -or
+                $receipt.draft.id -isnot [string] -or $receipt.draft.id -cne [string]$draftIdentity.id) { throw 'automated candidate chain' }
+        }
+        if ($Records.ContainsKey('Complete') -and
+            (-not (Test-CcodOfficialDraftCandidateEqual -Left $candidate -Right $Records['Complete'].candidate) -or
+             $Records['Complete'].draft.tag -isnot [string] -or $Records['Complete'].draft.tag -cne [string]$draftIdentity.tag -or
+             $Records['Complete'].draft.id -isnot [string] -or $Records['Complete'].draft.id -cne [string]$draftIdentity.id)) { throw 'complete candidate/draft chain' }
+        $freshFacts = $Records['FreshInstall'].facts
+        $preFacts = $Records['PreReboot'].facts
+        $postFacts = $Records['PostReboot'].facts
+        $legacyFacts = $Records['LegacyUpgrade'].facts
+        $uninstallFacts = $Records['Uninstall'].facts
+        $freshLeaf = [string]$script:CcodOfficialDraftPhaseFiles['FreshInstall']
+        if ([string]::IsNullOrWhiteSpace($StateDirectory) -or [string]::IsNullOrWhiteSpace($freshLeaf)) { throw 'fresh receipt path' }
+        $freshHash = Get-CcodOfficialDraftFileSha256 -Path (Join-Path $StateDirectory $freshLeaf)
+        if ((Get-CcodOfficialDraftFactValue -Facts $preFacts -Name 'freshInstallReceiptSha256') -cne $freshHash) { throw 'fresh receipt chain' }
+        $expectedKeyHash = Get-CcodOfficialDraftFactValue -Facts $freshFacts -Name 'deviceKeySha256'
+        $legacyAfterKeyHash = Get-CcodOfficialDraftFactValue -Facts $legacyFacts -Name 'deviceKeySha256After'
+        $uninstallBeforeKeyHash = Get-CcodOfficialDraftFactValue -Facts $uninstallFacts -Name 'deviceKeySha256Before'
+        $uninstallAfterKeyHash = Get-CcodOfficialDraftFactValue -Facts $uninstallFacts -Name 'deviceKeySha256After'
+        if (-not (Test-CcodOfficialDraftHash $expectedKeyHash) -or
+            -not (Test-CcodOfficialDraftHash $legacyAfterKeyHash) -or
+            -not (Test-CcodOfficialDraftHash $uninstallBeforeKeyHash) -or
+            -not (Test-CcodOfficialDraftHash $uninstallAfterKeyHash) -or
+            $legacyAfterKeyHash -cne $uninstallBeforeKeyHash -or
+            $uninstallBeforeKeyHash -cne $uninstallAfterKeyHash -or
+            $uninstallAfterKeyHash -cne $expectedKeyHash) { throw 'device-key chain' }
+        $preRuntimeId = Get-CcodOfficialDraftFactValue -Facts $preFacts -Name 'activeRuntimeId'
+        $preGeneration = Get-CcodOfficialDraftFactValue -Facts $preFacts -Name 'activeGeneration'
+        $preManifestHash = Get-CcodOfficialDraftFactValue -Facts $preFacts -Name 'runtimeManifestSha256'
+        $preKeyHash = Get-CcodOfficialDraftFactValue -Facts $preFacts -Name 'deviceKeySha256'
+        $freshRuntimeId = Get-CcodOfficialDraftFactValue -Facts $freshFacts -Name 'activeRuntimeId'
+        $freshGeneration = Get-CcodOfficialDraftFactValue -Facts $freshFacts -Name 'activeGeneration'
+        $freshManifestHash = Get-CcodOfficialDraftFactValue -Facts $freshFacts -Name 'runtimeManifestSha256'
+        if ($preRuntimeId -isnot [string] -or $freshRuntimeId -isnot [string] -or $preRuntimeId -cne $freshRuntimeId -or
+            -not (Test-CcodOfficialDraftPositiveInteger $preGeneration) -or -not (Test-CcodOfficialDraftPositiveInteger $freshGeneration) -or [UInt64]$preGeneration -ne [UInt64]$freshGeneration -or
+            -not (Test-CcodOfficialDraftHash $preManifestHash) -or -not (Test-CcodOfficialDraftHash $freshManifestHash) -or $preManifestHash -cne $freshManifestHash -or
+            -not (Test-CcodOfficialDraftHash $preKeyHash) -or $preKeyHash -cne $expectedKeyHash) { throw 'pre-reboot identity chain' }
+        $bootBefore = Get-CcodOfficialDraftFactValue -Facts $preFacts -Name 'bootIdBefore'
+        if (-not (Test-CcodOfficialDraftHash $expectedKeyHash) -or $bootBefore -isnot [string]) { throw 'reboot continuity inputs' }
+        [void](Assert-CcodOfficialDraftPersistedPostRebootContinuity -Facts $postFacts -FreshFacts $freshFacts -PreFacts $preFacts -ExpectedKeyHash $expectedKeyHash)
+        $readyFacts = $Records['ReadyForManualEvidence'].facts
+        if (-not (Test-CcodOfficialDraftExactProperties -Value $readyFacts -Expected @('automatedPhases','status','manualEvidencePending','complete','manualChallenge')) -or
+            (@($readyFacts.automatedPhases) -join '|') -cne 'Preflight|LegacyUpgrade|Uninstall|FreshInstall|PreReboot|PostReboot' -or
+            $readyFacts.status -isnot [string] -or $readyFacts.status -cne 'ReadyForManualEvidence' -or
+            $readyFacts.manualEvidencePending -isnot [bool] -or -not $readyFacts.manualEvidencePending -or
+            $readyFacts.complete -isnot [bool] -or $readyFacts.complete -or
+            $readyFacts.manualChallenge -isnot [string] -or $readyFacts.manualChallenge -cnotmatch '^[0-9a-f]{32}\z') { throw 'ready chain' }
+        if ($Records.ContainsKey('Complete')) {
+            $completeManual = @($Records['Complete'].facts.manualEvidence)
+            $fileManual = @()
+            foreach ($operation in $script:CcodOfficialDraftManualOperations) {
+                if (-not $Records['ManualEvidence'].ContainsKey($operation)) { throw 'manual state missing' }
+                $fileManual += $Records['ManualEvidence'][$operation]
+            }
+            if ($completeManual.Count -ne $script:CcodOfficialDraftManualOperations.Count -or $fileManual.Count -ne $completeManual.Count) { throw 'manual state count' }
+            $manualFields = @('schemaVersion','kind','phase','operation','terminalState','result','proof','reviewState','version','gitCommit','candidateManifestSha256','screenshotSha256','redactedLogSha256')
+            for ($manualIndex = 0; $manualIndex -lt $completeManual.Count; $manualIndex++) {
+                foreach ($right in @($fileManual[$manualIndex])) {
+                    foreach ($field in $manualFields) {
+                        $leftProperty = @($completeManual[$manualIndex].PSObject.Properties | Where-Object { $_.Name -ceq $field })
+                        $rightProperty = @($right.PSObject.Properties | Where-Object { $_.Name -ceq $field })
+                        if ($leftProperty.Count -ne 1 -or $rightProperty.Count -ne 1) { throw 'manual state binding' }
+                        $leftValue = [string]$leftProperty[0].Value
+                        $rightValue = [string]$rightProperty[0].Value
+                        if ($field -ceq 'proof') {
+                            $leftValue = $leftProperty[0].Value | ConvertTo-Json -Depth 12 -Compress
+                            $rightValue = $rightProperty[0].Value | ConvertTo-Json -Depth 12 -Compress
+                        }
+                        if ($leftValue -cne $rightValue) { throw 'manual state binding' }
+                    }
+                }
+            }
+            [void](Assert-CcodOfficialDraftRemoteProofRuntimeContinuity -ManualEvidence $completeManual -FreshFacts $freshFacts -PostFacts $postFacts)
+            $remoteManual = @($completeManual | Where-Object { $_.operation -ceq 'SecondDeviceControl' })
+            $readyChallenge = Get-CcodOfficialDraftFactValue -Facts $readyFacts -Name 'manualChallenge'
+            if ($remoteManual.Count -ne 1 -or $remoteManual[0].proof.challenge -isnot [string] -or $remoteManual[0].proof.challenge -cne [string]$readyChallenge -or
+                $remoteManual[0].proof.candidateVersion -isnot [string] -or $remoteManual[0].proof.candidateVersion -cne [string]$candidate.version) { throw 'remote proof chain' }
+        }
+        return $true
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'The automated official-draft receipt chain is missing, tampered, or inconsistent.' $null
+    }
+}
+
+function Assert-CcodOfficialDraftPersistedPostRebootContinuity {
+    param([Parameter(Mandatory)]$Facts,[Parameter(Mandatory)]$FreshFacts,[Parameter(Mandatory)]$PreFacts,[Parameter(Mandatory)][string]$ExpectedKeyHash)
+    try {
+        $bootBefore = Get-CcodOfficialDraftFactValue -Facts $PreFacts -Name 'bootIdBefore'
+        $postBefore = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'bootIdBefore'
+        $postAfter = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'bootIdAfter'
+        if ($bootBefore -isnot [string] -or $postBefore -isnot [string] -or $postAfter -isnot [string] -or
+            $bootBefore -cne $postBefore -or $postAfter -ceq $postBefore -or
+            (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'bootChanged') -isnot [bool] -or -not (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'bootChanged') -or
+            (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'receiptContinuity') -isnot [bool] -or -not (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'receiptContinuity')) { throw 'boot continuity' }
+        $runtimeId = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'activeRuntimeId'
+        $generation = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'activeGeneration'
+        $freshRuntimeId = Get-CcodOfficialDraftFactValue -Facts $FreshFacts -Name 'activeRuntimeId'
+        $freshGeneration = Get-CcodOfficialDraftFactValue -Facts $FreshFacts -Name 'activeGeneration'
+        $postManifestHash = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'runtimeManifestSha256'
+        $freshManifestHash = Get-CcodOfficialDraftFactValue -Facts $FreshFacts -Name 'runtimeManifestSha256'
+        if ($runtimeId -isnot [string] -or $runtimeId -cne $freshRuntimeId -or
+            -not (Test-CcodOfficialDraftPositiveInteger $generation) -or [UInt64]$generation -ne [UInt64]$freshGeneration -or
+            -not (Test-CcodOfficialDraftHash $postManifestHash) -or $postManifestHash -cne $freshManifestHash -or
+            -not (Test-CcodOfficialDraftInt32 (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'codexCount')) -or [int](Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'codexCount') -ne 1 -or
+            -not (Test-CcodOfficialDraftInt32 (Get-CcodOfficialDraftFactValue -Facts $FreshFacts -Name 'codexCount')) -or [int](Get-CcodOfficialDraftFactValue -Facts $FreshFacts -Name 'codexCount') -ne 1 -or
+            (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'transitionStage') -cne 'Idle' -or
+            (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'protectionRecovered') -isnot [bool] -or -not (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'protectionRecovered') -or
+            (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'protectionReady') -isnot [bool] -or -not (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'protectionReady') -or
+            (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'trayAuthenticated') -isnot [bool] -or -not (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'trayAuthenticated')) { throw 'runtime continuity' }
+        $terminal = ConvertTo-CcodOfficialDraftTerminalReceipt -Receipt (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'terminalReceipt')
+        $freshTerminal = ConvertTo-CcodOfficialDraftTerminalReceipt -Receipt (Get-CcodOfficialDraftFactValue -Facts $FreshFacts -Name 'terminalReceipt')
+        if ($terminal.runtimeId -cne $runtimeId -or [UInt64]$terminal.runtimeGeneration -ne [UInt64]$generation -or
+            $terminal.runtimeId -cne $freshTerminal.runtimeId -or [UInt64]$terminal.runtimeGeneration -ne [UInt64]$freshTerminal.runtimeGeneration -or
+            (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'deviceKeySha256') -cne $ExpectedKeyHash -or
+            (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'keyHashPreserved') -isnot [bool] -or -not (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'keyHashPreserved')) { throw 'terminal continuity' }
+        return $true
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'Persisted post-reboot identity is not bound to FreshInstall and PreReboot.' $null
+    }
+}
+
+function Write-CcodOfficialDraftReceipt {
+    param(
+        [Parameter(Mandatory)][string]$StateDirectory,
+        [Parameter(Mandatory)][string]$Phase,
+        [Parameter(Mandatory)]$Candidate,
+        [Parameter(Mandatory)]$Draft,
+        [Parameter(Mandatory)]$Facts,
+        [scriptblock]$ReadbackVerifier,
+        [ref]$PublishedHash
+    )
+    $leaf = if ($Phase -ceq 'Complete') { $script:CcodOfficialDraftCompletionFile } else { $script:CcodOfficialDraftPhaseFiles[$Phase] }
+    if ([string]::IsNullOrWhiteSpace([string]$leaf)) {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_PHASE_INVALID' 'The official-draft acceptance phase has no state file.' $Phase
+    }
+    $path = Join-Path $StateDirectory $leaf
+    $existing = $null
+    try { $existing = Get-Item -LiteralPath $path -Force -ErrorAction Stop } catch { if (-not (Test-CcodOfficialDraftMissingError -ErrorRecord $_)) { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_PHASE_REUSED' 'The acceptance receipt path could not be inspected safely.' $path } }
+    if ($null -ne $existing) {
+        if ($Phase -ne 'Complete') {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_PHASE_REUSED' 'An official-draft acceptance phase receipt already exists.' $null
+        }
+        try {
+            $existingReceipt = Assert-CcodOfficialDraftReceiptShape -Receipt (Read-CcodOfficialDraftJson -Path $path).Value -ExpectedPhase 'Complete'
+            if (-not (Test-CcodOfficialDraftCandidateEqual -Left $Candidate -Right $existingReceipt.candidate) -or
+                -not (Test-CcodOfficialDraftDraftEqual -Left $Draft -Right $existingReceipt.draft)) { throw 'complete identity' }
+            if ($null -ne $PublishedHash) { $PublishedHash.Value = $null }
+            return $existingReceipt
+        } catch {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_PHASE_REUSED' 'An existing Complete receipt is not safely resumable.' $path
+        }
+    }
+    $receipt = [pscustomobject][ordered]@{
+        schemaVersion = 1
+        phase = $Phase
+        candidate = $Candidate
+        draft = $Draft
+        facts = $Facts
+    }
+    $temporary = Join-Path $StateDirectory ('.acceptance-' + [guid]::NewGuid().ToString('N') + '.tmp')
+    $published = $false
+    $expectedHash = $null
+    try {
+        $bytes = [Text.UTF8Encoding]::new($false).GetBytes(($receipt | ConvertTo-Json -Depth 16))
+        $sha = [Security.Cryptography.SHA256]::Create()
+        try { $expectedHash = ([BitConverter]::ToString($sha.ComputeHash($bytes))).Replace('-','').ToLowerInvariant() } finally { $sha.Dispose() }
+        $stream = [IO.File]::Open($temporary,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::Read)
+        try { $stream.Write($bytes,0,$bytes.Length); $stream.Flush($true) } finally { $stream.Dispose() }
+        [IO.File]::Move($temporary,$path)
+        $published = $true
+        if ($null -ne $PublishedHash) { $PublishedHash.Value = $expectedHash }
+        if ($null -ne $ReadbackVerifier -and -not [bool](& $ReadbackVerifier $path)) { throw 'receipt readback' }
+        $normalizedReceipt = Assert-CcodOfficialDraftReceiptShape -Receipt (Read-CcodOfficialDraftJson -Path $path).Value -ExpectedPhase $Phase
+        if ((Get-CcodOfficialDraftFileSha256 -Path $path) -cne $expectedHash) { throw 'receipt semantic mismatch' }
+        return $normalizedReceipt
+    } catch {
+        $failure = $_
+        if ($null -ne $temporary) {
+            try { $tempItem = Get-Item -LiteralPath $temporary -Force -ErrorAction Stop; if ($null -ne $tempItem) { Remove-Item -LiteralPath $temporary -Force -ErrorAction Stop } } catch { if (-not (Test-CcodOfficialDraftMissingError -ErrorRecord $_)) { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_CLEANUP_FAILED' 'Temporary acceptance receipt cleanup could not be proven.' $temporary } }
+        }
+        if ($published) {
+            try {
+                $item = $null
+                try { $item = Get-Item -LiteralPath $path -Force -ErrorAction Stop } catch { if (-not (Test-CcodOfficialDraftMissingError -ErrorRecord $_)) { throw } }
+                if ($null -ne $item) {
+                    if ($item -isnot [IO.FileInfo] -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0 -or
+                        ($null -ne $expectedHash -and (Get-CcodOfficialDraftFileSha256 -Path $path) -cne $expectedHash)) { throw 'receipt cleanup target' }
+                    Remove-Item -LiteralPath $path -Force -ErrorAction Stop
+                }
+                $residual = $null
+                try { $residual = Get-Item -LiteralPath $path -Force -ErrorAction Stop } catch { if (-not (Test-CcodOfficialDraftMissingError -ErrorRecord $_)) { throw } }
+                if ($null -ne $residual) { throw 'receipt cleanup residue' }
+            } catch {
+                Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_CLEANUP_FAILED' 'Receipt destination cleanup could not be proven after a failed readback.' $path
+            }
+        }
+        if ($failure.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw $failure }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_WRITE_FAILED' 'Official-draft acceptance receipt could not be durably written.' $null
+    }
+}
+
+function Test-CcodOfficialDraftIntegerValue {
+    param($Value)
+    if ($null -eq $Value -or $Value -is [bool]) { return $false }
+    return $Value.GetType() -in @([sbyte],[byte],[int16],[uint16],[int32],[uint32],[int64],[uint64])
+}
+
+function Test-CcodOfficialDraftMissingError {
+    param([Parameter(Mandatory)]$ErrorRecord)
+    return $ErrorRecord.CategoryInfo.Category -eq 'ObjectNotFound' -or
+        $ErrorRecord.Exception -is [IO.FileNotFoundException] -or $ErrorRecord.Exception -is [IO.DirectoryNotFoundException]
+}
+
+function Assert-CcodOfficialDraftMissingPathAncestorsSafe {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][scriptblock]$GetItem,[Parameter(Mandatory)][string]$ErrorId)
+    try {
+        $current = [IO.Path]::GetFullPath($Path)
+        $pathRoot = [IO.Path]::GetPathRoot($current)
+        while ($null -ne $current) {
+            $parent = [IO.Directory]::GetParent($current)
+            if ($null -eq $parent) { break }
+            $current = $parent.FullName
+            try {
+                $items = @(& $GetItem $current)
+                if ($items.Count -ne 1 -or $null -eq $items[0] -or -not [bool]$items[0].PSIsContainer) { throw 'ancestor shape' }
+                if (($items[0].Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'ancestor reparse' }
+            } catch {
+                if (-not (Test-CcodOfficialDraftMissingError -ErrorRecord $_)) { throw }
+            }
+            if ($current.TrimEnd('\') -ceq $pathRoot.TrimEnd('\')) { break }
+        }
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError $ErrorId 'Installed lifecycle path ancestry could not be inspected safely.' $Path
+    }
+}
+
+function Get-CcodOfficialDraftOptionalPathState {
+    param(
+        [Parameter(Mandatory)][string]$Path,
+        [Parameter(Mandatory)][bool]$ExpectDirectory,
+        [Parameter(Mandatory)][scriptblock]$GetItem,
+        [Parameter(Mandatory)][string]$ErrorId
+    )
+    try {
+        $items = @(& $GetItem $Path)
+        if ($items.Count -ne 1 -or $null -eq $items[0]) { throw 'path observation' }
+        $item = $items[0]
+        if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0 -or
+            [bool]$item.PSIsContainer -ne $ExpectDirectory) { throw 'wrong type or reparse' }
+        return $true
+    } catch {
+        $missing = $_.CategoryInfo.Category -eq 'ObjectNotFound' -or
+            $_.Exception -is [IO.FileNotFoundException] -or $_.Exception -is [IO.DirectoryNotFoundException]
+        if ($missing) {
+            Assert-CcodOfficialDraftMissingPathAncestorsSafe -Path $Path -GetItem $GetItem -ErrorId $ErrorId
+            return $false
+        }
+        Throw-CcodOfficialDraftError $ErrorId 'Installed lifecycle path could not be inspected safely.' $Path
+    }
+}
+
+function Assert-CcodOfficialDraftRegularEvidenceFile {
+    param([Parameter(Mandatory)][string]$Path)
+    try {
+        if ([string]::IsNullOrWhiteSpace($Path) -or -not [IO.Path]::IsPathRooted($Path)) { throw 'absolute' }
+        $full = [IO.Path]::GetFullPath($Path)
+        $root = [IO.Path]::GetPathRoot($full)
+        if ([string]::IsNullOrWhiteSpace($root) -or $full.TrimEnd('\') -cne $Path.TrimEnd('\')) { throw 'canonical' }
+        $item = Get-Item -LiteralPath $full -Force -ErrorAction Stop
+        if ($item -isnot [IO.FileInfo] -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0 -or
+            [int64]$item.Length -lt 1 -or [int64]$item.Length -gt 2MB) { throw 'evidence file' }
+        $parent = [IO.Directory]::GetParent($full)
+        if ($null -eq $parent) { throw 'parent' }
+        [void](Assert-CcodOfficialDraftSafeDirectory -Path $parent.FullName -ErrorId 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID')
+        return $full
+    } catch {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'Manual evidence must be a bounded regular file.' $Path
+    }
+}
+
+function Close-CcodOfficialDraftEvidenceReadLease {
+    param($Lease)
+    if ($null -eq $Lease -or $Lease.Closed) { return }
+    $failed = $false
+    for ($index = $Lease.Entries.Count - 1; $index -ge 0; $index--) {
+        $entry = $Lease.Entries[$index]
+        try {
+            if ($null -ne $entry.Stream) { $entry.Stream.Dispose() } else { $entry.Handle.Dispose() }
+        } catch { $failed = $true }
+    }
+    $Lease.Closed = $true
+    if ($failed) { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'Manual evidence read authority could not be released.' $null }
+}
+
+function Assert-CcodOfficialDraftEvidenceReadLease {
+    param([Parameter(Mandatory)]$Lease)
+    try {
+        if ($Lease.Closed) { throw 'closed read authority' }
+        foreach ($entry in $Lease.Entries) {
+            $current = [CcodReleaseFileAuthorityV1]::Identity($entry.Handle)
+            if ([CcodReleaseFileAuthorityV1]::IsReparse($current) -or
+                [CcodReleaseFileAuthorityV1]::IsDirectory($current) -ne $entry.Directory -or
+                $current.Volume -ne $entry.Identity.Volume -or $current.FileId -ne $entry.Identity.FileId -or
+                -not $current.FinalPath.TrimEnd('\').Equals($entry.Path.TrimEnd('\'),[StringComparison]::OrdinalIgnoreCase)) { throw 'read identity drift' }
+            if (-not $entry.Directory) {
+                if ($current.Links -ne 1 -or $current.Attributes -ne $entry.Identity.Attributes -or $entry.Stream.Length -ne $entry.Length) { throw 'read file drift' }
+                $validStreams = & $Lease.AssetModule { param($Identity) Test-CcodReleaseAuthorityStreams -Identity $Identity -AllowZone } $current
+                $currentHash = & $Lease.AssetModule { param($Stream) Get-CcodReleaseAuthorityStreamSha256 -Stream $Stream } $entry.Stream
+                if (-not $validStreams -or $currentHash -cne $entry.Sha256) { throw 'read bytes drift' }
+            }
+        }
+    } catch {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'Held manual evidence changed or became unavailable.' $null
+    }
+}
+
+function Open-CcodOfficialDraftEvidenceReadLease {
+    param([Parameter(Mandatory)][string[]]$Paths)
+    $lease = [pscustomobject]@{ Entries = [Collections.Generic.List[object]]::new(); AssetModule = (Get-CcodOfficialDraftAssetModule); Closed = $false }
+    try {
+        if ($Paths.Count -eq 0) { throw 'evidence paths missing' }
+        $directories = [Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+        $files = [Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+        foreach ($path in $Paths) {
+            $full = Assert-CcodOfficialDraftRegularEvidenceFile -Path $path
+            if (-not $files.Add($full)) { continue }
+            $parents = [Collections.Generic.List[string]]::new()
+            for ($parent = [IO.Directory]::GetParent($full); $null -ne $parent; $parent = $parent.Parent) { $parents.Insert(0,$parent.FullName) }
+            if ($parents.Count -eq 0 -or -not $parents[0].TrimEnd('\').Equals([IO.Path]::GetPathRoot($full).TrimEnd('\'),[StringComparison]::OrdinalIgnoreCase)) { throw 'evidence ancestry' }
+            foreach ($directory in $parents) {
+                if (-not $directories.Add($directory)) { continue }
+                $handle = [CcodReleaseFileAuthorityV1]::OpenDirectory($directory,$true)
+                $entry = [pscustomobject]@{ Directory = $true; Path = $directory; Handle = $handle; Stream = $null; Identity = $null; Length = 0; Sha256 = $null }
+                $lease.Entries.Add($entry)
+                $entry.Identity = [CcodReleaseFileAuthorityV1]::Identity($handle)
+                if ([CcodReleaseFileAuthorityV1]::IsReparse($entry.Identity) -or -not [CcodReleaseFileAuthorityV1]::IsDirectory($entry.Identity) -or
+                    -not $entry.Identity.FinalPath.TrimEnd('\').Equals($directory.TrimEnd('\'),[StringComparison]::OrdinalIgnoreCase)) { throw 'unsafe evidence ancestor' }
+            }
+            $stream = [CcodReleaseFileAuthorityV1]::OpenReadFile($full,$false)
+            $entry = [pscustomobject]@{ Directory = $false; Path = $full; Handle = $stream.SafeFileHandle; Stream = $stream; Identity = $null; Length = 0; Sha256 = $null }
+            $lease.Entries.Add($entry)
+            $entry.Identity = [CcodReleaseFileAuthorityV1]::Identity($entry.Handle)
+            if ([CcodReleaseFileAuthorityV1]::IsReparse($entry.Identity) -or [CcodReleaseFileAuthorityV1]::IsDirectory($entry.Identity) -or
+                $entry.Identity.Links -ne 1 -or $stream.Length -lt 1 -or $stream.Length -gt 2MB -or
+                -not $entry.Identity.FinalPath.Equals($full,[StringComparison]::OrdinalIgnoreCase)) { throw 'unsafe evidence file' }
+            $entry.Length = $stream.Length
+            $entry.Sha256 = & $lease.AssetModule { param($Stream) Get-CcodReleaseAuthorityStreamSha256 -Stream $Stream } $stream
+        }
+        Assert-CcodOfficialDraftEvidenceReadLease -Lease $lease
+        return $lease
+    } catch {
+        Close-CcodOfficialDraftEvidenceReadLease -Lease $lease
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'Immutable manual evidence read authority could not be acquired.' $null
+    }
+}
+
+function Read-CcodOfficialDraftJsonStringToken {
+    param([Parameter(Mandatory)][string]$Raw,[Parameter(Mandatory)][ref]$Index)
+    if ($Index.Value -ge $Raw.Length -or $Raw[$Index.Value] -cne [char]34) { throw 'json string' }
+    $start = $Index.Value
+    $Index.Value++
+    $escaped = $false
+    while ($Index.Value -lt $Raw.Length) {
+        $character = $Raw[$Index.Value]
+        $Index.Value++
+        if ($escaped) { $escaped = $false; continue }
+        if ($character -eq [char]92) { $escaped = $true; continue }
+        if ($character -eq [char]34) {
+            $encoded = ([string][char]34) + $Raw.Substring($start + 1, $Index.Value - $start - 2) + ([string][char]34)
+            return [string]($encoded | ConvertFrom-Json -ErrorAction Stop)
+        }
+    }
+    throw 'json string'
+}
+
+function Skip-CcodOfficialDraftJsonWhitespace {
+    param([Parameter(Mandatory)][string]$Raw,[Parameter(Mandatory)][ref]$Index)
+    while ($Index.Value -lt $Raw.Length -and [char]::IsWhiteSpace($Raw[$Index.Value])) { $Index.Value++ }
+}
+
+function Skip-CcodOfficialDraftJsonValue {
+    param([Parameter(Mandatory)][string]$Raw,[Parameter(Mandatory)][ref]$Index)
+    Skip-CcodOfficialDraftJsonWhitespace -Raw $Raw -Index $Index
+    if ($Index.Value -ge $Raw.Length) { throw 'json value' }
+    switch ([string]$Raw[$Index.Value]) {
+        '{' { Skip-CcodOfficialDraftJsonObject -Raw $Raw -Index $Index; return }
+        '[' { Skip-CcodOfficialDraftJsonArray -Raw $Raw -Index $Index; return }
+        '"' { [void](Read-CcodOfficialDraftJsonStringToken -Raw $Raw -Index $Index); return }
+        default {
+            $start = $Index.Value
+            while ($Index.Value -lt $Raw.Length -and $Raw[$Index.Value] -notin @([char]44,[char]93,[char]125) -and -not [char]::IsWhiteSpace($Raw[$Index.Value])) { $Index.Value++ }
+            if ($Index.Value -eq $start) { throw 'json scalar' }
+        }
+    }
+}
+
+function Skip-CcodOfficialDraftJsonArray {
+    param([Parameter(Mandatory)][string]$Raw,[Parameter(Mandatory)][ref]$Index)
+    if ($Raw[$Index.Value] -cne [char]91) { throw 'json array' }
+    $Index.Value++
+    Skip-CcodOfficialDraftJsonWhitespace -Raw $Raw -Index $Index
+    if ($Index.Value -lt $Raw.Length -and $Raw[$Index.Value] -ceq [char]93) { $Index.Value++; return }
+    while ($true) {
+        Skip-CcodOfficialDraftJsonValue -Raw $Raw -Index $Index
+        Skip-CcodOfficialDraftJsonWhitespace -Raw $Raw -Index $Index
+        if ($Index.Value -ge $Raw.Length) { throw 'json array' }
+        if ($Raw[$Index.Value] -ceq [char]93) { $Index.Value++; return }
+        if ($Raw[$Index.Value] -cne [char]44) { throw 'json array separator' }
+        $Index.Value++
+    }
+}
+
+function Skip-CcodOfficialDraftJsonObject {
+    param([Parameter(Mandatory)][string]$Raw,[Parameter(Mandatory)][ref]$Index)
+    if ($Raw[$Index.Value] -cne [char]123) { throw 'json object' }
+    $Index.Value++
+    $names = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    Skip-CcodOfficialDraftJsonWhitespace -Raw $Raw -Index $Index
+    if ($Index.Value -lt $Raw.Length -and $Raw[$Index.Value] -ceq [char]125) { $Index.Value++; return }
+    while ($true) {
+        Skip-CcodOfficialDraftJsonWhitespace -Raw $Raw -Index $Index
+        $name = Read-CcodOfficialDraftJsonStringToken -Raw $Raw -Index $Index
+        if (-not $names.Add($name)) { throw 'duplicate json property' }
+        Skip-CcodOfficialDraftJsonWhitespace -Raw $Raw -Index $Index
+        if ($Index.Value -ge $Raw.Length -or $Raw[$Index.Value] -cne [char]58) { throw 'json object separator' }
+        $Index.Value++
+        Skip-CcodOfficialDraftJsonValue -Raw $Raw -Index $Index
+        Skip-CcodOfficialDraftJsonWhitespace -Raw $Raw -Index $Index
+        if ($Index.Value -ge $Raw.Length) { throw 'json object' }
+        if ($Raw[$Index.Value] -ceq [char]125) { $Index.Value++; return }
+        if ($Raw[$Index.Value] -cne [char]44) { throw 'json object separator' }
+        $Index.Value++
+    }
+}
+
+function Assert-CcodOfficialDraftJsonNoDuplicateProperties {
+    param([Parameter(Mandatory)][string]$Raw)
+    try {
+        $index = 0
+        Skip-CcodOfficialDraftJsonValue -Raw $Raw -Index ([ref]$index)
+        Skip-CcodOfficialDraftJsonWhitespace -Raw $Raw -Index ([ref]$index)
+        if ($index -ne $Raw.Length) { throw 'json trailing data' }
+    } catch {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'A JSONL evidence record is malformed or contains duplicate properties.' $null
+    }
+}
+
+function Get-CcodOfficialDraftJsonLines {
+    param(
+        [Parameter(Mandatory)][string]$Path,
+        [AllowNull()][Nullable[DateTimeOffset]]$NotBefore
+    )
+    $full = Assert-CcodOfficialDraftRegularEvidenceFile -Path $Path
+    try {
+        $text = [IO.File]::ReadAllText($full, [Text.UTF8Encoding]::new($false, $true))
+        $records = [Collections.Generic.List[object]]::new()
+        $lines = @($text -split "`r?`n")
+        for ($lineIndex = 0; $lineIndex -lt $lines.Count; $lineIndex++) {
+            $line = $lines[$lineIndex]
+            if ([string]::IsNullOrWhiteSpace($line)) {
+                if ($lineIndex -eq ($lines.Count - 1) -and $line -ceq '' -and ($text.EndsWith("`n") -or $text.EndsWith("`r"))) { continue }
+                throw 'json blank line'
+            }
+            Assert-CcodOfficialDraftJsonNoDuplicateProperties -Raw $line
+            $value = $line | ConvertFrom-Json -ErrorAction Stop
+            if ($value -isnot [pscustomobject]) { throw 'json line object' }
+            $timestampProperties = @($value.PSObject.Properties | Where-Object { $_.Name -ceq 'timestampUtc' })
+            if ($timestampProperties.Count -ne 1 -or $timestampProperties[0].Value -isnot [string] -or -not (Test-CcodOfficialDraftCanonicalUtc $timestampProperties[0].Value)) { throw 'timestamp field' }
+            if ($null -ne $NotBefore) {
+                $timestamp = [DateTimeOffset]::ParseExact([string]$timestampProperties[0].Value, 'o', [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AssumeUniversal)
+                if ($timestamp -lt [DateTimeOffset]$NotBefore) { continue }
+            }
+            $records.Add($value)
+        }
+        return @($records)
+    } catch {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'Manual evidence log is not valid UTF-8 JSONL.' $full
+    }
+}
+
+function Get-CcodOfficialDraftTrayActionProof {
+    param(
+        [Parameter(Mandatory)][string]$Path,
+        [Parameter(Mandatory)][string]$Operation,
+        [AllowNull()][Nullable[DateTimeOffset]]$NotBefore
+    )
+    $allowedCommands = @{
+        About = @('ShowAbout')
+        Language = @('SetLanguageSystem','SetLanguageChinese','SetLanguageEnglish')
+        OpenLogs = @('OpenLogs')
+        Repair = @('CheckAndRepair')
+    }
+    $matches = [Collections.Generic.List[object]]::new()
+    foreach ($record in @(Get-CcodOfficialDraftJsonLines -Path $Path -NotBefore $NotBefore)) {
+        if ([string]$record.stage -cne 'TrayAction') { continue }
+        $fields = @($record.PSObject.Properties.Name)
+        if (($fields -join ',') -cne 'schemaVersion,timestampUtc,component,stage,code,outcome,command,revision,status' -or
+            -not (Test-CcodOfficialDraftIntegerValue $record.schemaVersion) -or [int64]$record.schemaVersion -ne 1 -or
+            $record.timestampUtc -isnot [string] -or $record.component -isnot [string] -or $record.stage -isnot [string] -or $record.stage -cne 'TrayAction' -or $record.component -cne 'Supervisor' -or
+            $record.code -isnot [string] -or $record.code -cne 'CCOD_TRAY_ACTION_COMPLETED' -or
+            $record.outcome -isnot [string] -or $record.outcome -cne 'Completed' -or
+            $record.command -isnot [string] -or -not $allowedCommands.ContainsKey($Operation) -or $allowedCommands[$Operation] -cnotcontains [string]$record.command -or
+            -not (Test-CcodOfficialDraftIntegerValue $record.revision) -or [uint64]$record.revision -eq 0 -or
+            $record.status -isnot [string] -or $record.status -cne 'Completed') { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'Tray action proof is malformed or has invalid field types.' $Path }
+        $matches.Add($record)
+    }
+    if ($matches.Count -ne 1) {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_OPERATION_UNPROVEN' 'The requested tray operation has no unique verified terminal result.' $Operation
+    }
+    return $matches[0]
+}
+
+function Get-CcodOfficialDraftRemoteProof {
+    param(
+        [Parameter(Mandatory)][string]$Path,
+        [Parameter(Mandatory)][string]$ExpectedChallenge,
+        [Parameter(Mandatory)][Nullable[DateTimeOffset]]$NotBefore,
+        [Parameter(Mandatory)][string]$ExpectedVersion,
+        [Parameter(Mandatory)][string]$ExpectedRuntimeId,
+        [Parameter(Mandatory)][UInt64]$ExpectedGeneration,
+        [Parameter(Mandatory)][string]$ExpectedManifestSha256
+    )
+    $records = @(Get-CcodOfficialDraftJsonLines -Path $Path -NotBefore $NotBefore)
+    if ($records.Count -ne 1) { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_REMOTE_UNPROVEN' 'Second-device proof must contain exactly one structured record.' $Path }
+    $record = $records[0]
+    $expected = @('schemaVersion','timestampUtc','kind','operation','deviceRole','challenge','candidateVersion','runtimeId','runtimeGeneration','runtimeManifestSha256','attestation','connection','control','outcome','code')
+    if (($record.PSObject.Properties.Name -join ',') -cne ($expected -join ',') -or
+        -not (Test-CcodOfficialDraftIntegerValue $record.schemaVersion) -or [int64]$record.schemaVersion -ne 1 -or
+        $record.timestampUtc -isnot [string] -or
+        $record.kind -isnot [string] -or $record.kind -cne 'remote-control-manual-proof' -or
+        $record.operation -isnot [string] -or $record.operation -cne 'SecondDeviceControl' -or
+        $record.deviceRole -isnot [string] -or $record.deviceRole -cne 'SecondDevice' -or
+        $record.challenge -isnot [string] -or $record.challenge -cne $ExpectedChallenge -or
+        $record.candidateVersion -isnot [string] -or $record.candidateVersion -cne $ExpectedVersion -or
+        $record.runtimeId -isnot [string] -or $record.runtimeId -cne $ExpectedRuntimeId -or
+        -not (Test-CcodOfficialDraftPositiveInteger $record.runtimeGeneration) -or [UInt64]$record.runtimeGeneration -ne $ExpectedGeneration -or
+        $record.runtimeManifestSha256 -isnot [string] -or $record.runtimeManifestSha256 -cne $ExpectedManifestSha256 -or
+        $record.attestation -isnot [string] -or $record.attestation -cne 'HumanReviewedStructuredAttestation' -or
+        $record.connection -isnot [string] -or $record.connection -cne 'Connected' -or
+        $record.control -isnot [string] -or $record.control -cne 'Completed' -or
+        $record.outcome -isnot [string] -or $record.outcome -cne 'Completed' -or
+        $record.code -isnot [string] -or $record.code -cne 'CCOD_REMOTE_ACTION_COMPLETED') {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_REMOTE_UNPROVEN' 'Second-device proof is malformed or does not prove a completed connection and control.' $Path
+    }
+    return $record
+}
+
+function Get-CcodOfficialDraftTrayHostReadyProof {
+    param(
+        [Parameter(Mandatory)][string]$InstallRoot,
+        [Parameter(Mandatory)][string]$RuntimeId,
+        [Parameter(Mandatory)]$TrayHosts
+    )
+    $logPath = Join-Path ([IO.Path]::GetFullPath($InstallRoot)) 'logs\supervisor.log'
+    if ($TrayHosts.Count -ne 1) { return $null }
+    $host = $TrayHosts[0]
+    if (-not (Test-CcodOfficialDraftExactProperties -Value $host -Expected @('pid','creationTimeUtc')) -or
+        -not (Test-CcodOfficialDraftInt32 $host.pid) -or [int]$host.pid -le 0 -or
+        $host.creationTimeUtc -isnot [string] -or -not (Test-CcodOfficialDraftCanonicalUtc $host.creationTimeUtc)) {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'TrayHost identity is malformed or not canonical.' $logPath
+    }
+    $matches = [Collections.Generic.List[object]]::new()
+    foreach ($record in @(Get-CcodOfficialDraftJsonLines -Path $logPath)) {
+        if ([string]$record.stage -cne 'TrayHostReady') { continue }
+        $fields = @($record.PSObject.Properties.Name)
+        if (($fields -join ',') -cne 'schemaVersion,timestampUtc,component,stage,code,outcome,runtimeId,hostPid,hostCreationTimeUtc,protocolMajor,capabilities' -or
+            -not (Test-CcodOfficialDraftIntegerValue $record.schemaVersion) -or [int64]$record.schemaVersion -ne 1 -or
+            $record.timestampUtc -isnot [string] -or $record.component -isnot [string] -or $record.stage -isnot [string] -or $record.stage -cne 'TrayHostReady' -or $record.component -cne 'Supervisor' -or
+            $record.code -isnot [string] -or $record.code -cne 'CCOD_TRAYHOST_READY' -or
+            $record.outcome -isnot [string] -or $record.outcome -cne 'Completed' -or
+            $record.runtimeId -isnot [string] -or [string]::IsNullOrWhiteSpace($record.runtimeId) -or
+            -not (Test-CcodOfficialDraftInt32 $record.hostPid) -or [int]$record.hostPid -le 0 -or
+            $record.hostCreationTimeUtc -isnot [string] -or -not (Test-CcodOfficialDraftCanonicalUtc $record.hostCreationTimeUtc) -or
+            -not (Test-CcodOfficialDraftIntegerValue $record.protocolMajor) -or [int64]$record.protocolMajor -ne 2 -or
+            -not (Test-CcodOfficialDraftPositiveInteger $record.capabilities) -or [uint64]$record.capabilities -eq 0) { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'TrayHost ready proof is malformed or has invalid field types.' $logPath }
+        if ($record.runtimeId -cne $RuntimeId) { continue }
+        $matches.Add($record)
+    }
+    $identityMatches = [Collections.Generic.List[object]]::new()
+    foreach ($record in $matches) {
+        if ([int]$record.hostPid -eq [int]$host.pid -and $record.hostCreationTimeUtc -ceq $host.creationTimeUtc) { $identityMatches.Add($record) }
+    }
+    if ($identityMatches.Count -ne 1) { return $null }
+    return $identityMatches[0]
+}
+
+function Assert-CcodOfficialDraftDebugEndpointOwnership {
+    param([AllowNull()]$Endpoints,[Parameter(Mandatory)][int[]]$ExpectedPorts,[Parameter(Mandatory)][int]$ExpectedPid,[Parameter(Mandatory)][string]$ExpectedCreationTimeUtc)
+    try {
+        if ($ExpectedPid -le 0 -or $null -eq $Endpoints) { throw 'debug endpoint owner' }
+        $expected = @($ExpectedPorts | Sort-Object -Unique)
+        if ($expected.Count -eq 0 -or @($Endpoints).Count -ne $expected.Count) { throw 'debug endpoint count' }
+        $seen = [Collections.Generic.HashSet[int]]::new()
+        foreach ($endpoint in @($Endpoints)) {
+            if (-not (Test-CcodOfficialDraftExactProperties -Value $endpoint -Expected @('localAddress','localPort','owningProcess','owningProcessCreationTimeUtc')) -or
+                $endpoint.localAddress -isnot [string] -or $endpoint.localAddress -cne '127.0.0.1' -or
+                -not (Test-CcodOfficialDraftPositiveInteger $endpoint.localPort) -or [int]$endpoint.localPort -gt 65535 -or
+                -not (Test-CcodOfficialDraftPositiveInteger $endpoint.owningProcess) -or [int]$endpoint.owningProcess -ne $ExpectedPid -or
+                $endpoint.owningProcessCreationTimeUtc -isnot [string] -or [string]::IsNullOrWhiteSpace($endpoint.owningProcessCreationTimeUtc) -or $endpoint.owningProcessCreationTimeUtc -cne $ExpectedCreationTimeUtc -or
+                -not $seen.Add([int]$endpoint.localPort)) { throw 'debug endpoint owner' }
+        }
+        if (@($seen | Where-Object { $expected -contains $_ }).Count -ne $expected.Count) { throw 'debug endpoint ports' }
+        return $true
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE' 'Debug endpoints are not bound to the verified process identity.' $null
+    }
+}
+
+function Get-CcodOfficialDraftDefaultAdapters {
+    $debugOwnershipFunction = ${function:Assert-CcodOfficialDraftDebugEndpointOwnership}
+    $manualTerminalStates = $script:CcodOfficialDraftManualTerminalStates
+    $manualResultCodes = $script:CcodOfficialDraftManualResultCodes
+    $defaults = @{}
+    $assetModule = Get-CcodOfficialDraftAssetModule
+    $defenderModule = Get-CcodOfficialDraftDefenderModule
+    $moduleInfo = $ExecutionContext.SessionState.Module
+    $openEvidenceReadLease = { param($Paths) & $moduleInfo { param($EvidencePaths) Open-CcodOfficialDraftEvidenceReadLease -Paths $EvidencePaths } $Paths }.GetNewClosure()
+    $checkEvidenceReadLease = { param($Lease) & $moduleInfo { param($EvidenceLease) Assert-CcodOfficialDraftEvidenceReadLease -Lease $EvidenceLease } $Lease }.GetNewClosure()
+    $closeEvidenceReadLease = { param($Lease) & $moduleInfo { param($EvidenceLease) Close-CcodOfficialDraftEvidenceReadLease -Lease $EvidenceLease } $Lease }.GetNewClosure()
+    $normalizeObservedIdentities = {
+        param($Records,$Kind)
+        & $moduleInfo {
+            param($Values,$Label)
+            if ($Values -isnot [array]) { throw "$Label observation array" }
+            foreach ($value in $Values) {
+                if (Test-CcodOfficialDraftExactProperties -Value $value -Expected @('Pid','CreationTimeUtc')) {
+                    $canonical = [pscustomobject][ordered]@{ pid = $value.Pid; creationTimeUtc = $value.CreationTimeUtc }
+                } elseif (Test-CcodOfficialDraftExactProperties -Value $value -Expected @('pid','creationTimeUtc')) {
+                    $canonical = $value
+                } else { throw "$Label observation identity" }
+                ConvertTo-CcodOfficialDraftSafeProcessIdentity -Value $canonical -Label $Label
+            }
+        } $Records $Kind
+    }.GetNewClosure()
+    $trayActionProof = {
+        param($Path,$Operation,$NotBefore)
+        & $moduleInfo { param($ProofPath,$ProofOperation,$ProofNotBefore) Get-CcodOfficialDraftTrayActionProof -Path $ProofPath -Operation $ProofOperation -NotBefore $ProofNotBefore } $Path $Operation $NotBefore
+    }.GetNewClosure()
+    $remoteProof = {
+        param($Path,$ExpectedChallenge,$NotBefore,$ExpectedVersion,$ExpectedRuntimeId,$ExpectedGeneration,$ExpectedManifestSha256)
+        & $moduleInfo { param($ProofPath,$Challenge,$ProofNotBefore,$Version,$RuntimeId,$Generation,$ManifestHash) Get-CcodOfficialDraftRemoteProof -Path $ProofPath -ExpectedChallenge $Challenge -NotBefore $ProofNotBefore -ExpectedVersion $Version -ExpectedRuntimeId $RuntimeId -ExpectedGeneration $Generation -ExpectedManifestSha256 $ManifestHash } $Path $ExpectedChallenge $NotBefore $ExpectedVersion $ExpectedRuntimeId $ExpectedGeneration $ExpectedManifestSha256
+    }.GetNewClosure()
+    $trayReadyProofCommand = {
+        param($Root,$RuntimeId,$Hosts)
+        & $moduleInfo { param($InstallRoot,$ExpectedRuntimeId,$TrayHosts) Get-CcodOfficialDraftTrayHostReadyProof -InstallRoot $InstallRoot -RuntimeId $ExpectedRuntimeId -TrayHosts $TrayHosts } $Root $RuntimeId $Hosts
+    }.GetNewClosure()
+    $integrationModule = Get-CcodOfficialDraftIntegrationModule
+    $localAppData = [Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)
+    $throwAcceptanceError = {
+        param($Id, $Message, $Target)
+        throw [Management.Automation.ErrorRecord]::new(
+            [InvalidOperationException]::new($Message),
+            $Id,
+            [Management.Automation.ErrorCategory]::InvalidOperation,
+            $Target
+        )
+    }.GetNewClosure()
+    if ([string]::IsNullOrWhiteSpace($localAppData)) {
+        & $throwAcceptanceError 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE' 'Local application data is unavailable for installed-lifecycle observation.' $null
+    }
+    $configuredInstallRoot = [string]$script:CcodOfficialDraftInstallRoot
+    if ([string]::IsNullOrWhiteSpace($configuredInstallRoot)) {
+        $configuredInstallRoot = Join-Path $localAppData 'CodexControlOtherDevices'
+    }
+    $pathProbe = { param($Path) Get-Item -LiteralPath $Path -Force -ErrorAction Stop }.GetNewClosure()
+    $pathState = {
+        param($Path,$ExpectDirectory,$Probe,$ErrorId)
+        & $moduleInfo {
+            param($ObservedPath,$ExpectedDirectory,$GetItem,$AcceptanceErrorId)
+            Get-CcodOfficialDraftOptionalPathState -Path $ObservedPath -ExpectDirectory $ExpectedDirectory -GetItem $GetItem -ErrorId $AcceptanceErrorId
+        } $Path $ExpectDirectory $Probe $ErrorId
+    }.GetNewClosure()
+    $integerValue = {
+        param($Value)
+        & $moduleInfo { param($ObservedValue) Test-CcodOfficialDraftIntegerValue -Value $ObservedValue } $Value
+    }.GetNewClosure()
+    $fileHash = {
+        param($Path)
+        & $moduleInfo { param($ObservedPath) Get-CcodOfficialDraftFileSha256 -Path $ObservedPath } $Path
+    }.GetNewClosure()
+    $hashValue = {
+        param($Value)
+        & $moduleInfo { param($ObservedValue) Test-CcodOfficialDraftHash $ObservedValue } $Value
+    }.GetNewClosure()
+    try {
+        if (-not [IO.Path]::IsPathRooted($configuredInstallRoot)) { throw 'install root absolute' }
+        $installRoot = [IO.Path]::GetFullPath($configuredInstallRoot)
+        if ($installRoot -cne $configuredInstallRoot.TrimEnd('\')) { throw 'install root canonical' }
+        $installRootPresent = & $pathState $installRoot $true $pathProbe 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+        if ($installRootPresent) {
+            [void](Assert-CcodOfficialDraftSafeDirectory -Path $installRoot -ErrorId 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE')
+        }
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        & $throwAcceptanceError 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE' 'The installed lifecycle root is unavailable or unsafe.' $null
+    }
+    $debugPorts = [Collections.Generic.List[int]]::new()
+    $defaults.ValidateAssetSet = {
+        param($Path, $Version)
+        & $assetModule { param($AssetDirectory,$ExpectedVersion) Test-CcodExactReleaseAssetSet -AssetDirectory $AssetDirectory -Version $ExpectedVersion } $Path $Version
+    }.GetNewClosure()
+    $defaults.ValidatePreviousSetup = {
+        param($Path, $Version)
+        try {
+            & $moduleInfo {param($Directory,$ExpectedVersion)Get-CcodOfficialDraftPreviousSetupContract -Directory $Directory -Version $ExpectedVersion} $Path $Version
+        } catch {
+            & $throwAcceptanceError 'CCOD_ACCEPTANCE_PREVIOUS_ASSET_INVALID' 'The previous public v2.5.21 Setup is not manifest-bound.' $null
+        }
+    }.GetNewClosure()
+    $defaults.GetDraftIdentity = {
+        param($Path, $Candidate, $ExpectedDraftId)
+        if ([string]::IsNullOrWhiteSpace([string]$ExpectedDraftId)) {
+            & $throwAcceptanceError 'CCOD_ACCEPTANCE_DRAFT_IDENTITY_INVALID' 'The official draft database identifier is required.' $null
+        }
+        [pscustomobject][ordered]@{ tag = 'v2.5.22'; id = [string]$ExpectedDraftId }
+    }.GetNewClosure()
+    $defaults.InvokeDefenderCheck = {
+        param($Path, $AssetType, $Origin, $Version, $GitCommit, $EvidencePath)
+        $names = @(& $assetModule { param($ExpectedVersion) Get-CcodExpectedReleaseAssetNames -Version $ExpectedVersion } $Version)
+        $assetIndex = if ($AssetType -ceq 'Setup') { 5 } else { 0 }
+        $checksumIndex = if ($AssetType -ceq 'Setup') { 6 } else { 1 }
+        $manifestIndex = if ($AssetType -ceq 'Setup') { 10 } else { 4 }
+        $candidatePath = Join-Path $Path $names[$assetIndex]
+        $checksumPath = Join-Path $Path $names[$checksumIndex]
+        $manifestPath = Join-Path $Path $names[$manifestIndex]
+        & $defenderModule {
+            param($CandidatePath,$ChecksumPath,$ManifestPath,$ScanOrigin,$ExpectedVersion,$ExpectedGitCommit,$ReceiptPath)
+            Invoke-CcodReleaseDefenderCheck -CandidatePath $CandidatePath -ChecksumPath $ChecksumPath -ManifestPath $ManifestPath -Origin $ScanOrigin -ExpectedVersion $ExpectedVersion -ExpectedGitCommit $ExpectedGitCommit -EvidencePath $ReceiptPath
+        } $candidatePath $checksumPath $manifestPath $Origin $Version $GitCommit $EvidencePath
+    }.GetNewClosure()
+    $defaults.GetUtcNow = { [datetime]::UtcNow }.GetNewClosure()
+    $defaults.CaptureFacts = {
+        param($Context, $Point)
+        try {
+            $expectedVersion = if ($Context.PSObject.Properties['expectedVersion'] -and $Context.expectedVersion -is [string]) { [string]$Context.expectedVersion } else { $null }
+            $observationVersion = $expectedVersion
+            if ($Context.phase -ceq 'LegacyUpgrade' -and $Point -ceq 'Before' -and $Context.PSObject.Properties['previousSetup'] -and $null -ne $Context.previousSetup -and $Context.previousSetup.version -is [string]) { $observationVersion = [string]$Context.previousSetup.version }
+            $values = @(& $integrationModule { param($Root,$Version) Get-CcodInstalledLifecycleFacts -InstallRoot $Root -ExpectedVersion $Version } $installRoot $observationVersion)
+            if ($values.Count -ne 1 -or $null -eq $values[0]) { throw 'facts' }
+            $raw = $values[0]
+            foreach ($name in @('installRootPresent','appPresent','runtimeRootPresent','activePointerPresent','activeRuntimeId','activeGeneration','runtimeManifestSha256','supervisor','trayHost','codex','taskState','statusPhase','statusRuntimeId','statusCodex','transitionStage','lifecycleReceipt','aboutVersion','deviceKeyPresent','deviceKeySha256','shortcuts','debugPorts','debugEndpoints')) {
+                if ($null -eq $raw.PSObject.Properties[$name]) { throw 'facts shape' }
+            }
+            $get = {
+                param($Name)
+                $property = $raw.PSObject.Properties[$Name]
+                if ($null -eq $property) { return $null }
+                return ,$property.Value
+            }.GetNewClosure()
+            $supervisor = @(& $normalizeObservedIdentities $raw.PSObject.Properties['supervisor'].Value 'supervisor')
+            $trayHost = @(& $normalizeObservedIdentities $raw.PSObject.Properties['trayHost'].Value 'tray host')
+            $activeRuntimeId = & $get 'activeRuntimeId'
+            $activeGeneration = & $get 'activeGeneration'
+            $receipt = & $get 'lifecycleReceipt'
+            $taskState = & $get 'taskState'
+            $appPresent = & $get 'appPresent'
+            $aboutVersion = & $get 'aboutVersion'
+            $statusPhase = & $get 'statusPhase'
+            $statusRuntimeId = & $get 'statusRuntimeId'
+            $statusCodex = & $get 'statusCodex'
+            $transitionStage = & $get 'transitionStage'
+            if ($transitionStage -isnot [string] -or [string]::IsNullOrWhiteSpace($transitionStage)) { throw 'transition stage' }
+            $codex = @(& $normalizeObservedIdentities $raw.PSObject.Properties['codex'].Value 'codex')
+            if ($null -ne $raw.PSObject.Properties['codexCount']) {
+                $rawCodexCount = & $get 'codexCount'
+                if (-not (& $integerValue $rawCodexCount) -or [int64]$rawCodexCount -ne [int64]$codex.Count) { throw 'codex count' }
+            }
+            $deviceKeyPresent = & $get 'deviceKeyPresent'
+            $deviceKeySha256 = & $get 'deviceKeySha256'
+            $shortcutsValue = & $get 'shortcuts'
+            $shortcuts = if ($null -eq $shortcutsValue) {
+                [pscustomobject][ordered]@{ startMenu = $false; desktop = $false }
+            } else { $shortcutsValue }
+            $installRootPresent = [bool](& $pathState $installRoot $true $pathProbe 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE')
+            $runtimeRootPresent = & $get 'runtimeRootPresent'
+            $activePointerPresent = & $get 'activePointerPresent'
+            if ($runtimeRootPresent -isnot [bool] -or $activePointerPresent -isnot [bool]) { throw 'selector facts' }
+            $terminalValid = $null -ne $receipt -and
+                $receipt.kind -is [string] -and $receipt.kind -ceq 'RestartAndRepair' -and
+                $receipt.origin -is [string] -and $receipt.origin -ceq 'Installer' -and
+                $receipt.runtimeId -is [string] -and $receipt.runtimeGeneration -is [ValueType] -and
+                $receipt.phase -is [string] -and $receipt.phase -ceq 'Completed'
+            if ($null -ne $activeGeneration -and -not [bool](& $integerValue $activeGeneration)) { throw 'active generation type' }
+            $generationValid = $false
+            $generation = [UInt64]0
+            try {
+                if ($null -ne $activeGeneration -and [bool](& $integerValue $activeGeneration)) {
+                    $generation = [UInt64]$activeGeneration
+                    $generationValid = $generation -gt 0
+                }
+            } catch { $generationValid = $false }
+            $runtimeValid = $activeRuntimeId -is [string] -and $activeRuntimeId -cmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z'
+            $manifestHash = & $get 'runtimeManifestSha256'
+            $expectedVersionProperties = @($Context.PSObject.Properties | Where-Object { $_.Name -ceq 'expectedVersion' })
+            $expectedVersion = if ($expectedVersionProperties.Count -eq 1 -and $expectedVersionProperties[0].Value -is [string]) { [string]$expectedVersionProperties[0].Value } else { $null }
+            $requiresCandidateReady = $Context.phase -in @('FreshInstall','PreReboot','PostReboot','ReadyForManualEvidence','TrayEvidence','RemoteEvidence') -or
+                ($Context.phase -ceq 'LegacyUpgrade' -and ($Point -ceq 'Before' -or ($Point -ceq 'After' -and $aboutVersion -ceq $expectedVersion)))
+            $readinessVersion = if ($Context.phase -ceq 'LegacyUpgrade' -and $Point -ceq 'Before') { $observationVersion } else { $expectedVersion }
+            $observedDebugValue = & $get 'debugEndpoints'
+            $expectedDebugValue = & $get 'debugPorts'
+            $debugEndpoints = @()
+            if ($null -ne $observedDebugValue) { $debugEndpoints = @($observedDebugValue) }
+            $expectedPorts = @()
+            if ($null -ne $expectedDebugValue) { $expectedPorts = @($expectedDebugValue) }
+            $debugOwnershipValid = $true
+            $trayReadyProof = $null
+            $collectorAuthenticated = $false
+            if ($requiresCandidateReady) {
+                $collectorAuthenticated = & $get 'trayAuthenticated'
+                if ($collectorAuthenticated -isnot [bool]) { throw 'tray authentication observation' }
+                $ownerPid = $null
+                if ($null -ne $statusCodex -and $statusCodex.PSObject.Properties['pid']) { $ownerPid = $statusCodex.pid }
+                elseif ($codex.Count -eq 1) { $ownerPid = $codex[0].pid }
+                if ($null -eq $ownerPid -or $ownerPid -isnot [ValueType] -or $ownerPid -is [bool] -or $expectedPorts.Count -ne 2 -or @($expectedPorts | Sort-Object -Unique).Count -ne 2) { throw 'debug endpoint readiness' }
+                [void](& $debugOwnershipFunction -Endpoints $debugEndpoints -ExpectedPorts $expectedPorts -ExpectedPid ([int]$ownerPid) -ExpectedCreationTimeUtc ([string]$codex[0].creationTimeUtc))
+            }
+            if ($requiresCandidateReady -and $trayHost.Count -eq 1 -and $activeRuntimeId -is [string]) {
+                if($Context.phase-ceq'LegacyUpgrade'-and$Point-ceq'Before'-and$readinessVersion-ceq'2.5.21'){
+                    if($activeRuntimeId-cnotmatch'^2\.5\.21-[0-9a-f]{16}\z'){throw 'legacy runtime profile'}
+                    $legacyProof=@(&$integrationModule {param($Root,$RuntimeId,$Parent,$HostIdentity)Get-CcodInstalledLifecycleLegacyTrayReadyProof -InstallRoot $Root -RuntimeId $RuntimeId -Supervisor $Parent -TrayHost $HostIdentity} $installRoot $activeRuntimeId $supervisor $trayHost)
+                    if($legacyProof.Count-ne1-or$legacyProof[0]-isnot[bool]){throw 'legacy readiness proof'}
+                    if($legacyProof[0]){$trayReadyProof=$true}
+                } else {
+                    $trayReadyProof = & $trayReadyProofCommand $installRoot ([string]$activeRuntimeId) $trayHost
+                }
+            }
+            $statusCodexPid = if ($null -ne $statusCodex) { $statusCodex.pid } else { $null }
+            $codexPid = if ($codex.Count -eq 1) { $codex[0].pid } else { $null }
+            $codexStatusMatches = $false
+            if ($statusCodexPid -ne $null -and $codexPid -ne $null -and
+                [bool](& $integerValue $statusCodexPid) -and [bool](& $integerValue $codexPid) -and
+                [uint64]$statusCodexPid -gt 0 -and [uint64]$codexPid -gt 0 -and
+                [uint64]$statusCodexPid -eq [uint64]$codexPid -and [string]$statusCodex.creationTimeUtc -ceq [string]$codex[0].creationTimeUtc) {
+                $codexStatusMatches = $true
+            }
+            $ready = $appPresent -is [bool] -and [bool]$appPresent -and
+                $runtimeRootPresent -and $activePointerPresent -and
+                $runtimeValid -and $generationValid -and $manifestHash -is [string] -and $manifestHash -cmatch '^[0-9a-f]{64}\z' -and
+                $taskState -is [string] -and $taskState -in @('Ready','Running') -and
+                $supervisor.Count -eq 1 -and $trayHost.Count -eq 1 -and $trayReadyProof -ne $null -and $collectorAuthenticated -and $debugOwnershipValid -and $terminalValid -and
+                $aboutVersion -is [string] -and $aboutVersion -ceq $readinessVersion -and
+                $statusPhase -is [string] -and $statusPhase -ceq 'Active' -and $transitionStage -ceq 'Idle' -and
+                $statusRuntimeId -is [string] -and $statusRuntimeId -ceq [string]$activeRuntimeId -and $codexStatusMatches -and
+                [string]$receipt.runtimeId -ceq [string]$activeRuntimeId -and [UInt64]$receipt.runtimeGeneration -eq $generation
+            if ($Context.phase -ceq 'Uninstall' -and $Point -ceq 'Before') {
+                $debugPorts.Clear()
+                if ($expectedDebugValue -isnot [array]) { throw 'debug port observation' }
+                foreach ($port in $expectedPorts) {
+                    if (($port -isnot [int] -and $port -isnot [long]) -or $port -lt 1 -or $port -gt 65535) { throw 'debug port observation' }
+                    [void]$debugPorts.Add([int]$port)
+                }
+                if ($debugPorts.Count -ne 2 -or @($debugPorts | Sort-Object -Unique).Count -ne 2) { throw 'debug port observation' }
+            }
+            if ($Context.phase -ceq 'Uninstall' -and $Point -ceq 'After' -and $debugPorts.Count -gt 0) {
+                $closed = @(& $integrationModule { param($Ports) Test-CcodInstalledLifecycleDebugPortsClosed -Ports $Ports } ([int[]]$debugPorts))
+                if ($closed.Count -ne 1 -or $closed[0] -isnot [bool]) { throw 'debug endpoint observation' }
+                if (-not $closed[0]) {
+                    & $throwAcceptanceError 'CCOD_ACCEPTANCE_UNINSTALL_OBSERVATION_INVALID' 'A previously declared debug port still has a listener after uninstall.' $null
+                }
+            }
+            $bootValues = @(Get-CimInstance -ClassName Win32_OperatingSystem -ErrorAction Stop)
+            if ($bootValues.Count -ne 1 -or $null -eq $bootValues[0].LastBootUpTime) { throw 'boot identity' }
+            $lastBoot = $bootValues[0].LastBootUpTime
+            if ($lastBoot -isnot [datetime]) { $lastBoot = [datetime]::Parse([string]$lastBoot, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::RoundtripKind) }
+            $bootId = 'boot-' + $lastBoot.ToUniversalTime().ToString('yyyyMMddTHHmmssfffffffZ', [Globalization.CultureInfo]::InvariantCulture)
+            $trayHostIdentity = $null
+            if ($trayHost.Count -eq 1) { $trayHostIdentity = [pscustomobject][ordered]@{ pid = $trayHost[0].pid; creationTimeUtc = [string]$trayHost[0].creationTimeUtc } }
+            return [pscustomobject][ordered]@{
+                installRootPresent = [bool]$installRootPresent
+                installReady = [bool]$ready
+                appRootPresent = if ($appPresent -is [bool]) { [bool]$appPresent } else { $false }
+                runtimeRootPresent = $runtimeRootPresent
+                activePointerPresent = $activePointerPresent
+                activeRuntimeId = if ($runtimeValid) { [string]$activeRuntimeId } else { $null }
+                activeGeneration = if ($generationValid) { $generation } else { $null }
+                runtimeManifestSha256 = if ($manifestHash -is [string] -and $manifestHash -cmatch '^[0-9a-f]{64}\z') { [string]$manifestHash } else { $null }
+                supervisor = @($supervisor)
+                trayHost = @($trayHost)
+                codex = @($codex)
+                codexCount = [int]$codex.Count
+                trayHostIdentity = $trayHostIdentity
+                trayAuthenticated = [bool]$ready
+                taskState = if ($taskState -is [string]) { [string]$taskState } else { 'Unknown' }
+                statusPhase = if ($statusPhase -is [string]) { [string]$statusPhase } else { 'Unavailable' }
+                statusRuntimeId = if ($statusRuntimeId -is [string]) { [string]$statusRuntimeId } else { $null }
+                statusCodex = $statusCodex
+                transitionStage = $transitionStage
+                lifecycleReceipt = $receipt
+                aboutVersion = if ($aboutVersion -is [string]) { [string]$aboutVersion } else { $null }
+                shortcuts = $shortcuts
+                debugPorts = [int[]]$expectedPorts
+                protectionReady = [bool]$ready
+                protectionRecovered = [bool]($ready -and $Context.phase -ceq 'PostReboot' -and $Point -ceq 'After')
+                deviceKeyPresent = if ($deviceKeyPresent -is [bool]) { [bool]$deviceKeyPresent } else { $false }
+                deviceKeySha256 = if ($deviceKeySha256 -is [string]) { [string]$deviceKeySha256 } else { $null }
+                bootId = $bootId
+                debugEndpoints = @($debugEndpoints)
+            }
+        } catch {
+            if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+            & $throwAcceptanceError 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE' 'Installed lifecycle observations are unavailable or cannot be proven safely.' $null
+        }
+    }.GetNewClosure()
+    $assertManualReadiness = {
+        param([string]$ExpectedVersion,[string]$ExpectedRuntimeId,$ExpectedGeneration,[string]$ExpectedManifestSha256,[string]$ExpectedBootId,[string]$ExpectedDeviceKeySha256)
+        $readinessContext = [pscustomobject][ordered]@{ phase = 'PostReboot'; expectedVersion = $ExpectedVersion }
+        $values = @(& $defaults.CaptureFacts $readinessContext 'After')
+        if ($values.Count -ne 1 -or $null -eq $values[0]) { throw 'manual readiness observation' }
+        $facts = $values[0]
+        $terminal = $facts.lifecycleReceipt
+        if ($facts.appRootPresent -isnot [bool] -or -not [bool]$facts.appRootPresent -or
+            $facts.runtimeRootPresent -isnot [bool] -or -not [bool]$facts.runtimeRootPresent -or
+            $facts.activePointerPresent -isnot [bool] -or -not [bool]$facts.activePointerPresent -or
+            $facts.activeRuntimeId -isnot [string] -or $facts.activeRuntimeId -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z' -or
+            $facts.activeGeneration -isnot [UInt64] -or [UInt64]$facts.activeGeneration -lt 1 -or
+            @($facts.supervisor).Count -ne 1 -or @($facts.trayHost).Count -ne 1 -or
+            $facts.trayAuthenticated -isnot [bool] -or -not [bool]$facts.trayAuthenticated -or
+            $facts.protectionReady -isnot [bool] -or -not [bool]$facts.protectionReady -or
+            $facts.protectionRecovered -isnot [bool] -or -not [bool]$facts.protectionRecovered -or
+            $facts.taskState -isnot [string] -or $facts.taskState -notin @('Ready','Running') -or
+            $facts.runtimeManifestSha256 -isnot [string] -or -not (& $hashValue $facts.runtimeManifestSha256) -or
+            $facts.bootId -isnot [string] -or $facts.bootId -notmatch '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}\z' -or
+            $facts.deviceKeyPresent -isnot [bool] -or -not [bool]$facts.deviceKeyPresent -or
+            $facts.deviceKeySha256 -isnot [string] -or $facts.deviceKeySha256 -notmatch '^[0-9a-f]{64}\z' -or
+            $null -eq $terminal -or $terminal.kind -isnot [string] -or $terminal.kind -cne 'RestartAndRepair' -or
+            $terminal.origin -isnot [string] -or $terminal.origin -cne 'Installer' -or
+            $terminal.runtimeId -isnot [string] -or $terminal.runtimeId -cne [string]$facts.activeRuntimeId -or
+            $terminal.runtimeGeneration -isnot [UInt64] -or [UInt64]$terminal.runtimeGeneration -ne [UInt64]$facts.activeGeneration -or
+            $terminal.phase -isnot [string] -or $terminal.phase -cne 'Completed') { throw 'manual readiness' }
+        if (-not [string]::IsNullOrEmpty([string]$ExpectedRuntimeId) -and ($ExpectedRuntimeId -isnot [string] -or $facts.activeRuntimeId -cne $ExpectedRuntimeId)) { throw 'manual persisted runtime' }
+        if ($null -ne $ExpectedGeneration -and ($ExpectedGeneration -isnot [UInt64] -or [UInt64]$facts.activeGeneration -ne [UInt64]$ExpectedGeneration)) { throw 'manual persisted generation' }
+        if (-not [string]::IsNullOrEmpty([string]$ExpectedManifestSha256) -and ($ExpectedManifestSha256 -isnot [string] -or -not (& $hashValue $ExpectedManifestSha256) -or $facts.runtimeManifestSha256 -cne $ExpectedManifestSha256)) { throw 'manual persisted manifest' }
+        if (-not [string]::IsNullOrEmpty([string]$ExpectedDeviceKeySha256) -and ($ExpectedDeviceKeySha256 -isnot [string] -or -not (& $hashValue $ExpectedDeviceKeySha256) -or $facts.deviceKeySha256 -cne $ExpectedDeviceKeySha256)) { throw 'manual persisted device key' }
+        if (-not [string]::IsNullOrEmpty([string]$ExpectedBootId) -and ($ExpectedBootId -isnot [string] -or $facts.bootId -cne $ExpectedBootId)) { throw 'manual persisted boot' }
+        return $facts
+    }.GetNewClosure()
+    $defaults.RunPhase = {
+        param($Context)
+        try {
+            if ($Context.allowMachineMutation -isnot [bool] -or -not [bool]$Context.allowMachineMutation) {
+                & $throwAcceptanceError 'CCOD_ACCEPTANCE_MACHINE_MUTATION_NOT_ALLOWED' 'This installed-lifecycle operation requires explicit machine-mutation authorization.' $null
+            }
+            if ($Context.allowCodexRestart -isnot [bool] -or -not [bool]$Context.allowCodexRestart) {
+                & $throwAcceptanceError 'CCOD_ACCEPTANCE_CODEX_RESTART_NOT_ALLOWED' 'This installed-lifecycle operation requires explicit Codex-restart authorization.' $null
+            }
+            $scenario = switch ([string]$Context.phase) {
+                'LegacyUpgrade' { 'Upgrade'; break }
+                'Uninstall' { 'DirectUninstall'; break }
+                'FreshInstall' { 'FreshInstall'; break }
+                default { & $throwAcceptanceError 'CCOD_ACCEPTANCE_MACHINE_OPERATION_UNAVAILABLE' 'The requested official-draft phase has no installed-lifecycle scenario mapping.' $null }
+            }
+            $previousPath = if ([string]$Context.phase -ceq 'LegacyUpgrade') { [string]$Context.previousSetupPath } else { $null }
+            $values = @(& $integrationModule {
+                param($InstallerPath,$PreviousInstallerPath,$PreviousExpectedVersion,$PreviousInstallerSha256,$PreviousManifestSha256,$ExpectedVersion,$EvidenceRoot,$Mutation,$Restart,$ScenarioName,$ExpectedCandidate)
+                Invoke-CcodInstalledLifecycleIntegration -InstallerPath $InstallerPath -PreviousInstallerPath $PreviousInstallerPath -PreviousExpectedVersion $PreviousExpectedVersion -PreviousInstallerSha256 $PreviousInstallerSha256 -PreviousManifestSha256 $PreviousManifestSha256 -ExpectedVersion $ExpectedVersion -EvidenceRoot $EvidenceRoot -AllowMachineMutation:$Mutation -AllowCodexRestart:$Restart -Scenario $ScenarioName -ExpectedCandidate $ExpectedCandidate
+            } $Context.setupPath $previousPath $Context.previousSetupVersion $Context.previousSetupSha256 $Context.previousManifestSha256 $Context.expectedVersion $Context.evidenceRoot $Context.allowMachineMutation $Context.allowCodexRestart $scenario $Context.candidate)
+            if ($values.Count -ne 1 -or $null -eq $values[0] -or
+                $values[0].outcome -isnot [string] -or $values[0].outcome -cne 'Completed' -or
+                $null -eq $values[0].verification -or $values[0].verification.verified -isnot [bool] -or
+                -not [bool]$values[0].verification.verified) { throw 'integration result' }
+            $setupName = [IO.Path]::GetFileName([string]$Context.setupPath)
+            $expectedInstallerHash = @($Context.candidate.assetHashes | Where-Object { $_.name -ceq $setupName })
+            $installerHash = if ($null -ne $values[0].PSObject.Properties['installerSha256']) { $values[0].installerSha256 } else { $null }
+            $runtimeHash = if ($null -ne $values[0].verification.facts.PSObject.Properties['runtimeManifestSha256']) { $values[0].verification.facts.runtimeManifestSha256 } else { $null }
+            if ($expectedInstallerHash.Count -ne 1 -or $installerHash -isnot [string] -or -not (& $hashValue $installerHash) -or
+                $installerHash -cne [string]$expectedInstallerHash[0].sha256 -or
+                ($null -ne $runtimeHash -and ($runtimeHash -isnot [string] -or -not (& $hashValue $runtimeHash))) -or
+                ([string]$Context.phase -ceq 'FreshInstall' -and -not (& $hashValue $runtimeHash))) { throw 'integration binding' }
+            return [pscustomobject][ordered]@{ completed = $true; outcome = 'Completed'; installerSha256 = [string]$installerHash; runtimeManifestSha256 = if ($null -eq $runtimeHash) { $null } else { [string]$runtimeHash } }
+        } catch {
+            if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+            & $throwAcceptanceError 'CCOD_ACCEPTANCE_MACHINE_OPERATION_FAILED' 'The installed-lifecycle operation did not return proven completion.' $null
+        }
+    }.GetNewClosure()
+    $defaults.RunManualOperation = {
+        param($Context,$Operation)
+        $evidenceReadLease = $null
+        try {
+            if ($null -eq $Context -or $Operation -isnot [string] -or
+                [string]::IsNullOrWhiteSpace([string]$Context.screenshotPath) -or
+                [string]::IsNullOrWhiteSpace([string]$Context.redactedLogPath)) { throw 'manual context' }
+            $operation = [string]$Operation
+            $startedAt = [DateTimeOffset]::UtcNow
+            $expectedRuntimeId = if ($null -ne $Context.PSObject.Properties['expectedRuntimeId']) { $Context.expectedRuntimeId } else { $null }
+            $expectedGeneration = if ($null -ne $Context.PSObject.Properties['expectedGeneration']) { $Context.expectedGeneration } else { $null }
+            $expectedManifestHash = if ($null -ne $Context.PSObject.Properties['expectedRuntimeManifestSha256']) { $Context.expectedRuntimeManifestSha256 } else { $null }
+            $expectedDeviceKeyHash = if ($null -ne $Context.PSObject.Properties['expectedDeviceKeySha256']) { $Context.expectedDeviceKeySha256 } else { $null }
+            $expectedBootId = if ($null -ne $Context.PSObject.Properties['expectedBootId']) { $Context.expectedBootId } else { $null }
+            $expectedAck = 'CCOD_MANUAL_' + $operation.ToUpperInvariant() + '_COMPLETED'
+            $instructions = @{
+                About = 'Open the CodexRemote-fix tray menu, select About, confirm the dialog, and keep the redacted supervisor action record.'
+                Language = 'Open the CodexRemote-fix tray menu, select any enabled language, confirm the presentation changes, and keep the redacted supervisor action record.'
+                OpenLogs = 'Open the CodexRemote-fix tray menu, select Open logs, confirm the log directory opens, and keep the redacted supervisor action record.'
+                Repair = 'Open the CodexRemote-fix tray menu, select Check and repair remote connection, wait for the terminal result, and keep the redacted supervisor action record.'
+                SecondDeviceControl = 'Use the second device to connect to and control this Windows Codex session, then provide one strict redacted JSON proof record.'
+            }
+            if (-not $instructions.ContainsKey($operation)) { throw 'unsupported manual operation' }
+            Write-Host ''
+            Write-Host ('Manual official-draft evidence: {0}' -f $operation) -ForegroundColor Cyan
+            Write-Host $instructions[$operation] -ForegroundColor Yellow
+            if ($operation -ceq 'SecondDeviceControl') { Write-Host ('Include this one-time challenge in the proof: {0}' -f $Context.manualChallenge) -ForegroundColor Yellow }
+            $readyBefore = & $assertManualReadiness ([string]$Context.expectedVersion) $expectedRuntimeId $expectedGeneration $expectedManifestHash $expectedBootId $expectedDeviceKeyHash
+            $prompt = ('After independently completing the operation, type {0}' -f $expectedAck)
+            $ack = if ($null -ne $Context.PSObject.Properties['manualAcknowledgement']) { [string]$Context.manualAcknowledgement } elseif ($null -ne $script:CcodOfficialDraftManualAcknowledgement) { & $script:CcodOfficialDraftManualAcknowledgement $prompt } else { Read-Host $prompt }
+            if ([string]$ack -cne $expectedAck) { throw 'manual acknowledgement' }
+            $readyAfter = & $assertManualReadiness ([string]$Context.expectedVersion) $expectedRuntimeId $expectedGeneration $expectedManifestHash $expectedBootId $expectedDeviceKeyHash
+            if ([string]$readyAfter.activeRuntimeId -cne [string]$readyBefore.activeRuntimeId -or
+                [UInt64]$readyAfter.activeGeneration -ne [UInt64]$readyBefore.activeGeneration -or
+                [string]$readyAfter.bootId -cne [string]$readyBefore.bootId) { throw 'manual readiness changed' }
+            $evidenceReadLease = & $openEvidenceReadLease @([string]$Context.redactedLogPath,[string]$Context.screenshotPath)
+ if ($operation -ceq 'SecondDeviceControl') {
+     $redactedHashBefore = & $fileHash $Context.redactedLogPath
+     $proof = & $remoteProof -Path $Context.redactedLogPath -ExpectedChallenge ([string]$Context.manualChallenge) -NotBefore ([DateTimeOffset]$startedAt) -ExpectedVersion ([string]$Context.expectedVersion) -ExpectedRuntimeId ([string]$readyAfter.activeRuntimeId) -ExpectedGeneration ([UInt64]$readyAfter.activeGeneration) -ExpectedManifestSha256 ([string]$readyAfter.runtimeManifestSha256)
+     $remoteDebugPorts = @($readyAfter.debugEndpoints | ForEach-Object { if ($_.localPort -is [ValueType] -and $_.localPort -isnot [bool]) { [int]$_.localPort } })
+     $readyAfterCodex = @($readyAfter.codex)
+     if ($remoteDebugPorts.Count -ne 2 -or @($remoteDebugPorts | Sort-Object -Unique).Count -ne 2 -or $readyAfterCodex.Count -ne 1) { throw 'remote debug ports' }
+     $values = @(& $integrationModule {
+         param($Root,$Version,$DebugPorts)
+         Get-CcodInstalledLifecycleFacts -InstallRoot $Root -ExpectedVersion $Version -ExpectedDebugPorts ([int[]]$DebugPorts)
+     } $installRoot ([string]$Context.expectedVersion) ([int[]]$remoteDebugPorts))
+     if ($values.Count -ne 1 -or $null -eq $values[0]) { throw 'remote status' }
+     $facts = $values[0]
+     $statusCodex = $facts.statusCodex
+     $codex = @($facts.codex)
+     $codexMatchesReady = $codex.Count -eq 1 -and $readyAfterCodex.Count -eq 1 -and [int]$codex[0].pid -eq [int]$readyAfterCodex[0].pid -and [string]$codex[0].creationTimeUtc -ceq [string]$readyAfterCodex[0].creationTimeUtc
+     $remotePortKey = (@($facts.debugPorts | ForEach-Object { [int]$_ } | Sort-Object) -join ',')
+     $expectedRemotePortKey = (@($remoteDebugPorts | Sort-Object) -join ',')
+     $remoteEndpointValid = $true
+     if ($facts.debugEndpoints.Count -ne 2 -or $remotePortKey -cne $expectedRemotePortKey -or -not $codexMatchesReady) { $remoteEndpointValid = $false }
+     else {
+         foreach ($port in $remoteDebugPorts) {
+             $endpointMatches = @($facts.debugEndpoints | Where-Object {
+                 $_.localAddress -is [string] -and $_.localAddress -ceq '127.0.0.1' -and
+                 $_.localPort -is [ValueType] -and $_.localPort -isnot [bool] -and [int]($_.localPort) -eq [int]$port -and
+                 $_.owningProcess -is [ValueType] -and $_.owningProcess -isnot [bool] -and [uint64]($_.owningProcess) -eq [uint64]$readyAfterCodex[0].pid -and
+                 $_.owningProcessCreationTimeUtc -is [string] -and $_.owningProcessCreationTimeUtc -ceq [string]$readyAfterCodex[0].creationTimeUtc
+             })
+             if ($endpointMatches.Count -ne 1) { $remoteEndpointValid = $false }
+         }
+     }
+     if ($facts.aboutVersion -isnot [string] -or $facts.aboutVersion -cne [string]$Context.expectedVersion -or
+         $facts.runtimeManifestSha256 -isnot [string] -or $facts.runtimeManifestSha256 -cne [string]$readyAfter.runtimeManifestSha256 -or
+         $facts.activeRuntimeId -isnot [string] -or $facts.activeRuntimeId -cne [string]$readyAfter.activeRuntimeId -or
+         $facts.activeGeneration -isnot [UInt64] -or [UInt64]$facts.activeGeneration -ne [UInt64]$readyAfter.activeGeneration -or
+         $facts.deviceKeyPresent -isnot [bool] -or -not [bool]$facts.deviceKeyPresent -or
+         $facts.deviceKeySha256 -isnot [string] -or $facts.deviceKeySha256 -cne [string]$readyAfter.deviceKeySha256 -or
+         -not $remoteEndpointValid -or
+         $facts.appPresent -isnot [bool] -or -not [bool]$facts.appPresent -or
+         $facts.statusPhase -isnot [string] -or $facts.statusPhase -cne 'Active' -or
+         $facts.statusRuntimeId -isnot [string] -or $facts.statusRuntimeId -cne [string]$facts.activeRuntimeId -or
+         $facts.taskState -isnot [string] -or $facts.taskState -notin @('Ready','Running') -or
+         @($facts.trayHost).Count -ne 1 -or $codex.Count -ne 1 -or $null -eq $statusCodex -or
+         [int]$statusCodex.pid -ne [int]$codex[0].pid -or [string]$statusCodex.creationTimeUtc -cne [string]$codex[0].creationTimeUtc) { throw 'remote status' }
+     $redactedHashAfter = & $fileHash $Context.redactedLogPath
+     if ($redactedHashBefore -cne $redactedHashAfter) { throw 'remote evidence changed' }
+     & $checkEvidenceReadLease $evidenceReadLease
+     return [pscustomobject][ordered]@{ verified = $true; operation = $operation; terminalState = [string]$manualTerminalStates[$operation]; code = [string]$manualResultCodes[$operation]; proof = $proof; screenshotSha256 = [string](& $fileHash $Context.screenshotPath); redactedLogSha256 = [string]$redactedHashAfter }
+ }
+            $liveLog = Join-Path $installRoot 'logs\supervisor.log'
+            $live = & $trayActionProof -Path $liveLog -Operation $operation -NotBefore ([DateTimeOffset]$startedAt)
+            $redactedHashBefore = & $fileHash $Context.redactedLogPath
+            $redacted = & $trayActionProof -Path $Context.redactedLogPath -Operation $operation -NotBefore ([DateTimeOffset]$startedAt)
+            $redactedHashAfter = & $fileHash $Context.redactedLogPath
+            if ([string]$redacted.timestampUtc -cne [string]$live.timestampUtc -or
+                [string]$redacted.command -cne [string]$live.command -or [uint64]$redacted.revision -ne [uint64]$live.revision -or
+                [string]$redacted.code -cne [string]$live.code -or [string]$redacted.status -cne [string]$live.status -or
+                $redactedHashBefore -cne $redactedHashAfter) { throw 'tray proof mismatch' }
+            $trayProof = [pscustomobject][ordered]@{ timestampUtc = [string]$redacted.timestampUtc; command = [string]$redacted.command; revision = [UInt64]$redacted.revision; code = 'CCOD_TRAY_ACTION_COMPLETED'; status = 'Completed' }
+            & $checkEvidenceReadLease $evidenceReadLease
+            return [pscustomobject][ordered]@{ verified = $true; operation = $operation; terminalState = [string]$manualTerminalStates[$operation]; code = [string]$manualResultCodes[$operation]; proof = $trayProof; screenshotSha256 = [string](& $fileHash $Context.screenshotPath); redactedLogSha256 = [string]$redactedHashAfter }
+        } catch {
+            if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+            & $throwAcceptanceError 'CCOD_ACCEPTANCE_MANUAL_OPERATION_UNPROVEN' 'The requested tray or second-device operation did not produce a unique verified result.' $null
+        } finally { & $closeEvidenceReadLease $evidenceReadLease }
+    }.GetNewClosure()
+    $defaults.GetBootIdentity = {
+        try {
+            $values = @(Get-CimInstance -ClassName Win32_OperatingSystem -ErrorAction Stop)
+            if ($values.Count -ne 1 -or $null -eq $values[0].LastBootUpTime) { throw 'boot' }
+            $lastBoot = $values[0].LastBootUpTime
+            if ($lastBoot -isnot [datetime]) { $lastBoot = [datetime]::Parse([string]$lastBoot, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::RoundtripKind) }
+            return 'boot-' + $lastBoot.ToUniversalTime().ToString('yyyyMMddTHHmmssfffffffZ', [Globalization.CultureInfo]::InvariantCulture)
+        } catch {
+            & $throwAcceptanceError 'CCOD_ACCEPTANCE_BOOT_ID_UNAVAILABLE' 'The Windows boot identity could not be observed safely.' $null
+        }
+    }.GetNewClosure()
+    $defaults.Reboot = {
+        param($Context)
+        if ($null -eq $Context -or $Context.allowWindowsReboot -isnot [bool] -or -not [bool]$Context.allowWindowsReboot) {
+            & $throwAcceptanceError 'CCOD_ACCEPTANCE_WINDOWS_REBOOT_NOT_ALLOWED' 'Windows reboot requires explicit authorization.' $null
+        }
+        try {
+            Restart-Computer -Force -ErrorAction Stop
+            return $true
+        } catch {
+            & $throwAcceptanceError 'CCOD_ACCEPTANCE_REBOOT_FAILED' 'The authorized Windows reboot could not be initiated.' $null
+        }
+    }.GetNewClosure()
+    return $defaults
+}
+
+function Resolve-CcodOfficialDraftAdapters {
+    param([hashtable]$Adapters)
+    $resolved = Get-CcodOfficialDraftDefaultAdapters
+    if ($null -eq $Adapters) { return $resolved }
+    foreach ($name in $Adapters.Keys) {
+        if (-not $resolved.ContainsKey([string]$name) -or $Adapters[$name] -isnot [scriptblock]) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_ADAPTER_INVALID' 'Private acceptance adapters must replace known scriptblock operations only.' $null
+        }
+        $resolved[[string]$name] = $Adapters[$name]
+    }
+    return $resolved
+}
+
+function Assert-CcodOfficialDraftPhaseState {
+    param([Parameter(Mandatory)][string]$Phase, [Parameter(Mandatory)]$Records, [Parameter(Mandatory)]$Candidate, [Parameter(Mandatory)]$Draft,[switch]$AllowExistingComplete)
+    $manualValues = @()
+    if ($Records.ContainsKey('ManualEvidence') -and $null -ne $Records['ManualEvidence']) {
+        $manualValues = @($Records['ManualEvidence'].Values)
+        if ($null -eq $manualValues) { $manualValues = @() }
+    }
+    if ($Phase -notin @('TrayEvidence','RemoteEvidence','Complete') -and $manualValues.Count -gt 0) {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_EARLY' 'Manual evidence cannot exist before ReadyForManualEvidence.' $null
+    }
+    if ($Phase -in @('TrayEvidence','RemoteEvidence','Complete')) {
+        foreach ($automatedPhase in $script:CcodOfficialDraftPhases) {
+            if (-not $Records.ContainsKey($automatedPhase)) {
+                Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_PHASE_ORDER_INVALID' 'Manual evidence requires all automated acceptance phases first.' $null
+            }
+            if (-not (Test-CcodOfficialDraftCandidateEqual -Left $Candidate -Right $Records[$automatedPhase].candidate)) {
+                Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_CANDIDATE_CHANGED' 'The official-draft candidate changed before manual evidence.' $null
+            }
+            if (-not (Test-CcodOfficialDraftDraftEqual -Left $Draft -Right $Records[$automatedPhase].draft)) {
+                Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_DRAFT_IDENTITY_CHANGED' 'The official-draft identity changed before manual evidence.' $null
+            }
+        }
+        if ($Records.ContainsKey('Complete') -and -not ($Phase -ceq 'Complete' -and $AllowExistingComplete)) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_PHASE_REUSED' 'Complete acceptance evidence cannot be reused.' $null
+        }
+        return
+    }
+    $index = [array]::IndexOf([string[]]$script:CcodOfficialDraftPhases,$Phase)
+    if ($index -lt 0) { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_PHASE_INVALID' 'The official-draft acceptance phase is unsupported.' $null }
+    if ($Records.ContainsKey('Complete')) {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_PHASE_REUSED' 'Automated acceptance cannot continue after Complete evidence.' $null
+    }
+    for ($prior = 0; $prior -lt $index; $prior++) {
+        $name = $script:CcodOfficialDraftPhases[$prior]
+        if (-not $Records.ContainsKey($name)) { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_PHASE_ORDER_INVALID' 'Official-draft acceptance phases must be completed in order.' $null }
+        if (-not (Test-CcodOfficialDraftCandidateEqual -Left $Candidate -Right $Records[$name].candidate)) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_CANDIDATE_CHANGED' 'The official-draft candidate changed during acceptance.' $null
+        }
+        if (-not (Test-CcodOfficialDraftDraftEqual -Left $Draft -Right $Records[$name].draft)) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_DRAFT_IDENTITY_CHANGED' 'The official-draft identity changed during acceptance.' $null
+        }
+    }
+    for ($later = $index; $later -lt $script:CcodOfficialDraftPhases.Count; $later++) {
+        if ($Records.ContainsKey($script:CcodOfficialDraftPhases[$later])) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_PHASE_REUSED' 'An official-draft acceptance phase cannot be reused or skipped.' $null
+        }
+    }
+}
+
+function Assert-CcodOfficialDraftPhaseAuthorization {
+    param(
+        [Parameter(Mandatory)][string]$Phase,
+        [switch]$AllowMachineMutation,
+        [switch]$AllowCodexRestart,
+        [switch]$AllowWindowsReboot
+    )
+    if ($Phase -in @('LegacyUpgrade','Uninstall','FreshInstall','PreReboot','PostReboot')) {
+        if (-not $AllowMachineMutation) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MACHINE_MUTATION_NOT_ALLOWED' 'This official-draft phase requires explicit machine-mutation authorization.' $null
+        }
+        if (-not $AllowCodexRestart) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_CODEX_RESTART_NOT_ALLOWED' 'This official-draft phase requires explicit Codex-restart authorization.' $null
+        }
+    }
+    if ($Phase -in @('PreReboot','PostReboot') -and -not $AllowWindowsReboot) {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_WINDOWS_REBOOT_NOT_ALLOWED' 'This official-draft phase requires explicit Windows-reboot authorization.' $null
+    }
+}
+
+function ConvertTo-CcodOfficialDraftPreviousSetup {
+    param([Parameter(Mandatory)]$Value)
+    try {
+        if ($null -eq $Value -or $Value.Valid -isnot [bool] -or -not [bool]$Value.Valid -or
+            $Value.Version -isnot [string] -or $Value.Version -cne '2.5.21' -or
+            $Value.InstallerName -isnot [string] -or $Value.InstallerName -cne 'CodexRemote-fix-2.5.21-setup.exe' -or
+            -not (Test-CcodOfficialDraftCommit $Value.GitCommit) -or
+            -not (Test-CcodOfficialDraftHash $Value.InstallerSha256) -or
+            -not (Test-CcodOfficialDraftHash $Value.ManifestSha256)) { throw 'previous setup' }
+        return [pscustomobject][ordered]@{
+            version = '2.5.21'
+            gitCommit = [string]$Value.GitCommit
+            assetSha256 = [string]$Value.InstallerSha256
+            manifestSha256 = [string]$Value.ManifestSha256
+        }
+    } catch {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_PREVIOUS_ASSET_INVALID' 'The previous public v2.5.21 Setup is not manifest-bound.' $null
+    }
+}
+
+function Get-CcodOfficialDraftFactValue {
+    param([Parameter(Mandatory)]$Facts, [Parameter(Mandatory)][string]$Name)
+    if ($Facts -is [Collections.IDictionary]) {
+        if (-not $Facts.Contains($Name)) { return $null }
+        return $Facts[$Name]
+    }
+    $property = $Facts.PSObject.Properties[$Name]
+    if ($null -eq $property) { return $null }
+    return $property.Value
+}
+
+function Get-CcodOfficialDraftObservedKeyHash {
+    param([Parameter(Mandatory)]$Facts)
+    try {
+        $present = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'deviceKeyPresent'
+        $hash = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'deviceKeySha256'
+        if ($present -isnot [bool] -or -not [bool]$present -or -not (Test-CcodOfficialDraftHash $hash)) { throw 'key' }
+        return [string]$hash
+    } catch {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_KEY_OBSERVATION_INVALID' 'The DPAPI device-key observation is missing or malformed.' $null
+    }
+}
+
+function Invoke-CcodOfficialDraftPhaseOperation {
+    param([Parameter(Mandatory)]$Adapters, [Parameter(Mandatory)]$Context)
+    try {
+        $values = @(& $Adapters.RunPhase $Context)
+        if ($values.Count -ne 1 -or $null -eq $values[0]) { throw 'operation result' }
+        $result = $values[0]
+        if (-not (Test-CcodOfficialDraftExactProperties -Value $result -Expected @('completed','outcome','installerSha256','runtimeManifestSha256')) -or
+            $result.installerSha256 -isnot [string] -or -not (Test-CcodOfficialDraftHash $result.installerSha256) -or
+            ($null -ne $result.runtimeManifestSha256 -and ($result.runtimeManifestSha256 -isnot [string] -or -not (Test-CcodOfficialDraftHash $result.runtimeManifestSha256)))) { throw 'operation binding' }
+        $setupName = [IO.Path]::GetFileName([string]$Context.setupPath)
+        $expectedInstallerHash = Get-CcodOfficialDraftAssetHash -Candidate $Context.candidate -Name $setupName
+        if (-not (Test-CcodOfficialDraftHash $expectedInstallerHash) -or $result.installerSha256 -cne $expectedInstallerHash) { throw 'operation candidate binding' }
+        $completed = $false
+        $outcomeCompleted = $false
+        $hasCompletion = $false
+        $property = $result.PSObject.Properties['completed']
+        if ($null -ne $property) {
+            if ($property.Value -isnot [bool]) { throw 'completed type' }
+            $completed = [bool]$property.Value
+            $hasCompletion = $true
+        }
+        $property = $result.PSObject.Properties['outcome']
+        if ($null -ne $property) {
+            if ($property.Value -isnot [string]) { throw 'outcome type' }
+            if ([string]$property.Value -cne 'Completed') { throw 'outcome' }
+            $outcomeCompleted = $true
+            $hasCompletion = $true
+        }
+        if (-not $hasCompletion -or -not $completed -or -not $outcomeCompleted) { throw 'operation result' }
+        return $result
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MACHINE_OPERATION_FAILED' 'The official-draft machine operation did not return proven completion.' $null
+    }
+}
+
+function New-CcodOfficialDraftContext {
+    param(
+        [Parameter(Mandatory)][string]$Phase,
+        [Parameter(Mandatory)][string]$AssetDirectory,
+        [Parameter(Mandatory)][string]$PreviousAssetDirectory,
+        [Parameter(Mandatory)][string]$EvidenceRoot,
+        [Parameter(Mandatory)]$Candidate,
+        [Parameter(Mandatory)]$Draft,
+        [Parameter(Mandatory)]$PreviousSetup,
+        [switch]$AllowMachineMutation,
+        [switch]$AllowCodexRestart,
+        [switch]$AllowWindowsReboot
+    )
+    $names = @(Get-CcodOfficialDraftExpectedAssetNames)
+    return [pscustomobject][ordered]@{
+        phase = $Phase
+        assetDirectory = [IO.Path]::GetFullPath($AssetDirectory)
+        previousAssetDirectory = [IO.Path]::GetFullPath($PreviousAssetDirectory)
+        evidenceRoot = [IO.Path]::GetFullPath($EvidenceRoot)
+        installRoot = [IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)) 'CodexControlOtherDevices'))
+        expectedVersion = [string]$Candidate.version
+        setupPath = [IO.Path]::GetFullPath((Join-Path $AssetDirectory $names[5]))
+        portablePath = [IO.Path]::GetFullPath((Join-Path $AssetDirectory $names[0]))
+        previousSetupPath = [IO.Path]::GetFullPath((Join-Path $PreviousAssetDirectory 'CodexRemote-fix-2.5.21-setup.exe'))
+        previousSetupVersion = [string]$PreviousSetup.version
+        previousSetupSha256 = [string]$PreviousSetup.assetSha256
+        previousManifestSha256 = [string]$PreviousSetup.manifestSha256
+        candidate = $Candidate
+        draft = $Draft
+        previousSetup = $PreviousSetup
+        allowMachineMutation = [bool]$AllowMachineMutation
+        allowCodexRestart = [bool]$AllowCodexRestart
+        allowWindowsReboot = [bool]$AllowWindowsReboot
+    }
+}
+
+function ConvertTo-CcodOfficialDraftLegacyFacts {
+    param([Parameter(Mandatory)]$PreviousSetup,[Parameter(Mandatory)]$BeforeObservation,[Parameter(Mandatory)]$AfterObservation,[Parameter(Mandatory)][string]$BeforeHash,[Parameter(Mandatory)][string]$AfterHash)
+    return [pscustomobject][ordered]@{
+        previousSetup = $PreviousSetup
+        before = $BeforeObservation
+        after = $AfterObservation
+        deviceKeySha256Before = $BeforeHash
+        deviceKeySha256After = $AfterHash
+        keyHashPreserved = $true
+        operationOutcome = 'Completed'
+    }
+}
+
+function Test-CcodOfficialDraftHasFact {
+    param([Parameter(Mandatory)]$Facts, [Parameter(Mandatory)][string]$Name)
+    if ($Facts -is [Collections.IDictionary]) { return $Facts.Contains($Name) }
+    return $null -ne $Facts.PSObject.Properties[$Name]
+}
+
+function Assert-CcodOfficialDraftUninstallFacts {
+    param([Parameter(Mandatory)]$Facts, [Parameter(Mandatory)][string]$ExpectedKeyHash)
+    try {
+        foreach ($name in @('installRootPresent','appRootPresent','runtimeRootPresent','activePointerPresent','taskState','supervisor','trayHost','codex','shortcuts','debugEndpoints')) {
+            if (-not (Test-CcodOfficialDraftHasFact -Facts $Facts -Name $name)) { throw 'missing fact' }
+        }
+        foreach ($name in @('appRootPresent','runtimeRootPresent','activePointerPresent')) {
+            $value = Get-CcodOfficialDraftFactValue -Facts $Facts -Name $name
+            if ($value -isnot [bool] -or [bool]$value) { throw 'owned state remains' }
+        }
+        $rootValue = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'installRootPresent'
+        if ($rootValue -isnot [bool] -or [bool]$rootValue) { throw 'install root remains' }
+        if ((Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'taskState') -isnot [string] -or
+            (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'taskState') -cne 'Absent') { throw 'task' }
+        if (@(Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'supervisor').Count -ne 0 -or
+            @(Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'trayHost').Count -ne 0 -or
+            @(Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'codex').Count -ne 0 -or
+            @(Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'debugEndpoints').Count -ne 0) { throw 'process or endpoint remains' }
+        $shortcuts = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'shortcuts'
+        if (-not (Test-CcodOfficialDraftExactProperties -Value $shortcuts -Expected @('startMenu','desktop')) -or
+            $shortcuts.startMenu -isnot [bool] -or [bool]$shortcuts.startMenu -or
+            $shortcuts.desktop -isnot [bool] -or [bool]$shortcuts.desktop) { throw 'shortcuts' }
+        $afterHash = Get-CcodOfficialDraftObservedKeyHash -Facts $Facts
+        if ($afterHash -cne $ExpectedKeyHash) { throw 'key' }
+        return $afterHash
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_UNINSTALL_OBSERVATION_INVALID' 'Uninstall did not prove complete owned-state removal.' $null
+    }
+}
+
+function ConvertTo-CcodOfficialDraftUninstallFacts {
+    param([Parameter(Mandatory)]$Facts,[Parameter(Mandatory)][string]$BeforeHash,[Parameter(Mandatory)][string]$AfterHash)
+    return [pscustomobject][ordered]@{
+        stateRemoved = $true
+        installRootPresent = $false
+        appRootPresent = $false
+        runtimeRootPresent = $false
+        activePointerPresent = $false
+        taskState = 'Absent'
+        supervisorCount = 0
+        trayHostCount = 0
+        codexCount = 0
+        shortcuts = [pscustomobject][ordered]@{ startMenu = $false; desktop = $false }
+        debugEndpointsGone = $true
+        deviceKeySha256Before = $BeforeHash
+        deviceKeySha256After = $AfterHash
+        keyHashPreserved = $true
+        operationOutcome = 'Completed'
+    }
+}
+
+function ConvertTo-CcodOfficialDraftTerminalReceipt {
+    param([Parameter(Mandatory)]$Receipt)
+    try {
+        if (-not (Test-CcodOfficialDraftExactProperties -Value $Receipt -Expected @('kind','origin','runtimeId','runtimeGeneration','phase')) -or
+            $Receipt.kind -isnot [string] -or $Receipt.kind -cne 'RestartAndRepair' -or
+            $Receipt.origin -isnot [string] -or $Receipt.origin -cne 'Installer' -or
+            $Receipt.runtimeId -isnot [string] -or $Receipt.runtimeId -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z' -or
+            -not (Test-CcodOfficialDraftPositiveInteger $Receipt.runtimeGeneration) -or
+            $Receipt.phase -isnot [string] -or $Receipt.phase -cne 'Completed') { throw 'terminal receipt' }
+        return [pscustomobject][ordered]@{
+            kind = 'RestartAndRepair'
+            origin = 'Installer'
+            runtimeId = [string]$Receipt.runtimeId
+            runtimeGeneration = [UInt64]$Receipt.runtimeGeneration
+            phase = 'Completed'
+        }
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_FRESH_INSTALL_OBSERVATION_INVALID' 'Fresh install did not expose a valid terminal lifecycle receipt.' $null
+    }
+}
+
+function Assert-CcodOfficialDraftFreshFacts {
+    param([Parameter(Mandatory)]$Facts,[Parameter(Mandatory)][string]$ExpectedKeyHash,[string]$ExpectedRuntimeManifestSha256)
+    try {
+        foreach ($name in @('installRootPresent','appRootPresent','runtimeRootPresent','activePointerPresent','activeRuntimeId','activeGeneration','runtimeManifestSha256','supervisor','trayHost','codex','codexCount','statusCodex','trayAuthenticated','taskState','lifecycleReceipt','protectionReady')) {
+            if (-not (Test-CcodOfficialDraftHasFact -Facts $Facts -Name $name)) { throw 'missing fact' }
+        }
+        foreach ($name in @('installRootPresent','appRootPresent','runtimeRootPresent','activePointerPresent','trayAuthenticated','protectionReady')) {
+            $value = Get-CcodOfficialDraftFactValue -Facts $Facts -Name $name
+            if ($value -isnot [bool] -or -not [bool]$value) { throw 'readiness flag' }
+        }
+        $runtimeId = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'activeRuntimeId'
+        $generation = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'activeGeneration'
+        $manifestHash = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'runtimeManifestSha256'
+        if ($runtimeId -isnot [string] -or $runtimeId -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z' -or
+            -not (Test-CcodOfficialDraftPositiveInteger $generation) -or
+            -not (Test-CcodOfficialDraftHash $manifestHash) -or
+            ($null -ne $ExpectedRuntimeManifestSha256 -and ($manifestHash -cne $ExpectedRuntimeManifestSha256))) { throw 'active generation' }
+        if ((Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'taskState') -isnot [string] -or
+            (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'taskState') -notin @('Ready','Running')) { throw 'task' }
+        $codex = @(Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'codex')
+        $statusCodex = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'statusCodex'
+        if (@(Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'supervisor').Count -ne 1 -or
+            @(Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'trayHost').Count -ne 1 -or
+            -not (Test-CcodOfficialDraftInt32 (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'codexCount')) -or
+            [int](Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'codexCount') -ne 1 -or $codex.Count -ne 1 -or $null -eq $statusCodex) { throw 'process count' }
+        $codexIdentity = ConvertTo-CcodOfficialDraftSafeProcessIdentity -Value $codex[0] -Label 'fresh codex'
+        $statusCodexIdentity = ConvertTo-CcodOfficialDraftSafeProcessIdentity -Value $statusCodex -Label 'fresh status codex'
+        if ($codexIdentity.pid -ne $statusCodexIdentity.pid -or $codexIdentity.creationTimeUtc -cne $statusCodexIdentity.creationTimeUtc) { throw 'codex identity binding' }
+        $trayIdentity = ConvertTo-CcodOfficialDraftTrayHostIdentity -Value (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'trayHostIdentity')
+        $observedTrayIdentity = ConvertTo-CcodOfficialDraftTrayHostIdentity -Value (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'trayHost')[0]
+        if ($trayIdentity.pid -ne $observedTrayIdentity.pid -or $trayIdentity.creationTimeUtc -cne $observedTrayIdentity.creationTimeUtc) { throw 'tray identity binding' }
+        $terminal = ConvertTo-CcodOfficialDraftTerminalReceipt -Receipt (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'lifecycleReceipt')
+        if ($terminal.runtimeId -cne $runtimeId -or [UInt64]$terminal.runtimeGeneration -ne [UInt64]$generation) { throw 'receipt binding' }
+        $keyHash = Get-CcodOfficialDraftObservedKeyHash -Facts $Facts
+        if ($keyHash -cne $ExpectedKeyHash) { throw 'key' }
+        return [pscustomobject][ordered]@{
+            installRootPresent = $true
+            installReady = $true
+            activePointerPresent = $true
+            activeRuntimeId = [string]$runtimeId
+            activeGeneration = [UInt64]$generation
+            runtimeManifestSha256 = [string]$manifestHash
+            supervisorCount = 1
+            trayHostCount = 1
+            codexCount = 1
+            trayHostIdentity = $trayIdentity
+            trayAuthenticated = $true
+            taskState = [string](Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'taskState')
+            terminalReceipt = $terminal
+            protectionReady = $true
+            deviceKeySha256 = $keyHash
+            operationOutcome = 'Completed'
+        }
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_FRESH_INSTALL_OBSERVATION_INVALID' 'Fresh install did not prove an active generation and authenticated protection.' $null
+    }
+}
+
+function Get-CcodOfficialDraftFileSha256 {
+    param([Parameter(Mandatory)][string]$Path,[string]$ErrorId='CCOD_ACCEPTANCE_RECEIPT_INVALID',[string]$Message='The acceptance receipt could not be hashed safely.')
+    try {
+        $full = Assert-CcodOfficialDraftRegularFile -Path $Path -ErrorId $ErrorId
+        $sha = [Security.Cryptography.SHA256]::Create()
+        $stream = [IO.File]::OpenRead($full)
+        try { return ([BitConverter]::ToString($sha.ComputeHash($stream))).Replace('-','').ToLowerInvariant() }
+        finally { $stream.Dispose(); $sha.Dispose() }
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError $ErrorId $Message $null
+    }
+}
+
+function Write-CcodOfficialDraftJsonCreateOnly {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)]$Record,[Parameter(Mandatory)][string]$ErrorId,[scriptblock]$Readback,[ref]$PublishedHash,[scriptblock]$BeforeTemporaryOpen)
+    $temporary = $null
+    $full = $null
+    $published = $false
+    $expectedHash = $null
+    try {
+        $full = [IO.Path]::GetFullPath($Path)
+        $parent = [IO.Directory]::GetParent($full)
+        if ($null -eq $parent) { throw 'parent' }
+        [void](Assert-CcodOfficialDraftSafeDirectory -Path $parent.FullName -ErrorId $ErrorId)
+        $existing = $null
+        try { $existing = Get-Item -LiteralPath $full -Force -ErrorAction Stop } catch { if (-not (Test-CcodOfficialDraftMissingError -ErrorRecord $_)) { throw } }
+        if ($null -ne $existing) { throw 'exists' }
+        $temporary = Join-Path $parent.FullName ('.manual-' + [guid]::NewGuid().ToString('N') + '.tmp')
+        $bytes = [Text.UTF8Encoding]::new($false).GetBytes(($Record | ConvertTo-Json -Depth 16))
+        $sha = [Security.Cryptography.SHA256]::Create()
+        try { $expectedHash = ([BitConverter]::ToString($sha.ComputeHash($bytes))).Replace('-','').ToLowerInvariant() } finally { $sha.Dispose() }
+        if ($null -ne $BeforeTemporaryOpen) { & $BeforeTemporaryOpen $temporary }
+        $stream = [IO.File]::Open($temporary,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::Read)
+        try { $stream.Write($bytes,0,$bytes.Length); $stream.Flush($true) } finally { $stream.Dispose() }
+        [IO.File]::Move($temporary,$full)
+        $published = $true
+        if ($null -ne $PublishedHash) { $PublishedHash.Value = $expectedHash }
+        $targetItem = Get-Item -LiteralPath $full -Force -ErrorAction Stop
+        if ($targetItem -isnot [IO.FileInfo] -or ($targetItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'readback target' }
+        if ($null -ne $Readback -and -not [bool](& $Readback $full)) { throw 'readback verifier' }
+        $readbackObject = [IO.File]::ReadAllText($full,[Text.UTF8Encoding]::new($false,$true)) | ConvertFrom-Json -ErrorAction Stop
+        if ($null -eq $readbackObject -or (Get-CcodOfficialDraftFileSha256 -Path $full) -cne $expectedHash) { throw 'readback semantic mismatch' }
+        if ($null -ne $PublishedHash) { $PublishedHash.Value = $expectedHash }
+        return $full
+    } catch {
+        $failure = $_
+        if ($null -ne $temporary) {
+            try {
+                $tempItems = @()
+                try { $tempItems = @(Get-Item -LiteralPath $temporary -Force -ErrorAction Stop) } catch { if (-not (Test-CcodOfficialDraftMissingError -ErrorRecord $_)) { throw } }
+                if ($tempItems.Count -gt 0) {
+                    if ($tempItems.Count -ne 1 -or $tempItems[0] -isnot [IO.FileInfo] -or
+                        ($tempItems[0].Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0 -or
+                        $expectedHash -isnot [string] -or $expectedHash -notmatch '^[0-9a-f]{64}\z' -or
+                        (Get-CcodOfficialDraftFileSha256 -Path $temporary) -cne $expectedHash) { throw 'temporary cleanup target' }
+                    Remove-Item -LiteralPath $temporary -Force -ErrorAction Stop
+                }
+                $residual = $null
+                try { $residual = @(Get-Item -LiteralPath $temporary -Force -ErrorAction Stop) } catch { if (-not (Test-CcodOfficialDraftMissingError -ErrorRecord $_)) { throw } }
+                if ($null -ne $residual -and @($residual).Count -gt 0) { throw 'temporary cleanup residue' }
+            } catch { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_CLEANUP_FAILED' 'Temporary manual receipt cleanup could not be proven.' $temporary }
+        }
+        if ($published) {
+            try {
+                $item = $null
+                try { $item = Get-Item -LiteralPath $full -Force -ErrorAction Stop } catch { if (-not (Test-CcodOfficialDraftMissingError -ErrorRecord $_)) { throw } }
+                if ($null -ne $item) {
+                    if ($item -isnot [IO.FileInfo] -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0 -or
+                        ($null -ne $expectedHash -and (Get-CcodOfficialDraftFileSha256 -Path $full) -cne $expectedHash)) { throw 'readback cleanup target' }
+                    Remove-Item -LiteralPath $full -Force -ErrorAction Stop
+                }
+                $residual = $null
+                try { $residual = Get-Item -LiteralPath $full -Force -ErrorAction Stop } catch { if (-not (Test-CcodOfficialDraftMissingError -ErrorRecord $_)) { throw } }
+                if ($null -ne $residual) { throw 'readback cleanup residue' }
+            } catch {
+                Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_CLEANUP_FAILED' 'Receipt destination cleanup could not be proven after a failed readback.' $full
+            }
+        }
+        if ($failure.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw $failure }
+        Throw-CcodOfficialDraftError $ErrorId 'Manual acceptance evidence could not be written durably.' $full
+    }
+}
+
+function Remove-CcodOfficialDraftCompleteArtifacts {
+    param([Parameter(Mandatory)][string[]]$Paths,[Parameter(Mandatory)][hashtable]$ExpectedHashes,[scriptblock]$RemovePath)
+    $failures = [Collections.Generic.List[string]]::new()
+    foreach ($path in $Paths) {
+        $full = [IO.Path]::GetFullPath($path)
+        try {
+            $hasExpected = $ExpectedHashes.ContainsKey($full)
+            $expected = $null
+            if ($hasExpected) { $expected = [string]$ExpectedHashes[$full] }
+            $items = @(Get-Item -LiteralPath $full -Force -ErrorAction Stop)
+            if ($items.Count -ne 1 -or $items[0] -isnot [IO.FileInfo] -or
+                ($items[0].Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0 -or
+                -not $hasExpected -or $expected -notmatch '^[0-9a-f]{64}\z' -or (Get-CcodOfficialDraftFileSha256 -Path $full) -cne $expected) { throw 'cleanup target' }
+            if ($null -eq $RemovePath) { Remove-Item -LiteralPath $full -Force -ErrorAction Stop }
+            else { & $RemovePath $full }
+            try {
+                @(Get-Item -LiteralPath $full -Force -ErrorAction Stop) | Out-Null
+                [void]$failures.Add($full)
+            } catch {
+                $missing = $_.CategoryInfo.Category -eq 'ObjectNotFound' -or
+                    $_.Exception -is [IO.FileNotFoundException] -or $_.Exception -is [IO.DirectoryNotFoundException]
+                if (-not $missing) { [void]$failures.Add($full) }
+            }
+        } catch {
+            $missing = $_.CategoryInfo.Category -eq 'ObjectNotFound' -or
+                $_.Exception -is [IO.FileNotFoundException] -or $_.Exception -is [IO.DirectoryNotFoundException]
+            if ($missing) {
+                try {
+                    [void](Assert-CcodOfficialDraftMissingPathAncestorsSafe -Path $full -GetItem { param($CandidatePath) Get-Item -LiteralPath $CandidatePath -Force -ErrorAction Stop } -ErrorId 'CCOD_ACCEPTANCE_COMPLETE_CLEANUP_FAILED')
+                } catch { [void]$failures.Add($full) }
+            } else { [void]$failures.Add($full) }
+        }
+    }
+    if ($failures.Count -gt 0) {
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_COMPLETE_CLEANUP_FAILED' 'Complete acceptance cleanup could not prove terminal artifacts were removed.' ($failures -join ';')
+    }
+    return $true
+}
+
+function Assert-CcodOfficialDraftEvidenceHashesStable {
+    param(
+        [Parameter(Mandatory)][string]$ScreenshotPath,
+        [Parameter(Mandatory)][string]$RedactedLogPath,
+        [Parameter(Mandatory)][string]$ExpectedScreenshotSha256,
+        [Parameter(Mandatory)][string]$ExpectedRedactedLogSha256
+    )
+    try {
+        if (-not (Test-CcodOfficialDraftHash $ExpectedScreenshotSha256) -or
+            -not (Test-CcodOfficialDraftHash $ExpectedRedactedLogSha256)) { throw 'expected evidence hashes' }
+        [void](Assert-CcodOfficialDraftRegularEvidenceFile -Path $ScreenshotPath)
+        [void](Assert-CcodOfficialDraftRegularEvidenceFile -Path $RedactedLogPath)
+        $screenshotHash = Get-CcodOfficialDraftFileSha256 -Path $ScreenshotPath -ErrorId 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' -Message 'Manual screenshot could not be hashed safely.'
+        $redactedLogHash = Get-CcodOfficialDraftFileSha256 -Path $RedactedLogPath -ErrorId 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' -Message 'Manual redacted log could not be hashed safely.'
+        if ($screenshotHash -cne $ExpectedScreenshotSha256 -or $redactedLogHash -cne $ExpectedRedactedLogSha256) { throw 'evidence changed' }
+        return [pscustomobject][ordered]@{ screenshotSha256 = $screenshotHash; redactedLogSha256 = $redactedLogHash }
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'Manual evidence changed after operation proof.' $null
+    }
+}
+
+function Get-CcodOfficialDraftManualArtifactPaths {
+    param([Parameter(Mandatory)][string]$ArtifactDirectory,[Parameter(Mandatory)][string]$Operation,[switch]$Create)
+    try {
+        $root = [IO.Path]::GetFullPath($ArtifactDirectory)
+        $parent = [IO.Directory]::GetParent($root)
+        if ($null -eq $parent) { throw 'artifact parent' }
+        [void](Assert-CcodOfficialDraftSafeDirectory -Path $parent.FullName -ErrorId 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID')
+        $rootItem = $null
+        try { $rootItem = Get-Item -LiteralPath $root -Force -ErrorAction Stop } catch { if (-not (Test-CcodOfficialDraftMissingError -ErrorRecord $_)) { throw } }
+        if ($null -ne $rootItem -and -not $rootItem.PSIsContainer) { throw 'artifact root file' }
+        if ($null -eq $rootItem) {
+            if (-not $Create) { throw 'artifact root missing' }
+            [IO.Directory]::CreateDirectory($root) | Out-Null
+        }
+        [void](Assert-CcodOfficialDraftSafeDirectory -Path $root -ErrorId 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID')
+        $operationDirectory = Join-Path $root $Operation
+        $operationItem = $null
+        try { $operationItem = Get-Item -LiteralPath $operationDirectory -Force -ErrorAction Stop } catch { if (-not (Test-CcodOfficialDraftMissingError -ErrorRecord $_)) { throw } }
+        if ($null -ne $operationItem -and -not $operationItem.PSIsContainer) { throw 'artifact operation file' }
+        if ($null -eq $operationItem) {
+            if (-not $Create) { throw 'artifact operation missing' }
+            [IO.Directory]::CreateDirectory($operationDirectory) | Out-Null
+        }
+        [void](Assert-CcodOfficialDraftSafeDirectory -Path $operationDirectory -ErrorId 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID')
+        return [pscustomobject][ordered]@{
+            Directory = $operationDirectory
+            Screenshot = Join-Path $operationDirectory 'screenshot.bin'
+            RedactedLog = Join-Path $operationDirectory 'redacted.log'
+        }
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'Manual artifact directory is missing, reused, or unsafe.' $ArtifactDirectory
+    }
+}
+
+function Write-CcodOfficialDraftManualArtifacts {
+    param(
+        [Parameter(Mandatory)][string]$ArtifactDirectory,
+        [Parameter(Mandatory)][string]$Operation,
+        [Parameter(Mandatory)][string]$ScreenshotPath,
+        [Parameter(Mandatory)][string]$RedactedLogPath,
+        [Parameter(Mandatory)][string]$ExpectedScreenshotSha256,
+        [Parameter(Mandatory)][string]$ExpectedRedactedLogSha256
+    )
+    $paths = $null
+    $created = [Collections.Generic.List[string]]::new()
+    $temporary = [Collections.Generic.List[string]]::new()
+    $temporaryHashes = @{}
+    $createdHashes = @{}
+    try {
+        $paths = Get-CcodOfficialDraftManualArtifactPaths -ArtifactDirectory $ArtifactDirectory -Operation $Operation -Create
+        foreach ($target in @($paths.Screenshot,$paths.RedactedLog)) {
+            $targetItem = $null
+            try { $targetItem = Get-Item -LiteralPath $target -Force -ErrorAction Stop } catch { if (-not (Test-CcodOfficialDraftMissingError -ErrorRecord $_)) { throw } }
+            if ($null -ne $targetItem) { throw 'artifact reused' }
+        }
+        foreach ($pair in @(
+            [pscustomobject]@{ Source = $ScreenshotPath; Target = $paths.Screenshot; ExpectedHash = $ExpectedScreenshotSha256 }
+            [pscustomobject]@{ Source = $RedactedLogPath; Target = $paths.RedactedLog; ExpectedHash = $ExpectedRedactedLogSha256 }
+        )) {
+            $temporaryPath = Join-Path $paths.Directory ('.manual-artifact-' + [guid]::NewGuid().ToString('N') + '.tmp')
+            $temporary.Add($temporaryPath)
+            [IO.File]::Copy((Assert-CcodOfficialDraftRegularEvidenceFile -Path $pair.Source), $temporaryPath, $false)
+            [void](Assert-CcodOfficialDraftRegularEvidenceFile -Path $temporaryPath)
+            $temporaryHash = Get-CcodOfficialDraftFileSha256 -Path $temporaryPath -ErrorId 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' -Message 'Temporary manual artifact could not be hashed safely.'
+            $temporaryHashes[[IO.Path]::GetFullPath($temporaryPath)] = $temporaryHash
+            if ($temporaryHash -cne $pair.ExpectedHash) { throw 'artifact hash mismatch' }
+            [IO.File]::Move($temporaryPath, $pair.Target)
+            [void]$temporary.Remove($temporaryPath)
+            $created.Add($pair.Target)
+            $createdHashes[[IO.Path]::GetFullPath($pair.Target)] = $temporaryHash
+        }
+        [void](Assert-CcodOfficialDraftRegularEvidenceFile -Path $paths.Screenshot)
+        [void](Assert-CcodOfficialDraftRegularEvidenceFile -Path $paths.RedactedLog)
+        $screenshotHash = Get-CcodOfficialDraftFileSha256 -Path $paths.Screenshot -ErrorId 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' -Message 'Published manual screenshot could not be hashed safely.'
+        $redactedLogHash = Get-CcodOfficialDraftFileSha256 -Path $paths.RedactedLog -ErrorId 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' -Message 'Published manual redacted log could not be hashed safely.'
+        if ($screenshotHash -cne $ExpectedScreenshotSha256 -or $redactedLogHash -cne $ExpectedRedactedLogSha256) { throw 'artifact hash mismatch' }
+        return $paths
+    } catch {
+        if ($temporary.Count -gt 0) {
+            try { [void](Remove-CcodOfficialDraftCompleteArtifacts -Paths @($temporary) -ExpectedHashes $temporaryHashes) }
+            catch { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_CLEANUP_FAILED' 'Temporary manual artifact cleanup could not prove removal.' ($temporary -join ';') }
+        }
+        if ($created.Count -gt 0) {
+            try { [void](Remove-CcodOfficialDraftCompleteArtifacts -Paths @($created) -ExpectedHashes $createdHashes) }
+            catch { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_CLEANUP_FAILED' 'Manual artifact cleanup could not prove removal after a failed evidence write.' ($created -join ';') }
+        }
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'Manual evidence artifacts could not be copied and verified.' $ArtifactDirectory
+    }
+}
+
+function Write-CcodOfficialDraftManualEvidence {
+    param(
+        [Parameter(Mandatory)][string]$StateDirectory,
+        [Parameter(Mandatory)][string]$Phase,
+        [Parameter(Mandatory)][string]$Operation,
+        [Parameter(Mandatory)]$Candidate,
+        [Parameter(Mandatory)]$Existing,
+        [Parameter(Mandatory)]$ProgrammaticResult,
+        [Parameter(Mandatory)][string]$ScreenshotPath,
+        [Parameter(Mandatory)][string]$RedactedLogPath,
+        [Parameter(Mandatory)][string]$ArtifactDirectory,
+        [Parameter(Mandatory)][string]$ReviewState,
+        [string]$ExpectedChallenge,
+        [string]$ExpectedRuntimeId,
+        $ExpectedGeneration,
+        [string]$ExpectedManifestSha256
+    )
+    $artifactPaths = $null
+    $receiptPath = $null
+    $cleanupHashes = @{}
+    try {
+        if ($Phase -notin @('TrayEvidence','RemoteEvidence') -or
+            -not $script:CcodOfficialDraftManualFiles.ContainsKey($Operation) -or
+            ($Phase -ceq 'TrayEvidence' -and $Operation -ceq 'SecondDeviceControl') -or
+            ($Phase -ceq 'RemoteEvidence' -and $Operation -cne 'SecondDeviceControl') -or
+            $ReviewState -cne 'Reviewed' -or
+            -not (Test-CcodOfficialDraftExactProperties -Value $ProgrammaticResult -Expected @('verified','operation','terminalState','code','proof','screenshotSha256','redactedLogSha256')) -or
+            $ProgrammaticResult.verified -isnot [bool] -or -not [bool]$ProgrammaticResult.verified -or
+            $ProgrammaticResult.operation -isnot [string] -or $ProgrammaticResult.operation -cne $Operation -or
+            $ProgrammaticResult.terminalState -isnot [string] -or $ProgrammaticResult.terminalState -cne [string]$script:CcodOfficialDraftManualTerminalStates[$Operation] -or
+            $ProgrammaticResult.code -isnot [string] -or $ProgrammaticResult.code -cne [string]$script:CcodOfficialDraftManualResultCodes[$Operation] -or
+            $ProgrammaticResult.screenshotSha256 -isnot [string] -or $ProgrammaticResult.redactedLogSha256 -isnot [string]) { throw 'manual input' }
+            $proof = $null
+            if ($Operation -ceq 'SecondDeviceControl') {
+            $proof = ConvertTo-CcodOfficialDraftRemoteProof -Proof $ProgrammaticResult.proof
+            if (-not [string]::IsNullOrEmpty([string]$ExpectedChallenge) -and $proof.challenge -cne $ExpectedChallenge -or
+            -not [string]::IsNullOrEmpty([string]$ExpectedRuntimeId) -and $proof.runtimeId -cne $ExpectedRuntimeId -or
+            $null -ne $ExpectedGeneration -and ([UInt64]$proof.runtimeGeneration -ne [UInt64]$ExpectedGeneration) -or
+            -not [string]::IsNullOrEmpty([string]$ExpectedManifestSha256) -and $proof.runtimeManifestSha256 -cne $ExpectedManifestSha256 -or
+            $proof.candidateVersion -cne [string]$Candidate.version) { throw 'remote proof binding' }
+            } else {
+            $proof = ConvertTo-CcodOfficialDraftTrayProof -Proof $ProgrammaticResult.proof -Operation $Operation
+            }
+            $stableHashes = Assert-CcodOfficialDraftEvidenceHashesStable -ScreenshotPath $ScreenshotPath -RedactedLogPath $RedactedLogPath -ExpectedScreenshotSha256 $ProgrammaticResult.screenshotSha256 -ExpectedRedactedLogSha256 $ProgrammaticResult.redactedLogSha256
+        $screenshotHash = [string]$stableHashes.screenshotSha256
+        $logHash = [string]$stableHashes.redactedLogSha256
+        if ($screenshotHash -ceq $logHash) { throw 'same file' }
+        foreach ($record in @($Existing.Values)) {
+            if ($null -eq $record) { continue }
+            if ([string]$record.operation -ceq $Operation -or
+                [string]$record.screenshotSha256 -ceq $screenshotHash -or
+                [string]$record.screenshotSha256 -ceq $logHash -or
+                [string]$record.redactedLogSha256 -ceq $screenshotHash -or
+                [string]$record.redactedLogSha256 -ceq $logHash) { throw 'manual reuse' }
+        }
+        $artifactPaths = Write-CcodOfficialDraftManualArtifacts -ArtifactDirectory $ArtifactDirectory -Operation $Operation -ScreenshotPath $ScreenshotPath -RedactedLogPath $RedactedLogPath -ExpectedScreenshotSha256 $screenshotHash -ExpectedRedactedLogSha256 $logHash
+        $cleanupHashes[[IO.Path]::GetFullPath($artifactPaths.Screenshot)] = $screenshotHash
+        $cleanupHashes[[IO.Path]::GetFullPath($artifactPaths.RedactedLog)] = $logHash
+        $record = [pscustomobject][ordered]@{
+            schemaVersion = 1
+            kind = 'manual-evidence'
+            phase = $Phase
+            operation = $Operation
+            terminalState = [string]$ProgrammaticResult.terminalState
+            result = [string]$ProgrammaticResult.code
+            proof = $proof
+            reviewState = 'Reviewed'
+            version = [string]$Candidate.version
+            gitCommit = [string]$Candidate.gitCommit
+            candidateManifestSha256 = [string]$Candidate.manifestHashes.portable
+            screenshotSha256 = $screenshotHash
+            redactedLogSha256 = $logHash
+        }
+        $path = Get-CcodOfficialDraftManualEvidencePath -StateDirectory $StateDirectory -Operation $Operation
+        $publishedReceiptHash = $null
+        $receiptPath = Write-CcodOfficialDraftJsonCreateOnly -Path $path -Record $record -ErrorId 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_WRITE_FAILED' -PublishedHash ([ref]$publishedReceiptHash)
+        $cleanupHashes[[IO.Path]::GetFullPath($receiptPath)] = $publishedReceiptHash
+        return (Assert-CcodOfficialDraftManualRecordShape -Record (Read-CcodOfficialDraftJson -Path $receiptPath).Value)
+    } catch {
+        $failure = $_
+        $cleanupPaths = [Collections.Generic.List[string]]::new()
+        if ($null -ne $receiptPath) { $cleanupPaths.Add($receiptPath) }
+        if ($null -ne $artifactPaths) { $cleanupPaths.Add($artifactPaths.Screenshot); $cleanupPaths.Add($artifactPaths.RedactedLog) }
+        if ($cleanupPaths.Count -gt 0) {
+            try { [void](Remove-CcodOfficialDraftCompleteArtifacts -Paths @($cleanupPaths) -ExpectedHashes $cleanupHashes) }
+            catch { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_CLEANUP_FAILED' 'Manual receipt and artifact cleanup could not prove removal after a failed record write.' ($cleanupPaths -join ';') }
+        }
+        if ($failure.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw $failure }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'Manual evidence is missing, reused, unreviewed, or unsafe.' $null
+    }
+}
+
+function Assert-CcodOfficialDraftManualEvidenceArtifacts {
+    param([Parameter(Mandatory)][string]$EvidenceRoot,[Parameter(Mandatory)]$Records)
+    try {
+        $artifactRoot = Join-Path $EvidenceRoot $script:CcodOfficialDraftManualArtifactRootName
+        foreach ($record in @($Records)) {
+            $paths = Get-CcodOfficialDraftManualArtifactPaths -ArtifactDirectory $artifactRoot -Operation ([string]$record.operation)
+            [void](Assert-CcodOfficialDraftRegularEvidenceFile -Path $paths.Screenshot)
+            [void](Assert-CcodOfficialDraftRegularEvidenceFile -Path $paths.RedactedLog)
+            $screenshotHash = Get-CcodOfficialDraftFileSha256 -Path $paths.Screenshot -ErrorId 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' -Message 'Persisted manual screenshot could not be hashed safely.'
+            $redactedLogHash = Get-CcodOfficialDraftFileSha256 -Path $paths.RedactedLog -ErrorId 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' -Message 'Persisted manual redacted log could not be hashed safely.'
+            if ($screenshotHash.ToLowerInvariant() -cne ([string]$record.screenshotSha256).ToLowerInvariant() -or $redactedLogHash.ToLowerInvariant() -cne ([string]$record.redactedLogSha256).ToLowerInvariant()) { throw 'manual artifact hash' }
+        }
+        return $true
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'Persisted manual evidence artifacts do not match their recorded hashes.' $EvidenceRoot
+    }
+}
+
+function Write-CcodOfficialDraftCompleteAcceptance {
+    param([Parameter(Mandatory)][string]$EvidenceRoot,[string]$PreviousAssetDirectory,[Parameter(Mandatory)]$Candidate,[Parameter(Mandatory)]$Draft,[Parameter(Mandatory)]$ManualEvidence,[Parameter(Mandatory)]$AutomatedReceiptHashes,[Parameter(Mandatory)][datetime]$CompletedAtUtc,[string]$Path,[ref]$PublishedHash)
+    try {
+        if ($CompletedAtUtc.Kind -ne [DateTimeKind]::Utc) { throw 'complete clock kind' }
+        $stateDirectory = Get-CcodOfficialDraftStateDirectory -EvidenceRoot $EvidenceRoot
+        $reloadedRecords = Read-CcodOfficialDraftState -StateDirectory $stateDirectory -PreviousAssetDirectory $PreviousAssetDirectory
+        if (-not $reloadedRecords.ContainsKey('Preflight') -or
+            -not (Test-CcodOfficialDraftCandidateEqual -Left $Candidate -Right $reloadedRecords['Preflight'].candidate) -or
+            -not (Test-CcodOfficialDraftDraftEqual -Left $Draft -Right $reloadedRecords['Preflight'].draft)) {
+            throw 'complete chain identity'
+        }
+        $draftIdentity = ConvertTo-CcodOfficialDraftIdentity -Value $Draft
+        $manual = Assert-CcodOfficialDraftManualEvidenceSet -Records $reloadedRecords.ManualEvidence -Candidate $Candidate
+        [void](Assert-CcodOfficialDraftManualEvidenceArtifacts -EvidenceRoot $EvidenceRoot -Records $manual)
+        $automated = @($AutomatedReceiptHashes)
+        if ($automated.Count -ne ($script:CcodOfficialDraftPhases.Count + 1)) { throw 'automated receipt hash count' }
+        $normalizedAutomated = [Collections.Generic.List[object]]::new()
+        $expectedPhases = @($script:CcodOfficialDraftPhases) + @('Complete')
+        for ($index = 0; $index -lt $expectedPhases.Count; $index++) {
+            $entry = $automated[$index]
+            if ($null -eq $entry -or -not (Test-CcodOfficialDraftExactProperties -Value $entry -Expected @('phase','sha256')) -or
+                $entry.phase -isnot [string] -or $entry.phase -cne $expectedPhases[$index] -or
+                -not (Test-CcodOfficialDraftHash $entry.sha256)) { throw 'automated receipt hash shape' }
+            $leaf = if ($expectedPhases[$index] -ceq 'Complete') { $script:CcodOfficialDraftCompletionFile } else { $script:CcodOfficialDraftPhaseFiles[$expectedPhases[$index]] }
+            $statePath = Join-Path $stateDirectory $leaf
+            if ((Get-CcodOfficialDraftFileSha256 -Path $statePath) -cne [string]$entry.sha256) { throw 'automated receipt hash binding' }
+            $normalizedAutomated.Add([pscustomobject][ordered]@{ phase = $expectedPhases[$index]; sha256 = [string]$entry.sha256 })
+        }
+        $path = if ([string]::IsNullOrWhiteSpace($Path)) { Get-CcodOfficialDraftCompleteAcceptancePath -EvidenceRoot $EvidenceRoot } else { [IO.Path]::GetFullPath($Path) }
+        $existing = $null
+        try { $existing = Get-Item -LiteralPath $path -Force -ErrorAction Stop } catch { if (-not (Test-CcodOfficialDraftMissingError -ErrorRecord $_)) { throw } }
+        if ($null -ne $existing) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_PHASE_REUSED' 'The complete acceptance receipt already exists.' $null
+        }
+        $record = [pscustomobject][ordered]@{
+            schemaVersion = 1
+            kind = 'official-draft-acceptance'
+            version = [string]$Candidate.version
+            gitCommit = [string]$Candidate.gitCommit
+            draft = $draftIdentity
+            candidateManifestSha256 = [string]$Candidate.manifestHashes.portable
+            phase = 'Complete'
+            completedAtUtc = $CompletedAtUtc.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)
+            automatedReceiptSha256 = @($normalizedAutomated)
+            manualEvidence = @($manual)
+        }
+        [void](Write-CcodOfficialDraftJsonCreateOnly -Path $path -Record $record -ErrorId 'CCOD_ACCEPTANCE_COMPLETE_WRITE_FAILED' -PublishedHash $PublishedHash)
+        return (Read-CcodOfficialDraftJson -Path $path).Value
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_COMPLETE_WRITE_FAILED' 'The complete official-draft acceptance receipt could not be written.' $null
+    }
+}
+
+function Get-CcodOfficialDraftBootIdentity {
+    param([Parameter(Mandatory)]$Adapters)
+    try {
+        $values = @(& $Adapters.GetBootIdentity)
+        if ($values.Count -ne 1 -or $values[0] -isnot [string] -or
+            [string]$values[0] -notmatch '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}\z') { throw 'boot identity' }
+        return [string]$values[0]
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_BOOT_ID_INVALID' 'The boot identity observation is missing or malformed.' $null
+    }
+}
+
+function ConvertTo-CcodOfficialDraftPreRebootFacts {
+    param(
+        [Parameter(Mandatory)][string]$BootId,
+        [Parameter(Mandatory)][string]$FreshReceiptHash,
+        [Parameter(Mandatory)][string]$RuntimeId,
+        [Parameter(Mandatory)][UInt64]$Generation,
+        [Parameter(Mandatory)][string]$ManifestHash,
+        [Parameter(Mandatory)][string]$KeyHash,
+        [Parameter(Mandatory)]$Observation
+    )
+    return [pscustomobject][ordered]@{
+        rebootRequested = $true
+        bootIdBefore = $BootId
+        freshInstallReceiptSha256 = $FreshReceiptHash
+        activeRuntimeId = $RuntimeId
+        activeGeneration = $Generation
+        runtimeManifestSha256 = $ManifestHash
+        deviceKeySha256 = $KeyHash
+        operationOutcome = 'Completed'
+        observation = $Observation
+    }
+}
+
+function Assert-CcodOfficialDraftPostRebootFacts {
+    param(
+        [Parameter(Mandatory)]$Facts,
+        [Parameter(Mandatory)]$FreshFacts,
+        [Parameter(Mandatory)][string]$ExpectedKeyHash,
+        [Parameter(Mandatory)][string]$BootBefore,
+        [Parameter(Mandatory)][string]$ExpectedVersion
+    )
+    try {
+        foreach ($name in @('installRootPresent','activePointerPresent','bootId','transitionStage','protectionRecovered','protectionReady','taskState','supervisor','trayHost','codex','codexCount','statusCodex','trayAuthenticated','lifecycleReceipt','runtimeManifestSha256')) {
+            if (-not (Test-CcodOfficialDraftHasFact -Facts $Facts -Name $name)) { throw 'missing fact' }
+        }
+        foreach ($name in @('installRootPresent','activePointerPresent')) {
+            $presence = Get-CcodOfficialDraftFactValue -Facts $Facts -Name $name
+            if ($presence -isnot [bool] -or -not [bool]$presence) { throw 'installed state presence' }
+        }
+        $bootAfter = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'bootId'
+        if ($bootAfter -isnot [string] -or $bootAfter -notmatch '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}\z' -or $bootAfter -ceq $BootBefore) { throw 'boot' }
+        if ((Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'transitionStage') -isnot [string] -or
+            (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'transitionStage') -cne 'Idle') { throw 'transition' }
+        foreach ($name in @('protectionRecovered','protectionReady','trayAuthenticated')) {
+            $value = Get-CcodOfficialDraftFactValue -Facts $Facts -Name $name
+            if ($value -isnot [bool] -or -not [bool]$value) { throw 'protection' }
+        }
+        if ((Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'taskState') -notin @('Ready','Running') -or
+            @(Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'supervisor').Count -ne 1 -or
+            @(Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'trayHost').Count -ne 1 -or
+            -not (Test-CcodOfficialDraftInt32 (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'codexCount')) -or
+            [int](Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'codexCount') -ne 1 -or
+            @(Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'codex').Count -ne 1 -or
+            $null -eq (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'statusCodex')) { throw 'runtime' }
+        $trayIdentity = ConvertTo-CcodOfficialDraftTrayHostIdentity -Value (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'trayHostIdentity')
+        $observedTrayIdentity = ConvertTo-CcodOfficialDraftTrayHostIdentity -Value (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'trayHost')[0]
+        if ($trayIdentity.pid -ne $observedTrayIdentity.pid -or $trayIdentity.creationTimeUtc -cne $observedTrayIdentity.creationTimeUtc) { throw 'tray identity binding' }
+        $terminal = ConvertTo-CcodOfficialDraftTerminalReceipt -Receipt (Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'lifecycleReceipt')
+        $expectedTerminal = Get-CcodOfficialDraftFactValue -Facts $FreshFacts -Name 'terminalReceipt'
+        $observedRuntimeId = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'activeRuntimeId'
+        $observedGeneration = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'activeGeneration'
+        $expectedRuntimeId = Get-CcodOfficialDraftFactValue -Facts $FreshFacts -Name 'activeRuntimeId'
+        $expectedGeneration = Get-CcodOfficialDraftFactValue -Facts $FreshFacts -Name 'activeGeneration'
+        $observedManifestHash = Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'runtimeManifestSha256'
+        $expectedManifestHash = Get-CcodOfficialDraftFactValue -Facts $FreshFacts -Name 'runtimeManifestSha256'
+        if ($observedRuntimeId -isnot [string] -or $observedRuntimeId -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z' -or
+            -not (Test-CcodOfficialDraftPositiveInteger $observedGeneration) -or
+            -not (Test-CcodOfficialDraftHash $observedManifestHash) -or $observedManifestHash -cne $expectedManifestHash -or
+            $terminal.runtimeId -cne $observedRuntimeId -or [UInt64]$terminal.runtimeGeneration -ne [UInt64]$observedGeneration -or
+            $observedRuntimeId -cne $expectedRuntimeId -or [UInt64]$observedGeneration -ne [UInt64]$expectedGeneration -or
+            $terminal.runtimeId -cne $expectedTerminal.runtimeId -or [UInt64]$terminal.runtimeGeneration -ne [UInt64]$expectedTerminal.runtimeGeneration) { throw 'receipt continuity' }
+        $keyHash = Get-CcodOfficialDraftObservedKeyHash -Facts $Facts
+        if ($keyHash -cne $ExpectedKeyHash) { throw 'key' }
+        $observation = ConvertTo-CcodOfficialDraftLegacyObservation -Facts $Facts -ExpectedVersion $ExpectedVersion
+        if ($observation.bootId -cne [string]$bootAfter -or $observation.activeRuntimeId -cne [string]$observedRuntimeId -or
+            [UInt64]$observation.activeGeneration -ne [UInt64]$observedGeneration -or
+            $observation.runtimeManifestSha256 -cne [string]$observedManifestHash -or
+            $observation.deviceKeySha256 -cne [string]$keyHash) { throw 'observation continuity' }
+        return [pscustomobject][ordered]@{
+            observation = $observation
+            installRootPresent = $true
+            activePointerPresent = $true
+            bootIdBefore = $BootBefore
+            bootIdAfter = [string]$bootAfter
+            bootChanged = $true
+            receiptContinuity = $true
+            activeRuntimeId = [string]$observedRuntimeId
+            activeGeneration = [UInt64]$observedGeneration
+            runtimeManifestSha256 = [string]$observedManifestHash
+            transitionStage = 'Idle'
+            protectionRecovered = $true
+            protectionReady = $true
+            taskState = [string](Get-CcodOfficialDraftFactValue -Facts $Facts -Name 'taskState')
+            supervisorCount = 1
+            trayHostCount = 1
+            codexCount = 1
+            trayHostIdentity = $trayIdentity
+            trayAuthenticated = $true
+            terminalReceipt = $terminal
+            deviceKeySha256 = $keyHash
+            keyHashPreserved = $true
+            operationOutcome = 'Completed'
+        }
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_POST_REBOOT_OBSERVATION_INVALID' 'Post-reboot observations did not prove a new boot and recovered protected runtime.' $null
+    }
+}
+
+function Invoke-CcodOfficialDraftAcceptanceCore {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][ValidateSet('Preflight','LegacyUpgrade','Uninstall','FreshInstall','PreReboot','PostReboot','ReadyForManualEvidence','TrayEvidence','RemoteEvidence','Complete')][string]$Phase,
+        [Parameter(Mandatory)][string]$AssetDirectory,
+        [Parameter(Mandatory)][string]$PreviousAssetDirectory,
+        [Parameter(Mandatory)][string]$EvidenceRoot,
+        [string]$DraftId,
+        [switch]$AllowMachineMutation,
+        [switch]$AllowCodexRestart,
+        [switch]$AllowWindowsReboot,
+        [string]$TrayOperation,
+        [string]$RemoteOperation,
+        [string]$ScreenshotPath,
+        [string]$RedactedLogPath,
+        [string]$ReviewState,
+        [hashtable]$Adapters
+    )
+    $phaseMatches = @(@($script:CcodOfficialDraftPhases) + @('TrayEvidence','RemoteEvidence','Complete') | Where-Object { [string]$_ -ieq [string]$Phase })
+    if ($phaseMatches.Count -ne 1) { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_PHASE_INVALID' 'The official-draft acceptance phase is unsupported.' $Phase }
+    $Phase = [string]$phaseMatches[0]
+    $operationLease = Open-CcodOfficialDraftOperationLease -EvidenceRoot $EvidenceRoot
+    try {
+    $stateDirectory = Get-CcodOfficialDraftStateDirectory -EvidenceRoot $EvidenceRoot
+    [void](Assert-CcodOfficialDraftSafeDirectory -Path $PreviousAssetDirectory -ErrorId 'CCOD_ACCEPTANCE_PREVIOUS_ASSET_INVALID')
+    $adapters = Resolve-CcodOfficialDraftAdapters -Adapters $Adapters
+    $candidateValue = $null
+    try {
+        $candidateValue = & $adapters.ValidateAssetSet $AssetDirectory $script:CcodOfficialDraftExpectedVersion
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+        Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_ASSET_CONTRACT_INVALID' 'The official draft does not satisfy the exact eleven-asset manifest contract.' $null
+    }
+    $candidate = ConvertTo-CcodOfficialDraftCandidate -Value $candidateValue
+    $draftValue = $null
+    try { $draftValue = & $adapters.GetDraftIdentity $AssetDirectory $candidate $DraftId } catch { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_DRAFT_IDENTITY_INVALID' 'The official draft identity could not be read.' $null }
+    $draft = ConvertTo-CcodOfficialDraftIdentity -Value $draftValue
+    $records = Read-CcodOfficialDraftState -StateDirectory $stateDirectory -PreviousAssetDirectory $PreviousAssetDirectory
+    $allowExistingComplete = $false
+    if ($Phase -ceq 'Complete' -and $records.ContainsKey('Complete')) {
+        $existingAcceptance = $null
+        $acceptancePathForResume = Get-CcodOfficialDraftCompleteAcceptancePath -EvidenceRoot $EvidenceRoot
+        try { $existingAcceptance = Get-Item -LiteralPath $acceptancePathForResume -Force -ErrorAction Stop } catch { if (-not (Test-CcodOfficialDraftMissingError -ErrorRecord $_)) { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_PHASE_REUSED' 'The complete acceptance artifact could not be inspected safely.' $acceptancePathForResume } }
+        $allowExistingComplete = $null -eq $existingAcceptance
+    }
+    Assert-CcodOfficialDraftPhaseState -Phase $Phase -Records $records -Candidate $candidate -Draft $draft -AllowExistingComplete:$allowExistingComplete
+    Assert-CcodOfficialDraftPhaseAuthorization -Phase $Phase -AllowMachineMutation:$AllowMachineMutation -AllowCodexRestart:$AllowCodexRestart -AllowWindowsReboot:$AllowWindowsReboot
+    if ($Phase -ceq 'Preflight') {
+        $scanReceipts = [Collections.Generic.List[object]]::new()
+        $expectedScans = @(
+            [pscustomobject]@{ Type = 'Setup'; Index = 5 },
+            [pscustomobject]@{ Type = 'PortableZip'; Index = 0 }
+        )
+        foreach ($scan in $expectedScans) {
+            $pending = Join-Path $stateDirectory ('.defender-' + $scan.Type + '-' + [guid]::NewGuid().ToString('N') + '.json')
+            $pendingExpected = @{ ([IO.Path]::GetFullPath($pending)) = $null }
+            try {
+                $rawReceipt = & $adapters.InvokeDefenderCheck $AssetDirectory $scan.Type 'InternetDownload' $candidate.version $candidate.gitCommit $pending
+                $pendingHash = $null
+                try { $pendingItem = Get-Item -LiteralPath $pending -Force -ErrorAction Stop; if ($null -ne $pendingItem) { $pendingHash = Get-CcodOfficialDraftFileSha256 -Path $pending } } catch { if (-not (Test-CcodOfficialDraftMissingError -ErrorRecord $_)) { throw } }
+                $pendingExpected = @{ ([IO.Path]::GetFullPath($pending)) = $pendingHash }
+                if ($null -eq $rawReceipt) { throw 'empty' }
+                $scanReceipts.Add((ConvertTo-CcodOfficialDraftDefenderReceipt -Receipt $rawReceipt -Candidate $candidate -AssetType $scan.Type))
+            } catch {
+                if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+                Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_DEFENDER_RECEIPT_INVALID' 'The official downloaded-asset Defender scan did not produce a valid receipt.' $null
+            } finally {
+                try { [void](Remove-CcodOfficialDraftCompleteArtifacts -Paths @($pending) -ExpectedHashes $pendingExpected) }
+                catch { Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_DEFENDER_RECEIPT_CLEANUP_FAILED' 'Temporary Defender receipt cleanup could not be proven.' $pending }
+            }
+        }
+        $facts = [pscustomobject][ordered]@{ defenderReceipts = @($scanReceipts) }
+        $written = Write-CcodOfficialDraftReceipt -StateDirectory $stateDirectory -Phase $Phase -Candidate $candidate -Draft $draft -Facts $facts
+        return [pscustomobject][ordered]@{ phase = 'Preflight'; outcome = 'Completed'; complete = $false; candidate = $written.candidate; facts = $written.facts }
+    }
+    if ($Phase -ceq 'LegacyUpgrade') {
+        try {
+            $previousValues = @(& $adapters.ValidatePreviousSetup $PreviousAssetDirectory '2.5.21')
+            if ($previousValues.Count -ne 1 -or $null -eq $previousValues[0]) { throw 'previous' }
+            $previous = ConvertTo-CcodOfficialDraftPreviousSetup -Value $previousValues[0]
+        } catch {
+            if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_PREVIOUS_ASSET_INVALID' 'The previous public v2.5.21 Setup is not manifest-bound.' $null
+        }
+        $context = New-CcodOfficialDraftContext -Phase $Phase -AssetDirectory $AssetDirectory -PreviousAssetDirectory $PreviousAssetDirectory -EvidenceRoot $EvidenceRoot -Candidate $candidate -Draft $draft -PreviousSetup $previous -AllowMachineMutation:$AllowMachineMutation -AllowCodexRestart:$AllowCodexRestart -AllowWindowsReboot:$AllowWindowsReboot
+        try {
+            $beforeValues = @(& $adapters.CaptureFacts $context 'Before')
+            if ($beforeValues.Count -ne 1 -or $null -eq $beforeValues[0]) { throw 'before facts' }
+            $beforeObservation = ConvertTo-CcodOfficialDraftLegacyObservation -Facts $beforeValues[0] -ExpectedVersion $previous.version
+            $beforeHash = [string]$beforeObservation.deviceKeySha256
+        } catch {
+            if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE' 'The pre-upgrade lifecycle observation is unavailable.' $null
+        }
+        [void](Invoke-CcodOfficialDraftPhaseOperation -Adapters $adapters -Context $context)
+        try {
+            $afterValues = @(& $adapters.CaptureFacts $context 'After')
+            if ($afterValues.Count -ne 1 -or $null -eq $afterValues[0]) { throw 'after facts' }
+            $afterObservation = ConvertTo-CcodOfficialDraftLegacyObservation -Facts $afterValues[0] -ExpectedVersion $candidate.version
+            $afterHash = [string]$afterObservation.deviceKeySha256
+        } catch {
+            if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE' 'The post-upgrade lifecycle observation is unavailable.' $null
+        }
+        if ($beforeHash -cne $afterHash) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_KEY_HASH_CHANGED' 'The DPAPI device-key hash changed during legacy upgrade.' $null
+        }
+        $facts = ConvertTo-CcodOfficialDraftLegacyFacts -PreviousSetup $previous -BeforeObservation $beforeObservation -AfterObservation $afterObservation -BeforeHash $beforeHash -AfterHash $afterHash
+        $written = Write-CcodOfficialDraftReceipt -StateDirectory $stateDirectory -Phase $Phase -Candidate $candidate -Draft $draft -Facts $facts
+        return [pscustomobject][ordered]@{ phase = 'LegacyUpgrade'; outcome = 'Completed'; complete = $false; candidate = $written.candidate; facts = $written.facts }
+    }
+    if ($Phase -ceq 'Uninstall') {
+        $legacyFacts = $records.LegacyUpgrade.facts
+        $expectedKeyHash = Get-CcodOfficialDraftFactValue -Facts $legacyFacts -Name 'deviceKeySha256After'
+        if (-not (Test-CcodOfficialDraftHash $expectedKeyHash)) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'LegacyUpgrade does not contain a usable device-key hash.' $null
+        }
+        $context = New-CcodOfficialDraftContext -Phase $Phase -AssetDirectory $AssetDirectory -PreviousAssetDirectory $PreviousAssetDirectory -EvidenceRoot $EvidenceRoot -Candidate $candidate -Draft $draft -PreviousSetup $legacyFacts.previousSetup -AllowMachineMutation:$AllowMachineMutation -AllowCodexRestart:$AllowCodexRestart -AllowWindowsReboot:$AllowWindowsReboot
+        try {
+            $beforeValues = @(& $adapters.CaptureFacts $context 'Before')
+            if ($beforeValues.Count -ne 1 -or $null -eq $beforeValues[0]) { throw 'before facts' }
+            $beforeHash = Get-CcodOfficialDraftObservedKeyHash -Facts $beforeValues[0]
+        } catch {
+            if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE' 'The pre-uninstall lifecycle observation is unavailable.' $null
+        }
+        if ($beforeHash -cne [string]$expectedKeyHash) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_KEY_HASH_CHANGED' 'The DPAPI device-key hash changed before uninstall.' $null
+        }
+        [void](Invoke-CcodOfficialDraftPhaseOperation -Adapters $adapters -Context $context)
+        try {
+            $afterValues = @(& $adapters.CaptureFacts $context 'After')
+            if ($afterValues.Count -ne 1 -or $null -eq $afterValues[0]) { throw 'after facts' }
+            $afterHash = Assert-CcodOfficialDraftUninstallFacts -Facts $afterValues[0] -ExpectedKeyHash $expectedKeyHash
+        } catch {
+            if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_UNINSTALL_OBSERVATION_INVALID' 'Uninstall did not prove complete owned-state removal.' $null
+        }
+        $facts = ConvertTo-CcodOfficialDraftUninstallFacts -Facts $afterValues[0] -BeforeHash $beforeHash -AfterHash $afterHash
+        $written = Write-CcodOfficialDraftReceipt -StateDirectory $stateDirectory -Phase $Phase -Candidate $candidate -Draft $draft -Facts $facts
+        return [pscustomobject][ordered]@{ phase = 'Uninstall'; outcome = 'Completed'; complete = $false; candidate = $written.candidate; facts = $written.facts }
+    }
+    if ($Phase -ceq 'FreshInstall') {
+        $uninstallFacts = $records.Uninstall.facts
+        $expectedKeyHash = Get-CcodOfficialDraftFactValue -Facts $uninstallFacts -Name 'deviceKeySha256After'
+        if (-not (Test-CcodOfficialDraftHash $expectedKeyHash)) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'Uninstall does not contain a usable device-key hash.' $null
+        }
+        $previousSetup = $records.LegacyUpgrade.facts.previousSetup
+        $context = New-CcodOfficialDraftContext -Phase $Phase -AssetDirectory $AssetDirectory -PreviousAssetDirectory $PreviousAssetDirectory -EvidenceRoot $EvidenceRoot -Candidate $candidate -Draft $draft -PreviousSetup $previousSetup -AllowMachineMutation:$AllowMachineMutation -AllowCodexRestart:$AllowCodexRestart -AllowWindowsReboot:$AllowWindowsReboot
+        $operationResult = Invoke-CcodOfficialDraftPhaseOperation -Adapters $adapters -Context $context
+        try {
+            $afterValues = @(& $adapters.CaptureFacts $context 'After')
+            if ($afterValues.Count -ne 1 -or $null -eq $afterValues[0]) { throw 'after facts' }
+            $facts = Assert-CcodOfficialDraftFreshFacts -Facts $afterValues[0] -ExpectedKeyHash $expectedKeyHash -ExpectedRuntimeManifestSha256 $operationResult.runtimeManifestSha256
+        } catch {
+            if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_FRESH_INSTALL_OBSERVATION_INVALID' 'Fresh install did not prove an active generation and authenticated protection.' $null
+        }
+        $written = Write-CcodOfficialDraftReceipt -StateDirectory $stateDirectory -Phase $Phase -Candidate $candidate -Draft $draft -Facts $facts
+        return [pscustomobject][ordered]@{ phase = 'FreshInstall'; outcome = 'Completed'; complete = $false; candidate = $written.candidate; facts = $written.facts }
+    }
+    if ($Phase -ceq 'PreReboot') {
+        $freshFacts = $records.FreshInstall.facts
+        $expectedKeyHash = Get-CcodOfficialDraftFactValue -Facts $freshFacts -Name 'deviceKeySha256'
+        $runtimeId = Get-CcodOfficialDraftFactValue -Facts $freshFacts -Name 'activeRuntimeId'
+        $generation = Get-CcodOfficialDraftFactValue -Facts $freshFacts -Name 'activeGeneration'
+        if (-not (Test-CcodOfficialDraftHash $expectedKeyHash) -or
+            $runtimeId -isnot [string] -or $runtimeId -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z' -or
+            -not (Test-CcodOfficialDraftPositiveInteger $generation)) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'FreshInstall does not contain a usable continuity identity.' $null
+        }
+        $freshPath = Join-Path $stateDirectory $script:CcodOfficialDraftPhaseFiles.FreshInstall
+        $freshHash = Get-CcodOfficialDraftFileSha256 -Path $freshPath
+        $bootBefore = Get-CcodOfficialDraftBootIdentity -Adapters $adapters
+        $context = New-CcodOfficialDraftContext -Phase $Phase -AssetDirectory $AssetDirectory -PreviousAssetDirectory $PreviousAssetDirectory -EvidenceRoot $EvidenceRoot -Candidate $candidate -Draft $draft -PreviousSetup $records.LegacyUpgrade.facts.previousSetup -AllowMachineMutation:$AllowMachineMutation -AllowCodexRestart:$AllowCodexRestart -AllowWindowsReboot:$AllowWindowsReboot
+        try {
+            $beforeValues = @(& $adapters.CaptureFacts $context 'Before')
+            if ($beforeValues.Count -ne 1 -or $null -eq $beforeValues[0]) { throw 'before facts' }
+            $beforeObservation = ConvertTo-CcodOfficialDraftLegacyObservation -Facts $beforeValues[0] -ExpectedVersion $candidate.version
+            if ($beforeObservation.deviceKeySha256 -cne [string]$expectedKeyHash -or
+                $beforeObservation.activeRuntimeId -cne [string]$runtimeId -or
+                [UInt64]$beforeObservation.activeGeneration -ne [UInt64]$generation -or
+                $beforeObservation.runtimeManifestSha256 -cne [string]$freshFacts.runtimeManifestSha256 -or
+                $beforeObservation.bootId -isnot [string] -or $beforeObservation.bootId -cne $bootBefore) { throw 'pre-reboot continuity' }
+        } catch {
+            if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE' 'The pre-reboot lifecycle observation is unavailable.' $null
+        }
+        $facts = ConvertTo-CcodOfficialDraftPreRebootFacts -BootId $bootBefore -FreshReceiptHash $freshHash -RuntimeId $runtimeId -Generation ([UInt64]$generation) -ManifestHash ([string]$freshFacts.runtimeManifestSha256) -KeyHash $expectedKeyHash -Observation $beforeObservation
+        $preRebootHash = $null
+        $written = Write-CcodOfficialDraftReceipt -StateDirectory $stateDirectory -Phase $Phase -Candidate $candidate -Draft $draft -Facts $facts -PublishedHash ([ref]$preRebootHash)
+        $preRebootPath = Join-Path $stateDirectory $script:CcodOfficialDraftPhaseFiles.PreReboot
+        $preRebootExpected = @{ ([IO.Path]::GetFullPath($preRebootPath)) = $preRebootHash }
+        try {
+            $rebootValues = @(& $adapters.Reboot $context)
+            if ($rebootValues.Count -ne 1 -or $rebootValues[0] -isnot [bool] -or -not [bool]$rebootValues[0]) { throw 'reboot' }
+        } catch {
+            try {
+                [void](Remove-CcodOfficialDraftCompleteArtifacts -Paths @($preRebootPath) -ExpectedHashes $preRebootExpected)
+            } catch {
+                Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_REBOOT_FAILED' 'The failed reboot receipt could not be removed safely.' $null
+            }
+            if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_REBOOT_FAILED' 'The authorized Windows reboot did not return proven completion.' $null
+        }
+        return [pscustomobject][ordered]@{ phase = 'PreReboot'; outcome = 'Completed'; complete = $false; candidate = $written.candidate; facts = $written.facts }
+    }
+    if ($Phase -ceq 'PostReboot') {
+        $freshFacts = $records.FreshInstall.facts
+        $preFacts = $records.PreReboot.facts
+        $expectedKeyHash = Get-CcodOfficialDraftFactValue -Facts $freshFacts -Name 'deviceKeySha256'
+        $bootBefore = Get-CcodOfficialDraftFactValue -Facts $preFacts -Name 'bootIdBefore'
+        $freshReceiptHash = Get-CcodOfficialDraftFactValue -Facts $preFacts -Name 'freshInstallReceiptSha256'
+        if (-not (Test-CcodOfficialDraftHash $expectedKeyHash) -or
+            $bootBefore -isnot [string] -or $bootBefore -notmatch '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}\z' -or
+            -not (Test-CcodOfficialDraftHash $freshReceiptHash)) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'PreReboot does not contain a usable continuity identity.' $null
+        }
+        $freshPath = Join-Path $stateDirectory $script:CcodOfficialDraftPhaseFiles.FreshInstall
+        if ((Get-CcodOfficialDraftFileSha256 -Path $freshPath) -cne [string]$freshReceiptHash) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'The FreshInstall receipt changed after the reboot boundary.' $null
+        }
+        $bootAfter = Get-CcodOfficialDraftBootIdentity -Adapters $adapters
+        $context = New-CcodOfficialDraftContext -Phase $Phase -AssetDirectory $AssetDirectory -PreviousAssetDirectory $PreviousAssetDirectory -EvidenceRoot $EvidenceRoot -Candidate $candidate -Draft $draft -PreviousSetup $records.LegacyUpgrade.facts.previousSetup -AllowMachineMutation:$AllowMachineMutation -AllowCodexRestart:$AllowCodexRestart -AllowWindowsReboot:$AllowWindowsReboot
+        try {
+            $afterValues = @(& $adapters.CaptureFacts $context 'After')
+            if ($afterValues.Count -ne 1 -or $null -eq $afterValues[0]) { throw 'after facts' }
+            $facts = Assert-CcodOfficialDraftPostRebootFacts -Facts $afterValues[0] -FreshFacts $freshFacts -ExpectedKeyHash $expectedKeyHash -BootBefore $bootBefore -ExpectedVersion $candidate.version
+        } catch {
+            if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_POST_REBOOT_OBSERVATION_INVALID' 'Post-reboot observations did not prove a new boot and recovered protected runtime.' $null
+        }
+        if ($bootAfter -cne [string]$facts.bootIdAfter) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_BOOT_ID_INVALID' 'The post-reboot boot identity changed during observation.' $null
+        }
+        $written = Write-CcodOfficialDraftReceipt -StateDirectory $stateDirectory -Phase $Phase -Candidate $candidate -Draft $draft -Facts $facts
+        return [pscustomobject][ordered]@{ phase = 'PostReboot'; outcome = 'Completed'; complete = $false; candidate = $written.candidate; facts = $written.facts }
+    }
+    if ($Phase -ceq 'ReadyForManualEvidence') {
+        $manualChallenge = [guid]::NewGuid().ToString('N')
+        $facts = [pscustomobject][ordered]@{
+            automatedPhases = @('Preflight','LegacyUpgrade','Uninstall','FreshInstall','PreReboot','PostReboot')
+            status = 'ReadyForManualEvidence'
+            manualEvidencePending = $true
+            complete = $false
+            manualChallenge = $manualChallenge
+        }
+        $written = Write-CcodOfficialDraftReceipt -StateDirectory $stateDirectory -Phase $Phase -Candidate $candidate -Draft $draft -Facts $facts
+        return [pscustomobject][ordered]@{ phase = 'ReadyForManualEvidence'; outcome = 'ReadyForManualEvidence'; complete = $false; candidate = $written.candidate; facts = $written.facts }
+    }
+    if ($Phase -in @('TrayEvidence','RemoteEvidence')) {
+        if (($Phase -ceq 'TrayEvidence' -and [string]::IsNullOrWhiteSpace($TrayOperation)) -or
+            ($Phase -ceq 'RemoteEvidence' -and [string]::IsNullOrWhiteSpace($RemoteOperation)) -or
+            ($Phase -ceq 'TrayEvidence' -and -not [string]::IsNullOrWhiteSpace($RemoteOperation)) -or
+            ($Phase -ceq 'RemoteEvidence' -and -not [string]::IsNullOrWhiteSpace($TrayOperation)) -or
+            [string]::IsNullOrWhiteSpace($ScreenshotPath) -or [string]::IsNullOrWhiteSpace($RedactedLogPath) -or
+            [string]::IsNullOrWhiteSpace($ReviewState)) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'Manual evidence requires exactly one bounded operation, two evidence files, and Reviewed state.' $null
+        }
+        $rawOperation = if ($Phase -ceq 'TrayEvidence') { $TrayOperation } else { $RemoteOperation }
+        $operationMatches = @($script:CcodOfficialDraftManualOperations | Where-Object { [string]$_ -ieq [string]$rawOperation })
+        if ($operationMatches.Count -ne 1) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_OPERATION_INVALID' 'The manual evidence operation is unsupported.' $null
+        }
+        $operation = [string]$operationMatches[0]
+        $canonicalReviewState = if ([string]$ReviewState -ieq 'Reviewed') { 'Reviewed' } else { [string]$ReviewState }
+        $context = New-CcodOfficialDraftContext -Phase $Phase -AssetDirectory $AssetDirectory -PreviousAssetDirectory $PreviousAssetDirectory -EvidenceRoot $EvidenceRoot -Candidate $candidate -Draft $draft -PreviousSetup $records.LegacyUpgrade.facts.previousSetup -AllowMachineMutation:$AllowMachineMutation -AllowCodexRestart:$AllowCodexRestart -AllowWindowsReboot:$AllowWindowsReboot
+        $context | Add-Member -NotePropertyName operation -NotePropertyValue $operation
+        $context | Add-Member -NotePropertyName screenshotPath -NotePropertyValue ([IO.Path]::GetFullPath($ScreenshotPath))
+        $context | Add-Member -NotePropertyName redactedLogPath -NotePropertyValue ([IO.Path]::GetFullPath($RedactedLogPath))
+        $readyChallenge = Get-CcodOfficialDraftFactValue -Facts $records.ReadyForManualEvidence.facts -Name 'manualChallenge'
+        if ($readyChallenge -isnot [string] -or $readyChallenge -cnotmatch '^[0-9a-f]{32}\z') {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_RECEIPT_INVALID' 'ReadyForManualEvidence does not contain a usable manual challenge.' $null
+        }
+        $context | Add-Member -NotePropertyName manualChallenge -NotePropertyValue ([string]$readyChallenge)
+        $context | Add-Member -NotePropertyName expectedRuntimeId -NotePropertyValue ([string](Get-CcodOfficialDraftFactValue -Facts $records.FreshInstall.facts -Name 'activeRuntimeId'))
+        $context | Add-Member -NotePropertyName expectedGeneration -NotePropertyValue ([UInt64](Get-CcodOfficialDraftFactValue -Facts $records.FreshInstall.facts -Name 'activeGeneration'))
+        $context | Add-Member -NotePropertyName expectedRuntimeManifestSha256 -NotePropertyValue ([string](Get-CcodOfficialDraftFactValue -Facts $records.FreshInstall.facts -Name 'runtimeManifestSha256'))
+        $context | Add-Member -NotePropertyName expectedDeviceKeySha256 -NotePropertyValue ([string](Get-CcodOfficialDraftFactValue -Facts $records.FreshInstall.facts -Name 'deviceKeySha256'))
+        $context | Add-Member -NotePropertyName expectedBootId -NotePropertyValue ([string](Get-CcodOfficialDraftFactValue -Facts $records.PostReboot.facts -Name 'bootIdAfter'))
+        try {
+            $programmaticValues = @(& $adapters.RunManualOperation $context $operation)
+            if ($programmaticValues.Count -ne 1 -or $null -eq $programmaticValues[0] -or
+                -not (Test-CcodOfficialDraftExactProperties -Value $programmaticValues[0] -Expected @('verified','operation','terminalState','code','proof','screenshotSha256','redactedLogSha256')) -or
+                $programmaticValues[0].verified -isnot [bool] -or -not [bool]$programmaticValues[0].verified -or
+                $programmaticValues[0].screenshotSha256 -isnot [string] -or -not (Test-CcodOfficialDraftHash $programmaticValues[0].screenshotSha256) -or
+                $programmaticValues[0].redactedLogSha256 -isnot [string] -or -not (Test-CcodOfficialDraftHash $programmaticValues[0].redactedLogSha256)) { throw 'manual operation result' }
+            $programmaticResult = $programmaticValues[0]
+        } catch {
+            if ($_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_OPERATION_UNPROVEN' 'The requested manual operation did not produce programmatic proof.' $operation
+        }
+        try {
+            $manualObservationValues = @(& $adapters.CaptureFacts $context 'AfterManualOperation')
+            if ($manualObservationValues.Count -ne 1 -or $null -eq $manualObservationValues[0]) { throw 'manual observation' }
+            $manualObservation = ConvertTo-CcodOfficialDraftLegacyObservation -Facts $manualObservationValues[0] -ExpectedVersion ([string]$context.expectedVersion)
+            if ($manualObservation.activeRuntimeId -cne [string]$context.expectedRuntimeId -or
+                [UInt64]$manualObservation.activeGeneration -ne [UInt64]$context.expectedGeneration -or
+                $manualObservation.runtimeManifestSha256 -cne [string]$context.expectedRuntimeManifestSha256 -or
+                $manualObservation.deviceKeySha256 -cne [string]$context.expectedDeviceKeySha256 -or
+                $manualObservation.bootId -cne [string]$context.expectedBootId) { throw 'manual observation continuity' }
+        } catch {
+            $failure = $_
+            if ($failure.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw $failure }
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_OPERATION_UNPROVEN' 'The current runtime identity changed or could not be re-observed after the manual operation.' $operation
+        }
+        $existing = if ($records.ContainsKey('ManualEvidence')) { $records.ManualEvidence } else { @{} }
+        $manualRecord = Write-CcodOfficialDraftManualEvidence -StateDirectory $stateDirectory -Phase $Phase -Operation $operation -Candidate $candidate -Existing $existing -ProgrammaticResult $programmaticResult -ScreenshotPath $ScreenshotPath -RedactedLogPath $RedactedLogPath -ArtifactDirectory (Join-Path ([IO.Path]::GetFullPath($EvidenceRoot)) 'official-draft-artifacts') -ReviewState $canonicalReviewState -ExpectedChallenge ([string]$context.manualChallenge) -ExpectedRuntimeId ([string]$context.expectedRuntimeId) -ExpectedGeneration $context.expectedGeneration -ExpectedManifestSha256 ([string]$context.expectedRuntimeManifestSha256)
+        return [pscustomobject][ordered]@{ phase = $Phase; outcome = 'Completed'; complete = $false; candidate = $candidate; facts = $manualRecord }
+    }
+    if ($Phase -ceq 'Complete') {
+        if (-not [string]::IsNullOrWhiteSpace($TrayOperation) -or -not [string]::IsNullOrWhiteSpace($RemoteOperation) -or
+            -not [string]::IsNullOrWhiteSpace($ScreenshotPath) -or -not [string]::IsNullOrWhiteSpace($RedactedLogPath) -or
+            -not [string]::IsNullOrWhiteSpace($ReviewState)) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' 'Complete does not accept an individual manual evidence payload.' $null
+        }
+        $manual = Assert-CcodOfficialDraftManualEvidenceSet -Records $records.ManualEvidence -Candidate $candidate
+        $nowValues = @(& $adapters.GetUtcNow)
+        if ($nowValues.Count -ne 1 -or $nowValues[0] -isnot [datetime] -or $nowValues[0].Kind -ne [DateTimeKind]::Utc) {
+            Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_COMPLETE_WRITE_FAILED' 'Complete acceptance requires a valid UTC clock.' $null
+        }
+        $facts = [pscustomobject][ordered]@{ manualEvidence = @($manual); status = 'Complete'; complete = $true }
+        $acceptancePath = Get-CcodOfficialDraftCompleteAcceptancePath -EvidenceRoot $EvidenceRoot
+        $statePath = Join-Path $stateDirectory $script:CcodOfficialDraftCompletionFile
+        $completeCleanupExpected = @{}
+        $completeReceiptHash = $null
+        $completeAcceptanceHash = $null
+        try {
+            $written = Write-CcodOfficialDraftReceipt -StateDirectory $stateDirectory -Phase $Phase -Candidate $candidate -Draft $draft -Facts $facts -PublishedHash ([ref]$completeReceiptHash)
+            if (Test-CcodOfficialDraftHash $completeReceiptHash) { $completeCleanupExpected[[IO.Path]::GetFullPath($statePath)] = $completeReceiptHash }
+            $automatedHashes = [Collections.Generic.List[object]]::new()
+            foreach ($automatedPhase in $script:CcodOfficialDraftPhases) {
+                $automatedHashes.Add([pscustomobject][ordered]@{
+                    phase = [string]$automatedPhase
+                    sha256 = Get-CcodOfficialDraftFileSha256 -Path (Join-Path $stateDirectory $script:CcodOfficialDraftPhaseFiles[$automatedPhase])
+                })
+            }
+            $automatedHashes.Add([pscustomobject][ordered]@{ phase = 'Complete'; sha256 = Get-CcodOfficialDraftFileSha256 -Path $statePath })
+            $writtenAcceptance = Write-CcodOfficialDraftCompleteAcceptance -EvidenceRoot $EvidenceRoot -PreviousAssetDirectory $PreviousAssetDirectory -Candidate $candidate -Draft $draft -ManualEvidence $manual -AutomatedReceiptHashes @($automatedHashes) -CompletedAtUtc $nowValues[0] -Path $acceptancePath -PublishedHash ([ref]$completeAcceptanceHash)
+            if (Test-CcodOfficialDraftHash $completeAcceptanceHash) { $completeCleanupExpected[[IO.Path]::GetFullPath($acceptancePath)] = $completeAcceptanceHash }
+        } catch {
+            $failure = $_
+            if ($completeReceiptHash -is [string] -and $completeReceiptHash -cmatch '^[0-9a-f]{64}\z') {
+                $completeCleanupExpected[[IO.Path]::GetFullPath($statePath)] = $completeReceiptHash
+            }
+            if ($completeAcceptanceHash -is [string] -and $completeAcceptanceHash -cmatch '^[0-9a-f]{64}\z') {
+                $completeCleanupExpected[[IO.Path]::GetFullPath($acceptancePath)] = $completeAcceptanceHash
+            }
+            try {
+                $ownedPaths = @($acceptancePath,$statePath | Where-Object { $completeCleanupExpected.ContainsKey([IO.Path]::GetFullPath($_)) })
+                if ($ownedPaths.Count -gt 0) { [void](Remove-CcodOfficialDraftCompleteArtifacts -Paths $ownedPaths -ExpectedHashes $completeCleanupExpected) }
+            } catch {
+                Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_COMPLETE_CLEANUP_FAILED' 'Complete acceptance cleanup failed and terminal evidence may remain.' $null
+            }
+            throw $failure
+        }
+        return [pscustomobject][ordered]@{ phase = 'Complete'; outcome = 'Complete'; complete = $true; candidate = $written.candidate; facts = $written.facts }
+    }
+    Throw-CcodOfficialDraftError 'CCOD_ACCEPTANCE_NOT_IMPLEMENTED' 'The official-draft acceptance state machine phase is not implemented.' $Phase
+    } finally { Close-CcodOfficialDraftOperationLease $operationLease }
+}
+
+function Invoke-CcodOfficialDraftAcceptance {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][ValidateSet('Preflight','LegacyUpgrade','Uninstall','FreshInstall','PreReboot','PostReboot','ReadyForManualEvidence','TrayEvidence','RemoteEvidence','Complete')][string]$Phase,
+        [Parameter(Mandatory)][string]$AssetDirectory,
+        [Parameter(Mandatory)][string]$PreviousAssetDirectory,
+        [Parameter(Mandatory)][string]$EvidenceRoot,
+        [string]$DraftId,
+        [switch]$AllowMachineMutation,
+        [switch]$AllowCodexRestart,
+        [switch]$AllowWindowsReboot,
+        [ValidateSet('About','Language','OpenLogs','Repair')][string]$TrayOperation,
+        [ValidateSet('SecondDeviceControl')][string]$RemoteOperation,
+        [string]$ScreenshotPath,
+        [string]$RedactedLogPath,
+        [ValidateSet('Reviewed')][string]$ReviewState
+    )
+    Invoke-CcodOfficialDraftAcceptanceCore `
+        -Phase $Phase `
+        -AssetDirectory $AssetDirectory `
+        -PreviousAssetDirectory $PreviousAssetDirectory `
+        -EvidenceRoot $EvidenceRoot `
+        -DraftId $DraftId `
+        -AllowMachineMutation:$AllowMachineMutation `
+        -AllowCodexRestart:$AllowCodexRestart `
+        -AllowWindowsReboot:$AllowWindowsReboot `
+        -TrayOperation $TrayOperation `
+        -RemoteOperation $RemoteOperation `
+        -ScreenshotPath $ScreenshotPath `
+        -RedactedLogPath $RedactedLogPath `
+        -ReviewState $ReviewState
+}
+
+Export-ModuleMember -Function Invoke-CcodOfficialDraftAcceptance
diff --git a/tests/persistence/Bootstrap.SelfTest.ps1 b/tests/persistence/Bootstrap.SelfTest.ps1
index 0615b22..080ad09 100644
--- a/tests/persistence/Bootstrap.SelfTest.ps1
+++ b/tests/persistence/Bootstrap.SelfTest.ps1
@@ -380,6 +380,16 @@ $results += Invoke-CcodTest 'bootstrap legacy fallback rejects a state ancestor
     }finally{if(Test-Path $root){Remove-Item $root -Recurse -Force}}
 }
 
+$results += Invoke-CcodTest 'bootstrap runtime IDs use canonical TAB delimiters' {
+    $files = @(
+        [pscustomobject]@{ path = 'a.txt'; length = [int64]5; sha256 = ('a' * 64) }
+        [pscustomobject]@{ path = 'b.txt'; length = [int64]4; sha256 = ('b' * 64) }
+    )
+    $nonce = '0123456789abcdef0123456789abcdef'
+    $expected = '2.5.22-e71f4818a0f8e98f-0123456789abcdef0123456789abcdef'
+    Assert-CcodExactEqual $expected (Get-CcodBootstrapRuntimeId -ProjectVersion '2.5.22' -Files $files -Nonce $nonce) 'bootstrap runtime ID digest input must use literal TAB delimiters'
+}
+
 $results += Invoke-CcodTest 'generation bootstrap launches the append-only selected runtime without root active json' {
     $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-bootstrap-generation-'+[guid]::NewGuid().ToString('N'))
     try{
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index 310933b..e8612ef 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -12,6 +12,12 @@ Import-Module (Join-Path $repositoryRoot 'src\persistence\modules\UiPreferences.
 Import-Module (Join-Path $repositoryRoot 'src\persistence\modules\RuntimeManifest.psm1') -Force
 Import-Module (Join-Path $repositoryRoot 'src\persistence\modules\LifecycleEpoch.psm1') -Force
 
+function Invoke-CcodRuntimeCoreSetForTest {
+    param([Parameter(Mandatory)][string]$InstallRoot,[string]$NewRuntimeId,$TargetGeneration,$FileTransaction,$Ownership,[hashtable]$Adapters)
+    $module = Get-Module -Name RuntimeManifest
+    return & $module { param($Root,$Runtime,$Generation,$Transaction,$Lease,$Injected) Set-CcodActiveRuntimeCore -InstallRoot $Root -NewRuntimeId $Runtime -TargetGeneration $Generation -FileTransaction $Transaction -Ownership $Lease -Adapters $Injected } $InstallRoot $NewRuntimeId $TargetGeneration $FileTransaction $Ownership $Adapters
+}
+
 $v2521LifecycleShortcutNames=@(
     'Programs\CodexRemote-fix\CodexRemote-fix.lnk',
     'Programs\CodexRemote-fix\CodexRemote-fix compatibility check.lnk',
@@ -395,7 +401,7 @@ function New-CcodLifecycleFake {
         param($InstallRoot, $RuntimeId, $Ownership, $TargetGeneration, $FileTransaction)
         if ($null -ne $world.SetActiveFailure) { & $world.SetActiveFailure $InstallRoot $RuntimeId $Ownership $TargetGeneration $FileTransaction }
         $assertFence = { param($Root, $Receipt, $ExpectActivePointer,$TargetRuntimeId) if ($Receipt.released) { throw 'released lifecycle owner' }; $true }
-        Set-CcodActiveRuntime -InstallRoot $InstallRoot -NewRuntimeId $RuntimeId -TargetGeneration $TargetGeneration -FileTransaction $FileTransaction -Ownership $Ownership -Adapters @{ AssertLifecycleFence=$assertFence }
+        Invoke-CcodRuntimeCoreSetForTest -InstallRoot $InstallRoot -NewRuntimeId $RuntimeId -TargetGeneration $TargetGeneration -FileTransaction $FileTransaction -Ownership $Ownership -Adapters @{ AssertLifecycleFence=$assertFence }
     }.GetNewClosure()
     $adapters.ExitLifecycleOwnership = {
         param($Ownership)
@@ -1297,7 +1303,7 @@ $results += Invoke-CcodTest 'real v2.5.21 selector commit with a missing Pointer
             if($gate.Remaining-gt0){
                 $gate.Remaining--
                 $fence={param($InstallRoot,$Receipt,$ExpectActivePointer)$true}
-                Set-CcodActiveRuntime -InstallRoot $Root -TargetGeneration $TargetGeneration -FileTransaction $FileTransaction -Ownership $Ownership -Adapters @{AssertLifecycleFence=$fence}|Out-Null
+                Invoke-CcodRuntimeCoreSetForTest -InstallRoot $Root -TargetGeneration $TargetGeneration -FileTransaction $FileTransaction -Ownership $Ownership -Adapters @{AssertLifecycleFence=$fence}|Out-Null
                 throw 'PRIVATE_AFTER_SELECTOR_COMMIT_BEFORE_JOURNAL'
             }
         }.GetNewClosure()
@@ -1473,7 +1479,7 @@ $results += Invoke-CcodTest 'unique immutable runtime ids bind project and manif
     $second=&$module {param($Files)New-CcodUniqueRuntimeId -ProjectVersion '2.5.22' -Files $Files -NewNonce { '2'*32 }} $filesA
     $differentContent=&$module {param($Files)New-CcodUniqueRuntimeId -ProjectVersion '2.5.22' -Files $Files -NewNonce { '1'*32 }} $filesB
     $differentVersion=&$module {param($Files)New-CcodUniqueRuntimeId -ProjectVersion '2.5.23' -Files $Files -NewNonce { '1'*32 }} $filesA
-    Assert-CcodEqual '2.5.22-a1c6387570c23404-11111111111111111111111111111111' $first 'runtime id contains project version, manifest file digest, and canonical nonce'
+    Assert-CcodEqual '2.5.22-4b2146780452e12e-11111111111111111111111111111111' $first 'runtime id contains project version, manifest file digest, and canonical nonce'
     Assert-CcodTrue ($first.Length-le96) 'runtime id remains within the manifest identity bound'
     Assert-CcodTrue ($first-cne$second) 'identical package content receives a unique generation id per attempt'
     Assert-CcodTrue ($first-cne$differentContent) 'manifest file content changes the deterministic runtime identity'
@@ -2438,7 +2444,7 @@ $results += Invoke-CcodTest 'upgrade boundaries fail closed with phase receipts
         [pscustomobject]@{ Name='old task still running';Code='CCOD_INSTALL_SUPERVISOR_TASK_BUSY';Committed=$false;Configure={param($Fake)$Fake.World.TaskIdle=$false} },
         [pscustomobject]@{ Name='stale lifecycle generation';Code='CCOD_LIFECYCLE_FENCE_STALE';Committed=$false;Configure={param($Fake)$Fake.World.SetActiveFailure={throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new('stale'), 'CCOD_LIFECYCLE_FENCE_STALE', [Management.Automation.ErrorCategory]::InvalidData, $null)}} },
         [pscustomobject]@{ Name='active pointer write failure';Code='CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN';Committed=$false;Configure={param($Fake)$Fake.World.SetActiveFailure={throw 'PRIVATE_POINTER_SECRET'}} },
-        [pscustomobject]@{ Name='crash after generation commit';Code='CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN';Committed=$true;Configure={param($Fake,$OldRuntime)$gate=[pscustomobject]@{Remaining=1};$Fake.World.SetActiveFailure={param($Root,$RuntimeId,$Ownership,$TargetGeneration,$FileTransaction)if($gate.Remaining-gt0){$gate.Remaining--;$fence={param($InstallRoot,$Receipt,$ExpectActivePointer)$true};Set-CcodActiveRuntime -InstallRoot $Root -TargetGeneration $TargetGeneration -FileTransaction $FileTransaction -Ownership $Ownership -Adapters @{AssertLifecycleFence=$fence}|Out-Null;throw 'PRIVATE_AFTER_COMMIT_SECRET'}}.GetNewClosure()} },
+        [pscustomobject]@{ Name='crash after generation commit';Code='CCOD_INSTALL_RUNTIME_ACTIVATION_UNPROVEN';Committed=$true;Configure={param($Fake,$OldRuntime)$gate=[pscustomobject]@{Remaining=1};$Fake.World.SetActiveFailure={param($Root,$RuntimeId,$Ownership,$TargetGeneration,$FileTransaction)if($gate.Remaining-gt0){$gate.Remaining--;$fence={param($InstallRoot,$Receipt,$ExpectActivePointer)$true};Invoke-CcodRuntimeCoreSetForTest -InstallRoot $Root -TargetGeneration $TargetGeneration -FileTransaction $FileTransaction -Ownership $Ownership -Adapters @{AssertLifecycleFence=$fence}|Out-Null;throw 'PRIVATE_AFTER_COMMIT_SECRET'}}.GetNewClosure()} },
         [pscustomobject]@{ Name='new task start failure';Code='CCOD_INSTALL_SUPERVISOR_START_FAILED';Committed=$true;Configure={param($Fake,$OldRuntime)$gate=[pscustomobject]@{Remaining=1};$Fake.Adapters.StartSupervisorTask={if($gate.Remaining-gt0){$gate.Remaining--;throw 'PRIVATE_TASK_START_SECRET'};$Fake.World.TaskStarted++}.GetNewClosure()} },
         [pscustomobject]@{ Name='Supervisor ready timeout';Code='CCOD_INSTALL_NEW_RUNTIME_NOT_READY';Committed=$true;Configure={param($Fake,$OldRuntime)$Fake.Adapters.WaitNewRuntimeReady={param($Root,$RuntimeId,$Generation,$Identity,$Started,$Timeout)[pscustomobject]@{SupervisorReady=([string]$RuntimeId-ceq[string]$OldRuntime);TrayReady=$true}}.GetNewClosure()} },
         [pscustomobject]@{ Name='TrayHost ready timeout';Code='CCOD_INSTALL_NEW_RUNTIME_NOT_READY';Committed=$true;Configure={param($Fake,$OldRuntime)$Fake.Adapters.WaitNewRuntimeReady={param($Root,$RuntimeId,$Generation,$Identity,$Started,$Timeout)[pscustomobject]@{SupervisorReady=$true;TrayReady=([string]$RuntimeId-ceq[string]$OldRuntime)}}.GetNewClosure()} },
@@ -3508,7 +3514,7 @@ $results += Invoke-CcodTest 'portable release keeps the fail-closed bootstrap ha
     Assert-CcodTrue ($inno -notmatch 'BackupDeviceKeyStore|RemoveDeviceKeyStore|KeepCurrentSpecialSession') 'Inno exposes no key or special-session uninstall options'
     Assert-CcodTrue (Test-Path -LiteralPath $finalizerPath -PathType Leaf) 'portable release includes an external finalizer'
     Assert-CcodTrue (Test-Path -LiteralPath $portableModulePath -PathType Leaf) 'portable release includes a marker-bound removal module'
-    Assert-CcodTrue ($wrapper -match 'PortableUninstallFinalizer\.ps1' -and $wrapper -match '-Mode\s+Prepare') 'public wrapper prepares protected cleanup before launching the external portable finalizer'
+    Assert-CcodTrue ($wrapper -match 'PortableUninstallFinalizer\.ps1' -and $wrapper -match 'Invoke-CcodPublicUninstallPrepare[^\r\n]+-PrepareMode\s+Prepare\s+-Identity\s+\$null') 'public wrapper prepares protected cleanup before launching the external portable finalizer'
     Assert-CcodTrue ($wrapper -match 'Start-Process' -and $wrapper -match 'portable-finalizer\.stderr\.log') 'public wrapper delegates final deletion to a detached external process with auditable output'
     Assert-CcodTrue ($wrapper -notmatch 'Remove-Item') 'public wrapper cannot delete the portable installer root directly'
     Assert-CcodTrue ((Get-Content -LiteralPath $finalizerPath -Raw) -match 'Remove-CcodPortableInstallerRoot') 'external finalizer owns the bound portable root deletion'
diff --git a/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1 b/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1
index 4d840f4..336d09b 100644
--- a/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1
+++ b/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1
@@ -12,6 +12,8 @@ function New-CcodHarnessFixture {
     $hash = Get-CcodTestFileSha256 -Path $installer
     $checksum = "$installer.sha256.txt"
     [IO.File]::WriteAllText($checksum, ("{0} *{1}`r`n" -f $hash, [IO.Path]::GetFileName($installer)), [Text.UTF8Encoding]::new($false))
+    $payload = [ordered]@{ schemaVersion = 1; projectVersion = '2.5.0'; files = @([ordered]@{ path = 'package.json'; length = [int64]1; sha256 = ('e' * 64) }) }
+    [IO.File]::WriteAllText((Join-Path $root 'CodexRemote-fix-2.5.0-setup-payload-manifest.json'), ($payload | ConvertTo-Json -Depth 8), [Text.UTF8Encoding]::new($false))
     return [pscustomobject]@{
         Root = $root
         Installer = $installer
@@ -20,6 +22,18 @@ function New-CcodHarnessFixture {
     }
 }
 
+function New-CcodHarnessSealedFixture {
+    $source=Join-Path $repositoryRoot 'tests/persistence/ReleaseWorkflow.SelfTest.ps1'
+    $tokens=$null;$errors=$null;$ast=[Management.Automation.Language.Parser]::ParseFile($source,[ref]$tokens,[ref]$errors)
+    Assert-CcodEqual 0 @($errors).Count 'shared sealed fixture source parses'
+    foreach($name in @('Get-CcodTask5ExpectedAssetNames','Write-CcodTask5Json','New-CcodTask5ExactAssetFixture')){
+        $definitions=@($ast.EndBlock.Statements|Where-Object {$_-is[Management.Automation.Language.FunctionDefinitionAst]-and$_.Name-ceq$name})
+        Assert-CcodEqual 1 $definitions.Count 'one shared fixture definition is loaded without executing release tests'
+        . ([scriptblock]::Create($definitions[0].Extent.Text))
+    }
+    return New-CcodTask5ExactAssetFixture
+}
+
 function New-CcodHarnessCandidate {
     param(
         [Parameter(Mandatory)]$Fixture,
@@ -30,6 +44,8 @@ function New-CcodHarnessCandidate {
     [IO.File]::WriteAllBytes($installer, $Bytes)
     $hash = Get-CcodTestFileSha256 -Path $installer
     [IO.File]::WriteAllText("$installer.sha256.txt", ("{0} *{1}`r`n" -f $hash, [IO.Path]::GetFileName($installer)), [Text.UTF8Encoding]::new($false))
+    $payload = [ordered]@{ schemaVersion = 1; projectVersion = $Version; files = @([ordered]@{ path = 'package.json'; length = [int64]1; sha256 = ('e' * 64) }) }
+    [IO.File]::WriteAllText((Join-Path $Fixture.Root ("CodexRemote-fix-$Version-setup-payload-manifest.json")), ($payload | ConvertTo-Json -Depth 8), [Text.UTF8Encoding]::new($false))
     return $installer
 }
 
@@ -45,18 +61,26 @@ function New-CcodHarnessFacts {
         [string]$ReceiptPhase = 'Completed'
     )
     return [pscustomobject][ordered]@{
+        installRootPresent = $true
         appPresent = $true
+        runtimeRootPresent = $true
+        activePointerPresent = $true
+        installReady = $true
         activeRuntimeId = $RuntimeId
         activeGeneration = [UInt64]1
         runtimeManifestSha256 = ('a' * 64)
+        runtimeManifestFiles = @([pscustomobject][ordered]@{ path = 'package.json'; length = [int64]1; sha256 = ('e' * 64) })
         supervisor = @([pscustomobject]@{ pid = 100; creationTimeUtc = '2026-08-24T00:00:00.0000000Z' })
         trayHost = @([pscustomobject]@{ pid = 101; creationTimeUtc = '2026-08-24T00:00:01.0000000Z' })
+        trayHostIdentity = [pscustomobject][ordered]@{ pid = 101; creationTimeUtc = '2026-08-24T00:00:01.0000000Z' }
+        trayAuthenticated = $true
         codex = @([pscustomobject]@{ pid = $CodexPid; creationTimeUtc = $CodexCreationTimeUtc })
         taskState = 'Ready'
         statusPhase = 'Active'
         statusRuntimeId = $StatusRuntimeId
         statusCodex = [pscustomobject][ordered]@{ pid = $StatusCodexPid; creationTimeUtc = $StatusCodexCreationTimeUtc }
         transitionStage = 'Idle'
+        protectionReady = $true
         lifecycleReceipt = [pscustomobject][ordered]@{
             kind = 'RestartAndRepair'
             origin = 'Installer'
@@ -68,13 +92,30 @@ function New-CcodHarnessFacts {
         deviceKeyPresent = $true
         deviceKeySha256 = ('b' * 64)
         shortcuts = [pscustomobject]@{ startMenu = $true; desktop = $true }
-        privatePath = 'C:\\Users\\Alice\\.codex\\remote-control-device-keys.windows.json'
+        debugEndpoints = @(
+            [pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = 9229; owningProcess = $CodexPid; owningProcessCreationTimeUtc = $CodexCreationTimeUtc }
+            [pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = 9230; owningProcess = $CodexPid; owningProcessCreationTimeUtc = $CodexCreationTimeUtc }
+        )
+        debugPorts = @(9229,9230)
+        privatePath = 'fixture-private-key.json'
         token = 'do-not-store-this'
         userName = 'Alice'
         conversation = 'private conversation content must never enter evidence'
     }
 }
 
+function New-CcodHarnessAbsentFacts {
+    param([switch]$WithoutDeviceKey)
+    $facts = New-CcodHarnessFacts
+    foreach ($name in @('installRootPresent','appPresent','runtimeRootPresent','activePointerPresent','installReady','trayAuthenticated','protectionReady')) { $facts.$name = $false }
+    foreach ($name in @('activeRuntimeId','activeGeneration','runtimeManifestSha256','trayHostIdentity','statusRuntimeId','statusCodex','lifecycleReceipt','aboutVersion')) { $facts.$name = $null }
+    foreach ($name in @('runtimeManifestFiles','supervisor','trayHost','codex','debugPorts','debugEndpoints')) { $facts.$name = @() }
+    $facts.taskState = 'Absent'; $facts.statusPhase = 'Unavailable'; $facts.transitionStage = 'Unavailable'
+    $facts.shortcuts = [pscustomobject][ordered]@{ startMenu = $false; desktop = $false }
+    if ($WithoutDeviceKey) { $facts.deviceKeyPresent = $false; $facts.deviceKeySha256 = $null }
+    return $facts
+}
+
 function Write-CcodHarnessJson {
     param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)]$Value)
     $null = [IO.Directory]::CreateDirectory((Split-Path $Path -Parent))
@@ -117,7 +158,9 @@ function New-CcodHarnessInstalledStateFixture {
         [Parameter(Mandatory)][string]$StatusRuntimeId,
         [Parameter(Mandatory)][int]$StatusCodexPid,
         [Parameter(Mandatory)][string]$StatusCodexCreationTimeUtc,
-        [Parameter(Mandatory)][string]$ReceiptPhase
+        [Parameter(Mandatory)][string]$ReceiptPhase,
+        [int]$StatusMainPort = 41001,
+        [int]$StatusRendererPort = 41002
     )
     $active = [ordered]@{
         schemaVersion = 2
@@ -140,8 +183,8 @@ function New-CcodHarnessInstalledStateFixture {
                 packageFullName = 'OpenAI.Codex_1.0.0.0_x64__test'
                 packageVersion = '1.0.0.0'
                 appAsarSha256 = ('c' * 64)
-                mainPort = 41001
-                rendererPort = 41002
+                mainPort = $StatusMainPort
+                rendererPort = $StatusRendererPort
                 mainProbe = 'Closed'
                 rendererProbe = 'BridgeValid'
             }
@@ -151,7 +194,7 @@ function New-CcodHarnessInstalledStateFixture {
     $receipt = New-CcodHarnessLifecycleReceipt -RuntimeId $ActiveRuntimeId -RuntimeGeneration $ActiveGeneration -Phase $ReceiptPhase
     Write-CcodHarnessJson -Path (Join-Path $Root 'active.json') -Value $active
     $manifestPath = Join-Path (Join-Path (Join-Path $Root 'runtime') $ActiveRuntimeId) 'manifest.json'
-    Write-CcodHarnessJson -Path $manifestPath -Value ([ordered]@{ schemaVersion = 1; runtimeId = $ActiveRuntimeId })
+    Write-CcodHarnessJson -Path $manifestPath -Value ([ordered]@{ schemaVersion = 1; projectVersion = '2.5.21'; runtimeId = $ActiveRuntimeId; files = @() })
     Write-CcodHarnessJson -Path (Join-Path $Root 'state\status.json') -Value $status
     Write-CcodHarnessJson -Path (Join-Path $Root 'state\transition.json') -Value $transition
     Write-CcodHarnessJson -Path (Join-Path $Root ("state\lifecycle\receipts\{0}.json" -f $receipt.transactionId)) -Value $receipt
@@ -160,6 +203,12 @@ function New-CcodHarnessInstalledStateFixture {
 function Set-CcodHarnessProcessFixture {
     param([object[]]$ChatGPT, [object[]]$Codex = @())
     $script:CcodHarnessProcessFixture = [pscustomobject]@{ ChatGPT = @($ChatGPT); Codex = @($Codex) }
+    function global:Get-Process {
+        param($Id,$ErrorAction)
+        if(-not$script:CcodHarnessNativeCreation.ContainsKey([int]$Id)){throw 'unknown fixture native process'}
+        $value=[pscustomobject]@{Id=[int]$Id;StartTime=[datetime]::ParseExact($script:CcodHarnessNativeCreation[[int]$Id],'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind);HasExited=$false}
+        $value|Add-Member ScriptMethod Dispose {};return $value
+    }
     function global:Get-CimInstance {
         param($ClassName, $Filter, $ErrorAction)
         if ([string]$Filter -cmatch "Name = 'ChatGPT.exe'") { return @($script:CcodHarnessProcessFixture.ChatGPT) }
@@ -173,6 +222,7 @@ function Set-CcodHarnessProcessFixture {
 }
 
 function Clear-CcodHarnessProcessFixture {
+    Remove-Item -LiteralPath Function:\Get-Process -Force -ErrorAction SilentlyContinue
     Remove-Item -LiteralPath Function:\Get-CimInstance -Force -ErrorAction SilentlyContinue
     Remove-Item -LiteralPath Function:\Get-ScheduledTask -Force -ErrorAction SilentlyContinue
     $script:CcodHarnessProcessFixture = $null
@@ -187,6 +237,8 @@ function New-CcodHarnessCimProcess {
         [int]$ParentProcessId = 0
     )
     $created = [datetime]::ParseExact($CreationTimeUtc, 'o', [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::RoundtripKind)
+    if($null-eq(Get-Variable CcodHarnessNativeCreation -Scope Script -ErrorAction SilentlyContinue)){$script:CcodHarnessNativeCreation=@{}}
+    $script:CcodHarnessNativeCreation[$ProcessId]=$CreationTimeUtc
     return [pscustomobject][ordered]@{
         Name = $Name
         ProcessId = $ProcessId
@@ -198,13 +250,41 @@ function New-CcodHarnessCimProcess {
 }
 
 function Invoke-CcodHarnessWithCapturedFacts {
-    param([Parameter(Mandatory)]$Context, [Parameter(Mandatory)]$BeforeFacts, [Parameter(Mandatory)]$AfterFacts)
+    param([Parameter(Mandatory)]$Context, [Parameter(Mandatory)]$BeforeFacts, [Parameter(Mandatory)]$AfterFacts, [ref]$ObservedExpectedDebugPorts, $RunResult,
+        [object[]]$PostUninstallListeners = @(), [switch]$FailUninstallEnumeration, [ref]$ObservedUninstallEnumeration)
+    if ($null -eq $Context.PSObject.Properties['transactionId']) { $Context | Add-Member -NotePropertyName transactionId -NotePropertyValue '11111111-2222-3333-4444-555555555555' }
+    if ($null -eq $Context.PSObject.Properties['installerSha256']) { $Context | Add-Member -NotePropertyName installerSha256 -NotePropertyValue ('a' * 64) }
+    if ($null -eq $Context.PSObject.Properties['candidatePayloadFiles']) { $Context | Add-Member -NotePropertyName candidatePayloadFiles -NotePropertyValue @($AfterFacts.runtimeManifestFiles) }
     $original = ${function:Get-CcodInstalledLifecycleFacts}
+    $originalNetTcp = ${function:Get-NetTCPConnection}
+    $uninstallFixture = $Context.scenario -in @('SettingsUninstall','DirectUninstall')
     try {
-        Set-Item -LiteralPath Function:\Get-CcodInstalledLifecycleFacts -Value ({ param($InstallRoot) return $AfterFacts }.GetNewClosure())
-        return Test-CcodInstalledLifecycleScenario -Context $Context -BeforeFacts $BeforeFacts -RunResult ([pscustomobject]@{ code = 'CCOD_INTEGRATION_OPERATOR_COMPLETED' })
+        if ($uninstallFixture) {
+            Set-Item -LiteralPath Function:\global:Get-NetTCPConnection -Value ({
+                param($State,$ErrorAction)
+                if ($null -ne $ObservedUninstallEnumeration) { $ObservedUninstallEnumeration.Value = [int]$ObservedUninstallEnumeration.Value + 1 }
+                if ($FailUninstallEnumeration) { throw [IO.IOException]::new('fixture listener enumeration unavailable') }
+                return @($PostUninstallListeners)
+            }.GetNewClosure())
+        }
+        Set-Item -LiteralPath Function:\Get-CcodInstalledLifecycleFacts -Value ({
+            param($InstallRoot,$ExpectedVersion,$ExpectedDebugPorts)
+            if ($null -ne $ObservedExpectedDebugPorts) {
+                $ObservedExpectedDebugPorts.Value = if ($null -eq $ExpectedDebugPorts) { 'none' } else { (@($ExpectedDebugPorts) -join ',') }
+            }
+            return $AfterFacts
+        }.GetNewClosure())
+        $effectiveRunResult = if ($null -eq $RunResult) {
+            $runtimeManifest = if ($Context.scenario -in @('FreshInstall','FreshLater','FreshRestart','Upgrade','SlowLaunch','ManualLaunchResume','LanguageStress','RepairStates')) { [string]$AfterFacts.runtimeManifestSha256 } else { $null }
+            [pscustomobject][ordered]@{ code = 'CCOD_INTEGRATION_OPERATOR_COMPLETED'; scenario = [string]$Context.scenario; transactionId = [string]$Context.transactionId; completed = $true; operatorAttestation = 'OperatorConfirmed'; installerSha256 = [string]$Context.installerSha256; runtimeManifestSha256 = $runtimeManifest }
+        } else { $RunResult }
+        return Test-CcodInstalledLifecycleScenario -Context $Context -BeforeFacts $BeforeFacts -RunResult $effectiveRunResult
     } finally {
         Set-Item -LiteralPath Function:\Get-CcodInstalledLifecycleFacts -Value $original
+        if ($uninstallFixture) {
+            if ($null -eq $originalNetTcp) { Remove-Item -LiteralPath Function:\global:Get-NetTCPConnection -Force -ErrorAction SilentlyContinue }
+            else { Set-Item -LiteralPath Function:\global:Get-NetTCPConnection -Value $originalNetTcp }
+        }
     }
 }
 
@@ -214,11 +294,16 @@ function New-CcodHarnessAdapters {
         [Parameter(Mandatory)][AllowEmptyCollection()][Collections.Generic.List[string]]$Calls,
         [switch]$FailScenario,
         [switch]$DirtyCheckout,
+        [string]$ReplacePreviousAfterValidation,
+        [switch]$RecordRollbackIdentity,
+        [string]$BeforeVersion = '2.5.0',
+        [string]$AfterVersion,
         [ref]$CapturedReceipt
     )
 
-    $before = New-CcodHarnessFacts
-    $after = New-CcodHarnessFacts
+    $resolvedAfterVersion = if ([string]::IsNullOrWhiteSpace($AfterVersion)) { $BeforeVersion } else { $AfterVersion }
+    $before = New-CcodHarnessFacts -Version $BeforeVersion
+    $after = New-CcodHarnessFacts -Version $resolvedAfterVersion
     return @{
         GetGitStatus = {
             param($RepositoryRoot)
@@ -244,12 +329,25 @@ function New-CcodHarnessAdapters {
         WriteEvidence = {
             param($EvidenceDirectory, $Receipt)
             $Calls.Add('WriteEvidence')
-            $CapturedReceipt.Value = $Receipt
-            return [IO.Path]::GetFullPath((Join-Path $EvidenceDirectory 'receipt.json'))
+            $directory = [IO.Directory]::CreateDirectory($EvidenceDirectory).FullName
+            $path = [IO.Path]::GetFullPath((Join-Path $directory 'receipt.json'))
+            $json = ($Receipt | ConvertTo-Json -Depth 16)
+            $stream = [IO.File]::Open($path, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::None)
+            try { $bytes = [Text.UTF8Encoding]::new($false).GetBytes($json); $stream.Write($bytes,0,$bytes.Length); $stream.Flush($true) } finally { $stream.Dispose() }
+            $readback = [IO.File]::ReadAllText($path, [Text.UTF8Encoding]::new($false)) | ConvertFrom-Json -ErrorAction Stop
+            if ($null -eq $readback) { throw 'fixture evidence readback failed' }
+            $CapturedReceipt.Value = $readback
+            return $path
         }.GetNewClosure()
         CaptureFacts = {
-            param($InstallRoot)
-            $Calls.Add('CaptureFacts')
+            param($InstallRoot,$ExpectedVersion)
+            $Calls.Add('CaptureFacts:' + [string]$ExpectedVersion)
+            if (-not [string]::IsNullOrWhiteSpace($ReplacePreviousAfterValidation) -and -not ($Calls -contains 'ReplacePreviousAfterValidation')) {
+                $Calls.Add('ReplacePreviousAfterValidation')
+                [IO.File]::WriteAllBytes($ReplacePreviousAfterValidation, [byte[]](31,29,27,25,23,21,19,17))
+                $replacementHash = Get-CcodTestFileSha256 -Path $ReplacePreviousAfterValidation
+                [IO.File]::WriteAllText("$ReplacePreviousAfterValidation.sha256.txt", ("{0} *{1}`r`n" -f $replacementHash, [IO.Path]::GetFileName($ReplacePreviousAfterValidation)), [Text.UTF8Encoding]::new($false))
+            }
             if (($Calls | Where-Object { $_ -eq 'RunScenario' }).Count -eq 0) { return $before }
             return $after
         }.GetNewClosure()
@@ -262,7 +360,8 @@ function New-CcodHarnessAdapters {
             param($Context)
             $Calls.Add('RunScenario')
             if ($FailScenario) { throw [InvalidOperationException]::new('operator scenario failed') }
-            return [pscustomobject]@{ code = 'CCOD_OPERATOR_COMPLETED'; operatorAttestation = 'accepted'; privatePath = 'C:\\private\\operator' }
+            $runtimeManifest = if ($Context.scenario -in @('FreshInstall','FreshLater','FreshRestart','Upgrade','SlowLaunch','ManualLaunchResume','LanguageStress','RepairStates')) { [string]$after.runtimeManifestSha256 } else { $null }
+            return [pscustomobject][ordered]@{ code = 'CCOD_INTEGRATION_OPERATOR_COMPLETED'; scenario = [string]$Context.scenario; transactionId = [string]$Context.transactionId; completed = $true; operatorAttestation = 'OperatorConfirmed'; installerSha256 = [string]$Context.installerSha256; runtimeManifestSha256 = $runtimeManifest }
         }.GetNewClosure()
         VerifyScenario = {
             param($Context, $BeforeFacts, $RunResult)
@@ -272,6 +371,10 @@ function New-CcodHarnessAdapters {
         Rollback = {
             param($Context, $Snapshot)
             $Calls.Add('Rollback')
+            if ($RecordRollbackIdentity) {
+                $Calls.Add('RollbackPath:' + [string]$Context.previousInstallerPath)
+                $Calls.Add('RollbackHash:' + (Get-CcodTestFileSha256 -Path ([string]$Context.previousInstallerPath)))
+            }
             return [pscustomobject]@{ restored = $true; code = 'CCOD_INTEGRATION_ROLLBACK_COMPLETED' }
         }.GetNewClosure()
         CleanupRollback = {
@@ -286,17 +389,110 @@ function New-CcodHarnessAdapters {
     }
 }
 
+Invoke-CcodTest 'installed lifecycle active facts prefer the append-only selector over legacy active json' {
+    . $harnessPath -Library
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-selector-authority-' + [guid]::NewGuid().ToString('N'))
+    try {
+        $null = [IO.Directory]::CreateDirectory($root)
+        $selector = Join-Path (Join-Path $root 'state') 'active-generation'
+        $null = [IO.Directory]::CreateDirectory($selector)
+        $id = '2.5.22-e3b0c44298fc1c14-22222222222222222222222222222222'
+        $runtime = Join-Path (Join-Path $root 'runtime') $id
+        $null = [IO.Directory]::CreateDirectory($runtime)
+        [IO.File]::WriteAllText((Join-Path $runtime 'manifest.json'), (([ordered]@{ schemaVersion = 1; projectVersion = '2.5.22'; runtimeId = $id; files = @() } | ConvertTo-Json -Compress)), [Text.UTF8Encoding]::new($false))
+        $record = [ordered]@{ schemaVersion = 1; generation = [UInt64]1; activeRuntime = $id; previousGeneration = [UInt64]0 }
+        [IO.File]::WriteAllText((Join-Path $selector '00000000000000000001.json'), ($record | ConvertTo-Json -Compress), [Text.UTF8Encoding]::new($false))
+        $legacy = [ordered]@{ schemaVersion = 2; activeRuntime = 'legacy-runtime'; previousRuntime = $null; generation = [UInt64]99; updatedAtUtc = '2030-02-03T04:05:06.0000000Z' }
+        [IO.File]::WriteAllText((Join-Path $root 'active.json'), ($legacy | ConvertTo-Json -Compress), [Text.UTF8Encoding]::new($false))
+        $actual = Read-CcodInstalledLifecycleActiveFact -InstallRoot $root
+        Assert-CcodEqual $id ([string]$actual.activeRuntime) 'append-only selector is authoritative over legacy active json'
+        Assert-CcodEqual ([UInt64]1) ([UInt64]$actual.generation) 'selector generation is returned'
+        Add-Content -LiteralPath (Join-Path $selector '00000000000000000001.json') -Stream 'tampered' -Value 'alternate' -NoNewline
+        Assert-CcodThrows { Read-CcodInstalledLifecycleActiveFact -InstallRoot $root | Out-Null } 'CCOD_INTEGRATION_FACTS_INVALID'
+    } finally { if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force } }
+}
+
+    Invoke-CcodTest 'installed lifecycle selector rejects a file state ancestor before legacy fallback' {
+        . $harnessPath -Library
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-selector-state-file-' + [guid]::NewGuid().ToString('N'))
+        try {
+            $null = [IO.Directory]::CreateDirectory($root)
+            [IO.File]::WriteAllText((Join-Path $root 'state'), 'not-a-directory', [Text.UTF8Encoding]::new($false))
+            $legacy = [ordered]@{ schemaVersion = 2; activeRuntime = 'legacy-runtime'; previousRuntime = $null; generation = [UInt64]1; updatedAtUtc = '2030-02-03T04:05:06.0000000Z' }
+            [IO.File]::WriteAllText((Join-Path $root 'active.json'), ($legacy | ConvertTo-Json -Compress), [Text.UTF8Encoding]::new($false))
+            Assert-CcodThrows { Read-CcodInstalledLifecycleActiveFact -InstallRoot $root | Out-Null } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+        } finally { if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force } }
+    }
+
+Invoke-CcodTest 'installed lifecycle selector rejects a dot-leading active runtime before path construction' {
+    . $harnessPath -Library
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-selector-dot-leading-' + [guid]::NewGuid().ToString('N'))
+    try {
+        $selector = Join-Path (Join-Path $root 'state') 'active-generation'
+        [IO.Directory]::CreateDirectory($selector) | Out-Null
+        $record = [ordered]@{ schemaVersion = 1; generation = [UInt64]1; activeRuntime = '..'; previousGeneration = [UInt64]0 }
+        [IO.File]::WriteAllText((Join-Path $selector '00000000000000000001.json'), ($record | ConvertTo-Json -Compress), [Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows { Read-CcodInstalledLifecycleActiveFact -InstallRoot $root | Out-Null } 'CCOD_INTEGRATION_FACTS_INVALID'
+    } finally {
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
 Invoke-CcodTest 'installed lifecycle harness exposes the guarded library interface' {
     Assert-CcodTrue (Test-Path -LiteralPath $harnessPath -PathType Leaf) 'installed lifecycle harness exists'
     . $harnessPath -Library
     Assert-CcodTrue ($null -ne (Get-Command Invoke-CcodInstalledLifecycleIntegration -ErrorAction SilentlyContinue)) 'harness exports its invocation function when loaded as a library'
 }
 
+Invoke-CcodTest 'FreshInstall is a distinct guarded integration scenario' {
+    . $harnessPath -Library
+    Assert-CcodThrows {
+        Invoke-CcodInstalledLifecycleIntegration -InstallerPath 'C:\fixture\CodexRemote-fix-2.5.22-setup.exe' -ExpectedVersion '2.5.22' -EvidenceRoot 'C:\fixture\evidence' -Scenario FreshInstall
+    } 'CCOD_INTEGRATION_MUTATION_NOT_ALLOWED'
+}
+
 # Production mutation caught: FreshRestart ignores stale status and a current-runtime CloseFailed receipt.
+Invoke-CcodTest 'direct uninstall verification rejects partial owned-state residue' {
+    . $harnessPath -Library
+    $before = New-CcodHarnessFacts
+    $after = New-CcodHarnessFacts
+    $after.installRootPresent = $false; $after.appPresent = $false; $after.runtimeRootPresent = $true; $after.activePointerPresent = $true; $after.taskState = 'Absent'
+    $context = [pscustomobject]@{ scenario = 'DirectUninstall'; expectedVersion = '2.5.0'; installRoot = 'C:\fixture' }
+    $result = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after
+    Assert-CcodTrue (-not $result.verified -and [string]$result.code -eq 'CCOD_INTEGRATION_OBSERVATION_UNPROVEN') 'direct uninstall rejects runtime and pointer residue'
+}
+
+Invoke-CcodTest 'direct uninstall rejects a newly created device key when none existed before' {
+    . $harnessPath -Library
+    $before = New-CcodHarnessFacts
+    $before.deviceKeyPresent = $false
+    $before.deviceKeySha256 = $null
+    $after = New-CcodHarnessAbsentFacts -WithoutDeviceKey
+    $context = [pscustomobject]@{ scenario = 'DirectUninstall'; expectedVersion = '2.5.0'; installRoot = 'C:\fixture' }
+    $positive = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after
+    Assert-CcodTrue $positive.verified 'the absent-key uninstall baseline is independently valid'
+    $after.deviceKeyPresent = $true; $after.deviceKeySha256 = ('b' * 64)
+    $result = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after
+    Assert-CcodTrue (-not $result.verified -and [string]$result.code -eq 'CCOD_INTEGRATION_OBSERVATION_UNPROVEN') 'uninstall rejects device-key creation after an absent baseline'
+}
+
+Invoke-CcodTest 'uninstall rejects persisted runtime status residue after owned state is gone' {
+    . $harnessPath -Library
+    $before = New-CcodHarnessFacts
+    $before.deviceKeyPresent = $false; $before.deviceKeySha256 = $null
+    $after = New-CcodHarnessFacts
+    $after.installRootPresent = $false; $after.appPresent = $false; $after.runtimeRootPresent = $false; $after.activePointerPresent = $false; $after.taskState = 'Absent'
+    $after.supervisor = @(); $after.trayHost = @(); $after.trayHostIdentity = $null; $after.trayAuthenticated = $false; $after.installReady = $false; $after.protectionReady = $false; $after.codex = @(); $after.deviceKeyPresent = $false; $after.deviceKeySha256 = $null
+    $after.shortcuts = [pscustomobject]@{ startMenu = $false; desktop = $false }; $after.debugEndpoints = @(); $after.lifecycleReceipt = $null
+    $context = [pscustomobject]@{ scenario = 'DirectUninstall'; expectedVersion = '2.5.0'; installRoot = 'C:\fixture' }
+    $result = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after
+    Assert-CcodTrue (-not $result.verified -and [string]$result.code -eq 'CCOD_INTEGRATION_OBSERVATION_UNPROVEN') 'uninstall rejects persisted status and transition residue'
+}
+
 Invoke-CcodTest 'rejects FreshRestart when current active runtime has stale status and a CloseFailed installer receipt' {
     . $harnessPath -Library
     $before = New-CcodHarnessFacts -RuntimeId '2.5.19-old' -CodexPid 10664
-    $after = New-CcodHarnessFacts -RuntimeId '2.5.21-new' -CodexPid 13948 `
+    $after = New-CcodHarnessFacts -RuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -CodexPid 13948 `
         -StatusRuntimeId '2.5.19-old' -StatusCodexPid 10664 -ReceiptPhase 'CloseFailed'
     $context = [pscustomobject]@{ scenario = 'FreshRestart'; expectedVersion = '2.5.0'; installRoot = 'C:\fixture' }
     $verification = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after
@@ -304,13 +500,37 @@ Invoke-CcodTest 'rejects FreshRestart when current active runtime has stale stat
     Assert-CcodEqual 'CCOD_INTEGRATION_OBSERVATION_UNPROVEN' $verification.code 'rejection uses the stable observation code'
 }
 
+Invoke-CcodTest 'FreshInstall requires the same current-runtime Ready and Complete proof as later phases' {
+    . $harnessPath -Library
+    $before = New-CcodHarnessAbsentFacts
+    $after = New-CcodHarnessFacts
+    $context = [pscustomobject]@{ scenario = 'FreshInstall'; expectedVersion = '2.5.0'; expectedDebugPorts = @(9229,9230); installRoot = 'C:\fixture' }
+    $positive = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after
+    Assert-CcodTrue $positive.verified 'clean pre-install state and complete candidate proof form a valid FreshInstall baseline'
+    $after.lifecycleReceipt = $null
+    $verification = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after
+    Assert-CcodEqual $false $verification.verified 'FreshInstall cannot use the generic installed success branch'
+    Assert-CcodEqual 'CCOD_INTEGRATION_OBSERVATION_UNPROVEN' $verification.code 'FreshInstall missing proof uses the stable observation code'
+}
+
+Invoke-CcodTest 'rejects FreshRestart without current Active status Idle transition or Completed receipt' {
+    . $harnessPath -Library
+    $before = New-CcodHarnessFacts -RuntimeId '2.5.21-before' -CodexPid 10664
+    $after = New-CcodHarnessFacts -RuntimeId '2.5.22-after' -CodexPid 13948
+    $after.statusPhase = 'Unknown'; $after.statusRuntimeId = $null; $after.statusCodex = $null; $after.transitionStage = 'Unknown'; $after.lifecycleReceipt = $null
+    $context = [pscustomobject]@{ scenario = 'FreshRestart'; expectedVersion = '2.5.0'; installRoot = 'C:\fixture' }
+    $verification = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after
+    Assert-CcodEqual $false $verification.verified 'FreshRestart requires current-runtime Ready/Complete evidence'
+    Assert-CcodEqual 'CCOD_INTEGRATION_OBSERVATION_UNPROVEN' $verification.code 'missing Ready/Complete evidence uses the stable observation code'
+}
+
 # Production mutation caught: querying Codex.exe instead of the Windows app root ChatGPT.exe.
 Invoke-CcodTest 'captures exactly the top-level ChatGPT root and excludes Electron type children' {
     . $harnessPath -Library
     $root = Join-Path $env:TEMP ('ccod-installed-capture-' + [guid]::NewGuid().ToString('N'))
     try {
         $null = [IO.Directory]::CreateDirectory($root)
-        $created = '2026-08-24T00:00:04.0000000Z'
+        $created = '2026-08-24T00:00:04.0000006Z'
         Set-CcodHarnessProcessFixture -ChatGPT @(
             (New-CcodHarnessCimProcess -Name 'ChatGPT.exe' -ProcessId 13948 -CreationTimeUtc $created -CommandLine '"C:\Program Files\WindowsApps\OpenAI.Codex\ChatGPT.exe"'),
             (New-CcodHarnessCimProcess -Name 'ChatGPT.exe' -ProcessId 13949 -CreationTimeUtc '2026-08-24T00:00:04.1000000Z' -CommandLine '"C:\Program Files\WindowsApps\OpenAI.Codex\ChatGPT.exe" --type=renderer' -ParentProcessId 13948),
@@ -344,6 +564,7 @@ Invoke-CcodTest 'normalizes only supported CIM creation-time evidence for comple
         foreach ($case in $successCases) {
             $process = New-CcodHarnessCimProcess -Name 'ChatGPT.exe' -ProcessId 13948 -CreationTimeUtc '2026-08-24T00:00:04.0000000Z' -CommandLine $commandLine
             $process.CreationDate = $case.Value
+            $script:CcodHarnessNativeCreation[13948]=$case.Expected
             Set-CcodHarnessProcessFixture -ChatGPT @($process)
             $facts = Get-CcodInstalledLifecycleFacts -InstallRoot $root
             Assert-CcodEqual 1 $facts.codex.Count ("{0} keeps one root" -f $case.Name)
@@ -401,14 +622,14 @@ Invoke-CcodTest 'captures bounded current-runtime status transition and latest i
     $root = Join-Path $env:TEMP ('ccod-installed-state-' + [guid]::NewGuid().ToString('N'))
     try {
         $null = [IO.Directory]::CreateDirectory($root)
-        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-new' -ActiveGeneration ([UInt64]8) `
+        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -ActiveGeneration ([UInt64]8) `
             -StatusRuntimeId '2.5.19-old' -StatusCodexPid 10664 -StatusCodexCreationTimeUtc '2026-08-24T00:00:02.0000000Z' -ReceiptPhase 'CloseFailed'
         Set-CcodHarnessProcessFixture -ChatGPT @(
             (New-CcodHarnessCimProcess -Name 'ChatGPT.exe' -ProcessId 13948 -CreationTimeUtc '2026-08-24T00:00:04.0000000Z' -CommandLine '"C:\Program Files\WindowsApps\OpenAI.Codex\ChatGPT.exe"'),
             (New-CcodHarnessCimProcess -Name 'ChatGPT.exe' -ProcessId 13949 -CreationTimeUtc '2026-08-24T00:00:04.1000000Z' -CommandLine '"C:\Program Files\WindowsApps\OpenAI.Codex\ChatGPT.exe" --type=renderer' -ParentProcessId 13948)
         )
         $facts = Get-CcodInstalledLifecycleFacts -InstallRoot $root
-        Assert-CcodEqual '2.5.21-new' $facts.activeRuntimeId 'active schema 2 supplies the current runtime'
+        Assert-CcodEqual '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' $facts.activeRuntimeId 'active schema 2 supplies the current runtime'
         Assert-CcodEqual 8 ([UInt64]$facts.activeGeneration) 'active schema 2 supplies the current generation'
         Assert-CcodEqual 'Active' $facts.statusPhase 'complete status schema 1 supplies the session state'
         Assert-CcodEqual '2.5.19-old' $facts.statusRuntimeId 'stale status runtime remains visible for correlation rejection'
@@ -416,7 +637,7 @@ Invoke-CcodTest 'captures bounded current-runtime status transition and latest i
         Assert-CcodEqual 'Idle' $facts.transitionStage 'null active transaction is captured as idle'
         Assert-CcodEqual 'RestartAndRepair' $facts.lifecycleReceipt.kind 'receipt kind is bounded and retained'
         Assert-CcodEqual 'Installer' $facts.lifecycleReceipt.origin 'receipt origin is bounded and retained'
-        Assert-CcodEqual '2.5.21-new' $facts.lifecycleReceipt.runtimeId 'latest receipt is bound to the active runtime'
+        Assert-CcodEqual '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' $facts.lifecycleReceipt.runtimeId 'latest receipt is bound to the active runtime'
         Assert-CcodEqual 'CloseFailed' $facts.lifecycleReceipt.phase 'terminal receipt failure remains visible'
         $serialized = $facts | ConvertTo-Json -Depth 16 -Compress
         foreach ($forbidden in @('00000000:000003E7','S-1-5-21-1-2-3-1001','OpenAI.Codex_1.0.0.0_x64__test','41001','--type=renderer','C:\Program Files\WindowsApps')) {
@@ -433,9 +654,9 @@ Invoke-CcodTest 'selects only an unambiguous latest current-runtime installer re
     $root = Join-Path $env:TEMP ('ccod-installed-receipts-' + [guid]::NewGuid().ToString('N'))
     try {
         $null = [IO.Directory]::CreateDirectory($root)
-        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-new' -ActiveGeneration ([UInt64]8) `
-            -StatusRuntimeId '2.5.21-new' -StatusCodexPid 13948 -StatusCodexCreationTimeUtc '2026-08-24T00:00:04.0000000Z' -ReceiptPhase 'CloseFailed'
-        $completed = New-CcodHarnessLifecycleReceipt -RuntimeId '2.5.21-new' -RuntimeGeneration ([UInt64]8) -Phase 'Completed' `
+        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -ActiveGeneration ([UInt64]8) `
+            -StatusRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -StatusCodexPid 13948 -StatusCodexCreationTimeUtc '2026-08-24T00:00:04.0000000Z' -ReceiptPhase 'CloseFailed'
+        $completed = New-CcodHarnessLifecycleReceipt -RuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -RuntimeGeneration ([UInt64]8) -Phase 'Completed' `
             -TransactionId '22222222-3333-4444-5555-666666666666' -UpdatedAtUtc '2026-08-24T00:00:06.0000000Z'
         Write-CcodHarnessJson -Path (Join-Path $root ("state\lifecycle\receipts\{0}.json" -f $completed.transactionId)) -Value $completed
         Set-CcodHarnessProcessFixture -ChatGPT @(
@@ -444,7 +665,7 @@ Invoke-CcodTest 'selects only an unambiguous latest current-runtime installer re
         $facts = Get-CcodInstalledLifecycleFacts -InstallRoot $root
         Assert-CcodEqual 'Completed' $facts.lifecycleReceipt.phase 'strict receipt selection uses the unique latest updatedAtUtc'
 
-        $ambiguous = New-CcodHarnessLifecycleReceipt -RuntimeId '2.5.21-new' -RuntimeGeneration ([UInt64]8) -Phase 'CloseFailed' `
+        $ambiguous = New-CcodHarnessLifecycleReceipt -RuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -RuntimeGeneration ([UInt64]8) -Phase 'CloseFailed' `
             -TransactionId '33333333-4444-5555-6666-777777777777' -UpdatedAtUtc '2026-08-24T00:00:06.0000000Z'
         Write-CcodHarnessJson -Path (Join-Path $root ("state\lifecycle\receipts\{0}.json" -f $ambiguous.transactionId)) -Value $ambiguous
         Assert-CcodThrows { Get-CcodInstalledLifecycleFacts -InstallRoot $root } 'CCOD_INTEGRATION_FACTS_INVALID'
@@ -460,9 +681,9 @@ Invoke-CcodTest 'ignores a newer wrong-generation receipt when selecting the cur
     $root = Join-Path $env:TEMP ('ccod-installed-receipt-generation-' + [guid]::NewGuid().ToString('N'))
     try {
         $null = [IO.Directory]::CreateDirectory($root)
-        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-new' -ActiveGeneration ([UInt64]8) `
-            -StatusRuntimeId '2.5.21-new' -StatusCodexPid 13948 -StatusCodexCreationTimeUtc '2026-08-24T00:00:04.0000000Z' -ReceiptPhase 'Completed'
-        $wrongGeneration = New-CcodHarnessLifecycleReceipt -RuntimeId '2.5.21-new' -RuntimeGeneration ([UInt64]7) -Phase 'CloseFailed' `
+        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -ActiveGeneration ([UInt64]8) `
+            -StatusRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -StatusCodexPid 13948 -StatusCodexCreationTimeUtc '2026-08-24T00:00:04.0000000Z' -ReceiptPhase 'Completed'
+        $wrongGeneration = New-CcodHarnessLifecycleReceipt -RuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -RuntimeGeneration ([UInt64]7) -Phase 'CloseFailed' `
             -TransactionId '44444444-5555-6666-7777-888888888888' -UpdatedAtUtc '2026-08-24T00:00:07.0000000Z'
         Write-CcodHarnessJson -Path (Join-Path $root ("state\lifecycle\receipts\{0}.json" -f $wrongGeneration.transactionId)) -Value $wrongGeneration
         Set-CcodHarnessProcessFixture -ChatGPT @()
@@ -480,11 +701,11 @@ Invoke-CcodTest 'does not treat tied wrong-generation receipts as current-genera
     $root = Join-Path $env:TEMP ('ccod-installed-receipt-generation-tie-' + [guid]::NewGuid().ToString('N'))
     try {
         $null = [IO.Directory]::CreateDirectory($root)
-        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-new' -ActiveGeneration ([UInt64]8) `
-            -StatusRuntimeId '2.5.21-new' -StatusCodexPid 13948 -StatusCodexCreationTimeUtc '2026-08-24T00:00:04.0000000Z' -ReceiptPhase 'Completed'
+        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -ActiveGeneration ([UInt64]8) `
+            -StatusRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -StatusCodexPid 13948 -StatusCodexCreationTimeUtc '2026-08-24T00:00:04.0000000Z' -ReceiptPhase 'Completed'
         foreach ($record in @(
-            (New-CcodHarnessLifecycleReceipt -RuntimeId '2.5.21-new' -RuntimeGeneration ([UInt64]7) -Phase 'CloseFailed' -TransactionId '55555555-6666-7777-8888-999999999999' -UpdatedAtUtc '2026-08-24T00:00:07.0000000Z'),
-            (New-CcodHarnessLifecycleReceipt -RuntimeId '2.5.21-new' -RuntimeGeneration ([UInt64]7) -Phase 'RepairFailed' -TransactionId '66666666-7777-8888-9999-aaaaaaaaaaaa' -UpdatedAtUtc '2026-08-24T00:00:07.0000000Z')
+            (New-CcodHarnessLifecycleReceipt -RuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -RuntimeGeneration ([UInt64]7) -Phase 'CloseFailed' -TransactionId '55555555-6666-7777-8888-999999999999' -UpdatedAtUtc '2026-08-24T00:00:07.0000000Z'),
+            (New-CcodHarnessLifecycleReceipt -RuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -RuntimeGeneration ([UInt64]7) -Phase 'RepairFailed' -TransactionId '66666666-7777-8888-9999-aaaaaaaaaaaa' -UpdatedAtUtc '2026-08-24T00:00:07.0000000Z')
         )) {
             Write-CcodHarnessJson -Path (Join-Path $root ("state\lifecycle\receipts\{0}.json" -f $record.transactionId)) -Value $record
         }
@@ -503,11 +724,11 @@ Invoke-CcodTest 'fails closed on receipt filename duplicate-property and nonterm
         $root = Join-Path $env:TEMP ("ccod-installed-receipt-$case-" + [guid]::NewGuid().ToString('N'))
         try {
             $null = [IO.Directory]::CreateDirectory($root)
-            New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-new' -ActiveGeneration ([UInt64]8) `
-                -StatusRuntimeId '2.5.21-new' -StatusCodexPid 13948 -StatusCodexCreationTimeUtc '2026-08-24T00:00:04.0000000Z' -ReceiptPhase 'Completed'
+            New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -ActiveGeneration ([UInt64]8) `
+                -StatusRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -StatusCodexPid 13948 -StatusCodexCreationTimeUtc '2026-08-24T00:00:04.0000000Z' -ReceiptPhase 'Completed'
             switch ($case) {
                 'filename' {
-                    $receipt = New-CcodHarnessLifecycleReceipt -RuntimeId '2.5.21-new' -RuntimeGeneration ([UInt64]8) -Phase 'Completed' `
+                    $receipt = New-CcodHarnessLifecycleReceipt -RuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -RuntimeGeneration ([UInt64]8) -Phase 'Completed' `
                         -TransactionId '77777777-8888-9999-aaaa-bbbbbbbbbbbb'
                     Write-CcodHarnessJson -Path (Join-Path $root 'state\lifecycle\receipts\88888888-9999-aaaa-bbbb-cccccccccccc.json') -Value $receipt
                     Assert-CcodThrows { Get-CcodInstalledLifecycleFacts -InstallRoot $root } 'CCOD_INTEGRATION_FACTS_INVALID'
@@ -519,7 +740,7 @@ Invoke-CcodTest 'fails closed on receipt filename duplicate-property and nonterm
                     Assert-CcodThrows { Get-CcodInstalledLifecycleFacts -InstallRoot $root } 'CCOD_STATE_MALFORMED'
                 }
                 'nonterminal' {
-                    $receipt = New-CcodHarnessLifecycleReceipt -RuntimeId '2.5.21-new' -RuntimeGeneration ([UInt64]8) -Phase 'Completed' `
+                    $receipt = New-CcodHarnessLifecycleReceipt -RuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -RuntimeGeneration ([UInt64]8) -Phase 'Completed' `
                         -TransactionId '99999999-aaaa-bbbb-cccc-dddddddddddd'
                     $receipt.phase = 'Requested'
                     Write-CcodHarnessJson -Path (Join-Path $root ("state\lifecycle\receipts\{0}.json" -f $receipt.transactionId)) -Value $receipt
@@ -532,14 +753,38 @@ Invoke-CcodTest 'fails closed on receipt filename duplicate-property and nonterm
     }
 }
 
+Invoke-CcodTest 'lifecycle receipt inspection rejects non-json residue and non-plain receipt links' {
+    . $harnessPath -Library
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-receipt-authority-' + [guid]::NewGuid().ToString('N'))
+    $outside = Join-Path ([IO.Path]::GetTempPath()) ('ccod-receipt-hardlink-' + [guid]::NewGuid().ToString('N') + '.json')
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14' -ActiveGeneration ([UInt64]8) `
+            -StatusRuntimeId '2.5.21-e3b0c44298fc1c14' -StatusCodexPid 13948 -StatusCodexCreationTimeUtc '2026-08-24T00:00:04.0000000Z' -ReceiptPhase 'Completed'
+        Set-CcodHarnessProcessFixture -ChatGPT @(
+            (New-CcodHarnessCimProcess -Name 'ChatGPT.exe' -ProcessId 13948 -CreationTimeUtc '2026-08-24T00:00:04.0000000Z' -CommandLine '"C:\Program Files\WindowsApps\OpenAI.Codex\ChatGPT.exe"')
+        )
+        $receiptDirectory = Join-Path $root 'state/lifecycle/receipts'
+        [IO.File]::WriteAllText((Join-Path $receiptDirectory 'unexpected.tmp'), 'residue', [Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows { Get-CcodInstalledLifecycleFacts -InstallRoot $root | Out-Null } 'CCOD_INTEGRATION_FACTS_INVALID'
+        Remove-Item -LiteralPath (Join-Path $receiptDirectory 'unexpected.tmp') -Force
+        New-Item -ItemType HardLink -Path $outside -Target (Get-ChildItem -LiteralPath $receiptDirectory -Filter '*.json' | Select-Object -First 1 -ExpandProperty FullName) | Out-Null
+        Assert-CcodThrows { Get-CcodInstalledLifecycleFacts -InstallRoot $root | Out-Null } 'CCOD_INTEGRATION_FACTS_INVALID'
+    } finally {
+        Clear-CcodHarnessProcessFixture
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+        if (Test-Path -LiteralPath $outside) { Remove-Item -LiteralPath $outside -Force }
+    }
+}
+
 Invoke-CcodTest 'fails closed on malformed active status and transition schemas' {
     . $harnessPath -Library
     foreach ($case in @('active','status','transition')) {
         $root = Join-Path $env:TEMP ("ccod-installed-state-$case-" + [guid]::NewGuid().ToString('N'))
         try {
             $null = [IO.Directory]::CreateDirectory($root)
-            New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-new' -ActiveGeneration ([UInt64]8) `
-                -StatusRuntimeId '2.5.21-new' -StatusCodexPid 13948 -StatusCodexCreationTimeUtc '2026-08-24T00:00:04.0000000Z' -ReceiptPhase 'Completed'
+            New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -ActiveGeneration ([UInt64]8) `
+                -StatusRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -StatusCodexPid 13948 -StatusCodexCreationTimeUtc '2026-08-24T00:00:04.0000000Z' -ReceiptPhase 'Completed'
             switch ($case) {
                 'active' {
                     $path = Join-Path $root 'active.json'
@@ -584,22 +829,1115 @@ Invoke-CcodTest 'does not accept a Codex.exe-only fixture as Codex process evide
     }
 }
 
+Invoke-CcodTest 'sealed direct uninstall launches the active public uninstaller rather than removed Inno executable' {
+    . $harnessPath -Library
+    $root=Join-Path $env:TEMP ('ccod-modern-uninstall-'+[guid]::NewGuid().ToString('N'))
+    $originalStart=${function:Start-Process};$originalAck=${function:Read-CcodInstalledLifecycleOperatorAck}
+    $originalCommand=${function:Get-CcodInstalledLifecycleUninstallCommand}
+    $originalLaunch=${function:Start-CcodInstalledLifecycleVerifiedUninstall}
+    $state=[pscustomobject]@{Launch=$null;Ack=0;Resolved=0}
+    try {
+        [IO.Directory]::CreateDirectory($root)|Out-Null
+        $runtimeId='2.5.22-'+('a'*16)+'-'+('b'*32);$runtime=Join-Path $root ('runtime\'+$runtimeId)
+        [IO.Directory]::CreateDirectory($runtime)|Out-Null
+        $uninstaller=Join-Path $runtime 'Uninstall-CodexControlOtherDevices.ps1';[IO.File]::WriteAllText($uninstaller,'# inert uninstall test')
+        $installer=Join-Path $root 'candidate.exe';[IO.File]::WriteAllText($installer,'inert candidate')
+        $context=[pscustomobject]@{scenario='DirectUninstall';expectedVersion='2.5.22';installRoot=$root;installerApplicationRoot=(Join-Path $root 'obsolete-inno');installerPath=$installer;candidatePayloadFiles=@([pscustomobject]@{path='payload';length=1;sha256=('a'*64)});transactionId='11111111-2222-3333-4444-555555555555'}
+        function Get-CcodInstalledLifecycleUninstallCommand {param($InstallRoot,$ExpectedVersion,$ExpectedPayloadFiles)$state.Resolved++;Assert-CcodEqual '2.5.22' $ExpectedVersion 'resolver gets the bound version';Assert-CcodEqual 1 @($ExpectedPayloadFiles).Count 'resolver gets the actual candidate records';[pscustomobject]@{Spec=[pscustomobject]@{installRoot=$InstallRoot;runtimeId=$runtimeId;candidatePayloadFiles=$ExpectedPayloadFiles}}}
+        function Start-Process {throw 'unverified direct native launch must not occur'}
+        function Start-CcodInstalledLifecycleVerifiedUninstall {param($Spec)$state.Launch=$Spec;[pscustomobject]@{ExitCode=0}}
+        function Read-CcodInstalledLifecycleOperatorAck {param($Scenario,$Instructions)$state.Ack++}
+        $result=Invoke-CcodInstalledLifecycleOperatorScenario -Context $context
+        Assert-CcodEqual 1 $state.Resolved 'actual scenario resolves the sealed uninstaller contract'
+        Assert-CcodEqual $root $state.Launch.installRoot 'verified launcher receives the selected install root'
+        Assert-CcodEqual $runtimeId $state.Launch.runtimeId 'launcher receives the original runtime identity rather than command text'
+        Assert-CcodEqual 1 @($state.Launch.candidatePayloadFiles).Count 'launcher retains original candidate records'
+        Assert-CcodEqual 1 $state.Ack 'operator acknowledgement remains mandatory'
+        Assert-CcodTrue $result.completed 'only scenario initiation is reported; final absence is verified separately'
+    } finally {
+        foreach($pair in @(@('Start-Process',$originalStart),@('Read-CcodInstalledLifecycleOperatorAck',$originalAck),@('Get-CcodInstalledLifecycleUninstallCommand',$originalCommand),@('Start-CcodInstalledLifecycleVerifiedUninstall',$originalLaunch))){if($null-ne$pair[1]){Set-Item ('Function:'+$pair[0]) $pair[1]}else{Remove-Item ('Function:'+$pair[0]) -ErrorAction SilentlyContinue}}
+        if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force}
+    }
+}
+
+Invoke-CcodTest 'public finalizer launch arguments round trip through native parser and inert child' {
+    . $harnessPath -Library
+    Initialize-CcodInstalledLifecycleCommandLineParser
+    $publicPath=Join-Path $repositoryRoot 'Uninstall-CodexControlOtherDevices.ps1'
+    $tokens=$null;$errors=$null;$ast=[Management.Automation.Language.Parser]::ParseFile($publicPath,[ref]$tokens,[ref]$errors)
+    Assert-CcodEqual 0 @($errors).Count 'public wrapper parses before extracting inert argument boundary'
+    $converters=@($ast.FindAll({param($node)$node-is[Management.Automation.Language.FunctionDefinitionAst]-and$node.Name-in@('ConvertTo-CcodInstalledUninstallLiteral','ConvertTo-CcodPublicUninstallPowerShellLiteral')},$true))
+    Assert-CcodEqual 2 $converters.Count 'both current native launch converters are covered'
+    foreach($converter in $converters){. ([scriptblock]::Create($converter.Extent.Text))}
+    $launchArguments=@($ast.FindAll({param($node)$node-is[Management.Automation.Language.AssignmentStatementAst]-and$node.Left-is[Management.Automation.Language.VariableExpressionAst]-and$node.Left.VariablePath.UserPath-ceq'arguments'},$true))
+    Assert-CcodEqual 2 $launchArguments.Count 'installed and portable native argument builders are uniquely identified'
+    $root=Join-Path $env:TEMP ('ccod native args '+[char]0x6d4b+[char]0x8bd5+" O'Brien "+[guid]::NewGuid().ToString('N'))
+    $powershellPath=Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'WindowsPowerShell/v1.0/powershell.exe'
+    $oldPolicy=[Environment]::GetEnvironmentVariable('PSExecutionPolicyPreference','Process')
+    try {
+        [IO.Directory]::CreateDirectory($root)|Out-Null
+        $finalizer=Join-Path $root 'inert finalizer.ps1';$finalizerPath=$finalizer
+        $probe=@'
+param([switch]$WrapperResume,[string]$TransactionId,[string]$RuntimeRoot,[string]$InstallerRoot,[string]$InstallRoot,[int]$WrapperProcessId,[string]$WrapperCreationTimeUtc)
+$ErrorActionPreference='Stop'
+[Console]::OutputEncoding=[Text.UTF8Encoding]::new($false)
+[Console]::Out.WriteLine(([pscustomobject][ordered]@{transactionId=$TransactionId;runtimeRoot=$RuntimeRoot;installerRoot=$InstallerRoot;installRoot=$InstallRoot;wrapperPid=$WrapperProcessId;wrapperCreated=$WrapperCreationTimeUtc;resume=[bool]$WrapperResume}|ConvertTo-Json -Compress))
+'@
+        [IO.File]::WriteAllText($finalizer,$probe,[Text.UTF8Encoding]::new($true))
+        $installerRoot=Join-Path $root 'runtime selected';$expectedInstallRoot=(Join-Path $root 'install root')+'\'
+        $wrapperId=[int]417;$wrapperCreated='2030-02-03T04:05:01.0000006Z'
+        $prepared=[pscustomobject]@{transactionId='11111111-2222-3333-4444-555555555555'}
+        foreach($mode in @('Installed','Resume','Portable')){
+            $resumeExisting=$mode-ceq'Resume';$arguments=$null
+            $builder=$launchArguments[$(if($mode-ceq'Portable'){1}else{0})]
+            . ([scriptblock]::Create($builder.Extent.Text))
+            $argv=@([CcodInstalledLifecycleCommandLine]::Parse(('"'+$powershellPath+'" '+$arguments)))
+            $fileIndex=[Array]::IndexOf($argv,'-File')
+            Assert-CcodTrue ($fileIndex-gt0) 'actual builder supplies native File switch'
+            Assert-CcodEqual $finalizer $argv[$fileIndex+1] ($mode+' preserves finalizer filename before any process starts')
+            $expected=@('-TransactionId',$prepared.transactionId)
+            if($mode-ceq'Portable'){$expected+=@('-InstallerRoot',$installerRoot,'-InstallRoot',$expectedInstallRoot)}
+            else{$expected+=@('-RuntimeRoot',$installerRoot,'-InstallRoot',$expectedInstallRoot,'-WrapperProcessId',[string]$wrapperId,'-WrapperCreationTimeUtc',$wrapperCreated)}
+            if($resumeExisting){$expected=@('-WrapperResume')+$expected}
+            $actual=@($argv|Select-Object -Skip ($fileIndex+2))
+            Assert-CcodEqual ($expected-join'|') ($actual-join'|') ($mode+' exact native arguments have no quotes or split paths')
+            # Argument fidelity probe only: omit the existing production policy override.
+            # The unmodified argv above is tested separately; no new Bypass child is run.
+            $normalArguments=$arguments.Replace('-ExecutionPolicy Bypass ','')
+            Assert-CcodTrue ($normalArguments-notmatch'(?i)-ExecutionPolicy') 'normal-policy smoke has no override argument'
+            [Environment]::SetEnvironmentVariable('PSExecutionPolicyPreference',$null,'Process')
+            $stdout=Join-Path $root ($mode+'.stdout');$stderr=Join-Path $root ($mode+'.stderr')
+            $child=Start-Process -FilePath $powershellPath -ArgumentList $normalArguments -RedirectStandardOutput $stdout -RedirectStandardError $stderr -NoNewWindow -PassThru -Wait -ErrorAction Stop
+            try{Assert-CcodEqual 0 $child.ExitCode ($mode+' inert child actually executes')}finally{$child.Dispose()}
+            Assert-CcodEqual '' ([IO.File]::ReadAllText($stderr)) ($mode+' inert child produces no error')
+            $value=[IO.File]::ReadAllText($stdout)|ConvertFrom-Json
+            Assert-CcodEqual $prepared.transactionId $value.transactionId 'actual child retains transaction'
+            Assert-CcodEqual $expectedInstallRoot $value.installRoot 'actual child retains spaced trailing-slash path'
+            Assert-CcodEqual $resumeExisting $value.resume 'actual child retains resume distinction'
+            if($mode-ceq'Portable'){Assert-CcodEqual $installerRoot $value.installerRoot 'portable child receives its root'}else{Assert-CcodEqual $installerRoot $value.runtimeRoot 'installed child receives its root';Assert-CcodEqual $wrapperCreated $value.wrapperCreated 'installed child preserves precise wrapper identity';Assert-CcodEqual $wrapperId $value.wrapperPid 'installed child preserves wrapper PID'}
+        }
+    } finally {
+        [Environment]::SetEnvironmentVariable('PSExecutionPolicyPreference',$oldPolicy,'Process')
+        if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force}
+    }
+}
+
+Invoke-CcodTest 'public uninstall bootstrap invocation returns the actual function receipt instead of CLI exit' {
+    $publicPath=Join-Path $repositoryRoot 'Uninstall-CodexControlOtherDevices.ps1'
+    $bootstrapSource=Join-Path $repositoryRoot 'src/persistence/UninstallBootstrap.ps1'
+    $tokens=$null;$errors=$null;$publicAst=[Management.Automation.Language.Parser]::ParseFile($publicPath,[ref]$tokens,[ref]$errors)
+    Assert-CcodEqual 0 @($errors).Count 'public wrapper parses'
+    $bootstrapAst=[Management.Automation.Language.Parser]::ParseFile($bootstrapSource,[ref]$tokens,[ref]$errors)
+    Assert-CcodEqual 0 @($errors).Count 'bootstrap source parses'
+    $tail=@($bootstrapAst.EndBlock.Statements|Where-Object {$_-is[Management.Automation.Language.IfStatementAst]-and$_.Extent.Text.StartsWith('if ($MyInvocation.InvocationName')})
+    Assert-CcodEqual 1 $tail.Count 'actual CLI-only entry is unambiguous'
+    $calls=@($publicAst.FindAll({param($Node)$Node-is[Management.Automation.Language.AssignmentStatementAst]-and$Node.Left-is[Management.Automation.Language.VariableExpressionAst]-and$Node.Left.VariablePath.UserPath-ceq'prepared'},$true))
+    Assert-CcodEqual 2 $calls.Count 'installed and portable actual caller expressions are exercised'
+    $root=Join-Path $env:TEMP ('ccod-bootstrap-receipt-'+[guid]::NewGuid().ToString('N'))
+    [IO.Directory]::CreateDirectory($root)|Out-Null
+    try {
+        $bootstrapPath=Join-Path $root 'bootstrap.ps1';$installerRoot=$root;$expectedInstallRoot=Join-Path $root 'install'
+        $wrapperIdentity=[pscustomobject]@{pid=7}
+        $stub=@'
+function Invoke-CcodUninstallBootstrap {
+ param($InstallerRoot,$InstallRoot,$Mode,$WrapperIdentity)
+ [pscustomobject]@{transactionId='11111111-2222-3333-4444-555555555555';phase=$(if($Mode-ceq'PrepareInstalled'){'TaskRemoved'}else{'ReadyForInno'});installerRoot=$InstallerRoot;installRoot=$InstallRoot;mode=$Mode;wrapper=$WrapperIdentity}
+}
+'@
+        [IO.File]::WriteAllText($bootstrapPath,$bootstrapAst.ParamBlock.Extent.Text+"`n"+$stub+"`n"+$tail[0].Extent.Text,[Text.UTF8Encoding]::new($false))
+        foreach($definition in @($publicAst.EndBlock.Statements|Where-Object {$_-is[Management.Automation.Language.FunctionDefinitionAst]})){. ([scriptblock]::Create($definition.Extent.Text))}
+        foreach($index in @(0,1)) {
+            $prepared=$null
+            . ([scriptblock]::Create($calls[$index].Extent.Text))
+            Assert-CcodTrue ($null-ne$prepared) 'the real public caller obtains the bootstrap function receipt'
+            Assert-CcodEqual '11111111-2222-3333-4444-555555555555' $prepared.transactionId 'producer receipt is not synthesized by the wrapper'
+            Assert-CcodEqual $root $prepared.installerRoot 'caller runtime root reaches the function unchanged'
+            Assert-CcodEqual $expectedInstallRoot $prepared.installRoot 'target root reaches the function unchanged'
+            Assert-CcodEqual @('TaskRemoved','ReadyForInno')[$index] $prepared.phase 'both public modes preserve their terminal boundary'
+        }
+    } finally {if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+}
+
+Invoke-CcodTest 'direct uninstall never consumes a substituted dependency after resolution' {
+    . $harnessPath -Library
+    $root=Join-Path $env:TEMP ('ccod-uninstall-consumption-'+[guid]::NewGuid().ToString('N'))
+    $originalFacts=${function:Get-CcodInstalledLifecycleFacts};$originalActive=${function:Read-CcodInstalledLifecycleActiveFact}
+    $originalStart=${function:Start-Process};$originalAck=${function:Read-CcodInstalledLifecycleOperatorAck}
+    $originalLaunch=${function:Start-CcodInstalledLifecycleVerifiedUninstall}
+    try {
+        $runtimeId='2.5.22-'+('a'*16)+'-'+('b'*32);$runtime=Join-Path $root ('runtime\'+$runtimeId)
+        [IO.Directory]::CreateDirectory((Join-Path $runtime 'src/persistence'))|Out-Null
+        $uninstaller=Join-Path $runtime 'Uninstall-CodexControlOtherDevices.ps1';$dependency=Join-Path $runtime 'src/persistence/UninstallBootstrap.ps1'
+        $body='[CmdletBinding(SupportsShouldProcess=$true)]param(); $global:CcodUninstallRaceConsumed++; . (Join-Path $PSScriptRoot ''src/persistence/UninstallBootstrap.ps1''); [pscustomobject]@{Outcome=''InstalledFinalizationStarted'';TransactionId=''11111111-2222-3333-4444-555555555555'';FinalizerProcessId=1;KeptDeviceKeyStore=$true}'
+        [IO.File]::WriteAllText($uninstaller,$body);[IO.File]::WriteAllText($dependency,'$global:CcodUninstallRaceValue=''original''')
+        $records=@('Uninstall-CodexControlOtherDevices.ps1','src/persistence/UninstallBootstrap.ps1'|ForEach-Object {$path=Join-Path $runtime $_;[pscustomobject][ordered]@{path=$_;length=[long](Get-Item $path).Length;sha256=Get-CcodTestFileSha256 $path}})
+        $manifestPath=Join-Path $runtime 'manifest.json';[IO.File]::WriteAllText($manifestPath,'inert manifest captured by independent facts seam')
+        $facts=New-CcodHarnessFacts -Version '2.5.22' -RuntimeId $runtimeId;$facts.runtimeManifestFiles=$records;$facts.runtimeManifestSha256=Get-CcodTestFileSha256 $manifestPath
+        $installer=Join-Path $root 'candidate.exe';[IO.File]::WriteAllText($installer,'inert candidate')
+        $context=[pscustomobject]@{scenario='DirectUninstall';expectedVersion='2.5.22';installRoot=$root;installerApplicationRoot=(Join-Path $root 'obsolete');installerPath=$installer;candidatePayloadFiles=$records;transactionId='11111111-2222-3333-4444-555555555555'}
+        $probe=[pscustomobject]@{Attack=$false;Seam=0;Ack=0;Facts=$facts}
+        function Get-CcodInstalledLifecycleFacts {param($InstallRoot,$ExpectedVersion,$ExpectedPayloadFiles)return $probe.Facts}
+        function Read-CcodInstalledLifecycleActiveFact {param($InstallRoot)[pscustomobject]@{activeRuntime=$runtimeId;generation=[uint64]1}}
+        function Start-Process {param($FilePath,$ArgumentList,[switch]$PassThru,[switch]$Wait,$ErrorAction)
+            $probe.Seam++;if($probe.Attack){[IO.File]::WriteAllText($dependency,'$global:CcodUninstallRaceValue=''substituted''')}
+            & $uninstaller -Confirm:$false|Out-Null
+            [pscustomobject]@{ExitCode=0}
+        }
+        function Start-CcodInstalledLifecycleVerifiedUninstall {param($Spec)
+            $probe.Seam++;if($probe.Attack){[IO.File]::WriteAllText($dependency,'$global:CcodUninstallRaceValue=''substituted''')}
+            Invoke-CcodInstalledLifecycleVerifiedUninstall -Spec $Spec|Out-Null
+            [pscustomobject]@{ExitCode=0}
+        }
+        function Read-CcodInstalledLifecycleOperatorAck {param($Scenario,$Instructions)$probe.Ack++}
+        $global:CcodUninstallRaceConsumed=0;$global:CcodUninstallRaceValue=$null
+        $control=Invoke-CcodInstalledLifecycleOperatorScenario -Context $context
+        Assert-CcodTrue $control.completed 'unchanged actual resolver and consumer path succeeds'
+        Assert-CcodEqual 1 $global:CcodUninstallRaceConsumed 'positive control actually loads inert wrapper and dependency'
+        Assert-CcodEqual 'original' $global:CcodUninstallRaceValue 'positive control observes original dependency bytes'
+        $probe.Attack=$true;$probe.Seam=0;$probe.Ack=0;$global:CcodUninstallRaceConsumed=0;$global:CcodUninstallRaceValue=$null
+        $failure=$null;try{Invoke-CcodInstalledLifecycleOperatorScenario -Context $context|Out-Null}catch{$failure=$_.FullyQualifiedErrorId}
+        Assert-CcodEqual 1 $probe.Seam 'replacement occurs at the real parent-to-consumer boundary'
+        Assert-CcodEqual 0 $global:CcodUninstallRaceConsumed 'substitution cannot execute even the inert wrapper'
+        Assert-CcodTrue ($failure-like'CCOD_INTEGRATION_*') 'changed dependency fails closed before operation success'
+        Assert-CcodEqual 0 $probe.Ack 'no success acknowledgement occurs after rejected consumption'
+    } finally {
+        foreach($pair in @(@('Get-CcodInstalledLifecycleFacts',$originalFacts),@('Read-CcodInstalledLifecycleActiveFact',$originalActive),@('Start-Process',$originalStart),@('Read-CcodInstalledLifecycleOperatorAck',$originalAck),@('Start-CcodInstalledLifecycleVerifiedUninstall',$originalLaunch))){if($null-ne$pair[1]){Set-Item ('Function:'+$pair[0]) $pair[1]}else{Remove-Item ('Function:'+$pair[0]) -ErrorAction SilentlyContinue}}
+        Remove-Variable CcodUninstallRaceConsumed,CcodUninstallRaceValue -Scope Global -ErrorAction SilentlyContinue
+        if(Test-Path $root){Remove-Item $root -Recurse -Force}
+    }
+}
+
+Invoke-CcodTest 'verified uninstall launcher uses normal-policy native process and exact completion framing' {
+    . $harnessPath -Library
+    $root=Join-Path $env:TEMP ('ccod child '+[char]0x6d4b+[char]0x8bd5+" O'Brien "+[guid]::NewGuid().ToString('N'))
+    $oldRoot=$script:CcodInstalledLifecycleRepositoryRoot
+    try {
+        foreach($relative in @('tests/installed','tools','src/persistence/modules')){[IO.Directory]::CreateDirectory((Join-Path $root $relative))|Out-Null}
+        Copy-Item (Join-Path $repositoryRoot 'tools/ReleaseAssetContract.psm1') (Join-Path $root 'tools/ReleaseAssetContract.psm1')
+        foreach($leaf in @('PersistenceIO.psm1','StateStore.psm1','TrustedLogonIdentity.psm1','LifecycleTransaction.psm1','KernelObjects.psm1','ProductRegistration.psm1')){[IO.File]::WriteAllText((Join-Path $root ('src/persistence/modules/'+$leaf)),'# inert source held by real launcher')}
+        $entry=Join-Path $root 'tests/installed/Invoke-InstalledLifecycleIntegration.ps1'
+        $child=@'
+param([switch]$VerifiedUninstallChild,[switch]$AllowMachineMutation,[switch]$AllowCodexRestart)
+$ErrorActionPreference='Stop'
+[Console]::OutputEncoding=[Text.UTF8Encoding]::new($false)
+$spec=[Console]::In.ReadToEnd()|ConvertFrom-Json
+if(-not$VerifiedUninstallChild){throw 'child mode missing'}
+if(-not[string]::IsNullOrEmpty($env:PSExecutionPolicyPreference)){throw 'inherited policy override'}
+$root=Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+$blocked=0
+foreach($path in @($PSCommandPath,(Join-Path $root 'src/persistence/modules/KernelObjects.psm1'))){try{[IO.File]::WriteAllText($path,'wrong')}catch [IO.IOException]{$blocked++}}
+try{[IO.Directory]::Move($root,$root+'-moved')}catch [IO.IOException]{$blocked++}
+if($blocked-ne3){throw 'parent source authority absent'}
+if($spec.text-cne('inert-'+[char]0x6d4b+[char]0x8bd5+" O'Brien")){throw 'stdin unicode drift'}
+if($spec.mode-ceq'Error'){[Console]::Error.WriteLine('inert child failure');exit 1}
+if($spec.mode-ceq'Empty'){exit 0}
+if($spec.mode-ceq'Polluted'){[Console]::Out.WriteLine('unexpected output')}
+[Console]::Out.WriteLine('CCOD_UNINSTALL_WRAPPER_COMPLETED')
+'@
+        [IO.File]::WriteAllText($entry,$child,[Text.UTF8Encoding]::new($true))
+        $script:CcodInstalledLifecycleRepositoryRoot=$root
+        $spec=[pscustomobject]@{mode='Normal';text=('inert-'+[char]0x6d4b+[char]0x8bd5+" O'Brien")}
+        $control=Start-CcodInstalledLifecycleVerifiedUninstall -Spec $spec
+        Assert-CcodEqual 0 $control.ExitCode 'normal-policy child consumes original source and exact Unicode input'
+        foreach($mode in @('Error','Empty','Polluted')){$spec.mode=$mode;Assert-CcodThrows {Start-CcodInstalledLifecycleVerifiedUninstall -Spec $spec|Out-Null} 'CCOD_INTEGRATION_INSTALLER_FAILED'}
+        $spec.mode='Normal';Assert-CcodEqual 0 (Start-CcodInstalledLifecycleVerifiedUninstall -Spec $spec).ExitCode 'failed child runs release all source holds for retry'
+        [IO.File]::WriteAllText($entry,'# writable after child completion')
+    } finally {$script:CcodInstalledLifecycleRepositoryRoot=$oldRoot;if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+}
+
+Invoke-CcodTest 'native uninstall child requires both machine and host restart authorizations before consumption' {
+    $tokens=$null;$errors=$null;$ast=[Management.Automation.Language.Parser]::ParseFile($harnessPath,[ref]$tokens,[ref]$errors)
+    Assert-CcodEqual 0 @($errors).Count 'real child entry parses'
+    $tail=@($ast.EndBlock.Statements|Where-Object {$_-is[Management.Automation.Language.IfStatementAst]-and$_.Extent.Text.StartsWith('if ($VerifiedUninstallChild)')})
+    Assert-CcodEqual 1 $tail.Count 'one actual native child dispatch is selected'
+    $root=Join-Path $env:TEMP ('ccod-child-consent-'+[guid]::NewGuid().ToString('N'))
+    [IO.Directory]::CreateDirectory($root)|Out-Null
+    try {
+        $probe=Join-Path $root 'child.ps1'
+        $stub=@'
+$ErrorActionPreference='Stop'
+$script:CcodInstalledLifecyclePersistenceIoModule=New-Module {function Test-CcodJsonHasNoDuplicateProperties {param($Json)return $true}}
+function Throw-CcodInstalledLifecycleError {param($Id,$Message,$Target)throw $Id}
+function Invoke-CcodInstalledLifecycleVerifiedUninstall {param($Spec)[IO.File]::WriteAllText((Join-Path $PSScriptRoot 'consumed.txt'),'inert consumer reached')}
+'@
+        [IO.File]::WriteAllText($probe,$ast.ParamBlock.Extent.Text+"`n"+$stub+"`n"+$tail[0].Extent.Text,[Text.UTF8Encoding]::new($true))
+        $spec=[pscustomobject]@{installRoot=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)) 'CodexControlOtherDevices'))}
+        foreach($arguments in @('',' -AllowMachineMutation',' -AllowCodexRestart',' -AllowMachineMutation -AllowCodexRestart')) {
+            $start=[Diagnostics.ProcessStartInfo]::new();$start.FileName=Join-Path $PSHOME 'powershell.exe'
+            $start.Arguments='-NoLogo -NoProfile -NonInteractive -File "'+$probe+'" -VerifiedUninstallChild'+$arguments
+            $start.UseShellExecute=$false;$start.CreateNoWindow=$true;$start.RedirectStandardInput=$true;$start.RedirectStandardOutput=$true;$start.RedirectStandardError=$true
+            [void]$start.EnvironmentVariables.Remove('PSExecutionPolicyPreference')
+            $child=[Diagnostics.Process]::Start($start)
+            try {
+                $output=$child.StandardOutput.ReadToEndAsync();$errorOutput=$child.StandardError.ReadToEndAsync()
+                $child.StandardInput.Write(($spec|ConvertTo-Json -Compress));$child.StandardInput.Close()
+                Assert-CcodTrue ($child.WaitForExit(15000)) 'inert child gate completes'
+                $authorized=$arguments-ceq' -AllowMachineMutation -AllowCodexRestart'
+                Assert-CcodEqual $authorized ([IO.File]::Exists((Join-Path $root 'consumed.txt'))) 'only both explicit consents allow reaching the consumer'
+                if($authorized){Assert-CcodEqual 0 $child.ExitCode 'authorized inert child reaches valid dispatch';Assert-CcodEqual ('CCOD_UNINSTALL_WRAPPER_COMPLETED'+[Environment]::NewLine) $output.Result 'authorized dispatch returns exact marker'}
+                else{Assert-CcodTrue ($child.ExitCode-ne0) 'missing consent cannot report success'}
+            } finally {if(-not$child.HasExited){$child.Kill();$child.WaitForExit()};$child.Dispose()}
+        }
+    } finally {if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+}
+
+Invoke-CcodTest 'native verified consumer retains dependencies until wrapper return and releases before process exit' {
+    . $harnessPath -Library
+    $root=Join-Path $env:TEMP ('ccod-consumer-native-'+[guid]::NewGuid().ToString('N'))
+    $child=$null
+    try {
+        $runtimeId='2.5.22-'+('a'*16)+'-'+('b'*32);$runtime=Join-Path $root ('runtime\'+$runtimeId)
+        [IO.Directory]::CreateDirectory((Join-Path $runtime 'src/persistence'))|Out-Null
+        $wrapper=Join-Path $runtime 'Uninstall-CodexControlOtherDevices.ps1';$dependency=Join-Path $runtime 'src/persistence/UninstallBootstrap.ps1'
+        $body=@'
+[CmdletBinding(SupportsShouldProcess=$true)]param()
+$blocked=0
+foreach($path in @($PSCommandPath,(Join-Path $PSScriptRoot 'src/persistence/UninstallBootstrap.ps1'))){try{[IO.File]::WriteAllText($path,'not allowed')}catch [IO.IOException]{$blocked++}}
+try{[IO.Directory]::Move($PSScriptRoot,$PSScriptRoot+'-moved')}catch [IO.IOException]{$blocked++}
+. (Join-Path $PSScriptRoot 'src/persistence/UninstallBootstrap.ps1')
+if($bootstrapProof-cne'original-bootstrap'){throw 'changed bootstrap consumed'}
+[Console]::Out.WriteLine('CCOD_HELD='+$blocked);[Console]::Out.Flush()
+if([Console]::In.ReadLine()-cne'continue'){throw 'handshake failed'}
+[pscustomobject][ordered]@{Outcome='InstalledFinalizationStarted';TransactionId='11111111-2222-3333-4444-555555555555';FinalizerProcessId=[int]$PID;KeptDeviceKeyStore=$true}
+'@
+        [IO.File]::WriteAllText($wrapper,$body,[Text.UTF8Encoding]::new($false));[IO.File]::WriteAllText($dependency,'$bootstrapProof=''original-bootstrap''')
+        $manifest=Join-Path $runtime 'manifest.json';[IO.File]::WriteAllText($manifest,'inert manifest bound by captured facts')
+        $records=@('Uninstall-CodexControlOtherDevices.ps1','src/persistence/UninstallBootstrap.ps1'|ForEach-Object {$path=Join-Path $runtime $_;[pscustomobject][ordered]@{path=$_;length=[long](Get-Item $path).Length;sha256=Get-CcodTestFileSha256 $path}})
+        $facts=New-CcodHarnessFacts -Version '2.5.22' -RuntimeId $runtimeId;$facts.runtimeManifestFiles=$records;$facts.runtimeManifestSha256=Get-CcodTestFileSha256 $manifest
+        $spec=[pscustomobject][ordered]@{schemaVersion=1;installRoot=$root;expectedVersion='2.5.22';runtimeId=$runtimeId;generation=1;manifestSha256=$facts.runtimeManifestSha256;runtimeFiles=$records;candidatePayloadFiles=$records}
+        [IO.File]::WriteAllText((Join-Path $root 'facts.json'),($facts|ConvertTo-Json -Depth 12),[Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText((Join-Path $root 'spec.json'),($spec|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+        $driver=Join-Path $root 'driver.ps1'
+        $text=@'
+param([string]$IntegrationPath)
+$ErrorActionPreference='Stop';$WarningPreference='SilentlyContinue'
+. $IntegrationPath -Library
+$script:FixtureFacts=[IO.File]::ReadAllText((Join-Path $PSScriptRoot 'facts.json'))|ConvertFrom-Json
+$spec=[IO.File]::ReadAllText((Join-Path $PSScriptRoot 'spec.json'))|ConvertFrom-Json
+function Get-CcodInstalledLifecycleFacts {param($InstallRoot,$ExpectedVersion,$ExpectedPayloadFiles)return $script:FixtureFacts}
+function Read-CcodInstalledLifecycleActiveFact {param($InstallRoot)[pscustomobject]@{activeRuntime=$script:FixtureFacts.activeRuntimeId;generation=1}}
+$result=Invoke-CcodInstalledLifecycleVerifiedUninstall -Spec $spec
+$runtime=Join-Path (Join-Path $spec.installRoot 'runtime') $spec.runtimeId
+[IO.Directory]::Move($runtime,$runtime+'-released')
+[IO.Directory]::Move($runtime+'-released',$runtime)
+if($result.Outcome-cne'InstalledFinalizationStarted'){throw 'wrong completion'}
+[Console]::Out.WriteLine('CCOD_RELEASED_BEFORE_EXIT')
+'@
+        [IO.File]::WriteAllText($driver,$text,[Text.UTF8Encoding]::new($false))
+        $start=[Diagnostics.ProcessStartInfo]::new();$start.FileName=Join-Path $PSHOME 'powershell.exe';$start.Arguments='-NoLogo -NoProfile -NonInteractive -File "'+$driver+'" -IntegrationPath "'+$harnessPath+'"'
+        $start.UseShellExecute=$false;$start.CreateNoWindow=$true;$start.RedirectStandardInput=$true;$start.RedirectStandardOutput=$true;$start.RedirectStandardError=$true
+        [void]$start.EnvironmentVariables.Remove('PSExecutionPolicyPreference')
+        $child=[Diagnostics.Process]::Start($start);$errors=$child.StandardError.ReadToEndAsync();$line=$child.StandardOutput.ReadLineAsync()
+        Assert-CcodTrue ($line.Wait(20000)) 'real consumer reaches the explicit held checkpoint'
+        Assert-CcodEqual 'CCOD_HELD=3' $line.Result 'actual child cannot rewrite wrapper dependency or ancestor while executing'
+        $blocked=$false;try{[IO.File]::WriteAllText($dependency,'outside writer')}catch [IO.IOException]{$blocked=$true};Assert-CcodTrue $blocked 'parent also cannot alter held dependency'
+        $child.StandardInput.WriteLine('continue');$child.StandardInput.Close();$rest=$child.StandardOutput.ReadToEndAsync()
+        Assert-CcodTrue ($child.WaitForExit(20000)) 'actual consumer exits after dependency handoff'
+        Assert-CcodEqual 0 $child.ExitCode ('real consumer failure: '+$errors.Result)
+        Assert-CcodEqual ('CCOD_RELEASED_BEFORE_EXIT'+[Environment]::NewLine) $rest.Result 'directory authority is released before wrapper process exit'
+        Assert-CcodEqual '' $errors.Result 'child has no hidden errors'
+        [IO.Directory]::Move($runtime,$runtime+'-reclaimed')
+    } finally {if($null-ne$child){if(-not$child.HasExited){$child.StandardInput.Close();if(-not$child.WaitForExit(15000)){$child.Kill();$child.WaitForExit()}};$child.Dispose()};if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+}
+
+Invoke-CcodTest 'staged uninstall dependency cannot change at its real module import boundary' {
+    $root=Join-Path $env:TEMP ('ccod-stage-load-'+[guid]::NewGuid().ToString('N'))
+    $module=$null;$loaded=$null
+    try {
+        $payload=Join-Path $root 'payload';$modules=Join-Path $payload 'src/persistence/modules'
+        [IO.Directory]::CreateDirectory($modules)|Out-Null
+        $target=Join-Path $modules 'InstallLifecycle.psm1'
+        [IO.File]::WriteAllText($target,'function Invoke-CcodUninstallCleanup { param($InstallRoot,$Transaction,$WriteTransaction,$StopAfterTaskRemoval) $Transaction }; Export-ModuleMember -Function Invoke-CcodUninstallCleanup')
+        $records=@([pscustomobject][ordered]@{path='src/persistence/modules/InstallLifecycle.psm1';length=[long](Get-Item $target).Length;sha256=Get-CcodTestFileSha256 $target})
+        $transaction=[pscustomobject]@{installedBinding=[pscustomobject]@{payloadRecords=$records}}
+        $bootstrap=Join-Path $repositoryRoot 'src/persistence/UninstallBootstrap.ps1'
+        $module=New-Module -ArgumentList $bootstrap -ScriptBlock {param($Source). $Source}
+        $probe=[pscustomobject]@{Target=$target;Attack=$false;Reached=0;Denied=0;Loaded=$null}
+        &$module {
+            param($State)
+            $script:BoundaryProbe=$State
+            function script:Import-Module {
+                [CmdletBinding()]param([string]$Name,[switch]$Force,[switch]$PassThru,[switch]$DisableNameChecking)
+                $state=$script:BoundaryProbe
+                if($Name-ceq$state.Target){$state.Reached++;if($state.Attack){try{[IO.File]::AppendAllText($Name,"`nthrow 'substituted module initializer'")}catch [IO.IOException]{$state.Denied++}}}
+                $state.Loaded=Microsoft.PowerShell.Core\Import-Module -Name $Name -Force -PassThru -DisableNameChecking
+                if($PassThru){return $state.Loaded}
+            }
+        } $probe
+        $run=&$module {(Get-CcodUninstallBootstrapAdapters).RunCleanup}
+        $control=&$module {param($Run,$Root,$Transaction)&$Run $Root $Root $Root $Transaction {param($Value)} 'PrepareInstalled'} $run $root $transaction
+        Assert-CcodTrue ($null-ne$control) 'valid staged module reaches its actual cleanup function'
+        $probe.Attack=$true;$probe.Reached=0;$failure=$null
+        try{&$module {param($Run,$Root,$Transaction)&$Run $Root $Root $Root $Transaction {param($Value)} 'PrepareInstalled'} $run $root $transaction|Out-Null}catch{$failure=$_}
+        Assert-CcodEqual 1 $probe.Reached 'attack reaches the real import seam'
+        Assert-CcodEqual 1 $probe.Denied 'held staged dependency refuses modification through actual loader'
+        Assert-CcodEqual $null $failure 'valid original cleanup is not poisoned by a denied writer'
+        [IO.File]::AppendAllText($target,"`n# writable after consumption")
+    } finally {if($null-ne$probe-and$null-ne$probe.Loaded){Remove-Module $probe.Loaded -Force -ErrorAction SilentlyContinue};if($null-ne$module){Remove-Module $module -Force -ErrorAction SilentlyContinue};if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+}
+
+Invoke-CcodTest 'public installed finalizer retains staged bytes through native child acquisition' {
+    $root=Join-Path $env:TEMP ('ccod-finalizer-launch-'+[guid]::NewGuid().ToString('N'))
+    $originalStart=${function:Start-Process};$process=$null
+    $tokens=$null;$errors=$null;$ast=[Management.Automation.Language.Parser]::ParseFile((Join-Path $repositoryRoot 'Uninstall-CodexControlOtherDevices.ps1'),[ref]$tokens,[ref]$errors)
+    Assert-CcodEqual 0 @($errors).Count 'public wrapper parses'
+    foreach($definition in @($ast.EndBlock.Statements|Where-Object {$_-is[Management.Automation.Language.FunctionDefinitionAst]})){. ([scriptblock]::Create($definition.Extent.Text))}
+    $launch=@($ast.FindAll({param($Node)$Node-is[Management.Automation.Language.TryStatementAst]-and$Node.Body.Extent.Text.StartsWith('{$process=')},$true))
+    Assert-CcodEqual 1 $launch.Count 'actual installed finalizer launch is unique'
+    try {
+        $transactionDirectory=$root;$payloadRoot=Join-Path $root 'payload';$bootstrapPath=Join-Path $repositoryRoot 'src/persistence/UninstallBootstrap.ps1'
+        [IO.Directory]::CreateDirectory((Join-Path $payloadRoot 'src/persistence'))|Out-Null
+        $finalizer=Join-Path $payloadRoot 'src/persistence/InstalledUninstallFinalizer.ps1'
+        $child=@'
+param([string]$AuthorityReadyHandle)
+$ErrorActionPreference='Stop'
+. '__BOOTSTRAP__'
+$records=[IO.File]::ReadAllText('__RECORDS__')|ConvertFrom-Json
+$lease=Open-CcodUninstallBootstrapPayloadAuthority -PayloadRoot '__PAYLOAD__' -Records @($records)
+try {
+ if(-not[string]::IsNullOrEmpty($AuthorityReadyHandle)){
+  $pipe=[IO.Pipes.AnonymousPipeClientStream]::new([IO.Pipes.PipeDirection]::Out,$AuthorityReadyHandle)
+  try{$bytes=[BitConverter]::GetBytes([int]$PID);$pipe.Write($bytes,0,$bytes.Length);$pipe.Flush()}finally{$pipe.Dispose()}
+ }
+}finally{$lease.Dispose()}
+'@
+        $recordsPath=Join-Path $root 'records.json'
+        $child=$child.Replace('__BOOTSTRAP__',$bootstrapPath.Replace("'","''")).Replace('__RECORDS__',$recordsPath.Replace("'","''")).Replace('__PAYLOAD__',$payloadRoot.Replace("'","''"))
+        [IO.File]::WriteAllText($finalizer,$child,[Text.UTF8Encoding]::new($false))
+        $records=@([pscustomobject][ordered]@{path='src/persistence/InstalledUninstallFinalizer.ps1';length=[long](Get-Item $finalizer).Length;sha256=Get-CcodTestFileSha256 $finalizer})
+        [IO.File]::WriteAllText($recordsPath,(ConvertTo-Json -InputObject $records -Depth 4),[Text.UTF8Encoding]::new($false))
+        $prepared=[pscustomobject]@{installedBinding=[pscustomobject]@{payloadRecords=$records}}
+        $powershellPath=Join-Path $PSHOME 'powershell.exe';$arguments='-NoLogo -NoProfile -NonInteractive -File "'+$finalizer+'"'
+        $probe=[pscustomobject]@{Attack=$false;Reached=0;Denied=0}
+        function Start-Process {
+            [CmdletBinding()]param($FilePath,$ArgumentList,$WindowStyle,$RedirectStandardOutput,$RedirectStandardError,[switch]$PassThru)
+            $probe.Reached++
+            if($probe.Attack){try{[IO.File]::AppendAllText($finalizer,"`nthrow 'substituted finalizer initializer'")}catch [IO.IOException]{$probe.Denied++}}
+            $child=Microsoft.PowerShell.Management\Start-Process @PSBoundParameters
+            [void]$child.Handle
+            return $child
+        }
+        foreach($attack in @($false,$true)) {
+            $probe.Attack=$attack;$probe.Reached=0;$probe.Denied=0;$failure=$null
+            try{. ([scriptblock]::Create($launch[0].Extent.Text))}catch{$failure=$_}
+            Assert-CcodEqual 1 $probe.Reached 'real parent launch boundary is exercised'
+            if($attack){Assert-CcodEqual 1 $probe.Denied 'staged script replacement is denied before the native child reads it'}
+            Assert-CcodEqual $null $failure 'original finalizer acquisition is not poisoned by a denied replacement'
+            Assert-CcodTrue ($process.WaitForExit(15000)) 'owned inert finalizer finishes'
+            Assert-CcodEqual 0 $process.ExitCode ('inert child failed: '+[IO.File]::ReadAllText((Join-Path $root 'installed-finalizer.stderr.log')))
+            $process.Dispose();$process=$null
+        }
+        [IO.File]::AppendAllText($finalizer,"`n# released after native acquisition")
+    } finally {if($null-ne$process){if(-not$process.HasExited){$process.Kill();$process.WaitForExit()};$process.Dispose()};if($null-ne$originalStart){Set-Item Function:Start-Process $originalStart}else{Remove-Item Function:Start-Process -ErrorAction SilentlyContinue};if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+}
+
+Invoke-CcodTest 'default finalizer pins its staged closure before validating the envelope' {
+    $root=Join-Path $env:TEMP ('ccod-finalizer-consumer-'+[guid]::NewGuid().ToString('N'))
+    $previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process');$module=$null
+    try {
+        [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$root,'Process')
+        $id='11111111-2222-3333-4444-555555555555';$payload=Join-Path $root ('CodexRemote-fix-uninstall/'+$id+'/payload')
+        $source=Join-Path $repositoryRoot 'src/persistence/InstalledUninstallFinalizer.ps1'
+        $tokens=$null;$errors=$null;$ast=[Management.Automation.Language.Parser]::ParseFile($source,[ref]$tokens,[ref]$errors)
+        Assert-CcodEqual 0 @($errors).Count 'actual finalizer parses'
+        $entries=@($ast.FindAll({param($Node)$Node-is[Management.Automation.Language.AssignmentStatementAst]-and$Node.Left.Extent.Text-ceq'$script:CcodInstalledFinalizerPayloadEntries'},$true))
+        Assert-CcodEqual 1 $entries.Count 'one complete production payload allowlist'
+        $leaves=@($entries[0].Right.FindAll({param($Node)$Node-is[Management.Automation.Language.StringConstantExpressionAst]},$true)|ForEach-Object Value)
+        foreach($relative in $leaves){$path=Join-Path $payload $relative;[IO.Directory]::CreateDirectory((Split-Path $path -Parent))|Out-Null;[IO.File]::WriteAllText($path,'# inert staged payload')}
+        $entry=Join-Path $payload 'src/persistence/InstalledUninstallFinalizer.ps1';Copy-Item $source $entry -Force
+        $module=New-Module -ArgumentList $entry -ScriptBlock {param($Path). $Path}
+        $probe=[pscustomobject]@{Target=(Join-Path $payload 'src/persistence/UninstallBootstrap.ps1');Root=$payload;Reached=0;Denied=0}
+        &$module {
+            param($Probe)
+            $script:AuthorityProbe=$Probe
+            function script:Read-CcodInstalledFinalizerEnvelope {
+                param($TransactionRoot,$TransactionId,$PayloadRoot,$RuntimeRoot,$InstallRoot)
+                $script:AuthorityProbe.Reached++
+                try{[IO.File]::AppendAllText($script:AuthorityProbe.Target,'# must not change')}catch [IO.IOException]{$script:AuthorityProbe.Denied++}
+                try{[IO.Directory]::Move($script:AuthorityProbe.Root,$script:AuthorityProbe.Root+'-moved');[IO.Directory]::Move($script:AuthorityProbe.Root+'-moved',$script:AuthorityProbe.Root)}catch [IO.IOException]{$script:AuthorityProbe.Denied++}
+                return [pscustomobject]@{validated=$true}
+            }
+            function script:Get-CcodInstalledFinalizerAdapters {param($Adapters,$TransactionRoot,$PayloadRoot,$RuntimeRoot,$InstallRoot)throw 'INERT_STOP_BEFORE_ANY_MACHINE_OPERATION'}
+        } $probe
+        $install=Join-Path $root 'CodexControlOtherDevices';$runtime=Join-Path $install ('runtime/2.5.22-'+('a'*16)+'-'+('b'*32))
+        $failure=$null;try{&$module {param($Id,$Runtime,$Install)Invoke-CcodInstalledUninstallFinalizer -TransactionId $Id -RuntimeRoot $Runtime -InstallRoot $Install -WrapperIdentity $null -Resume} $id $runtime $install|Out-Null}catch{$failure=$_}
+        Assert-CcodEqual 1 $probe.Reached 'actual default path reaches envelope validation'
+        Assert-CcodEqual 2 $probe.Denied 'complete staged closure and ancestry remain immutable before envelope checks'
+        Assert-CcodTrue ($failure.Exception.Message-like'*INERT_STOP_BEFORE_ANY_MACHINE_OPERATION*') 'test stops before any machine adapter can operate'
+        [IO.File]::WriteAllText($probe.Target,'released after rejected operation')
+        [IO.Directory]::Move($payload,$payload+'-released')
+    } finally {if($null-ne$module){Remove-Module $module -Force -ErrorAction SilentlyContinue};[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+}
+
+Invoke-CcodTest 'default finalizer never treats an unavailable wrapper observation as process exit' {
+    $source=Join-Path $repositoryRoot 'src/persistence/InstalledUninstallFinalizer.ps1'
+    $module=New-Module -ArgumentList $source -ScriptBlock {param($Path). $Path}
+    $current=[Diagnostics.Process]::GetCurrentProcess();$windowsIdentity=[Security.Principal.WindowsIdentity]::GetCurrent();$child=$null
+    try {
+        $identity=[pscustomobject]@{pid=[int]$current.Id;creationTimeUtc=$current.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture);sessionId=[int]$current.SessionId;userSid=[string]$windowsIdentity.User.Value}
+        $control=&$module {
+            param($Identity)
+            $adapters=Get-CcodInstalledFinalizerAdapters -TransactionRoot $env:TEMP -PayloadRoot $env:TEMP -RuntimeRoot $env:TEMP -InstallRoot $env:TEMP
+            &$adapters.WaitWrapperExit $Identity 0
+        } $identity
+        Assert-CcodTrue $control.verifiedAtStart 'real current wrapper identity is observable'
+        Assert-CcodTrue (-not $control.exited) 'a live wrapper does not authorize deletion'
+        $start=[Diagnostics.ProcessStartInfo]::new()
+        $start.FileName=Join-Path $PSHOME 'powershell.exe';$start.Arguments='-NoLogo -NoProfile -NonInteractive -Command "Start-Sleep -Milliseconds 800"'
+        $start.UseShellExecute=$false;$start.CreateNoWindow=$true;$start.EnvironmentVariables.Remove('PSExecutionPolicyPreference')
+        $child=[Diagnostics.Process]::Start($start)
+        $exitedIdentity=[pscustomobject]@{pid=[int]$child.Id;creationTimeUtc=$child.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture);sessionId=[int]$child.SessionId;userSid=$identity.userSid}
+        Assert-CcodTrue ($child.WaitForExit(10000)) 'owned inert wrapper actually exits'
+        Assert-CcodEqual 0 $child.ExitCode 'owned inert wrapper exits successfully'
+        $child.Dispose();$child=$null
+        $exited=&$module {
+            param($Identity)
+            $adapters=Get-CcodInstalledFinalizerAdapters -TransactionRoot $env:TEMP -PayloadRoot $env:TEMP -RuntimeRoot $env:TEMP -InstallRoot $env:TEMP
+            &$adapters.WaitWrapperExit $Identity 1000
+        } $exitedIdentity
+        Assert-CcodTrue ($exited.verifiedAtStart-and$exited.exited) 'exact native process-not-found proves the already exited wrapper is absent'
+        foreach($failurePoint in @('Initial','Polling')) {
+            foreach($category in @('PermissionDenied','ReadError','ObjectNotFound','Empty')) {
+                $probe=[pscustomobject]@{Calls=0;FailurePoint=$failurePoint;Category=$category}
+                &$module {
+                    param($Probe)
+                    $script:WrapperObservationProbe=$Probe
+                    function script:Get-Process {
+                        [CmdletBinding()]param([int]$Id)
+                        $script:WrapperObservationProbe.Calls++
+                        if($script:WrapperObservationProbe.FailurePoint-ceq'Polling'-and$script:WrapperObservationProbe.Calls-eq1){return Microsoft.PowerShell.Management\Get-Process -Id $Id -ErrorAction Stop}
+                        if($script:WrapperObservationProbe.Category-ceq'Empty'){return}
+                        Write-Error -Message 'INERT_WRAPPER_OBSERVATION_FAILURE' -Category $script:WrapperObservationProbe.Category -ErrorId 'CcodWrapperObservationFailure'
+                    }
+                } $probe
+                $result=$null;$failure=$null
+                try {
+                    $result=&$module {
+                        param($Identity)
+                        $adapters=Get-CcodInstalledFinalizerAdapters -TransactionRoot $env:TEMP -PayloadRoot $env:TEMP -RuntimeRoot $env:TEMP -InstallRoot $env:TEMP
+                        &$adapters.WaitWrapperExit $Identity 1000
+                    } $identity
+                } catch {$failure=$_}
+                Assert-CcodTrue ($probe.Calls-gt0) "$failurePoint/$category reaches the real process observation seam"
+                Assert-CcodTrue ($null-ne$failure) "$failurePoint/$category must fail closed rather than authorize deletion"
+                Assert-CcodEqual $null $result "$failurePoint/$category returns no successful exit proof"
+            }
+        }
+    } finally {if($null-ne$child){if(-not$child.HasExited){$child.Kill();$child.WaitForExit()};$child.Dispose()};$current.Dispose();$windowsIdentity.Dispose();Remove-Module $module -Force -ErrorAction SilentlyContinue}
+}
+
+Invoke-CcodTest 'uninstall and finalizer independently embed the same native payload lease' {
+    $definitions=@()
+    foreach($relative in @('src/persistence/UninstallBootstrap.ps1','src/persistence/InstalledUninstallFinalizer.ps1')) {
+        $tokens=$null;$errors=$null;$ast=[Management.Automation.Language.Parser]::ParseFile((Join-Path $repositoryRoot $relative),[ref]$tokens,[ref]$errors)
+        Assert-CcodEqual 0 @($errors).Count 'native lease entry parses'
+        $function=@($ast.EndBlock.Statements|Where-Object {$_-is[Management.Automation.Language.FunctionDefinitionAst]-and$_.Name-ceq'Initialize-CcodUninstallPayloadAuthority'})
+        Assert-CcodEqual 1 $function.Count 'each independent entry has its own bootstrap before any unheld import'
+        $definitions+=($function[0].Extent.Text-replace"`r`n","`n")
+    }
+    Assert-CcodEqual $definitions[0] $definitions[1] 'the shared native type cannot drift depending on who initializes first'
+}
+
+Invoke-CcodTest 'actual product module naming warning does not pollute the verified uninstall result' {
+    . $harnessPath -Library
+    $originalImport=${function:Import-Module};$probe=[pscustomobject]@{Module=$null;Calls=0}
+    try {
+        function Import-Module {
+            [CmdletBinding()]param([Parameter(Position=0)][string]$Name,[switch]$PassThru,[switch]$DisableNameChecking)
+            $probe.Calls++
+            $probe.Module=Microsoft.PowerShell.Core\Import-Module -Name $Name -Force -PassThru -DisableNameChecking:$DisableNameChecking
+            &$probe.Module {function script:Read-CcodCurrentProductState {param($ExpectedRuntimeId)[pscustomobject]@{valid=$true;runtimeId=$ExpectedRuntimeId}}}
+            if($PassThru){return $probe.Module}
+        }
+        $values=@(& {Get-CcodInstalledLifecycleProductState -RuntimeId ('2.5.22-'+('a'*16)+'-'+('b'*32))} 3>&1)
+        Assert-CcodEqual 1 $probe.Calls 'actual production import is reached once'
+        Assert-CcodEqual 0 @($values|Where-Object {$_-is[Management.Automation.WarningRecord]}).Count 'actual ProductRegistration import must not add name-check prose to native stdout'
+        Assert-CcodEqual 1 $values.Count 'the product observation remains exactly one object'
+        Assert-CcodTrue $values[0].valid 'positive observation is consumed without registry mutation'
+    } finally {if($null-ne$probe.Module){Remove-Module $probe.Module -Force -ErrorAction SilentlyContinue};if($null-ne$originalImport){Set-Item Function:Import-Module $originalImport}else{Remove-Item Function:Import-Module -ErrorAction SilentlyContinue}}
+}
+
+Invoke-CcodTest 'sealed uninstall resolver requires active manifest file identity' {
+    . $harnessPath -Library
+    $root=Join-Path $env:TEMP ('ccod-uninstall-resolver-'+[guid]::NewGuid().ToString('N'))
+    $originalFacts=${function:Get-CcodInstalledLifecycleFacts};$originalActive=${function:Read-CcodInstalledLifecycleActiveFact}
+    try {
+        $runtimeId='2.5.22-'+('a'*16)+'-'+('b'*32);$runtime=Join-Path $root ('runtime\'+$runtimeId)
+        [IO.Directory]::CreateDirectory($runtime)|Out-Null
+        $path=Join-Path $runtime 'Uninstall-CodexControlOtherDevices.ps1';[IO.File]::WriteAllText($path,'# inert test uninstaller')
+        $records=@([pscustomobject][ordered]@{path='Uninstall-CodexControlOtherDevices.ps1';length=[long](Get-Item $path).Length;sha256=Get-CcodTestFileSha256 $path})
+        $facts=New-CcodHarnessFacts -Version '2.5.22' -RuntimeId $runtimeId;$facts.runtimeManifestFiles=$records
+        $state=[pscustomobject]@{Facts=$facts;Reads=0;Drift=$false}
+        function Get-CcodInstalledLifecycleFacts {param($InstallRoot,$ExpectedVersion,$ExpectedPayloadFiles)$state.Reads++;return $state.Facts}
+        function Read-CcodInstalledLifecycleActiveFact {param($InstallRoot)[pscustomobject]@{activeRuntime=$(if($state.Drift){'wrong'}else{$state.Facts.activeRuntimeId});generation=[uint64]1}}
+        $result=Get-CcodInstalledLifecycleUninstallCommand -InstallRoot $root -ExpectedVersion '2.5.22' -ExpectedPayloadFiles $records
+        Assert-CcodEqual $root $result.Spec.installRoot 'typed specification binds the current root'
+        Assert-CcodEqual $runtimeId $result.Spec.runtimeId 'typed specification binds the selected runtime'
+        Assert-CcodEqual $records[0].sha256 $result.Spec.runtimeFiles[0].sha256 'typed specification retains the validated script hash'
+        Assert-CcodEqual $null $result.PSObject.Properties['Arguments'] 'resolver does not expose a mutable executable command'
+        [IO.File]::WriteAllText($path,'# changed uninstaller')
+        Assert-CcodThrows {Get-CcodInstalledLifecycleUninstallCommand -InstallRoot $root -ExpectedVersion '2.5.22' -ExpectedPayloadFiles $records|Out-Null} 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+        [IO.File]::WriteAllText($path,'# inert test uninstaller');$state.Drift=$true
+        Assert-CcodThrows {Get-CcodInstalledLifecycleUninstallCommand -InstallRoot $root -ExpectedVersion '2.5.22' -ExpectedPayloadFiles $records|Out-Null} 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+        $state.Drift=$false;$state.Facts.protectionReady=$false
+        Assert-CcodThrows {Get-CcodInstalledLifecycleUninstallCommand -InstallRoot $root -ExpectedVersion '2.5.22' -ExpectedPayloadFiles $records|Out-Null} 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+    } finally {
+        Set-Item Function:Get-CcodInstalledLifecycleFacts $originalFacts;Set-Item Function:Read-CcodInstalledLifecycleActiveFact $originalActive
+        if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force}
+    }
+}
+
+Invoke-CcodTest 'sealed payload comparison validates generated shortcuts rather than ignoring extras' {
+    . $harnessPath -Library
+    $root=Join-Path $env:TEMP ('ccod-product-proof-'+[guid]::NewGuid().ToString('N'))
+    $original=${function:Get-CcodInstalledLifecycleProductState}
+    try {
+        $payload=@([pscustomobject][ordered]@{path='package.json';length=[long]25;sha256=('a'*64)})
+        $records=@($payload)+@([pscustomobject][ordered]@{path='registration/Desktop.CodexRemote-fix.lnk';length=[long]40;sha256=('b'*64)},[pscustomobject][ordered]@{path='registration/StartMenu.CodexRemote-fix.lnk';length=[long]41;sha256=('c'*64)})
+        $runtimeId='2.5.22-'+('d'*16)+'-'+('e'*32)
+        $proof=[pscustomobject][ordered]@{phase='Ready';installRoot=$root;runtimeId=$runtimeId;runtimeGeneration=[uint64]8;packageSha256=('f'*64);manifestSha256=('9'*64);startMenuSha256=('c'*64);desktopSha256=('b'*64);targetPath=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'schtasks.exe'));arguments='/Run /TN "Codex Control Other Devices Supervisor"'}
+        $state=[pscustomobject]@{valid=$true;readyEvidence=$proof;entries=@([pscustomobject]@{kind='StartMenu';path='test';sha256=('c'*64)},[pscustomobject]@{kind='Desktop';path='test';sha256=('b'*64)},[pscustomobject]@{kind='Registry';path='test'})}
+        function Get-CcodInstalledLifecycleProductState {param($RuntimeId)return $state}
+        Assert-CcodTrue (Test-CcodInstalledLifecycleCandidateFileSet -Actual $records -Expected $payload -InstallRoot $root -RuntimeId $runtimeId -Generation 8 -ManifestSha256 ('9'*64)) 'candidate comparison accepts shipped payload plus independently bound generated shortcuts'
+        $state.readyEvidence.desktopSha256='f'*64
+        Assert-CcodEqual $false (Test-CcodInstalledLifecycleCandidateFileSet -Actual $records -Expected $payload -InstallRoot $root -RuntimeId $runtimeId -Generation 8 -ManifestSha256 ('9'*64)) 'mismatched registered shortcut hash is rejected'
+        $state.readyEvidence.desktopSha256='b'*64
+        $records+=@([pscustomobject][ordered]@{path='unexpected.txt';length=[long]1;sha256=('1'*64)})
+        Assert-CcodEqual $false (Test-CcodInstalledLifecycleCandidateFileSet -Actual $records -Expected $payload -InstallRoot $root -RuntimeId $runtimeId -Generation 8 -ManifestSha256 ('9'*64)) 'unknown extra payload file is never ignored'
+    } finally {if($null-ne$original){Set-Item Function:Get-CcodInstalledLifecycleProductState $original}else{Remove-Item Function:Get-CcodInstalledLifecycleProductState -ErrorAction SilentlyContinue}}
+}
+
+Invoke-CcodTest 'installed runtime validator agrees with the actual manifest producer digest' {
+    . $harnessPath -Library
+    $module=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/RuntimeManifest.psm1') -PassThru -Force
+    $root=Join-Path $env:TEMP ('ccod-producer-digest-'+[guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root)|Out-Null
+        [IO.File]::WriteAllText((Join-Path $root 'payload.txt'),'actual producer fixture')
+        $manifest=&$module {param($Root)New-CcodRuntimeManifest -RuntimeDirectory $Root -ProjectVersion '2.5.22'} $root
+        $actual=Assert-CcodInstalledLifecycleRuntimeManifest -Manifest $manifest -ExpectedVersion '2.5.22' -ExpectedRuntimeId $manifest.runtimeId -RuntimeRoot $root
+        Assert-CcodEqual $manifest.runtimeId $actual.runtimeId 'real producer and installed validator agree on nonempty records'
+        $legacyCanonical=@($manifest.files|ForEach-Object {'{0}`t{1}`t{2}' -f [string]$_.path,[int64]$_.length,[string]$_.sha256})-join "`n"
+        $legacySha=[Security.Cryptography.SHA256]::Create();try{$legacyDigest=[BitConverter]::ToString($legacySha.ComputeHash([Text.Encoding]::UTF8.GetBytes($legacyCanonical))).Replace('-','').ToLowerInvariant()}finally{$legacySha.Dispose()}
+        $legacy=[pscustomobject][ordered]@{schemaVersion=1;projectVersion='2.5.21';runtimeId=('2.5.21-'+$legacyDigest.Substring(0,16));files=@($manifest.files)}
+        Assert-CcodEqual $legacy.runtimeId (Assert-CcodInstalledLifecycleRuntimeManifest -Manifest $legacy -ExpectedVersion '2.5.21' -ExpectedRuntimeId $legacy.runtimeId -RuntimeRoot $root).runtimeId 'historical digest grammar stays identical without the nonce'
+        [IO.File]::WriteAllText((Join-Path $root 'payload.txt'),'changed producer fixture')
+        Assert-CcodThrows {Assert-CcodInstalledLifecycleRuntimeManifest -Manifest $manifest -ExpectedVersion '2.5.22' -ExpectedRuntimeId $manifest.runtimeId -RuntimeRoot $root|Out-Null} 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+    } finally {if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force}}
+}
+
+Invoke-CcodTest 'installed runtime ordering matches mixed-case producer paths across cultures' {
+    . $harnessPath -Library
+    $module=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/RuntimeManifest.psm1') -PassThru -Force
+    $root=Join-Path $env:TEMP ('ccod-producer-order-'+[guid]::NewGuid().ToString('N'))
+    $originalCulture=[Threading.Thread]::CurrentThread.CurrentCulture
+    try {
+        [IO.Directory]::CreateDirectory((Join-Path $root 'bin'))|Out-Null
+        foreach($relative in @('Uninstall-CodexControlOtherDevices.ps1','package.json','bin/CodexRemote.txt')){
+            [IO.File]::WriteAllText((Join-Path $root $relative),'inert producer ordering fixture')
+        }
+        foreach($culture in @('en-US','zh-CN','tr-TR')){
+            [Threading.Thread]::CurrentThread.CurrentCulture=[Globalization.CultureInfo]::GetCultureInfo($culture)
+            $manifest=&$module {param($Root)New-CcodRuntimeManifest -RuntimeDirectory $Root -ProjectVersion '2.5.22'} $root
+            Assert-CcodEqual 'Uninstall-CodexControlOtherDevices.ps1|bin/CodexRemote.txt|package.json' (@($manifest.files|ForEach-Object{$_.path})-join'|') 'producer uses ordinal path order'
+            $actual=Assert-CcodInstalledLifecycleRuntimeManifest -Manifest $manifest -ExpectedVersion '2.5.22' -ExpectedRuntimeId $manifest.runtimeId -RuntimeRoot $root
+            Assert-CcodEqual $manifest.runtimeId $actual.runtimeId ('current mixed-case producer accepts under '+$culture)
+            $legacyCanonical=@($manifest.files|ForEach-Object {'{0}`t{1}`t{2}' -f [string]$_.path,[int64]$_.length,[string]$_.sha256})-join "`n"
+            $legacySha=[Security.Cryptography.SHA256]::Create();try{$legacyDigest=[BitConverter]::ToString($legacySha.ComputeHash([Text.Encoding]::UTF8.GetBytes($legacyCanonical))).Replace('-','').ToLowerInvariant()}finally{$legacySha.Dispose()}
+            $legacy=[pscustomobject][ordered]@{schemaVersion=1;projectVersion='2.5.21';runtimeId=('2.5.21-'+$legacyDigest.Substring(0,16));files=@($manifest.files)}
+            Assert-CcodEqual $legacy.runtimeId (Assert-CcodInstalledLifecycleRuntimeManifest -Manifest $legacy -ExpectedVersion '2.5.21' -ExpectedRuntimeId $legacy.runtimeId -RuntimeRoot $root).runtimeId ('legacy mixed-case producer accepts under '+$culture)
+        }
+        $reordered=$manifest.PSObject.Copy();$reordered.files=@($manifest.files[2],$manifest.files[1],$manifest.files[0])
+        Assert-CcodThrows {Assert-CcodInstalledLifecycleRuntimeManifest -Manifest $reordered -ExpectedVersion '2.5.22' -ExpectedRuntimeId $manifest.runtimeId -RuntimeRoot $root|Out-Null} 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+        [IO.File]::WriteAllText((Join-Path $root 'extra.txt'),'undeclared')
+        Assert-CcodThrows {Assert-CcodInstalledLifecycleRuntimeManifest -Manifest $manifest -ExpectedVersion '2.5.22' -ExpectedRuntimeId $manifest.runtimeId -RuntimeRoot $root|Out-Null} 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+    } finally {
+        [Threading.Thread]::CurrentThread.CurrentCulture=$originalCulture
+        if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force}
+    }
+}
+
+Invoke-CcodTest 'sealed runtime metadata does not depend on the obsolete Inno directory' {
+    . $harnessPath -Library
+    $root=Join-Path $env:TEMP ('ccod-modern-app-'+[guid]::NewGuid().ToString('N'))
+    $originalManifest=${function:Assert-CcodInstalledLifecycleRuntimeManifest}
+    $originalOptional=${function:Get-CcodInstalledLifecycleOptionalDirectoryState};$previousHome=$env:CODEX_HOME
+    try {
+        [IO.Directory]::CreateDirectory($root)|Out-Null;$env:CODEX_HOME=Join-Path $root 'keys'
+        $runtimeId='2.5.22-e3b0c44298fc1c14-'+('a'*32)
+        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId $runtimeId -ActiveGeneration 8 -StatusRuntimeId $runtimeId -StatusCodexPid 702 -StatusCodexCreationTimeUtc '2026-08-24T00:00:02.0000000Z' -ReceiptPhase Completed
+        $runtime=Join-Path $root ('runtime\'+$runtimeId)
+        [IO.File]::WriteAllText((Join-Path $runtime 'package.json'),'{"version":"2.5.22"}')
+        $manifest=[IO.File]::ReadAllText((Join-Path $runtime 'manifest.json'))|ConvertFrom-Json;$manifest.projectVersion='2.5.22'
+        $manifest.files=@([pscustomobject][ordered]@{path='package.json';length=[long](Get-Item (Join-Path $runtime 'package.json')).Length;sha256=Get-CcodTestFileSha256 (Join-Path $runtime 'package.json')})
+        Write-CcodHarnessJson (Join-Path $runtime 'manifest.json') $manifest
+        Set-CcodHarnessProcessFixture -ChatGPT @()
+        function Get-CcodInstalledLifecycleOptionalDirectoryState {param($Path,$GetItem)if($Path.EndsWith('CodexControlOtherDevices-installer')){return $false};return &$originalOptional -Path $Path -GetItem $GetItem}
+        function Assert-CcodInstalledLifecycleRuntimeManifest {param($Manifest,$ExpectedVersion,$ExpectedRuntimeId,$RuntimeRoot)return $Manifest}
+        $facts=Get-CcodInstalledLifecycleFacts -InstallRoot $root -ExpectedVersion '2.5.22'
+        Assert-CcodTrue $facts.appPresent 'sealed runtime is the installed application'
+        Assert-CcodEqual '2.5.22' $facts.aboutVersion 'version comes from the active runtime package'
+        Assert-CcodTrue $facts.installReady 'absence of the obsolete Inno directory does not reject sealed metadata'
+        Assert-CcodTrue (-not$facts.protectionReady) 'metadata alone does not prove protection readiness'
+    } finally {
+        Set-Item Function:Assert-CcodInstalledLifecycleRuntimeManifest $originalManifest
+        Set-Item Function:Get-CcodInstalledLifecycleOptionalDirectoryState $originalOptional
+        Clear-CcodHarnessProcessFixture
+        if($null-eq$previousHome){Remove-Item Env:CODEX_HOME -ErrorAction SilentlyContinue}else{$env:CODEX_HOME=$previousHome}
+        if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force}
+    }
+}
+
+Invoke-CcodTest 'native CIM timestamps are preserved for installed supervisor and tray' {
+    . $harnessPath -Library
+    $root = Join-Path $env:TEMP ('ccod-installed-native-cim-' + [guid]::NewGuid().ToString('N'))
+    $hadCodexHome = Test-Path -LiteralPath Env:CODEX_HOME
+    $previousCodexHome = $env:CODEX_HOME
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $env:CODEX_HOME = Join-Path $root 'keys'
+        $created = [datetime]::ParseExact('2026-08-24T00:00:00.0000000Z', 'o', [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::RoundtripKind)
+        $supervisorProcess = New-CcodHarnessCimProcess -Name 'powershell.exe' -ProcessId 700 -CreationTimeUtc $created.ToString('o') -CommandLine ('powershell.exe -File "{0}"' -f (Join-Path $root 'Supervisor.ps1'))
+        $trayProcess = New-CcodHarnessCimProcess -Name 'CodexRemote.TrayHost.exe' -ProcessId 701 -CreationTimeUtc $created.AddSeconds(1).ToString('o') -CommandLine 'CodexRemote.TrayHost.exe'
+        $trayProcess.ExecutablePath = Join-Path $root 'bin\CodexRemote.TrayHost.exe'
+        Set-CcodHarnessProcessFixture -ChatGPT @()
+        $global:CcodInstalledLifecycleNativeCimFixture = @($supervisorProcess,$trayProcess)
+        function global:Get-CimInstance {
+            param($ClassName,$Filter,$ErrorAction)
+            return @($global:CcodInstalledLifecycleNativeCimFixture | Where-Object { $Filter -ceq ("Name = '{0}'" -f $_.Name) })
+        }
+        $legacy = Get-CcodInstalledLifecycleFacts -InstallRoot $root
+        Assert-CcodEqual 1 $legacy.supervisor.Count 'DMTF supervisor baseline is observed'
+        Assert-CcodEqual 1 $legacy.trayHost.Count 'DMTF tray baseline is observed'
+        Assert-CcodEqual $created.ToString('o') $legacy.supervisor[0].CreationTimeUtc 'DMTF supervisor time is canonical UTC'
+        Assert-CcodEqual $created.AddSeconds(1).ToString('o') $legacy.trayHost[0].CreationTimeUtc 'DMTF tray time is canonical UTC'
+        $supervisorProcess.CreationDate = $created
+        $trayProcess.CreationDate = $created.AddSeconds(1)
+        Assert-CcodTrue ($supervisorProcess.CreationDate -is [datetime] -and $trayProcess.CreationDate -is [datetime]) 'native CIM DateTime values reach the real collector'
+        $native = Get-CcodInstalledLifecycleFacts -InstallRoot $root
+        Assert-CcodEqual 1 $native.supervisor.Count 'native supervisor is observed'
+        Assert-CcodEqual 1 $native.trayHost.Count 'native tray is observed'
+        Assert-CcodEqual $created.ToString('o') $native.supervisor[0].CreationTimeUtc 'native supervisor creation identity is preserved'
+        Assert-CcodEqual $created.AddSeconds(1).ToString('o') $native.trayHost[0].CreationTimeUtc 'native tray creation identity is preserved'
+        $supervisorProcess.CreationDate = 'not-a-cim-timestamp'
+        Assert-CcodThrows { Get-CcodInstalledLifecycleFacts -InstallRoot $root } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+    } finally {
+        Clear-CcodHarnessProcessFixture
+        Remove-Variable -Name CcodInstalledLifecycleNativeCimFixture -Scope Global -ErrorAction SilentlyContinue
+        if ($hadCodexHome) { $env:CODEX_HOME = $previousCodexHome } else { Remove-Item -LiteralPath Env:CODEX_HOME -ErrorAction SilentlyContinue }
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'process precision correlation retains exact native time and rejects cross-microsecond identity' {
+    . $harnessPath -Library
+    $original=${function:Get-CcodInstalledLifecycleNativeProcessCreationTimeUtc}
+    try {
+        $cim=[datetime]::ParseExact('2026-08-24T00:00:04.0000000Z','o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
+        $process=[pscustomobject]@{ProcessId=[uint32]13948;CreationDate=$cim}
+        $state=[pscustomobject]@{Native=$cim.ToString('o');Fail=$false;Calls=0}
+        function Get-CcodInstalledLifecycleNativeProcessCreationTimeUtc {param($ProcessId)$state.Calls++;if($state.Fail){throw 'native query denied'};return $state.Native}
+        foreach($delta in @(0,6,9)){
+            $state.Native=$cim.AddTicks($delta).ToString('o')
+            Assert-CcodEqual $state.Native (Get-CcodInstalledLifecycleCorrelatedCreationTimeUtc -Process $process) 'only CIM precision is correlated; full native ticks remain exact'
+        }
+        foreach($delta in @(-1,10)){
+            $state.Native=$cim.AddTicks($delta).ToString('o')
+            Assert-CcodThrows {Get-CcodInstalledLifecycleCorrelatedCreationTimeUtc -Process $process|Out-Null} 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+        }
+        $process.CreationDate=$cim.AddTicks(6);$state.Native=$process.CreationDate.ToString('o')
+        Assert-CcodEqual $state.Native (Get-CcodInstalledLifecycleCorrelatedCreationTimeUtc -Process $process) 'already precise observation must equal native identity'
+        $state.Native=$cim.AddTicks(7).ToString('o')
+        Assert-CcodThrows {Get-CcodInstalledLifecycleCorrelatedCreationTimeUtc -Process $process|Out-Null} 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+        $state.Fail=$true
+        Assert-CcodThrows {Get-CcodInstalledLifecycleCorrelatedCreationTimeUtc -Process $process|Out-Null} 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+        $state.Fail=$false;$state.Native=$null
+        Assert-CcodThrows {Get-CcodInstalledLifecycleCorrelatedCreationTimeUtc -Process $process|Out-Null} 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+        Assert-CcodTrue ($state.Calls-ge9) 'each boundary reaches native observation'
+    } finally {Set-Item Function:Get-CcodInstalledLifecycleNativeProcessCreationTimeUtc $original}
+}
+
+Invoke-CcodTest 'actual local process retains native precision through CIM correlation' {
+    . $harnessPath -Library
+    $current=[Diagnostics.Process]::GetCurrentProcess()
+    try {
+        $cim=CimCmdlets\Get-CimInstance -ClassName Win32_Process -Filter ('ProcessId = '+$current.Id) -ErrorAction Stop
+        $exact=$current.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)
+        Assert-CcodEqual $exact (Get-CcodInstalledLifecycleNativeProcessCreationTimeUtc -ProcessId $current.Id) 'real native read retains all ticks'
+        Assert-CcodEqual $exact (Get-CcodInstalledLifecycleCorrelatedCreationTimeUtc -Process $cim) 'real current process correlates without replacing exact native identity'
+    } finally {$current.Dispose()}
+}
+
+Invoke-CcodTest 'installed tray observation selects active runtime bin rather than top-level decoy' {
+    . $harnessPath -Library
+    $root=Join-Path $env:TEMP ('ccod-tray-runtime-path-'+[guid]::NewGuid().ToString('N'))
+    $previousHome=$env:CODEX_HOME
+    try {
+        [IO.Directory]::CreateDirectory($root)|Out-Null
+        $env:CODEX_HOME=Join-Path $root 'keys'
+        $runtimeId='2.5.21-e3b0c44298fc1c14'
+        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId $runtimeId -ActiveGeneration 8 -StatusRuntimeId $runtimeId -StatusCodexPid 702 -StatusCodexCreationTimeUtc '2026-08-24T00:00:02.0000000Z' -ReceiptPhase Completed
+        $actual=New-CcodHarnessCimProcess -Name 'CodexRemote.TrayHost.exe' -ProcessId 701 -CreationTimeUtc '2026-08-24T00:00:01.0000000Z' -CommandLine 'CodexRemote.TrayHost.exe'
+        $actual.ExecutablePath=Join-Path $root ('runtime\'+$runtimeId+'\bin\CodexRemote.TrayHost.exe')
+        $decoy=New-CcodHarnessCimProcess -Name 'CodexRemote.TrayHost.exe' -ProcessId 799 -CreationTimeUtc '2026-08-24T00:00:01.0000000Z' -CommandLine 'CodexRemote.TrayHost.exe'
+        $decoy.ExecutablePath=Join-Path $root 'bin\CodexRemote.TrayHost.exe'
+        Set-CcodHarnessProcessFixture -ChatGPT @()
+        $global:CcodRuntimePathProcesses=@($actual,$decoy)
+        function global:Get-CimInstance {param($ClassName,$Filter,$ErrorAction)return @($global:CcodRuntimePathProcesses|Where-Object {$Filter-ceq("Name = '{0}'"-f$_.Name)})}
+        $originalReady=${function:Get-CcodInstalledLifecycleTrayHostReadyProof}
+        function Get-CcodInstalledLifecycleTrayHostReadyProof {param($InstallRoot,$RuntimeId,$TrayHost)return $false}
+        $facts=Get-CcodInstalledLifecycleFacts -InstallRoot $root
+        Assert-CcodEqual 1 $facts.trayHost.Count 'only the current runtime tray is selected'
+        Assert-CcodEqual 701 $facts.trayHost[0].Pid 'top-level executable is not the active TrayHost'
+    } finally {
+        if($null-ne$originalReady){Set-Item Function:Get-CcodInstalledLifecycleTrayHostReadyProof $originalReady}
+        Clear-CcodHarnessProcessFixture
+        Remove-Variable CcodRuntimePathProcesses -Scope Global -ErrorAction SilentlyContinue
+        if($null-eq$previousHome){Remove-Item Env:CODEX_HOME -ErrorAction SilentlyContinue}else{$env:CODEX_HOME=$previousHome}
+        if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force}
+    }
+}
+
+Invoke-CcodTest 'legacy readiness uses protected event and exact current process identities without new logs' {
+    . $harnessPath -Library
+    $root=Join-Path $env:TEMP ('ccod-legacy-ready-'+[guid]::NewGuid().ToString('N'))
+    $kernel=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/KernelObjects.psm1') -PassThru -Force
+    $event=$null
+    $originalNative=${function:Get-CcodInstalledLifecycleNativeProcessCreationTimeUtc}
+    try {
+        function Get-CcodInstalledLifecycleNativeProcessCreationTimeUtc {param($ProcessId)return $script:CcodHarnessNativeCreation[[int]$ProcessId]}
+        $utf8=[Text.UTF8Encoding]::new($false)
+        $records=[Collections.Generic.List[object]]::new()
+        foreach($relative in @('bin/CodexRemote.TrayHost.exe','src/persistence/Supervisor.ps1')){
+            $bytes=$utf8.GetBytes('inert legacy '+$relative);$sha=[Security.Cryptography.SHA256]::Create()
+            try{$hash=[BitConverter]::ToString($sha.ComputeHash($bytes)).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()}
+            $records.Add([pscustomobject][ordered]@{path=$relative;length=[long]$bytes.Length;sha256=$hash})
+        }
+        $canonical=(@($records|ForEach-Object {'{0}`t{1}`t{2}' -f $_.path,$_.length,$_.sha256})-join"`n")
+        $sha=[Security.Cryptography.SHA256]::Create();try{$digest=[BitConverter]::ToString($sha.ComputeHash($utf8.GetBytes($canonical))).Replace('-','').ToLowerInvariant()}finally{$sha.Dispose()}
+        $runtimeId='2.5.21-'+$digest.Substring(0,16)
+        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId $runtimeId -ActiveGeneration 8 -StatusRuntimeId $runtimeId -StatusCodexPid 702 -StatusCodexCreationTimeUtc '2026-08-24T00:00:02.0000000Z' -ReceiptPhase Completed
+        $runtime=Join-Path $root ('runtime\'+$runtimeId)
+        foreach($record in $records){$path=Join-Path $runtime $record.path;[IO.Directory]::CreateDirectory((Split-Path $path -Parent))|Out-Null;[IO.File]::WriteAllText($path,('inert legacy '+$record.path),$utf8)}
+        Write-CcodHarnessJson -Path (Join-Path $runtime 'manifest.json') -Value ([ordered]@{schemaVersion=1;projectVersion='2.5.21';runtimeId=$runtimeId;files=@($records)})
+        $current=[Diagnostics.Process]::GetCurrentProcess();try{$session=$current.SessionId}finally{$current.Dispose()}
+        $windowsIdentity=[Security.Principal.WindowsIdentity]::GetCurrent();try{$sid=$windowsIdentity.User.Value}finally{$windowsIdentity.Dispose()}
+        $token=[guid]::NewGuid().ToString('N')+[guid]::NewGuid().ToString('N')
+        $event=&$kernel {param($Sid,$Session,$Token)New-CcodEvent -Kind Ready -UserSid $Sid -SessionId $Session -ReadyToken $Token} $sid $session $token
+        $powershell=Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+        $created=[datetime]::ParseExact('2026-08-24T00:00:00.0000006Z','o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
+        $supervisor=New-CcodHarnessCimProcess -Name 'powershell.exe' -ProcessId 700 -CreationTimeUtc $created.ToString('o') -CommandLine ('"{0}" -NoProfile -ExecutionPolicy Bypass -STA -File "{1}" -ReadyToken {2}'-f$powershell,(Join-Path $runtime 'src/persistence/Supervisor.ps1'),$token)
+        $supervisor.ExecutablePath=$powershell;$supervisor|Add-Member SessionId $session
+        $trayPath=Join-Path $runtime 'bin/CodexRemote.TrayHost.exe'
+        $tray=New-CcodHarnessCimProcess -Name 'CodexRemote.TrayHost.exe' -ProcessId 701 -ParentProcessId 700 -CreationTimeUtc $created.AddSeconds(1).ToString('o') -CommandLine ('"{0}" --child --parent-pid 700 --parent-created {1} --runtime-id {2}'-f$trayPath,$created.ToFileTimeUtc(),$runtimeId)
+        $tray.ExecutablePath=$trayPath;$tray|Add-Member SessionId $session
+        $statusPath=Join-Path $root 'state/status.json';$status=[IO.File]::ReadAllText($statusPath)|ConvertFrom-Json;$status.session.supervisorCreationTimeUtc=$created.ToString('o');$status.session.sessionId=$session.ToString([Globalization.CultureInfo]::InvariantCulture);Write-CcodHarnessJson $statusPath $status
+        $supervisorIdentity=@([pscustomobject]@{Pid=700;CreationTimeUtc=$created.ToString('o')});$trayIdentity=@([pscustomobject]@{Pid=701;CreationTimeUtc=$created.AddSeconds(1).ToString('o')})
+        $global:CcodLegacyReadyFixture=[pscustomobject]@{Processes=@($supervisor,$tray);Calls=0;Drift=$false}
+        function global:Get-CimInstance {param($ClassName,$Filter,$ErrorAction)$global:CcodLegacyReadyFixture.Calls++;$items=@($global:CcodLegacyReadyFixture.Processes|Where-Object {$Filter-ceq('ProcessId = '+$_.ProcessId)});if($global:CcodLegacyReadyFixture.Drift-and$global:CcodLegacyReadyFixture.Calls-ge3){return @()};return $items}
+        Assert-CcodEqual $false (Get-CcodInstalledLifecycleTrayHostReadyProof -InstallRoot $root -RuntimeId $runtimeId -TrayHost $trayIdentity) 'absent newer log does not prove old readiness'
+        [void]$event.Handle.Set()
+        Assert-CcodTrue (Get-CcodInstalledLifecycleTrayHostReadyProof -InstallRoot $root -RuntimeId $runtimeId -TrayHost $trayIdentity) 'protected legacy startup event proves the current parent and host without a log'
+        [void]$event.Handle.Reset()
+        Assert-CcodEqual $false (Get-CcodInstalledLifecycleLegacyTrayReadyProof -InstallRoot $root -RuntimeId $runtimeId -Supervisor $supervisorIdentity -TrayHost $trayIdentity) 'unsignaled event does not prove readiness'
+        [void]$event.Handle.Set()
+        Assert-CcodTrue (-not(Test-Path -LiteralPath (Join-Path $root 'logs/supervisor.log'))) 'no fabricated newer Ready log is written'
+        $tray.ParentProcessId=799
+        Assert-CcodThrows {Get-CcodInstalledLifecycleLegacyTrayReadyProof -InstallRoot $root -RuntimeId $runtimeId -Supervisor $supervisorIdentity -TrayHost $trayIdentity|Out-Null} 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+        $tray.ParentProcessId=700
+        $status.session.supervisorCreationTimeUtc=$created.AddSeconds(-1).ToString('o');Write-CcodHarnessJson $statusPath $status
+        Assert-CcodThrows {Get-CcodInstalledLifecycleLegacyTrayReadyProof -InstallRoot $root -RuntimeId $runtimeId -Supervisor $supervisorIdentity -TrayHost $trayIdentity|Out-Null} 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+        $status.session.supervisorCreationTimeUtc=$created.ToString('o');Write-CcodHarnessJson $statusPath $status
+        $global:CcodLegacyReadyFixture.Calls=0;$global:CcodLegacyReadyFixture.Drift=$true
+        Assert-CcodThrows {Get-CcodInstalledLifecycleLegacyTrayReadyProof -InstallRoot $root -RuntimeId $runtimeId -Supervisor $supervisorIdentity -TrayHost $trayIdentity|Out-Null} 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+        $global:CcodLegacyReadyFixture.Drift=$false
+        Assert-CcodThrows {Get-CcodInstalledLifecycleLegacyTrayReadyProof -InstallRoot $root -RuntimeId ($runtimeId+'-'+('a'*32)) -Supervisor $supervisorIdentity -TrayHost $trayIdentity|Out-Null} 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+        Assert-CcodTrue (Get-CcodInstalledLifecycleLegacyTrayReadyProof -InstallRoot $root -RuntimeId $runtimeId -Supervisor $supervisorIdentity -TrayHost $trayIdentity) 'failure releases event and module leases for retry'
+    } finally {
+        if($null-ne$event){$event.Handle.Dispose()}
+        Set-Item Function:Get-CcodInstalledLifecycleNativeProcessCreationTimeUtc $originalNative
+        Remove-Item Function:\Get-CimInstance -ErrorAction SilentlyContinue
+        Remove-Variable CcodLegacyReadyFixture -Scope Global -ErrorAction SilentlyContinue
+        if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force}
+    }
+}
+
+Invoke-CcodTest 'installed readiness selects current Ready across valid supervisor history' {
+    . $harnessPath -Library
+    $root = Join-Path $env:TEMP ('ccod-installed-ready-history-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory((Join-Path $root 'logs')) | Out-Null
+        $log = Join-Path $root 'logs\supervisor.log'
+        $current = [ordered]@{ schemaVersion = 1; timestampUtc = '2030-02-03T04:05:07.0000000Z'; component = 'Supervisor'; stage = 'TrayHostReady'; code = 'CCOD_TRAYHOST_READY'; outcome = 'Completed'; runtimeId = 'runtime-2.5.22'; hostPid = 201; hostCreationTimeUtc = '2030-02-03T04:05:01.0000000Z'; protocolMajor = 2; capabilities = 7 }
+        $hosts = @([pscustomobject][ordered]@{ Pid = 201; CreationTimeUtc = $current.hostCreationTimeUtc })
+        [IO.File]::WriteAllText($log, (($current | ConvertTo-Json -Compress) + [Environment]::NewLine))
+        Assert-CcodTrue (Get-CcodInstalledLifecycleTrayHostReadyProof -InstallRoot $root -RuntimeId 'runtime-2.5.22' -TrayHost $hosts) 'a current Ready record proves the baseline'
+        $historical = [ordered]@{}
+        foreach ($key in $current.Keys) { $historical[$key] = $current[$key] }
+        $historical.runtimeId = 'runtime-2.5.21'
+        $action = [ordered]@{ schemaVersion = 1; timestampUtc = $current.timestampUtc; component = 'Supervisor'; stage = 'TrayAction'; code = 'CCOD_TRAY_ACTION_COMPLETED'; outcome = 'Completed'; command = 'ShowAbout'; revision = 1; status = 'Completed' }
+        $warning = [ordered]@{ schemaVersion = 1; timestampUtc = $current.timestampUtc; component = 'Supervisor'; stage = 'LeaseAcquire'; code = 'CCOD_SUPERVISOR_LEASE_ABANDONED'; outcome = 'Warning' }
+        $history = @($action,$historical,$warning)
+        [IO.File]::WriteAllText($log, ((@($history + @($current) | ForEach-Object { $_ | ConvertTo-Json -Compress }) -join [Environment]::NewLine) + [Environment]::NewLine))
+        Assert-CcodTrue (Get-CcodInstalledLifecycleTrayHostReadyProof -InstallRoot $root -RuntimeId 'runtime-2.5.22' -TrayHost $hosts) 'well-formed action and old runtime records do not invalidate current Ready'
+        [IO.File]::WriteAllText($log, ((@($history | ForEach-Object { $_ | ConvertTo-Json -Compress }) -join [Environment]::NewLine) + [Environment]::NewLine))
+        Assert-CcodEqual $false (Get-CcodInstalledLifecycleTrayHostReadyProof -InstallRoot $root -RuntimeId 'runtime-2.5.22' -TrayHost $hosts) 'historical runtime cannot prove readiness even with matching process identity'
+        $current.hostPid = '201'
+        [IO.File]::WriteAllText($log, ((@($history + @($current) | ForEach-Object { $_ | ConvertTo-Json -Compress }) -join [Environment]::NewLine) + [Environment]::NewLine))
+        Assert-CcodThrows { Get-CcodInstalledLifecycleTrayHostReadyProof -InstallRoot $root -RuntimeId 'runtime-2.5.22' -TrayHost $hosts } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+        $current.hostPid = 201
+        $action.status = @('Completed')
+        [IO.File]::WriteAllText($log, ((@($action,$current | ForEach-Object { $_ | ConvertTo-Json -Depth 4 -Compress }) -join [Environment]::NewLine) + [Environment]::NewLine))
+        Assert-CcodThrows { Get-CcodInstalledLifecycleTrayHostReadyProof -InstallRoot $root -RuntimeId 'runtime-2.5.22' -TrayHost $hosts } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+    } finally {
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'expected debug ports survive the installed lifecycle facts boundary' {
+    . $harnessPath -Library
+    $root = Join-Path $env:TEMP ('ccod-installed-expected-ports-' + [guid]::NewGuid().ToString('N'))
+    $originalNetTcp = ${function:Get-NetTCPConnection}
+    $originalDirectoryProbe = ${function:Get-CcodInstalledLifecycleOptionalDirectoryState}
+    $originalFileProbe = ${function:Get-CcodInstalledLifecycleOptionalRegularFileState}
+    $fixtureAbsentApplicationRoot = Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)) 'CodexControlOtherDevices-installer'
+    $fixtureApplicationProbes = [pscustomobject]@{ Directory = 0; Metadata = 0 }
+    try {
+        function Get-CcodInstalledLifecycleOptionalDirectoryState {
+            param($Path,$GetItem)
+            if ($Path -ieq $fixtureAbsentApplicationRoot) { $fixtureApplicationProbes.Directory++; return $false }
+            & $originalDirectoryProbe -Path $Path -GetItem $GetItem
+        }
+        function Get-CcodInstalledLifecycleOptionalRegularFileState {
+            param($Path,$GetItem)
+            if ($Path -ieq (Join-Path $fixtureAbsentApplicationRoot 'package.json')) { $fixtureApplicationProbes.Metadata++; return $null }
+            & $originalFileProbe -Path $Path -GetItem $GetItem
+        }
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14' -ActiveGeneration ([UInt64]8) `
+            -StatusRuntimeId '2.5.21-e3b0c44298fc1c14' -StatusCodexPid 13948 -StatusCodexCreationTimeUtc '2026-08-24T00:00:02.0000000Z' -ReceiptPhase 'Completed' -StatusMainPort 9229 -StatusRendererPort 9230
+        Set-CcodHarnessProcessFixture -ChatGPT @(
+            (New-CcodHarnessCimProcess -Name 'ChatGPT.exe' -ProcessId 13948 -CreationTimeUtc '2026-08-24T00:00:02.0000000Z' -CommandLine '"C:\Program Files\WindowsApps\OpenAI.Codex\ChatGPT.exe"')
+        )
+        function global:Get-NetTCPConnection {
+            param($State,$ErrorAction)
+            return @(
+                [pscustomobject]@{ LocalAddress = '127.0.0.1'; LocalPort = 9229; OwningProcess = 13948 }
+                [pscustomobject]@{ LocalAddress = '127.0.0.1'; LocalPort = 9230; OwningProcess = 13948 }
+            )
+        }
+        $facts = Get-CcodInstalledLifecycleFacts -InstallRoot $root -ExpectedDebugPorts @(9229,9230)
+        Assert-CcodEqual '9229,9230' ($facts.debugPorts -join ',') 'expected debug ports are preserved for listener verification'
+        Assert-CcodEqual $false $facts.appPresent 'port observation does not depend on a machine installation'
+        Assert-CcodEqual $null $facts.aboutVersion 'port fixture has no installed application metadata'
+        Assert-CcodTrue ($fixtureApplicationProbes.Directory -gt 0 -and $fixtureApplicationProbes.Metadata -gt 0) 'real application path lookups are isolated by the fixture'
+        $legacyFacts = Get-CcodInstalledLifecycleFacts -InstallRoot $root
+        Assert-CcodTrue ($null -ne $legacyFacts -and $legacyFacts.activeRuntimeId -is [string]) 'legacy two-part runtime identity can be observed without an expected version'
+    } finally {
+        Set-Item -LiteralPath Function:\Get-CcodInstalledLifecycleOptionalDirectoryState -Value $originalDirectoryProbe
+        Set-Item -LiteralPath Function:\Get-CcodInstalledLifecycleOptionalRegularFileState -Value $originalFileProbe
+        Clear-CcodHarnessProcessFixture
+        if ($null -eq $originalNetTcp) { Remove-Item -LiteralPath Function:\Get-NetTCPConnection -Force -ErrorAction SilentlyContinue }
+        else { Set-Item -LiteralPath Function:\Get-NetTCPConnection -Value $originalNetTcp }
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'rejects non-integer debug port facts before endpoint observation' {
+    . $harnessPath -Library
+    $root = Join-Path $env:TEMP ('ccod-installed-noninteger-port-' + [guid]::NewGuid().ToString('N'))
+    $originalNetTcp = ${function:Get-NetTCPConnection}
+    $originalStatusReader = ${function:Read-CcodInstalledLifecycleStatusFact}
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14' -ActiveGeneration ([UInt64]8) `
+            -StatusRuntimeId '2.5.21-e3b0c44298fc1c14' -StatusCodexPid 13948 -StatusCodexCreationTimeUtc '2026-08-24T00:00:02.0000000Z' -ReceiptPhase 'Completed' -StatusMainPort 9229 -StatusRendererPort 9230
+        $statusOverride = Get-Content -LiteralPath (Join-Path $root 'state\status.json') -Raw | ConvertFrom-Json
+        $global:CcodInstalledLifecycleNonIntegerStatusOverride = $statusOverride
+        Set-Item -LiteralPath Function:\Read-CcodInstalledLifecycleStatusFact -Value { param($StateRoot) return $global:CcodInstalledLifecycleNonIntegerStatusOverride }
+        Set-CcodHarnessProcessFixture -ChatGPT @(
+            (New-CcodHarnessCimProcess -Name 'ChatGPT.exe' -ProcessId 13948 -CreationTimeUtc '2026-08-24T00:00:02.0000000Z' -CommandLine '"C:\Program Files\WindowsApps\OpenAI.Codex\ChatGPT.exe"')
+        )
+        function global:Get-NetTCPConnection {
+            param($State,$ErrorAction)
+            return @(
+                [pscustomobject]@{ LocalAddress = '127.0.0.1'; LocalPort = 9229; OwningProcess = 13948 }
+                [pscustomobject]@{ LocalAddress = '127.0.0.1'; LocalPort = 9230; OwningProcess = 13948 }
+            )
+        }
+        $positive = Get-CcodInstalledLifecycleFacts -InstallRoot $root -ExpectedDebugPorts @(9229,9230)
+        Assert-CcodEqual 2 $positive.debugEndpoints.Count 'complete integer status fixture reaches endpoint observation'
+        $statusOverride.session.codex.mainPort = [decimal]9229.25
+        Assert-CcodTrue ($statusOverride.session.codex.mainPort -is [decimal]) 'fixture retains a non-integer status port value'
+        Assert-CcodEqual 9229 ([int]$statusOverride.session.codex.mainPort) 'rounding would otherwise preserve the declared port binding'
+        Assert-CcodThrows {
+            Get-CcodInstalledLifecycleFacts -InstallRoot $root -ExpectedDebugPorts @(9229,9230)
+        } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+    } finally {
+        Clear-CcodHarnessProcessFixture
+        if ($null -eq $originalNetTcp) { Remove-Item -LiteralPath Function:\Get-NetTCPConnection -Force -ErrorAction SilentlyContinue }
+        else { Set-Item -LiteralPath Function:\Get-NetTCPConnection -Value $originalNetTcp }
+        Set-Item -LiteralPath Function:\Read-CcodInstalledLifecycleStatusFact -Value $originalStatusReader
+        Remove-Variable -Name CcodInstalledLifecycleNonIntegerStatusOverride -Scope Global -ErrorAction SilentlyContinue
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'uses absolute end anchors for lifecycle candidate and version validation' {
+    . $harnessPath -Library
+    $source = [IO.File]::ReadAllText($harnessPath, [Text.UTF8Encoding]::new($false))
+    Assert-CcodTrue ($source.Contains('[regex]::Match($leaf, ''^CodexRemote-fix-(\d+\.\d+\.\d+)-setup\.exe\z''')) 'candidate filename validation uses an absolute end anchor'
+    Assert-CcodTrue ($source.Contains('[Parameter(Mandatory)][ValidatePattern(''^\d+\.\d+\.\d+\z'')][string]$ExpectedVersion,')) 'public expected-version validation uses an absolute end anchor'
+    Assert-CcodTrue (-not $source.Contains("'^[0-9a-f]{64}$'")) 'lifecycle hash validation uses an absolute end anchor'
+}
+
+Invoke-CcodTest 'rejects expected debug ports detached from the current runtime declaration' {
+    . $harnessPath -Library
+    $root = Join-Path $env:TEMP ('ccod-installed-port-binding-' + [guid]::NewGuid().ToString('N'))
+    $originalStatusReader = ${function:Read-CcodInstalledLifecycleStatusFact}
+    $originalNetTcp = ${function:Get-NetTCPConnection}
+    try {
+        $null = [IO.Directory]::CreateDirectory($root)
+        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -ActiveGeneration ([UInt64]8) `
+            -StatusRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -StatusCodexPid 13948 -StatusCodexCreationTimeUtc '2026-08-24T00:00:04.0000000Z' -ReceiptPhase 'Completed'
+        Set-CcodHarnessProcessFixture -ChatGPT @(
+            (New-CcodHarnessCimProcess -Name 'ChatGPT.exe' -ProcessId 13948 -CreationTimeUtc '2026-08-24T00:00:04.0000000Z' -CommandLine '"C:\Program Files\WindowsApps\OpenAI.Codex\ChatGPT.exe"')
+        )
+        $status = Get-Content -LiteralPath (Join-Path $root 'state\status.json') -Raw | ConvertFrom-Json
+        $status.session.codex.mainPort = 9229
+        $status.session.codex.rendererPort = 9230
+        $global:InstalledLifecycleHarnessStatusOverride = $status
+        Set-Item -LiteralPath Function:\Read-CcodInstalledLifecycleStatusFact -Value { param($StateRoot) return $global:InstalledLifecycleHarnessStatusOverride }
+        function global:Get-NetTCPConnection { param($State,$ErrorAction) return @() }
+        $positive = Get-CcodInstalledLifecycleFacts -InstallRoot $root -ExpectedDebugPorts @(9229,9230)
+        Assert-CcodEqual '9229,9230' ($positive.debugPorts -join ',') 'matching declared port baseline succeeds independently of application version'
+        Assert-CcodThrows {
+            Get-CcodInstalledLifecycleFacts -InstallRoot $root -ExpectedDebugPorts @(9331,9332)
+        } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+    } finally {
+        if ($null -eq $originalNetTcp) { Remove-Item -LiteralPath Function:\Get-NetTCPConnection -Force -ErrorAction SilentlyContinue }
+        else { Set-Item -LiteralPath Function:\Get-NetTCPConnection -Value $originalNetTcp }
+        Set-Item -LiteralPath Function:\Read-CcodInstalledLifecycleStatusFact -Value $originalStatusReader
+        Remove-Variable -Name InstalledLifecycleHarnessStatusOverride -Scope Global -ErrorAction SilentlyContinue
+        Clear-CcodHarnessProcessFixture
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'rejects fractional expected debug ports before endpoint observation' {
+    . $harnessPath -Library
+    $root = Join-Path $env:TEMP ('ccod-installed-port-type-' + [guid]::NewGuid().ToString('N'))
+    $originalNetTcp = ${function:Get-NetTCPConnection}
+    try {
+        $null = [IO.Directory]::CreateDirectory($root)
+        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -ActiveGeneration ([UInt64]8) `
+            -StatusRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -StatusCodexPid 13948 -StatusCodexCreationTimeUtc '2026-08-24T00:00:04.0000000Z' -ReceiptPhase 'Completed' -StatusMainPort 9229 -StatusRendererPort 9230
+        Set-CcodHarnessProcessFixture -ChatGPT @()
+        function global:Get-NetTCPConnection { param($State,$ErrorAction) return @() }
+        $positive = Get-CcodInstalledLifecycleFacts -InstallRoot $root -ExpectedDebugPorts @(9229,9230)
+        Assert-CcodEqual '9229,9230' ($positive.debugPorts -join ',') 'integer expected-port baseline succeeds before the scalar mutation'
+        Assert-CcodEqual 9229 ([int][decimal]9229.25) 'fractional fixture cannot be rejected only by downstream port mismatch'
+        Assert-CcodThrows {
+            Get-CcodInstalledLifecycleFacts -InstallRoot $root -ExpectedDebugPorts @([decimal]9229.25, 9230)
+        } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+    } finally {
+        if ($null -eq $originalNetTcp) { Remove-Item -LiteralPath Function:\Get-NetTCPConnection -Force -ErrorAction SilentlyContinue }
+        else { Set-Item -LiteralPath Function:\Get-NetTCPConnection -Value $originalNetTcp }
+        Clear-CcodHarnessProcessFixture
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'rejects listener endpoint fields whose scalar types are not exact integers' {
+    . $harnessPath -Library
+    $root = Join-Path $env:TEMP ('ccod-installed-listener-type-' + [guid]::NewGuid().ToString('N'))
+    $originalNetTcp = ${function:Get-NetTCPConnection}
+    $global:InstalledLifecycleListenerObserved = 0
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -ActiveGeneration ([UInt64]8) `
+            -StatusRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -StatusCodexPid 13948 -StatusCodexCreationTimeUtc '2026-08-24T00:00:04.0000000Z' -ReceiptPhase 'Completed' -StatusMainPort 9229 -StatusRendererPort 9230
+        Set-CcodHarnessProcessFixture -ChatGPT @(
+            (New-CcodHarnessCimProcess -Name 'ChatGPT.exe' -ProcessId 13948 -CreationTimeUtc '2026-08-24T00:00:04.0000000Z' -CommandLine '"C:\Program Files\WindowsApps\OpenAI.Codex\ChatGPT.exe"')
+        )
+        function global:Get-NetTCPConnection {
+            param($State,$ErrorAction)
+            $global:InstalledLifecycleListenerObserved = [int]$global:InstalledLifecycleListenerObserved + 1
+            return @(
+                [pscustomobject]@{ LocalAddress = '127.0.0.1'; LocalPort = 9229; OwningProcess = 13948 }
+                [pscustomobject]@{ LocalAddress = '127.0.0.1'; LocalPort = 9230; OwningProcess = 13948 }
+            )
+        }
+        $valid = Get-CcodInstalledLifecycleFacts -InstallRoot $root -ExpectedDebugPorts @(9229,9230)
+        Assert-CcodEqual '9229,9230' ($valid.debugPorts -join ',') 'integer listener fixture reaches a valid endpoint observation'
+        $global:CcodInstalledLifecycleMixedListeners = @(
+            [pscustomobject]@{ LocalAddress = '127.0.0.1'; LocalPort = [uint16]9229; OwningProcess = [uint32]13948 }
+            [pscustomobject]@{ LocalAddress = '127.0.0.1'; LocalPort = [uint16]9230; OwningProcess = [uint32]13948 }
+            [pscustomobject]@{ LocalAddress = '0.0.0.0'; LocalPort = [uint16]80; OwningProcess = [uint32]4 }
+            [pscustomobject]@{ LocalAddress = '::'; LocalPort = [uint16]135; OwningProcess = [uint32]4 }
+            [pscustomobject]@{ LocalAddress = '192.0.2.1'; LocalPort = [uint16]445; OwningProcess = [uint32]4 }
+        )
+        function global:Get-NetTCPConnection {
+            param($State,$ErrorAction)
+            $global:InstalledLifecycleListenerObserved = [int]$global:InstalledLifecycleListenerObserved + 1
+            return @($global:CcodInstalledLifecycleMixedListeners)
+        }
+        $mixed = Get-CcodInstalledLifecycleFacts -InstallRoot $root -ExpectedDebugPorts @(9229,9230)
+        Assert-CcodEqual 2 $mixed.debugEndpoints.Count 'unrelated wildcard IPv6 and LAN listeners are excluded from debug evidence'
+        Assert-CcodEqual '9229,9230' (($mixed.debugEndpoints | ForEach-Object { $_.localPort }) -join ',') 'only declared debug listeners are retained'
+        foreach ($unsafeAddress in @('0.0.0.0','::')) {
+            $global:CcodInstalledLifecycleMixedListeners[0].LocalAddress = $unsafeAddress
+            Assert-CcodThrows { Get-CcodInstalledLifecycleFacts -InstallRoot $root -ExpectedDebugPorts @(9229,9230) } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+        }
+        $global:CcodInstalledLifecycleMixedListeners[0].LocalAddress = '127.0.0.1'
+        $global:CcodInstalledLifecycleMixedListeners[0].OwningProcess = [uint32]13949
+        Assert-CcodThrows { Get-CcodInstalledLifecycleFacts -InstallRoot $root -ExpectedDebugPorts @(9229,9230) } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+        Remove-Item -LiteralPath Function:\Get-NetTCPConnection -Force
+        function global:Get-NetTCPConnection {
+            param($State,$ErrorAction)
+            $global:InstalledLifecycleListenerObserved = [int]$global:InstalledLifecycleListenerObserved + 1
+            return @(
+                [pscustomobject]@{ LocalAddress = '127.0.0.1'; LocalPort = '9229'; OwningProcess = '13948' }
+                [pscustomobject]@{ LocalAddress = '127.0.0.1'; LocalPort = '9230'; OwningProcess = '13948' }
+            )
+        }
+        Assert-CcodThrows {
+            Get-CcodInstalledLifecycleFacts -InstallRoot $root -ExpectedDebugPorts @(9229,9230)
+        } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+        Assert-CcodTrue ($global:InstalledLifecycleListenerObserved -ge 2) 'both valid and malformed listener fixtures were observed'
+    } finally {
+        Remove-Variable -Name CcodInstalledLifecycleMixedListeners -Scope Global -ErrorAction SilentlyContinue
+        Clear-CcodHarnessProcessFixture
+        if ($null -eq $originalNetTcp) { Remove-Item -LiteralPath Function:\Get-NetTCPConnection -Force -ErrorAction SilentlyContinue }
+        else { Set-Item -LiteralPath Function:\Get-NetTCPConnection -Value $originalNetTcp }
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
 Invoke-CcodTest 'verifies FreshRestart only with one correlated ChatGPT root and Completed current-runtime installer receipt' {
     . $harnessPath -Library
     $root = Join-Path $env:TEMP ('ccod-installed-success-' + [guid]::NewGuid().ToString('N'))
     try {
         $null = [IO.Directory]::CreateDirectory($root)
-        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-new' -ActiveGeneration ([UInt64]8) `
-            -StatusRuntimeId '2.5.21-new' -StatusCodexPid 13948 -StatusCodexCreationTimeUtc '2026-08-24T00:00:04.0000000Z' -ReceiptPhase 'Completed'
+        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -ActiveGeneration ([UInt64]8) `
+            -StatusRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -StatusCodexPid 13948 -StatusCodexCreationTimeUtc '2026-08-24T00:00:04.0000000Z' -ReceiptPhase 'Completed'
         Set-CcodHarnessProcessFixture -ChatGPT @(
             (New-CcodHarnessCimProcess -Name 'ChatGPT.exe' -ProcessId 13948 -CreationTimeUtc '2026-08-24T00:00:04.0000000Z' -CommandLine '"C:\Program Files\WindowsApps\OpenAI.Codex\ChatGPT.exe"'),
             (New-CcodHarnessCimProcess -Name 'ChatGPT.exe' -ProcessId 13949 -CreationTimeUtc '2026-08-24T00:00:04.1000000Z' -CommandLine '"C:\Program Files\WindowsApps\OpenAI.Codex\ChatGPT.exe" --type=renderer' -ParentProcessId 13948)
         )
         $after = Get-CcodInstalledLifecycleFacts -InstallRoot $root
-        $after.appPresent = $true
+        $after.installRootPresent = $true; $after.appPresent = $true
+        $after.installReady = $true; $after.protectionReady = $true; $after.trayAuthenticated = $true
+        $after.trayHost = @([pscustomobject][ordered]@{ Pid = 101; CreationTimeUtc = '2026-08-24T00:00:01.0000000Z' })
+        $after.trayHostIdentity = [pscustomobject][ordered]@{ pid = 101; creationTimeUtc = '2026-08-24T00:00:01.0000000Z' }
         $after.aboutVersion = '2.5.0'
         $after.deviceKeyPresent = $true
         $after.deviceKeySha256 = ('b' * 64)
+        $after.debugPorts = @(9229,9230)
+        $after.debugEndpoints = @(
+            [pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = 9229; owningProcess = $after.codex[0].Pid; owningProcessCreationTimeUtc = $after.codex[0].CreationTimeUtc }
+            [pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = 9230; owningProcess = $after.codex[0].Pid; owningProcessCreationTimeUtc = $after.codex[0].CreationTimeUtc }
+        )
         $before = New-CcodHarnessFacts -RuntimeId '2.5.19-old' -CodexPid 10664
         $context = [pscustomobject]@{ scenario = 'FreshRestart'; expectedVersion = '2.5.0'; installRoot = $root }
         $verification = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after
@@ -611,28 +1949,189 @@ Invoke-CcodTest 'verifies FreshRestart only with one correlated ChatGPT root and
     }
 }
 
+Invoke-CcodTest 'rejects installed verification without an authenticated ready-state proof' {
+    . $harnessPath -Library
+    $context = [pscustomobject]@{ scenario = 'FreshLater'; expectedVersion = '2.5.0'; installRoot = 'C:\fixture' }
+    $before = New-CcodHarnessFacts
+    $after = New-CcodHarnessFacts
+    $after.installReady = $false
+    $after.protectionReady = $false
+    $after.trayAuthenticated = $false
+    $verification = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after
+    Assert-CcodEqual $false $verification.verified 'installed verification requires durable readiness and authenticated TrayHost identity'
+    Assert-CcodEqual 'CCOD_INTEGRATION_OBSERVATION_UNPROVEN' $verification.code 'missing readiness proof uses the stable observation code'
+}
+
+Invoke-CcodTest 'rejects an incomplete installed operator run result before verification' {
+    . $harnessPath -Library
+    $context = [pscustomobject]@{ scenario = 'FreshLater'; expectedVersion = '2.5.0'; installRoot = 'C:\fixture' }
+    $facts = New-CcodHarnessFacts
+    $verification = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $facts -AfterFacts $facts -RunResult ([pscustomobject]@{ code = 'CCOD_INTEGRATION_OPERATOR_COMPLETED' })
+    Assert-CcodEqual $false $verification.verified 'an incomplete operator run result cannot report success'
+    Assert-CcodEqual 'CCOD_INTEGRATION_OBSERVATION_UNPROVEN' $verification.code 'incomplete operator attestation uses the stable observation code'
+}
+
+Invoke-CcodTest 'rejects a FreshLater verification without complete owner-bound debug endpoints' {
+    . $harnessPath -Library
+    $before = New-CcodHarnessFacts
+    $after = New-CcodHarnessFacts
+    $after.debugEndpoints = @()
+    $context = [pscustomobject]@{ scenario = 'FreshLater'; expectedVersion = '2.5.0'; expectedDebugPorts = @(9229,9230); installRoot = 'C:\Fake\Install' }
+    $verification = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after
+    Assert-CcodEqual $false $verification.verified 'FreshLater requires both expected debug endpoints'
+    Assert-CcodEqual 'CCOD_INTEGRATION_OBSERVATION_UNPROVEN' $verification.code 'missing debug endpoint proof uses the stable observation code'
+}
+
+Invoke-CcodTest 'rejects FreshLater verification without current status and terminal lifecycle identity' {
+    . $harnessPath -Library
+    $before = New-CcodHarnessFacts
+    $after = New-CcodHarnessFacts
+    $after.statusPhase = 'Unavailable'
+    $after.statusRuntimeId = $null
+    $after.statusCodex = $null
+    $after.transitionStage = 'Unknown'
+    $after.trayAuthenticated = $false
+    $after.lifecycleReceipt = $null
+    $context = [pscustomobject]@{ scenario = 'FreshLater'; expectedVersion = '2.5.0'; expectedDebugPorts = @(9229,9230); installRoot = 'C:\Fake\Install' }
+    $verification = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after
+    Assert-CcodEqual $false $verification.verified 'FreshLater requires current status, transition, tray, and lifecycle receipt identity'
+    Assert-CcodEqual 'CCOD_INTEGRATION_OBSERVATION_UNPROVEN' $verification.code 'detached FreshLater status uses the stable observation code'
+}
+
+Invoke-CcodTest 'FreshInstall requires a clean pre-install product baseline beyond zero Codex roots' {
+    . $harnessPath -Library
+    $before = New-CcodHarnessFacts
+    $before.codex = @()
+    $after = New-CcodHarnessFacts
+    $context = [pscustomobject]@{ scenario = 'FreshInstall'; expectedVersion = '2.5.0'; expectedDebugPorts = @(9229,9230); installRoot = 'C:\Fake\Install' }
+    $verification = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after
+    Assert-CcodEqual $false $verification.verified 'FreshInstall rejects an already-present install baseline even when Codex is absent'
+}
+
+Invoke-CcodTest 'FreshLater requires a pre-existing Codex identity even when the baseline is empty' {
+    . $harnessPath -Library
+    $before = New-CcodHarnessFacts
+    $before.codex = @()
+    $after = New-CcodHarnessFacts
+    $context = [pscustomobject]@{ scenario = 'FreshLater'; expectedVersion = '2.5.0'; expectedDebugPorts = @(9229,9230); installRoot = 'C:\Fake\Install' }
+    $verification = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after
+    Assert-CcodEqual $false $verification.verified 'FreshLater cannot claim a preserved pre-existing session from an empty baseline'
+}
+
+Invoke-CcodTest 'uninstall verification probes captured ports independently of deleted status' {
+    . $harnessPath -Library
+    $before = New-CcodHarnessFacts
+    $after = New-CcodHarnessFacts
+    $after.installRootPresent = $false
+    $after.appPresent = $false
+    $after.runtimeRootPresent = $false
+    $after.activePointerPresent = $false
+    $after.activeRuntimeId = $null
+    $after.activeGeneration = $null
+    $after.runtimeManifestSha256 = $null
+    $after.runtimeManifestFiles = @()
+    $after.supervisor = @()
+    $after.trayHost = @()
+    $after.trayHostIdentity = $null
+    $after.trayAuthenticated = $false
+    $after.installReady = $false
+    $after.protectionReady = $false
+    $after.codex = @()
+    $after.taskState = 'Absent'
+    $after.statusPhase = 'Unavailable'
+    $after.statusRuntimeId = $null
+    $after.statusCodex = $null
+    $after.transitionStage = 'Unavailable'
+    $after.lifecycleReceipt = $null
+    $after.aboutVersion = $null
+    $after.shortcuts = [pscustomobject]@{ startMenu = $false; desktop = $false }
+    $after.debugPorts = @()
+    $after.debugEndpoints = @()
+    $afterKey = $after.deviceKeySha256
+    $observedArgument = 'unset'
+    $listenerProbes = 0
+    $context = [pscustomobject]@{ scenario = 'DirectUninstall'; expectedVersion = '2.5.0'; expectedDebugPorts = @(9229,9230); installRoot = 'C:\Fake\Install' }
+    $verification = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after -ObservedExpectedDebugPorts ([ref]$observedArgument) -ObservedUninstallEnumeration ([ref]$listenerProbes)
+    Assert-CcodEqual 'none' $observedArgument 'removed status is not treated as a current runtime port declaration'
+    Assert-CcodTrue $verification.verified 'empty uninstall state is a valid terminal observation'
+    Assert-CcodEqual $afterKey $verification.facts.deviceKeySha256 'uninstall preserves the existing device-key identity'
+    Assert-CcodEqual 1 $listenerProbes 'terminal verification independently enumerates the captured ports'
+    foreach ($port in @(9229,9230)) { foreach ($address in @('127.0.0.1','0.0.0.0','::','192.0.2.1')) {
+        $listener = [pscustomobject]@{ LocalAddress = $address; LocalPort = [uint16]$port; OwningProcess = [uint32]4 }
+        $residual = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after -PostUninstallListeners @($listener)
+        Assert-CcodEqual $false $residual.verified 'any remaining listener on a captured port blocks uninstall verification'
+        Assert-CcodEqual 'CCOD_INTEGRATION_OBSERVATION_UNPROVEN' $residual.code 'remaining listener is not a completed uninstall'
+    } }
+    $context.expectedDebugPorts = @()
+    $cannotSuppress = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after -PostUninstallListeners @([pscustomobject]@{ LocalPort = [uint16]9230 })
+    Assert-CcodEqual $false $cannotSuppress.verified 'empty caller hints cannot suppress the pre-uninstall observation'
+    $context.expectedDebugPorts = @(9229,9230)
+    foreach ($invalidPorts in @(@('9229',9230),@([double]9229,9230),@(9229,9229))) {
+        $invalidBefore = $before.PSObject.Copy()
+        $invalidBefore.debugPorts = $invalidPorts
+        Assert-CcodThrows { Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $invalidBefore -AfterFacts $after } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+    }
+    $unrelated = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after -PostUninstallListeners @([pscustomobject]@{ LocalAddress = '::'; LocalPort = [uint16]443; OwningProcess = [uint32]4 })
+    Assert-CcodTrue $unrelated.verified 'unrelated listeners do not prevent proof that captured ports are closed'
+    Assert-CcodThrows { Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after -FailUninstallEnumeration } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+}
+
+Invoke-CcodTest 'accepts a FreshRestart verification with ports discovered only after a clean uninstall' {
+    . $harnessPath -Library
+    $before = New-CcodHarnessFacts -CodexPid 10664
+    $before.debugPorts = @()
+    $before.debugEndpoints = @()
+    $after = New-CcodHarnessFacts
+    $context = [pscustomobject]@{ scenario = 'FreshRestart'; expectedVersion = '2.5.0'; installRoot = 'C:\Fake\Install' }
+    $verification = Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after
+    Assert-CcodEqual $true $verification.verified 'FreshInstall can establish its new debug-port set after uninstall'
+}
+
+Invoke-CcodTest 'rejects an active runtime with a zero generation' {
+    . $harnessPath -Library
+    $facts = New-CcodHarnessFacts
+    $facts.activeGeneration = [UInt64]0
+    Assert-CcodThrows { ConvertTo-CcodInstalledLifecycleFacts -Facts $facts } 'CCOD_INTEGRATION_FACTS_INVALID'
+}
+
+Invoke-CcodTest 'rejects non-boolean runtime-root and active-pointer presence facts' {
+    . $harnessPath -Library
+    $facts = New-CcodHarnessFacts
+    $facts.runtimeRootPresent = 'true'
+    Assert-CcodThrows { ConvertTo-CcodInstalledLifecycleFacts -Facts $facts } 'CCOD_INTEGRATION_FACTS_INVALID'
+    $facts = New-CcodHarnessFacts
+    $facts.activePointerPresent = 1
+    Assert-CcodThrows { ConvertTo-CcodInstalledLifecycleFacts -Facts $facts } 'CCOD_INTEGRATION_FACTS_INVALID'
+}
+
+Invoke-CcodTest 'rejects dot-only active runtime IDs at the facts boundary' {
+    . $harnessPath -Library
+    $facts = New-CcodHarnessFacts
+    $facts.activeRuntimeId = '..'
+    Assert-CcodThrows { ConvertTo-CcodInstalledLifecycleFacts -Facts $facts } 'CCOD_INTEGRATION_FACTS_INVALID'
+}
+
 Invoke-CcodTest 'rejects FreshRestart when the fully correlated after root is unchanged from before' {
     . $harnessPath -Library
-    $root = Join-Path $env:TEMP ('ccod-installed-unchanged-root-' + [guid]::NewGuid().ToString('N'))
+    $after=New-CcodHarnessFacts -RuntimeId '2.5.22-after' -CodexPid 13948 -CodexCreationTimeUtc '2026-08-24T00:00:04.0000006Z'
+    $before=New-CcodHarnessFacts -RuntimeId '2.5.21-before' -CodexPid 10664 -CodexCreationTimeUtc '2026-08-24T00:00:00.0000000Z'
+    $context=[pscustomobject]@{scenario='FreshRestart';expectedVersion='2.5.0';installRoot='C:\fixture'}
+    $positive=Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after
+    Assert-CcodTrue $positive.verified 'fully valid new-root baseline passes before the single identity mutation'
+    $before.codex=@($after.codex)
+    $negative=Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after
+    Assert-CcodEqual $false $negative.verified 'only unchanged root makes the complete baseline invalid'
+    Assert-CcodEqual 'CCOD_INTEGRATION_OBSERVATION_UNPROVEN' $negative.code 'unchanged root uses stable rejection'
+    $original=${function:Test-CcodInstalledLifecycleScenario}
     try {
-        $null = [IO.Directory]::CreateDirectory($root)
-        $unchangedPid=13948;$unchangedCreation='2026-08-24T00:00:04.0000000Z'
-        New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-new' -ActiveGeneration ([UInt64]8) `
-            -StatusRuntimeId '2.5.21-new' -StatusCodexPid $unchangedPid -StatusCodexCreationTimeUtc $unchangedCreation -ReceiptPhase 'Completed'
-        Set-CcodHarnessProcessFixture -ChatGPT @(
-            (New-CcodHarnessCimProcess -Name 'ChatGPT.exe' -ProcessId $unchangedPid -CreationTimeUtc $unchangedCreation -CommandLine '"C:\Program Files\WindowsApps\OpenAI.Codex\ChatGPT.exe"')
-        )
-        $after=Get-CcodInstalledLifecycleFacts -InstallRoot $root
-        $after.appPresent=$true;$after.aboutVersion='2.5.0';$after.deviceKeyPresent=$true;$after.deviceKeySha256=('b'*64)
-        $before=New-CcodHarnessFacts -RuntimeId '2.5.19-old' -CodexPid $unchangedPid -CodexCreationTimeUtc $unchangedCreation
-        $context=[pscustomobject]@{scenario='FreshRestart';expectedVersion='2.5.0';installRoot=$root}
-        $verification=Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after
-        Assert-CcodEqual $false $verification.verified 'FreshRestart requires the root identity to change even when status and receipt fully correlate'
-        Assert-CcodEqual 'CCOD_INTEGRATION_OBSERVATION_UNPROVEN' $verification.code 'unchanged root rejection uses the stable observation code'
-    } finally {
-        Clear-CcodHarnessProcessFixture
-        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
-    }
+        $source=$original.ToString();$needle='$rootIdentityReplaced -and'
+        Assert-CcodEqual 1 ([regex]::Matches($source,[regex]::Escape($needle))).Count 'one identity guard is mutated in memory only'
+        Set-Item Function:Test-CcodInstalledLifecycleScenario ([scriptblock]::Create($source.Replace($needle,'$true -and')))
+        $mutant=Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after
+        Assert-CcodTrue $mutant.verified 'removing only root replacement enforcement admits the unchanged-root negative'
+    } finally {Set-Item Function:Test-CcodInstalledLifecycleScenario $original}
+    $before.codex=@([pscustomobject]@{pid=13948;creationTimeUtc='2026-08-24T00:00:04.0000005Z'})
+    Assert-CcodTrue ((Invoke-CcodHarnessWithCapturedFacts -Context $context -BeforeFacts $before -AfterFacts $after).verified) 'reused PID with different exact creation time is a replacement root'
 }
 
 Invoke-CcodTest 'requires mutation and Codex-restart consent before any adapter or filesystem action' {
@@ -650,11 +2149,82 @@ Invoke-CcodTest 'requires mutation and Codex-restart consent before any adapter
             Invoke-CcodInstalledLifecycleIntegration -InstallerPath $fixture.Installer -ExpectedVersion '2.5.0' -EvidenceRoot $fixture.EvidenceRoot -Scenario FreshRestart -AllowMachineMutation -Adapters $adapters
         } 'CCOD_INTEGRATION_CODEX_RESTART_NOT_ALLOWED'
         Assert-CcodEqual 0 $calls.Count 'restart rejection also precedes every adapter action'
+        Assert-CcodThrows {
+            Invoke-CcodInstalledLifecycleIntegration -InstallerPath $fixture.Installer -ExpectedVersion '2.5.0' -EvidenceRoot $fixture.EvidenceRoot -Scenario FreshInstall -AllowMachineMutation -Adapters $adapters
+        } 'CCOD_INTEGRATION_CODEX_RESTART_NOT_ALLOWED'
+        Assert-CcodEqual 0 $calls.Count 'FreshInstall restart rejection also precedes every adapter action'
     } finally {
         if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
     }
 }
 
+Invoke-CcodTest 'integration keeps candidate bytes immutable through scenario execution' {
+    . $harnessPath -Library
+    $fixture=New-CcodHarnessFixture
+    $calls=[Collections.Generic.List[string]]::new();$captured=$null
+    try {
+        $adapters=New-CcodHarnessAdapters -Fixture $fixture -Calls $calls -CapturedReceipt ([ref]$captured)
+        $original=$adapters.RunScenario
+        $probe=[pscustomobject]@{Attempted=0;Blocked=0;Consumed=$null}
+        $adapters.RunScenario={param($Context)
+            $probe.Attempted++
+            try{[IO.File]::WriteAllText($Context.installerPath,'changed-at-execution')}catch [IO.IOException]{$probe.Blocked++}
+            $probe.Consumed=Get-CcodTestFileSha256 $Context.installerPath
+            & $original $Context
+        }
+        $result=Invoke-CcodInstalledLifecycleIntegration -InstallerPath $fixture.Installer -ExpectedVersion '2.5.0' -EvidenceRoot $fixture.EvidenceRoot -Scenario FreshLater -AllowMachineMutation -Adapters $adapters
+        Assert-CcodEqual 1 $probe.Attempted 'test reaches real scenario execution after validation'
+        Assert-CcodEqual $fixture.InstallerHash $probe.Consumed 'scenario consumes the original candidate bytes'
+        Assert-CcodEqual 1 $probe.Blocked 'candidate overwrite is denied throughout consumption'
+        Assert-CcodEqual 'Completed' $result.outcome 'unchanged consumption remains valid'
+        [IO.File]::WriteAllText($fixture.Installer,'writable-after-execution')
+    } finally {if(Test-Path $fixture.Root){Remove-Item -LiteralPath $fixture.Root -Recurse -Force}}
+}
+
+Invoke-CcodTest 'default official phase binds its original candidate before actual integration mutation' {
+    $fixture=New-CcodHarnessFixture;$sealed=$null;$official=$null;$integration=$null
+    try {
+        $sealed=New-CcodHarnessSealedFixture
+        $official=Import-Module (Join-Path $repositoryRoot 'tests/installed/OfficialDraftAcceptance.psm1') -Force -PassThru -DisableNameChecking
+        $integration=&$official {Get-CcodOfficialDraftIntegrationModule}
+        $calls=[Collections.Generic.List[string]]::new();$captured=$null
+        $adapters=New-CcodHarnessAdapters -Fixture $fixture -Calls $calls -BeforeVersion '2.5.22' -AfterVersion '2.5.22' -CapturedReceipt ([ref]$captured)
+        $after=New-CcodHarnessFacts -Version '2.5.22'
+        $after.runtimeManifestFiles=@(([IO.File]::ReadAllText((Join-Path $sealed.Root $sealed.Names[8]))|ConvertFrom-Json).files)
+        $adapters.VerifyScenario={param($Context,$BeforeFacts,$RunResult)$calls.Add('VerifyScenario');[pscustomobject]@{verified=$true;code='CCOD_INTEGRATION_VERIFIED';facts=$after}}
+        &$integration {param($SafeAdapters)$script:CcodBoundaryAdapters=$SafeAdapters;function script:Resolve-CcodInstalledLifecycleAdapters {param($Adapters)return $script:CcodBoundaryAdapters}} $adapters
+        $context=&$official {
+            param($Root,$Evidence)
+            $assetModule=Get-CcodOfficialDraftAssetModule
+            $contract=&$assetModule {param($Root)Test-CcodExactReleaseAssetSet -AssetDirectory $Root -Version '2.5.22'} $Root
+            $candidate=ConvertTo-CcodOfficialDraftCandidate $contract
+            New-CcodOfficialDraftContext -Phase FreshInstall -AssetDirectory $Root -PreviousAssetDirectory $Root -EvidenceRoot $Evidence -Candidate $candidate -Draft ([pscustomobject]@{tag='v2.5.22';id='123'}) -PreviousSetup ([pscustomobject]@{version='2.5.21';assetSha256=('a'*64);manifestSha256=('b'*64)}) -AllowMachineMutation -AllowCodexRestart
+        } $sealed.Root $fixture.EvidenceRoot
+        $run=&$official {(Get-CcodOfficialDraftDefaultAdapters).RunPhase}
+        $control=&$run $context
+        Assert-CcodTrue $control.completed 'real default phase and real integration have a valid sealed candidate control'
+        $original=$context.candidate|ConvertTo-Json -Depth 8 -Compress
+        foreach($mode in @('Installer','Commit','OtherAsset')) {
+            $context.candidate=$original|ConvertFrom-Json
+            if($mode-ceq'Installer'){$context.candidate.assetHashes[5].sha256='1'*64}
+            elseif($mode-ceq'Commit'){$context.candidate.gitCommit='1'*40}
+            else{$context.candidate.assetHashes[2].sha256='1'*64}
+            $calls.Clear()
+            Assert-CcodThrows {&$run $context|Out-Null} 'CCOD_ACCEPTANCE_MACHINE_OPERATION_FAILED'
+            Assert-CcodTrue (-not$calls.Contains('CreateRollbackSnapshot')) ($mode+' rejects before snapshot')
+            Assert-CcodTrue (-not$calls.Contains('RunScenario')) ($mode+' rejects before machine action rather than post-operation')
+            Assert-CcodTrue (-not$calls.Contains('NewEvidenceDirectory')) ($mode+' rejects before creating success evidence')
+        }
+        $context.candidate=$original|ConvertFrom-Json
+        Assert-CcodTrue (&$run $context).completed 'failed binding releases authority for a legitimate retry'
+    } finally {
+        if($null-ne$integration){Remove-Module $integration.Name -Force -ErrorAction SilentlyContinue}
+        if($null-ne$official){Remove-Module $official.Name -Force -ErrorAction SilentlyContinue}
+        if($null-ne$sealed){foreach($root in @($sealed.Root,$sealed.Outside)){if(Test-Path $root){Remove-Item $root -Recurse -Force}}}
+        if(Test-Path $fixture.Root){Remove-Item $fixture.Root -Recurse -Force}
+    }
+}
+
 Invoke-CcodTest 'blocks a dirty checkout before snapshot or scenario execution' {
     . $harnessPath -Library
     $fixture = New-CcodHarnessFixture
@@ -720,41 +2290,187 @@ Invoke-CcodTest 'rolls back, records a redacted failure receipt, and raises a st
     }
 }
 
+Invoke-CcodTest 'rollback launches the canonical frozen installer path directly' {
+    $source = [IO.File]::ReadAllText($harnessPath)
+    Assert-CcodTrue (-not $source.Contains('Start-Process -FilePath $installer.FullName')) 'rollback uses the canonical frozen installer path returned by validation'
+}
+
+Invoke-CcodTest 'rollback validates the frozen temporary root before copying prior artifacts' {
+    $source = [IO.File]::ReadAllText($harnessPath, [Text.UTF8Encoding]::new($false))
+    $copy = $source.IndexOf('[IO.File]::Copy($previousCandidate.Path', [StringComparison]::Ordinal)
+    $safe = $source.IndexOf('Assert-CcodInstalledLifecycleSafeDirectory -Path $frozenPreviousRoot', [StringComparison]::Ordinal)
+    Assert-CcodTrue ($safe -ge 0 -and $copy -ge 0 -and $safe -lt $copy) 'frozen rollback root is checked for canonical non-reparse ancestry before copying'
+}
+
+Invoke-CcodTest 'rollback cleanup rejects a descendant reparse point before recursive deletion' {
+    . $harnessPath -Library
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-frozen-descendant-reparse-' + [guid]::NewGuid().ToString('N'))
+    $outside = Join-Path ([IO.Path]::GetTempPath()) ('ccod-frozen-descendant-outside-' + [guid]::NewGuid().ToString('N'))
+    $junction = Join-Path $root 'escape'
+    [IO.Directory]::CreateDirectory($root) | Out-Null
+    [IO.Directory]::CreateDirectory($outside) | Out-Null
+    $outsideFile = Join-Path $outside 'keep.txt'
+    [IO.File]::WriteAllText($outsideFile, 'must remain', [Text.UTF8Encoding]::new($false))
+    try {
+        New-Item -ItemType Junction -Path $junction -Target $outside | Out-Null
+        Assert-CcodThrows { Remove-CcodInstalledLifecycleFrozenRoot -Path $root } 'CCOD_INTEGRATION_ROLLBACK_CLEANUP_FAILED'
+        Assert-CcodTrue (Test-Path -LiteralPath $outsideFile -PathType Leaf) 'unsafe frozen cleanup does not touch the reparse target'
+    } finally {
+        try { if ([IO.Directory]::Exists($junction)) { [IO.Directory]::Delete($junction, $false) } } catch { }
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        if (Test-Path -LiteralPath $outside) { Remove-Item -LiteralPath $outside -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+Invoke-CcodTest 'default installed verifier preserves converter fields until the integration boundary' {
+    $source = [IO.File]::ReadAllText($harnessPath)
+    $removeDebug = $source.IndexOf("if (`$afterFacts.PSObject.Properties['debugPorts']) { `$afterFacts.PSObject.Properties.Remove('debugPorts') }")
+    $callerConvert = $source.IndexOf('$verification = [pscustomobject][ordered]@{')
+    Assert-CcodTrue ($removeDebug -lt 0 -or $callerConvert -lt $removeDebug) 'default verifier does not remove mandatory debug fields before the caller converter'
+}
+
 Invoke-CcodTest 'accepts an exact checksum-bound v2.5.21 installer as the source of a v2.5.22 upgrade run' {
     . $harnessPath -Library
     $fixture = New-CcodHarnessFixture
+    $sealed=$null
     try {
-        $current = New-CcodHarnessCandidate -Fixture $fixture -Version '2.5.22' -Bytes ([byte[]](9,8,7,6,5,4,3,2))
+        $sealed=New-CcodHarnessSealedFixture
+        $current=Join-Path $sealed.Root $sealed.Names[5]
+        $package=[IO.File]::ReadAllText((Join-Path $sealed.Root $sealed.Names[8]))|ConvertFrom-Json
         $legacy = New-CcodHarnessCandidate -Fixture $fixture -Version '2.5.21' -Bytes ([byte[]](2,3,5,7,11,13,17,19))
+        $legacyManifest = Join-Path $fixture.Root 'CodexRemote-fix-2.5.21-setup-release-manifest.json'
+        [IO.File]::WriteAllText($legacyManifest, 'legacy release manifest', [Text.UTF8Encoding]::new($false))
+        $legacyInstallerHash = Get-CcodTestFileSha256 -Path $legacy
+        $legacyManifestHash = Get-CcodTestFileSha256 -Path $legacyManifest
         $calls = [Collections.Generic.List[string]]::new()
         $captured = $null
-        $adapters = New-CcodHarnessAdapters -Fixture $fixture -Calls $calls -CapturedReceipt ([ref]$captured)
-        $receipt = Invoke-CcodInstalledLifecycleIntegration -InstallerPath $current -PreviousInstallerPath $legacy -ExpectedVersion '2.5.22' -EvidenceRoot $fixture.EvidenceRoot -Scenario Upgrade -AllowMachineMutation -AllowCodexRestart -Adapters $adapters
+        $adapters = New-CcodHarnessAdapters -Fixture $fixture -Calls $calls -BeforeVersion '2.5.21' -AfterVersion '2.5.22' -CapturedReceipt ([ref]$captured)
+        $after=New-CcodHarnessFacts -Version '2.5.22';$after.runtimeManifestFiles=@($package.files)
+        $adapters.VerifyScenario={param($Context,$BeforeFacts,$RunResult)$calls.Add('VerifyScenario');[pscustomobject]@{verified=$true;code='CCOD_INTEGRATION_VERIFIED';facts=$after}}
+        $receipt = Invoke-CcodInstalledLifecycleIntegration -InstallerPath $current -PreviousInstallerPath $legacy -PreviousExpectedVersion '2.5.21' -PreviousInstallerSha256 $legacyInstallerHash -PreviousManifestSha256 $legacyManifestHash -ExpectedVersion '2.5.22' -EvidenceRoot $fixture.EvidenceRoot -Scenario Upgrade -AllowMachineMutation -AllowCodexRestart -Adapters $adapters
         Assert-CcodEqual 'Completed' ([string]$receipt.outcome) 'v2.5.21 to v2.5.22 reaches the fake installed verification boundary'
+        Assert-CcodTrue ($receipt.beforeFacts.PSObject.Properties['debugPorts'] -and $receipt.beforeFacts.PSObject.Properties['debugEndpoints']) 'upgrade evidence retains the observed pre-operation debug endpoints'
+        Assert-CcodTrue ($receipt.verification.facts.PSObject.Properties['debugPorts'] -and $receipt.verification.facts.PSObject.Properties['debugEndpoints']) 'upgrade evidence retains the observed post-operation debug endpoints'
         Assert-CcodEqual (Get-CcodTestFileSha256 -Path $legacy) ([string]$receipt.previousInstallerSha256) 'upgrade evidence binds the exact v2.5.21 installer bytes'
+        [IO.File]::WriteAllBytes($legacy, [byte[]](31,29,27,25,23,21,19,17))
+        $replacementHash = Get-CcodTestFileSha256 -Path $legacy
+        [IO.File]::WriteAllText("$legacy.sha256.txt", ("{0} *{1}`r`n" -f $replacementHash, [IO.Path]::GetFileName($legacy)), [Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows {
+            Invoke-CcodInstalledLifecycleIntegration -InstallerPath $current -PreviousInstallerPath $legacy -PreviousExpectedVersion '2.5.21' -PreviousInstallerSha256 $legacyInstallerHash -PreviousManifestSha256 $legacyManifestHash -ExpectedVersion '2.5.22' -EvidenceRoot $fixture.EvidenceRoot -Scenario Upgrade -AllowMachineMutation -AllowCodexRestart -Adapters $adapters
+        } 'CCOD_INTEGRATION_PREVIOUS_INSTALLER_INVALID'
+        Assert-CcodTrue ($replacementHash -cne $legacyInstallerHash) 'replacement fixture changes the prior installer bytes'
         Assert-CcodTrue ($calls -contains 'CreateRollbackSnapshot') 'legacy upgrade captures rollback state before the adapted scenario'
         Assert-CcodTrue ($calls -contains 'VerifyScenario') 'legacy upgrade still requires independent installed verification'
+        Assert-CcodEqual 'CaptureFacts:2.5.21' ((@($calls | Where-Object { [string]$_ -like 'CaptureFacts:*' }) -join '|')) 'upgrade observes the retained v2.5.21 state before invoking the v2.5.22 operation'
+    } finally {
+        if($null-ne$sealed){foreach($root in @($sealed.Root,$sealed.Outside)){if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force}}}
+        if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'rejects a self-consistent active runtime whose payload file set is detached from the candidate' {
+    . $harnessPath -Library
+    $fixture = New-CcodHarnessFixture
+    $sealed=$null
+    try {
+        $sealed=New-CcodHarnessSealedFixture
+        $current=Join-Path $sealed.Root $sealed.Names[5]
+        $package=[IO.File]::ReadAllText((Join-Path $sealed.Root $sealed.Names[8]))|ConvertFrom-Json
+        $calls = [Collections.Generic.List[string]]::new()
+        $adapters = New-CcodHarnessAdapters -Fixture $fixture -Calls $calls -BeforeVersion '2.5.21' -AfterVersion '2.5.22' -CapturedReceipt ([ref]$null)
+        $state=[pscustomobject]@{After=(New-CcodHarnessFacts -Version '2.5.22')}
+        $state.After.runtimeManifestFiles=@($package.files)
+        $adapters.VerifyScenario={param($Context,$BeforeFacts,$RunResult)$calls.Add('VerifyScenario');[pscustomobject]@{verified=$true;code='CCOD_INTEGRATION_VERIFIED';facts=$state.After}}
+        $control=Invoke-CcodInstalledLifecycleIntegration -InstallerPath $current -ExpectedVersion '2.5.22' -EvidenceRoot $fixture.EvidenceRoot -Scenario FreshLater -AllowMachineMutation -AllowCodexRestart -Adapters $adapters
+        Assert-CcodEqual 'Completed' $control.outcome 'sealed candidate and matching runtime records pass before one file changes'
+        $state.After.runtimeManifestFiles[0].sha256='f'*64
+        Assert-CcodThrows {
+            Invoke-CcodInstalledLifecycleIntegration -InstallerPath $current -ExpectedVersion '2.5.22' -EvidenceRoot $fixture.EvidenceRoot -Scenario FreshLater -AllowMachineMutation -AllowCodexRestart -Adapters $adapters
+        } 'CCOD_INTEGRATION_VERIFICATION_FAILED'
     } finally {
+        if($null-ne$sealed){foreach($root in @($sealed.Root,$sealed.Outside)){if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force}}}
         if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
     }
 }
 
+Invoke-CcodTest 'upgrade rollback routes through a frozen previous installer identity' {
+    . $harnessPath -Library
+    $fixture = New-CcodHarnessFixture
+    try {
+        $current = New-CcodHarnessCandidate -Fixture $fixture -Version '2.5.0' -Bytes ([byte[]](9,8,7,6,5,4,3,2))
+        $previous = New-CcodHarnessCandidate -Fixture $fixture -Version '2.4.24' -Bytes ([byte[]](2,3,5,7,11,13,17,19))
+        $previousManifest = Join-Path $fixture.Root 'CodexRemote-fix-2.4.24-setup-release-manifest.json'
+        [IO.File]::WriteAllText($previousManifest, 'previous release manifest', [Text.UTF8Encoding]::new($false))
+        $previousInstallerHash = Get-CcodTestFileSha256 -Path $previous
+        $previousManifestHash = Get-CcodTestFileSha256 -Path $previousManifest
+        $calls = [Collections.Generic.List[string]]::new()
+        $captured = $null
+        $adapters = New-CcodHarnessAdapters -Fixture $fixture -Calls $calls -FailScenario -ReplacePreviousAfterValidation $previous -RecordRollbackIdentity -CapturedReceipt ([ref]$captured)
+        Assert-CcodThrows {
+            Invoke-CcodInstalledLifecycleIntegration -InstallerPath $current -PreviousInstallerPath $previous -PreviousExpectedVersion '2.4.24' -PreviousInstallerSha256 $previousInstallerHash -PreviousManifestSha256 $previousManifestHash -ExpectedVersion '2.5.0' -EvidenceRoot $fixture.EvidenceRoot -Scenario Upgrade -AllowMachineMutation -AllowCodexRestart -Adapters $adapters
+        } 'CCOD_INTEGRATION_SCENARIO_FAILED'
+        $rollbackPath = @($calls | Where-Object { [string]$_ -like 'RollbackPath:*' })[0].Substring(13)
+        $rollbackHash = @($calls | Where-Object { [string]$_ -like 'RollbackHash:*' })[0].Substring(13)
+        Assert-CcodTrue (-not [string]::IsNullOrWhiteSpace($rollbackPath)) 'failed upgrade enters rollback with an explicit previous installer'
+        Assert-CcodEqual $previousInstallerHash $rollbackHash 'rollback uses the byte identity validated before the scenario'
+        Assert-CcodTrue ($rollbackPath -cne $previous) 'rollback does not launch the mutable source path'
+    } finally {
+        if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'frozen rollback bytes remain held until their actual consumer returns' {
+    . $harnessPath -Library
+    $fixture=New-CcodHarnessFixture
+    $originalStart=${function:Start-Process};$originalAck=${function:Read-CcodInstalledLifecycleOperatorAck}
+    try {
+        $previous=New-CcodHarnessCandidate -Fixture $fixture -Version '2.4.24'
+        $manifest=Join-Path $fixture.Root 'CodexRemote-fix-2.4.24-setup-release-manifest.json'
+        [IO.File]::WriteAllText($manifest,'original previous manifest')
+        $expected=Get-CcodTestFileSha256 $previous;$manifestHash=Get-CcodTestFileSha256 $manifest
+        $calls=[Collections.Generic.List[string]]::new();$captured=$null
+        $adapters=New-CcodHarnessAdapters -Fixture $fixture -Calls $calls -FailScenario -CapturedReceipt ([ref]$captured)
+        $probe=[pscustomobject]@{Attempts=0;Blocked=0;Consumed=$null;Path=$null;Manifest=$null}
+        $adapters.Rollback={param($Context,$Snapshot)$probe.Manifest=$Context.previousManifestPath;Invoke-CcodInstalledLifecycleRollback -Context $Context -Snapshot $Snapshot}
+        function Start-Process {param($FilePath,[switch]$PassThru,[switch]$Wait,$ErrorAction)
+            $probe.Attempts++;$probe.Path=$FilePath
+            foreach($path in @($FilePath,$probe.Manifest)){try{[IO.File]::WriteAllText($path,'changed before rollback launch')}catch [IO.IOException]{$probe.Blocked++}}
+            $probe.Consumed=Get-CcodTestFileSha256 $FilePath
+            [pscustomobject]@{ExitCode=0}
+        }
+        function Read-CcodInstalledLifecycleOperatorAck {param($Scenario,$Instructions)}
+        Assert-CcodThrows {Invoke-CcodInstalledLifecycleIntegration -InstallerPath $fixture.Installer -PreviousInstallerPath $previous -PreviousExpectedVersion '2.4.24' -PreviousInstallerSha256 $expected -PreviousManifestSha256 $manifestHash -ExpectedVersion '2.5.0' -EvidenceRoot $fixture.EvidenceRoot -Scenario Upgrade -AllowMachineMutation -AllowCodexRestart -Adapters $adapters|Out-Null} 'CCOD_INTEGRATION_SCENARIO_FAILED'
+        Assert-CcodEqual 1 $probe.Attempts 'real rollback reaches the native launch seam'
+        Assert-CcodEqual $expected $probe.Consumed 'rollback consumes only originally frozen executable bytes'
+        Assert-CcodEqual 2 $probe.Blocked 'both executable and manifest remain held through launch'
+        Assert-CcodTrue $captured.rollback.completed 'rollback itself completes while the original scenario stays failed'
+        Assert-CcodTrue (-not(Test-Path -LiteralPath (Split-Path $probe.Path -Parent))) 'all holds release before frozen directory cleanup'
+    } finally {
+        foreach($pair in @(@('Start-Process',$originalStart),@('Read-CcodInstalledLifecycleOperatorAck',$originalAck))){if($null-ne$pair[1]){Set-Item ('Function:'+$pair[0]) $pair[1]}else{Remove-Item ('Function:'+$pair[0]) -ErrorAction SilentlyContinue}}
+        if(Test-Path $fixture.Root){Remove-Item $fixture.Root -Recurse -Force}
+    }
+}
+
 Invoke-CcodTest 'accepts only a distinct checksum-bound prior installer for an upgrade rollback path' {
     . $harnessPath -Library
     $fixture = New-CcodHarnessFixture
     try {
         $previous = New-CcodHarnessCandidate -Fixture $fixture -Version '2.4.24'
+        $previousManifest = Join-Path $fixture.Root 'CodexRemote-fix-2.4.24-setup-release-manifest.json'
+        [IO.File]::WriteAllText($previousManifest, 'previous release manifest', [Text.UTF8Encoding]::new($false))
+        $previousInstallerHash = Get-CcodTestFileSha256 -Path $previous
+        $previousManifestHash = Get-CcodTestFileSha256 -Path $previousManifest
         $calls = [Collections.Generic.List[string]]::new()
         $captured = $null
         $adapters = New-CcodHarnessAdapters -Fixture $fixture -Calls $calls -CapturedReceipt ([ref]$captured)
-        $receipt = Invoke-CcodInstalledLifecycleIntegration -InstallerPath $fixture.Installer -PreviousInstallerPath $previous -ExpectedVersion '2.5.0' -EvidenceRoot $fixture.EvidenceRoot -Scenario Upgrade -AllowMachineMutation -AllowCodexRestart -Adapters $adapters
+        $receipt = Invoke-CcodInstalledLifecycleIntegration -InstallerPath $fixture.Installer -PreviousInstallerPath $previous -PreviousExpectedVersion '2.4.24' -PreviousInstallerSha256 $previousInstallerHash -PreviousManifestSha256 $previousManifestHash -ExpectedVersion '2.5.0' -EvidenceRoot $fixture.EvidenceRoot -Scenario Upgrade -AllowMachineMutation -AllowCodexRestart -Adapters $adapters
         Assert-CcodEqual 'Completed' ([string]$receipt.outcome) 'distinct prior installer can support a checked upgrade run'
         Assert-CcodThrows {
-            Invoke-CcodInstalledLifecycleIntegration -InstallerPath $fixture.Installer -PreviousInstallerPath $fixture.Installer -ExpectedVersion '2.5.0' -EvidenceRoot $fixture.EvidenceRoot -Scenario Upgrade -AllowMachineMutation -AllowCodexRestart -Adapters $adapters
+            Invoke-CcodInstalledLifecycleIntegration -InstallerPath $fixture.Installer -PreviousInstallerPath $fixture.Installer -PreviousExpectedVersion '2.4.24' -PreviousInstallerSha256 $previousInstallerHash -PreviousManifestSha256 $previousManifestHash -ExpectedVersion '2.5.0' -EvidenceRoot $fixture.EvidenceRoot -Scenario Upgrade -AllowMachineMutation -AllowCodexRestart -Adapters $adapters
         } 'CCOD_INTEGRATION_PREVIOUS_INSTALLER_INVALID'
         $future = New-CcodHarnessCandidate -Fixture $fixture -Version '2.5.1'
         Assert-CcodThrows {
-            Invoke-CcodInstalledLifecycleIntegration -InstallerPath $fixture.Installer -PreviousInstallerPath $future -ExpectedVersion '2.5.0' -EvidenceRoot $fixture.EvidenceRoot -Scenario Upgrade -AllowMachineMutation -AllowCodexRestart -Adapters $adapters
+            Invoke-CcodInstalledLifecycleIntegration -InstallerPath $fixture.Installer -PreviousInstallerPath $future -PreviousExpectedVersion '2.4.24' -PreviousInstallerSha256 $previousInstallerHash -PreviousManifestSha256 $previousManifestHash -ExpectedVersion '2.5.0' -EvidenceRoot $fixture.EvidenceRoot -Scenario Upgrade -AllowMachineMutation -AllowCodexRestart -Adapters $adapters
         } 'CCOD_INTEGRATION_PREVIOUS_INSTALLER_INVALID'
     } finally {
         if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
@@ -779,4 +2495,180 @@ Invoke-CcodTest 'rejects an installer checksum mismatch before snapshot or scena
     }
 }
 
+Invoke-CcodTest 'rejects a noncanonical installer path before candidate validation' {
+    . $harnessPath -Library
+    $fixture = New-CcodHarnessFixture
+    try {
+        $calls = [Collections.Generic.List[string]]::new()
+        $captured = $null
+        $adapters = New-CcodHarnessAdapters -Fixture $fixture -Calls $calls -CapturedReceipt ([ref]$captured)
+        $nonCanonical = Join-Path $fixture.Root 'nested\..\CodexRemote-fix-2.5.0-setup.exe'
+        Assert-CcodThrows {
+            Get-CcodInstalledLifecycleCandidate -Path $nonCanonical -ExpectedVersion '2.5.0' -Adapters $adapters -Kind 'Installer' | Out-Null
+        } 'CCOD_INTEGRATION_CANDIDATE_INVALID'
+    } finally {
+        if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'rejects noncanonical installed observation paths instead of normalizing them' {
+    . $harnessPath -Library
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-integration-canonical-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        Set-CcodHarnessProcessFixture -ChatGPT @()
+        $probe = { param($Path) throw [IO.FileNotFoundException]::new('fixture missing',$Path) }
+        Assert-CcodThrows {
+            Get-CcodInstalledLifecycleOptionalDirectoryState -Path (Join-Path $root '.\missing') -GetItem $probe | Out-Null
+        } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+        Assert-CcodThrows {
+            Get-CcodInstalledLifecycleFacts -InstallRoot (Join-Path $root '.')
+        } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+    } finally {
+        Clear-CcodHarnessProcessFixture
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'installed lifecycle optional directory probe fails closed on access errors' {
+    . $harnessPath -Library
+    $probe = { param($Path) throw [UnauthorizedAccessException]::new('fixture access denied') }
+    Assert-CcodThrows { Get-CcodInstalledLifecycleOptionalDirectoryState -Path 'C:\fixture\blocked' -GetItem $probe | Out-Null } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+}
+
+Invoke-CcodTest 'installed lifecycle optional missing leaves reject a reparse parent' {
+    . $harnessPath -Library
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-integration-reparse-' + [guid]::NewGuid().ToString('N'))
+    $outside = Join-Path ([IO.Path]::GetTempPath()) ('ccod-integration-reparse-target-' + [guid]::NewGuid().ToString('N'))
+    $junction = Join-Path $root 'state-link'
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        [IO.Directory]::CreateDirectory($outside) | Out-Null
+        New-Item -ItemType Junction -Path $junction -Target $outside | Out-Null
+        $probe = { param($Path) Get-Item -LiteralPath $Path -Force -ErrorAction Stop }
+        Assert-CcodThrows { Get-CcodInstalledLifecycleOptionalRegularFileState -Path (Join-Path $junction 'missing.json') -GetItem $probe | Out-Null } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+    } finally {
+        if ([IO.Directory]::Exists($junction)) { [IO.Directory]::Delete($junction) }
+        if ([IO.Directory]::Exists($root)) { [IO.Directory]::Delete($root, $true) }
+        if ([IO.Directory]::Exists($outside)) { [IO.Directory]::Delete($outside, $true) }
+    }
+}
+
+Invoke-CcodTest 'installed lifecycle default evidence writer cleans a failed readback' {
+    . $harnessPath -Library
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-evidence-readback-' + [guid]::NewGuid().ToString('N'))
+    $receipt = [pscustomobject][ordered]@{ schemaVersion = 1; transactionId = 'fixture-readback'; outcome = 'Completed' }
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $defaults = Get-CcodInstalledLifecycleDefaultAdapters
+        $directory = & $defaults.NewEvidenceDirectory $root 'fixture-readback'
+        $verifier = { param($Path) [IO.File]::WriteAllText($Path, 'tampered', [Text.UTF8Encoding]::new($false)); return $false }
+        Assert-CcodThrows { & $defaults.WriteEvidence $directory $receipt $verifier | Out-Null } 'CCOD_INTEGRATION_EVIDENCE_CLEANUP_FAILED'
+        Assert-CcodTrue ([IO.File]::Exists((Join-Path $directory 'receipt.json'))) 'unknown replacement evidence remains for manual cleanup'
+    } finally {
+        if ([IO.Directory]::Exists($root)) { [IO.Directory]::Delete($root, $true) }
+    }
+}
+
+Invoke-CcodTest 'installed lifecycle rejects unreadable Supervisor and TrayHost identity fields' {
+    . $harnessPath -Library
+    Assert-CcodThrows { Assert-CcodInstalledLifecycleReadableProcessText -Value $null -Kind 'Supervisor CommandLine' } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+    Assert-CcodThrows { Assert-CcodInstalledLifecycleReadableProcessText -Value ([pscustomobject]@{}) -Kind 'TrayHost ExecutablePath' } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+}
+
+Invoke-CcodTest 'installed lifecycle clean checkout includes ignored contamination' {
+    $raw = [IO.File]::ReadAllText($harnessPath, [Text.UTF8Encoding]::new($false))
+    Assert-CcodTrue ($raw.Contains('--ignored=matching')) 'default Git status includes ignored contamination'
+}
+
+Invoke-CcodTest 'installed lifecycle accepts schema-one legacy active json' {
+    . $harnessPath -Library
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-legacy-active-json-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $legacyRuntime = '2.5.21-e3b0c44298fc1c14'
+        [IO.File]::WriteAllText((Join-Path $root 'active.json'), ([ordered]@{ schemaVersion = 1; activeRuntime = $legacyRuntime; previousRuntime = $null; updatedAtUtc = '2030-02-03T04:05:06.0000000Z' } | ConvertTo-Json -Compress), [Text.UTF8Encoding]::new($false))
+        $active = Read-CcodInstalledLifecycleActiveFact -InstallRoot $root
+        Assert-CcodEqual $legacyRuntime $active.activeRuntime 'legacy active runtime id is retained'
+        Assert-CcodEqual ([UInt64]1) ([UInt64]$active.generation) 'schema-one active pointer maps to generation one'
+    } finally { if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force } }
+}
+
+Invoke-CcodTest 'installed lifecycle rejects an invalid UTC start clock before mutation' {
+    . $harnessPath -Library
+    $fixture = New-CcodHarnessFixture
+    try {
+        $calls = [Collections.Generic.List[string]]::new()
+        $adapters = New-CcodHarnessAdapters -Fixture $fixture -Calls $calls
+        $adapters.GetUtcNow = { [datetime]::SpecifyKind([datetime]::MinValue,[DateTimeKind]::Utc) }
+        Assert-CcodThrows {
+            Invoke-CcodInstalledLifecycleIntegration -InstallerPath $fixture.Installer -ExpectedVersion '2.5.0' -EvidenceRoot $fixture.EvidenceRoot -Scenario FreshRestart -AllowMachineMutation -AllowCodexRestart -Adapters $adapters
+        } 'CCOD_INTEGRATION_CLOCK_INVALID'
+        Assert-CcodTrue (-not ($calls -contains 'RunScenario')) 'invalid start clock cannot run a machine scenario'
+    } finally {
+        if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'installed lifecycle rejects an invalid completion clock instead of substituting the current time' {
+    . $harnessPath -Library
+    $fixture = New-CcodHarnessFixture
+    try {
+        $calls = [Collections.Generic.List[string]]::new()
+        $adapters = New-CcodHarnessAdapters -Fixture $fixture -Calls $calls
+        $global:CcodLifecycleCompletionClockCalls = 0
+        $adapters.GetUtcNow = {
+            $global:CcodLifecycleCompletionClockCalls++
+            if ($global:CcodLifecycleCompletionClockCalls -eq 1) { return [datetime]::UtcNow }
+            return 'not-a-date'
+        }
+        Assert-CcodThrows {
+            Invoke-CcodInstalledLifecycleIntegration -InstallerPath $fixture.Installer -ExpectedVersion '2.5.0' -EvidenceRoot $fixture.EvidenceRoot -Scenario FreshRestart -AllowMachineMutation -AllowCodexRestart -Adapters $adapters
+        } 'CCOD_INTEGRATION_CLOCK_INVALID'
+    } finally {
+        Remove-Variable -Name CcodLifecycleCompletionClockCalls -Scope Global -ErrorAction SilentlyContinue
+        if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+    }
+}
+
+Invoke-CcodTest 'installed lifecycle rejects an unsafe schema-one active runtime before path use' {
+    . $harnessPath -Library
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-legacy-unsafe-active-json-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $legacy = [ordered]@{ schemaVersion = 1; activeRuntime = '..'; previousRuntime = $null; updatedAtUtc = '2030-02-03T04:05:06.0000000Z' }
+        [IO.File]::WriteAllText((Join-Path $root 'active.json'), ($legacy | ConvertTo-Json -Compress), [Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows { Read-CcodInstalledLifecycleActiveFact -InstallRoot $root | Out-Null } 'CCOD_INTEGRATION_FACTS_INVALID'
+    } finally { if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force } }
+}
+
+Invoke-CcodTest 'installed lifecycle accepts the documented two-part v2.5.21 runtime identity' {
+    . $harnessPath -Library
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-legacy-runtime-' + [guid]::NewGuid().ToString('N'))
+    try {
+        $runtime = Join-Path $root 'runtime'
+        [IO.Directory]::CreateDirectory($runtime) | Out-Null
+        $payload = Join-Path $runtime 'payload.txt'
+        [IO.File]::WriteAllText($payload, 'legacy payload', [Text.UTF8Encoding]::new($false))
+        $length = [int64](Get-Item -LiteralPath $payload).Length
+        $sha = Get-CcodInstalledLifecycleHash -Path $payload
+        $canonical = 'payload.txt`t{0}`t{1}' -f $length,$sha
+        $digestAlgorithm = [Security.Cryptography.SHA256]::Create()
+        try { $digest = ([BitConverter]::ToString($digestAlgorithm.ComputeHash([Text.Encoding]::UTF8.GetBytes($canonical)))).Replace('-','').ToLowerInvariant() } finally { $digestAlgorithm.Dispose() }
+        $runtimeId = '2.5.21-' + $digest.Substring(0,16)
+        $manifest = [pscustomobject][ordered]@{ schemaVersion = 1; projectVersion = '2.5.21'; runtimeId = $runtimeId; files = @([pscustomobject][ordered]@{ path = 'payload.txt'; length = $length; sha256 = $sha }) }
+        [IO.File]::WriteAllText((Join-Path $runtime 'manifest.json'), ($manifest | ConvertTo-Json -Depth 8), [Text.UTF8Encoding]::new($false))
+        $result = Assert-CcodInstalledLifecycleRuntimeManifest -Manifest $manifest -ExpectedVersion '2.5.21' -ExpectedRuntimeId $runtimeId -RuntimeRoot $runtime
+        Assert-CcodEqual $runtimeId $result.runtimeId 'legacy two-part runtime identity is accepted only for v2.5.21'
+    } finally { if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force } }
+}
+
+Invoke-CcodTest 'installed lifecycle runtime manifest binds schema version project version and runtime id' {
+    . $harnessPath -Library
+    $manifest = [pscustomobject][ordered]@{ schemaVersion = 1; projectVersion = '2.5.21'; runtimeId = '2.5.22-aaaaaaaaaaaaaaaa-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'; files = @() }
+    Assert-CcodThrows { Assert-CcodInstalledLifecycleRuntimeManifest -Manifest $manifest -ExpectedVersion '2.5.22' -ExpectedRuntimeId $manifest.runtimeId } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+    $mismatch = [pscustomobject][ordered]@{ schemaVersion = 1; projectVersion = '2.5.22'; runtimeId = '2.5.21-aaaaaaaaaaaaaaaa'; files = @() }
+    Assert-CcodThrows { Assert-CcodInstalledLifecycleRuntimeManifest -Manifest $mismatch -ExpectedVersion '2.5.22' -ExpectedRuntimeId $mismatch.runtimeId } 'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE'
+}
+
 Write-Host 'Installed lifecycle harness self-tests passed.'
diff --git a/tests/persistence/LegacyReleaseFixture.ps1 b/tests/persistence/LegacyReleaseFixture.ps1
new file mode 100644
index 0000000..0de3a7a
--- /dev/null
+++ b/tests/persistence/LegacyReleaseFixture.ps1
@@ -0,0 +1,35 @@
+# Offline contract data only. Nothing in this fixture may be installed or executed.
+function New-CcodLegacyReleaseFixture {
+    param([Parameter(Mandatory)][string]$Directory)
+    if (@(Get-ChildItem -LiteralPath $Directory -Force -ErrorAction Stop).Count -ne 0) { throw 'legacy fixture directory must be empty' }
+    $version='2.5.21';$commit='b'*40;$timestamp='2030-02-03T04:05:06.0000000Z'
+    $names=@('CodexRemote-fix-2.5.21-windows-x64.zip','CodexRemote-fix-2.5.21-windows-x64.zip.sha256.txt','CodexRemote-fix-2.5.21-trayhost-provenance.json','CodexRemote-fix-2.5.21-payload-manifest.json','CodexRemote-fix-2.5.21-release-manifest.json','CodexRemote-fix-2.5.21-setup.exe','CodexRemote-fix-2.5.21-setup.exe.sha256.txt','CodexRemote-fix-2.5.21-setup-release-manifest.json')
+    $work=Join-Path ([IO.Path]::GetTempPath()) ('ccod-legacy-contract-'+[guid]::NewGuid().ToString('N'))
+    $utf8=[Text.UTF8Encoding]::new($false)
+    try {
+        [IO.Directory]::CreateDirectory((Join-Path $work 'payload'))|Out-Null
+        [IO.File]::WriteAllText((Join-Path $work 'CodexRemote-fix.exe'),'inert legacy launcher fixture',$utf8)
+        [IO.File]::WriteAllText((Join-Path $work 'CodexRemote-fix.exe.config'),'<configuration/>',$utf8)
+        [IO.File]::WriteAllText((Join-Path $work 'Install-CodexRemote-fix.ps1'),'# inert legacy installer fixture',$utf8)
+        $payloadFile=Join-Path $work 'payload/fixture.txt'
+        [IO.File]::WriteAllText($payloadFile,'legacy payload fixture',$utf8)
+        $payload=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;files=@([ordered]@{path='fixture.txt';length=[long](Get-Item $payloadFile).Length;sha256=Get-CcodTestFileSha256 $payloadFile})}
+        $payloadJson=$payload|ConvertTo-Json -Depth 8
+        [IO.File]::WriteAllText((Join-Path $work 'payload-manifest.json'),$payloadJson,$utf8)
+        [IO.File]::WriteAllText((Join-Path $Directory $names[3]),$payloadJson,$utf8)
+        Add-Type -AssemblyName System.IO.Compression.FileSystem
+        [IO.Compression.ZipFile]::CreateFromDirectory($work,(Join-Path $Directory $names[0]))
+        [IO.File]::WriteAllText((Join-Path $Directory $names[1]),((Get-CcodTestFileSha256 (Join-Path $Directory $names[0]))+' *'+$names[0]),$utf8)
+        $tray=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;targetFramework='net48';compiler=[ordered]@{name='csc.exe';sha256=('1'*64)};referenceRoot='locked-net48';sourceFiles=@([ordered]@{name='AssemblyInfo.cs';sha256=('2'*64)});iconSha256=('3'*64);manifestSha256=('4'*64);configSha256=('5'*64);artifactSha256=Get-CcodTestFileSha256 (Join-Path $work 'CodexRemote-fix.exe');configArtifactSha256=Get-CcodTestFileSha256 (Join-Path $work 'CodexRemote-fix.exe.config')}
+        [IO.File]::WriteAllText((Join-Path $Directory $names[2]),($tray|ConvertTo-Json -Depth 8),$utf8)
+        $portableAssets=@(foreach($name in $names[0..3]){[ordered]@{name=$name;sha256=Get-CcodTestFileSha256 (Join-Path $Directory $name)}})
+        $portableAssets+=@(foreach($name in @('CodexRemote-fix.exe','CodexRemote-fix.exe.config')){[ordered]@{name=$name;sha256=Get-CcodTestFileSha256 (Join-Path $work $name)}})
+        $portable=[ordered]@{schemaVersion=2;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;distribution='portable-zip';assets=$portableAssets}
+        [IO.File]::WriteAllText((Join-Path $Directory $names[4]),($portable|ConvertTo-Json -Depth 8),$utf8)
+        [IO.File]::WriteAllText((Join-Path $Directory $names[5]),'inert legacy setup fixture',$utf8)
+        [IO.File]::WriteAllText((Join-Path $Directory $names[6]),((Get-CcodTestFileSha256 (Join-Path $Directory $names[5]))+' *'+$names[5]),$utf8)
+        $setup=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;assets=@(foreach($name in @($names[5],$names[6],$names[2])){[ordered]@{name=$name;sha256=Get-CcodTestFileSha256 (Join-Path $Directory $name)}})}
+        [IO.File]::WriteAllText((Join-Path $Directory $names[7]),($setup|ConvertTo-Json -Depth 8),$utf8)
+        return [pscustomobject]@{Names=$names;GitCommit=$commit;SetupSha256=Get-CcodTestFileSha256 (Join-Path $Directory $names[5]);ManifestSha256=Get-CcodTestFileSha256 (Join-Path $Directory $names[7])}
+    } finally {if(Test-Path -LiteralPath $work){Remove-Item -LiteralPath $work -Recurse -Force}}
+}
diff --git a/tests/persistence/ManualWrappers.SelfTest.ps1 b/tests/persistence/ManualWrappers.SelfTest.ps1
index 2eab7da..2ea5537 100644
--- a/tests/persistence/ManualWrappers.SelfTest.ps1
+++ b/tests/persistence/ManualWrappers.SelfTest.ps1
@@ -257,7 +257,7 @@ Invoke-CcodTest 'public uninstall wrapper rejects retired direct options and del
     Assert-CcodTrue ($commands -ccontains 'Import-Module') 'Uninstall wrapper verifies the installed portable marker through its manifest-bound module'
     foreach($forbidden in @('Remove-Item','Move-Item','Copy-Item','Invoke-CcodUninstall')){Assert-CcodTrue ($commands -cnotcontains $forbidden) "Uninstall wrapper has no direct $forbidden path"}
     $source=Get-Content -LiteralPath $uninstallPath -Raw -Encoding UTF8
-    foreach($required in @('portable-release.json','Assert-CcodPortableInstalledMarker','-Mode Prepare','PortableUninstallFinalizer.ps1')){
+    foreach($required in @('portable-release.json','Assert-CcodPortableInstalledMarker','Invoke-CcodPublicUninstallPrepare','-PrepareMode Prepare -Identity $null','Invoke-CcodUninstallBootstrap -InstallerRoot $Runtime -InstallRoot $Root -Mode $PrepareMode','PortableUninstallFinalizer.ps1')){
         Assert-CcodTrue ($source -cmatch [regex]::Escape($required)) "Uninstall wrapper requires $required for the portable finalization boundary"
     }
     foreach($argument in @(@{Name='KeepCurrentSpecialSession';Value=$true},@{Name='BackupDeviceKeyStore';Value=$true},@{Name='RemoveDeviceKeyStore';Value=$true})){
diff --git a/tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1 b/tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1
new file mode 100644
index 0000000..13ebedf
--- /dev/null
+++ b/tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1
@@ -0,0 +1,3491 @@
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'TestSupport.ps1')
+. (Join-Path $PSScriptRoot 'LegacyReleaseFixture.ps1')
+
+$repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+$modulePath = Join-Path $repositoryRoot 'tests\installed\OfficialDraftAcceptance.psm1'
+$wrapperPath = Join-Path $repositoryRoot 'tests\installed\Invoke-OfficialDraftAcceptance.ps1'
+
+Invoke-CcodTest 'validation entrypoint includes the official draft acceptance harness' {
+    $validationPath = Join-Path $repositoryRoot 'tests\Validate.ps1'
+    Assert-CcodTrue (Test-Path -LiteralPath $validationPath -PathType Leaf) 'validation entrypoint exists'
+    $validation = [IO.File]::ReadAllText($validationPath, [Text.UTF8Encoding]::new($false))
+    Assert-CcodTrue ($validation.Contains('OfficialDraftAcceptanceHarness.SelfTest.ps1')) 'validation runs the official draft acceptance harness'
+    Assert-CcodTrue ($validation.Contains('PSExecutionPolicyPreference')) 'acceptance validation clears inherited process policy for the child'
+    Assert-CcodTrue ($validation.Contains('tests\installed\OfficialDraftAcceptance.psm1')) 'validation requires the official draft acceptance module'
+}
+
+Invoke-CcodTest 'legacy official manifest initial validation and persisted reload agree' {
+    $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-legacy-binding-'+[guid]::NewGuid().ToString('N'))
+    $module=Import-Module $modulePath -Force -PassThru -DisableNameChecking
+    try {
+        [IO.Directory]::CreateDirectory($root)|Out-Null
+        $fixture=New-CcodLegacyReleaseFixture -Directory $root
+        Assert-CcodEqual 8 @(Get-ChildItem -LiteralPath $root -File).Count 'fixture has the published legacy eight-file layout'
+        $assetModule=&$module {Get-CcodOfficialDraftAssetModule}
+        &$assetModule {param($Root)$path=Join-Path $Root 'CodexRemote-fix-2.5.21-release-manifest.json';$loaded=Read-CcodReleaseContractJson -Path $path -ErrorId 'LEGACY_FIXTURE';Test-CcodReleasePortableManifestDeep -Manifest $loaded.Value -ManifestRaw $loaded.Raw -ManifestPath $path -Directory $Root -Version '2.5.21' -ErrorId 'LEGACY_FIXTURE'|Out-Null} $root
+        $validate=&$module {(Get-CcodOfficialDraftDefaultAdapters).ValidatePreviousSetup}
+        $initial=&$validate $root '2.5.21'
+        Assert-CcodTrue $initial.Valid 'real default adapter accepts the actual legacy manifest schema'
+        Assert-CcodEqual $fixture.SetupSha256 $initial.InstallerSha256 'initial validation binds actual setup bytes'
+        $previous=[pscustomobject][ordered]@{version='2.5.21';gitCommit=$initial.GitCommit;assetSha256=$initial.InstallerSha256;manifestSha256=$initial.ManifestSha256}
+        Assert-CcodTrue (&$module {param($Value,$Root)Assert-CcodOfficialDraftPreviousSetupBinding -PreviousSetup $Value -PreviousAssetDirectory $Root} $previous $root) 'persisted binding accepts the same legacy contract'
+        foreach($name in $fixture.Names){
+            $path=Join-Path $root $name;$bytes=[IO.File]::ReadAllBytes($path)
+            try {
+                [IO.File]::WriteAllText($path,'tampered legacy asset',[Text.UTF8Encoding]::new($false))
+                Assert-CcodThrows {&$validate $root '2.5.21'|Out-Null} 'CCOD_ACCEPTANCE_PREVIOUS_ASSET_INVALID'
+                Assert-CcodThrows {&$module {param($Value,$Root)Assert-CcodOfficialDraftPreviousSetupBinding -PreviousSetup $Value -PreviousAssetDirectory $Root} $previous $root|Out-Null} 'CCOD_ACCEPTANCE_RECEIPT_INVALID'
+            } finally {[IO.File]::WriteAllBytes($path,$bytes)}
+        }
+        $extra=Join-Path $root 'extra.json'
+        try {[IO.File]::WriteAllText($extra,'{}');Assert-CcodThrows {&$validate $root '2.5.21'|Out-Null} 'CCOD_ACCEPTANCE_PREVIOUS_ASSET_INVALID'}finally{Remove-Item -LiteralPath $extra -Force}
+        Assert-CcodTrue (&$validate $root '2.5.21').Valid 'all failed validations release handles and allow a valid retry'
+    } finally {Remove-Module $module.Name -Force -ErrorAction SilentlyContinue;if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force}}
+}
+
+Invoke-CcodTest 'validation acceptance child preserves the normal effective execution policy' {
+    $validationPath = Join-Path $repositoryRoot 'tests\Validate.ps1'
+    $tokens = $null
+    $parseErrors = $null
+    $ast = [Management.Automation.Language.Parser]::ParseFile($validationPath, [ref]$tokens, [ref]$parseErrors)
+    Assert-CcodEqual 0 @($parseErrors).Count 'validation source parses before the real child invocation probe'
+    $blocks = @($ast.FindAll({
+        param($node)
+        $node -is [Management.Automation.Language.IfStatementAst] -and
+            $node.Extent.Text.StartsWith('if (-not (Test-Path -LiteralPath $officialDraftAcceptanceSelfTest')
+    }, $true))
+    Assert-CcodEqual 1 $blocks.Count 'exactly one acceptance validation block is exercised'
+    $markerFunctions = @($ast.FindAll({
+        param($node)
+        $node -is [Management.Automation.Language.FunctionDefinitionAst] -and
+            $node.Name -ceq 'Get-CcodValidationSafeChildMarkers'
+    }, $true))
+    Assert-CcodEqual 1 $markerFunctions.Count 'the real validation marker classifier is available'
+    $powershellExecutable = (Get-Command powershell.exe -ErrorAction Stop).Source
+    $hadPolicy = Test-Path -LiteralPath 'Env:PSExecutionPolicyPreference'
+    $previousPolicy = $env:PSExecutionPolicyPreference
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-policy-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $probe = Join-Path $root 'policy-probe.ps1'
+        [IO.File]::WriteAllText($probe, '[Console]::WriteLine("CCOD_POLICY_PROBE effective=" + (Get-ExecutionPolicy).ToString() + " process=" + (Get-ExecutionPolicy -Scope Process).ToString())', [Text.UTF8Encoding]::new($false))
+        Remove-Item -LiteralPath 'Env:PSExecutionPolicyPreference' -ErrorAction SilentlyContinue
+        $baseline = @(& $powershellExecutable -NoProfile -Command 'Get-ExecutionPolicy; Get-ExecutionPolicy -Scope Process')
+        Assert-CcodEqual 0 $LASTEXITCODE 'normal child policy query succeeds without executing a script'
+        Assert-CcodEqual 2 $baseline.Count 'normal child reports effective and process policies'
+        Assert-CcodTrue ($baseline[0] -cmatch '^(Restricted|AllSigned|RemoteSigned|Unrestricted|Bypass)\z') 'baseline reports a supported effective policy'
+        Assert-CcodEqual 'Undefined' $baseline[1] 'baseline has no explicit or inherited process policy'
+        $normalPolicy = $baseline[0]
+        $expectedMarker = 'CCOD_POLICY_PROBE effective={0} process={1}' -f $normalPolicy,$baseline[1]
+        if ($hadPolicy) { $env:PSExecutionPolicyPreference = $previousPolicy }
+        $observed = & {
+            param($Probe, $ValidationBlock, $MarkerDefinition)
+            . $MarkerDefinition
+            $officialDraftAcceptanceSelfTest = $Probe
+            $failures = [Collections.Generic.List[string]]::new()
+            . $ValidationBlock
+            [pscustomobject]@{
+                ExitCode = $officialDraftAcceptanceExitCode
+                Output = @($officialDraftAcceptanceOutput)
+                Failures = @($failures.ToArray())
+            }
+        } $probe ([scriptblock]::Create($blocks[0].Extent.Text)) ([scriptblock]::Create($markerFunctions[0].Extent.Text))
+        Assert-CcodEqual $hadPolicy (Test-Path -LiteralPath 'Env:PSExecutionPolicyPreference') 'validation restores parent process-policy presence'
+        if ($hadPolicy) { Assert-CcodEqual $previousPolicy $env:PSExecutionPolicyPreference 'validation restores parent process-policy value' }
+        if ($normalPolicy -in @('Restricted', 'AllSigned')) {
+            Assert-CcodTrue ($observed.ExitCode -ne 0) 'normal policy still rejects the unsigned local probe'
+            Assert-CcodEqual 1 $observed.Failures.Count 'normal policy rejection remains a validation failure'
+            Assert-CcodTrue (-not (@($observed.Output | ForEach-Object { [string]$_ }) -contains $expectedMarker)) 'blocked probe never executes'
+        } else {
+            Assert-CcodEqual 0 $observed.ExitCode 'actual acceptance runner loads a local script allowed by the normal policy'
+            Assert-CcodEqual 0 $observed.Failures.Count 'normal allowed execution has no validation failures'
+            Assert-CcodEqual $expectedMarker ($observed.Output -join '') 'actual runner preserves normal effective and process policy'
+        }
+    } finally {
+        if ($hadPolicy) { $env:PSExecutionPolicyPreference = $previousPolicy }
+        else { Remove-Item -LiteralPath 'Env:PSExecutionPolicyPreference' -ErrorAction SilentlyContinue }
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    }
+}
+
+function Invoke-CcodAcceptancePrivate {
+    param(
+        [Parameter(Mandatory)][string]$Phase,
+        [Parameter(Mandatory)][string]$AssetDirectory,
+        [Parameter(Mandatory)][string]$PreviousAssetDirectory,
+        [Parameter(Mandatory)][string]$EvidenceRoot,
+        [string]$DraftId = '123',
+        [hashtable]$Adapters,
+        [string]$TrayOperation,
+        [string]$RemoteOperation,
+        [string]$ScreenshotPath,
+        [string]$RedactedLogPath,
+        [string]$ReviewState,
+        [switch]$AllowMachineMutation,
+        [switch]$AllowCodexRestart,
+        [switch]$AllowWindowsReboot
+    )
+    $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+    try {
+        return & $module {
+            param($P, $A, $Previous, $Evidence, $Draft, $Tray, $Remote, $Screenshot, $Log, $Review, $Mutation, $Restart, $Reboot, $PrivateAdapters)
+            Invoke-CcodOfficialDraftAcceptanceCore `
+                -Phase $P `
+                -AssetDirectory $A `
+                -PreviousAssetDirectory $Previous `
+                -EvidenceRoot $Evidence `
+                -DraftId $Draft `
+                -TrayOperation $Tray `
+                -RemoteOperation $Remote `
+                -ScreenshotPath $Screenshot `
+                -RedactedLogPath $Log `
+                -ReviewState $Review `
+                -AllowMachineMutation:$Mutation `
+                -AllowCodexRestart:$Restart `
+                -AllowWindowsReboot:$Reboot `
+                -Adapters $PrivateAdapters
+        } $Phase $AssetDirectory $PreviousAssetDirectory $EvidenceRoot $DraftId $TrayOperation $RemoteOperation $ScreenshotPath $RedactedLogPath $ReviewState $AllowMachineMutation $AllowCodexRestart $AllowWindowsReboot $Adapters
+    } finally {
+        if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+function New-CcodAcceptanceCandidateFixture {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-candidate-' + [guid]::NewGuid().ToString('N'))
+    [IO.Directory]::CreateDirectory($root) | Out-Null
+    $version = '2.5.22'
+    $commit = 'c' * 40
+    $names = @(
+        "CodexRemote-fix-$version-windows-x64.zip",
+        "CodexRemote-fix-$version-windows-x64.zip.sha256.txt",
+        "CodexRemote-fix-$version-trayhost-provenance.json",
+        "CodexRemote-fix-$version-payload-manifest.json",
+        "CodexRemote-fix-$version-release-manifest.json",
+        "CodexRemote-fix-$version-setup.exe",
+        "CodexRemote-fix-$version-setup.exe.sha256.txt",
+        "CodexRemote-fix-$version-setup-provenance.json",
+        "CodexRemote-fix-$version-setup-payload-manifest.json",
+        "CodexRemote-fix-$version-setup-destination-inventory.iss",
+        "CodexRemote-fix-$version-setup-release-manifest.json"
+    )
+    foreach ($name in $names) {
+        [IO.File]::WriteAllBytes((Join-Path $root $name), [Text.Encoding]::UTF8.GetBytes("fixture:$name"))
+    }
+    $assets = @($names | ForEach-Object {
+        [pscustomobject][ordered]@{ name = $_; sha256 = Get-CcodTestFileSha256 -Path (Join-Path $root $_) }
+    })
+    return [pscustomobject][ordered]@{
+        Root = $root
+        Version = $version
+        GitCommit = $commit
+        Names = $names
+        Contract = [pscustomobject][ordered]@{
+            Valid = $true
+            Version = $version
+            GitCommit = $commit
+            Assets = $assets
+            SetupManifestSha256 = $assets[10].sha256
+            PortableManifestSha256 = $assets[4].sha256
+        }
+    }
+}
+
+function New-CcodAcceptanceDefenderReceipt {
+    param(
+        [Parameter(Mandatory)]$Fixture,
+        [Parameter(Mandatory)][ValidateSet('Setup','PortableZip')][string]$AssetType
+    )
+    $setup = $AssetType -ceq 'Setup'
+    $assetName = if ($setup) { $Fixture.Names[5] } else { $Fixture.Names[0] }
+    $checksumName = if ($setup) { $Fixture.Names[6] } else { $Fixture.Names[1] }
+    $manifestName = if ($setup) { $Fixture.Names[10] } else { $Fixture.Names[4] }
+    $assetHash = [string](($Fixture.Contract.Assets | Where-Object { $_.name -ceq $assetName }).sha256)
+    $checksumHash = [string](($Fixture.Contract.Assets | Where-Object { $_.name -ceq $checksumName }).sha256)
+    $manifestHash = [string](($Fixture.Contract.Assets | Where-Object { $_.name -ceq $manifestName }).sha256)
+    return [pscustomobject][ordered]@{
+        schemaVersion = 2
+        assetType = $AssetType
+        assetName = $assetName
+        assetSha256 = $assetHash
+        checksumName = $checksumName
+        checksumSha256 = $checksumHash
+        manifestName = $manifestName
+        manifestSha256 = $manifestHash
+        version = $Fixture.Version
+        gitCommit = $Fixture.GitCommit
+        origin = 'InternetDownload'
+        workflowArtifactIdentity = $null
+        zoneId = 3
+        defenderServiceEnabled = $true
+        antivirusEnabled = $true
+        realTimeProtectionEnabled = $true
+        defenderPlatformVersion = '4.18.26070.1'
+        defenderEngineVersion = '1.1.26070.1'
+        signatureVersion = '1.999.1.0'
+        signatureUpdatedAtUtc = '2030-02-03T02:05:06.0000000Z'
+        scanStartedAtUtc = '2030-02-03T04:05:06.0000000Z'
+        scanCompletedAtUtc = '2030-02-03T04:05:07.0000000Z'
+        detectionCount = 0
+        outcome = 'Completed'
+        errorCode = $null
+    }
+}
+
+function New-CcodAcceptanceFacts {
+    param(
+        [switch]$Absent,
+        [string]$KeyHash = ('b' * 64),
+        [string]$BootId = 'boot-1',
+        [string]$RuntimeId = 'runtime-2.5.22',
+        [UInt64]$Generation = 2,
+        [string]$Version = '2.5.22'
+    )
+    if ($Absent) {
+        return [pscustomobject][ordered]@{
+            installRootPresent = $false; appRootPresent = $false; runtimeRootPresent = $false; activePointerPresent = $false
+            activeRuntimeId = $null; activeGeneration = $null; runtimeManifestSha256 = $null
+            supervisor = @(); trayHost = @(); trayHostIdentity = $null; trayAuthenticated = $false; codex = @()
+            taskState = 'Absent'; statusPhase = 'Unavailable'; statusRuntimeId = $null; statusCodex = $null; codexCount = 0
+            transitionStage = 'Idle'; lifecycleReceipt = $null
+            debugPorts = @()
+            shortcuts = [pscustomobject][ordered]@{ startMenu = $false; desktop = $false }
+            debugEndpoints = @(); protectionReady = $false; protectionRecovered = $false
+            deviceKeyPresent = $true; deviceKeySha256 = $KeyHash; bootId = $BootId
+            privatePath = 'C:\\Users\\fixture\\private'; token = 'fixture-token'; rawLog = 'fixture raw log'
+        }
+    }
+    return [pscustomobject][ordered]@{
+        installRootPresent = $true; appRootPresent = $true; runtimeRootPresent = $true; activePointerPresent = $true; installReady = $true
+        activeRuntimeId = $RuntimeId; activeGeneration = $Generation; runtimeManifestSha256 = ('d' * 64)
+        supervisor = @([pscustomobject]@{ pid = 200; creationTimeUtc = '2030-02-03T04:05:00.0000000Z' })
+        trayHost = @([pscustomobject]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' })
+        trayHostIdentity = [pscustomobject][ordered]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' }
+        trayAuthenticated = $true; codex = @([pscustomobject]@{ pid = 202; creationTimeUtc = '2030-02-03T04:05:02.0000000Z' }); codexCount = 1
+        taskState = 'Ready'; statusPhase = 'Active'; statusRuntimeId = $RuntimeId; aboutVersion = $Version
+        statusCodex = [pscustomobject][ordered]@{ pid = 202; creationTimeUtc = '2030-02-03T04:05:02.0000000Z' }
+        transitionStage = 'Idle'
+        lifecycleReceipt = [pscustomobject][ordered]@{ kind = 'RestartAndRepair'; origin = 'Installer'; runtimeId = $RuntimeId; runtimeGeneration = $Generation; phase = 'Completed' }
+        shortcuts = [pscustomobject][ordered]@{ startMenu = $true; desktop = $true }
+        debugEndpoints = @(
+            [pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = 9229; owningProcess = 202; owningProcessCreationTimeUtc = '2030-02-03T04:05:02.0000000Z' }
+            [pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = 9230; owningProcess = 202; owningProcessCreationTimeUtc = '2030-02-03T04:05:02.0000000Z' }
+        )
+        debugPorts = @(9229,9230)
+        protectionReady = $true; protectionRecovered = $true
+        deviceKeyPresent = $true; deviceKeySha256 = $KeyHash; bootId = $BootId
+        privatePath = 'C:\\Users\\fixture\\private'; token = 'fixture-token'; rawLog = 'fixture raw log'
+    }
+}
+
+function New-CcodAcceptanceRawFacts {
+    param([switch]$Absent)
+    $facts = New-CcodAcceptanceFacts -Absent:$Absent
+    $facts | Add-Member -NotePropertyName appPresent -NotePropertyValue ([bool]$facts.appRootPresent)
+    if ($Absent) { $facts | Add-Member -NotePropertyName aboutVersion -NotePropertyValue $null }
+    $facts.PSObject.Properties.Remove('appRootPresent')
+    $facts.PSObject.Properties.Remove('codexCount')
+    foreach ($name in @('supervisor','trayHost','codex')) {
+        $facts.$name = @($facts.$name | ForEach-Object { [pscustomobject]@{ Pid = [uint32]$_.pid; CreationTimeUtc = [string]$_.creationTimeUtc } })
+    }
+    if ($null -ne $facts.statusCodex) { $facts.statusCodex = [pscustomobject]@{ Pid = [uint32]$facts.statusCodex.pid; CreationTimeUtc = [string]$facts.statusCodex.creationTimeUtc } }
+    return $facts
+}
+
+function New-CcodAcceptancePhaseAdapters {
+    param(
+        [Parameter(Mandatory)]$Fixture,
+        [Parameter(Mandatory)]$State,
+        [switch]$ReturnAbsentAfterUninstall,
+        [switch]$LeaveInstallRootAfterUninstall
+    )
+    $previousContractPath=Join-Path $repositoryRoot 'tests/installed/OfficialDraftAcceptance.psm1'
+    $previousFixtureWriter=${function:New-CcodLegacyReleaseFixture}
+    return @{
+        ValidateAssetSet = {
+            param($Path, $Version)
+            return $Fixture.Contract
+        }.GetNewClosure()
+        ValidatePreviousSetup = {
+            param($Path, $Version)
+            if ($null -ne $State.PreviousCalls) { $State.PreviousCalls++ }
+            try {
+                if ($Version -cne '2.5.21') { throw 'previous version request' }
+                $directory = Get-Item -LiteralPath $Path -Force -ErrorAction Stop
+                if ($directory -isnot [IO.DirectoryInfo] -or ($directory.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'previous directory' }
+                $setupPath = Join-Path $directory.FullName 'CodexRemote-fix-2.5.21-setup.exe'
+                $manifestPath = Join-Path $directory.FullName 'CodexRemote-fix-2.5.21-setup-release-manifest.json'
+                $seed = $true
+                if ($null -ne $State.PSObject.Properties['SeedPreviousSetup']) {
+                    if ($State.SeedPreviousSetup -isnot [bool]) { throw 'seed flag' }
+                    $seed = [bool]$State.SeedPreviousSetup
+                }
+                if ($seed -and -not [IO.File]::Exists($setupPath) -and -not [IO.File]::Exists($manifestPath)) {
+                    &$previousFixtureWriter -Directory $directory.FullName|Out-Null
+                }
+                $previousModule=Import-Module $previousContractPath -PassThru -DisableNameChecking
+                return &$previousModule {param($Root,$Version)Get-CcodOfficialDraftPreviousSetupContract -Directory $Root -Version $Version} $directory.FullName $Version
+            } catch { throw 'previous setup fixture validation failed' }
+        }.GetNewClosure()
+        GetDraftIdentity = {
+            param($Path, $Candidate, $ExpectedDraftId)
+            return [pscustomobject][ordered]@{ tag = 'v2.5.22'; id = [string]$ExpectedDraftId }
+        }.GetNewClosure()
+        InvokeDefenderCheck = {
+            param($Path, $AssetType, $Origin, $Version, $GitCommit, $EvidencePath)
+            $State.DefenderCalls.Add(('{0}:{1}' -f $AssetType, $Origin))
+            return New-CcodAcceptanceDefenderReceipt -Fixture $Fixture -AssetType $AssetType
+        }.GetNewClosure()
+        CaptureFacts = {
+            param($Context, $Point)
+            $State.CaptureCalls.Add(('{0}:{1}' -f $Context.phase, $Point))
+            if ($null -ne $State.PSObject.Properties['Events']) { $State.Events.Add(('Capture:{0}:{1}' -f $Context.phase, $Point)) }
+            if ($Context.phase -ceq 'Uninstall' -and $Point -ceq 'After' -and $ReturnAbsentAfterUninstall) {
+                $absentFacts = New-CcodAcceptanceFacts -Absent -KeyHash $State.KeyHash -BootId $State.BootId
+                if ($LeaveInstallRootAfterUninstall) { $absentFacts.installRootPresent = $true }
+                return $absentFacts
+            }
+            if ($Context.phase -ceq 'LegacyUpgrade' -and $Point -ceq 'Before') {
+                return New-CcodAcceptanceFacts -RuntimeId '2.5.21-legacy-runtime' -Generation 1 -Version '2.5.21' -KeyHash $State.KeyHash -BootId $State.BootId
+            }
+            return $State.Facts
+        }.GetNewClosure()
+        RunPhase = {
+            param($Context)
+            $State.RunCalls.Add([string]$Context.phase)
+            if ($null -ne $State.PSObject.Properties['Events']) { $State.Events.Add(('Run:{0}' -f $Context.phase)) }
+            $setupName = [IO.Path]::GetFileName([string]$Context.setupPath)
+            $setupAsset = @($Fixture.Contract.Assets | Where-Object { $_.name -ceq $setupName })
+            [pscustomobject][ordered]@{ completed = $true; outcome = 'Completed'; installerSha256 = [string]$setupAsset[0].sha256; runtimeManifestSha256 = [string]$State.Facts.runtimeManifestSha256 }
+        }.GetNewClosure()
+        RunManualOperation = {
+            param($Context,$Operation)
+            $states = @{ About = 'AboutVisible'; Language = 'LanguageChanged'; OpenLogs = 'LogsOpened'; Repair = 'RepairCompleted'; SecondDeviceControl = 'SecondDeviceControlled' }
+            $codes = @{ About = 'CCOD_TRAYABOUT_COMPLETED'; Language = 'CCOD_TRAYLANGUAGE_COMPLETED'; OpenLogs = 'CCOD_TRAYOPENLOGS_COMPLETED'; Repair = 'CCOD_TRAYREPAIR_COMPLETED'; SecondDeviceControl = 'CCOD_SECONDDEVICE_COMPLETED' }
+            $timestamp = '2030-02-03T04:05:06.0000000Z'
+            $proof = $null
+            if ([string]$Operation -ceq 'SecondDeviceControl') {
+                $proof = [pscustomobject][ordered]@{ schemaVersion = 1; timestampUtc = $timestamp; kind = 'remote-control-manual-proof'; operation = 'SecondDeviceControl'; deviceRole = 'SecondDevice'; challenge = [string]$Context.manualChallenge; candidateVersion = [string]$Context.expectedVersion; runtimeId = [string]$State.Facts.activeRuntimeId; runtimeGeneration = [UInt64]$State.Facts.activeGeneration; runtimeManifestSha256 = [string]$State.Facts.runtimeManifestSha256; attestation = 'HumanReviewedStructuredAttestation'; connection = 'Connected'; control = 'Completed'; outcome = 'Completed'; code = 'CCOD_REMOTE_ACTION_COMPLETED' }
+            } else {
+                $commands = @{ About = 'ShowAbout'; Language = 'SetLanguageEnglish'; OpenLogs = 'OpenLogs'; Repair = 'CheckAndRepair' }
+                $proof = [pscustomobject][ordered]@{ timestampUtc = $timestamp; command = [string]$commands[$Operation]; revision = [UInt64]1; code = 'CCOD_TRAY_ACTION_COMPLETED'; status = 'Completed' }
+            }
+            return [pscustomobject][ordered]@{ verified = $true; operation = [string]$Operation; terminalState = [string]$states[$Operation]; code = [string]$codes[$Operation]; proof = $proof; screenshotSha256 = Get-CcodTestFileSha256 -Path $Context.screenshotPath; redactedLogSha256 = Get-CcodTestFileSha256 -Path $Context.redactedLogPath }
+        }.GetNewClosure()
+        GetBootIdentity = {
+            $State.BootCalls++
+            return [string]$State.BootId
+        }.GetNewClosure()
+        Reboot = {
+            $State.RebootCalls++
+            return $true
+        }.GetNewClosure()
+        GetUtcNow = {
+            return [datetime]::Parse('2030-02-03T04:05:06Z').ToUniversalTime()
+        }.GetNewClosure()
+    }
+}
+
+function Invoke-CcodAcceptanceThroughReady {
+    param(
+        [Parameter(Mandatory)]$Fixture,
+        [Parameter(Mandatory)]$PreviousRoot,
+        [Parameter(Mandatory)]$EvidenceRoot,
+        [Parameter(Mandatory)]$Adapters,
+        [Parameter(Mandatory)]$State
+    )
+    Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $Fixture.Root -PreviousAssetDirectory $PreviousRoot -EvidenceRoot $EvidenceRoot -Adapters $Adapters | Out-Null
+    Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $Fixture.Root -PreviousAssetDirectory $PreviousRoot -EvidenceRoot $EvidenceRoot -Adapters $Adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+    Invoke-CcodAcceptancePrivate -Phase Uninstall -AssetDirectory $Fixture.Root -PreviousAssetDirectory $PreviousRoot -EvidenceRoot $EvidenceRoot -Adapters $Adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+    Invoke-CcodAcceptancePrivate -Phase FreshInstall -AssetDirectory $Fixture.Root -PreviousAssetDirectory $PreviousRoot -EvidenceRoot $EvidenceRoot -Adapters $Adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+    Invoke-CcodAcceptancePrivate -Phase PreReboot -AssetDirectory $Fixture.Root -PreviousAssetDirectory $PreviousRoot -EvidenceRoot $EvidenceRoot -Adapters $Adapters -AllowMachineMutation -AllowCodexRestart -AllowWindowsReboot | Out-Null
+    $State.BootId = 'boot-2'
+    $State.Facts = New-CcodAcceptanceFacts -BootId 'boot-2'
+    Invoke-CcodAcceptancePrivate -Phase PostReboot -AssetDirectory $Fixture.Root -PreviousAssetDirectory $PreviousRoot -EvidenceRoot $EvidenceRoot -Adapters $Adapters -AllowMachineMutation -AllowCodexRestart -AllowWindowsReboot | Out-Null
+    Invoke-CcodAcceptancePrivate -Phase ReadyForManualEvidence -AssetDirectory $Fixture.Root -PreviousAssetDirectory $PreviousRoot -EvidenceRoot $EvidenceRoot -Adapters $Adapters | Out-Null
+}
+
+function New-CcodAcceptanceManualInputFiles {
+    param([Parameter(Mandatory)][string]$Root)
+    [IO.Directory]::CreateDirectory($Root) | Out-Null
+    $paths = @{}
+    foreach ($operation in @('About','Language','OpenLogs','Repair','SecondDeviceControl')) {
+        $paths[$operation] = [pscustomobject][ordered]@{
+            Screenshot = Join-Path $Root ($operation + '-screenshot.png')
+            Log = Join-Path $Root ($operation + '-redacted.log')
+        }
+        [IO.File]::WriteAllText($paths[$operation].Screenshot, 'screenshot-' + $operation, [Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($paths[$operation].Log, 'redacted-log-' + $operation, [Text.UTF8Encoding]::new($false))
+    }
+    return $paths
+}
+
+function Invoke-CcodAcceptanceManualRecords {
+    param(
+        [Parameter(Mandatory)]$Fixture,
+        [Parameter(Mandatory)]$PreviousRoot,
+        [Parameter(Mandatory)]$EvidenceRoot,
+        [Parameter(Mandatory)]$Adapters,
+        [Parameter(Mandatory)]$Paths
+    )
+    foreach ($operation in @('About','Language','OpenLogs','Repair')) {
+        Invoke-CcodAcceptancePrivate -Phase TrayEvidence -TrayOperation $operation -ScreenshotPath $Paths[$operation].Screenshot -RedactedLogPath $Paths[$operation].Log -ReviewState Reviewed -AssetDirectory $Fixture.Root -PreviousAssetDirectory $PreviousRoot -EvidenceRoot $EvidenceRoot -Adapters $Adapters | Out-Null
+    }
+    Invoke-CcodAcceptancePrivate -Phase RemoteEvidence -RemoteOperation SecondDeviceControl -ScreenshotPath $Paths.SecondDeviceControl.Screenshot -RedactedLogPath $Paths.SecondDeviceControl.Log -ReviewState Reviewed -AssetDirectory $Fixture.Root -PreviousAssetDirectory $PreviousRoot -EvidenceRoot $EvidenceRoot -Adapters $Adapters | Out-Null
+}
+
+try {
+    Invoke-CcodTest 'official draft acceptance exposes the required public module and wrapper boundary' {
+        Assert-CcodTrue (Test-Path -LiteralPath $modulePath -PathType Leaf) 'official-draft acceptance module exists'
+        Assert-CcodTrue (Test-Path -LiteralPath $wrapperPath -PathType Leaf) 'official-draft acceptance wrapper exists'
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            Assert-CcodEqual 'Invoke-CcodOfficialDraftAcceptance' ((@($module.ExportedCommands.Keys | Sort-Object) -join ',')) 'module exports only the official-draft acceptance command'
+            $command = Get-Command Invoke-CcodOfficialDraftAcceptance -Module $module.Name -ErrorAction Stop
+            Assert-CcodTrue (-not $command.Parameters.ContainsKey('Adapters')) 'public command does not expose test adapters'
+            Assert-CcodTrue ($command.Parameters.ContainsKey('Phase')) 'public command exposes phase'
+            Assert-CcodTrue ($command.Parameters.ContainsKey('AssetDirectory')) 'public command exposes candidate asset directory'
+            Assert-CcodTrue ($command.Parameters.ContainsKey('PreviousAssetDirectory')) 'public command exposes previous asset directory'
+            Assert-CcodTrue ($command.Parameters.ContainsKey('EvidenceRoot')) 'public command exposes evidence root'
+            Assert-CcodTrue ($command.Parameters.ContainsKey('DraftId')) 'public command exposes the official draft identifier'
+            Assert-CcodTrue ($command.Parameters.ContainsKey('AllowMachineMutation')) 'public command exposes machine mutation authorization'
+            Assert-CcodTrue ($command.Parameters.ContainsKey('AllowCodexRestart')) 'public command exposes Codex restart authorization'
+            Assert-CcodTrue ($command.Parameters.ContainsKey('AllowWindowsReboot')) 'public command exposes Windows reboot authorization'
+            Assert-CcodTrue ($command.Parameters.ContainsKey('TrayOperation')) 'public command exposes bounded tray operation'
+            Assert-CcodTrue ($command.Parameters.ContainsKey('RemoteOperation')) 'public command exposes bounded remote operation'
+            Assert-CcodTrue ($command.Parameters.ContainsKey('ScreenshotPath')) 'public command exposes screenshot evidence path'
+            Assert-CcodTrue ($command.Parameters.ContainsKey('RedactedLogPath')) 'public command exposes redacted log evidence path'
+            Assert-CcodTrue ($command.Parameters.ContainsKey('ReviewState')) 'public command exposes manual evidence review state'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft acceptance rejects a missing evidence root before adapter work' {
+        $assetRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-assets-' + [guid]::NewGuid().ToString('N'))
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-missing-' + [guid]::NewGuid().ToString('N'))
+        try {
+            [IO.Directory]::CreateDirectory($assetRoot) | Out-Null
+            [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $assetRoot -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot
+            } 'CCOD_ACCEPTANCE_EVIDENCE_ROOT_INVALID'
+        } finally {
+            foreach ($path in @($assetRoot, $previousRoot, $evidenceRoot)) {
+                if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force }
+            }
+        }
+    }
+
+    Invoke-CcodTest 'official draft public wrapper runs in a fresh process and fails closed' {
+        $assetRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-wrapper-assets-' + [guid]::NewGuid().ToString('N'))
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-wrapper-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-wrapper-missing-' + [guid]::NewGuid().ToString('N'))
+        [IO.Directory]::CreateDirectory($assetRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        try {
+            $stderrPath = Join-Path $assetRoot 'wrapper.stderr.log'
+            $stdoutPath = Join-Path $assetRoot 'wrapper.stdout.log'
+            $child = Start-Process -FilePath 'powershell.exe' -ArgumentList @('-NoLogo','-NoProfile','-File',$wrapperPath,'-Phase','Preflight','-AssetDirectory',$assetRoot,'-PreviousAssetDirectory',$previousRoot,'-EvidenceRoot',$evidenceRoot) -RedirectStandardOutput $stdoutPath -RedirectStandardError $stderrPath -Wait -PassThru -WindowStyle Hidden
+            $exitCode = $child.ExitCode
+            $stdout = if (Test-Path -LiteralPath $stdoutPath -PathType Leaf) { [IO.File]::ReadAllText($stdoutPath, [Text.UTF8Encoding]::new($false, $true)) } else { '' }
+            $stderrBytes = if (Test-Path -LiteralPath $stderrPath -PathType Leaf) { [IO.File]::ReadAllBytes($stderrPath) } else { [byte[]]@() }
+            $stderr = ([Text.Encoding]::ASCII.GetString($stderrBytes) + "`n" + [Text.Encoding]::Unicode.GetString($stderrBytes))
+            $joined = $stdout + "`n" + $stderr
+            Assert-CcodEqual 1 $exitCode 'public wrapper exits nonzero for a missing evidence root'
+            Assert-CcodTrue ($joined.Contains('CCOD_ACCEPTANCE_EVIDENCE_ROOT_INVALID')) 'public wrapper preserves the stable fail-closed error code'
+            $invalidStderrPath = Join-Path $assetRoot 'wrapper-invalid-phase.stderr.log'
+            $invalidStdoutPath = Join-Path $assetRoot 'wrapper-invalid-phase.stdout.log'
+            $invalidChild = Start-Process -FilePath 'powershell.exe' -ArgumentList @('-NoLogo','-NoProfile','-File',$wrapperPath,'-Phase','NotARealPhase','-AssetDirectory',$assetRoot,'-PreviousAssetDirectory',$previousRoot,'-EvidenceRoot',$evidenceRoot) -RedirectStandardOutput $invalidStdoutPath -RedirectStandardError $invalidStderrPath -Wait -PassThru -WindowStyle Hidden
+            $invalidBytes = if (Test-Path -LiteralPath $invalidStderrPath -PathType Leaf) { [IO.File]::ReadAllBytes($invalidStderrPath) } else { [byte[]]@() }
+            $invalidOutput = ([Text.Encoding]::ASCII.GetString($invalidBytes) + "`n" + [Text.Encoding]::Unicode.GetString($invalidBytes))
+            Assert-CcodEqual 1 $invalidChild.ExitCode 'public wrapper exits nonzero for an invalid phase'
+            Assert-CcodTrue ($invalidOutput.Contains('CCOD_ACCEPTANCE_PHASE_INVALID')) 'public wrapper converts binder-level phase rejection into a stable error code'
+        } finally {
+            foreach ($path in @($assetRoot, $previousRoot, $evidenceRoot)) {
+                if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force -ErrorAction SilentlyContinue }
+            }
+        }
+    }
+
+    Invoke-CcodTest 'official draft preflight scans exactly two downloaded assets and persists a bound receipt' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $calls = [Collections.Generic.List[string]]::new()
+        $defenderArguments = [Collections.Generic.List[object]]::new()
+        try {
+            $adapters = @{
+                ValidateAssetSet = {
+                    param($Path, $Version)
+                    $calls.Add(('ValidateAssetSet:{0}:{1}' -f $Path, $Version))
+                    return $fixture.Contract
+                }.GetNewClosure()
+                GetDraftIdentity = {
+                    param($Path, $Candidate)
+                    $calls.Add('GetDraftIdentity')
+                    return [pscustomobject][ordered]@{ tag = 'v2.5.22'; id = '123' }
+                }.GetNewClosure()
+                InvokeDefenderCheck = {
+                    param($Path, $AssetType, $Origin, $Version, $GitCommit, $EvidencePath)
+                    $calls.Add(('Defender:{0}:{1}' -f $AssetType, $Origin))
+                    $assetIndex = if ($AssetType -ceq 'Setup') { 5 } else { 0 }
+                    $defenderArguments.Add([pscustomobject][ordered]@{
+                        AssetType = $AssetType
+                        Origin = $Origin
+                        Version = $Version
+                        GitCommit = $GitCommit
+                        CandidatePath = [IO.Path]::GetFullPath((Join-Path $Path $fixture.Names[$assetIndex]))
+                        EvidencePath = [IO.Path]::GetFullPath($EvidencePath)
+                    })
+                    return New-CcodAcceptanceDefenderReceipt -Fixture $fixture -AssetType $AssetType
+                }.GetNewClosure()
+                GetUtcNow = {
+                    return [datetime]::Parse('2030-02-03T04:05:06Z').ToUniversalTime()
+                }.GetNewClosure()
+            }
+            $result = Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters
+            Assert-CcodEqual 'Preflight' ([string]$result.phase) 'preflight returns its canonical phase'
+            Assert-CcodEqual 'Completed' ([string]$result.outcome) 'preflight returns a completed outcome'
+            $defenderCalls = @($calls | Where-Object { $_ -like 'Defender:*' })
+            Assert-CcodEqual 2 $defenderCalls.Count 'preflight invokes Defender exactly twice'
+            Assert-CcodEqual 'Defender:Setup:InternetDownload' $defenderCalls[0] 'Setup is scanned first as an InternetDownload'
+            Assert-CcodEqual 'Defender:PortableZip:InternetDownload' $defenderCalls[1] 'portable ZIP is scanned second as an InternetDownload'
+            $stateDirectory = Join-Path $evidenceRoot 'official-draft-acceptance'
+            $expectedAssetIndexes = @(5,0)
+            for ($index = 0; $index -lt 2; $index++) {
+                $arguments = $defenderArguments[$index]
+                Assert-CcodEqual @('Setup','PortableZip')[$index] ([string]$arguments.AssetType) 'Defender callback receives the ordered asset type'
+                Assert-CcodEqual 'InternetDownload' ([string]$arguments.Origin) 'Defender callback receives the download origin'
+                Assert-CcodEqual $fixture.Version ([string]$arguments.Version) 'Defender callback receives the candidate version'
+                Assert-CcodEqual $fixture.Contract.GitCommit ([string]$arguments.GitCommit) 'Defender callback receives the candidate commit'
+                Assert-CcodEqual ([IO.Path]::GetFullPath((Join-Path $fixture.Root $fixture.Names[$expectedAssetIndexes[$index]]))) ([string]$arguments.CandidatePath) 'Defender callback receives the expected candidate asset'
+                Assert-CcodTrue (([string]$arguments.EvidencePath).StartsWith([IO.Path]::GetFullPath($stateDirectory) + [IO.Path]::DirectorySeparatorChar, [StringComparison]::OrdinalIgnoreCase)) 'Defender callback evidence is inside the acceptance state directory'
+                Assert-CcodTrue ([IO.Path]::GetFileName([string]$arguments.EvidencePath) -cmatch '^\.defender-(Setup|PortableZip)-[0-9a-f]{32}\.json$') 'Defender callback evidence uses a bounded pending receipt name'
+            }
+            $preflightPath = Join-Path $stateDirectory '01-Preflight.json'
+            Assert-CcodTrue (Test-Path -LiteralPath $preflightPath -PathType Leaf) 'preflight writes one durable state receipt'
+            $serialized = [IO.File]::ReadAllText($preflightPath)
+            foreach ($forbidden in @('C:\\Users', 'private', 'token', 'account', 'raw log')) {
+                Assert-CcodTrue (-not $serialized.Contains($forbidden)) "preflight receipt omits $forbidden data"
+            }
+            $receipt = $serialized | ConvertFrom-Json
+            Assert-CcodEqual 'Preflight' ([string]$receipt.phase) 'durable receipt records the exact phase'
+            Assert-CcodEqual 'v2.5.22' ([string]$receipt.draft.tag) 'durable receipt records the draft tag'
+            Assert-CcodEqual '123' ([string]$receipt.draft.id) 'durable receipt records the bounded draft id'
+            Assert-CcodEqual 2 @($receipt.facts.defenderReceipts).Count 'durable receipt retains both Defender receipts'
+            for ($index = 0; $index -lt 2; $index++) {
+                $assetName = $fixture.Names[$expectedAssetIndexes[$index]]
+                $expectedHash = [string](($fixture.Contract.Assets | Where-Object { $_.name -ceq $assetName }).sha256)
+                Assert-CcodEqual $assetName ([string]$receipt.facts.defenderReceipts[$index].assetName) 'durable Defender receipts preserve asset order'
+                Assert-CcodEqual $expectedHash ([string]$receipt.facts.defenderReceipts[$index].assetSha256) 'durable Defender receipts bind exact asset hashes'
+            }
+        } finally {
+            foreach ($path in @($fixture.Root, $previousRoot)) {
+                if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force }
+            }
+        }
+    }
+
+    Invoke-CcodTest 'official draft rejects a missing draft identifier before Defender work' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        $calls = [Collections.Generic.List[string]]::new()
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        try {
+            $adapters = @{
+                ValidateAssetSet = { param($Path,$Version) $fixture.Contract }.GetNewClosure()
+                GetDraftIdentity = { param($Path,$Candidate) [pscustomobject][ordered]@{ tag = 'v2.5.22'; id = $null } }.GetNewClosure()
+                InvokeDefenderCheck = { param($Path,$AssetType,$Origin,$Version,$GitCommit,$EvidencePath) $calls.Add($AssetType); New-CcodAcceptanceDefenderReceipt -Fixture $fixture -AssetType $AssetType }.GetNewClosure()
+            }
+            Assert-CcodThrows { Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null } 'CCOD_ACCEPTANCE_DRAFT_IDENTITY_INVALID'
+            Assert-CcodEqual 0 $calls.Count 'missing draft ID blocks Defender work'
+            $adapters.GetDraftIdentity = { param($Path,$Candidate,$Expected) [pscustomobject][ordered]@{ tag = 'v2.5.22'; id = 'draft-123' } }.GetNewClosure()
+            Assert-CcodThrows { Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null } 'CCOD_ACCEPTANCE_DRAFT_IDENTITY_INVALID'
+            Assert-CcodEqual 0 $calls.Count 'nonnumeric draft ID also blocks Defender work'
+        } finally {
+            foreach ($path in @($fixture.Root,$previousRoot)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force } }
+        }
+    }
+
+    Invoke-CcodTest 'official draft acceptance enforces authorization before machine mutation and rejects skipped phases' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{
+            DefenderCalls = [Collections.Generic.List[string]]::new()
+            RunCalls = [Collections.Generic.List[string]]::new()
+            CaptureCalls = [Collections.Generic.List[string]]::new()
+            BootCalls = 0
+            RebootCalls = 0
+            PreviousCalls = 0
+            BootId = 'boot-1'
+            KeyHash = ('b' * 64)
+            Facts = (New-CcodAcceptanceFacts)
+        }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state
+            Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters
+            } 'CCOD_ACCEPTANCE_MACHINE_MUTATION_NOT_ALLOWED'
+            Assert-CcodEqual 0 $state.RunCalls.Count 'missing machine authorization precedes the operation adapter'
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation
+            } 'CCOD_ACCEPTANCE_CODEX_RESTART_NOT_ALLOWED'
+            Assert-CcodEqual 0 $state.RunCalls.Count 'missing restart authorization also precedes the operation adapter'
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase Uninstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart
+            } 'CCOD_ACCEPTANCE_PHASE_ORDER_INVALID'
+            Assert-CcodEqual 0 $state.RunCalls.Count 'a skipped phase cannot invoke machine mutation'
+        } finally {
+            foreach ($path in @($fixture.Root, $previousRoot)) {
+                if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force }
+            }
+        }
+    }
+
+    Invoke-CcodTest 'official draft legacy upgrade requires the public v2.5.21 Setup and preserves the device key hash' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{
+            DefenderCalls = [Collections.Generic.List[string]]::new()
+            RunCalls = [Collections.Generic.List[string]]::new()
+            CaptureCalls = [Collections.Generic.List[string]]::new()
+            Events = [Collections.Generic.List[string]]::new()
+            BootCalls = 0; RebootCalls = 0; PreviousCalls = 0
+            BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = (New-CcodAcceptanceFacts)
+        }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state
+            Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            $previous = @(& $adapters.ValidatePreviousSetup $previousRoot '2.5.21')
+            Assert-CcodEqual 1 $previous.Count 'legacy setup validator returns one real previous setup record'
+            $previousSetupPath = Join-Path $previousRoot 'CodexRemote-fix-2.5.21-setup.exe'
+            $previousManifestPath = Join-Path $previousRoot 'CodexRemote-fix-2.5.21-setup-release-manifest.json'
+            Assert-CcodTrue ([IO.File]::Exists($previousSetupPath) -and [IO.File]::Exists($previousManifestPath)) 'legacy setup validator binds both previous files on disk'
+            Assert-CcodEqual (Get-CcodTestFileSha256 -Path $previousSetupPath) ([string]$previous[0].InstallerSha256) 'legacy setup metadata binds the actual installer hash'
+            Assert-CcodEqual (Get-CcodTestFileSha256 -Path $previousManifestPath) ([string]$previous[0].ManifestSha256) 'legacy setup metadata binds the actual manifest hash'
+            $originalPreviousManifest = [IO.File]::ReadAllBytes($previousManifestPath)
+            $tamperedPreviousManifest = [IO.File]::ReadAllText($previousManifestPath) | ConvertFrom-Json
+            $tamperedPreviousManifest.version = '2.5.22'
+            [IO.File]::WriteAllText($previousManifestPath, ($tamperedPreviousManifest | ConvertTo-Json -Depth 8), [Text.UTF8Encoding]::new($false))
+            $rejectedVersion = $false
+            try { & $adapters.ValidatePreviousSetup $previousRoot '2.5.21' | Out-Null } catch { $rejectedVersion = $true }
+            Assert-CcodTrue $rejectedVersion 'legacy setup validator rejects a manifest version detached from the requested v2.5.21'
+            [IO.File]::WriteAllBytes($previousManifestPath, $originalPreviousManifest)
+            $wrongPreviousRoot = Join-Path $fixture.Root 'wrong-previous-root'
+            [IO.Directory]::CreateDirectory($wrongPreviousRoot) | Out-Null
+            $state | Add-Member -NotePropertyName SeedPreviousSetup -NotePropertyValue $false
+            $rejectedPath = $false
+            try { & $adapters.ValidatePreviousSetup $wrongPreviousRoot '2.5.21' | Out-Null } catch { $rejectedPath = $true }
+            Assert-CcodTrue $rejectedPath 'legacy setup validator rejects an empty alternate previous-asset path'
+            $state.PSObject.Properties.Remove('SeedPreviousSetup')
+            $state.PreviousCalls = 0
+            $result = Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart
+            Assert-CcodEqual 'LegacyUpgrade' ([string]$result.phase) 'legacy upgrade returns its canonical phase'
+            Assert-CcodEqual 'Completed' ([string]$result.outcome) 'legacy upgrade returns a completed outcome'
+            Assert-CcodEqual 1 $state.PreviousCalls 'legacy upgrade validates the supplied previous installer once'
+            Assert-CcodEqual 'LegacyUpgrade' $state.RunCalls[0] 'legacy upgrade invokes only its injected operation'
+            Assert-CcodTrue ($state.CaptureCalls -contains 'LegacyUpgrade:Before') 'legacy upgrade captures the key before mutation'
+            Assert-CcodTrue ($state.CaptureCalls -contains 'LegacyUpgrade:After') 'legacy upgrade captures the key after mutation'
+            Assert-CcodEqual 'Capture:LegacyUpgrade:Before,Run:LegacyUpgrade,Capture:LegacyUpgrade:After' (@($state.Events) -join ',') 'legacy upgrade enforces before-operation-after ordering'
+            $receiptPath = Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '02-LegacyUpgrade.json'
+            $serialized = [IO.File]::ReadAllText($receiptPath)
+            foreach ($forbidden in @('C:\\Users', 'private', 'token', 'raw log')) {
+                Assert-CcodTrue (-not $serialized.Contains($forbidden)) "legacy receipt omits $forbidden data"
+            }
+            $receipt = $serialized | ConvertFrom-Json
+            Assert-CcodTrue ([bool]$receipt.facts.keyHashPreserved) 'legacy receipt records unchanged key-hash proof'
+            Assert-CcodTrue ($null -ne $receipt.facts.before -and $null -ne $receipt.facts.after) 'legacy receipt persists before and after readiness observations'
+            Assert-CcodEqual '2.5.21' ([string]$receipt.facts.before.version) 'legacy receipt binds the pre-upgrade observation to v2.5.21'
+            Assert-CcodEqual '2.5.22' ([string]$receipt.facts.after.version) 'legacy receipt binds the post-upgrade observation to v2.5.22'
+            Assert-CcodEqual '2.5.21-legacy-runtime' ([string]$receipt.facts.before.activeRuntimeId) 'legacy receipt binds the previous active runtime identity'
+            Assert-CcodEqual 1 ([int]$receipt.facts.before.activeGeneration) 'legacy receipt binds the previous active generation'
+            Assert-CcodEqual ('d' * 64) ([string]$receipt.facts.before.runtimeManifestSha256) 'legacy receipt binds the previous runtime manifest hash'
+            Assert-CcodEqual 'runtime-2.5.22' ([string]$receipt.facts.after.activeRuntimeId) 'legacy receipt binds the candidate active runtime identity'
+            Assert-CcodEqual 2 ([int]$receipt.facts.after.activeGeneration) 'legacy receipt binds the candidate active generation'
+            Assert-CcodEqual ('d' * 64) ([string]$receipt.facts.after.runtimeManifestSha256) 'legacy receipt binds the candidate runtime manifest hash'
+            Assert-CcodEqual ('b' * 64) ([string]$receipt.facts.before.deviceKeySha256) 'legacy receipt binds the before device-key hash'
+            Assert-CcodEqual ('b' * 64) ([string]$receipt.facts.after.deviceKeySha256) 'legacy receipt binds the after device-key hash'
+            Assert-CcodEqual '2.5.21' ([string]$receipt.facts.previousSetup.version) 'legacy receipt records the manifest-bound prior version'
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft legacy upgrade rejects an unready v2.5.21 runtime before mutation' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{
+            DefenderCalls = [Collections.Generic.List[string]]::new()
+            RunCalls = [Collections.Generic.List[string]]::new()
+            CaptureCalls = [Collections.Generic.List[string]]::new()
+            BootCalls = 0; RebootCalls = 0; PreviousCalls = 0
+            BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = (New-CcodAcceptanceFacts)
+        }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state
+            Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            $adapters.CaptureFacts = {
+                param($Context, $Point)
+                if ($Context.phase -ceq 'LegacyUpgrade' -and $Point -ceq 'Before') {
+                    $facts = New-CcodAcceptanceFacts -RuntimeId '2.5.21-legacy-runtime' -Generation 1 -Version '2.5.21' -KeyHash $State.KeyHash -BootId $State.BootId
+                    $facts.taskState = 'Unknown'
+                    return $facts
+                }
+                return $State.Facts
+            }.GetNewClosure()
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            } 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+            Assert-CcodEqual 0 $state.RunCalls.Count 'an unready previous runtime cannot reach the upgrade operation'
+        } finally {
+            foreach ($path in @($fixture.Root, $previousRoot)) {
+                if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force }
+            }
+        }
+    }
+
+    Invoke-CcodTest 'official draft uninstall proves owned state is gone while preserving the device key hash' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{
+            DefenderCalls = [Collections.Generic.List[string]]::new()
+            RunCalls = [Collections.Generic.List[string]]::new()
+            CaptureCalls = [Collections.Generic.List[string]]::new()
+            BootCalls = 0; RebootCalls = 0; PreviousCalls = 0
+            BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = (New-CcodAcceptanceFacts)
+        }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            $result = Invoke-CcodAcceptancePrivate -Phase Uninstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart
+            Assert-CcodEqual 'Uninstall' ([string]$result.phase) 'uninstall returns its canonical phase'
+            Assert-CcodEqual 'Completed' ([string]$result.outcome) 'uninstall returns a completed outcome'
+            Assert-CcodEqual 'Uninstall' $state.RunCalls[1] 'uninstall invokes its injected operation after upgrade'
+            $receiptPath = Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '03-Uninstall.json'
+            $serialized = [IO.File]::ReadAllText($receiptPath)
+            foreach ($forbidden in @('C:\\Users', 'private', 'token', 'raw log')) {
+                Assert-CcodTrue (-not $serialized.Contains($forbidden)) "uninstall receipt omits $forbidden data"
+            }
+            $receipt = $serialized | ConvertFrom-Json
+            Assert-CcodTrue ([bool]$receipt.facts.stateRemoved) 'uninstall receipt records complete removal proof'
+            Assert-CcodTrue ([bool]$receipt.facts.keyHashPreserved) 'uninstall receipt records unchanged key-hash proof'
+            Assert-CcodEqual 'Absent' ([string]$receipt.facts.taskState) 'uninstall receipt records the absent scheduled task'
+            Assert-CcodEqual 0 ([int]$receipt.facts.supervisorCount) 'uninstall receipt records no Supervisor'
+            Assert-CcodEqual 0 ([int]$receipt.facts.trayHostCount) 'uninstall receipt records no TrayHost'
+            Assert-CcodTrue ($null -ne $receipt.facts.PSObject.Properties['codexCount']) 'uninstall receipt persists the Codex absence fact'
+            Assert-CcodEqual 0 ([int]$receipt.facts.codexCount) 'uninstall receipt records no Codex process'
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft uninstall rejects a lingering Codex process even without debug listeners' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            $capture = $adapters.CaptureFacts
+            $adapters.CaptureFacts = {
+                param($Context, $Point)
+                $facts = & $capture $Context $Point
+                if ($Context.phase -ceq 'Uninstall' -and $Point -ceq 'After') {
+                    $facts.codex = @([pscustomobject]@{ pid = 202; creationTimeUtc = '2030-02-03T04:05:02.0000000Z' }); $facts.codexCount = 1
+                }
+                return $facts
+            }.GetNewClosure()
+            Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Assert-CcodThrows { Invoke-CcodAcceptancePrivate -Phase Uninstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null } 'CCOD_ACCEPTANCE_UNINSTALL_OBSERVATION_INVALID'
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft uninstall rejects a lingering top-level install root' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall -LeaveInstallRootAfterUninstall
+            Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Assert-CcodThrows { Invoke-CcodAcceptancePrivate -Phase Uninstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null } 'CCOD_ACCEPTANCE_UNINSTALL_OBSERVATION_INVALID'
+            Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '03-Uninstall.json'))) 'uninstall does not persist a receipt when the top-level root remains'
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft fresh install proves one active generation and authenticated protection' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{
+            DefenderCalls = [Collections.Generic.List[string]]::new()
+            RunCalls = [Collections.Generic.List[string]]::new()
+            CaptureCalls = [Collections.Generic.List[string]]::new()
+            BootCalls = 0; RebootCalls = 0; PreviousCalls = 0
+            BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = (New-CcodAcceptanceFacts)
+        }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase Uninstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            $result = Invoke-CcodAcceptancePrivate -Phase FreshInstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart
+            Assert-CcodEqual 'FreshInstall' ([string]$result.phase) 'fresh install returns its canonical phase'
+            Assert-CcodEqual 'Completed' ([string]$result.outcome) 'fresh install returns a completed outcome'
+            Assert-CcodEqual 'FreshInstall' $state.RunCalls[2] 'fresh install invokes its injected operation after uninstall'
+            $receiptPath = Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '04-FreshInstall.json'
+            $serialized = [IO.File]::ReadAllText($receiptPath)
+            foreach ($forbidden in @('C:\\Users', 'private', 'token', 'raw log')) {
+                Assert-CcodTrue (-not $serialized.Contains($forbidden)) "fresh-install receipt omits $forbidden data"
+            }
+            $receipt = $serialized | ConvertFrom-Json
+            Assert-CcodTrue ([bool]$receipt.facts.installReady) 'fresh-install receipt records the complete readiness proof'
+            Assert-CcodEqual 1 ([int]$receipt.facts.supervisorCount) 'fresh-install receipt records one Supervisor'
+            Assert-CcodEqual 1 ([int]$receipt.facts.trayHostCount) 'fresh-install receipt records one TrayHost'
+            Assert-CcodTrue ([bool]$receipt.facts.trayAuthenticated) 'fresh-install receipt records authenticated TrayHost evidence'
+            Assert-CcodEqual 'Completed' ([string]$receipt.facts.terminalReceipt.phase) 'fresh-install receipt records a terminal lifecycle receipt'
+            Assert-CcodEqual 1 ([int]$receipt.facts.codexCount) 'fresh-install receipt records exactly one Codex process'
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft pre-reboot persists a fresh-install receipt hash and boot identity before reboot' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{
+            DefenderCalls = [Collections.Generic.List[string]]::new()
+            RunCalls = [Collections.Generic.List[string]]::new()
+            CaptureCalls = [Collections.Generic.List[string]]::new()
+            BootCalls = 0; RebootCalls = 0; PreviousCalls = 0
+            BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = (New-CcodAcceptanceFacts)
+        }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase Uninstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase FreshInstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            $adapters.Reboot = {
+                $State.RebootCalls++
+                $stateDirectory = Join-Path $evidenceRoot 'official-draft-acceptance'
+                $preRebootPath = Join-Path $stateDirectory '05-PreReboot.json'
+                $freshInstallPath = Join-Path $stateDirectory '04-FreshInstall.json'
+                Assert-CcodTrue (Test-Path -LiteralPath $preRebootPath -PathType Leaf) 'pre-reboot receipt is durable before reboot is requested'
+                $preReboot = [IO.File]::ReadAllText($preRebootPath, [Text.UTF8Encoding]::new($false, $true)) | ConvertFrom-Json
+                $freshInstallHash = Get-CcodTestFileSha256 -Path $freshInstallPath
+                Assert-CcodEqual $freshInstallHash ([string]$preReboot.facts.freshInstallReceiptSha256) 'pre-reboot receipt carries the exact fresh-install receipt hash'
+                return $true
+            }.GetNewClosure()
+            $result = Invoke-CcodAcceptancePrivate -Phase PreReboot -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart -AllowWindowsReboot
+            Assert-CcodEqual 'PreReboot' ([string]$result.phase) 'pre-reboot returns its canonical phase'
+            Assert-CcodEqual 'Completed' ([string]$result.outcome) 'pre-reboot returns a completed outcome'
+            Assert-CcodEqual 1 $state.BootCalls 'pre-reboot captures one boot identity'
+            Assert-CcodEqual 1 $state.RebootCalls 'pre-reboot invokes exactly one injected reboot'
+            $receiptPath = Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '05-PreReboot.json'
+            $receipt = ([IO.File]::ReadAllText($receiptPath) | ConvertFrom-Json)
+            Assert-CcodTrue ([bool]$receipt.facts.rebootRequested) 'pre-reboot receipt records the reboot boundary'
+            Assert-CcodEqual 'boot-1' ([string]$receipt.facts.bootIdBefore) 'pre-reboot receipt records the old boot identity'
+            Assert-CcodEqual (Get-CcodTestFileSha256 -Path (Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '04-FreshInstall.json')) ([string]$receipt.facts.freshInstallReceiptSha256) 'pre-reboot receipt binds the exact fresh-install receipt hash'
+            Assert-CcodTrue ($null -ne $receipt.facts.observation) 'pre-reboot receipt persists the complete bounded lifecycle observation'
+            foreach ($field in @('installRootPresent','installReady','activePointerPresent','activeRuntimeId','activeGeneration','runtimeManifestSha256','supervisor','trayHost','trayHostIdentity','statusPhase','statusRuntimeId','statusCodex','lifecycleReceipt','debugPorts','debugEndpoints','deviceKeySha256')) {
+                Assert-CcodTrue ($null -ne $receipt.facts.observation.PSObject.Properties[$field]) "pre-reboot observation persists $field"
+            }
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft pre-reboot rejects current runtime identity drift before reboot' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{
+            DefenderCalls = [Collections.Generic.List[string]]::new()
+            RunCalls = [Collections.Generic.List[string]]::new()
+            CaptureCalls = [Collections.Generic.List[string]]::new()
+            BootCalls = 0; RebootCalls = 0; PreviousCalls = 0
+            BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = (New-CcodAcceptanceFacts)
+        }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase Uninstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase FreshInstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            $state.Facts.activeGeneration = [UInt64]3
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase PreReboot -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart -AllowWindowsReboot | Out-Null
+            } 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+            Assert-CcodEqual 0 $state.RebootCalls 'runtime identity drift cannot reach the reboot adapter'
+        } finally {
+            foreach ($path in @($fixture.Root, $previousRoot)) {
+                if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force }
+            }
+        }
+    }
+
+    Invoke-CcodTest 'official draft post-reboot proves a new boot and recovered protected runtime' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{
+            DefenderCalls = [Collections.Generic.List[string]]::new()
+            RunCalls = [Collections.Generic.List[string]]::new()
+            CaptureCalls = [Collections.Generic.List[string]]::new()
+            BootCalls = 0; RebootCalls = 0; PreviousCalls = 0
+            BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = (New-CcodAcceptanceFacts -BootId 'boot-1')
+        }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase Uninstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase FreshInstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase PreReboot -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart -AllowWindowsReboot | Out-Null
+            $state.BootId = 'boot-2'
+            $state.Facts = New-CcodAcceptanceFacts -BootId 'boot-2'
+            $result = Invoke-CcodAcceptancePrivate -Phase PostReboot -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart -AllowWindowsReboot
+            Assert-CcodEqual 'PostReboot' ([string]$result.phase) 'post-reboot returns its canonical phase'
+            Assert-CcodEqual 'Completed' ([string]$result.outcome) 'post-reboot returns a completed outcome'
+            Assert-CcodEqual 2 $state.BootCalls 'post-reboot captures one additional boot identity'
+            Assert-CcodEqual 1 $state.RebootCalls 'post-reboot does not request another reboot'
+            Assert-CcodEqual 2 $state.DefenderCalls.Count 'post-reboot never invokes Defender'
+            $receiptPath = Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '06-PostReboot.json'
+            $receipt = ([IO.File]::ReadAllText($receiptPath) | ConvertFrom-Json)
+            Assert-CcodTrue ([bool]$receipt.facts.bootChanged) 'post-reboot receipt records a new boot identity'
+            Assert-CcodEqual 'boot-1' ([string]$receipt.facts.bootIdBefore) 'post-reboot receipt binds the pre-reboot boot'
+            Assert-CcodEqual 'boot-2' ([string]$receipt.facts.bootIdAfter) 'post-reboot receipt binds the new boot'
+            Assert-CcodTrue ([bool]$receipt.facts.receiptContinuity) 'post-reboot receipt records lifecycle receipt continuity'
+            Assert-CcodTrue ([bool]$receipt.facts.protectionRecovered) 'post-reboot receipt records recovered protection'
+            Assert-CcodEqual 'Idle' ([string]$receipt.facts.transitionStage) 'post-reboot receipt records the Idle transition'
+            Assert-CcodTrue ([bool]$receipt.facts.keyHashPreserved) 'post-reboot receipt records unchanged key-hash proof'
+            Assert-CcodEqual 1 ([int]$receipt.facts.codexCount) 'post-reboot receipt records exactly one Codex process'
+            Assert-CcodTrue ($null -ne $receipt.facts.observation) 'post-reboot receipt persists the complete bounded lifecycle observation'
+            foreach ($field in @('installRootPresent','installReady','activePointerPresent','activeRuntimeId','activeGeneration','runtimeManifestSha256','supervisor','trayHost','trayHostIdentity','statusPhase','statusRuntimeId','statusCodex','lifecycleReceipt','debugPorts','debugEndpoints','deviceKeySha256')) {
+                Assert-CcodTrue ($null -ne $receipt.facts.observation.PSObject.Properties[$field]) "post-reboot observation persists $field"
+            }
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft ready-for-manual-evidence requires every automated phase but never claims complete' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{
+            DefenderCalls = [Collections.Generic.List[string]]::new()
+            RunCalls = [Collections.Generic.List[string]]::new()
+            CaptureCalls = [Collections.Generic.List[string]]::new()
+            BootCalls = 0; RebootCalls = 0; PreviousCalls = 0
+            BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = (New-CcodAcceptanceFacts -BootId 'boot-1')
+        }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase Uninstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase FreshInstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase PreReboot -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart -AllowWindowsReboot | Out-Null
+            $state.BootId = 'boot-2'; $state.Facts = New-CcodAcceptanceFacts -BootId 'boot-2'
+            Invoke-CcodAcceptancePrivate -Phase PostReboot -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart -AllowWindowsReboot | Out-Null
+            $result = Invoke-CcodAcceptancePrivate -Phase ReadyForManualEvidence -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters
+            Assert-CcodEqual 'ReadyForManualEvidence' ([string]$result.phase) 'ready phase returns its canonical phase'
+            Assert-CcodEqual 'ReadyForManualEvidence' ([string]$result.outcome) 'ready phase does not use a free-text completion result'
+            Assert-CcodEqual $false ([bool]$result.complete) 'ready phase never claims Complete'
+            $receiptPath = Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '07-ReadyForManualEvidence.json'
+            $serialized = [IO.File]::ReadAllText($receiptPath)
+            Assert-CcodTrue ($serialized -notmatch '"outcome"\s*:\s*"Complete"') 'ready receipt contains no Complete claim'
+            $receipt = $serialized | ConvertFrom-Json
+            Assert-CcodEqual 6 @($receipt.facts.automatedPhases).Count 'ready receipt requires all six automated phases'
+            Assert-CcodEqual $false ([bool]$receipt.facts.complete) 'ready receipt records that manual evidence is still pending'
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+    Invoke-CcodTest 'official draft rejects a tampered legacy receipt before uninstall mutation' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{
+            DefenderCalls = [Collections.Generic.List[string]]::new()
+            RunCalls = [Collections.Generic.List[string]]::new()
+            CaptureCalls = [Collections.Generic.List[string]]::new()
+            BootCalls = 0; RebootCalls = 0; PreviousCalls = 0
+            BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = (New-CcodAcceptanceFacts)
+        }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            $legacyPath = Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '02-LegacyUpgrade.json'
+            $legacy = [IO.File]::ReadAllText($legacyPath) | ConvertFrom-Json
+            $legacy.draft.id = '999'
+            [IO.File]::WriteAllText($legacyPath, ($legacy | ConvertTo-Json -Depth 16), [Text.UTF8Encoding]::new($false))
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase Uninstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart
+            } 'CCOD_ACCEPTANCE_DRAFT_IDENTITY_CHANGED'
+            Assert-CcodEqual 1 $state.RunCalls.Count 'draft identity mismatch is rejected before uninstall mutation'
+            $legacy.draft.id = '123'
+            [IO.File]::WriteAllText($legacyPath, ($legacy | ConvertTo-Json -Depth 16), [Text.UTF8Encoding]::new($false))
+            $legacy = [IO.File]::ReadAllText($legacyPath) | ConvertFrom-Json
+            $legacy.facts.keyHashPreserved = $false
+            [IO.File]::WriteAllText($legacyPath, ($legacy | ConvertTo-Json -Depth 16), [Text.UTF8Encoding]::new($false))
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase Uninstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart
+            } 'CCOD_ACCEPTANCE_RECEIPT_INVALID'
+            Assert-CcodEqual 1 $state.RunCalls.Count 'tampered receipt is rejected before uninstall mutation'
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft default Defender adapter binds each downloaded asset to its checksum and manifest' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        $fakeState = [pscustomobject]@{ Calls = [Collections.Generic.List[object]]::new() }
+        $fakeModule = New-Module -ArgumentList $fakeState -ScriptBlock {
+            param($State)
+            function Invoke-CcodReleaseDefenderCheck {
+                param($CandidatePath,$ChecksumPath,$ManifestPath,$Origin,$ExpectedVersion,$ExpectedGitCommit,$EvidencePath)
+                $State.Calls.Add([pscustomobject][ordered]@{
+                    CandidatePath = $CandidatePath
+                    ChecksumPath = $ChecksumPath
+                    ManifestPath = $ManifestPath
+                    Origin = $Origin
+                    ExpectedVersion = $ExpectedVersion
+                    ExpectedGitCommit = $ExpectedGitCommit
+                    EvidencePath = $EvidencePath
+                })
+                [pscustomobject]@{ fixture = $true }
+            }
+            Export-ModuleMember -Function Invoke-CcodReleaseDefenderCheck
+        }
+        try {
+            &$module {
+                param($Fake,$Root,$Commit,$SetupReceipt,$PortableReceipt)
+                $script:CcodOfficialDraftDefenderModule = $Fake
+                $defaults = Get-CcodOfficialDraftDefaultAdapters
+                & $defaults.InvokeDefenderCheck $Root 'Setup' 'InternetDownload' '2.5.22' $Commit $SetupReceipt | Out-Null
+                & $defaults.InvokeDefenderCheck $Root 'PortableZip' 'InternetDownload' '2.5.22' $Commit $PortableReceipt | Out-Null
+            } $fakeModule $fixture.Root $fixture.GitCommit (Join-Path $fixture.Root 'setup-receipt.json') (Join-Path $fixture.Root 'portable-receipt.json')
+            Assert-CcodEqual 2 $fakeState.Calls.Count 'default Defender adapter invokes the checker once per downloaded asset'
+            $setup = $fakeState.Calls[0]
+            Assert-CcodEqual (Join-Path $fixture.Root $fixture.Names[5]) ([string]$setup.CandidatePath) 'Setup scan uses the Setup executable'
+            Assert-CcodEqual (Join-Path $fixture.Root $fixture.Names[6]) ([string]$setup.ChecksumPath) 'Setup scan uses its checksum'
+            Assert-CcodEqual (Join-Path $fixture.Root $fixture.Names[10]) ([string]$setup.ManifestPath) 'Setup scan uses its release manifest'
+            $portable = $fakeState.Calls[1]
+            Assert-CcodEqual (Join-Path $fixture.Root $fixture.Names[0]) ([string]$portable.CandidatePath) 'portable scan uses the ZIP'
+            Assert-CcodEqual (Join-Path $fixture.Root $fixture.Names[1]) ([string]$portable.ChecksumPath) 'portable scan uses its checksum'
+            Assert-CcodEqual (Join-Path $fixture.Root $fixture.Names[4]) ([string]$portable.ManifestPath) 'portable scan uses its release manifest'
+        } finally {
+            if ($null -ne $fakeModule) { Remove-Module -Name $fakeModule.Name -Force -ErrorAction SilentlyContinue }
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft schemas reject non-integer numbers and scalar arrays' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            Assert-CcodTrue (-not (& $module { param($Value) Test-CcodOfficialDraftPositiveInteger $Value } ([double]2.0))) 'floating point pseudo-integer is rejected'
+            Assert-CcodTrue (-not (& $module { param($Value) Test-CcodOfficialDraftPositiveInteger $Value } ([decimal]2))) 'decimal pseudo-integer is rejected'
+            $freshFacts = New-CcodAcceptanceFacts
+            $freshFacts.activeGeneration = [double]2
+            Assert-CcodThrows {
+                &$module { param($Facts,$KeyHash) Assert-CcodOfficialDraftFreshFacts -Facts $Facts -ExpectedKeyHash $KeyHash } $freshFacts ('b' * 64) | Out-Null
+            } 'CCOD_ACCEPTANCE_FRESH_INSTALL_OBSERVATION_INVALID'
+            $receipt = New-CcodAcceptanceDefenderReceipt -Fixture $fixture -AssetType Setup
+            $receipt.assetName = @([string]$receipt.assetName)
+            $candidate = [pscustomobject][ordered]@{
+                version = $fixture.Version; gitCommit = $fixture.GitCommit
+                assetHashes = @($fixture.Contract.Assets)
+                manifestHashes = [pscustomobject][ordered]@{ portable = $fixture.Contract.PortableManifestSha256; setup = $fixture.Contract.SetupManifestSha256 }
+            }
+            Assert-CcodThrows {
+                &$module { param($Receipt,$Candidate) Assert-CcodOfficialDraftDefenderReceipt -Receipt $Receipt -Candidate $Candidate -AssetType Setup } $receipt $candidate | Out-Null
+            } 'CCOD_ACCEPTANCE_DEFENDER_RECEIPT_INVALID'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if ($null -ne $fixture -and (Test-Path -LiteralPath $fixture.Root)) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft phase operation requires completed and outcome to agree' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            $state = [pscustomobject]@{ RunCalls = [Collections.Generic.List[string]]::new() }
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state
+            $adapters.RunPhase = { param($Context) [pscustomobject][ordered]@{ completed = $false; outcome = 'Completed'; installerSha256 = [string]$fixture.Contract.Assets[5].sha256; runtimeManifestSha256 = ('1' * 64) } }.GetNewClosure()
+            $context = [pscustomobject][ordered]@{
+                setupPath = Join-Path $fixture.Root $fixture.Names[5]
+                candidate = [pscustomobject][ordered]@{ assetHashes = @($fixture.Contract.Assets) }
+            }
+            Assert-CcodThrows {
+                &$module { param($Adapters,$Context) Invoke-CcodOfficialDraftPhaseOperation -Adapters $Adapters -Context $Context } $adapters $context | Out-Null
+            } 'CCOD_ACCEPTANCE_MACHINE_OPERATION_FAILED'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft persisted hash validators use absolute end anchors' {
+        $source = [IO.File]::ReadAllText($modulePath, [Text.UTF8Encoding]::new($false))
+        Assert-CcodTrue (-not $source.Contains("'^[0-9a-f]{40}$'")) 'acceptance commit validators reject trailing newline variants'
+        Assert-CcodTrue (-not $source.Contains("'^[0-9a-f]{64}$'")) 'acceptance hash validators reject trailing newline variants'
+    }
+
+    Invoke-CcodTest 'official draft JSONL rejects duplicate object properties' {
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            Assert-CcodThrows { &$module { param($Raw) Assert-CcodOfficialDraftJsonNoDuplicateProperties -Raw $Raw } '{"code":"first","code":"second"}' } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID'
+            Assert-CcodThrows { &$module { param($Raw) Assert-CcodOfficialDraftJsonNoDuplicateProperties -Raw $Raw } '{"code":"first","\u0063ode":"second"}' } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID'
+        } finally { if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue } }
+    }
+
+    Invoke-CcodTest 'official draft debug endpoints require an owning verified process' {
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            Assert-CcodThrows { &$module { param($Endpoints) Assert-CcodOfficialDraftDebugEndpointOwnership -Endpoints $Endpoints -ExpectedPorts @(9229) -ExpectedPid 13948 -ExpectedCreationTimeUtc '2030-02-03T04:05:02.0000000Z' } @([pscustomobject]@{ localAddress = '127.0.0.1'; localPort = 9229 }) } 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+        } finally { if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue } }
+    }
+
+    Invoke-CcodTest 'official draft debug endpoint owning process rejects Int32 wrapping values' {
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            $endpoint = [pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = 9229; owningProcess = [uint64]4294981244; owningProcessCreationTimeUtc = '2030-02-03T04:05:02.0000000Z' }
+            Assert-CcodThrows { &$module { param($Endpoints) Assert-CcodOfficialDraftDebugEndpointOwnership -Endpoints $Endpoints -ExpectedPorts @(9229) -ExpectedPid 13948 -ExpectedCreationTimeUtc '2030-02-03T04:05:02.0000000Z' } @($endpoint) } 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+        } finally { if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue } }
+    }
+
+    Invoke-CcodTest 'official draft tray and remote proofs reject noncanonical timestamps' {
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            $tray = [pscustomobject][ordered]@{ timestampUtc = '2030-02-03T04:05:06+00:00'; command = 'ShowAbout'; revision = [UInt64]1; code = 'CCOD_TRAY_ACTION_COMPLETED'; status = 'Completed' }
+            Assert-CcodThrows { &$module { param($Proof) ConvertTo-CcodOfficialDraftTrayProof -Proof $Proof -Operation About } $tray } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID'
+            $remote = [pscustomobject][ordered]@{
+                schemaVersion = 1; timestampUtc = '2030-02-03T04:05:06+00:00'; kind = 'remote-control-manual-proof'; operation = 'SecondDeviceControl'; deviceRole = 'SecondDevice'; challenge = 'run-1'; candidateVersion = '2.5.22'; runtimeId = 'runtime-2.5.22'; runtimeGeneration = [UInt64]2; runtimeManifestSha256 = ('d' * 64); attestation = 'HumanReviewedStructuredAttestation'; connection = 'Connected'; control = 'Completed'; outcome = 'Completed'; code = 'CCOD_REMOTE_ACTION_COMPLETED'
+            }
+            Assert-CcodThrows { &$module { param($Proof) ConvertTo-CcodOfficialDraftRemoteProof -Proof $Proof } $remote } 'CCOD_ACCEPTANCE_REMOTE_UNPROVEN'
+        } finally { if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue } }
+    }
+
+    Invoke-CcodTest 'official draft tray proof requires a real terminal action record' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-tray-proof-' + [guid]::NewGuid().ToString('N'))
+        $log = Join-Path $root 'supervisor.log'
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $record = [ordered]@{ schemaVersion = 1; timestampUtc = '2030-02-03T04:05:07.0000000Z'; component = 'Supervisor'; stage = 'TrayAction'; code = 'CCOD_TRAY_ACTION_COMPLETED'; outcome = 'Completed'; command = 'ShowAbout'; revision = [UInt64]1; status = 'Completed' }
+        [IO.File]::WriteAllText($log, (($record | ConvertTo-Json -Compress) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            $proof = &$module { param($Path) Get-CcodOfficialDraftTrayActionProof -Path $Path -Operation About -NotBefore ([DateTimeOffset]::Parse('2030-02-03T04:05:06.0000000Z')) } $log
+            Assert-CcodEqual 'ShowAbout' ([string]$proof.command) 'tray proof binds the actual command'
+            [IO.File]::WriteAllText($log, (($record | ConvertTo-Json -Compress) + [Environment]::NewLine + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+            Assert-CcodThrows { &$module { param($Path) Get-CcodOfficialDraftTrayActionProof -Path $Path -Operation About } $log | Out-Null } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID'
+            $arrayRecord = [ordered]@{}
+            foreach ($key in $record.Keys) { $arrayRecord[$key] = $record[$key] }
+            $arrayRecord.stage = @('TrayAction')
+            [IO.File]::WriteAllText($log, (($arrayRecord | ConvertTo-Json -Compress) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+            Assert-CcodThrows { &$module { param($Path) Get-CcodOfficialDraftTrayActionProof -Path $Path -Operation About } $log | Out-Null } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID'
+            [IO.File]::WriteAllText($log, (($record | ConvertTo-Json -Compress) + [Environment]::NewLine + '{"stage":"TrayAction"}' + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+            Assert-CcodThrows { &$module { param($Path) Get-CcodOfficialDraftTrayActionProof -Path $Path -Operation About -NotBefore ([DateTimeOffset]::Parse('2030-02-03T04:05:06.0000000Z')) } $log | Out-Null } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID'
+            [IO.File]::WriteAllText($log, 'completed', [Text.UTF8Encoding]::new($false))
+            Assert-CcodThrows { &$module { param($Path) Get-CcodOfficialDraftTrayActionProof -Path $Path -Operation About } $log | Out-Null } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft tray ready proof selects the current host from historical records' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-tray-ready-history-' + [guid]::NewGuid().ToString('N'))
+        $logDirectory = Join-Path $root 'logs'
+        $log = Join-Path $logDirectory 'supervisor.log'
+        $module = $null
+        try {
+            [IO.Directory]::CreateDirectory($logDirectory) | Out-Null
+            $base = [ordered]@{ schemaVersion = 1; timestampUtc = '2030-02-03T04:05:07.0000000Z'; component = 'Supervisor'; stage = 'TrayHostReady'; code = 'CCOD_TRAYHOST_READY'; outcome = 'Completed'; runtimeId = 'runtime-2.5.21'; hostPid = 101; hostCreationTimeUtc = '2030-02-03T04:04:01.0000000Z'; protocolMajor = 2; capabilities = [UInt64]2 }
+            $current = [ordered]@{ schemaVersion = 1; timestampUtc = $base.timestampUtc; component = 'Supervisor'; stage = 'TrayHostReady'; code = 'CCOD_TRAYHOST_READY'; outcome = 'Completed'; runtimeId = 'runtime-2.5.22'; hostPid = 201; hostCreationTimeUtc = '2030-02-03T04:05:01.0000000Z'; protocolMajor = 2; capabilities = [UInt64]2 }
+            [IO.File]::WriteAllText($log, (($base | ConvertTo-Json -Compress) + [Environment]::NewLine + ($current | ConvertTo-Json -Compress) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+            $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            $proof = &$module { param($InstallRoot,$Hosts) Get-CcodOfficialDraftTrayHostReadyProof -InstallRoot $InstallRoot -RuntimeId 'runtime-2.5.22' -TrayHosts $Hosts } $root @([pscustomobject]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' })
+            Assert-CcodTrue ($null -ne $proof -and [int]$proof.hostPid -eq 201) 'current TrayHost identity is selected from historical ready records'
+            $oldRuntimeCurrentHost = [ordered]@{}
+            foreach ($key in $current.Keys) { $oldRuntimeCurrentHost[$key] = $current[$key] }
+            $oldRuntimeCurrentHost.runtimeId = 'runtime-2.5.21'
+            [IO.File]::WriteAllText($log, (($oldRuntimeCurrentHost | ConvertTo-Json -Compress) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+            $oldRuntimeProof = &$module { param($InstallRoot,$Hosts) Get-CcodOfficialDraftTrayHostReadyProof -InstallRoot $InstallRoot -RuntimeId 'runtime-2.5.22' -TrayHosts $Hosts } $root @([pscustomobject]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' })
+            Assert-CcodTrue ($null -eq $oldRuntimeProof) 'matching process identity from another runtime cannot prove current readiness'
+            $offsetReady = [ordered]@{}
+            foreach ($key in $current.Keys) { $offsetReady[$key] = $current[$key] }
+            $offsetReady.hostCreationTimeUtc = '2030-02-03T04:05:01.0000000+00:00'
+            [IO.File]::WriteAllText($log, (($base | ConvertTo-Json -Compress) + [Environment]::NewLine + ($offsetReady | ConvertTo-Json -Compress) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+            Assert-CcodThrows { &$module { param($InstallRoot,$Hosts) Get-CcodOfficialDraftTrayHostReadyProof -InstallRoot $InstallRoot -RuntimeId 'runtime-2.5.22' -TrayHosts $Hosts } $root @([pscustomobject]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' }) } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID'
+            $arrayReady = [ordered]@{}
+            foreach ($key in $current.Keys) { $arrayReady[$key] = $current[$key] }
+            $arrayReady.stage = @('TrayHostReady')
+            [IO.File]::WriteAllText($log, (($base | ConvertTo-Json -Compress) + [Environment]::NewLine + ($arrayReady | ConvertTo-Json -Compress) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+            Assert-CcodThrows { &$module { param($InstallRoot,$Hosts) Get-CcodOfficialDraftTrayHostReadyProof -InstallRoot $InstallRoot -RuntimeId 'runtime-2.5.22' -TrayHosts $Hosts } $root @([pscustomobject]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' }) } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID'
+            $withinCompatibility = [ordered]@{ schemaVersion = 1; timestampUtc = $base.timestampUtc; component = 'Supervisor'; stage = 'TrayHostReady'; code = 'CCOD_TRAYHOST_READY'; outcome = 'Completed'; runtimeId = 'runtime-2.5.22'; hostPid = 201; hostCreationTimeUtc = '2030-02-03T04:05:01.0000001Z'; protocolMajor = 2; capabilities = 7 }
+            [IO.File]::WriteAllText($log, (($base | ConvertTo-Json -Compress) + [Environment]::NewLine + ($withinCompatibility | ConvertTo-Json -Compress) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+            $withinProof = &$module { param($InstallRoot,$Hosts) Get-CcodOfficialDraftTrayHostReadyProof -InstallRoot $InstallRoot -RuntimeId 'runtime-2.5.22' -TrayHosts $Hosts } $root @([pscustomobject]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' })
+            Assert-CcodTrue ($null -eq $withinProof) 'native creation identity requires exact equality even within one CIM microsecond'
+            $near = [ordered]@{ schemaVersion = 1; timestampUtc = $base.timestampUtc; component = 'Supervisor'; stage = 'TrayHostReady'; code = 'CCOD_TRAYHOST_READY'; outcome = 'Completed'; runtimeId = 'runtime-2.5.22'; hostPid = 201; hostCreationTimeUtc = '2030-02-03T04:05:01.0000010Z'; protocolMajor = 2; capabilities = 7 }
+            [IO.File]::WriteAllText($log, (($base | ConvertTo-Json -Compress) + [Environment]::NewLine + ($near | ConvertTo-Json -Compress) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+            $nearProof = &$module { param($InstallRoot,$Hosts) Get-CcodOfficialDraftTrayHostReadyProof -InstallRoot $InstallRoot -RuntimeId 'runtime-2.5.22' -TrayHosts $Hosts } $root @([pscustomobject]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' })
+            Assert-CcodTrue ($null -eq $nearProof) 'creation identity outside the observed native instant is rejected'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'default capture preserves exact native tray readiness and collector rejection' {
+        $root=Join-Path $env:TEMP ('ccod-native-ready-capture-'+[guid]::NewGuid().ToString('N'))
+        $logs=Join-Path $root 'logs';$log=Join-Path $logs 'supervisor.log';$module=$null;$integration=$null
+        try {
+            [IO.Directory]::CreateDirectory($logs)|Out-Null
+            $facts=New-CcodAcceptanceRawFacts
+            $facts.trayHost[0].CreationTimeUtc='2030-02-03T04:05:01.0000006Z'
+            $facts.trayHostIdentity.creationTimeUtc=$facts.trayHost[0].CreationTimeUtc
+            $state=[pscustomobject]@{Facts=$facts;Calls=0;ProofCalls=0;OverrideAuth=$null}
+            $record=[ordered]@{schemaVersion=1;timestampUtc='2030-02-03T04:05:07.0000000Z';component='Supervisor';stage='TrayHostReady';code='CCOD_TRAYHOST_READY';outcome='Completed';runtimeId=$facts.activeRuntimeId;hostPid=201;hostCreationTimeUtc=$facts.trayHost[0].CreationTimeUtc;protocolMajor=2;capabilities=2}
+            [IO.File]::WriteAllText($log,(($record|ConvertTo-Json -Compress)+"`n"),[Text.UTF8Encoding]::new($false))
+            $module=Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            $integration=&$module {Get-CcodOfficialDraftIntegrationModule}
+            &$integration {
+                param($State)
+                $script:CcodNativeReadyState=$State
+                function script:Get-CcodInstalledLifecycleFacts {
+                    param($InstallRoot,$ExpectedVersion)
+                    $s=$script:CcodNativeReadyState;$s.Calls++;$value=$s.Facts.PSObject.Copy();$s.ProofCalls++
+                    $value.trayAuthenticated=Get-CcodInstalledLifecycleTrayHostReadyProof -InstallRoot $InstallRoot -RuntimeId $value.activeRuntimeId -TrayHost $value.trayHost
+                    if($null-ne$s.OverrideAuth){$value.trayAuthenticated=$s.OverrideAuth}
+                    return $value
+                }
+            } $state
+            $capture=&$module {param($Root,$Integration)$script:CcodOfficialDraftInstallRoot=$Root;$script:CcodOfficialDraftIntegrationModule=$Integration;(Get-CcodOfficialDraftDefaultAdapters).CaptureFacts} $root $integration
+            $context=[pscustomobject]@{phase='PostReboot';expectedVersion='2.5.22'}
+            $positive=&$capture $context 'After'
+            Assert-CcodTrue $positive.trayAuthenticated 'exact nonzero native tick identity passes both real matchers'
+            Assert-CcodTrue $positive.protectionReady 'positive default capture proves readiness'
+            $record.hostCreationTimeUtc='2030-02-03T04:05:01.0000007Z'
+            [IO.File]::WriteAllText($log,(($record|ConvertTo-Json -Compress)+"`n"),[Text.UTF8Encoding]::new($false))
+            $changed=&$capture $context 'After'
+            Assert-CcodEqual 2 $state.ProofCalls 'changed identity reaches real integration matcher'
+            Assert-CcodEqual $false $changed.trayAuthenticated 'one changed native tick cannot regain authentication in default capture'
+            Assert-CcodEqual $false $changed.protectionReady 'mismatched native identity is not protection ready'
+            $record.hostCreationTimeUtc=$facts.trayHost[0].CreationTimeUtc
+            [IO.File]::WriteAllText($log,(($record|ConvertTo-Json -Compress)+"`n"),[Text.UTF8Encoding]::new($false))
+            $state.OverrideAuth=$false
+            $rejected=&$capture $context 'After'
+            Assert-CcodEqual $false $rejected.trayAuthenticated 'exact log cannot override collector authentication rejection'
+            foreach($invalid in @('true',1,@($true))){$state.OverrideAuth=$invalid;Assert-CcodThrows {&$capture $context 'After'|Out-Null} 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'}
+            $state.OverrideAuth=$null
+            Assert-CcodTrue ((&$capture $context 'After').protectionReady) 'clean retry is possible after rejected observations'
+        } finally {
+            if($null-ne$integration){Remove-Module $integration -Force -ErrorAction SilentlyContinue}
+            if($null-ne$module){Remove-Module $module -Force -ErrorAction SilentlyContinue}
+            if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force}
+        }
+    }
+
+    Invoke-CcodTest 'official draft tray ready proof rejects noncanonical timestamps' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-tray-ready-timestamp-' + [guid]::NewGuid().ToString('N'))
+        $logDirectory = Join-Path $root 'logs'
+        $log = Join-Path $logDirectory 'supervisor.log'
+        $module = $null
+        try {
+            [IO.Directory]::CreateDirectory($logDirectory) | Out-Null
+            $record = [ordered]@{ schemaVersion = 1; timestampUtc = 'not-a-canonical-utc'; component = 'Supervisor'; stage = 'TrayHostReady'; code = 'CCOD_TRAYHOST_READY'; outcome = 'Completed'; runtimeId = 'runtime-2.5.22'; hostPid = 201; hostCreationTimeUtc = '2030-02-03T04:05:01.0000000Z'; protocolMajor = 2; capabilities = [UInt64]2 }
+            [IO.File]::WriteAllText($log, (($record | ConvertTo-Json -Compress) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+            $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            Assert-CcodThrows { &$module { param($InstallRoot) Get-CcodOfficialDraftTrayHostReadyProof -InstallRoot $InstallRoot -RuntimeId 'runtime-2.5.22' -TrayHosts @([pscustomobject]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' }) } $root } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft default tray operation verifies live and redacted terminal records' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-default-tray-operation-' + [guid]::NewGuid().ToString('N'))
+        $logDirectory = Join-Path $root 'logs'
+        $liveLog = Join-Path $logDirectory 'supervisor.log'
+        $redactedLog = Join-Path $root 'redacted.log'
+        $screenshot = Join-Path $root 'screenshot.png'
+        [IO.Directory]::CreateDirectory((Join-Path $root 'runtime')) | Out-Null
+        [IO.Directory]::CreateDirectory($logDirectory) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $root 'active.json'), '{}', [Text.UTF8Encoding]::new($false))
+        $future = [DateTimeOffset]::UtcNow.AddMinutes(5).ToUniversalTime().ToString("yyyy-MM-dd'T'HH:mm:ss.fffffff'Z'",[Globalization.CultureInfo]::InvariantCulture)
+        $readyRecord = [ordered]@{ schemaVersion = 1; timestampUtc = $future; component = 'Supervisor'; stage = 'TrayHostReady'; code = 'CCOD_TRAYHOST_READY'; outcome = 'Completed'; runtimeId = 'runtime-2.5.22'; hostPid = 201; hostCreationTimeUtc = '2030-02-03T04:05:01.0000000Z'; protocolMajor = 2; capabilities = [UInt64]2 }
+        $actionRecord = [ordered]@{ schemaVersion = 1; timestampUtc = $future; component = 'Supervisor'; stage = 'TrayAction'; code = 'CCOD_TRAY_ACTION_COMPLETED'; outcome = 'Completed'; command = 'ShowAbout'; revision = [UInt64]1; status = 'Completed' }
+        $serialized = (($readyRecord | ConvertTo-Json -Compress) + "`n" + ($actionRecord | ConvertTo-Json -Compress) + [Environment]::NewLine)
+        [IO.File]::WriteAllText($liveLog, $serialized, [Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($redactedLog, (($actionRecord | ConvertTo-Json -Compress) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($screenshot, 'fixture screenshot', [Text.UTF8Encoding]::new($false))
+        $facts = [pscustomobject][ordered]@{
+            installRootPresent = $true; appPresent = $true; runtimeRootPresent = $true; activePointerPresent = $true; activeRuntimeId = 'runtime-2.5.22'; activeGeneration = [UInt64]2; runtimeManifestSha256 = ('d' * 64)
+            supervisor = @([pscustomobject]@{ Pid = 200; CreationTimeUtc = '2030-02-03T04:05:00.0000000Z' })
+            trayHost = @([pscustomobject]@{ Pid = 201; CreationTimeUtc = '2030-02-03T04:05:01.0000000Z' })
+            trayHostIdentity = [pscustomobject][ordered]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' }
+            codex = @([pscustomobject]@{ Pid = 202; CreationTimeUtc = '2030-02-03T04:05:02.0000000Z' })
+            trayAuthenticated = $true
+            taskState = 'Ready'; statusPhase = 'Active'; statusRuntimeId = 'runtime-2.5.22'
+            statusCodex = [pscustomobject]@{ pid = 202; creationTimeUtc = '2030-02-03T04:05:02.0000000Z' }
+            transitionStage = 'Idle'; lifecycleReceipt = [pscustomobject][ordered]@{ kind = 'RestartAndRepair'; origin = 'Installer'; runtimeId = 'runtime-2.5.22'; runtimeGeneration = [UInt64]2; phase = 'Completed' }
+            aboutVersion = '2.5.22'; deviceKeyPresent = $true; deviceKeySha256 = ('b' * 64)
+            shortcuts = [pscustomobject][ordered]@{ startMenu = $true; desktop = $true }
+            debugEndpoints = @([pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = 9229; owningProcess = 202; owningProcessCreationTimeUtc = '2030-02-03T04:05:02.0000000Z' },[pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = 9230; owningProcess = 202; owningProcessCreationTimeUtc = '2030-02-03T04:05:02.0000000Z' })
+            debugPorts = @(9229,9230)
+        }
+        $fakeIntegration = New-Module -ArgumentList $facts -ScriptBlock {
+            param($Facts)
+            function Get-CcodInstalledLifecycleFacts { param([string]$InstallRoot,[string]$ExpectedVersion); return $Facts }
+            Export-ModuleMember -Function Get-CcodInstalledLifecycleFacts
+        }
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            Assert-CcodEqual $null $facts.PSObject.Properties['codexCount'] 'raw integration output has identities rather than a precomputed codex count'
+            $observation = &$module {
+                param($InstallRoot,$EvidencePath,$FakeIntegration,$ScreenshotPath)
+                $script:CcodOfficialDraftManualAcknowledgement = { param([string]$Prompt) return 'CCOD_MANUAL_ABOUT_COMPLETED' }
+                $script:CcodOfficialDraftInstallRoot = $InstallRoot
+                $script:CcodOfficialDraftIntegrationModule = $FakeIntegration
+                $adapters = Get-CcodOfficialDraftDefaultAdapters
+                $context = [pscustomobject][ordered]@{ screenshotPath = $ScreenshotPath; redactedLogPath = $EvidencePath; expectedVersion = '2.5.22'; manualAcknowledgement = 'CCOD_MANUAL_ABOUT_COMPLETED' }
+                $captured = & $adapters.CaptureFacts ([pscustomobject]@{ phase = 'PostReboot'; expectedVersion = '2.5.22' }) 'After'
+                $result = & $adapters.RunManualOperation $context 'About'
+                [pscustomobject]@{ Captured = $captured; Result = $result; Capture = $adapters.CaptureFacts }
+            } $root $redactedLog $fakeIntegration $screenshot
+            $result = $observation.Result
+            Assert-CcodEqual 1 $observation.Captured.codexCount 'default capture derives the count from the observed identities'
+            Assert-CcodEqual 'Idle' $observation.Captured.transitionStage 'default capture preserves transition state for core validation'
+            $coreObservation = & $module { param($Captured) ConvertTo-CcodOfficialDraftLegacyObservation -Facts $Captured -ExpectedVersion '2.5.22' } $observation.Captured
+            Assert-CcodEqual '2.5.22' $coreObservation.version 'actual default capture output passes the strict core observation contract'
+            Assert-CcodEqual 1 $coreObservation.codex.Count 'strict core observes the same single Codex identity'
+            foreach ($kind in @('supervisor','trayHost','codex')) {
+                Assert-CcodEqual 'pid,creationTimeUtc' ($observation.Captured.$kind[0].PSObject.Properties.Name -join ',') 'native producer identity fields become the canonical core schema'
+            }
+            $captureContext = [pscustomobject]@{ phase = 'PostReboot'; expectedVersion = '2.5.22' }
+            $facts.transitionStage = 'NotIdle'
+            $busy = & $observation.Capture $captureContext 'After'
+            Assert-CcodEqual 'NotIdle' $busy.transitionStage 'nonterminal transition state is retained'
+            Assert-CcodEqual $false $busy.protectionReady 'busy transition cannot be promoted to ready by the adapter'
+            $facts.transitionStage = 'Idle'
+            $facts.activeGeneration = @([UInt64]2)
+            Assert-CcodThrows { & $observation.Capture $captureContext 'After' | Out-Null } 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+            $facts.activeGeneration = [UInt64]2
+            $facts.transitionStage = @('Idle')
+            Assert-CcodThrows { & $observation.Capture $captureContext 'After' | Out-Null } 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+            $facts.transitionStage = 'Idle'
+            $facts.codex[0].Pid = '202'
+            Assert-CcodThrows { & $observation.Capture $captureContext 'After' | Out-Null } 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+            $facts.codex[0].Pid = 202
+            $facts | Add-Member -NotePropertyName codexCount -NotePropertyValue 2
+            Assert-CcodThrows { & $observation.Capture $captureContext 'After' | Out-Null } 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+            $facts.PSObject.Properties.Remove('codexCount')
+            Assert-CcodTrue ([bool]$result.verified) 'default tray adapter returns verified only after both terminal records match'
+            Assert-CcodEqual 'CCOD_TRAYABOUT_COMPLETED' ([string]$result.code) 'default tray adapter returns the canonical operation code'
+            Assert-CcodTrue ($result.screenshotSha256 -is [string] -and $result.screenshotSha256 -match '^[0-9a-f]{64}\z') 'default tray adapter captures the screenshot hash'
+            Assert-CcodTrue ($result.redactedLogSha256 -is [string] -and $result.redactedLogSha256 -match '^[0-9a-f]{64}\z') 'default tray adapter captures the redacted log hash'
+            $bad = &$module {
+                param($InstallRoot,$EvidencePath,$FakeIntegration,$ScreenshotPath)
+                $script:CcodOfficialDraftManualAcknowledgement = { param([string]$Prompt) return 'CCOD_MANUAL_ABOUT_COMPLETED' }
+                $script:CcodOfficialDraftInstallRoot = $InstallRoot
+                $script:CcodOfficialDraftIntegrationModule = $FakeIntegration
+                $adapters = Get-CcodOfficialDraftDefaultAdapters
+                $context = [pscustomobject][ordered]@{ screenshotPath = $ScreenshotPath; redactedLogPath = $EvidencePath; expectedVersion = '2.5.22'; expectedRuntimeId = 'runtime-other'; manualAcknowledgement = 'CCOD_MANUAL_ABOUT_COMPLETED' }
+                try { & $adapters.RunManualOperation $context 'About' | Out-Null; return $null } catch { return $_ }
+            } $root $redactedLog $fakeIntegration $screenshot
+            Assert-CcodTrue ($null -ne $bad -and [string]$bad.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_MANUAL_OPERATION_UNPROVEN*') 'default tray adapter binds manual proof to the persisted runtime identity'
+        } finally {
+            if ($null -ne $module) { & $module { $script:CcodOfficialDraftManualAcknowledgement = $null }; Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if ($null -ne $fakeIntegration) { Remove-Module -Name $fakeIntegration.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft default absent observation preserves empty arrays and null state' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-absent-capture-' + [guid]::NewGuid().ToString('N'))
+        $facts = [pscustomobject][ordered]@{
+            installRootPresent = $false; appPresent = $false; runtimeRootPresent = $false; activePointerPresent = $false
+            activeRuntimeId = $null; activeGeneration = $null; runtimeManifestSha256 = $null
+            supervisor = @(); trayHost = @(); codex = @(); taskState = 'Absent'; statusPhase = 'Unavailable'
+            statusRuntimeId = $null; statusCodex = $null; transitionStage = 'Unavailable'; lifecycleReceipt = $null; aboutVersion = $null
+            deviceKeyPresent = $true; deviceKeySha256 = ('b' * 64)
+            shortcuts = [pscustomobject][ordered]@{ startMenu = $false; desktop = $false }
+            debugPorts = @(); debugEndpoints = @()
+        }
+        $fakeIntegration = New-Module -ArgumentList $facts -ScriptBlock {
+            param($Facts)
+            function Get-CcodInstalledLifecycleFacts { param($InstallRoot,$ExpectedVersion) return $Facts }
+            Export-ModuleMember -Function Get-CcodInstalledLifecycleFacts
+        }
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            $captured = & $module {
+                param($InstallRoot,$Integration)
+                $script:CcodOfficialDraftInstallRoot = $InstallRoot
+                $script:CcodOfficialDraftIntegrationModule = $Integration
+                $defaults = Get-CcodOfficialDraftDefaultAdapters
+                & $defaults.CaptureFacts ([pscustomobject]@{ phase = 'Uninstall'; expectedVersion = '2.5.22' }) 'After'
+            } $root $fakeIntegration
+            Assert-CcodEqual $false $captured.installRootPresent 'the read-only capture preserves an actually absent fixture root'
+            Assert-CcodEqual $false $captured.protectionReady 'absence is never turned into protection readiness'
+            Assert-CcodEqual 0 $captured.codexCount 'empty producer identities yield zero observed Codex roots'
+            foreach ($kind in @('supervisor','trayHost','codex')) {
+                Assert-CcodTrue ($captured.$kind -is [array] -and $captured.$kind.Count -eq 0) 'empty native identity arrays remain arrays'
+            }
+            Assert-CcodEqual $null $captured.activeGeneration 'null generation remains null rather than a synthetic zero'
+            Assert-CcodEqual 'Unavailable' $captured.transitionStage 'absent transition observation is retained'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if ($null -ne $fakeIntegration) { Remove-Module -Name $fakeIntegration.Name -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft uninstall reuses captured ports and rejects every residual binding' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-uninstall-census-' + [guid]::NewGuid().ToString('N'))
+        $originalNetTcp = ${function:Get-NetTCPConnection}
+        $module = $null; $fakeIntegration = $null
+        try {
+            [IO.Directory]::CreateDirectory($root) | Out-Null
+            $before = New-CcodAcceptanceFacts
+            $before | Add-Member -NotePropertyName appPresent -NotePropertyValue $true
+            $before.PSObject.Properties.Remove('codexCount')
+            $after = New-CcodAcceptanceFacts -Absent
+            $after | Add-Member -NotePropertyName appPresent -NotePropertyValue $false
+            $after | Add-Member -NotePropertyName aboutVersion -NotePropertyValue $null
+            $after.PSObject.Properties.Remove('codexCount')
+            $state = [pscustomobject]@{ Facts = $before; Listeners = @(); StatusReads = 0; CensusCalls = 0; FailEnumeration = $false }
+            # Capture a mutable fixture reference without shadowing the cmdlet's State parameter.
+            $censusState = $state
+            Set-Item -LiteralPath Function:\global:Get-NetTCPConnection -Value ({
+                param($State,$ErrorAction)
+                if ($censusState.FailEnumeration) { throw [IO.IOException]::new('fixture census unavailable') }
+                return @($censusState.Listeners)
+            }.GetNewClosure())
+            $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            $realIntegration = & $module { Get-CcodOfficialDraftIntegrationModule }
+            $fakeIntegration = New-Module -ArgumentList $state,$realIntegration -ScriptBlock {
+                param($State,$RealIntegration)
+                function Get-CcodInstalledLifecycleFacts { param($InstallRoot,$ExpectedVersion) return $State.Facts }
+                function Read-CcodInstalledLifecycleStatusFact {
+                    param($StateRoot)
+                    $State.StatusReads++
+                    [pscustomobject]@{ session = [pscustomobject]@{ codex = [pscustomobject]@{ mainPort = 9229; rendererPort = 9230 } } }
+                }
+                function Test-CcodInstalledLifecycleDebugPortsClosed {
+                    param($Ports)
+                    $State.CensusCalls++
+                    & $RealIntegration { param($CapturedPorts) Test-CcodInstalledLifecycleDebugPortsClosed -Ports $CapturedPorts } $Ports
+                }
+                Export-ModuleMember -Function Get-CcodInstalledLifecycleFacts,Read-CcodInstalledLifecycleStatusFact,Test-CcodInstalledLifecycleDebugPortsClosed
+            }
+            $capture = & $module {
+                param($InstallRoot,$Integration)
+                $script:CcodOfficialDraftInstallRoot = $InstallRoot
+                $script:CcodOfficialDraftIntegrationModule = $Integration
+                (Get-CcodOfficialDraftDefaultAdapters).CaptureFacts
+            } $root $fakeIntegration
+            $context = [pscustomobject]@{ phase = 'Uninstall'; expectedVersion = '2.5.22' }
+            $capturedBefore = & $capture $context 'Before'
+            Assert-CcodEqual '9229,9230' ($capturedBefore.debugPorts -join ',') 'before capture retains the observed port pair'
+            Assert-CcodEqual 0 $state.StatusReads 'port capture does not reopen mutable status after taking the observation'
+            $state.Facts = $after
+            Remove-Item -LiteralPath $root -Recurse -Force
+            $capturedAfter = & $capture $context 'After'
+            Assert-CcodEqual 1 $state.CensusCalls 'after capture uses the real closed-port census despite removed status'
+            $key = & $module { param($Facts) Assert-CcodOfficialDraftUninstallFacts -Facts $Facts -ExpectedKeyHash ('b' * 64) } $capturedAfter
+            Assert-CcodEqual ('b' * 64) $key 'complete absence retains the expected key hash'
+            foreach ($port in @(9229,9230)) { foreach ($address in @('127.0.0.1','0.0.0.0','::','192.0.2.1')) {
+                $state.Listeners = @([pscustomobject]@{ LocalAddress = $address; LocalPort = [uint16]$port; OwningProcess = [uint32]4 })
+                Assert-CcodThrows { & $capture $context 'After' | Out-Null } 'CCOD_ACCEPTANCE_UNINSTALL_OBSERVATION_INVALID'
+            } }
+            $state.Listeners = @([pscustomobject]@{ LocalAddress = '::'; LocalPort = [uint16]443; OwningProcess = [uint32]4 })
+            $unrelated = & $capture $context 'After'
+            Assert-CcodEqual 0 $unrelated.debugEndpoints.Count 'unrelated listeners are not evidence of a retained product endpoint'
+            $state.FailEnumeration = $true
+            Assert-CcodThrows { & $capture $context 'After' | Out-Null } 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+        } finally {
+            if ($null -eq $originalNetTcp) { Remove-Item -LiteralPath Function:\global:Get-NetTCPConnection -Force -ErrorAction SilentlyContinue }
+            else { Set-Item -LiteralPath Function:\global:Get-NetTCPConnection -Value $originalNetTcp }
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if ($null -ne $fakeIntegration) { Remove-Module -Name $fakeIntegration.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'manual proof rejects ABA file and ancestor replacement between hashing and parsing' {
+        foreach ($operation in @('About','SecondDeviceControl')) { foreach ($attack in @('File','Directory')) {
+            $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-proof-aba-' + [guid]::NewGuid().ToString('N'))
+            $module = $null; $fakeIntegration = $null
+            try {
+                $evidence = Join-Path $root 'evidence'
+                [IO.Directory]::CreateDirectory($evidence) | Out-Null
+                [IO.Directory]::CreateDirectory((Join-Path $root 'logs')) | Out-Null
+                $target = Join-Path $evidence 'redacted.log'
+                $screenshot = Join-Path $root 'screenshot.bin'
+                [IO.File]::WriteAllText($screenshot,'fixture image',[Text.UTF8Encoding]::new($false))
+                $freshTime = [DateTimeOffset]::UtcNow.AddMinutes(5).ToString('o')
+                $freshTime = [DateTimeOffset]::Parse($freshTime).UtcDateTime.ToString('o')
+                $ready = [ordered]@{ schemaVersion = 1; timestampUtc = $freshTime; component = 'Supervisor'; stage = 'TrayHostReady'; code = 'CCOD_TRAYHOST_READY'; outcome = 'Completed'; runtimeId = 'runtime-2.5.22'; hostPid = 201; hostCreationTimeUtc = '2030-02-03T04:05:01.0000000Z'; protocolMajor = 2; capabilities = 7 }
+                $action = [ordered]@{ schemaVersion = 1; timestampUtc = $freshTime; component = 'Supervisor'; stage = 'TrayAction'; code = 'CCOD_TRAY_ACTION_COMPLETED'; outcome = 'Completed'; command = 'ShowAbout'; revision = 1; status = 'Completed' }
+                [IO.File]::WriteAllText((Join-Path $root 'logs\supervisor.log'), (($ready | ConvertTo-Json -Compress) + "`n" + ($action | ConvertTo-Json -Compress) + "`n"), [Text.UTF8Encoding]::new($false))
+                $proof = if ($operation -ceq 'About') { $action } else {
+                    [ordered]@{ schemaVersion = 1; timestampUtc = $freshTime; kind = 'remote-control-manual-proof'; operation = 'SecondDeviceControl'; deviceRole = 'SecondDevice'; challenge = 'fixture-challenge'; candidateVersion = '2.5.22'; runtimeId = 'runtime-2.5.22'; runtimeGeneration = 2; runtimeManifestSha256 = ('d' * 64); attestation = 'HumanReviewedStructuredAttestation'; connection = 'Connected'; control = 'Completed'; outcome = 'Completed'; code = 'CCOD_REMOTE_ACTION_COMPLETED' }
+                }
+                $goodBytes = [Text.UTF8Encoding]::new($false).GetBytes(($proof | ConvertTo-Json -Compress) + "`n")
+                $oldProof = [ordered]@{}
+                foreach ($key in $proof.Keys) { $oldProof[$key] = $proof[$key] }
+                $oldProof.timestampUtc = [DateTime]::UtcNow.AddDays(-1).ToString('o')
+                $oldBytes = [Text.UTF8Encoding]::new($false).GetBytes(($oldProof | ConvertTo-Json -Compress) + "`n")
+                [IO.File]::WriteAllBytes($target,$goodBytes)
+                $facts = New-CcodAcceptanceFacts
+                $facts | Add-Member -NotePropertyName appPresent -NotePropertyValue $true
+                $fakeIntegration = New-Module -ArgumentList $facts -ScriptBlock {
+                    param($Facts)
+                    function Get-CcodInstalledLifecycleFacts { param($InstallRoot,$ExpectedVersion,$ExpectedDebugPorts) return $Facts }
+                    Export-ModuleMember -Function Get-CcodInstalledLifecycleFacts
+                }
+                $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+                $run = & $module {
+                    param($Root,$Integration)
+                    $script:CcodOfficialDraftInstallRoot = $Root
+                    $script:CcodOfficialDraftIntegrationModule = $Integration
+                    (Get-CcodOfficialDraftDefaultAdapters).RunManualOperation
+                } $root $fakeIntegration
+                $context = [pscustomobject]@{ screenshotPath = $screenshot; redactedLogPath = $target; expectedVersion = '2.5.22'; manualChallenge = 'fixture-challenge'; manualAcknowledgement = ('CCOD_MANUAL_' + $operation.ToUpperInvariant() + '_COMPLETED') }
+                $control = & $run $context $operation
+                Assert-CcodTrue $control.verified 'the real manual operation reaches a valid proof before the attack'
+                [IO.File]::WriteAllBytes($target,$oldBytes)
+                $oldHash = Get-CcodTestFileSha256 $target
+                $state = [pscustomobject]@{ Target = $target; Parent = $evidence; Backup = ($evidence + '-moved'); OldBytes = $oldBytes; GoodBytes = $goodBytes; Mode = $attack; Attempts = 0; Replaced = $false }
+                & $module {
+                    param($State)
+                    $script:CcodProofRace = $State
+                    $script:CcodProofRaceOriginal = ${function:Get-CcodOfficialDraftJsonLines}
+                    function script:Get-CcodOfficialDraftJsonLines {
+                        param([string]$Path,[AllowNull()][Nullable[DateTimeOffset]]$NotBefore)
+                        $race = $script:CcodProofRace
+                        if ($Path -cne $race.Target) { return & $script:CcodProofRaceOriginal -Path $Path -NotBefore $NotBefore }
+                        $race.Attempts++
+                        $changed = $false
+                        try {
+                            if ($race.Mode -ceq 'Directory') {
+                                [IO.Directory]::Move($race.Parent,$race.Backup)
+                                $changed = $true
+                                [IO.Directory]::CreateDirectory($race.Parent) | Out-Null
+                            }
+                            [IO.File]::WriteAllBytes($race.Target,$race.GoodBytes)
+                            $changed = $true; $race.Replaced = $true
+                            return & $script:CcodProofRaceOriginal -Path $Path -NotBefore $NotBefore
+                        } finally {
+                            if ($changed) {
+                                if ($race.Mode -ceq 'Directory') { [IO.Directory]::Delete($race.Parent,$true); [IO.Directory]::Move($race.Backup,$race.Parent) }
+                                else { [IO.File]::WriteAllBytes($race.Target,$race.OldBytes) }
+                            }
+                        }
+                    }
+                } $state
+                $accepted = $false
+                try { $result = & $run $context $operation; $accepted = [bool]$result.verified } catch { }
+                Assert-CcodEqual 1 $state.Attempts 'the attack reaches the actual semantic-read boundary'
+                Assert-CcodEqual $oldHash (Get-CcodTestFileSha256 $target) 'the ABA sequence retains the original hashed bytes'
+                Assert-CcodEqual $false $accepted 'an ABA-swapped proof cannot be accepted under the original file hash'
+                Assert-CcodEqual $false $state.Replaced 'held file and ancestor authority blocks replacement'
+                [IO.File]::WriteAllBytes($target,$goodBytes)
+                Assert-CcodTrue ((Get-CcodTestFileSha256 $target) -cne $oldHash) 'failure releases evidence handles for a later legitimate retry'
+            } finally {
+                if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+                if ($null -ne $fakeIntegration) { Remove-Module -Name $fakeIntegration.Name -Force -ErrorAction SilentlyContinue }
+                if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+            }
+        } }
+    }
+
+    Invoke-CcodTest 'manual read authority rejects existing writers and releases partial acquisition' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-evidence-read-lease-' + [guid]::NewGuid().ToString('N'))
+        $module = $null; $writer = $null; $lease = $null
+        try {
+            [IO.Directory]::CreateDirectory($root) | Out-Null
+            $first = Join-Path $root 'first evidence.bin'
+            $second = Join-Path $root 'second.log'
+            [IO.File]::WriteAllText($first,'first original')
+            [IO.File]::WriteAllText($second,'second original')
+            $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            $writer = [IO.File]::Open($second,[IO.FileMode]::Open,[IO.FileAccess]::ReadWrite,([IO.FileShare]::ReadWrite -bor [IO.FileShare]::Delete))
+            Assert-CcodThrows { & $module { param($Paths) Open-CcodOfficialDraftEvidenceReadLease -Paths $Paths } @($first,$second) | Out-Null } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID'
+            [IO.File]::WriteAllText($first,'first after rejected acquisition')
+            Assert-CcodEqual 'first after rejected acquisition' ([IO.File]::ReadAllText($first)) 'a failed second-file acquisition releases the first file'
+            $writer.Dispose(); $writer = $null
+            $lease = & $module { param($Paths) Open-CcodOfficialDraftEvidenceReadLease -Paths $Paths } @($first,$second)
+            [IO.File]::WriteAllText((Join-Path $root 'unrelated-sibling.txt'),'allowed sibling mutation')
+            & $module { param($Lease) Assert-CcodOfficialDraftEvidenceReadLease -Lease $Lease } $lease
+            $blocked = $false
+            try { [IO.File]::WriteAllText($first,'must not replace held bytes') } catch [IO.IOException] { $blocked = $true }
+            Assert-CcodTrue $blocked 'successful read authority excludes concurrent data writers'
+            & $module { param($Lease) Close-CcodOfficialDraftEvidenceReadLease -Lease $Lease } $lease
+            Assert-CcodTrue $lease.Closed 'read lease records closure'
+            [IO.File]::WriteAllText($first,'first after release')
+            [IO.File]::WriteAllText($second,'second after release')
+            Assert-CcodEqual 'second after release' ([IO.File]::ReadAllText($second)) 'all evidence files become writable after release'
+        } finally {
+            if ($null -ne $writer) { $writer.Dispose() }
+            if ($null -ne $lease -and $null -ne $module) { & $module { param($Lease) Close-CcodOfficialDraftEvidenceReadLease -Lease $Lease } $lease }
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'manual artifact copy rejects changed bytes before publication and removes its own residue' {
+        foreach ($changedKind in @('Screenshot','RedactedLog')) {
+            $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-artifact-copy-change-' + [guid]::NewGuid().ToString('N'))
+            $module = $null
+            try {
+                [IO.Directory]::CreateDirectory($root) | Out-Null
+                $screenshot = Join-Path $root 'source-image.bin'
+                $log = Join-Path $root 'source.log'
+                [IO.File]::WriteAllText($screenshot,'original screenshot bytes',[Text.UTF8Encoding]::new($false))
+                [IO.File]::WriteAllText($log,'original redacted log bytes',[Text.UTF8Encoding]::new($false))
+                $screenshotHash = Get-CcodTestFileSha256 $screenshot
+                $logHash = Get-CcodTestFileSha256 $log
+                $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+                $write = {
+                    param($Destination)
+                    & $module {
+                        param($Directory,$Image,$Log,$ImageHash,$LogHash)
+                        Write-CcodOfficialDraftManualArtifacts -ArtifactDirectory $Directory -Operation About -ScreenshotPath $Image -RedactedLogPath $Log -ExpectedScreenshotSha256 $ImageHash -ExpectedRedactedLogSha256 $LogHash
+                    } $Destination $screenshot $log $screenshotHash $logHash
+                }
+                $control = & $write (Join-Path $root 'control')
+                Assert-CcodEqual $screenshotHash (Get-CcodTestFileSha256 $control.Screenshot) 'unmodified copy control publishes the checked screenshot'
+                Assert-CcodEqual $logHash (Get-CcodTestFileSha256 $control.RedactedLog) 'unmodified copy control publishes the checked log'
+                $changedPath = if ($changedKind -ceq 'Screenshot') { $screenshot } else { $log }
+                [IO.File]::WriteAllText($changedPath,'bytes changed after caller hashing',[Text.UTF8Encoding]::new($false))
+                $destination = Join-Path $root 'changed'
+                Assert-CcodThrows { & $write $destination | Out-Null } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID'
+                Assert-CcodEqual 0 @(Get-ChildItem -LiteralPath $destination -Recurse -File).Count 'hash mismatch leaves no temporary or published file owned by this attempt'
+                [IO.File]::WriteAllText($screenshot,'original screenshot bytes',[Text.UTF8Encoding]::new($false))
+                [IO.File]::WriteAllText($log,'original redacted log bytes',[Text.UTF8Encoding]::new($false))
+                $retry = & $write $destination
+                Assert-CcodEqual $screenshotHash (Get-CcodTestFileSha256 $retry.Screenshot) 'a clean retry is not blocked by failed-copy residue'
+                Assert-CcodEqual $logHash (Get-CcodTestFileSha256 $retry.RedactedLog) 'retry log retains the originally checked bytes'
+            } finally {
+                if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+                if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+            }
+        }
+    }
+
+    Invoke-CcodTest 'official draft remote proof binds the current acceptance challenge' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-remote-proof-' + [guid]::NewGuid().ToString('N'))
+        $proofPath = Join-Path $root 'remote-proof.json'
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $proofTimestamp = [DateTimeOffset]::UtcNow.AddMinutes(5).ToUniversalTime().ToString("yyyy-MM-dd'T'HH:mm:ss.fffffff'Z'",[Globalization.CultureInfo]::InvariantCulture)
+        $proof = [ordered]@{ schemaVersion = 1; timestampUtc = $proofTimestamp; kind = 'remote-control-manual-proof'; operation = 'SecondDeviceControl'; deviceRole = 'SecondDevice'; challenge = 'run-1'; candidateVersion = '2.5.22'; runtimeId = 'runtime-2.5.22'; runtimeGeneration = [UInt64]2; runtimeManifestSha256 = ('d' * 64); attestation = 'HumanReviewedStructuredAttestation'; connection = 'Connected'; control = 'Completed'; outcome = 'Completed'; code = 'CCOD_REMOTE_ACTION_COMPLETED' }
+        [IO.File]::WriteAllText($proofPath, (($proof | ConvertTo-Json -Compress) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            $parsed = &$module { param($Path) Get-CcodOfficialDraftRemoteProof -Path $Path -ExpectedChallenge 'run-1' -NotBefore ([DateTimeOffset]::UtcNow) -ExpectedVersion '2.5.22' -ExpectedRuntimeId 'runtime-2.5.22' -ExpectedGeneration ([UInt64]2) -ExpectedManifestSha256 ('d' * 64) } $proofPath
+            Assert-CcodEqual 'run-1' ([string]$parsed.challenge) 'remote proof binds the current challenge'
+            $proof.challenge = 'run-2'
+            [IO.File]::WriteAllText($proofPath, (($proof | ConvertTo-Json -Compress) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+            Assert-CcodThrows { &$module { param($Path) Get-CcodOfficialDraftRemoteProof -Path $Path -ExpectedChallenge 'run-1' -NotBefore ([DateTimeOffset]::UtcNow) -ExpectedVersion '2.5.22' -ExpectedRuntimeId 'runtime-2.5.22' -ExpectedGeneration ([UInt64]2) -ExpectedManifestSha256 ('d' * 64) } $proofPath | Out-Null } 'CCOD_ACCEPTANCE_REMOTE_UNPROVEN'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft default adapters use the isolated installed-lifecycle integration contract' {
+        $assetNames = @(
+            'CodexRemote-fix-2.5.21-windows-x64.zip',
+            'CodexRemote-fix-2.5.21-windows-x64.zip.sha256.txt',
+            'CodexRemote-fix-2.5.21-trayhost-provenance.json',
+            'CodexRemote-fix-2.5.21-payload-manifest.json',
+            'CodexRemote-fix-2.5.21-release-manifest.json',
+            'CodexRemote-fix-2.5.21-setup.exe',
+            'CodexRemote-fix-2.5.21-setup.exe.sha256.txt',
+            'CodexRemote-fix-2.5.21-setup-provenance.json',
+            'CodexRemote-fix-2.5.21-setup-payload-manifest.json',
+            'CodexRemote-fix-2.5.21-setup-destination-inventory.iss',
+            'CodexRemote-fix-2.5.21-setup-release-manifest.json'
+        )
+        $assetState = [pscustomobject]@{ Contract = [pscustomobject][ordered]@{
+            Valid = $true; Version = '2.5.21'; GitCommit = ('b' * 40)
+            Assets = @($assetNames | ForEach-Object { [pscustomobject][ordered]@{ name = $_; sha256 = ('a' * 64) } })
+        } }
+        $fakeAssetModule = New-Module -ArgumentList $assetState, $assetNames -ScriptBlock {
+            param($State,$Names)
+            function Get-CcodExpectedReleaseAssetNames { param($Version); return @($Names | ForEach-Object { $_ -replace '2\.5\.21', [string]$Version }) }
+            function Test-CcodExactReleaseAssetSet { param($AssetDirectory,$Version); return $State.Contract }
+            Export-ModuleMember -Function Get-CcodExpectedReleaseAssetNames,Test-CcodExactReleaseAssetSet
+        }
+        $integrationState = [pscustomobject]@{
+            PreviousCalls = 0
+            FactsCalls = [Collections.Generic.List[string]]::new()
+            RunCalls = [Collections.Generic.List[object]]::new()
+            Facts = [pscustomobject][ordered]@{
+                installRootPresent = $true
+                appPresent = $true
+                runtimeRootPresent = $true
+                activePointerPresent = $true
+                activeRuntimeId = 'runtime-2.5.22'
+                activeGeneration = [UInt64]2
+                runtimeManifestSha256 = ('d' * 64)
+                supervisor = @([pscustomobject]@{ pid = 200; creationTimeUtc = '2030-02-03T04:05:00.0000000Z' })
+                trayHost = @([pscustomobject]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' })
+                codex = @([pscustomobject]@{ pid = 202; creationTimeUtc = '2030-02-03T04:05:02.0000000Z' }); codexCount = 1
+                taskState = 'Ready'
+                statusPhase = 'Active'
+                statusRuntimeId = 'runtime-2.5.22'
+                statusCodex = [pscustomobject]@{ pid = 202; creationTimeUtc = '2030-02-03T04:05:02.0000000Z' }
+                transitionStage = 'Idle'
+                lifecycleReceipt = [pscustomobject][ordered]@{ kind = 'RestartAndRepair'; origin = 'Installer'; runtimeId = 'runtime-2.5.22'; runtimeGeneration = [UInt64]2; phase = 'Completed' }
+                shortcuts = [pscustomobject][ordered]@{ startMenu = $true; desktop = $true }
+            debugEndpoints = @([pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = 9229; owningProcess = 202; owningProcessCreationTimeUtc = '2030-02-03T04:05:02.0000000Z' },[pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = 9230; owningProcess = 202; owningProcessCreationTimeUtc = '2030-02-03T04:05:02.0000000Z' })
+            debugPorts = @(9229,9230)
+                aboutVersion = $null
+                deviceKeyPresent = $true
+                deviceKeySha256 = ('b' * 64)
+            }
+        }
+        $fakeIntegrationModule = New-Module -ArgumentList $integrationState -ScriptBlock {
+            param($State)
+            function Get-CcodInstalledLifecycleFacts {
+                param($InstallRoot,$ExpectedVersion)
+                $State.FactsCalls.Add([string]$InstallRoot)
+                return $State.Facts
+            }
+            function Invoke-CcodInstalledLifecycleIntegration {
+                param($InstallerPath,$PreviousInstallerPath,$PreviousExpectedVersion,$PreviousInstallerSha256,$PreviousManifestSha256,$ExpectedVersion,$EvidenceRoot,$AllowMachineMutation,$AllowCodexRestart,$Scenario)
+                $State.RunCalls.Add([pscustomobject][ordered]@{
+                    InstallerPath = $InstallerPath; PreviousInstallerPath = $PreviousInstallerPath; PreviousExpectedVersion = $PreviousExpectedVersion; PreviousInstallerSha256 = $PreviousInstallerSha256; PreviousManifestSha256 = $PreviousManifestSha256; ExpectedVersion = $ExpectedVersion
+                    EvidenceRoot = $EvidenceRoot; AllowMachineMutation = [bool]$AllowMachineMutation; AllowCodexRestart = [bool]$AllowCodexRestart; Scenario = $Scenario
+                })
+                return [pscustomobject][ordered]@{ outcome = 'Completed'; installerSha256 = ('c' * 64); verification = [pscustomobject][ordered]@{ verified = $true; facts = [pscustomobject][ordered]@{ runtimeManifestSha256 = ('d' * 64) } } }
+            }
+            Export-ModuleMember -Function Get-CcodInstalledLifecycleFacts,Invoke-CcodInstalledLifecycleIntegration
+        }
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            $observed = &$module {
+                param($FakeAsset,$FakeIntegration)
+                $script:CcodOfficialDraftAssetModule = $FakeAsset
+                $script:CcodOfficialDraftIntegrationModule = $FakeIntegration
+                $candidate = [pscustomobject][ordered]@{ version = '2.5.22'; assetHashes = @([pscustomobject][ordered]@{ name = 'CodexRemote-fix-2.5.22-setup.exe'; sha256 = ('c' * 64) }) }
+                $draft = [pscustomobject][ordered]@{ tag = 'v2.5.22'; id = '123' }
+                $previousSetup = [pscustomobject][ordered]@{ version = '2.5.21'; gitCommit = ('b' * 40); assetSha256 = ('a' * 64); manifestSha256 = ('a' * 64) }
+                $context = New-CcodOfficialDraftContext -Phase 'LegacyUpgrade' -AssetDirectory 'C:\candidate' -PreviousAssetDirectory 'C:\previous' -EvidenceRoot 'C:\evidence' -Candidate $candidate -Draft $draft -PreviousSetup $previousSetup -AllowMachineMutation -AllowCodexRestart
+                $defaults = Get-CcodOfficialDraftDefaultAdapters
+                $run = & $defaults.RunPhase $context
+                $facts = & $defaults.CaptureFacts $context 'After'
+                [pscustomobject][ordered]@{ Context = $context; Run = $run; Facts = $facts }
+            } $fakeAssetModule $fakeIntegrationModule
+            Assert-CcodEqual 'Upgrade' ([string]$integrationState.RunCalls[0].Scenario) 'default LegacyUpgrade maps to the integration Upgrade scenario'
+            Assert-CcodEqual ([string]$observed.Context.setupPath) ([string]$integrationState.RunCalls[0].InstallerPath) 'default phase passes the candidate Setup path'
+            Assert-CcodEqual ([string]$observed.Context.previousSetupPath) ([string]$integrationState.RunCalls[0].PreviousInstallerPath) 'default upgrade passes the previous Setup path'
+            Assert-CcodEqual '2.5.21' ([string]$integrationState.RunCalls[0].PreviousExpectedVersion) 'default upgrade passes the validated previous version'
+            Assert-CcodEqual ('a' * 64) ([string]$integrationState.RunCalls[0].PreviousInstallerSha256) 'default upgrade passes the validated previous Setup hash'
+            Assert-CcodEqual ('a' * 64) ([string]$integrationState.RunCalls[0].PreviousManifestSha256) 'default upgrade passes the validated previous manifest hash'
+            Assert-CcodEqual '2.5.22' ([string]$observed.Context.expectedVersion) 'core context binds the candidate version'
+            Assert-CcodEqual '2.5.22' ([string]$integrationState.RunCalls[0].ExpectedVersion) 'default phase passes the candidate version'
+            Assert-CcodEqual 1 $integrationState.FactsCalls.Count 'default facts adapter captures through the integration module'
+            Assert-CcodTrue ([bool]$observed.Facts.appRootPresent) 'default facts preserve the installed app observation'
+        } finally {
+            if ($null -ne $fakeIntegrationModule) { Remove-Module -Name $fakeIntegrationModule.Name -Force -ErrorAction SilentlyContinue }
+            if ($null -ne $fakeAssetModule) { Remove-Module -Name $fakeAssetModule.Name -Force -ErrorAction SilentlyContinue }
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft default remote adapter passes candidate-bound lifecycle observation arguments' {
+        $source = [IO.File]::ReadAllText($modulePath)
+        Assert-CcodTrue ($source.Contains('Get-CcodInstalledLifecycleFacts -InstallRoot $Root -ExpectedVersion $Version -ExpectedDebugPorts ([int[]]$DebugPorts)')) 'default remote adapter binds the candidate version and complete expected debug-port set'
+        Assert-CcodTrue ($source.Contains('$facts.activeRuntimeId -cne [string]$readyAfter.activeRuntimeId')) 'default remote adapter binds the active runtime to the ready-after identity'
+        Assert-CcodTrue ($source.Contains('[UInt64]$facts.activeGeneration -ne [UInt64]$readyAfter.activeGeneration')) 'default remote adapter binds the active generation to the ready-after identity'
+        Assert-CcodTrue ($source.Contains('ExpectedDeviceKeySha256')) 'manual readiness accepts the persisted device-key expectation'
+        Assert-CcodTrue ($source.Contains('$facts.deviceKeySha256 -cne $ExpectedDeviceKeySha256')) 'manual readiness binds the device key to the persisted acceptance state'
+        Assert-CcodTrue ($source.Contains('$readyAfterCodex')) 'remote evidence binds endpoints to the ready-after Codex identity'
+    }
+
+    Invoke-CcodTest 'official draft Complete rejects missing bounded manual evidence' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{
+            DefenderCalls = [Collections.Generic.List[string]]::new()
+            RunCalls = [Collections.Generic.List[string]]::new()
+            CaptureCalls = [Collections.Generic.List[string]]::new()
+            BootCalls = 0; RebootCalls = 0; PreviousCalls = 0
+            BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = (New-CcodAcceptanceFacts -BootId 'boot-1')
+        }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase Uninstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase FreshInstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase PreReboot -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart -AllowWindowsReboot | Out-Null
+            $state.BootId = 'boot-2'; $state.Facts = New-CcodAcceptanceFacts -BootId 'boot-2'
+            Invoke-CcodAcceptancePrivate -Phase PostReboot -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart -AllowWindowsReboot | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase ReadyForManualEvidence -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase Complete -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters
+            } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INCOMPLETE'
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft manual proof rejects a stale redacted action log' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-stale-redacted-log-' + [guid]::NewGuid().ToString('N'))
+        $logs = Join-Path $root 'logs'
+        $redacted = Join-Path $root 'redacted.log'
+        $screenshot = Join-Path $root 'screenshot.bin'
+        [IO.Directory]::CreateDirectory((Join-Path $root 'runtime')) | Out-Null
+        [IO.Directory]::CreateDirectory($logs) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $root 'active.json'), '{}', [Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($screenshot,'fixture screenshot',[Text.UTF8Encoding]::new($false))
+        $future = [DateTimeOffset]::UtcNow.AddMinutes(1).ToUniversalTime().ToString("yyyy-MM-dd'T'HH:mm:ss.fffffff'Z'", [Globalization.CultureInfo]::InvariantCulture)
+        $ready = [ordered]@{ schemaVersion = 1; timestampUtc = $future; component = 'Supervisor'; stage = 'TrayHostReady'; code = 'CCOD_TRAYHOST_READY'; outcome = 'Completed'; runtimeId = 'runtime-2.5.22'; hostPid = 201; hostCreationTimeUtc = '2030-02-03T04:05:01.0000000Z'; protocolMajor = 2; capabilities = [UInt64]2 }
+        $base = [ordered]@{ schemaVersion = 1; timestampUtc = $future; component = 'Supervisor'; stage = 'TrayAction'; code = 'CCOD_TRAY_ACTION_COMPLETED'; outcome = 'Completed'; command = 'ShowAbout'; revision = 7; status = 'Completed' }
+        [IO.File]::WriteAllText((Join-Path $logs 'supervisor.log'), (($ready | ConvertTo-Json -Compress) + "`n" + ($base | ConvertTo-Json -Compress) + "`n"), [Text.UTF8Encoding]::new($false))
+        $stale = [ordered]@{}
+        foreach ($entry in $base.GetEnumerator()) { $stale[$entry.Key] = $entry.Value }
+        $stale.timestampUtc = '2000-01-01T00:00:00.0000000Z'
+        [IO.File]::WriteAllText($redacted, (($base | ConvertTo-Json -Compress) + "`n"), [Text.UTF8Encoding]::new($false))
+        $facts = [pscustomobject][ordered]@{
+            installRootPresent = $true; appPresent = $true; runtimeRootPresent = $true; activePointerPresent = $true; activeRuntimeId = 'runtime-2.5.22'; activeGeneration = [UInt64]2; runtimeManifestSha256 = ('d' * 64)
+            supervisor = @([pscustomobject]@{ pid = 200; creationTimeUtc = '2030-02-03T04:05:00.0000000Z' })
+            trayHost = @([pscustomobject]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' })
+            trayHostIdentity = [pscustomobject][ordered]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' }
+            codex = @([pscustomobject]@{ pid = 202; creationTimeUtc = '2030-02-03T04:05:02.0000000Z' }); codexCount = 1
+            trayAuthenticated = $true
+            taskState = 'Ready'; statusPhase = 'Active'; statusRuntimeId = 'runtime-2.5.22'
+            statusCodex = [pscustomobject]@{ pid = 202; creationTimeUtc = '2030-02-03T04:05:02.0000000Z' }
+            transitionStage = 'Idle'; lifecycleReceipt = [pscustomobject][ordered]@{ kind = 'RestartAndRepair'; origin = 'Installer'; runtimeId = 'runtime-2.5.22'; runtimeGeneration = [UInt64]2; phase = 'Completed' }
+            aboutVersion = '2.5.22'; deviceKeyPresent = $true; deviceKeySha256 = ('b' * 64)
+            shortcuts = [pscustomobject][ordered]@{ startMenu = $true; desktop = $true }
+            debugEndpoints = @([pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = 9229; owningProcess = 202; owningProcessCreationTimeUtc = '2030-02-03T04:05:02.0000000Z' },[pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = 9230; owningProcess = 202; owningProcessCreationTimeUtc = '2030-02-03T04:05:02.0000000Z' })
+            debugPorts = @(9229,9230)
+        }
+        $state = [pscustomobject]@{ Facts = $facts; Calls = 0; ProofReads = 0; LiveProofReads = 0; Target = $redacted; LivePath = (Join-Path $logs 'supervisor.log') }
+        $fakeIntegration = New-Module -ArgumentList $state -ScriptBlock {
+            param($State)
+            function Get-CcodInstalledLifecycleFacts { param($InstallRoot,$ExpectedVersion) $State.Calls++; return $State.Facts }
+            Export-ModuleMember -Function Get-CcodInstalledLifecycleFacts
+        }
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            $run = & $module {
+                param($Fake,$InstallRoot,$State)
+                $script:CcodOfficialDraftIntegrationModule = $Fake
+                $script:CcodOfficialDraftInstallRoot = $InstallRoot
+                $script:CcodStaleProofState = $State
+                $script:CcodStaleProofOriginal = ${function:Get-CcodOfficialDraftJsonLines}
+                function script:Get-CcodOfficialDraftJsonLines {
+                    param([string]$Path,[AllowNull()][Nullable[DateTimeOffset]]$NotBefore)
+                    if ($Path -ceq $script:CcodStaleProofState.Target) { $script:CcodStaleProofState.ProofReads++ }
+                    if ($Path -ceq $script:CcodStaleProofState.LivePath -and $null -ne $NotBefore) { $script:CcodStaleProofState.LiveProofReads++ }
+                    & $script:CcodStaleProofOriginal -Path $Path -NotBefore $NotBefore
+                }
+                (Get-CcodOfficialDraftDefaultAdapters).RunManualOperation
+            } $fakeIntegration $root $state
+            $context = [pscustomobject][ordered]@{ screenshotPath = $screenshot; redactedLogPath = $redacted; expectedVersion = '2.5.22'; manualAcknowledgement = 'CCOD_MANUAL_ABOUT_COMPLETED' }
+            $positive = & $run $context 'About'
+            Assert-CcodTrue $positive.verified 'complete fresh manual proof is accepted before the timestamp-only mutation'
+            $previousReads = $state.ProofReads
+            $previousFacts = $state.Calls
+            [IO.File]::WriteAllText($redacted, (($stale | ConvertTo-Json -Compress) + "`n"), [Text.UTF8Encoding]::new($false))
+            Assert-CcodThrows { & $run $context 'About' | Out-Null } 'CCOD_ACCEPTANCE_MANUAL_OPERATION_UNPROVEN'
+            Assert-CcodEqual ($previousReads + 1) $state.ProofReads 'stale case reaches the real redacted proof parser'
+            Assert-CcodEqual ($previousFacts + 2) $state.Calls 'stale case has passed both readiness observations'
+            # Matching old live/redacted records must still fail freshness, not only tuple equality.
+            [IO.File]::WriteAllText($state.LivePath, (($ready | ConvertTo-Json -Compress) + "`n" + ($stale | ConvertTo-Json -Compress) + "`n"), [Text.UTF8Encoding]::new($false))
+            $previousLiveReads = $state.LiveProofReads
+            $previousFacts = $state.Calls
+            Assert-CcodThrows { & $run $context 'About' | Out-Null } 'CCOD_ACCEPTANCE_MANUAL_OPERATION_UNPROVEN'
+            Assert-CcodEqual ($previousLiveReads + 1) $state.LiveProofReads 'matching stale records reach freshness validation in the live proof parser'
+            Assert-CcodEqual ($previousFacts + 2) $state.Calls 'matching stale action records do not invalidate current host readiness'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if ($null -ne $fakeIntegration) { Remove-Module -Name $fakeIntegration.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft manual proof rechecks current ready runtime state' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-manual-readiness-' + [guid]::NewGuid().ToString('N'))
+        $logs = Join-Path $root 'logs'
+        $redacted = Join-Path $root 'redacted.log'
+        $screenshot = Join-Path $root 'screenshot.bin'
+        [IO.Directory]::CreateDirectory($logs) | Out-Null
+        [IO.File]::WriteAllText($screenshot,'fixture screenshot',[Text.UTF8Encoding]::new($false))
+        $future = [DateTimeOffset]::UtcNow.AddMinutes(1).ToUniversalTime().ToString("yyyy-MM-dd'T'HH:mm:ss.fffffff'Z'", [Globalization.CultureInfo]::InvariantCulture)
+        $record = [ordered]@{
+            schemaVersion = 1; timestampUtc = $future; component = 'Supervisor'; stage = 'TrayAction'
+            code = 'CCOD_TRAY_ACTION_COMPLETED'; outcome = 'Completed'; command = 'ShowAbout'; revision = 7; status = 'Completed'
+        }
+        $json = (($record | ConvertTo-Json -Compress) + "`n")
+        $ready = [ordered]@{ schemaVersion = 1; timestampUtc = $future; component = 'Supervisor'; stage = 'TrayHostReady'; code = 'CCOD_TRAYHOST_READY'; outcome = 'Completed'; runtimeId = 'runtime-2.5.22'; hostPid = 201; hostCreationTimeUtc = '2030-02-03T04:05:01.0000000Z'; protocolMajor = 2; capabilities = 7 }
+        [IO.File]::WriteAllText((Join-Path $logs 'supervisor.log'), (($ready | ConvertTo-Json -Compress) + "`n" + $json), [Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($redacted, $json, [Text.UTF8Encoding]::new($false))
+        $facts = New-CcodAcceptanceFacts
+        $facts | Add-Member -NotePropertyName appPresent -NotePropertyValue $true
+        $state = [pscustomobject]@{ Facts = $facts; Calls = 0; DriftAt = 0 }
+        $fakeIntegration = New-Module -ArgumentList $state -ScriptBlock {
+            param($State)
+            function Get-CcodInstalledLifecycleFacts {
+                param($InstallRoot,$ExpectedVersion)
+                $State.Calls++
+                $observed = $State.Facts.PSObject.Copy()
+                if ($State.DriftAt -gt 0 -and $State.Calls -ge $State.DriftAt) { $observed.aboutVersion = '2.5.21' }
+                return $observed
+            }
+            Export-ModuleMember -Function Get-CcodInstalledLifecycleFacts
+        }
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            $run = & $module {
+                param($Fake,$InstallRoot)
+                $script:CcodOfficialDraftIntegrationModule = $Fake
+                $script:CcodOfficialDraftInstallRoot = $InstallRoot
+                (Get-CcodOfficialDraftDefaultAdapters).RunManualOperation
+            } $fakeIntegration $root
+            $context = [pscustomobject][ordered]@{ screenshotPath = $screenshot; redactedLogPath = $redacted; expectedVersion = '2.5.22'; manualAcknowledgement = 'CCOD_MANUAL_ABOUT_COMPLETED' }
+            $positive = & $run $context 'About'
+            Assert-CcodTrue $positive.verified 'complete ready baseline succeeds before observation drift'
+            $previousCalls = $state.Calls
+            $state.DriftAt = $previousCalls + 2
+            Assert-CcodThrows { & $run $context 'About' | Out-Null } 'CCOD_ACCEPTANCE_MANUAL_OPERATION_UNPROVEN'
+            Assert-CcodEqual ($previousCalls + 2) $state.Calls 'readiness is reobserved after acknowledgement, not rejected at context validation'
+            Assert-CcodEqual '2.5.22' $state.Facts.aboutVersion 'the initial healthy fixture remains unchanged'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if ($null -ne $fakeIntegration) { Remove-Module -Name $fakeIntegration.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft preserves an inner acceptance error from post-manual observation' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        $manualRoot = Join-Path $fixture.Root 'manual-input'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($manualRoot) | Out-Null
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptanceThroughReady -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -State $state
+            $paths = New-CcodAcceptanceManualInputFiles -Root $manualRoot
+            $originalCapture = $adapters.CaptureFacts
+            $adapters.CaptureFacts = {
+                param($Context,$Point)
+                try {
+                    if ([string]$Point -ceq 'AfterManualOperation') {
+                        $exception = New-Object -TypeName System.InvalidOperationException -ArgumentList 'inner acceptance fixture error'
+                        Write-Error -Exception $exception -ErrorId 'CCOD_ACCEPTANCE_TEST_INNER' -Category InvalidData -ErrorAction Stop
+                    }
+                    & $originalCapture $Context $Point
+                } catch { $State.InnerErrorId = [string]$_.FullyQualifiedErrorId; throw }
+            }.GetNewClosure()
+            $state | Add-Member -NotePropertyName InnerErrorId -NotePropertyValue $null -Force
+            $observedErrorId = $null
+            try {
+                Invoke-CcodAcceptancePrivate -Phase TrayEvidence -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -TrayOperation About -ScreenshotPath $paths.About.Screenshot -RedactedLogPath $paths.About.Log -ReviewState Reviewed | Out-Null
+            } catch { $observedErrorId = [string]$_.FullyQualifiedErrorId }
+            if ($state.InnerErrorId -notlike 'CCOD_ACCEPTANCE_TEST_INNER*') { throw "adapter inner error id was [$($state.InnerErrorId)]" }
+            Assert-CcodEqual 'CCOD_ACCEPTANCE_TEST_INNER' $observedErrorId 'post-manual observation preserves the inner acceptance error id'
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft records four tray operations and second-device evidence before Complete' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        $manualRoot = Join-Path $fixture.Root 'manual-input'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($manualRoot) | Out-Null
+        $state = [pscustomobject]@{
+            DefenderCalls = [Collections.Generic.List[string]]::new()
+            RunCalls = [Collections.Generic.List[string]]::new()
+            CaptureCalls = [Collections.Generic.List[string]]::new()
+            BootCalls = 0; RebootCalls = 0; PreviousCalls = 0
+            BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = (New-CcodAcceptanceFacts -BootId 'boot-1')
+        }
+        $operations = @('About','Language','OpenLogs','Repair','SecondDeviceControl')
+        $paths = @{}
+        foreach ($operation in $operations) {
+            $paths[$operation] = [pscustomobject][ordered]@{
+                Screenshot = Join-Path $manualRoot ($operation + '-screenshot.png')
+                Log = Join-Path $manualRoot ($operation + '-redacted.log')
+            }
+            [IO.File]::WriteAllText($paths[$operation].Screenshot, 'screenshot-' + $operation, [Text.UTF8Encoding]::new($false))
+            [IO.File]::WriteAllText($paths[$operation].Log, 'redacted-log-' + $operation, [Text.UTF8Encoding]::new($false))
+        }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase Uninstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase FreshInstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase PreReboot -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart -AllowWindowsReboot | Out-Null
+            $state.BootId = 'boot-2'; $state.Facts = New-CcodAcceptanceFacts -BootId 'boot-2'
+            Invoke-CcodAcceptancePrivate -Phase PostReboot -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart -AllowWindowsReboot | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase ReadyForManualEvidence -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            $normalManualOperation = $adapters.RunManualOperation
+            $adapters.RunManualOperation = {
+                param($Context,$Operation)
+                $State.Facts.bootId = 'boot-detached'
+                return & $normalManualOperation $Context $Operation
+            }.GetNewClosure()
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase TrayEvidence -TrayOperation 'About' -ScreenshotPath $paths.About.Screenshot -RedactedLogPath $paths.About.Log -ReviewState Reviewed -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            } 'CCOD_ACCEPTANCE_MANUAL_OPERATION_UNPROVEN'
+            $adapters.RunManualOperation = $normalManualOperation
+            $state.Facts = New-CcodAcceptanceFacts -BootId 'boot-2'
+            foreach ($operation in @('About','Language','OpenLogs','Repair')) {
+                Invoke-CcodAcceptancePrivate -Phase TrayEvidence -TrayOperation $operation -ScreenshotPath $paths[$operation].Screenshot -RedactedLogPath $paths[$operation].Log -ReviewState Reviewed -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            }
+            Invoke-CcodAcceptancePrivate -Phase RemoteEvidence -RemoteOperation SecondDeviceControl -ScreenshotPath $paths.SecondDeviceControl.Screenshot -RedactedLogPath $paths.SecondDeviceControl.Log -ReviewState Reviewed -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            $aboutArtifact = Join-Path (Join-Path (Join-Path $evidenceRoot 'official-draft-artifacts') 'About') 'screenshot.bin'
+            [IO.File]::WriteAllText($aboutArtifact, 'tampered-artifact', [Text.UTF8Encoding]::new($false))
+            Assert-CcodThrows { Invoke-CcodAcceptancePrivate -Phase Complete -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID'
+            $restoreBytes = [IO.File]::ReadAllBytes($paths['About'].Screenshot)
+            [IO.File]::Delete($aboutArtifact)
+            [IO.File]::WriteAllBytes($aboutArtifact, $restoreBytes)
+            $normalClock = $adapters.GetUtcNow
+            $adapters.GetUtcNow = { return [datetime]::SpecifyKind([datetime]::Parse('2030-02-03T04:05:06'), [DateTimeKind]::Unspecified) }
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase Complete -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            } 'CCOD_ACCEPTANCE_COMPLETE_WRITE_FAILED'
+            $adapters.GetUtcNow = $normalClock
+            $complete = Invoke-CcodAcceptancePrivate -Phase Complete -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters
+            Assert-CcodEqual 'Complete' ([string]$complete.phase) 'complete returns its canonical phase'
+            Assert-CcodTrue ([bool]$complete.complete) 'complete reports the complete gate only after all five records'
+            $manualDirectory = Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') 'manual-evidence'
+            Assert-CcodEqual 5 (@(Get-ChildItem -LiteralPath $manualDirectory -File).Count) 'complete retains exactly five bounded manual records'
+            $completePath = Join-Path (Join-Path $evidenceRoot 'acceptance') 'CodexRemote-fix-2.5.22-official-draft.complete.json'
+            Assert-CcodTrue (Test-Path -LiteralPath $completePath -PathType Leaf) 'complete writes the Promote acceptance receipt'
+            $serialized = [IO.File]::ReadAllText($completePath)
+            $completeReceipt = $serialized | ConvertFrom-Json
+            Assert-CcodEqual 'v2.5.22' ([string]$completeReceipt.draft.tag) 'complete receipt records the draft tag'
+            Assert-CcodEqual '123' ([string]$completeReceipt.draft.id) 'complete receipt records the draft identifier'
+            $remoteRecord = @($completeReceipt.manualEvidence | Where-Object { $_.operation -ceq 'SecondDeviceControl' })
+            Assert-CcodTrue ($remoteRecord.Count -eq 1 -and $null -ne $remoteRecord[0].proof -and [string]$remoteRecord[0].proof.candidateVersion -ceq '2.5.22' -and -not [string]::IsNullOrWhiteSpace([string]$remoteRecord[0].proof.challenge)) 'complete receipt preserves the structured second-device proof'
+            $freshReceipt = ([IO.File]::ReadAllText((Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '04-FreshInstall.json')) | ConvertFrom-Json)
+            $postReceipt = ([IO.File]::ReadAllText((Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '06-PostReboot.json')) | ConvertFrom-Json)
+            Assert-CcodTrue ($null -ne $freshReceipt.facts.trayHostIdentity -and $null -ne $postReceipt.facts.trayHostIdentity) 'automated receipts persist the exact TrayHost identity'
+            foreach ($path in @($paths.About.Screenshot,$paths.About.Log,$paths.SecondDeviceControl.Screenshot,$paths.SecondDeviceControl.Log)) {
+                Assert-CcodTrue (-not $serialized.Contains($path)) 'complete receipt does not persist private evidence paths'
+            }
+            Assert-CcodEqual 5 (@($complete.facts.manualEvidence).Count) 'complete result contains all five normalized records'
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase Complete -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters
+            } 'CCOD_ACCEPTANCE_PHASE_REUSED'
+            $stateDirectory = Join-Path $evidenceRoot 'official-draft-acceptance'
+            $completeStatePath = Join-Path $stateDirectory '08-Complete.json'
+            $manualStatePath = Join-Path (Join-Path $stateDirectory 'manual-evidence') 'RemoteEvidence-SecondDeviceControl.json'
+            $completeState = [IO.File]::ReadAllText($completeStatePath) | ConvertFrom-Json
+            $manualState = [IO.File]::ReadAllText($manualStatePath) | ConvertFrom-Json
+            $completeRemote = @($completeState.facts.manualEvidence | Where-Object { $_.operation -ceq 'SecondDeviceControl' })[0]
+            $completeRemote.proof.candidateVersion = '2.5.21'
+            $completeRemote.proof.challenge = 'tampered-challenge'
+            $manualState.proof.candidateVersion = '2.5.21'
+            $manualState.proof.challenge = 'tampered-challenge'
+            [IO.File]::WriteAllText($completeStatePath, ($completeState | ConvertTo-Json -Depth 16), [Text.UTF8Encoding]::new($false))
+            [IO.File]::WriteAllText($manualStatePath, ($manualState | ConvertTo-Json -Depth 16), [Text.UTF8Encoding]::new($false))
+            $stateModule = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            try {
+                Assert-CcodThrows {
+                    &$stateModule {
+                        param($Directory)
+                        $records = Read-CcodOfficialDraftState -StateDirectory $Directory
+                        [void](Assert-CcodOfficialDraftAutomatedReceiptChain -Records $records -StateDirectory $Directory)
+                    } $stateDirectory
+                } 'CCOD_ACCEPTANCE_RECEIPT_INVALID'
+            } finally {
+                if ($null -ne $stateModule) { Remove-Module -Name $stateModule.Name -Force -ErrorAction SilentlyContinue }
+            }
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft rejects a candidate change after ReadyForManualEvidence' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        $manualRoot = Join-Path $fixture.Root 'manual-input'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptanceThroughReady -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -State $state
+            $fixture.Contract.GitCommit = 'd' * 40
+            $paths = New-CcodAcceptanceManualInputFiles -Root $manualRoot
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase TrayEvidence -TrayOperation About -ScreenshotPath $paths.About.Screenshot -RedactedLogPath $paths.About.Log -ReviewState Reviewed -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            } 'CCOD_ACCEPTANCE_CANDIDATE_CHANGED'
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft manual evidence requires every automated receipt after Ready' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        $manualRoot = Join-Path $fixture.Root 'manual-input'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptanceThroughReady -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -State $state
+            Remove-Item -LiteralPath (Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '06-PostReboot.json') -Force
+            $paths = New-CcodAcceptanceManualInputFiles -Root $manualRoot
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase TrayEvidence -TrayOperation About -ScreenshotPath $paths.About.Screenshot -RedactedLogPath $paths.About.Log -ReviewState Reviewed -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            } 'CCOD_ACCEPTANCE_PHASE_ORDER_INVALID'
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft rejects manual evidence seeded before ReadyForManualEvidence' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $stateDirectory = Join-Path $evidenceRoot 'official-draft-acceptance'
+        $manualDirectory = Join-Path $stateDirectory 'manual-evidence'
+        [IO.Directory]::CreateDirectory($manualDirectory) | Out-Null
+        $record = [ordered]@{ schemaVersion = 1; kind = 'manual-evidence'; phase = 'TrayEvidence'; operation = 'About'; terminalState = 'AboutVisible'; result = 'CCOD_TRAYABOUT_COMPLETED'; proof = [ordered]@{ timestampUtc = '2030-02-03T04:05:06.0000000Z'; command = 'ShowAbout'; revision = 1; code = 'CCOD_TRAY_ACTION_COMPLETED'; status = 'Completed' }; reviewState = 'Reviewed'; version = '2.5.22'; gitCommit = $fixture.GitCommit; candidateManifestSha256 = $fixture.Contract.PortableManifestSha256; screenshotSha256 = ('1' * 64); redactedLogSha256 = ('2' * 64) }
+        [IO.File]::WriteAllText((Join-Path $manualDirectory 'TrayEvidence-About.json'), (($record | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_EARLY'
+            Assert-CcodEqual 0 $state.DefenderCalls.Count 'pre-seeded manual evidence blocks Defender work before automation'
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft Complete does not leave a terminal state when acceptance target already exists' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        $manualRoot = Join-Path $fixture.Root 'manual-input'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptanceThroughReady -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -State $state
+            $paths = New-CcodAcceptanceManualInputFiles -Root $manualRoot
+            Invoke-CcodAcceptanceManualRecords -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -Paths $paths
+            $acceptanceDirectory = Join-Path $evidenceRoot 'acceptance'
+            [IO.Directory]::CreateDirectory($acceptanceDirectory) | Out-Null
+            $acceptancePath = Join-Path $acceptanceDirectory 'CodexRemote-fix-2.5.22-official-draft.complete.json'
+            [IO.File]::WriteAllText($acceptancePath, 'existing', [Text.UTF8Encoding]::new($false))
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase Complete -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            } 'CCOD_ACCEPTANCE_PHASE_REUSED'
+            Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '08-Complete.json') -PathType Leaf)) 'failed Complete does not leave an unusable terminal state'
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'Complete rejects an interleaved contender without invalidating its successful receipt chain' {
+        $fixture=New-CcodAcceptanceCandidateFixture
+        $previousRoot=Join-Path ([IO.Path]::GetTempPath()) ('ccod-complete-interleave-'+[guid]::NewGuid().ToString('N'))
+        $evidenceRoot=Join-Path $fixture.Root 'evidence';$manualRoot=Join-Path $fixture.Root 'manual-input'
+        [IO.Directory]::CreateDirectory($previousRoot)|Out-Null;[IO.Directory]::CreateDirectory($evidenceRoot)|Out-Null
+        $state=[pscustomobject]@{DefenderCalls=[Collections.Generic.List[string]]::new();RunCalls=[Collections.Generic.List[string]]::new();CaptureCalls=[Collections.Generic.List[string]]::new();BootCalls=0;RebootCalls=0;PreviousCalls=0;BootId='boot-1';KeyHash=('b'*64);Facts=New-CcodAcceptanceFacts}
+        $module=$null
+        try {
+            $adapters=New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptanceThroughReady -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -State $state
+            $paths=New-CcodAcceptanceManualInputFiles -Root $manualRoot
+            Invoke-CcodAcceptanceManualRecords -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -Paths $paths
+            $module=Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            $probe=[pscustomobject]@{Attempts=0;InnerError=$null;InnerResult=$null;OuterError=$null;OuterResult=$null;InnerValidation=0}
+            $contender=$adapters.Clone();$validate=$contender.ValidateAssetSet
+            $contender.ValidateAssetSet={param($Path,$Version)$probe.InnerValidation++;&$validate $Path $Version}.GetNewClosure()
+            $clock=$adapters.GetUtcNow
+            $adapters.GetUtcNow={
+                $probe.Attempts++
+                try{$probe.InnerResult=&$module {param($A,$P,$E,$Adapters)Invoke-CcodOfficialDraftAcceptanceCore -Phase Complete -AssetDirectory $A -PreviousAssetDirectory $P -EvidenceRoot $E -DraftId '123' -Adapters $Adapters} $fixture.Root $previousRoot $evidenceRoot $contender}catch{$probe.InnerError=$_.FullyQualifiedErrorId}
+                return &$clock
+            }.GetNewClosure()
+            try{$probe.OuterResult=&$module {param($A,$P,$E,$Adapters)Invoke-CcodOfficialDraftAcceptanceCore -Phase Complete -AssetDirectory $A -PreviousAssetDirectory $P -EvidenceRoot $E -DraftId '123' -Adapters $Adapters} $fixture.Root $previousRoot $evidenceRoot $adapters}catch{$probe.OuterError=$_.FullyQualifiedErrorId}
+            Assert-CcodEqual 1 $probe.Attempts 'contender runs after the outer call validated its initial state'
+            Assert-CcodTrue ($probe.InnerError-like'CCOD_ACCEPTANCE_OPERATION_BUSY*') 'same evidence root rejects the contender before any operation'
+            Assert-CcodEqual 0 $probe.InnerValidation 'busy rejection precedes candidate/default adapter side effects'
+            Assert-CcodEqual $null $probe.OuterError 'the original operation is not poisoned by its rejected contender'
+            Assert-CcodTrue $probe.OuterResult.complete 'original Complete returns success'
+            $statePath=Join-Path $evidenceRoot 'official-draft-acceptance\08-Complete.json'
+            $acceptancePath=Join-Path $evidenceRoot 'acceptance\CodexRemote-fix-2.5.22-official-draft.complete.json'
+            $persisted=[IO.File]::ReadAllText($acceptancePath)|ConvertFrom-Json
+            Assert-CcodEqual (Get-CcodTestFileSha256 $statePath) (@($persisted.automatedReceiptSha256|Where-Object {$_.phase-ceq'Complete'})[0].sha256) 'successful aggregate remains linked to its durable Complete state'
+            & $module {param($Root) $records=Read-CcodOfficialDraftState -StateDirectory (Join-Path $Root 'official-draft-acceptance');Assert-CcodOfficialDraftAutomatedReceiptChain -Records $records -StateDirectory (Join-Path $Root 'official-draft-acceptance')|Out-Null} $evidenceRoot
+        } finally {if($null-ne$module){Remove-Module $module.Name -Force -ErrorAction SilentlyContinue};if(Test-Path $fixture.Root){Remove-Item $fixture.Root -Recurse -Force};if(Test-Path $previousRoot){Remove-Item $previousRoot -Recurse -Force}}
+    }
+
+    Invoke-CcodTest 'acceptance operation authority is exclusive across imports and native child processes' {
+        $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-op-lock-'+[guid]::NewGuid().ToString('N'))
+        $module=$null;$first=$null;$second=$null;$process=$null
+        [IO.Directory]::CreateDirectory($root)|Out-Null
+        $evidence=Join-Path $root 'evidence';$other=Join-Path $root 'other';[IO.Directory]::CreateDirectory($evidence)|Out-Null;[IO.Directory]::CreateDirectory($other)|Out-Null
+        try {
+            $module=Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            $first=&$module {param($Root) Open-CcodOfficialDraftOperationLease -EvidenceRoot $Root} $evidence
+            Assert-CcodThrows {&$module {param($Root) Open-CcodOfficialDraftOperationLease -EvidenceRoot $Root} $evidence|Out-Null} 'CCOD_ACCEPTANCE_OPERATION_BUSY'
+            $second=&$module {param($Root) Open-CcodOfficialDraftOperationLease -EvidenceRoot $Root} $other
+            &$module {param($Lease) Close-CcodOfficialDraftOperationLease $Lease} $second;$second=$null
+            &$module {param($Lease) Close-CcodOfficialDraftOperationLease $Lease} $first;$first=$null
+            $child=Join-Path $root 'hold-lock.ps1'
+            $text=@'
+param([string]$ModulePath,[string]$Root)
+$ErrorActionPreference='Stop';$ProgressPreference='SilentlyContinue'
+$module=Import-Module $ModulePath -Force -PassThru -DisableNameChecking
+$lease=$null
+try {
+ $lease=&$module {param($Root)Open-CcodOfficialDraftOperationLease -EvidenceRoot $Root} $Root
+ [Console]::WriteLine('CCOD_OPERATION_LEASE_HELD');[Console]::Out.Flush()
+ [void][Console]::ReadLine()
+} finally {if($null-ne$lease){&$module {param($Lease)Close-CcodOfficialDraftOperationLease $Lease} $lease}}
+'@
+            [IO.File]::WriteAllText($child,$text,[Text.UTF8Encoding]::new($false))
+            $start=[Diagnostics.ProcessStartInfo]::new();$start.FileName=Join-Path $PSHOME 'powershell.exe'
+            $start.Arguments='-NoLogo -NoProfile -NonInteractive -File "'+$child+'" -ModulePath "'+$modulePath+'" -Root "'+$evidence+'"'
+            $start.UseShellExecute=$false;$start.RedirectStandardOutput=$true;$start.RedirectStandardError=$true;$start.RedirectStandardInput=$true;$start.CreateNoWindow=$true
+            [void]$start.EnvironmentVariables.Remove('PSExecutionPolicyPreference')
+            $process=[Diagnostics.Process]::Start($start)
+            $errors=$process.StandardError.ReadToEndAsync();$line=$process.StandardOutput.ReadLineAsync()
+            Assert-CcodTrue ($line.Wait(15000)) 'normal-policy child reports the real acquired lock without a blind delay'
+            Assert-CcodEqual 'CCOD_OPERATION_LEASE_HELD' $line.Result 'child reached actual native lease'
+            Remove-Module $module.Name -Force;$module=Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            Assert-CcodThrows {&$module {param($Root)Open-CcodOfficialDraftOperationLease -EvidenceRoot $Root} $evidence|Out-Null} 'CCOD_ACCEPTANCE_OPERATION_BUSY'
+            $process.StandardInput.WriteLine('release');$process.StandardInput.Flush()
+            Assert-CcodTrue ($process.WaitForExit(15000)) 'owned inert child exits after explicit release'
+            Assert-CcodEqual 0 $process.ExitCode 'child lease release succeeds'
+            Assert-CcodEqual '' $errors.Result 'native child has no hidden lock error'
+            $first=&$module {param($Root)Open-CcodOfficialDraftOperationLease -EvidenceRoot $Root} $evidence
+            Assert-CcodTrue ($null-ne$first) 'new acquisition after child exit proves release'
+            $blocked=$false;try{[IO.Directory]::Move($evidence,$evidence+'.moved')}catch [IO.IOException]{$blocked=$true}
+            Assert-CcodTrue $blocked 'held evidence-root authority denies ancestor replacement'
+            &$module {param($Lease)Close-CcodOfficialDraftOperationLease $Lease} $first;$first=$null
+            $lockPath=Join-Path $evidence '.ccod-official-draft-operation.lock'
+            [IO.File]::WriteAllText($lockPath,'foreign lock contents')
+            Assert-CcodThrows {&$module {param($Root)Open-CcodOfficialDraftOperationLease -EvidenceRoot $Root} $evidence|Out-Null} 'CCOD_ACCEPTANCE_OPERATION_LOCK_FAILED'
+            Assert-CcodEqual 'foreign lock contents' ([IO.File]::ReadAllText($lockPath)) 'unsafe lock content remains untouched'
+            [IO.File]::WriteAllBytes($lockPath,[byte[]]@())
+            $first=&$module {param($Root)Open-CcodOfficialDraftOperationLease -EvidenceRoot $Root} $evidence
+        } finally {
+            if($null-ne$process){if(-not$process.HasExited){$process.StandardInput.Close();if(-not$process.WaitForExit(15000)){$process.Kill();[void]$process.WaitForExit(10000)}};$process.Dispose()}
+            foreach($lease in @($second,$first)){if($null-ne$lease){&$module {param($Lease)Close-CcodOfficialDraftOperationLease $Lease} $lease}}
+            if($null-ne$module){Remove-Module $module.Name -Force -ErrorAction SilentlyContinue}
+            if(Test-Path $root){Remove-Item $root -Recurse -Force}
+        }
+    }
+
+    Invoke-CcodTest 'failed Complete recovery never adopts deletion ownership of a preexisting state receipt' {
+        $fixture=New-CcodAcceptanceCandidateFixture
+        $previousRoot=Join-Path ([IO.Path]::GetTempPath()) ('ccod-complete-reuse-'+[guid]::NewGuid().ToString('N'))
+        $evidenceRoot=Join-Path $fixture.Root 'evidence';$manualRoot=Join-Path $fixture.Root 'manual-input'
+        [IO.Directory]::CreateDirectory($previousRoot)|Out-Null;[IO.Directory]::CreateDirectory($evidenceRoot)|Out-Null
+        $state=[pscustomobject]@{DefenderCalls=[Collections.Generic.List[string]]::new();RunCalls=[Collections.Generic.List[string]]::new();CaptureCalls=[Collections.Generic.List[string]]::new();BootCalls=0;RebootCalls=0;PreviousCalls=0;BootId='boot-1';KeyHash=('b'*64);Facts=New-CcodAcceptanceFacts}
+        try {
+            $adapters=New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptanceThroughReady -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -State $state
+            $paths=New-CcodAcceptanceManualInputFiles -Root $manualRoot
+            Invoke-CcodAcceptanceManualRecords -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -Paths $paths
+            $invokeArgs=@{Phase='Complete';AssetDirectory=$fixture.Root;PreviousAssetDirectory=$previousRoot;EvidenceRoot=$evidenceRoot;Adapters=$adapters}
+            $control=Invoke-CcodAcceptancePrivate @invokeArgs
+            Assert-CcodTrue $control.complete 'full successful control precedes recovery failure'
+            $statePath=Join-Path $evidenceRoot 'official-draft-acceptance\08-Complete.json'
+            $acceptancePath=Join-Path $evidenceRoot 'acceptance\CodexRemote-fix-2.5.22-official-draft.complete.json'
+            $stateHash=Get-CcodTestFileSha256 $statePath
+            [IO.File]::Delete($acceptancePath)
+            $artifact=Join-Path $evidenceRoot 'official-draft-artifacts\About\screenshot.bin'
+            $bytes=[IO.File]::ReadAllBytes($artifact)
+            [IO.File]::WriteAllText($artifact,'independent artifact drift')
+            Assert-CcodThrows {Invoke-CcodAcceptancePrivate @invokeArgs|Out-Null} 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID'
+            Assert-CcodTrue ([IO.File]::Exists($statePath)) 'reused Complete state is not owned by the failed invocation'
+            Assert-CcodEqual $stateHash (Get-CcodTestFileSha256 $statePath) 'failed recovery preserves prior terminal evidence bytes'
+            Assert-CcodTrue (-not[IO.File]::Exists($acceptancePath)) 'failed recovery does not create a successful aggregate'
+            [IO.File]::WriteAllBytes($artifact,$bytes)
+            $retry=Invoke-CcodAcceptancePrivate @invokeArgs
+            Assert-CcodTrue $retry.complete 'safe existing-state recovery remains retryable after the root cause is corrected'
+        } finally {if(Test-Path $fixture.Root){Remove-Item $fixture.Root -Recurse -Force};if(Test-Path $previousRoot){Remove-Item $previousRoot -Recurse -Force}}
+    }
+
+    Invoke-CcodTest 'official draft Complete resumes when the terminal state receipt survived without acceptance' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        $manualRoot = Join-Path $fixture.Root 'manual-input'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($manualRoot) | Out-Null
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptanceThroughReady -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -State $state
+            $paths = New-CcodAcceptanceManualInputFiles -Root $manualRoot
+            Invoke-CcodAcceptanceManualRecords -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -Paths $paths
+            $stateDirectory = Join-Path $evidenceRoot 'official-draft-acceptance'
+            $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            try {
+                &$module {
+                    param($Directory,$Previous)
+                    $records = Read-CcodOfficialDraftState -StateDirectory $Directory -PreviousAssetDirectory $Previous
+                    $facts = [pscustomobject][ordered]@{ manualEvidence = @($records.ManualEvidence.Values); status = 'Complete'; complete = $true }
+                    Write-CcodOfficialDraftReceipt -StateDirectory $Directory -Phase Complete -Candidate $records.Preflight.candidate -Draft $records.Preflight.draft -Facts $facts | Out-Null
+                } $stateDirectory $previousRoot
+            } finally { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            $completeState = Join-Path $stateDirectory '08-Complete.json'
+            Assert-CcodTrue (Test-Path -LiteralPath $completeState -PathType Leaf) 'terminal state receipt exists before simulated recovery'
+            $result = Invoke-CcodAcceptancePrivate -Phase Complete -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters
+            Assert-CcodEqual 'Complete' ([string]$result.outcome) 'Complete resumes from an existing terminal state receipt'
+            Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $evidenceRoot 'acceptance/CodexRemote-fix-2.5.22-official-draft.complete.json') -PathType Leaf) 'recovery writes the missing acceptance artifact'
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft accepts persisted Int64 receipt numbers from PowerShell Core' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state
+            $preflight = Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters
+            $preflightPath = Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '01-Preflight.json'
+            $receipt = [IO.File]::ReadAllText($preflightPath) | ConvertFrom-Json
+            $receipt.schemaVersion = [int64]$receipt.schemaVersion
+            foreach ($defender in @($receipt.facts.defenderReceipts)) {
+                $defender.schemaVersion = [int64]$defender.schemaVersion
+                $defender.zoneId = [int64]$defender.zoneId
+                $defender.detectionCount = [int64]$defender.detectionCount
+            }
+            $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            try {
+                $normalized = &$module {
+                    param($Receipt,$Candidate)
+                    Assert-CcodOfficialDraftReceiptShape -Receipt $Receipt -ExpectedPhase 'Preflight'
+                } $receipt $preflight.candidate
+                Assert-CcodEqual 'Preflight' ([string]$normalized.phase) 'Int64 receipt numbers remain readable across PowerShell runtimes'
+            } finally {
+                if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            }
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft optional state probes fail closed on access errors' {
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            Assert-CcodThrows { &$module { Get-CcodOfficialDraftOptionalPathState -Path 'C:\\fixture\\missing.json' -ExpectDirectory $false -GetItem { param($Path) throw [UnauthorizedAccessException]::new('fixture denied') } -ErrorId 'CCOD_ACCEPTANCE_RECEIPT_INVALID' } } 'CCOD_ACCEPTANCE_RECEIPT_INVALID'
+        } finally {
+            Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        }
+    }
+
+    Invoke-CcodTest 'official draft default observations reject wrong-type install residue' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-default-observation-' + [guid]::NewGuid().ToString('N'))
+        $runtime = Join-Path $root 'runtime'
+        $pointer = Join-Path $root 'active.json'
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        $realIntegration = & $module { Get-CcodOfficialDraftIntegrationModule }
+        $state = [pscustomobject]@{ Facts = (New-CcodAcceptanceRawFacts -Absent); Probes = [Collections.Generic.List[string]]::new() }
+        $fakeIntegration = New-Module -ArgumentList $state,$realIntegration -ScriptBlock {
+            param($State,$Real)
+            function Get-CcodInstalledLifecycleFacts {
+                param([string]$InstallRoot,[string]$ExpectedVersion)
+                $observed = $State.Facts.PSObject.Copy()
+                & $Real {
+                    param($Root,$Facts,$State)
+                    $probe = { param($Path) Get-Item -LiteralPath $Path -Force -ErrorAction Stop }
+                    $runtimePath = Join-Path $Root 'runtime'
+                    $pointerPath = Join-Path $Root 'active.json'
+                    $State.Probes.Add($runtimePath)
+                    $Facts.runtimeRootPresent = Get-CcodInstalledLifecycleOptionalDirectoryState -Path $runtimePath -GetItem $probe
+                    $State.Probes.Add($pointerPath)
+                    $Facts.activePointerPresent = $null -ne (Get-CcodInstalledLifecycleOptionalRegularFileState -Path $pointerPath -GetItem $probe)
+                } $InstallRoot $observed $State
+                return $observed
+            }
+            Export-ModuleMember -Function Get-CcodInstalledLifecycleFacts
+        }
+        try {
+            $capture = & $module {
+                param($Fake,$InstallRoot)
+                $script:CcodOfficialDraftIntegrationModule = $Fake
+                $script:CcodOfficialDraftInstallRoot = $InstallRoot
+                (Get-CcodOfficialDraftDefaultAdapters).CaptureFacts
+            } $fakeIntegration $root
+            foreach ($kind in @('Runtime','Pointer')) {
+                [IO.Directory]::CreateDirectory($runtime) | Out-Null
+                [IO.File]::WriteAllText($pointer,'{}',[Text.UTF8Encoding]::new($false))
+                $control = & $capture ([pscustomobject]@{ phase = 'Preflight' }) 'Before'
+                Assert-CcodTrue ($control.runtimeRootPresent -and $control.activePointerPresent) 'real path probes accept the valid directory/file pair'
+                $badPath = if ($kind -ceq 'Runtime') { $runtime } else { $pointer }
+                Remove-Item -LiteralPath $badPath -Recurse -Force
+                if ($kind -ceq 'Runtime') { [IO.File]::WriteAllText($runtime,'wrong-type') }
+                else { [IO.Directory]::CreateDirectory($pointer) | Out-Null }
+                $previousProbes = $state.Probes.Count
+                Assert-CcodThrows { & $capture ([pscustomobject]@{ phase = 'Preflight' }) 'After' | Out-Null } 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+                Assert-CcodTrue ($state.Probes.Count -gt $previousProbes) 'the invalid target reaches the production path probe'
+                Assert-CcodEqual $badPath $state.Probes[$state.Probes.Count - 1] 'the intended wrong-type path, not an earlier fixture defect, rejects'
+                Remove-Item -LiteralPath $runtime -Recurse -Force
+                Remove-Item -LiteralPath $pointer -Recurse -Force
+            }
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if ($null -ne $fakeIntegration) { Remove-Module -Name $fakeIntegration.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft default observations reject incomplete integration facts' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-default-incomplete-facts-' + [guid]::NewGuid().ToString('N'))
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $fakeIntegration = New-Module -ScriptBlock {
+            function Get-CcodInstalledLifecycleFacts {
+                param([string]$InstallRoot,[string]$ExpectedVersion)
+                return [pscustomobject][ordered]@{
+                    taskState = 'Absent'; supervisor = @(); trayHost = @()
+                    deviceKeyPresent = $true; deviceKeySha256 = ('b' * 64)
+                }
+            }
+            function Read-CcodInstalledLifecycleStatusFact { param([string]$StateRoot); return $null }
+            Export-ModuleMember -Function Get-CcodInstalledLifecycleFacts,Read-CcodInstalledLifecycleStatusFact
+        }
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            Assert-CcodThrows {
+                &$module {
+                    param($Fake,$InstallRoot)
+                    $script:CcodOfficialDraftIntegrationModule = $Fake
+                    $script:CcodOfficialDraftInstallRoot = $InstallRoot
+                    $adapters = Get-CcodOfficialDraftDefaultAdapters
+                    & $adapters.CaptureFacts ([pscustomobject]@{ phase = 'Uninstall' }) 'After' | Out-Null
+                } $fakeIntegration $root
+            } 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if ($null -ne $fakeIntegration) { Remove-Module -Name $fakeIntegration.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft optional path probe fails closed on access errors' {
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            Assert-CcodThrows {
+                &$module {
+                    $probe = { param($Path) throw [UnauthorizedAccessException]::new('fixture access denied') }
+                    Get-CcodOfficialDraftOptionalPathState -Path 'C:\fixture\blocked' -ExpectDirectory $true -GetItem $probe -ErrorId 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+                }
+            } 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft optional missing path rejects a reparse ancestor' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-optional-reparse-' + [guid]::NewGuid().ToString('N'))
+        $outside = Join-Path ([IO.Path]::GetTempPath()) ('ccod-optional-reparse-outside-' + [guid]::NewGuid().ToString('N'))
+        $module = $null
+        try {
+            [IO.Directory]::CreateDirectory($root) | Out-Null
+            [IO.Directory]::CreateDirectory($outside) | Out-Null
+            $ancestor = Join-Path $root 'ancestor'
+            New-Item -ItemType Junction -Path $ancestor -Target $outside | Out-Null
+            $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            Assert-CcodThrows {
+                &$module {
+                    param($Path)
+                    $probe = { param($CandidatePath) Get-Item -LiteralPath $CandidatePath -Force -ErrorAction Stop }
+                    Get-CcodOfficialDraftOptionalPathState -Path $Path -ExpectDirectory $false -GetItem $probe -ErrorId 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+                } (Join-Path $ancestor 'missing.txt')
+            } 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $outside) { Remove-Item -LiteralPath $outside -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft cleanup validates ancestors before accepting a missing target' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-cleanup-missing-reparse-' + [guid]::NewGuid().ToString('N'))
+        $outside = Join-Path ([IO.Path]::GetTempPath()) ('ccod-cleanup-missing-reparse-outside-' + [guid]::NewGuid().ToString('N'))
+        $junction = Join-Path $root 'unsafe'
+        $target = Join-Path $junction 'missing.json'
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        [IO.Directory]::CreateDirectory($outside) | Out-Null
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            New-Item -ItemType Junction -Path $junction -Target $outside | Out-Null
+            Assert-CcodThrows {
+                &$module { param($Path) Remove-CcodOfficialDraftCompleteArtifacts -Paths @($Path) -ExpectedHashes @{} } $target | Out-Null
+            } 'CCOD_ACCEPTANCE_COMPLETE_CLEANUP_FAILED'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $junction) { Remove-Item -LiteralPath $junction -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $outside) { Remove-Item -LiteralPath $outside -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft default observations recheck the install root after mutation' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-default-root-recheck-' + [guid]::NewGuid().ToString('N'))
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $facts = New-CcodAcceptanceRawFacts -Absent
+        $fakeIntegration = New-Module -ArgumentList $facts -ScriptBlock {
+            param($Facts)
+            function Get-CcodInstalledLifecycleFacts { param([string]$InstallRoot,[string]$ExpectedVersion); return $Facts }
+            Export-ModuleMember -Function Get-CcodInstalledLifecycleFacts
+        }
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            $capture = & $module {
+                param($Fake,$InstallRoot)
+                $script:CcodOfficialDraftIntegrationModule = $Fake
+                $script:CcodOfficialDraftInstallRoot = $InstallRoot
+                (Get-CcodOfficialDraftDefaultAdapters).CaptureFacts
+            } $fakeIntegration $root
+            $context = [pscustomobject]@{ phase = 'Preflight' }
+            $control = & $capture $context 'After'
+            Assert-CcodTrue $control.installRootPresent 'valid directory control succeeds before changing only the root type'
+            Remove-Item -LiteralPath $root -Recurse -Force
+            [IO.File]::WriteAllText($root,'root residue',[Text.UTF8Encoding]::new($false))
+            Assert-CcodThrows { & $capture $context 'After' | Out-Null } 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if ($null -ne $fakeIntegration) { Remove-Module -Name $fakeIntegration.Name -Force -ErrorAction SilentlyContinue }
+            if ([IO.File]::Exists($root)) { Remove-Item -LiteralPath $root -Force -ErrorAction SilentlyContinue }
+            if ([IO.Directory]::Exists($root)) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft default observations reject pseudo-integer generations' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-default-generation-type-' + [guid]::NewGuid().ToString('N'))
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $facts = New-CcodAcceptanceRawFacts
+        $fakeIntegration = New-Module -ArgumentList $facts -ScriptBlock {
+            param($Facts)
+            function Get-CcodInstalledLifecycleFacts { param([string]$InstallRoot,[string]$ExpectedVersion); return $Facts }
+            Export-ModuleMember -Function Get-CcodInstalledLifecycleFacts
+        }
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            $capture = & $module {
+                param($Fake,$InstallRoot)
+                $script:CcodOfficialDraftIntegrationModule = $Fake
+                $script:CcodOfficialDraftInstallRoot = $InstallRoot
+                (Get-CcodOfficialDraftDefaultAdapters).CaptureFacts
+            } $fakeIntegration $root
+            $context = [pscustomobject]@{ phase = 'Preflight'; expectedVersion = '2.5.22' }
+            foreach ($bad in @([double]2,[bool]$true,'2',([object[]]@(2)))) {
+                $facts.activeGeneration = [uint64]2
+                $control = & $capture $context 'After'
+                Assert-CcodEqual ([uint64]2) $control.activeGeneration 'the complete raw fixture exposes its valid generation'
+                $facts.activeGeneration = $bad
+                Assert-CcodThrows { & $capture $context 'After' | Out-Null } 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+            }
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if ($null -ne $fakeIntegration) { Remove-Module -Name $fakeIntegration.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft default observations accept Int64 process identities' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-default-pid-type-' + [guid]::NewGuid().ToString('N'))
+        $logs = Join-Path $root 'logs'
+        [IO.Directory]::CreateDirectory((Join-Path $root 'runtime')) | Out-Null
+        [IO.Directory]::CreateDirectory($logs) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $root 'active.json'), '{}', [Text.UTF8Encoding]::new($false))
+        $trayReady = [ordered]@{
+            schemaVersion = 1; timestampUtc = '2030-02-03T04:05:03.0000000Z'; component = 'Supervisor'; stage = 'TrayHostReady'
+            code = 'CCOD_TRAYHOST_READY'; outcome = 'Completed'; runtimeId = 'runtime-2.5.22'; hostPid = 201
+            hostCreationTimeUtc = '2030-02-03T04:05:01.0000000Z'; protocolMajor = 2; capabilities = [UInt64]2
+        }
+        [IO.File]::WriteAllText((Join-Path $logs 'supervisor.log'), (($trayReady | ConvertTo-Json -Compress) + "`n"), [Text.UTF8Encoding]::new($false))
+        $facts = [pscustomobject][ordered]@{
+            installRootPresent = $true; appPresent = $true; runtimeRootPresent = $true; activePointerPresent = $true; activeRuntimeId = 'runtime-2.5.22'; activeGeneration = [UInt64]2; runtimeManifestSha256 = ('d' * 64)
+            supervisor = @([pscustomobject]@{ pid = 200; creationTimeUtc = '2030-02-03T04:05:00.0000000Z' })
+            trayHost = @([pscustomobject]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' })
+            trayHostIdentity = [pscustomobject][ordered]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' }
+            codex = @([pscustomobject]@{ pid = [int64]202; creationTimeUtc = '2030-02-03T04:05:02.0000000Z' }); codexCount = [int64]1
+            trayAuthenticated = $true
+            taskState = 'Ready'; statusPhase = 'Active'; statusRuntimeId = 'runtime-2.5.22'
+            statusCodex = [pscustomobject]@{ pid = [int64]202; creationTimeUtc = '2030-02-03T04:05:02.0000000Z' }
+            transitionStage = 'Idle'; lifecycleReceipt = [pscustomobject][ordered]@{ kind = 'RestartAndRepair'; origin = 'Installer'; runtimeId = 'runtime-2.5.22'; runtimeGeneration = [UInt64]2; phase = 'Completed' }
+            aboutVersion = '2.5.22'; deviceKeyPresent = $true; deviceKeySha256 = ('b' * 64)
+            shortcuts = [pscustomobject][ordered]@{ startMenu = $true; desktop = $true }
+            debugEndpoints = @([pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = 9229; owningProcess = 202; owningProcessCreationTimeUtc = '2030-02-03T04:05:02.0000000Z' },[pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = 9230; owningProcess = 202; owningProcessCreationTimeUtc = '2030-02-03T04:05:02.0000000Z' })
+            debugPorts = @(9229,9230)
+        }
+        $fakeIntegration = New-Module -ArgumentList $facts -ScriptBlock {
+            param($Facts)
+            function Get-CcodInstalledLifecycleFacts { param([string]$InstallRoot,[string]$ExpectedVersion); return $Facts }
+            Export-ModuleMember -Function Get-CcodInstalledLifecycleFacts
+        }
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            $observed = &$module {
+                param($Fake,$InstallRoot)
+                $script:CcodOfficialDraftIntegrationModule = $Fake
+                $script:CcodOfficialDraftInstallRoot = $InstallRoot
+                $adapters = Get-CcodOfficialDraftDefaultAdapters
+                & $adapters.CaptureFacts ([pscustomobject]@{ phase = 'LegacyUpgrade'; expectedVersion = '2.5.22' }) 'After'
+            } $fakeIntegration $root
+            Assert-CcodTrue ([bool]$observed.trayAuthenticated) 'Int64 process identities preserve authenticated readiness'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if ($null -ne $fakeIntegration) { Remove-Module -Name $fakeIntegration.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft default legacy observations reject a missing installed baseline' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-default-legacy-baseline-' + [guid]::NewGuid().ToString('N'))
+    [IO.Directory]::CreateDirectory($root) | Out-Null
+    # The integration helper's protected event and CIM behavior have separate native tests.
+    $state = [pscustomobject]@{ Facts = (New-CcodAcceptanceRawFacts); Calls = 0; ReadyCalls = 0; Ready = $true }
+    $state.Facts.aboutVersion = '2.5.21'
+    $state.Facts.activeRuntimeId='2.5.21-e3b0c44298fc1c14'
+    $state.Facts.statusRuntimeId=$state.Facts.activeRuntimeId
+    $state.Facts.lifecycleReceipt.runtimeId=$state.Facts.activeRuntimeId
+    $fakeIntegration = New-Module -ArgumentList $state -ScriptBlock {
+        param($State)
+        function Get-CcodInstalledLifecycleFacts { param($InstallRoot,$ExpectedVersion) $State.Calls++; return $State.Facts }
+        function Get-CcodInstalledLifecycleLegacyTrayReadyProof {
+            param($InstallRoot,$RuntimeId,$Supervisor,$TrayHost)
+            $State.ReadyCalls++
+            if($RuntimeId-cne$State.Facts.activeRuntimeId-or@($Supervisor).Count-ne1-or$Supervisor[0].pid-ne200-or@($TrayHost).Count-ne1-or$TrayHost[0].pid-ne201){throw 'legacy helper arguments'}
+            return $State.Ready
+        }
+        Export-ModuleMember -Function Get-CcodInstalledLifecycleFacts,Get-CcodInstalledLifecycleLegacyTrayReadyProof
+    }
+    $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+    try {
+        $capture = &$module {
+            param($Fake,$InstallRoot)
+            $script:CcodOfficialDraftIntegrationModule = $Fake
+            $script:CcodOfficialDraftInstallRoot = $InstallRoot
+            (Get-CcodOfficialDraftDefaultAdapters).CaptureFacts
+        } $fakeIntegration $root
+        $context = [pscustomobject][ordered]@{ phase='LegacyUpgrade'; expectedVersion='2.5.22'; previousSetup=[pscustomobject]@{version='2.5.21'} }
+        $control = & $capture $context 'Before'
+        Assert-CcodTrue $control.protectionReady 'legacy observation uses protected event proof without a newer log'
+        Assert-CcodEqual 1 $state.ReadyCalls 'default capture invokes the legacy helper once'
+        $state.Ready=$false
+        $notReady=&$capture $context 'Before'
+        Assert-CcodTrue (-not$notReady.protectionReady-and-not$notReady.trayAuthenticated) 'negative protected-event proof cannot become readiness'
+        $state.Ready=$true
+        $previousCalls = $state.Calls
+        $state.Facts = New-CcodAcceptanceRawFacts -Absent
+        Assert-CcodThrows { & $capture $context 'Before' | Out-Null } 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+        Assert-CcodEqual ($previousCalls + 1) $state.Calls 'the absent installed observation reaches the same adapter boundary'
+    } finally {
+        if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        if ($null -ne $fakeIntegration) { Remove-Module -Name $fakeIntegration.Name -Force -ErrorAction SilentlyContinue }
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+Invoke-CcodTest 'official draft default uninstall observations require two debug ports' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-default-uninstall-ports-' + [guid]::NewGuid().ToString('N'))
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $facts = New-CcodAcceptanceRawFacts
+        $fakeIntegration = New-Module -ArgumentList $facts -ScriptBlock {
+            param($Facts)
+            function Get-CcodInstalledLifecycleFacts { param([string]$InstallRoot,[string]$ExpectedVersion); return $Facts }
+            function Read-CcodInstalledLifecycleStatusFact { param($StateRoot) throw 'status must not be reread after the fact snapshot' }
+            Export-ModuleMember -Function Get-CcodInstalledLifecycleFacts,Read-CcodInstalledLifecycleStatusFact
+        }
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            $capture = & $module {
+                param($Fake,$InstallRoot)
+                $script:CcodOfficialDraftIntegrationModule=$Fake
+                $script:CcodOfficialDraftInstallRoot=$InstallRoot
+                (Get-CcodOfficialDraftDefaultAdapters).CaptureFacts
+            } $fakeIntegration $root
+            $context = [pscustomobject]@{ phase='Uninstall' }
+            foreach ($bad in @(@(),@(9229),@(9229,9229),@([double]9229.25,9230),'9229')) {
+                $facts.debugPorts = @(9229,9230)
+                $control = & $capture $context 'Before'
+                Assert-CcodEqual '9229,9230' ($control.debugPorts -join ',') 'two captured ports are accepted before a single port-shape mutation'
+                $facts.debugPorts = $bad
+                Assert-CcodThrows { & $capture $context 'Before' | Out-Null } 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+            }
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if ($null -ne $fakeIntegration) { Remove-Module -Name $fakeIntegration.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft default observations include the current boot identity' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-default-boot-' + [guid]::NewGuid().ToString('N'))
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        [IO.Directory]::CreateDirectory((Join-Path $root 'runtime')) | Out-Null
+        [IO.Directory]::CreateDirectory((Join-Path $root 'logs')) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $root 'active.json'), '{}', [Text.UTF8Encoding]::new($false))
+        $trayReady = [ordered]@{ schemaVersion = 1; timestampUtc = '2030-02-03T04:05:03.0000000Z'; component = 'Supervisor'; stage = 'TrayHostReady'; code = 'CCOD_TRAYHOST_READY'; outcome = 'Completed'; runtimeId = 'runtime-2.5.22'; hostPid = 201; hostCreationTimeUtc = '2030-02-03T04:05:01.0000000Z'; protocolMajor = 2; capabilities = [UInt64]2 }
+        [IO.File]::WriteAllText((Join-Path $root 'logs\supervisor.log'), (($trayReady | ConvertTo-Json -Compress) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $facts = New-CcodAcceptanceFacts -BootId 'fixture-ignored'
+        $facts | Add-Member -NotePropertyName appPresent -NotePropertyValue $true
+        $facts.aboutVersion = '2.5.22'
+        $fakeIntegration = New-Module -ArgumentList $facts -ScriptBlock {
+            param($Facts)
+            function Get-CcodInstalledLifecycleFacts { param([string]$InstallRoot,[string]$ExpectedVersion); return $Facts }
+            Export-ModuleMember -Function Get-CcodInstalledLifecycleFacts
+        }
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            $observed = &$module {
+                param($Fake,$InstallRoot)
+                $script:CcodOfficialDraftIntegrationModule = $Fake
+                $script:CcodOfficialDraftInstallRoot = $InstallRoot
+                $adapters = Get-CcodOfficialDraftDefaultAdapters
+                & $adapters.CaptureFacts ([pscustomobject]@{ phase = 'PostReboot'; expectedVersion = '2.5.22' }) 'After'
+            } $fakeIntegration $root
+            Assert-CcodTrue ($observed.bootId -is [string] -and $observed.bootId.Length -gt 0) 'default observations include a sanitized boot identity'
+            Assert-CcodTrue ($observed.trayAuthenticated -and $observed.protectionReady) 'default observations require the authenticated tray proof and matching runtime status'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if ($null -ne $fakeIntegration) { Remove-Module -Name $fakeIntegration.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft post-reboot rejects an observed active generation that differs from the terminal receipt' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase Uninstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase FreshInstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase PreReboot -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart -AllowWindowsReboot | Out-Null
+            $state.BootId = 'boot-2'
+            $state.Facts = New-CcodAcceptanceFacts -BootId 'boot-2'
+            $state.Facts.activeRuntimeId = 'runtime-attacker'
+            $state.Facts.activeGeneration = [UInt64]99
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase PostReboot -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart -AllowWindowsReboot | Out-Null
+            } 'CCOD_ACCEPTANCE_POST_REBOOT_OBSERVATION_INVALID'
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft replay rejects a tampered PreReboot continuity identity' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptanceThroughReady -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -State $state
+            $path = Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '05-PreReboot.json'
+            $receipt = Get-Content -LiteralPath $path -Raw | ConvertFrom-Json
+            $receipt.facts.activeRuntimeId = 'runtime-tampered'
+            [IO.File]::WriteAllText($path, ($receipt | ConvertTo-Json -Depth 12), [Text.UTF8Encoding]::new($false))
+            $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            try { Assert-CcodThrows { &$module { param($Directory) Read-CcodOfficialDraftState -StateDirectory $Directory } (Join-Path $evidenceRoot 'official-draft-acceptance') } 'CCOD_ACCEPTANCE_RECEIPT_INVALID' } finally { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft replay revalidates the fixed v2.5.21 setup and manifest bytes' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptanceThroughReady -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -State $state
+            $path = Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '02-LegacyUpgrade.json'
+            $receipt = Get-Content -LiteralPath $path -Raw | ConvertFrom-Json
+            $receipt.facts.previousSetup.assetSha256 = ('e' * 64)
+            [IO.File]::WriteAllText($path, ($receipt | ConvertTo-Json -Depth 12), [Text.UTF8Encoding]::new($false))
+            $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            try {
+                Assert-CcodThrows { &$module { param($Directory,$Previous) Read-CcodOfficialDraftState -StateDirectory $Directory -PreviousAssetDirectory $Previous } (Join-Path $evidenceRoot 'official-draft-acceptance') $previousRoot } 'CCOD_ACCEPTANCE_RECEIPT_INVALID'
+            } finally { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft replay rejects a detached PreReboot runtime manifest hash' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptanceThroughReady -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -State $state
+            $path = Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '05-PreReboot.json'
+            $receipt = Get-Content -LiteralPath $path -Raw | ConvertFrom-Json
+            $receipt.facts.observation.runtimeManifestSha256 = ('e' * 64)
+            [IO.File]::WriteAllText($path, ($receipt | ConvertTo-Json -Depth 12), [Text.UTF8Encoding]::new($false))
+            $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            try { Assert-CcodThrows { &$module { param($Directory) Read-CcodOfficialDraftState -StateDirectory $Directory } (Join-Path $evidenceRoot 'official-draft-acceptance') } 'CCOD_ACCEPTANCE_RECEIPT_INVALID' } finally { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft replay rejects a PostReboot TrayHost identity detached from its observation' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptanceThroughReady -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -State $state
+            $path = Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '06-PostReboot.json'
+            $receipt = Get-Content -LiteralPath $path -Raw | ConvertFrom-Json
+            $receipt.facts.trayHostIdentity.pid = 999
+            [IO.File]::WriteAllText($path, ($receipt | ConvertTo-Json -Depth 12), [Text.UTF8Encoding]::new($false))
+            $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            try { Assert-CcodThrows { &$module { param($Directory) Read-CcodOfficialDraftState -StateDirectory $Directory } (Join-Path $evidenceRoot 'official-draft-acceptance') } 'CCOD_ACCEPTANCE_RECEIPT_INVALID' } finally { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft replay rejects a broken device-key chain across uninstall' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptanceThroughReady -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -State $state
+            $path = Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '03-Uninstall.json'
+            $receipt = Get-Content -LiteralPath $path -Raw | ConvertFrom-Json
+            $receipt.facts.deviceKeySha256Before = ('c' * 64)
+            $receipt.facts.deviceKeySha256After = ('c' * 64)
+            [IO.File]::WriteAllText($path, ($receipt | ConvertTo-Json -Depth 12), [Text.UTF8Encoding]::new($false))
+            $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            try {
+                Assert-CcodThrows { &$module { param($Directory) Read-CcodOfficialDraftState -StateDirectory $Directory } (Join-Path $evidenceRoot 'official-draft-acceptance') } 'CCOD_ACCEPTANCE_RECEIPT_INVALID'
+            } finally { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft state reader rejects a reparse-point state root' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-state-reparse-' + [guid]::NewGuid().ToString('N'))
+        $outside = Join-Path ([IO.Path]::GetTempPath()) ('ccod-state-reparse-outside-' + [guid]::NewGuid().ToString('N'))
+        [IO.Directory]::CreateDirectory($outside) | Out-Null
+        try {
+            New-Item -ItemType Junction -Path $root -Target $outside | Out-Null
+            $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            try { Assert-CcodThrows { &$module { param($Directory) Read-CcodOfficialDraftState -StateDirectory $Directory } $root } 'CCOD_ACCEPTANCE_RECEIPT_INVALID' } finally { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        } finally {
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $outside) { Remove-Item -LiteralPath $outside -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft state reader recovers closed orphan create-only temporaries' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-state-orphan-temp-' + [guid]::NewGuid().ToString('N'))
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $acceptanceTemp = Join-Path $root ('.acceptance-' + [guid]::NewGuid().ToString('N') + '.tmp')
+        $manualTemp = Join-Path $root ('.manual-' + [guid]::NewGuid().ToString('N') + '.tmp')
+        [IO.File]::WriteAllText($acceptanceTemp, 'orphan-acceptance', [Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($manualTemp, 'orphan-manual', [Text.UTF8Encoding]::new($false))
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            $records = &$module { param($Directory) Read-CcodOfficialDraftState -StateDirectory $Directory } $root
+            Assert-CcodTrue ($records.ContainsKey('ManualEvidence')) 'state reader continues after orphan temporary recovery'
+            Assert-CcodTrue (-not (Test-Path -LiteralPath $acceptanceTemp) -and -not (Test-Path -LiteralPath $manualTemp)) 'state reader removes only recognized closed orphan temporaries'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft JSONL proofs reject a reparse parent outside the evidence root' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-jsonl-reparse-' + [guid]::NewGuid().ToString('N'))
+        $outside = Join-Path ([IO.Path]::GetTempPath()) ('ccod-jsonl-reparse-outside-' + [guid]::NewGuid().ToString('N'))
+        $junction = Join-Path $root 'logs'
+        [IO.Directory]::CreateDirectory($outside) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $outside 'proof.jsonl'), '{"kind":"fixture"}', [Text.UTF8Encoding]::new($false))
+        try {
+            [IO.Directory]::CreateDirectory($root) | Out-Null
+            New-Item -ItemType Junction -Path $junction -Target $outside | Out-Null
+            $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            try {
+                Assert-CcodThrows {
+                    &$module { param($Path) Get-CcodOfficialDraftJsonLines -Path $Path } (Join-Path $junction 'proof.jsonl')
+                } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID'
+            } finally { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        } finally {
+            try { if ([IO.Directory]::Exists($junction)) { [IO.Directory]::Delete($junction, $false) } } catch { }
+            try { if ([IO.Directory]::Exists($root)) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue } } catch { }
+            try { if ([IO.Directory]::Exists($outside)) { Remove-Item -LiteralPath $outside -Recurse -Force -ErrorAction SilentlyContinue } } catch { }
+        }
+    }
+
+    Invoke-CcodTest 'official draft terminal receipts reject floating and boolean generations' {
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            foreach ($bad in @([double]2,[bool]$true)) {
+                $receipt = [pscustomobject][ordered]@{ kind='RestartAndRepair'; origin='Installer'; runtimeId='runtime-2.5.22'; runtimeGeneration=$bad; phase='Completed' }
+                Assert-CcodThrows { &$module { param($Value) ConvertTo-CcodOfficialDraftTerminalReceipt -Receipt $Value } $receipt } 'CCOD_ACCEPTANCE_FRESH_INSTALL_OBSERVATION_INVALID'
+            }
+        } finally { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+    }
+
+    Invoke-CcodTest 'official draft manual records reject lowercase phase variants' {
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        $record = [pscustomobject][ordered]@{
+            schemaVersion = 1; kind = 'manual-evidence'; phase = 'TrayEvidence'; operation = 'About'
+            terminalState = 'AboutVisible'; result = 'CCOD_TRAYABOUT_COMPLETED'
+            proof = [pscustomobject][ordered]@{ timestampUtc = [DateTime]::UtcNow.ToString('o'); command = 'ShowAbout'; revision = 7; code = 'CCOD_TRAY_ACTION_COMPLETED'; status = 'Completed' }
+            reviewState = 'Reviewed'
+            version = '2.5.22'; gitCommit = ('c' * 40); candidateManifestSha256 = ('d' * 64)
+            screenshotSha256 = ('1' * 64); redactedLogSha256 = ('2' * 64)
+        }
+        try {
+            $control = & $module { param($Value) Assert-CcodOfficialDraftManualRecordShape -Record $Value } $record
+            Assert-CcodEqual 'TrayEvidence' $control.phase 'complete proof with canonical phase succeeds before changing only case'
+            $record.phase = 'trayevidence'
+            Assert-CcodThrows {
+                &$module { param($Value) Assert-CcodOfficialDraftManualRecordShape -Record $Value } $record
+            } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID'
+        } finally { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+    }
+
+    Invoke-CcodTest 'official draft removes PreReboot receipt when the authorized reboot fails' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase Uninstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase FreshInstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            $adapters.Reboot = { $State.RebootCalls++; return $false }.GetNewClosure()
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase PreReboot -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart -AllowWindowsReboot | Out-Null
+            } 'CCOD_ACCEPTANCE_REBOOT_FAILED'
+            Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '05-PreReboot.json') -PathType Leaf)) 'failed reboot does not strand the PreReboot receipt'
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft receipt writer never deletes a colliding temporary file' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-receipt-collision-' + [guid]::NewGuid().ToString('N'))
+        $target = Join-Path $root 'receipt.json'
+        $collision = [hashtable]@{ Path = $null }
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            [IO.Directory]::CreateDirectory($root) | Out-Null
+            $beforeOpen = {
+                param($Path)
+                $collision.Path = $Path
+                [IO.File]::WriteAllText($Path, 'foreign temporary content', [Text.UTF8Encoding]::new($false))
+            }.GetNewClosure()
+            Assert-CcodThrows {
+                &$module { param($Path,$Callback) Write-CcodOfficialDraftJsonCreateOnly -Path $Path -Record ([ordered]@{ value = 'fixture' }) -ErrorId 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_WRITE_FAILED' -BeforeTemporaryOpen $Callback | Out-Null } $target $beforeOpen
+            } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_CLEANUP_FAILED'
+            Assert-CcodTrue ($null -ne $collision.Path -and [IO.File]::Exists($collision.Path)) 'foreign temporary file remains untouched after collision'
+            Assert-CcodEqual 'foreign temporary content' ([IO.File]::ReadAllText($collision.Path)) 'foreign temporary content is preserved'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft Complete reports cleanup failure instead of hiding a terminal residue' {
+        $path = Join-Path ([IO.Path]::GetTempPath()) ('ccod-complete-cleanup-' + [guid]::NewGuid().ToString('N') + '.json')
+        [IO.File]::WriteAllText($path, 'fixture', [Text.UTF8Encoding]::new($false))
+        $expectedHash = Get-CcodTestFileSha256 -Path $path
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            & $module { param($Target,$Hash) Remove-CcodOfficialDraftCompleteArtifacts -Paths @($Target) -ExpectedHashes @{ ([IO.Path]::GetFullPath($Target)) = $Hash } | Out-Null } $path $expectedHash
+            Assert-CcodTrue (-not (Test-Path -LiteralPath $path)) 'valid owned-file cleanup succeeds before the failing callback'
+            foreach ($mode in @('Throw','LeaveResidue')) {
+                [IO.File]::WriteAllText($path,'fixture',[Text.UTF8Encoding]::new($false))
+                $state = [pscustomobject]@{ Calls = 0; Mode = $mode }
+                $remove = { param($Path) $state.Calls++; if ($state.Mode -ceq 'Throw') { throw 'fixture cleanup failure' } }.GetNewClosure()
+                Assert-CcodThrows {
+                    &$module {
+                        param($Target,$Hash,$Remove)
+                        Remove-CcodOfficialDraftCompleteArtifacts -Paths @($Target) -ExpectedHashes @{ ([IO.Path]::GetFullPath($Target)) = $Hash } -RemovePath $Remove
+                    } $path $expectedHash $remove
+                } 'CCOD_ACCEPTANCE_COMPLETE_CLEANUP_FAILED'
+                Assert-CcodEqual 1 $state.Calls 'the valid hash reaches the actual deletion callback'
+                Assert-CcodTrue (Test-Path -LiteralPath $path -PathType Leaf) 'failed deletion leaves an explicitly reported residue'
+                Assert-CcodEqual $expectedHash (Get-CcodTestFileSha256 -Path $path) 'failed deletion does not change the owned bytes'
+            }
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft receipt chain rejects a detached Complete candidate' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        $manualRoot = Join-Path $fixture.Root 'manual-input'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($manualRoot) | Out-Null
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptanceThroughReady -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -State $state
+            $paths = New-CcodAcceptanceManualInputFiles -Root $manualRoot
+            Invoke-CcodAcceptanceManualRecords -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -Paths $paths
+            Invoke-CcodAcceptancePrivate -Phase Complete -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            $stateDirectory = Join-Path $evidenceRoot 'official-draft-acceptance'
+            $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            try {
+                $records = &$module { param($Directory) Read-CcodOfficialDraftState -StateDirectory $Directory } $stateDirectory
+                $completeRemote = @($records.Complete.facts.manualEvidence | Where-Object { $_.operation -ceq 'SecondDeviceControl' })[0]
+                $fileRemote = $records.ManualEvidence['SecondDeviceControl']
+                $completeRemote.proof.runtimeId = 'runtime-other'
+                $fileRemote.proof.runtimeId = 'runtime-other'
+                Assert-CcodThrows {
+                    &$module { param($Value,$Directory) Assert-CcodOfficialDraftAutomatedReceiptChain -Records $Value -StateDirectory $Directory } $records $stateDirectory
+                } 'CCOD_ACCEPTANCE_RECEIPT_INVALID'
+                $completeRemote.proof.runtimeId = 'runtime-2.5.22'
+                $fileRemote.proof.runtimeId = 'runtime-2.5.22'
+                $records.Complete.draft.id = 'different-draft'
+                Assert-CcodThrows {
+                    &$module { param($Value,$Directory) Assert-CcodOfficialDraftAutomatedReceiptChain -Records $Value -StateDirectory $Directory } $records $stateDirectory
+                } 'CCOD_ACCEPTANCE_RECEIPT_INVALID'
+                $records.Complete.draft.id = '123'
+                $detached = [pscustomobject][ordered]@{
+                    version = [string]$records.Complete.candidate.version
+                    gitCommit = ('d' * 40)
+                    assetHashes = @($records.Complete.candidate.assetHashes)
+                    manifestHashes = [pscustomobject][ordered]@{ portable = [string]$records.Complete.candidate.manifestHashes.portable; setup = [string]$records.Complete.candidate.manifestHashes.setup }
+                }
+                $records.Complete.candidate = $detached
+                Assert-CcodThrows {
+                    &$module { param($Value,$Directory) Assert-CcodOfficialDraftAutomatedReceiptChain -Records $Value -StateDirectory $Directory } $records $stateDirectory
+                } 'CCOD_ACCEPTANCE_RECEIPT_INVALID'
+            } finally { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft fresh install rejects a runtime binding detached from the candidate' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase Uninstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            $adapters.RunPhase = { param($Context) [pscustomobject][ordered]@{ completed = $true; outcome = 'Completed'; installerSha256 = [string](@($Fixture.Contract.Assets | Where-Object { $_.name -like '*-setup.exe' })[0].sha256); runtimeManifestSha256 = ('1' * 64) } }.GetNewClosure()
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase FreshInstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            } 'CCOD_ACCEPTANCE_FRESH_INSTALL_OBSERVATION_INVALID'
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'official draft manual evidence rejects files changed after proof capture' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-manual-hash-stability-' + [guid]::NewGuid().ToString('N'))
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $screenshot = Join-Path $root 'screenshot.png'
+        $log = Join-Path $root 'redacted.log'
+        [IO.File]::WriteAllText($screenshot, 'screenshot-before', [Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($log, 'log-before', [Text.UTF8Encoding]::new($false))
+        $screenshotHash = Get-CcodTestFileSha256 -Path $screenshot
+        $logHash = Get-CcodTestFileSha256 -Path $log
+        [IO.File]::WriteAllText($log, 'log-after', [Text.UTF8Encoding]::new($false))
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            Assert-CcodThrows {
+                &$module {
+                    param($Screenshot,$Log,$ExpectedScreenshot,$ExpectedLog)
+                    Assert-CcodOfficialDraftEvidenceHashesStable -ScreenshotPath $Screenshot -RedactedLogPath $Log -ExpectedScreenshotSha256 $ExpectedScreenshot -ExpectedRedactedLogSha256 $ExpectedLog
+                } $screenshot $log $screenshotHash $logHash
+            } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft manual artifacts reject files larger than two MiB' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-manual-size-bound-' + [guid]::NewGuid().ToString('N'))
+        $artifactRoot = Join-Path $root 'artifacts'
+        $screenshot = Join-Path $root 'screenshot.png'
+        $log = Join-Path $root 'redacted.log'
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        [IO.File]::WriteAllBytes($screenshot, [byte[]]::new((2MB) + 1))
+        [IO.File]::WriteAllText($log, 'bounded-log', [Text.UTF8Encoding]::new($false))
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            Assert-CcodThrows {
+                &$module {
+                    param($Artifact,$Shot,$Log,$ShotHash,$LogHash)
+                    Write-CcodOfficialDraftManualArtifacts -ArtifactDirectory $Artifact -Operation 'About' -ScreenshotPath $Shot -RedactedLogPath $Log -ExpectedScreenshotSha256 $ShotHash -ExpectedRedactedLogSha256 $LogHash | Out-Null
+                } $artifactRoot $screenshot $log (Get-CcodTestFileSha256 -Path $screenshot) (Get-CcodTestFileSha256 -Path $log)
+            } 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft regular file validation rejects noncanonical paths' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-noncanonical-file-' + [guid]::NewGuid().ToString('N'))
+        $nested = Join-Path $root 'nested'
+        $file = Join-Path $root 'evidence.log'
+        [IO.Directory]::CreateDirectory($nested) | Out-Null
+        [IO.File]::WriteAllText($file, 'fixture', [Text.UTF8Encoding]::new($false))
+        $noncanonical = Join-Path $nested '..\evidence.log'
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            Assert-CcodThrows {
+                &$module { param($Path) Get-CcodOfficialDraftFileSha256 -Path $Path } $noncanonical
+            } 'CCOD_ACCEPTANCE_RECEIPT_INVALID'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+    Invoke-CcodTest 'official draft atomic receipt writer removes a destination that fails readback' {
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-receipt-readback-' + [guid]::NewGuid().ToString('N'))
+        $target = Join-Path $root 'receipt.json'
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            [IO.Directory]::CreateDirectory($root) | Out-Null
+            $state = [pscustomobject]@{ Calls = 0; PublishedPresent = $false }
+            $readback = { param($Path) $state.Calls++; $state.PublishedPresent = ((Get-Item -LiteralPath $Path -Force -ErrorAction Stop) -is [IO.FileInfo]); return $false }.GetNewClosure()
+            $failure = &$module {
+                param($Path,$Callback)
+                $hash = $null
+                try { Write-CcodOfficialDraftJsonCreateOnly -Path $Path -Record ([ordered]@{ value = 'fixture' }) -ErrorId 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_WRITE_FAILED' -Readback $Callback -PublishedHash ([ref]$hash) | Out-Null }
+                catch { return [pscustomobject][ordered]@{ ErrorId = $_.FullyQualifiedErrorId; PublishedHash = $hash } }
+            } $target $readback
+            Assert-CcodEqual 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_WRITE_FAILED' $failure.ErrorId 'receipt writer preserves the original write failure after readback cleanup'
+            Assert-CcodTrue ($failure.PublishedHash -is [string] -and $failure.PublishedHash -cmatch '^[0-9a-f]{64}\z') 'receipt writer registers the published hash before readback'
+            Assert-CcodEqual 1 $state.Calls 'the actual readback callback reported failure'
+            Assert-CcodTrue $state.PublishedPresent 'readback left the published file for production rollback'
+            Assert-CcodTrue (-not [IO.File]::Exists($target)) 'receipt writer cleans a published destination after failed readback'
+            $successTarget = Join-Path $root 'success.json'
+            $publishedHash = &$module { param($Path) $hash = $null; Write-CcodOfficialDraftJsonCreateOnly -Path $Path -Record ([ordered]@{ value = 'fixture' }) -ErrorId 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_WRITE_FAILED' -PublishedHash ([ref]$hash) | Out-Null; return $hash } $successTarget
+            Assert-CcodTrue ($publishedHash -match '^[0-9a-f]{64}\z') 'receipt writer returns the intended hash before any caller cleanup'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+    Invoke-CcodTest 'official draft receipt writer removes a destination that fails readback' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-receipt-readback-' + [guid]::NewGuid().ToString('N'))
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $candidate = [pscustomobject][ordered]@{ version = $fixture.Version; gitCommit = $fixture.GitCommit; assetHashes = @($fixture.Contract.Assets); manifestHashes = [pscustomobject][ordered]@{ portable = $fixture.Contract.PortableManifestSha256; setup = $fixture.Contract.SetupManifestSha256 } }
+        $draft = [pscustomobject][ordered]@{ tag = 'v2.5.22'; id = '123' }
+        $setupReceipt = New-CcodAcceptanceDefenderReceipt -Fixture $fixture -AssetType Setup
+        $portableReceipt = New-CcodAcceptanceDefenderReceipt -Fixture $fixture -AssetType PortableZip
+        $facts = [pscustomobject][ordered]@{ defenderReceipts = @($setupReceipt,$portableReceipt) }
+        try {
+            $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+            try {
+                $state = [pscustomobject]@{ Calls = 0; PublishedPresent = $false }
+                $readback = { param($Path) $state.Calls++; $state.PublishedPresent = ((Get-Item -LiteralPath $Path -Force -ErrorAction Stop) -is [IO.FileInfo]); return $false }.GetNewClosure()
+                Assert-CcodThrows {
+                    &$module { param($Root,$Candidate,$Draft,$Facts,$Callback) Write-CcodOfficialDraftReceipt -StateDirectory $Root -Phase Preflight -Candidate $Candidate -Draft $Draft -Facts $Facts -ReadbackVerifier $Callback | Out-Null } $root $candidate $draft $facts $readback
+                } 'CCOD_ACCEPTANCE_RECEIPT_WRITE_FAILED'
+                Assert-CcodEqual 1 $state.Calls 'the phase receipt reaches actual readback'
+                Assert-CcodTrue $state.PublishedPresent 'the callback does not pre-delete the published phase receipt'
+                Assert-CcodTrue (-not [IO.File]::Exists((Join-Path $root '01-Preflight.json'))) 'receipt writer cleans a published destination after failed readback'
+            } finally { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft receipt writer registers its hash before readback failure' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-receipt-published-hash-' + [guid]::NewGuid().ToString('N'))
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $candidate = [pscustomobject][ordered]@{ version = $fixture.Version; gitCommit = $fixture.GitCommit; assetHashes = @($fixture.Contract.Assets); manifestHashes = [pscustomobject][ordered]@{ portable = $fixture.Contract.PortableManifestSha256; setup = $fixture.Contract.SetupManifestSha256 } }
+        $draft = [pscustomobject][ordered]@{ tag = 'v2.5.22'; id = '123' }
+        $facts = [pscustomobject][ordered]@{ defenderReceipts = @((New-CcodAcceptanceDefenderReceipt -Fixture $fixture -AssetType Setup),(New-CcodAcceptanceDefenderReceipt -Fixture $fixture -AssetType PortableZip)) }
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        try {
+            $hash = $null
+            $failure = &$module {
+                param($Root,$Candidate,$Draft,$Facts,$HashRef)
+                $readback = { param($Path) throw 'forced readback failure' }
+                try { Write-CcodOfficialDraftReceipt -StateDirectory $Root -Phase Preflight -Candidate $Candidate -Draft $Draft -Facts $Facts -ReadbackVerifier $readback -PublishedHash $HashRef | Out-Null }
+                catch { [pscustomobject][ordered]@{ ErrorId = $_.FullyQualifiedErrorId; Hash = $HashRef.Value } }
+            } $root $candidate $draft $facts ([ref]$hash)
+            Assert-CcodEqual 'CCOD_ACCEPTANCE_RECEIPT_WRITE_FAILED' $failure.ErrorId 'receipt writer retains write error identity after readback failure'
+            Assert-CcodTrue ($failure.Hash -is [string] -and $failure.Hash -cmatch '^[0-9a-f]{64}\z') 'receipt writer exposes the published hash before readback'
+            Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $root '01-Preflight.json'))) 'throwing readback still rolls back the destination'
+        } finally {
+            if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force -ErrorAction SilentlyContinue }
+            if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    Invoke-CcodTest 'official draft Complete rereads the automated chain before publishing terminal acceptance' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        $manualRoot = Join-Path $fixture.Root 'manual-input'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($manualRoot) | Out-Null
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptanceThroughReady -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -State $state
+            $paths = New-CcodAcceptanceManualInputFiles -Root $manualRoot
+            Invoke-CcodAcceptanceManualRecords -Fixture $fixture -PreviousRoot $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -Paths $paths
+            $adapters.GetUtcNow = {
+                $postPath = Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '06-PostReboot.json'
+                $post = [IO.File]::ReadAllText($postPath) | ConvertFrom-Json
+                $post.facts.installRootPresent = $false
+                [IO.File]::WriteAllText($postPath, ($post | ConvertTo-Json -Depth 16), [Text.UTF8Encoding]::new($false))
+                return [datetime]::Parse('2030-02-03T04:05:06Z').ToUniversalTime()
+            }.GetNewClosure()
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase Complete -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            } 'CCOD_ACCEPTANCE_RECEIPT_INVALID'
+            Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path (Join-Path $evidenceRoot 'official-draft-acceptance') '08-Complete.json') -PathType Leaf)) 'tampered automated chain does not leave a Complete receipt'
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+
+    Invoke-CcodTest 'persisted PostReboot facts require an installed root and active pointer' {
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        $facts = [pscustomobject][ordered]@{
+            observation = [pscustomobject][ordered]@{
+                version = '2.5.22'; bootId = 'boot-after'; installRootPresent = $true; installReady = $true; appRootPresent = $true; runtimeRootPresent = $true; activePointerPresent = $true
+                activeRuntimeId = 'runtime-2.5.22'; activeGeneration = [UInt64]2; runtimeManifestSha256 = ('d' * 64)
+                supervisor = @([pscustomobject][ordered]@{ pid = 200; creationTimeUtc = '2030-02-03T04:05:00.0000000Z' })
+                trayHost = @([pscustomobject][ordered]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' })
+                codex = @([pscustomobject][ordered]@{ pid = 202; creationTimeUtc = '2030-02-03T04:05:02.0000000Z' }); codexCount = 1
+                trayHostIdentity = [pscustomobject][ordered]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' }; trayAuthenticated = $true
+                taskState = 'Ready'; statusPhase = 'Active'; statusRuntimeId = 'runtime-2.5.22'; statusCodex = [pscustomobject][ordered]@{ pid = 202; creationTimeUtc = '2030-02-03T04:05:02.0000000Z' }
+                transitionStage = 'Idle'; lifecycleReceipt = [pscustomobject][ordered]@{ kind = 'RestartAndRepair'; origin = 'Installer'; runtimeId = 'runtime-2.5.22'; runtimeGeneration = [UInt64]2; phase = 'Completed' }; aboutVersion = '2.5.22'
+                deviceKeyPresent = $true; deviceKeySha256 = ('b' * 64); shortcuts = [pscustomobject][ordered]@{ startMenu = $true; desktop = $true }
+                debugPorts = @(9229,9230); debugEndpoints = @(
+                    [pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = 9229; owningProcess = 202; owningProcessCreationTimeUtc = '2030-02-03T04:05:02.0000000Z' }
+                    [pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = 9230; owningProcess = 202; owningProcessCreationTimeUtc = '2030-02-03T04:05:02.0000000Z' }
+                ); protectionReady = $true
+            }
+            installRootPresent = $true; activePointerPresent = $true
+            bootIdBefore = 'boot-before'; bootIdAfter = 'boot-after'; bootChanged = $true; receiptContinuity = $true
+            activeRuntimeId = 'runtime-2.5.22'; activeGeneration = [UInt64]2; runtimeManifestSha256 = ('d' * 64)
+            transitionStage = 'Idle'; protectionRecovered = $true; protectionReady = $true; taskState = 'Ready'
+            supervisorCount = 1; trayHostCount = 1; codexCount = 1
+            trayHostIdentity = [pscustomobject][ordered]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' }
+            trayAuthenticated = $true
+            terminalReceipt = [pscustomobject][ordered]@{ kind = 'RestartAndRepair'; origin = 'Installer'; runtimeId = 'runtime-2.5.22'; runtimeGeneration = [UInt64]2; phase = 'Completed' }
+            deviceKeySha256 = ('b' * 64); keyHashPreserved = $true; operationOutcome = 'Completed'
+        }
+        try {
+            $valid = &$module { param($Value) Assert-CcodOfficialDraftPersistedPhaseFacts -Phase 'PostReboot' -Facts $Value } $facts
+            Assert-CcodTrue ($null -ne $valid) 'persisted PostReboot facts accept both required presence flags'
+            foreach ($name in @('installRootPresent','activePointerPresent')) {
+                $tampered = [pscustomobject][ordered]@{}
+                foreach ($property in $facts.PSObject.Properties) { $tampered | Add-Member -NotePropertyName $property.Name -NotePropertyValue $property.Value }
+                $tampered.$name = $false
+                Assert-CcodThrows { &$module { param($Value) Assert-CcodOfficialDraftPersistedPhaseFacts -Phase 'PostReboot' -Facts $Value } $tampered | Out-Null } 'CCOD_ACCEPTANCE_RECEIPT_INVALID'
+            }
+        } finally { if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue } }
+    }
+
+    Invoke-CcodTest 'official draft preserves an inner terminal receipt error identity' {
+        $source = [IO.File]::ReadAllText($modulePath, [Text.UTF8Encoding]::new($false))
+        $start = $source.IndexOf('function ConvertTo-CcodOfficialDraftTerminalReceipt')
+        $end = $source.IndexOf('function Assert-CcodOfficialDraftFreshFacts', $start)
+        Assert-CcodTrue ($start -ge 0 -and $end -gt $start) 'terminal receipt converter source is present'
+        $block = $source.Substring($start, $end - $start)
+        Assert-CcodTrue ($block.Contains("if (`$_.FullyQualifiedErrorId -like 'CCOD_ACCEPTANCE_*') { throw }")) 'terminal receipt conversion preserves an existing acceptance error id'
+    }
+
+    Invoke-CcodTest 'official draft hashes manual artifacts with their own error context' {
+        $module = Import-Module $modulePath -Force -PassThru -DisableNameChecking
+        $missing = Join-Path ([IO.Path]::GetTempPath()) ('ccod-missing-manual-' + [guid]::NewGuid().ToString('N') + '.bin')
+        try {
+            $observed = & $module {
+                param($Path)
+                try { Get-CcodOfficialDraftFileSha256 -Path $Path -ErrorId 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' -Message 'manual artifact unavailable' | Out-Null; 'NO_ERROR' } catch { [string]$_.FullyQualifiedErrorId }
+            } $missing
+            Assert-CcodEqual 'CCOD_ACCEPTANCE_MANUAL_EVIDENCE_INVALID' $observed 'manual artifact hash failures retain the manual evidence error context'
+        } finally { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+    }
+
+    Invoke-CcodTest 'official draft pre-reboot binds the captured boot identity' {
+        $fixture = New-CcodAcceptanceCandidateFixture
+        $previousRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-acceptance-previous-' + [guid]::NewGuid().ToString('N'))
+        $evidenceRoot = Join-Path $fixture.Root 'evidence'
+        [IO.Directory]::CreateDirectory($previousRoot) | Out-Null
+        [IO.Directory]::CreateDirectory($evidenceRoot) | Out-Null
+        $state = [pscustomobject]@{ DefenderCalls = [Collections.Generic.List[string]]::new(); RunCalls = [Collections.Generic.List[string]]::new(); CaptureCalls = [Collections.Generic.List[string]]::new(); BootCalls = 0; RebootCalls = 0; PreviousCalls = 0; BootId = 'boot-1'; KeyHash = ('b' * 64); Facts = New-CcodAcceptanceFacts }
+        try {
+            $adapters = New-CcodAcceptancePhaseAdapters -Fixture $fixture -State $state -ReturnAbsentAfterUninstall
+            Invoke-CcodAcceptancePrivate -Phase Preflight -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase LegacyUpgrade -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase Uninstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            Invoke-CcodAcceptancePrivate -Phase FreshInstall -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart | Out-Null
+            $adapters.GetBootIdentity = { return 'boot-external' }
+            Assert-CcodThrows {
+                Invoke-CcodAcceptancePrivate -Phase PreReboot -AssetDirectory $fixture.Root -PreviousAssetDirectory $previousRoot -EvidenceRoot $evidenceRoot -Adapters $adapters -AllowMachineMutation -AllowCodexRestart -AllowWindowsReboot | Out-Null
+            } 'CCOD_ACCEPTANCE_OBSERVATION_UNAVAILABLE'
+            Assert-CcodEqual 0 $state.RebootCalls 'boot identity mismatch cannot reach the reboot adapter'
+        } finally {
+            if (Test-Path -LiteralPath $fixture.Root) { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+            if (Test-Path -LiteralPath $previousRoot) { Remove-Item -LiteralPath $previousRoot -Recurse -Force }
+        }
+    }
+} catch {
+    Write-Error $_
+    exit 1
+}
+
+Write-Host 'Official-draft acceptance harness self-tests passed.'
diff --git a/tests/persistence/ProductResidueCleanup.SelfTest.ps1 b/tests/persistence/ProductResidueCleanup.SelfTest.ps1
new file mode 100644
index 0000000..e286c33
--- /dev/null
+++ b/tests/persistence/ProductResidueCleanup.SelfTest.ps1
@@ -0,0 +1,348 @@
+$ErrorActionPreference='Stop'
+. (Join-Path $PSScriptRoot 'TestSupport.ps1')
+$repositoryRoot=Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+$module=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/GenerationReclamation.psm1') -Force -PassThru
+$fixtureTokens=$null;$fixtureErrors=$null
+$fixtureAst=[Management.Automation.Language.Parser]::ParseFile((Join-Path $PSScriptRoot 'InstallLifecycle.SelfTest.ps1'),[ref]$fixtureTokens,[ref]$fixtureErrors)
+if(@($fixtureErrors).Count-ne0){throw 'installer fixture definitions invalid'}
+foreach($definition in @($fixtureAst.EndBlock.Statements|Where-Object {$_-is[Management.Automation.Language.FunctionDefinitionAst]})){. ([scriptblock]::Create($definition.Extent.Text))}
+$v2521LifecycleShortcutNames=@('Programs\CodexRemote-fix\CodexRemote-fix.lnk','Programs\CodexRemote-fix\CodexRemote-fix compatibility check.lnk','Programs\CodexRemote-fix\Uninstall CodexRemote-fix.lnk','Desktop\CodexRemote-fix.lnk')
+$results=@()
+
+$results+=Invoke-CcodTest 'generation reclamation runtime IDs use canonical TAB delimiters' {
+    $records=@(
+        [pscustomobject]@{path='a.txt';length=[int64]5;sha256=('a'*64)}
+        [pscustomobject]@{path='b.txt';length=[int64]4;sha256=('b'*64)}
+    )
+    $expected='2.5.22-e71f4818a0f8e98f-0123456789abcdef0123456789abcdef'
+    Assert-CcodEqual $expected (&$module {param($ProjectVersion,$Records,$Nonce) Get-CcodGenerationReclamationRuntimeId -ProjectVersion $ProjectVersion -Records $Records -Nonce $Nonce} '2.5.22' $records '0123456789abcdef0123456789abcdef') 'generation reclamation digest input must use literal TAB delimiters'
+}
+
+$results+=Invoke-CcodTest 'bounded product residue cleanup removes only the verified disposable product root' {
+    $root=Join-Path $env:TEMP ('ccod-product-tail-'+[guid]::NewGuid().ToString('N'))
+    $install=Join-Path $root 'CodexControlOtherDevices'
+    try {
+        [IO.Directory]::CreateDirectory((Join-Path $install 'state/active-generation'))|Out-Null
+        [IO.Directory]::CreateDirectory((Join-Path $install 'runtime'))|Out-Null
+        $runtimeId='2.5.22-'+('a'*16)+'-'+('b'*32)
+        [IO.File]::WriteAllText((Join-Path $install 'state/lifecycle-epoch.json'),'{"schemaVersion":1,"epoch":11}')
+        [IO.File]::WriteAllText((Join-Path $install 'state/active-generation/00000000000000000001.json'),('{"schemaVersion":1,"generation":1,"activeRuntime":"'+$runtimeId+'","previousGeneration":0}'))
+        $outside=Join-Path $root 'project.txt';[IO.File]::WriteAllText($outside,'user project retained')
+        $outsideHash=Get-CcodTestFileSha256 $outside
+        $result=&$module {
+            param($Install,$Runtime)
+            Remove-CcodVerifiedProductResidue -InstallRoot $Install -SelectedRuntimeId $Runtime -ExpectedEpoch ([uint64]11)
+        } $install $runtimeId
+        Assert-CcodEqual 'Removed' $result.result 'product cleanup returns exact terminal result'
+        Assert-CcodTrue (-not(Test-Path -LiteralPath $install)) 'complete uninstall removes the product root'
+        Assert-CcodEqual $outsideHash (Get-CcodTestFileSha256 $outside) 'sibling project is unchanged'
+    } finally {if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+}
+$results+=Invoke-CcodTest 'bounded product residue cleanup accepts real initialized state and retained manifest files' {
+    $root=Join-Path $env:TEMP ('ccod-product-state-'+[guid]::NewGuid().ToString('N'))
+    $install=Join-Path $root 'CodexControlOtherDevices'
+    $modules=@()
+    try {
+        $state=Join-Path $install 'state'
+        [IO.Directory]::CreateDirectory((Join-Path $state 'active-generation'))|Out-Null
+        $modules+=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/StateStore.psm1') -Force -PassThru -DisableNameChecking
+        $modules+=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/UiPreferences.psm1') -Force -PassThru -DisableNameChecking
+        $modules+=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/RuntimeManifest.psm1') -Force -PassThru -DisableNameChecking
+        $initialized=Initialize-CcodState -StateRoot $state -NodeCandidates @() -CandidateCompatibleOptIn $false
+        $initialized.settings.automationEnabled=$false
+        Write-CcodSettings -StateRoot $state -Settings $initialized.settings
+        Initialize-CcodUiPreference -StateRoot $state|Out-Null
+        $runtimeId='2.5.22-'+('a'*16)+'-'+('b'*32)
+        [IO.File]::WriteAllText((Join-Path $state 'lifecycle-epoch.json'),'{"schemaVersion":1,"epoch":11}')
+        [IO.File]::WriteAllText((Join-Path $state 'active-generation/00000000000000000001.json'),('{"schemaVersion":1,"generation":1,"activeRuntime":"'+$runtimeId+'","previousGeneration":0}'))
+        $retained=Join-Path $install 'runtime/pending';[IO.Directory]::CreateDirectory($retained)|Out-Null
+        [IO.File]::WriteAllText((Join-Path $retained 'payload.txt'),'verified retained product payload')
+        $manifest=New-CcodRuntimeManifest -RuntimeDirectory $retained -ProjectVersion '2.5.22'
+        $sealed=Join-Path $install ('runtime/'+$manifest.runtimeId);[IO.Directory]::Move($retained,$sealed)
+        [IO.File]::WriteAllText((Join-Path $sealed 'manifest.json'),($manifest|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+        $result=&$module {param($Install,$Runtime)Remove-CcodVerifiedProductResidue -InstallRoot $Install -SelectedRuntimeId $Runtime -ExpectedEpoch ([uint64]11)} $install $runtimeId
+        Assert-CcodEqual 'Removed' $result.result 'actual producers are accepted without loosening unknown-file handling'
+        Assert-CcodTrue (-not(Test-Path -LiteralPath $install)) 'known state and verified retained product files are removed'
+    } finally {foreach($imported in $modules){Remove-Module $imported -Force -ErrorAction SilentlyContinue};if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+}
+
+foreach($mutation in @('UnknownFile','UnknownDirectory','DeviceKey','Reparse','Hardlink','Ads','OpenFile','EpochDrift')){
+    $results+=Invoke-CcodTest "bounded product residue rejects $mutation without deleting any file" {
+        $root=Join-Path $env:TEMP ('ccod-product-hostile-'+[guid]::NewGuid().ToString('N'))
+        $install=Join-Path $root 'CodexControlOtherDevices';$held=$null
+        try {
+            [IO.Directory]::CreateDirectory((Join-Path $install 'state/active-generation'))|Out-Null
+            [IO.Directory]::CreateDirectory((Join-Path $install 'runtime'))|Out-Null
+            $runtimeId='2.5.22-'+('a'*16)+'-'+('b'*32)
+            $epoch=Join-Path $install 'state/lifecycle-epoch.json'
+            [IO.File]::WriteAllText($epoch,'{"schemaVersion":1,"epoch":11}')
+            $pointer=Join-Path $install 'state/active-generation/00000000000000000001.json'
+            [IO.File]::WriteAllText($pointer,('{"schemaVersion":1,"generation":1,"activeRuntime":"'+$runtimeId+'","previousGeneration":0}'))
+            $outside=Join-Path $root 'outside.txt';[IO.File]::WriteAllText($outside,'outside user data')
+            $outsideHash=Get-CcodTestFileSha256 $outside
+            switch($mutation){
+                'UnknownFile' {[IO.File]::WriteAllText((Join-Path $install 'my-project.txt'),'user-owned')}
+                'UnknownDirectory' {[IO.Directory]::CreateDirectory((Join-Path $install 'projects'))|Out-Null}
+                'DeviceKey' {[IO.Directory]::CreateDirectory((Join-Path $install 'state/device-key'))|Out-Null;[IO.File]::WriteAllText((Join-Path $install 'state/device-key/sentinel.bin'),'synthetic protected data')}
+                'Reparse' {New-Item -ItemType Junction -Path (Join-Path $install 'projects') -Target $root|Out-Null}
+                'Hardlink' {Remove-Item $epoch;New-Item -ItemType HardLink -Path $epoch -Target $outside|Out-Null}
+                'Ads' {Set-Content -LiteralPath $epoch -Stream 'untrusted' -Value 'ads' -NoNewline}
+                'OpenFile' {$held=[IO.File]::Open($epoch,[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read)}
+                'EpochDrift' {[IO.File]::WriteAllText($epoch,'{"schemaVersion":1,"epoch":12}')}
+            }
+            Assert-CcodThrows {&$module {param($Install,$Runtime)Remove-CcodVerifiedProductResidue -InstallRoot $Install -SelectedRuntimeId $Runtime -ExpectedEpoch ([uint64]11)} $install $runtimeId|Out-Null} 'CCOD_PRODUCT_RESIDUE_INVALID'
+            Assert-CcodTrue (Test-Path $pointer) "$mutation leaves the product selector untouched"
+            Assert-CcodTrue (Test-Path $epoch) "$mutation leaves the epoch untouched"
+            Assert-CcodEqual $outsideHash (Get-CcodTestFileSha256 $outside) "$mutation leaves outside data untouched"
+        } finally {if($null-ne$held){$held.Dispose()};if(Test-Path (Join-Path $install 'projects') -PathType Container){$item=Get-Item (Join-Path $install 'projects') -Force;if($item.Attributes-band[IO.FileAttributes]::ReparsePoint){[IO.Directory]::Delete($item.FullName)}};if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+    }
+}
+
+$results+=Invoke-CcodTest 'bounded cleanup accepts the actual installer state-plane writer output' {
+    $root=Join-Path $env:TEMP ('ccod-product-install-plane-'+[guid]::NewGuid().ToString('N'))
+    $install=Join-Path $root 'CodexControlOtherDevices';$fileTransaction=$null;$installModule=$null;$fileModule=$null
+    try {
+        [IO.Directory]::CreateDirectory((Join-Path $install 'state/active-generation'))|Out-Null
+        [IO.Directory]::CreateDirectory((Join-Path $install 'runtime'))|Out-Null
+        $runtimeId='2.5.22-'+('a'*16)+'-'+('b'*32)
+        $fileModule=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/InstallFileTransaction.psm1') -Force -PassThru -DisableNameChecking
+        $installModule=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/InstallLifecycle.psm1') -Force -PassThru -DisableNameChecking
+        $fileTransaction=&$installModule {param($Root)Open-CcodLifecycleInstallStateTransaction -InstallRoot $Root} $install
+        &$installModule {param($Root,$Runtime,$Transaction)Initialize-CcodInstallStatePlanes -InstallRoot $Root -RuntimeId $Runtime -FileTransaction $Transaction -NodeCandidates @() -CandidateCompatibleOptIn $false} $install $runtimeId $fileTransaction
+        Close-CcodInstallFileTransaction -Transaction $fileTransaction -Disposition Ready|Out-Null;$fileTransaction=$null
+        &$installModule {param($Root)$settings=Read-CcodSettings -StateRoot (Join-Path $Root 'state');$settings.automationEnabled=$false;Write-CcodSettings -StateRoot (Join-Path $Root 'state') -Settings $settings} $install
+        [IO.File]::WriteAllText((Join-Path $install 'state/lifecycle-epoch.json'),'{"schemaVersion":1,"epoch":11}')
+        [IO.File]::WriteAllText((Join-Path $install 'state/active-generation/00000000000000000001.json'),('{"schemaVersion":1,"generation":1,"activeRuntime":"'+$runtimeId+'","previousGeneration":0}'))
+        $result=&$module {param($Install,$Runtime)Remove-CcodVerifiedProductResidue -InstallRoot $Install -SelectedRuntimeId $Runtime -ExpectedEpoch ([uint64]11)} $install $runtimeId
+        Assert-CcodEqual 'Removed' $result.result 'actual installer initialization records are recognized'
+    } finally {if($null-ne$fileTransaction){Close-CcodInstallFileTransaction -Transaction $fileTransaction -Disposition Failed|Out-Null};foreach($m in @($installModule,$fileModule)){if($null-ne$m){Remove-Module $m -Force -ErrorAction SilentlyContinue}};if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+}
+
+function Invoke-CcodFullInstallerResidueCase {
+    param([switch]$LegacyUpgrade)
+    $root=Join-Path $env:TEMP ('ccod-product-real-writers-'+[guid]::NewGuid().ToString('N'))
+    $install=Join-Path $root 'CodexControlOtherDevices';$source=Join-Path $root 'source';$nodeRoot=Join-Path $root 'node'
+    try {
+        Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/InstallLifecycle.psm1') -Force -DisableNameChecking
+        Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/StateStore.psm1') -Force -DisableNameChecking
+        Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/UiPreferences.psm1') -Force -DisableNameChecking
+        Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/RuntimeManifest.psm1') -Force -DisableNameChecking
+        Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/LifecycleEpoch.psm1') -Force -DisableNameChecking
+        Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/InstallFileTransaction.psm1') -DisableNameChecking
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null
+        $fake=New-CcodLifecycleFake -NodePath (New-CcodLifecycleFakeNode -Root $nodeRoot)
+        $productState=@{FailWrites=$false;Registration=$null;ReadyEvidence=$null;RetainedError=$null;Writes=0;ShortcutWrites=0;ProductOnlyObserved=$false;Shortcuts=@{}}
+        Set-CcodLifecycleDefaultProductRegistrationFixture -Fake $fake -ProductState $productState
+        [void]$fake.Adapters.Remove('WriteLog')
+        if($LegacyUpgrade){
+            $legacySource=Join-Path $root 'legacy-source'
+            New-CcodLifecycleSourceFixture -Root $legacySource -Version '2.5.21'|Out-Null
+            $legacy=New-CcodLifecycleV2521LegacyInstallFixture -InstallRoot $install -SourceRoot $legacySource
+        }
+        $receipt=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('c'*64) -Adapters $fake.Adapters
+        Assert-CcodTrue $receipt.ProductRegistrationVerified 'real installer wrote a verified product state'
+        $active=Read-CcodActiveRuntime -InstallRoot $install
+        $runtime=Join-Path $install ('runtime/'+$active.activeRuntime)
+        $manifestHash=Get-CcodTestFileSha256 (Join-Path $runtime 'manifest.json')
+        &$module {param($Root,$Runtime,$Id,$Hash)Remove-CcodVerifiedGenerationTree -InstallRoot $Root -RuntimeRoot $Runtime -RuntimeId $Id -ExpectedManifestSha256 $Hash} $install $runtime $active.activeRuntime $manifestHash|Out-Null
+        $lifecycle=Get-Module InstallLifecycle
+        &$lifecycle {param($Root)$settings=Read-CcodSettings -StateRoot (Join-Path $Root 'state');$settings.automationEnabled=$false;Write-CcodSettings -StateRoot (Join-Path $Root 'state') -Settings $settings} $install
+        [IO.File]::WriteAllText((Join-Path $install 'state/lifecycle-epoch.json'),'{"schemaVersion":1,"epoch":11}')
+        $result=&$module {param($Root,$Id)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId $Id -ExpectedEpoch ([uint64]11)} $install $active.activeRuntime
+        Assert-CcodEqual 'Removed' $result.result 'full installer output is recognized without a fabricated state layout'
+    } finally {if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+}
+
+$results+=Invoke-CcodTest 'bounded cleanup consumes the full actual installer output with isolated machine adapters' {Invoke-CcodFullInstallerResidueCase}
+$results+=Invoke-CcodTest 'bounded cleanup consumes the historical v2521 upgrade output without retaining product files' {Invoke-CcodFullInstallerResidueCase -LegacyUpgrade}
+
+$results+=Invoke-CcodTest 'an existing cleanup journal cannot authorize an unknown user file' {
+    $root=Join-Path $env:TEMP ('ccod-product-journal-forgery-'+[guid]::NewGuid().ToString('N'))
+    $install=Join-Path $root 'CodexControlOtherDevices';$native=$null
+    try {
+        [IO.Directory]::CreateDirectory((Join-Path $install 'state/active-generation'))|Out-Null
+        $userFile=Join-Path $install 'my-project.txt';[IO.File]::WriteAllText($userFile,'user project must survive')
+        $originalHash=Get-CcodTestFileSha256 $userFile
+        $runtimeId='2.5.22-'+('a'*16)+'-'+('b'*32);$id='11111111-2222-3333-4444-555555555555'
+        [IO.File]::WriteAllText((Join-Path $install 'state/lifecycle-epoch.json'),'{"schemaVersion":1,"epoch":11}')
+        [IO.File]::WriteAllText((Join-Path $install 'state/active-generation/00000000000000000001.json'),('{"schemaVersion":1,"generation":1,"activeRuntime":"'+$runtimeId+'","previousGeneration":0}'))
+        $directory=Join-Path $root ('CodexRemote-fix-uninstall/'+$id);[IO.Directory]::CreateDirectory($directory)|Out-Null
+        $native=&$module {param([string]$Root)Initialize-CcodGenerationReclamationRuntime;Invoke-CcodGenerationReclamationStatic -Name OpenResidue -Arguments @($Root)} $install
+        $identity=&$module {param($Native)Invoke-CcodGenerationReclamationMethod -Runtime $Native -Name RootIdentity -Arguments @()} $native
+        $snapshot=&$module {param($Native)Invoke-CcodGenerationReclamationMethod -Runtime $Native -Name Snapshot -Arguments @()} $native
+        $evidence=@($snapshot.Files|Where-Object {$_.Path.StartsWith('state/')}|ForEach-Object {[pscustomobject][ordered]@{path=$_.Path;text=(&$module {param($Native,[string]$Path)Invoke-CcodGenerationReclamationMethod -Runtime $Native -Name ReadFileText -Arguments @($Path)} $native $_.Path)}})
+        $native.Dispose();$native=$null
+        $plan=[pscustomobject][ordered]@{schemaVersion=1;transactionId=$id;installRoot=$install;runtimeId=$runtimeId;epoch=11;rootIdentity=$identity;files=@($snapshot.Files|ForEach-Object {[pscustomobject][ordered]@{path=$_.Path;length=$_.Length;sha256=$_.Sha256}});directories=@($snapshot.Directories);evidence=$evidence}
+        [IO.File]::WriteAllText((Join-Path $directory 'product-residue-plan.json'),($plan|ConvertTo-Json -Depth 8 -Compress))
+        Assert-CcodThrows {&$module {param($Root,$Runtime,$Directory,$Id)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId $Runtime -ExpectedEpoch ([uint64]11) -TransactionDirectory $Directory -TransactionId $Id} $install $runtimeId $directory $id|Out-Null} 'CCOD_PRODUCT_RESIDUE_INVALID'
+        Assert-CcodEqual $originalHash (Get-CcodTestFileSha256 $userFile) 'forged journal cannot expand the approved deletion inventory'
+    } finally {if($null-ne$native){$native.Dispose()};if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+}
+
+function Invoke-CcodResiduePartialRetryCase {
+    param([ValidateSet('None','AddedFile','ReplacementRoot','JournalMutation')][string]$Attack='None')
+    $root=Join-Path $env:TEMP ('ccod-product-partial-'+[guid]::NewGuid().ToString('N'))
+    $install=Join-Path $root 'CodexControlOtherDevices'
+    try {
+        [IO.Directory]::CreateDirectory((Join-Path $install 'state/active-generation'))|Out-Null
+        [IO.Directory]::CreateDirectory((Join-Path $install 'runtime'))|Out-Null
+        $runtimeId='2.5.22-'+('a'*16)+'-'+('b'*32);$id='11111111-2222-3333-4444-555555555555'
+        [IO.File]::WriteAllText((Join-Path $install 'state/lifecycle-epoch.json'),'{"schemaVersion":1,"epoch":11}')
+        [IO.File]::WriteAllText((Join-Path $install 'state/active-generation/00000000000000000001.json'),('{"schemaVersion":1,"generation":1,"activeRuntime":"'+$runtimeId+'","previousGeneration":0}'))
+        $directory=Join-Path $root ('CodexRemote-fix-uninstall/'+$id);[IO.Directory]::CreateDirectory($directory)|Out-Null
+        &$module {$script:CcodProductResidueFailCommitAtForTest=3}
+        Assert-CcodThrows {&$module {param($Root,$Runtime,$Directory,$Id)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId $Runtime -ExpectedEpoch ([uint64]11) -TransactionDirectory $Directory -TransactionId $Id} $install $runtimeId $directory $id|Out-Null} 'CCOD_PRODUCT_RESIDUE_INVALID'
+        Assert-CcodTrue (Test-Path $install) 'partial commit retains the same native root'
+        Assert-CcodTrue (-not(Test-Path (Join-Path $install 'state/lifecycle-epoch.json'))) 'failure happens after native files were actually deleted'
+        Assert-CcodTrue (Test-Path (Join-Path $directory 'product-residue-plan.json')) 'write-ahead plan survives actual partial deletion'
+        &$module {$script:CcodProductResidueFailCommitAtForTest=-1}
+        if($Attack-cne'None'){
+            switch($Attack){
+                'AddedFile' {[IO.File]::WriteAllText((Join-Path $install 'my-project.txt'),'added after partial cleanup')}
+                'ReplacementRoot' {$parked=Join-Path $root 'original-product-root';[IO.Directory]::Move($install,$parked);[IO.Directory]::CreateDirectory($install)|Out-Null}
+                'JournalMutation' {$planPath=Join-Path $directory 'product-residue-plan.json';$plan=[IO.File]::ReadAllText($planPath)|ConvertFrom-Json;$plan.runtimeId='2.5.22-'+('c'*16)+'-'+('d'*32);[IO.File]::WriteAllText($planPath,($plan|ConvertTo-Json -Depth 12 -Compress))}
+            }
+            Assert-CcodThrows {&$module {param($Root,$Runtime,$Directory,$Id)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId $Runtime -ExpectedEpoch ([uint64]11) -TransactionDirectory $Directory -TransactionId $Id} $install $runtimeId $directory $id|Out-Null} 'CCOD_PRODUCT_RESIDUE_INVALID'
+            Assert-CcodTrue (Test-Path $install) 'changed retry target is not removed'
+            if($Attack-ceq'AddedFile'){Assert-CcodEqual 'added after partial cleanup' ([IO.File]::ReadAllText((Join-Path $install 'my-project.txt'))) 'new user file is untouched'}
+            return
+        }
+        $result=&$module {param($Root,$Runtime,$Directory,$Id)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId $Runtime -ExpectedEpoch ([uint64]11) -TransactionDirectory $Directory -TransactionId $Id} $install $runtimeId $directory $id
+        Assert-CcodEqual 'Removed' $result.result 'same-root retry validates the saved inventory and completes'
+        Assert-CcodTrue (-not(Test-Path $install)) 'retried cleanup removes the exact residual root'
+    } finally {&$module {$script:CcodProductResidueFailCommitAtForTest=-1};if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+}
+
+$results+=Invoke-CcodTest 'bounded cleanup resumes the exact residual tree after a native partial commit failure' {Invoke-CcodResiduePartialRetryCase}
+foreach($retryAttack in @('AddedFile','ReplacementRoot','JournalMutation')){
+    $results+=Invoke-CcodTest "bounded cleanup refuses $retryAttack on a real partial-commit retry" {Invoke-CcodResiduePartialRetryCase -Attack $retryAttack}
+}
+
+$results+=Invoke-CcodTest 'bounded cleanup accepts real epoch initialization and supervisor log writers' {
+    $root=Join-Path $env:TEMP ('ccod-product-observation-'+[guid]::NewGuid().ToString('N'))
+    $install=Join-Path $root 'CodexControlOtherDevices'
+    try {
+        [IO.Directory]::CreateDirectory((Join-Path $install 'state/active-generation'))|Out-Null
+        [IO.Directory]::CreateDirectory((Join-Path $install 'state/workers'))|Out-Null
+        $runtimeId='2.5.22-'+('a'*16)+'-'+('b'*32)
+        [IO.File]::WriteAllText((Join-Path $install 'state/active-generation/00000000000000000001.json'),('{"schemaVersion":1,"generation":1,"activeRuntime":"'+$runtimeId+'","previousGeneration":0}'))
+        $epochModule=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/LifecycleEpoch.psm1') -Force -PassThru -DisableNameChecking
+        &$epochModule {param($Root)Write-CcodLifecycleEpoch -InstallRoot $Root -Epoch ([uint64]11)} $install
+        . (Join-Path $repositoryRoot 'src/persistence/Supervisor.ps1') -ReadyToken ('a'*64)
+        $io=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/PersistenceIO.psm1') -PassThru -DisableNameChecking
+        $hostState=[pscustomobject]@{RuntimeCleanupCodes=[Collections.Generic.List[string]]::new()}
+        $log=Join-Path $install 'logs/supervisor.log'
+        $adapters=@{GetUtcNow={[DateTime]::UtcNow};WriteLog={param($Record)&$io {param($Path,$Value)Write-CcodRotatingLog -Path $Path -Message ($Value|ConvertTo-Json -Depth 8 -Compress)} $log $Record}.GetNewClosure()}
+        Write-CcodSupervisorUiFailure -HostState $hostState -Adapters $adapters -Stage LanguageChange -Code 'CCOD_LANGUAGE_CHANGE_FAILED'
+        $action=[pscustomobject]@{Command='ShowAbout';Revision=[uint64]1}
+        Assert-CcodTrue (Write-CcodSupervisorTrayActionTerminal -HostState $hostState -Adapters $adapters -Action $action -Status Completed -ErrorCode $null) 'actual Supervisor log producer succeeded'
+        Assert-CcodEqual 0 $hostState.RuntimeCleanupCodes.Count 'log writing itself succeeded'
+        $result=&$module {param($Root,$Id)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId $Id -ExpectedEpoch ([uint64]11)} $install $runtimeId
+        Assert-CcodEqual 'Removed' $result.result 'product diagnostics and epoch initializer are recognized'
+    } finally {if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+}
+
+$results+=Invoke-CcodTest 'protected user data is rejected before opening or hashing its contents' {
+    $root=Join-Path $env:TEMP ('ccod-product-protected-'+[guid]::NewGuid().ToString('N'))
+    $install=Join-Path $root 'CodexControlOtherDevices';$held=$null
+    try {
+        [IO.Directory]::CreateDirectory((Join-Path $install 'state/device-key'))|Out-Null
+        $file=Join-Path $install 'state/device-key/sentinel.bin';[IO.File]::WriteAllText($file,'synthetic protected sentinel')
+        $held=[IO.File]::Open($file,[IO.FileMode]::Open,[IO.FileAccess]::ReadWrite,[IO.FileShare]::None)
+        $failure=$null
+        try {&$module {param($Root)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId ('2.5.22-'+('a'*16)+'-'+('b'*32)) -ExpectedEpoch ([uint64]11)} $install|Out-Null}catch{$failure=$_}
+        Assert-CcodTrue ($null-ne$failure-and$failure.Exception.Message.Contains('protected user data')) 'policy rejects the directory name before the exclusive file can cause a read error'
+    } finally {if($null-ne$held){$held.Dispose()};if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+}
+
+$results+=Invoke-CcodTest 'bounded cleanup accepts actual terminal lifecycle receipts and transaction archive output' {
+    $root=Join-Path $env:TEMP ('ccod-product-terminal-'+[guid]::NewGuid().ToString('N'))
+    $install=Join-Path $root 'CodexControlOtherDevices';$state=Join-Path $install 'state'
+    try {
+        [IO.Directory]::CreateDirectory((Join-Path $state 'active-generation'))|Out-Null
+        $runtimeId='2.5.22-'+('a'*16)+'-'+('b'*32);$id='11111111-2222-3333-4444-555555555555'
+        [IO.File]::WriteAllText((Join-Path $state 'lifecycle-epoch.json'),'{"schemaVersion":1,"epoch":11}')
+        [IO.File]::WriteAllText((Join-Path $state 'active-generation/00000000000000000001.json'),('{"schemaVersion":1,"generation":1,"activeRuntime":"'+$runtimeId+'","previousGeneration":0}'))
+        $lifecycle=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/LifecycleTransaction.psm1') -Force -PassThru -DisableNameChecking
+        $logon=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/TrustedLogonIdentity.psm1') -Force -PassThru -DisableNameChecking
+        $inbox=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/LifecycleRequest.psm1') -Force -PassThru -DisableNameChecking
+        $journal=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/TransitionJournal.psm1') -Force -PassThru -DisableNameChecking
+        $io=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/PersistenceIO.psm1') -PassThru -DisableNameChecking
+        $identity=&$logon {Get-CcodTrustedLogonIdentity}
+        $now=[DateTime]::UtcNow.ToString('o',[Globalization.CultureInfo]::InvariantCulture)
+        $request=&$lifecycle {param($Root,$Id,$Runtime,$Identity,$Now)
+            $owner=[pscustomobject]@{pid=[int]$PID;creationTimeUtc=[Diagnostics.Process]::GetCurrentProcess().StartTime.ToUniversalTime().ToString('o')}
+            $value=New-CcodLifecycleRequest -Kind SafeExit -Origin Tray -RuntimeId $Runtime -RuntimeGeneration 1 -LeaseEpoch 11 -OwnerIdentity $owner -LogonIdentity $Identity -NowUtc $Now -TransactionId $Id
+            $value.phase='CancelledBeforeClose'
+            Write-CcodLifecycleRequest -StateRoot $Root -Request $value
+            Complete-CcodLifecycleRequest -StateRoot $Root -Request $value
+            $value
+        } $state $id $runtimeId $identity $now
+        &$logon {param($Root,$Identity,$Runtime,$Id,$Now)Write-CcodSafeExitIntent -StateRoot $Root -LogonIdentity $Identity -RuntimeId $Runtime -RecoveryTransactionId $Id -NowUtc $Now} $state $identity $runtimeId $id $now|Out-Null
+        &$inbox {param($Root,$Id)Write-CcodLifecycleSubmissionReceipt -StateRoot $Root -SubmissionId $Id -Accepted $true -TransactionId $Id -ErrorCode $null} $state $id|Out-Null
+        $transition=[pscustomobject]@{transactionId=$id;stage='Closed';sourcePid=$null;sourceCreationTimeUtc=$null;specialPid=$null;specialCreationTimeUtc=$null;recoveryPid=$null;recoveryCreationTimeUtc=$null;appAsarSha256=('a'*64);runtimeId=$runtimeId}
+        $archive=&$journal {param($Transition,$Now)New-CcodArchiveRecord -Transition $Transition -Disposition Closed -CompletedAtUtc $Now} $transition $now
+        $completion=&$journal {param($Id,$Now)New-CcodCompletionReceipt -TransactionId $Id -Disposition Closed -TerminalStage Closed -CompletedAtUtc $Now -State Archived -ArchiveErrorId $null} $id $now
+        &$io {param($Root,$Archive,$Completion)Write-CcodRotatingLog -Path (Join-Path $Root 'logs/transactions.log') -Message ($Archive|ConvertTo-Json -Depth 8 -Compress);Write-CcodAtomicJson -Path (Join-Path $Root 'state/transaction-completion.receipt.json') -Value $Completion -Compress} $install $archive $completion
+        $result=&$module {param($Root,$Runtime)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId $Runtime -ExpectedEpoch ([uint64]11)} $install $runtimeId
+        Assert-CcodEqual 'Removed' $result.result 'actual completed lifecycle evidence is disposable product state'
+    } finally {if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+}
+
+$results+=Invoke-CcodTest 'bounded cleanup accepts real session and legacy install diagnostic writers' {
+    $root=Join-Path $env:TEMP ('ccod-product-session-log-'+[guid]::NewGuid().ToString('N'))
+    $install=Join-Path $root 'CodexControlOtherDevices'
+    try {
+        [IO.Directory]::CreateDirectory((Join-Path $install 'state/active-generation'))|Out-Null
+        $runtimeId='2.5.22-'+('a'*16)+'-'+('b'*32);$id='11111111-2222-3333-4444-555555555555'
+        [IO.File]::WriteAllText((Join-Path $install 'state/lifecycle-epoch.json'),'{"schemaVersion":1,"epoch":11}')
+        [IO.File]::WriteAllText((Join-Path $install 'state/active-generation/00000000000000000001.json'),('{"schemaVersion":1,"generation":1,"activeRuntime":"'+$runtimeId+'","previousGeneration":0}'))
+        . (Join-Path $repositoryRoot 'src/persistence/SessionController.ps1') -Action Inspect
+        $engine=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/SessionEngine.psm1') -PassThru -DisableNameChecking
+        $io=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/PersistenceIO.psm1') -PassThru -DisableNameChecking
+        $paths=[pscustomobject]@{SessionLogPath=(Join-Path $install 'logs/session.log')}
+        $adapter=@{UtcNow={[DateTime]::UtcNow};WriteLog={param($Path,$Message)&$io {param($P,$M)Write-CcodRotatingLog -Path $P -Message $M} $Path $Message}.GetNewClosure()}
+        $result=[pscustomobject]@{action='Inspect';transactionId=$id;stage='Inspect';error=[pscustomobject]@{code='CCOD_SESSION_FAILED'};logFile=$null}
+        Assert-CcodTrue (Write-CcodControllerDiagnostic -Result $result -Request $null -Paths $paths -Adapter $adapter) 'actual controller diagnostic is written'
+        &$engine {param($Result,$Id,$Paths,$Adapter)Write-CcodSessionDiagnostic -Result $Result -Action Inspect -TransactionId $Id -Stage Inspect -Code CCOD_SESSION_FAILED -Record $null -Paths $Paths -Adapter $Adapter} $result $id $paths $adapter
+        $lifecycle=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/InstallLifecycle.psm1') -Force -PassThru -DisableNameChecking
+        &$lifecycle {param($Root)$adapter=Get-CcodLifecycleAdapters;Write-CcodLifecycleLog -InstallRoot $Root -Adapters $adapter -Stage Install -Code CCOD_INSTALL_COMPLETED -Outcome Installed -ThrowOnFailure} $install
+        $result=&$module {param($Root,$Id)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId $Id -ExpectedEpoch ([uint64]11)} $install $runtimeId
+        Assert-CcodEqual 'Removed' $result.result 'actual session and legacy install diagnostics are recognized'
+    } finally {if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+}
+
+$results+=Invoke-CcodTest 'bounded cleanup accepts the exact abandoned-lease warning produced by Supervisor' {
+    $root=Join-Path $env:TEMP ('ccod-product-warning-'+[guid]::NewGuid().ToString('N'))
+    $install=Join-Path $root 'CodexControlOtherDevices'
+    try {
+        [IO.Directory]::CreateDirectory((Join-Path $install 'state/active-generation'))|Out-Null
+        $runtimeId='2.5.22-'+('a'*16)+'-'+('b'*32)
+        [IO.File]::WriteAllText((Join-Path $install 'state/lifecycle-epoch.json'),'{"schemaVersion":1,"epoch":11}')
+        [IO.File]::WriteAllText((Join-Path $install 'state/active-generation/00000000000000000001.json'),('{"schemaVersion":1,"generation":1,"activeRuntime":"'+$runtimeId+'","previousGeneration":0}'))
+        $supervisorPath=Join-Path $repositoryRoot 'src/persistence/Supervisor.ps1'
+        . $supervisorPath -ReadyToken ('a'*64)
+        $tokens=$null;$errors=$null;$ast=[Management.Automation.Language.Parser]::ParseFile($supervisorPath,[ref]$tokens,[ref]$errors)
+        Assert-CcodEqual 0 @($errors).Count 'real supervisor source parses'
+        $writer=@($ast.FindAll({param($n)$n-is[Management.Automation.Language.AssignmentStatementAst]-and$n.Left.Extent.Text-ceq'$record'-and$n.Right.Extent.Text.Contains("code='CCOD_SUPERVISOR_LEASE_ABANDONED'")},$true))
+        Assert-CcodEqual 1 $writer.Count 'one exact production warning producer'
+        $adapter=@{GetUtcNow={[DateTime]::UtcNow}}
+        $record=&([scriptblock]::Create($writer[0].Right.Extent.Text))
+        Assert-CcodEqual 'Warning' $record.outcome 'production outcome is Warning'
+        $io=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/PersistenceIO.psm1') -PassThru -DisableNameChecking
+        foreach($changedField in @('stage','code')){
+            $bad=$record|ConvertTo-Json -Compress|ConvertFrom-Json
+            if($changedField-ceq'stage'){$bad.stage='OtherStage'}else{$bad.code='CCOD_OTHER_WARNING'}
+            &$io {param($Root,$Value)Write-CcodRotatingLog -Path (Join-Path $Root 'logs/supervisor.log') -Message ($Value|ConvertTo-Json -Compress)} $install $bad
+            Assert-CcodThrows {&$module {param($Root,$Runtime)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId $Runtime -ExpectedEpoch ([uint64]11)} $install $runtimeId|Out-Null} 'CCOD_PRODUCT_RESIDUE_INVALID'
+            Assert-CcodTrue (Test-Path (Join-Path $install 'state/lifecycle-epoch.json')) 'unsupported Warning remains rejected before deletion'
+            [IO.File]::Delete((Join-Path $install 'logs/supervisor.log'))
+        }
+        &$io {param($Root,$Value)Write-CcodRotatingLog -Path (Join-Path $Root 'logs/supervisor.log') -Message ($Value|ConvertTo-Json -Compress)} $install $record
+        $result=&$module {param($Root,$Runtime)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId $Runtime -ExpectedEpoch ([uint64]11)} $install $runtimeId
+        Assert-CcodEqual 'Removed' $result.result 'real abandoned-lease diagnostic does not block uninstall'
+    } finally {if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+}
+
+$results|ForEach-Object {"PASS $($_.Name)"}
+Write-Output "Product residue cleanup self-tests passed: $($results.Count)"
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index e767b30..7710937 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -1,3 +1,6 @@
+[CmdletBinding()]
+param([string]$FocusedCase)
+
 $ErrorActionPreference = 'Stop'
 . (Join-Path $PSScriptRoot 'TestSupport.ps1')
 
@@ -6,10 +9,38 @@ $defenderPath = Join-Path $repositoryRoot 'tools\Test-ReleaseDefender.ps1'
 $releaseDefenderModulePath = Join-Path $repositoryRoot 'tools\ReleaseDefender.psm1'
 $assetContractPath = Join-Path $repositoryRoot 'tools\ReleaseAssetContract.psm1'
 
-$script:CcodReleaseBaseInvokeTest=${function:Invoke-CcodTest}
-function Invoke-CcodTest([string]$Name,[scriptblock]$Action){if(-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK5_RED_CASE)-or-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK6_RED_CASE)){return};&$script:CcodReleaseBaseInvokeTest $Name $Action}
-function Invoke-CcodTask5Test([string]$Id,[string]$Name,[scriptblock]$Action){if(-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK6_RED_CASE)){return};if(-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK5_RED_CASE)-and$env:CCOD_TASK5_RED_CASE-cne$Id){return};&$script:CcodReleaseBaseInvokeTest $Name $Action}
-function Invoke-CcodTask6Test([string]$Id,[string]$Name,[scriptblock]$Action){if(-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK5_RED_CASE)){return};if(-not[string]::IsNullOrWhiteSpace($env:CCOD_TASK6_RED_CASE)-and$env:CCOD_TASK6_RED_CASE-cne$Id){return};&$script:CcodReleaseBaseInvokeTest $Name $Action}
+foreach ($selector in @('CCOD_TASK5_RED_CASE','CCOD_TASK6_RED_CASE')) {
+    if (-not [string]::IsNullOrEmpty([Environment]::GetEnvironmentVariable($selector, 'Process'))) {
+        throw 'CCOD_RELEASE_TEST_SELECTION_INVALID: inherited selectors are forbidden; use -FocusedCase explicitly.'
+    }
+}
+$script:CcodReleaseFocus = $FocusedCase
+$script:CcodReleaseExecuted = 0
+$script:CcodReleaseSkipped = 0
+if ($PSBoundParameters.ContainsKey('FocusedCase')) {
+    $tokens = $null; $parseErrors = $null
+    $ast = [Management.Automation.Language.Parser]::ParseFile($PSCommandPath, [ref]$tokens, [ref]$parseErrors)
+    if (@($parseErrors).Count -ne 0) { throw 'CCOD_RELEASE_TEST_SELECTION_INVALID: test source does not parse.' }
+    $known = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    foreach ($command in @($ast.FindAll({ param($node) $node -is [Management.Automation.Language.CommandAst] -and $node.GetCommandName() -cin @('Invoke-CcodTask5Test','Invoke-CcodTask6Test') }, $true))) {
+        if ($command.CommandElements[1] -is [Management.Automation.Language.StringConstantExpressionAst]) {
+            $group = if ($command.GetCommandName() -ceq 'Invoke-CcodTask5Test') { 'Task5' } else { 'Task6' }
+            [void]$known.Add($group + ':' + $command.CommandElements[1].Value)
+        }
+    }
+    if ([string]::IsNullOrWhiteSpace($FocusedCase) -or -not $known.Contains($FocusedCase)) {
+        throw 'CCOD_RELEASE_TEST_SELECTION_INVALID: unknown explicit case.'
+    }
+}
+$script:CcodReleaseBaseInvokeTest = ${function:Invoke-CcodTest}
+function Invoke-CcodReleaseSelectedTest([string]$Id,[string]$Name,[scriptblock]$Action) {
+    if ($script:CcodReleaseFocus -and $script:CcodReleaseFocus -cne $Id) { $script:CcodReleaseSkipped++; return }
+    $script:CcodReleaseExecuted++
+    & $script:CcodReleaseBaseInvokeTest $Name $Action
+}
+function Invoke-CcodTest([string]$Name,[scriptblock]$Action) { Invoke-CcodReleaseSelectedTest '' $Name $Action }
+function Invoke-CcodTask5Test([string]$Id,[string]$Name,[scriptblock]$Action) { Invoke-CcodReleaseSelectedTest ('Task5:' + $Id) $Name $Action }
+function Invoke-CcodTask6Test([string]$Id,[string]$Name,[scriptblock]$Action) { Invoke-CcodReleaseSelectedTest ('Task6:' + $Id) $Name $Action }
 
 function ConvertFrom-CcodWorkflowScalar {
     param([Parameter(Mandatory)][AllowEmptyString()][string]$Value)
@@ -229,6 +260,7 @@ function Get-CcodTask5ExpectedAssetNames([string]$Version='2.5.22'){
 }
 
 function New-CcodTask5ExactAssetFixture {
+    param([switch]$SetupHashAsArray)
     $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task5-assets-'+[guid]::NewGuid().ToString('N'));$outside=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task5-assets-outside-'+[guid]::NewGuid().ToString('N'));$work=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task5-assets-work-'+[guid]::NewGuid().ToString('N'));foreach($directory in @($root,$outside,$work)){[IO.Directory]::CreateDirectory($directory)|Out-Null}
     $version='2.5.22';$commit='c'*40;$timestamp='2030-02-03T04:05:06.0000000Z';$names=Get-CcodTask5ExpectedAssetNames $version
     try{
@@ -238,7 +270,9 @@ function New-CcodTask5ExactAssetFixture {
         [IO.File]::WriteAllText((Join-Path $stage 'payload-manifest.json'),($payloadManifest|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false));Add-Type -AssemblyName System.IO.Compression.FileSystem -ErrorAction Stop;[IO.Compression.ZipFile]::CreateFromDirectory($stage,(Join-Path $root $names[0]),[IO.Compression.CompressionLevel]::Optimal,$false);[IO.File]::WriteAllText((Join-Path $root $names[1]),((Get-CcodTestFileSha256 (Join-Path $root $names[0]))+' *'+$names[0]),[Text.UTF8Encoding]::new($false));[IO.File]::WriteAllText((Join-Path $root $names[3]),($payloadManifest|ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
         $tray=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;targetFramework='net48';compiler=[ordered]@{name='csc.exe';sha256=('1'*64)};referenceRoot='locked-net48';sourceFiles=@([ordered]@{name='AssemblyInfo.cs';sha256=('2'*64)},[ordered]@{name='WindowsTrayHostRuntime.cs';sha256=('3'*64)});iconSha256=('4'*64);manifestSha256=('5'*64);configSha256=('6'*64);artifactSha256=('7'*64);configArtifactSha256=('8'*64)};Write-CcodTask5Json -Path (Join-Path $root $names[2]) -Value $tray
         $portableAssets=@([ordered]@{name=$names[0];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[0])},[ordered]@{name=$names[1];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[1])},[ordered]@{name=$names[2];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[2])},[ordered]@{name=$names[3];sha256=Get-CcodTestFileSha256 (Join-Path $root $names[3])},[ordered]@{name='CodexRemote-fix.exe';sha256=Get-CcodTestFileSha256 $launcher},[ordered]@{name='CodexRemote-fix.exe.config';sha256=Get-CcodTestFileSha256 $launcherConfig});Write-CcodTask5Json -Path (Join-Path $root $names[4]) -Value ([ordered]@{schemaVersion=2;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;distribution='portable-zip';assets=$portableAssets})
-        $packageManifest=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;payloadManifest=[ordered]@{name='installer-payload.manifest.json';length=[int64]123;sha256=('9'*64)};files=@([ordered]@{path='Install-CodexControlOtherDevices.ps1';length=[int64]321;sha256=('a'*64)},[ordered]@{path='package.json';length=[int64]42;sha256=('b'*64)})};Write-CcodTask5Json -Path (Join-Path $root $names[8]) -Value $packageManifest
+        $packageManifest=[ordered]@{schemaVersion=1;product='CodexRemote-fix';version=$version;gitCommit=$commit;payloadManifest=[ordered]@{name='installer-payload.manifest.json';length=[int64]123;sha256=('9'*64)};files=@([ordered]@{path='Install-CodexControlOtherDevices.ps1';length=[int64]321;sha256=('a'*64)},[ordered]@{path='package.json';length=[int64]42;sha256=('b'*64)})}
+        if ($SetupHashAsArray) { $packageManifest.files[0].sha256 = @($packageManifest.files[0].sha256) }
+        Write-CcodTask5Json -Path (Join-Path $root $names[8]) -Value $packageManifest
         $inventory="procedure AddCcodExpectedSetupDirectories(Directories: TStrings);`r`nbegin`r`n  Directories.Add('runtime');`r`nend;`r`n";[IO.File]::WriteAllText((Join-Path $root $names[9]),$inventory,[Text.UTF8Encoding]::new($false));$packageManifestHash=Get-CcodTestFileSha256 (Join-Path $root $names[8]);$packageHash='d'*64;$bootstrapHash='e'*64
         $provenance=[ordered]@{schemaVersion=2;product='CodexRemote-fix';version=$version;gitCommit=$commit;buildTimestampUtc=$timestamp;installerPackage=[ordered]@{name='installer-package.zip';length=[int64]456;sha256=$packageHash};installerPackageManifest=[ordered]@{name='installer-package.manifest.json';length=[int64](Get-Item (Join-Path $root $names[8])).Length;sha256=$packageManifestHash;fileCount=[int]2;payloadManifestSha256=('9'*64)};activationBootstrap=[ordered]@{name='Activate-CcodRemoteFix.ps1';length=[int64]789;sha256=$bootstrapHash};buildInputs=[ordered]@{innoTemplateSha256=('f'*64);destinationInventorySha256=Get-CcodTestFileSha256 (Join-Path $root $names[9]);compilerSha256=('1'*64);compilerFileVersion='6.7.3'};peContract=[ordered]@{fileVersion="$version.0";packageManifestFirst=$packageManifestHash.Substring(0,32);packageManifestLast=$packageManifestHash.Substring(32,32);bootstrapFirst=$bootstrapHash.Substring(0,32);bootstrapLast=$bootstrapHash.Substring(32,32);companyName=$commit;legalCopyright=$packageHash}};Write-CcodTask5Json -Path (Join-Path $root $names[7]) -Value $provenance
         $iscc=@((Join-Path $env:LOCALAPPDATA 'Programs\Inno Setup 6\ISCC.exe'),(Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'),(Join-Path $env:ProgramFiles 'Inno Setup 6\ISCC.exe'))|Where-Object{$_-and[IO.File]::Exists($_)}|Select-Object -First 1;if(-not$iscc){throw 'Inno Setup 6 required for Task5 exact fixture'};$iss=Join-Path $work 'fixture.iss';$out=Join-Path $work 'setup-output';[IO.Directory]::CreateDirectory($out)|Out-Null
@@ -293,7 +327,8 @@ function New-CcodTask5WorkflowIdentity([string]$Commit=('a'*40)){
 function New-CcodTask5DefenderReceipt {
     param([ValidateSet('Setup','PortableZip')][string]$AssetType='Setup',[string]$Version='2.5.22',[string]$Commit=('c'*40),[ValidateSet('InternetDownload','TrustedWorkflowArtifact')][string]$Origin='InternetDownload')
     $names=Get-CcodTask5ExpectedAssetNames $Version;$setup=$AssetType-ceq'Setup'
-    [pscustomobject][ordered]@{schemaVersion=2;assetType=$AssetType;assetName=$(if($setup){$names[5]}else{$names[0]});assetSha256=$(if($setup){'5'*64}else{'0'*64});checksumName=$(if($setup){$names[6]}else{$names[1]});checksumSha256=$(if($setup){'6'*64}else{'1'*64});manifestName=$(if($setup){$names[10]}else{$names[4]});manifestSha256=$(if($setup){'a'*64}else{'4'*64});version=$Version;gitCommit=$Commit;origin=$Origin;workflowArtifactIdentity=$(if($Origin-ceq'TrustedWorkflowArtifact'){New-CcodTask5WorkflowIdentity $Commit}else{$null});zoneId=$(if($Origin-ceq'InternetDownload'){3}else{$null});defenderServiceEnabled=$true;antivirusEnabled=$true;realTimeProtectionEnabled=$true;defenderPlatformVersion='4.18.26070.1';defenderEngineVersion='1.1.26070.1';signatureVersion='1.999.1.0';signatureUpdatedAtUtc='2030-02-03T02:05:06.0000000Z';scanStartedAtUtc='2030-02-03T04:05:06.0000000Z';scanCompletedAtUtc='2030-02-03T04:05:07.0000000Z';detectionCount=0;outcome='Completed';errorCode=$null}
+    $scanStarted=[datetime]::UtcNow.AddMinutes(-1);$scanCompleted=$scanStarted.AddSeconds(1);$signature=$scanStarted.AddHours(-1)
+    [pscustomobject][ordered]@{schemaVersion=2;assetType=$AssetType;assetName=$(if($setup){$names[5]}else{$names[0]});assetSha256=$(if($setup){'5'*64}else{'0'*64});checksumName=$(if($setup){$names[6]}else{$names[1]});checksumSha256=$(if($setup){'6'*64}else{'1'*64});manifestName=$(if($setup){$names[10]}else{$names[4]});manifestSha256=$(if($setup){'a'*64}else{'4'*64});version=$Version;gitCommit=$Commit;origin=$Origin;workflowArtifactIdentity=$(if($Origin-ceq'TrustedWorkflowArtifact'){New-CcodTask5WorkflowIdentity $Commit}else{$null});zoneId=$(if($Origin-ceq'InternetDownload'){3}else{$null});defenderServiceEnabled=$true;antivirusEnabled=$true;realTimeProtectionEnabled=$true;defenderPlatformVersion='4.18.26070.1';defenderEngineVersion='1.1.26070.1';signatureVersion='1.999.1.0';signatureUpdatedAtUtc=$signature.ToString('o');scanStartedAtUtc=$scanStarted.ToString('o');scanCompletedAtUtc=$scanCompleted.ToString('o');detectionCount=0;outcome='Completed';errorCode=$null}
 }
 
 function Get-CcodTask5PromotionReceiptNames([string]$Version='2.5.22'){
@@ -319,6 +354,207 @@ function New-CcodTask5PromotionFixture {
     [pscustomobject]@{Root=$root;Names=$names;Setup=$setup;Portable=$portable;Commit=('c'*40);Version='2.5.22'}
 }
 
+function New-CcodTask9ManualEvidenceFixture {
+    param([Parameter(Mandatory)][string]$ManifestHash,[string]$Version='2.5.22',[string]$Commit=('c'*40),[string]$ArtifactRoot)
+    $operations = @('About','Language','OpenLogs','Repair','SecondDeviceControl')
+    $states = @('AboutVisible','LanguageChanged','LogsOpened','RepairCompleted','SecondDeviceControlled')
+    $results = @('CCOD_TRAYABOUT_COMPLETED','CCOD_TRAYLANGUAGE_COMPLETED','CCOD_TRAYOPENLOGS_COMPLETED','CCOD_TRAYREPAIR_COMPLETED','CCOD_SECONDDEVICE_COMPLETED')
+    $hashes = @(('1' * 64),('2' * 64),('3' * 64),('4' * 64),('5' * 64),('6' * 64),('7' * 64),('8' * 64),('9' * 64),('a' * 64))
+    $records = [Collections.Generic.List[object]]::new()
+    for ($index = 0; $index -lt $operations.Count; $index++) {
+        $proof = $null
+        if ($index -lt 4) {
+            $commands = @('ShowAbout','SetLanguageEnglish','OpenLogs','CheckAndRepair')
+            $proof = [pscustomobject][ordered]@{ timestampUtc = '2030-02-03T04:05:07.0000000Z'; command = $commands[$index]; revision = [UInt64]1; code = 'CCOD_TRAY_ACTION_COMPLETED'; status = 'Completed' }
+        } else {
+            $proof = [pscustomobject][ordered]@{ schemaVersion = 1; timestampUtc = '2030-02-03T04:05:07.0000000Z'; kind = 'remote-control-manual-proof'; operation = 'SecondDeviceControl'; deviceRole = 'SecondDevice'; challenge = 'ffffffffffffffffffffffffffffffff'; candidateVersion = $Version; runtimeId = 'runtime-2.5.22'; runtimeGeneration = [UInt64]2; runtimeManifestSha256 = ('d' * 64); attestation = 'HumanReviewedStructuredAttestation'; connection = 'Connected'; control = 'Completed'; outcome = 'Completed'; code = 'CCOD_REMOTE_ACTION_COMPLETED' }
+        }
+        $record = [pscustomobject][ordered]@{
+            schemaVersion = 1
+            kind = 'manual-evidence'
+            phase = if ($index -lt 4) { 'TrayEvidence' } else { 'RemoteEvidence' }
+            operation = $operations[$index]
+            terminalState = $states[$index]
+            result = $results[$index]
+            proof = $proof
+            reviewState = 'Reviewed'
+            version = $Version
+            gitCommit = $Commit
+            candidateManifestSha256 = $ManifestHash
+            screenshotSha256 = $hashes[$index * 2]
+            redactedLogSha256 = $hashes[$index * 2 + 1]
+        }
+        if (-not [string]::IsNullOrWhiteSpace($ArtifactRoot)) {
+            $operationDirectory = Join-Path ([IO.Path]::GetFullPath($ArtifactRoot)) $operations[$index]
+            [IO.Directory]::CreateDirectory($operationDirectory) | Out-Null
+            $screenshotPath = Join-Path $operationDirectory 'screenshot.bin'
+            $redactedLogPath = Join-Path $operationDirectory 'redacted.log'
+            [IO.File]::WriteAllText($screenshotPath, "fixture screenshot $Version $Commit $($operations[$index])", [Text.UTF8Encoding]::new($false))
+            [IO.File]::WriteAllText($redactedLogPath, "fixture redacted log $Version $Commit $($operations[$index])", [Text.UTF8Encoding]::new($false))
+            $record.screenshotSha256 = Get-CcodTestFileSha256 $screenshotPath
+            $record.redactedLogSha256 = Get-CcodTestFileSha256 $redactedLogPath
+        }
+        $records.Add($record)
+    }
+    return @($records)
+}
+
+function New-CcodTask9AcceptanceRecord {
+    param([Parameter(Mandatory)]$AssetFixture,[string]$EvidenceRoot)
+    $manifestHash = Get-CcodTestFileSha256 (Join-Path $AssetFixture.Root $AssetFixture.Names[4])
+    $automated = @()
+    $manual = @()
+    if (-not [string]::IsNullOrWhiteSpace($EvidenceRoot)) {
+        $state = New-CcodTask9AutomatedAcceptanceState -AssetFixture $AssetFixture -EvidenceRoot $EvidenceRoot
+        $automated = @($state.AutomatedReceiptSha256)
+        $manual = @($state.ManualEvidence)
+    } else {
+        $manual = @(New-CcodTask9ManualEvidenceFixture -ManifestHash $manifestHash -Commit ([string]$AssetFixture.GitCommit))
+    }
+    [ordered]@{
+        schemaVersion = 1
+        kind = 'official-draft-acceptance'
+        version = '2.5.22'
+        gitCommit = [string]$AssetFixture.GitCommit
+        draft = [pscustomobject][ordered]@{ tag = 'v2.5.22'; id = '123' }
+        candidateManifestSha256 = $manifestHash
+        phase = 'Complete'
+        completedAtUtc = '2030-02-03T04:05:07.0000000Z'
+        automatedReceiptSha256 = @($automated)
+        manualEvidence = $manual
+    }
+}
+
+function Get-CcodTask9EvidenceRoot {
+    for ($scope = 0; $scope -le 3; $scope++) {
+        try { $promotionVariable = Get-Variable -Name promotion -Scope $scope -ValueOnly -ErrorAction Stop } catch { continue }
+        if ($null -ne $promotionVariable -and $null -ne $promotionVariable.Root) { return [string]$promotionVariable.Root }
+    }
+    for ($scope = 0; $scope -le 3; $scope++) {
+        try { $evidenceVariable = Get-Variable -Name evidence -Scope $scope -ValueOnly -ErrorAction Stop } catch { continue }
+        if ($null -ne $evidenceVariable) { return [string]$evidenceVariable }
+    }
+    throw 'Task 9 fixture evidence root is unavailable.'
+}
+
+function New-CcodTask9AutomatedAcceptanceState {
+    param([Parameter(Mandatory)]$AssetFixture,[Parameter(Mandatory)][string]$EvidenceRoot)
+    $stateRoot = Join-Path ([IO.Path]::GetFullPath($EvidenceRoot)) 'official-draft-acceptance'
+    $manualRoot = Join-Path $stateRoot 'manual-evidence'
+    [IO.Directory]::CreateDirectory($manualRoot) | Out-Null
+    $names = [string[]]$AssetFixture.Names
+    $assetHashes = @($names | ForEach-Object { [pscustomobject][ordered]@{ name = [string]$_; sha256 = Get-CcodTestFileSha256 (Join-Path $AssetFixture.Root $_) } })
+    $candidate = [pscustomobject][ordered]@{
+        version = '2.5.22'
+        gitCommit = [string]$AssetFixture.GitCommit
+        assetHashes = @($assetHashes)
+        manifestHashes = [pscustomobject][ordered]@{ portable = [string]$assetHashes[4].sha256; setup = [string]$assetHashes[10].sha256 }
+    }
+    $draft = [pscustomobject][ordered]@{ tag = 'v2.5.22'; id = '123' }
+    $defenderScanStarted=[datetime]::UtcNow.AddMinutes(-1);$defenderScanCompleted=$defenderScanStarted.AddSeconds(1);$defenderSignature=$defenderScanStarted.AddHours(-1)
+    $newDefender = {
+        param([string]$AssetType)
+        $assetIndex = if ($AssetType -ceq 'Setup') { 5 } else { 0 }
+        $checksumIndex = if ($AssetType -ceq 'Setup') { 6 } else { 1 }
+        $manifestIndex = if ($AssetType -ceq 'Setup') { 10 } else { 4 }
+        [pscustomobject][ordered]@{
+            schemaVersion = 2; assetType = $AssetType; assetName = $names[$assetIndex]; assetSha256 = $assetHashes[$assetIndex].sha256
+            checksumName = $names[$checksumIndex]; checksumSha256 = $assetHashes[$checksumIndex].sha256
+            manifestName = $names[$manifestIndex]; manifestSha256 = $assetHashes[$manifestIndex].sha256
+            version = '2.5.22'; gitCommit = [string]$AssetFixture.GitCommit; origin = 'InternetDownload'; workflowArtifactIdentity = $null; zoneId = 3
+            defenderServiceEnabled = $true; antivirusEnabled = $true; realTimeProtectionEnabled = $true
+            defenderPlatformVersion = '4.18.26070.1'; defenderEngineVersion = '1.1.26070.1'; signatureVersion = '1.999.1.0'
+            signatureUpdatedAtUtc = $defenderSignature.ToString('o'); scanStartedAtUtc = $defenderScanStarted.ToString('o'); scanCompletedAtUtc = $defenderScanCompleted.ToString('o')
+            detectionCount = 0; outcome = 'Completed'; errorCode = $null
+        }
+    }.GetNewClosure()
+    $keyHash = ('b' * 64); $runtimeId = 'runtime-2.5.22'; [UInt64]$generation = 2
+    $terminal = [pscustomobject][ordered]@{ kind = 'RestartAndRepair'; origin = 'Installer'; runtimeId = $runtimeId; runtimeGeneration = $generation; phase = 'Completed' }
+    $makeLegacyObservation = {
+        param([string]$Version,[string]$ObservedRuntimeId,[UInt64]$ObservedGeneration,[string]$ObservedManifestHash,[string]$ObservedBootId)
+        $observedTerminal = [pscustomobject][ordered]@{ kind = 'RestartAndRepair'; origin = 'Installer'; runtimeId = $ObservedRuntimeId; runtimeGeneration = $ObservedGeneration; phase = 'Completed' }
+        return [pscustomobject][ordered]@{
+            version = $Version
+            bootId = $ObservedBootId
+            installRootPresent = $true
+            installReady = $true
+            appRootPresent = $true
+            runtimeRootPresent = $true
+            activePointerPresent = $true
+            activeRuntimeId = $ObservedRuntimeId
+            activeGeneration = $ObservedGeneration
+            runtimeManifestSha256 = $ObservedManifestHash
+            supervisor = @([pscustomobject][ordered]@{ pid = 200; creationTimeUtc = '2030-02-03T04:05:00.0000000Z' })
+            trayHost = @([pscustomobject][ordered]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' })
+            codex = @([pscustomobject][ordered]@{ pid = 202; creationTimeUtc = '2030-02-03T04:05:02.0000000Z' })
+            trayHostIdentity = [pscustomobject][ordered]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' }
+            trayAuthenticated = $true
+            taskState = 'Ready'
+            statusPhase = 'Active'
+            statusRuntimeId = $ObservedRuntimeId
+            statusCodex = [pscustomobject][ordered]@{ pid = 202; creationTimeUtc = '2030-02-03T04:05:02.0000000Z' }
+            transitionStage = 'Idle'
+            lifecycleReceipt = $observedTerminal
+            aboutVersion = $Version
+            deviceKeyPresent = $true
+            deviceKeySha256 = $keyHash
+            shortcuts = [pscustomobject][ordered]@{ startMenu = $true; desktop = $true }
+            debugPorts = [int[]]@(9229,9230)
+            debugEndpoints = @(
+                [pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = 9229; owningProcess = 202; owningProcessCreationTimeUtc = '2030-02-03T04:05:02.0000000Z' }
+                [pscustomobject][ordered]@{ localAddress = '127.0.0.1'; localPort = 9230; owningProcess = 202; owningProcessCreationTimeUtc = '2030-02-03T04:05:02.0000000Z' }
+            )
+            protectionReady = $true
+        }
+    }.GetNewClosure()
+    $legacyBeforeObservation = & $makeLegacyObservation '2.5.21' 'runtime-2.5.21' ([UInt64]1) ('2' * 64) 'boot-legacy-before'
+    $legacyAfterObservation = & $makeLegacyObservation '2.5.22' $runtimeId $generation ('d' * 64) 'boot-legacy-after'
+    $facts = [ordered]@{}
+    $defenderReceipts = @(& $newDefender 'Setup')
+    $defenderReceipts += @(& $newDefender 'PortableZip')
+    $facts.Preflight = [pscustomobject][ordered]@{ defenderReceipts = @($defenderReceipts) }
+    $facts.LegacyUpgrade = [pscustomobject][ordered]@{
+        previousSetup = [pscustomobject][ordered]@{ version = '2.5.21'; gitCommit = ('a' * 40); assetSha256 = ('1' * 64); manifestSha256 = ('2' * 64) }
+        before = $legacyBeforeObservation; after = $legacyAfterObservation
+        deviceKeySha256Before = $keyHash; deviceKeySha256After = $keyHash; keyHashPreserved = $true; operationOutcome = 'Completed'
+    }
+    $facts.Uninstall = [pscustomobject][ordered]@{
+        stateRemoved = $true; installRootPresent = $false; appRootPresent = $false; runtimeRootPresent = $false; activePointerPresent = $false; taskState = 'Absent'; supervisorCount = 0; trayHostCount = 0; codexCount = 0
+        shortcuts = [pscustomobject][ordered]@{ startMenu = $false; desktop = $false }; debugEndpointsGone = $true
+        deviceKeySha256Before = $keyHash; deviceKeySha256After = $keyHash; keyHashPreserved = $true; operationOutcome = 'Completed'
+    }
+    $facts.FreshInstall = [pscustomobject][ordered]@{
+        installRootPresent = $true; installReady = $true; activePointerPresent = $true; activeRuntimeId = $runtimeId; activeGeneration = $generation; runtimeManifestSha256 = ('d' * 64)
+        supervisorCount = 1; trayHostCount = 1; codexCount = 1; trayHostIdentity = [pscustomobject][ordered]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' }; trayAuthenticated = $true; taskState = 'Ready'; terminalReceipt = $terminal; protectionReady = $true; deviceKeySha256 = $keyHash; operationOutcome = 'Completed'
+    }
+    $phaseFiles = [ordered]@{ Preflight = '01-Preflight.json'; LegacyUpgrade = '02-LegacyUpgrade.json'; Uninstall = '03-Uninstall.json'; FreshInstall = '04-FreshInstall.json'; PreReboot = '05-PreReboot.json'; PostReboot = '06-PostReboot.json'; ReadyForManualEvidence = '07-ReadyForManualEvidence.json'; Complete = '08-Complete.json' }
+    $writeReceipt = {
+        param([string]$Phase,$Value)
+        $receipt = [ordered]@{ schemaVersion = 1; phase = $Phase; candidate = $candidate; draft = $draft; facts = $Value }
+        [IO.File]::WriteAllText((Join-Path $stateRoot $phaseFiles[$Phase]), (($receipt | ConvertTo-Json -Depth 20) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+    }.GetNewClosure()
+    foreach ($phase in @('Preflight','LegacyUpgrade','Uninstall','FreshInstall')) { & $writeReceipt $phase $facts[$phase] }
+    $preObservation = & $makeLegacyObservation '2.5.22' $runtimeId $generation ('d' * 64) 'boot-1'
+    $facts.PreReboot = [pscustomobject][ordered]@{ rebootRequested = $true; bootIdBefore = 'boot-1'; freshInstallReceiptSha256 = Get-CcodTestFileSha256 (Join-Path $stateRoot $phaseFiles.FreshInstall); activeRuntimeId = $runtimeId; activeGeneration = $generation; runtimeManifestSha256 = $preObservation.runtimeManifestSha256; deviceKeySha256 = $keyHash; operationOutcome = 'Completed'; observation = $preObservation }
+    $postObservation = & $makeLegacyObservation '2.5.22' $runtimeId $generation ('d' * 64) 'boot-2'
+    $facts.PostReboot = [pscustomobject][ordered]@{
+        observation = $postObservation
+        installRootPresent = $true; activePointerPresent = $true; bootIdBefore = 'boot-1'; bootIdAfter = 'boot-2'; bootChanged = $true; receiptContinuity = $true; activeRuntimeId = $runtimeId; activeGeneration = $generation; runtimeManifestSha256 = ('d' * 64); transitionStage = 'Idle'
+        protectionRecovered = $true; protectionReady = $true; taskState = 'Ready'; supervisorCount = 1; trayHostCount = 1; codexCount = 1; trayHostIdentity = [pscustomobject][ordered]@{ pid = 201; creationTimeUtc = '2030-02-03T04:05:01.0000000Z' }; trayAuthenticated = $true; terminalReceipt = $terminal
+        deviceKeySha256 = $keyHash; keyHashPreserved = $true; operationOutcome = 'Completed'
+    }
+    $facts.ReadyForManualEvidence = [pscustomobject][ordered]@{ automatedPhases = @('Preflight','LegacyUpgrade','Uninstall','FreshInstall','PreReboot','PostReboot'); status = 'ReadyForManualEvidence'; manualEvidencePending = $true; complete = $false; manualChallenge = 'ffffffffffffffffffffffffffffffff' }
+    & $writeReceipt 'PreReboot' $facts.PreReboot; & $writeReceipt 'PostReboot' $facts.PostReboot; & $writeReceipt 'ReadyForManualEvidence' $facts.ReadyForManualEvidence
+    $manual = @(New-CcodTask9ManualEvidenceFixture -ManifestHash $candidate.manifestHashes.portable -Commit $candidate.gitCommit -ArtifactRoot (Join-Path $EvidenceRoot 'official-draft-artifacts'))
+    $manualNames = @('TrayEvidence-About.json','TrayEvidence-Language.json','TrayEvidence-OpenLogs.json','TrayEvidence-Repair.json','RemoteEvidence-SecondDeviceControl.json')
+    for ($index = 0; $index -lt $manual.Count; $index++) { [IO.File]::WriteAllText((Join-Path $manualRoot $manualNames[$index]), (($manual[$index] | ConvertTo-Json -Depth 12) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false)) }
+    $facts.Complete = [pscustomobject][ordered]@{ manualEvidence = $manual; status = 'Complete'; complete = $true }
+    & $writeReceipt 'Complete' $facts.Complete
+    $hashes = [Collections.Generic.List[object]]::new()
+    foreach ($phase in @('Preflight','LegacyUpgrade','Uninstall','FreshInstall','PreReboot','PostReboot','ReadyForManualEvidence','Complete')) { $hashes.Add([pscustomobject][ordered]@{ phase = $phase; sha256 = Get-CcodTestFileSha256 (Join-Path $stateRoot $phaseFiles[$phase]) }) }
+    return [pscustomobject][ordered]@{ StateDirectory = $stateRoot; AutomatedReceiptSha256 = @($hashes); ManualEvidence = @($manual) }
+}
+
 function Sync-CcodTask5OuterAssetHash {
     param([Parameter(Mandatory)]$Fixture,[Parameter(Mandatory)][ValidateSet('Portable','Setup')][string]$Distribution,[Parameter(Mandatory)][string]$AssetName)
     $manifestName=if($Distribution-ceq'Portable'){$Fixture.Names[4]}else{$Fixture.Names[10]}
@@ -368,6 +604,88 @@ function Get-CcodReadOnlyProductTreeSnapshot {
     return [pscustomobject][ordered]@{root=$full;exists=$true;rootAttributes=[int]$rootItem.Attributes;rootCreationTimeUtc=$rootItem.CreationTimeUtc.ToString('o',[Globalization.CultureInfo]::InvariantCulture);rootLastWriteTimeUtc=$rootItem.LastWriteTimeUtc.ToString('o',[Globalization.CultureInfo]::InvariantCulture);entryCount=$records.Count;totalBytes=$total;records=@($records)}
 }
 
+Invoke-CcodTask5Test 'review-installed-package-contract' 'installed candidate reader accepts the actual sealed release package manifest' {
+    $fixture=$null;$integration=$null
+    try {
+        $fixture=New-CcodTask5ExactAssetFixture
+        $asset=Import-Module $assetContractPath -Force -PassThru
+        $contract=Test-CcodExactReleaseAssetSet -AssetDirectory $fixture.Root -Version '2.5.22'
+        Assert-CcodTrue $contract.Valid 'the real release validator accepts the fixture before the integration reader'
+        $integration=New-Module -ArgumentList (Join-Path $repositoryRoot 'tests/installed/Invoke-InstalledLifecycleIntegration.ps1') -ScriptBlock {param($Path). $Path -Library}
+        $path=Join-Path $fixture.Root $fixture.Names[5]
+        $result=&$integration {param($Path)Get-CcodInstalledLifecycleCandidate -Path $Path -ExpectedVersion '2.5.22' -Kind Installer -Adapters (Get-CcodInstalledLifecycleDefaultAdapters)} $path
+        Assert-CcodEqual (Get-CcodTestFileSha256 $path) $result.Sha256 'integration binds the same installer bytes'
+        $package=[IO.File]::ReadAllText((Join-Path $fixture.Root $fixture.Names[8]))|ConvertFrom-Json
+        Assert-CcodEqual ($package.files|ConvertTo-Json -Depth 8 -Compress) ($result.PayloadFiles|ConvertTo-Json -Depth 8 -Compress) 'runtime expectations use real package file records'
+        [IO.File]::WriteAllText((Join-Path $fixture.Root $fixture.Names[8]),'{}')
+        Assert-CcodThrows {&$integration {param($Path)Get-CcodInstalledLifecycleCandidate -Path $Path -ExpectedVersion '2.5.22' -Kind Installer -Adapters (Get-CcodInstalledLifecycleDefaultAdapters)} $path|Out-Null} 'CCOD_INTEGRATION_CANDIDATE_INVALID'
+    } finally {
+        if($null-ne$integration){Remove-Module $integration.Name -Force -ErrorAction SilentlyContinue}
+        if($null-ne$fixture){Remove-CcodTask5ExactAssetFixture $fixture}
+    }
+}
+
+Invoke-CcodTask5Test 'fix2-setup-file-hash-type' 'Setup file hashes reject singleton arrays with all dependent hashes rebound' {
+    $fixture = $null
+    $module = Import-Module $assetContractPath -Force -PassThru -DisableNameChecking
+    try {
+        $fixture = New-CcodTask5ExactAssetFixture -SetupHashAsArray
+        $package = [IO.File]::ReadAllText((Join-Path $fixture.Root $fixture.Names[8])) | ConvertFrom-Json
+        Assert-CcodTrue ($package.files[0].sha256 -is [array]) 'malformed hash remains an array after JSON round-trip'
+        Assert-CcodThrows {
+            Test-CcodReleaseAssetManifest -ManifestPath (Join-Path $fixture.Root $fixture.Names[10]) -AssetDirectory $fixture.Root -ExpectedVersion $fixture.Version | Out-Null
+        } 'CCOD_RELEASE_MANIFEST_INVALID'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $fixture) { Remove-CcodTask5ExactAssetFixture $fixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix2-selector' 'release test selection rejects inherited filters and never reports a partial run as full success' {
+    $selfTest = Join-Path $repositoryRoot 'tests\persistence\ReleaseWorkflow.SelfTest.ps1'
+    $runChild = {
+        param([hashtable]$Environment,[string]$Focus)
+        $start = [Diagnostics.ProcessStartInfo]::new()
+        $start.FileName = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+        $start.Arguments = '-NoLogo -NoProfile -File "' + $selfTest + '"'
+        if ($Focus) { $start.Arguments += ' -FocusedCase "' + $Focus + '"' }
+        $start.UseShellExecute = $false
+        $start.CreateNoWindow = $true
+        $start.RedirectStandardOutput = $true
+        $start.RedirectStandardError = $true
+        foreach ($name in @('CCOD_TASK5_RED_CASE','CCOD_TASK6_RED_CASE')) { $start.EnvironmentVariables.Remove($name) }
+        foreach ($name in $Environment.Keys) { $start.EnvironmentVariables[$name] = $Environment[$name] }
+        $start.EnvironmentVariables.Remove('PSExecutionPolicyPreference')
+        Assert-CcodTrue ($start.Arguments -notmatch '-ExecutionPolicy') 'selector child does not override normal execution policy'
+        Assert-CcodTrue (-not $start.EnvironmentVariables.ContainsKey('PSExecutionPolicyPreference')) 'selector child does not inherit parent process policy'
+        $child = [Diagnostics.Process]::new()
+        $child.StartInfo = $start
+        try {
+            [void]$child.Start()
+            $stdout = $child.StandardOutput.ReadToEndAsync()
+            $stderr = $child.StandardError.ReadToEndAsync()
+            if (-not $child.WaitForExit(60000)) { $child.Kill(); $child.WaitForExit(); throw 'selector child timed out' }
+            [pscustomobject]@{ ExitCode = $child.ExitCode; Output = $stdout.GetAwaiter().GetResult() + $stderr.GetAwaiter().GetResult() }
+        } finally { $child.Dispose() }
+    }.GetNewClosure()
+    foreach ($environment in @(
+        @{ CCOD_TASK5_RED_CASE = 'unknown-case' },
+        @{ CCOD_TASK6_RED_CASE = 'fix1-absolute-tag-anchor' },
+        @{ CCOD_TASK5_RED_CASE = ' '; CCOD_TASK6_RED_CASE = 'unknown-case' }
+    )) {
+        $result = & $runChild $environment ''
+        Assert-CcodTrue ($result.ExitCode -ne 0) 'inherited selectors fail rather than silently skipping release gates'
+        Assert-CcodTrue ($result.Output.Contains('CCOD_RELEASE_TEST_SELECTION_INVALID')) 'inherited selector failure has a stable marker'
+        Assert-CcodTrue (-not $result.Output.Contains('Release workflow self-tests passed')) 'rejected run never reports full success'
+    }
+    $unknown = & $runChild @{} 'Task6:unknown-case'
+    Assert-CcodTrue ($unknown.ExitCode -ne 0 -and $unknown.Output.Contains('CCOD_RELEASE_TEST_SELECTION_INVALID')) 'unknown explicit selection is rejected before running tests'
+    $focused = & $runChild @{} 'Task6:fix1-absolute-tag-anchor'
+    Assert-CcodEqual 0 $focused.ExitCode 'known explicit focused case executes successfully'
+    Assert-CcodTrue ($focused.Output.Contains('CCOD_RELEASE_FOCUSED_TESTS_PASSED')) 'focused mode identifies itself separately'
+    Assert-CcodTrue (-not $focused.Output.Contains('Release workflow self-tests passed')) 'focused mode cannot masquerade as a full release suite'
+}
+
 Invoke-CcodTask5Test 'fix1-public' 'public Defender surfaces cannot accept adapters or enter library mode' {
     $cli=Get-Command $defenderPath -ErrorAction Stop
     Assert-CcodTrue (-not$cli.Parameters.ContainsKey('Library')) 'Defender CLI exposes no library bypass'
@@ -472,6 +790,8 @@ Invoke-CcodTask5Test 'fix1-handle-promotion' 'promotion holds all asset and rece
     $assetFixture=$null;$evidence=$null
     try{
         Assert-CcodTrue ($null-ne(&$module {Get-Command Test-CcodReleasePromotionEvidenceCore -ErrorAction SilentlyContinue})) 'asset module has a private promotion core for controlled replacement tests'
+        $source=[IO.File]::ReadAllText($assetContractPath,[Text.UTF8Encoding]::new($false))
+        Assert-CcodTrue (([regex]::Matches($source,'foreach\(\$directoryAuthority in @\(\$heldFileDirectories\)\)')).Count -ge 2) 'promotion rechecks every held parent directory before and after the visibility callback'
         $assetFixture=New-CcodTask5ExactAssetFixture;$evidence=New-CcodTask5PromotionFixture $assetFixture;$probe=[pscustomobject]@{AssetBlocked=$false;AssetReplaced=$false;ReceiptBlocked=$false;ReceiptReplaced=$false}
         $assetBackup=(Join-Path $assetFixture.Root $assetFixture.Names[0])+'.original';$receiptPath=Join-Path $evidence.Root $evidence.Names[0];$receiptBackup=$receiptPath+'.original'
         $callback={param($Assets,$Evidence,$Receipts)try{[IO.File]::Move($Assets.Files[0].Path,$assetBackup);[IO.File]::Copy($assetBackup,$Assets.Files[0].Path,$false);$probe.AssetReplaced=$true}catch [IO.IOException] {$probe.AssetBlocked=$true};try{[IO.File]::Move($Receipts[0].Path,$receiptBackup);[IO.File]::Copy($receiptBackup,$Receipts[0].Path,$false);$probe.ReceiptReplaced=$true}catch [IO.IOException] {$probe.ReceiptBlocked=$true}}.GetNewClosure()
@@ -486,11 +806,34 @@ Invoke-CcodTask5Test 'fix1-handle-promotion' 'promotion holds all asset and rece
     }
 }
 
+Invoke-CcodTask5Test 'fix1-handle-promotion-post-callback' 'promotion rechecks every held authority after the visibility callback' {
+    $module=Import-Module $assetContractPath -Force -PassThru -DisableNameChecking
+    $assetFixture=$null;$evidence=$null
+    try{
+        $assetFixture=New-CcodTask5ExactAssetFixture;$evidence=New-CcodTask5PromotionFixture $assetFixture
+        $callback={param($Assets,$Evidence,$Receipts)
+            &$module {param($Authority)Close-CcodExactReleaseAssetAuthority $Authority} $Assets
+            &$module {param($Authority)Close-CcodReleaseAuthority $Authority} $Evidence
+            foreach($receipt in @($Receipts)){&$module {param($Authority)Close-CcodReleaseAuthority $Authority} $receipt}
+        }.GetNewClosure()
+        Assert-CcodThrows {
+            &$module {param($EvidenceRoot,$AssetRoot,$Version,$Commit,$Callback)Test-CcodReleasePromotionEvidenceCore -EvidenceDirectory $EvidenceRoot -AssetDirectory $AssetRoot -Version $Version -ExpectedGitCommit $Commit -BeforeReturn $Callback} $evidence.Root $assetFixture.Root $assetFixture.Version $assetFixture.GitCommit $callback
+        } 'CCOD_RELEASE_PROMOTION_EVIDENCE_INVALID'
+    }finally{
+        if($null-ne$evidence-and(Test-Path $evidence.Root)){Remove-Item -LiteralPath $evidence.Root -Recurse -Force}
+        if($null-ne$assetFixture){Remove-CcodTask5ExactAssetFixture $assetFixture};Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+    }
+}
+
 foreach($receiptShape in @('NoOp','Corrupt','WrongTarget','StaleObject','ReplacedReadback','FailedNoOp')){
     Invoke-CcodTask5Test ("fix1-receipt-$receiptShape") ("Defender receipt readback rejects $receiptShape publication") {
         $fixture=New-CcodTask5ExactAssetFixture
         try{
             $candidate=Join-Path $fixture.Root $fixture.Names[5];$checksum=Join-Path $fixture.Root $fixture.Names[6];$manifest=Join-Path $fixture.Root $fixture.Names[10];$evidence=Join-Path $fixture.Outside ("receipt-$receiptShape.json");$case=if($receiptShape-ceq'FailedNoOp'){New-CcodTask5DefenderAdapterFixture -ScanThrows}else{New-CcodTask5DefenderAdapterFixture};$realPublish=(Get-CcodTask5DefaultDefenderAdapters).PublishReceiptBytes
+            $controlPath=Join-Path $fixture.Outside 'control.json'
+            $control=Invoke-CcodTask5DefenderCore -CandidatePath $candidate -ChecksumPath $checksum -ManifestPath $manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity (New-CcodTask5WorkflowIdentity $fixture.GitCommit) -ExpectedVersion $fixture.Version -ExpectedGitCommit $fixture.GitCommit -EvidencePath $controlPath -Adapters (New-CcodTask5DefenderAdapterFixture).Adapters
+            Assert-CcodEqual 'Completed' $control.outcome 'the same candidate has a passing real publication control'
+            $controlHash=Get-CcodTestFileSha256 $controlPath
             switch($receiptShape){
                 'NoOp'{$case.Adapters.PublishReceiptBytes={param($Directory,$Leaf,$Bytes)$null}}
                 'Corrupt'{$case.Adapters.PublishReceiptBytes={param($Directory,$Leaf,$Bytes)&$realPublish $Directory $Leaf ([Text.UTF8Encoding]::new($false).GetBytes('{}'))}.GetNewClosure()}
@@ -499,7 +842,21 @@ foreach($receiptShape in @('NoOp','Corrupt','WrongTarget','StaleObject','Replace
                 'ReplacedReadback'{$case.Adapters.PublishReceiptBytes={param($Directory,$Leaf,$Bytes)$pin=&$realPublish $Directory $Leaf $Bytes;$pin.Stream.Dispose();$pin.Closed=$true;$target=Join-Path $Directory.Path $Leaf;$original=$target+'.original';[IO.File]::Move($target,$original);[IO.File]::Copy($original,$target,$false);$pin}.GetNewClosure()}
                 'FailedNoOp'{$case.Adapters.PublishReceiptBytes={param($Directory,$Leaf,$Bytes)$null}}
             }
-            Assert-CcodThrows {Invoke-CcodTask5DefenderCore -CandidatePath $candidate -ChecksumPath $checksum -ManifestPath $manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity (New-CcodTask5WorkflowIdentity $fixture.GitCommit) -ExpectedVersion $fixture.Version -ExpectedGitCommit $fixture.GitCommit -EvidencePath $evidence -Adapters $case.Adapters|Out-Null} 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED'
+            $faultPublish=$case.Adapters.PublishReceiptBytes
+            $state=[pscustomobject]@{Calls=0;Authority=$null}
+            $case.Adapters.PublishReceiptBytes={param($Directory,$Leaf,$Bytes)$state.Calls++;$value=&$faultPublish $Directory $Leaf $Bytes;$state.Authority=$value;return $value}.GetNewClosure()
+            $expected=if($receiptShape-in@('WrongTarget','StaleObject','ReplacedReadback')){'CCOD_DEFENDER_EVIDENCE_CLEANUP_FAILED'}else{'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED'}
+            Assert-CcodThrows {Invoke-CcodTask5DefenderCore -CandidatePath $candidate -ChecksumPath $checksum -ManifestPath $manifest -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity (New-CcodTask5WorkflowIdentity $fixture.GitCommit) -ExpectedVersion $fixture.Version -ExpectedGitCommit $fixture.GitCommit -EvidencePath $evidence -Adapters $case.Adapters|Out-Null} $expected
+            Assert-CcodEqual 1 $state.Calls 'the failing publisher is actually invoked once'
+            Assert-CcodEqual $controlHash (Get-CcodTestFileSha256 $controlPath) 'failure preserves the unrelated valid receipt'
+            if($receiptShape-in@('NoOp','Corrupt','FailedNoOp')){Assert-CcodTrue (-not[IO.File]::Exists($evidence)) 'no-op or rejected owned publication leaves no target'}
+            if($receiptShape-ceq'WrongTarget') {
+                Assert-CcodTrue (-not[IO.File]::Exists($evidence)) 'wrong-target callback never created the requested receipt'
+                Assert-CcodEqual $state.Authority.Sha256 (Get-CcodTestFileSha256 ($evidence+'.wrong.json')) 'cleanup does not guess ownership of the other target'
+            }
+            if($receiptShape-in@('StaleObject','ReplacedReadback')){Assert-CcodEqual $state.Authority.Sha256 (Get-CcodTestFileSha256 $evidence) 'unverifiable authority is rejected without pathname deletion'}
+            if($receiptShape-ceq'ReplacedReadback'){Assert-CcodEqual $state.Authority.Sha256 (Get-CcodTestFileSha256 ($evidence+'.original')) 'detached original is not guessed from its pathname'}
+            if($null-ne$state.Authority){Assert-CcodTrue $state.Authority.Closed 'every retained publisher handle is released'}
         }finally{Remove-CcodTask5ExactAssetFixture $fixture}
     }
 }
@@ -2523,6 +2880,260 @@ Invoke-CcodTask5Test 'defender' 'Defender gate binds exact origins status clocks
     }finally{Remove-CcodTask5ExactAssetFixture $fixture}
 }
 
+Invoke-CcodTask5Test 'review-defender-existing-threat' 'Defender rejects the same unresolved candidate detection before and after a scan' {
+    $fixture=New-CcodTask5ExactAssetFixture
+    try {
+        $candidate=Join-Path $fixture.Root $fixture.Names[5]
+        $invoke=@{CandidatePath=$candidate;ChecksumPath=(Join-Path $fixture.Root $fixture.Names[6]);ManifestPath=(Join-Path $fixture.Root $fixture.Names[10]);Origin='TrustedWorkflowArtifact';WorkflowArtifactIdentity=(New-CcodTask5WorkflowIdentity $fixture.GitCommit);ExpectedVersion=$fixture.Version;ExpectedGitCommit=$fixture.GitCommit}
+        $control=New-CcodTask5DefenderAdapterFixture
+        $clean=Invoke-CcodTask5DefenderCore @invoke -EvidencePath (Join-Path $fixture.Outside 'clean.json') -Adapters $control.Adapters
+        Assert-CcodEqual 'Completed' $clean.outcome 'otherwise-valid unchanged candidate passes before introducing the old detection'
+        Assert-CcodEqual 2 $control.State.Threat 'passing control observes both sides of the scan'
+        [Console]::WriteLine('CCOD_DEFENDER_EXISTING_THREAT_CONTROL_PASSED')
+        $record=[pscustomobject]@{ThreatID=[long]99;InitialDetectionTime=([datetime]::Parse('2030-02-02T04:05:06Z').ToUniversalTime());Resources=[string[]]@('file:_'+$candidate);ThreatStatusID=[byte]1;ActionSuccess=$false;ThreatStatusErrorCode=[int]0;AdditionalActionsBitMask=[uint32]0;CurrentThreatExecutionStatusID=[byte]0;LastThreatStatusChangeTime=([datetime]::Parse('2030-02-02T04:05:06Z').ToUniversalTime());RemediationTime=$null}
+        $case=New-CcodTask5DefenderAdapterFixture
+        $state=$case.State
+        $case.Adapters.GetThreatDetections={$state.Calls.Add('Threat');$state.Threat++;return @($record)}.GetNewClosure()
+        $path=Join-Path $fixture.Outside 'unresolved.json'
+        Assert-CcodThrows {Invoke-CcodTask5DefenderCore @invoke -EvidencePath $path -Adapters $case.Adapters | Out-Null} 'CCOD_DEFENDER_DETECTIONS_FOUND'
+        Assert-CcodEqual 2 $state.Threat 'unchanged unresolved detection is observed before and after scanning'
+        Assert-CcodEqual 1 @($state.Calls | Where-Object {$_ -ceq 'Scan'}).Count 'the isolated scan adapter actually ran'
+        $failed=[IO.File]::ReadAllText($path)|ConvertFrom-Json
+        Assert-CcodEqual 'Failed' $failed.outcome 'unresolved candidate never leaves a clean receipt'
+        Assert-CcodEqual 1 $failed.detectionCount 'the same detection is counted once rather than omitted or counted twice'
+        Assert-CcodTrue (-not([IO.File]::ReadAllText($path).Contains($candidate))) 'receipt does not leak threat resource paths'
+    } finally {Remove-CcodTask5ExactAssetFixture $fixture}
+}
+
+Invoke-CcodTask5Test 'review-defender-status-drift' 'Defender does not ignore remediation changes under an existing detection key' {
+    $fixture=New-CcodTask5ExactAssetFixture
+    try {
+        $candidate=Join-Path $fixture.Root $fixture.Names[5]
+        $invoke=@{CandidatePath=$candidate;ChecksumPath=(Join-Path $fixture.Root $fixture.Names[6]);ManifestPath=(Join-Path $fixture.Root $fixture.Names[10]);Origin='TrustedWorkflowArtifact';WorkflowArtifactIdentity=(New-CcodTask5WorkflowIdentity $fixture.GitCommit);ExpectedVersion=$fixture.Version;ExpectedGitCommit=$fixture.GitCommit}
+        $initial=[datetime]::Parse('2030-02-02T04:05:06Z').ToUniversalTime()
+        $record=[pscustomobject]@{ThreatID=[long]99;InitialDetectionTime=$initial;Resources=[string[]]@('file:_'+$candidate);ThreatStatusID=[byte]2;ActionSuccess=$true;ThreatStatusErrorCode=[int]0;AdditionalActionsBitMask=[uint32]0;CurrentThreatExecutionStatusID=[byte]4;LastThreatStatusChangeTime=$initial.AddMinutes(1);RemediationTime=$initial.AddMinutes(1)}
+        foreach($mode in @('Stable','RemediationTime','LastThreatStatusChangeTime','ThreatStatusID','CurrentThreatExecutionStatusID','ThreatStatusErrorCode','AdditionalActionsBitMask','ActionSuccess','MissingStatus','StatusArray','StatusString','BeforeUnresolved','DisappearingUnresolved','Unrelated','SamePrefixOtherFile','ContainerFile','Allowed','UnknownResource')) {
+            $case=New-CcodTask5DefenderAdapterFixture;$state=$case.State
+            $before=$record.PSObject.Copy()
+            $after=$record.PSObject.Copy()
+            switch($mode) {
+                'RemediationTime'{$after.RemediationTime=$initial.AddMinutes(2)}
+                'LastThreatStatusChangeTime'{$after.LastThreatStatusChangeTime=$initial.AddMinutes(2)}
+                'ThreatStatusID'{$after.ThreatStatusID=[byte]3}
+                'CurrentThreatExecutionStatusID'{$after.CurrentThreatExecutionStatusID=[byte]3}
+                'ThreatStatusErrorCode'{$after.ThreatStatusErrorCode=[int]-1}
+                'AdditionalActionsBitMask'{$after.AdditionalActionsBitMask=[uint32]8}
+                'ActionSuccess'{$after.ActionSuccess=$false}
+                'MissingStatus'{$before.PSObject.Properties.Remove('ThreatStatusID');$after.PSObject.Properties.Remove('ThreatStatusID')}
+                'StatusArray'{$before.ThreatStatusID=@([byte]2);$after.ThreatStatusID=@([byte]2)}
+                'StatusString'{$before.ThreatStatusID='2';$after.ThreatStatusID='2'}
+                'BeforeUnresolved'{$before.ThreatStatusID=[byte]1;$before.ActionSuccess=$false}
+                'DisappearingUnresolved'{$before.ThreatStatusID=[byte]1;$before.ActionSuccess=$false;$after=$null}
+                'Unrelated'{$before.Resources=[string[]]@('file:_' + (Join-Path $fixture.Outside 'other.exe'));$after.Resources=$before.Resources;$before.ActionSuccess=$false;$after.ActionSuccess=$false}
+                'SamePrefixOtherFile'{$before.Resources=[string[]]@('file:_' + $candidate + '.other');$after.Resources=$before.Resources;$before.ActionSuccess=$false;$after.ActionSuccess=$false}
+                'ContainerFile'{$before.Resources=[string[]]@('containerfile:_' + $candidate + ';file:_inside.exe');$after.Resources=$before.Resources;$before.ActionSuccess=$false;$after.ActionSuccess=$false}
+                'Allowed'{$before.ThreatStatusID=[byte]5;$after.ThreatStatusID=[byte]5}
+                'UnknownResource'{$before.Resources=[string[]]@('unrecognized-resource');$after.Resources=$before.Resources;$before.ActionSuccess=$false;$after.ActionSuccess=$false}
+            }
+            $case.Adapters.GetThreatDetections={$state.Calls.Add('Threat');$state.Threat++;if($state.Threat-eq1){$before}else{$after}}.GetNewClosure()
+            $path=Join-Path $fixture.Outside ($mode+'.json')
+            if($mode-in@('Stable','Unrelated','SamePrefixOtherFile')) {
+                $result=Invoke-CcodTask5DefenderCore @invoke -EvidencePath $path -Adapters $case.Adapters
+                Assert-CcodEqual 'Completed' $result.outcome 'unchanged successfully remediated historical detection is a passing control'
+                Assert-CcodEqual 0 $result.detectionCount 'stable clean history is not counted as a new threat'
+                [Console]::WriteLine('CCOD_DEFENDER_RESOLVED_HISTORY_CONTROL_PASSED '+$mode)
+            } else {
+                Assert-CcodThrows {Invoke-CcodTask5DefenderCore @invoke -EvidencePath $path -Adapters $case.Adapters|Out-Null} 'CCOD_DEFENDER_DETECTIONS_FOUND'
+                $failed=[IO.File]::ReadAllText($path)|ConvertFrom-Json
+                Assert-CcodEqual 'Failed' $failed.outcome 'status changes cannot produce Completed'
+                Assert-CcodEqual 1 $failed.detectionCount 'changed existing record is counted once'
+            }
+            Assert-CcodEqual 2 $state.Threat 'both snapshots are actually observed'
+        }
+    } finally {Remove-CcodTask5ExactAssetFixture $fixture}
+}
+
+Invoke-CcodTask5Test 'review-defender-malformed-observation' 'Defender cannot interpret an unidentified record as empty clean history' {
+    $fixture=New-CcodTask5ExactAssetFixture
+    try {
+        $invoke=@{CandidatePath=(Join-Path $fixture.Root $fixture.Names[5]);ChecksumPath=(Join-Path $fixture.Root $fixture.Names[6]);ManifestPath=(Join-Path $fixture.Root $fixture.Names[10]);Origin='TrustedWorkflowArtifact';WorkflowArtifactIdentity=(New-CcodTask5WorkflowIdentity $fixture.GitCommit);ExpectedVersion=$fixture.Version;ExpectedGitCommit=$fixture.GitCommit}
+        $control=New-CcodTask5DefenderAdapterFixture
+        $clean=Invoke-CcodTask5DefenderCore @invoke -EvidencePath (Join-Path $fixture.Outside 'clean.json') -Adapters $control.Adapters
+        Assert-CcodEqual 'Completed' $clean.outcome 'legitimate empty observation passes'
+        $case=New-CcodTask5DefenderAdapterFixture;$state=$case.State
+        $case.Adapters.GetThreatDetections={$state.Threat++;return @([pscustomobject]@{})}.GetNewClosure()
+        $path=Join-Path $fixture.Outside 'invalid.json'
+        Assert-CcodThrows {Invoke-CcodTask5DefenderCore @invoke -EvidencePath $path -Adapters $case.Adapters|Out-Null} 'CCOD_DEFENDER_DETECTIONS_INVALID'
+        Assert-CcodTrue (-not[IO.File]::Exists($path)) 'unidentified observation cannot create a clean receipt'
+        Assert-CcodEqual 1 $state.Threat 'malformed first observation is reached'
+        Assert-CcodTrue (-not($state.Calls-contains'Scan')) 'malformed baseline blocks the scan'
+    } finally {Remove-CcodTask5ExactAssetFixture $fixture}
+}
+
+Invoke-CcodTask5Test 'review2-defender-receipt-rename' 'Defender cannot leave success evidence after an attempted held-receipt rename' {
+    $fixture=New-CcodTask5ExactAssetFixture
+    try {
+        $invoke=@{CandidatePath=(Join-Path $fixture.Root $fixture.Names[5]);ChecksumPath=(Join-Path $fixture.Root $fixture.Names[6]);ManifestPath=(Join-Path $fixture.Root $fixture.Names[10]);Origin='TrustedWorkflowArtifact';WorkflowArtifactIdentity=(New-CcodTask5WorkflowIdentity $fixture.GitCommit);ExpectedVersion=$fixture.Version;ExpectedGitCommit=$fixture.GitCommit}
+        $controlPath=Join-Path $fixture.Outside 'rename-control.json'
+        $control=Invoke-CcodTask5DefenderCore @invoke -EvidencePath $controlPath -Adapters (New-CcodTask5DefenderAdapterFixture).Adapters
+        Assert-CcodEqual 'Completed' $control.outcome 'real publisher/readback control passes'
+        $controlHash=Get-CcodTestFileSha256 $controlPath
+        $path=Join-Path $fixture.Outside 'rename-target.json';$renamed=Join-Path $fixture.Outside 'renamed-success.json';$interference=Join-Path $fixture.Outside 'rename-interference.txt'
+        $state=[pscustomobject]@{Attempts=0;Moved=$false;Authority=$null}
+        $realPublish=(Get-CcodTask5DefaultDefenderAdapters).PublishReceiptBytes
+        $case=New-CcodTask5DefenderAdapterFixture
+        $case.Adapters.PublishReceiptBytes={
+            param($Directory,$Leaf,$Bytes)
+            $pin=&$realPublish $Directory $Leaf $Bytes;$state.Authority=$pin;$state.Attempts++
+            try{[IO.File]::Move($pin.Path,$renamed);$state.Moved=$true}catch [IO.IOException]{}
+            [IO.File]::WriteAllText($interference,'post-publication membership failure')
+            return $pin
+        }.GetNewClosure()
+        $failure=$null
+        try{Invoke-CcodTask5DefenderCore @invoke -EvidencePath $path -Adapters $case.Adapters|Out-Null}catch{$failure=$_.FullyQualifiedErrorId}
+        Assert-CcodEqual 1 $state.Attempts 'actual publication occurs before the native rename attempt'
+        Assert-CcodTrue ($failure-like'CCOD_DEFENDER_*') 'post-publication failure reaches owned rollback'
+        Assert-CcodTrue (-not[IO.File]::Exists($path)-and-not[IO.File]::Exists($renamed)) 'failed invocation leaves no owned Completed receipt under either name'
+        Assert-CcodEqual $false $state.Moved 'publisher denies another opener rename while retaining ownership'
+        Assert-CcodTrue $state.Authority.Closed 'failure closes the real owned authority'
+        Assert-CcodEqual $controlHash (Get-CcodTestFileSha256 $controlPath) 'earlier successful evidence remains untouched'
+        Assert-CcodTrue ([IO.File]::Exists($interference)) 'unowned sibling is never deleted by rollback'
+        [IO.File]::Delete($interference)
+        $retry=Invoke-CcodTask5DefenderCore @invoke -EvidencePath $path -Adapters (New-CcodTask5DefenderAdapterFixture).Adapters
+        Assert-CcodEqual 'Completed' $retry.outcome 'released authority permits legitimate retry'
+    } finally {Remove-CcodTask5ExactAssetFixture $fixture}
+}
+
+Invoke-CcodTask5Test 'review-defender-published-rollback' 'Defender removes its published receipt when evidence membership validation fails' {
+    $fixture=New-CcodTask5ExactAssetFixture
+    try {
+        $invoke=@{CandidatePath=(Join-Path $fixture.Root $fixture.Names[5]);ChecksumPath=(Join-Path $fixture.Root $fixture.Names[6]);ManifestPath=(Join-Path $fixture.Root $fixture.Names[10]);Origin='TrustedWorkflowArtifact';WorkflowArtifactIdentity=(New-CcodTask5WorkflowIdentity $fixture.GitCommit);ExpectedVersion=$fixture.Version;ExpectedGitCommit=$fixture.GitCommit}
+        $control=New-CcodTask5DefenderAdapterFixture
+        $controlPath=Join-Path $fixture.Outside 'control.json'
+        $clean=Invoke-CcodTask5DefenderCore @invoke -EvidencePath $controlPath -Adapters $control.Adapters
+        Assert-CcodEqual 'Completed' $clean.outcome 'unchanged publication and readback pass before injecting failure'
+        $controlHash=Get-CcodTestFileSha256 $controlPath
+        $case=New-CcodTask5DefenderAdapterFixture
+        $publish=(Get-CcodTask5DefaultDefenderAdapters).PublishReceiptBytes
+        $state=[pscustomobject]@{Published=$false;Authority=$null;Interference=$null}
+        $case.Adapters.PublishReceiptBytes={
+            param($Directory,$Leaf,$Bytes)
+            $authority=&$publish $Directory $Leaf $Bytes
+            $state.Authority=$authority
+            $state.Published=[IO.File]::Exists($authority.Path)
+            $state.Interference=Join-Path $Directory.Path 'unrelated.txt'
+            [IO.File]::WriteAllText($state.Interference,'unrelated-data',[Text.UTF8Encoding]::new($false))
+            return $authority
+        }.GetNewClosure()
+        $path=Join-Path $fixture.Outside 'rejected.json'
+        Assert-CcodThrows {Invoke-CcodTask5DefenderCore @invoke -EvidencePath $path -Adapters $case.Adapters|Out-Null} 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED'
+        Assert-CcodTrue $state.Published 'failure occurs after actual native receipt publication'
+        Assert-CcodTrue (-not[IO.File]::Exists($path)) 'failed Defender invocation leaves no published success-shaped receipt'
+        Assert-CcodTrue $state.Authority.Closed 'owned receipt authority is released after rollback'
+        Assert-CcodEqual $controlHash (Get-CcodTestFileSha256 $controlPath) 'rollback preserves the existing valid receipt'
+        Assert-CcodEqual 'unrelated-data' ([IO.File]::ReadAllText($state.Interference)) 'rollback does not delete the interfering sibling'
+        $retry=Invoke-CcodTask5DefenderCore @invoke -EvidencePath $path -Adapters (New-CcodTask5DefenderAdapterFixture).Adapters
+        Assert-CcodEqual 'Completed' $retry.outcome 'clean retry proves receipt and directory handles were released'
+    } finally {Remove-CcodTask5ExactAssetFixture $fixture}
+}
+
+Invoke-CcodTask5Test 'review-defender-readback-final-rollback' 'Defender rolls back readback failures and input drift after successful readback' {
+    $fixture=New-CcodTask5ExactAssetFixture
+    $module=Import-Module $releaseDefenderModulePath -Force -PassThru -DisableNameChecking
+    $original=&$module {${function:Confirm-CcodReleaseDefenderReceiptReadback}}
+    try {
+        &$module {
+            param($Original)
+            $script:CcodReviewOriginalReadback=$Original
+            function script:Confirm-CcodReleaseDefenderReceiptReadback {
+                param($PublishedAuthority,$ReadbackAuthority,[string]$ExpectedPath,[byte[]]$ExpectedBytes,$ExpectedReceipt)
+                $script:CcodReviewReadbackState.Readbacks++
+                $result=&$script:CcodReviewOriginalReadback @PSBoundParameters
+                $script:CcodReviewReadbackState.Confirmed=$true
+                if($script:CcodReviewReadbackState.Mode-ceq'FinalInputs') {
+                    [IO.File]::WriteAllText($script:CcodReviewReadbackState.Interference,'fixture-input-drift',[Text.UTF8Encoding]::new($false))
+                    $script:CcodReviewReadbackState.Injected=$true
+                }
+                return $result
+            }
+        } $original
+        $invoke=@{CandidatePath=(Join-Path $fixture.Root $fixture.Names[5]);ChecksumPath=(Join-Path $fixture.Root $fixture.Names[6]);ManifestPath=(Join-Path $fixture.Root $fixture.Names[10]);Origin='TrustedWorkflowArtifact';WorkflowArtifactIdentity=(New-CcodTask5WorkflowIdentity $fixture.GitCommit);ExpectedVersion=$fixture.Version;ExpectedGitCommit=$fixture.GitCommit}
+        $publish=(Get-CcodTask5DefaultDefenderAdapters).PublishReceiptBytes
+        foreach($mode in @('Clean','ReadbackBytes','ReadbackLength','FinalInputs')) {
+            $state=[pscustomobject]@{Mode=$mode;Readbacks=0;Confirmed=$false;Injected=$false;Authority=$null;Interference=(Join-Path $fixture.Root 'after-confirm.txt')}
+            &$module {param($State)$script:CcodReviewReadbackState=$State} $state
+            $case=New-CcodTask5DefenderAdapterFixture
+            $case.Adapters.PublishReceiptBytes={
+                param($Directory,$Leaf,$Bytes)
+                $authority=&$publish $Directory $Leaf $Bytes
+                $state.Authority=$authority
+                if($state.Mode-in@('ReadbackBytes','ReadbackLength')) {
+                    $text=[Text.UTF8Encoding]::new($false).GetString($Bytes)
+                    $text=if($state.Mode-ceq'ReadbackBytes'){$text.Replace('Completed','CompleteX')}else{$text+' '}
+                    $changed=[Text.UTF8Encoding]::new($false).GetBytes($text)
+                    $authority.Stream.Position=0;$authority.Stream.Write($changed,0,$changed.Length);$authority.Stream.SetLength($changed.Length);$authority.Stream.Flush($true)
+                    $state.Injected=$true
+                }
+                return $authority
+            }.GetNewClosure()
+            $path=Join-Path $fixture.Outside ($mode+'.json')
+            if($mode-ceq'Clean') {
+                $result=Invoke-CcodTask5DefenderCore @invoke -EvidencePath $path -Adapters $case.Adapters
+                Assert-CcodEqual 'Completed' $result.outcome 'the instrumented actual readback succeeds without interference'
+                Assert-CcodTrue $state.Confirmed 'passing control reaches real readback confirmation'
+            } else {
+                $expected=if($mode-ceq'FinalInputs'){'CCOD_RELEASE_ASSET_HASH_MISMATCH'}else{'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED'}
+                Assert-CcodThrows {Invoke-CcodTask5DefenderCore @invoke -EvidencePath $path -Adapters $case.Adapters|Out-Null} $expected
+                Assert-CcodTrue $state.Injected "$mode failure is injected at the actual boundary"
+                Assert-CcodEqual 1 $state.Readbacks "$mode reaches the real readback helper"
+                if($mode-ceq'FinalInputs') {
+                    Assert-CcodTrue $state.Confirmed 'final input drift occurs strictly after successful readback'
+                    Assert-CcodEqual 'fixture-input-drift' ([IO.File]::ReadAllText($state.Interference)) 'production rollback preserves the unrelated candidate sibling'
+                    [IO.File]::Delete($state.Interference)
+                }
+                Assert-CcodTrue (-not[IO.File]::Exists($path)) "$mode leaves no usable published receipt"
+                Assert-CcodTrue $state.Authority.Closed "$mode releases the published file handle"
+                $state.Mode='Retry'
+                $retry=Invoke-CcodTask5DefenderCore @invoke -EvidencePath $path -Adapters (New-CcodTask5DefenderAdapterFixture).Adapters
+                Assert-CcodEqual 'Completed' $retry.outcome "$mode allows a new valid operation after cleanup"
+            }
+        }
+    } finally {
+        &$module {param($Original)Set-Item -LiteralPath Function:script:Confirm-CcodReleaseDefenderReceiptReadback -Value $Original;Remove-Variable -Name CcodReviewOriginalReadback,CcodReviewReadbackState -Scope Script -ErrorAction SilentlyContinue} $original
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        Remove-CcodTask5ExactAssetFixture $fixture
+    }
+}
+
+Invoke-CcodTask5Test 'review-defender-rollback-lost-authority' 'Defender cleanup fails closed without deleting a pathname replacement after authority loss' {
+    $fixture=New-CcodTask5ExactAssetFixture
+    try {
+        $invoke=@{CandidatePath=(Join-Path $fixture.Root $fixture.Names[5]);ChecksumPath=(Join-Path $fixture.Root $fixture.Names[6]);ManifestPath=(Join-Path $fixture.Root $fixture.Names[10]);Origin='TrustedWorkflowArtifact';WorkflowArtifactIdentity=(New-CcodTask5WorkflowIdentity $fixture.GitCommit);ExpectedVersion=$fixture.Version;ExpectedGitCommit=$fixture.GitCommit}
+        $clean=Invoke-CcodTask5DefenderCore @invoke -EvidencePath (Join-Path $fixture.Outside 'control.json') -Adapters (New-CcodTask5DefenderAdapterFixture).Adapters
+        Assert-CcodEqual 'Completed' $clean.outcome 'valid publication succeeds with retained authority'
+        $publish=(Get-CcodTask5DefaultDefenderAdapters).PublishReceiptBytes
+        $state=[pscustomobject]@{Replaced=$false;OwnedPath=$null;Authority=$null}
+        $case=New-CcodTask5DefenderAdapterFixture
+        $case.Adapters.PublishReceiptBytes={
+            param($Directory,$Leaf,$Bytes)
+            $authority=&$publish $Directory $Leaf $Bytes
+            $state.Authority=$authority
+            $authority.Stream.Dispose();$authority.Closed=$true
+            $state.OwnedPath=Join-Path $Directory.Path 'detached.json'
+            [IO.File]::Move($authority.Path,$state.OwnedPath)
+            [IO.File]::WriteAllText($authority.Path,'unrelated-replacement',[Text.UTF8Encoding]::new($false))
+            $state.Replaced=$true
+            return $authority
+        }.GetNewClosure()
+        $path=Join-Path $fixture.Outside 'replaced.json'
+        Assert-CcodThrows {Invoke-CcodTask5DefenderCore @invoke -EvidencePath $path -Adapters $case.Adapters|Out-Null} 'CCOD_DEFENDER_EVIDENCE_CLEANUP_FAILED'
+        Assert-CcodTrue $state.Replaced 'fixture actually replaces the published pathname after closing its authority'
+        Assert-CcodEqual 'unrelated-replacement' ([IO.File]::ReadAllText($path)) 'failure never falls back to deleting the replacement by pathname'
+        Assert-CcodTrue ([IO.File]::Exists($state.OwnedPath)) 'lost ownership is reported rather than guessed from another path'
+        Assert-CcodTrue $state.Authority.Closed 'the lost authority remains closed'
+    } finally {Remove-CcodTask5ExactAssetFixture $fixture}
+}
+
 Invoke-CcodTask5Test 'evidence' 'Defender default evidence writer is create-only and rejects unsafe targets before scan' {
     $fixture=New-CcodTask5ExactAssetFixture
     $unsafeOutside=$null;$unsafeLink=$null
@@ -3131,6 +3742,7 @@ function Import-CcodTask6ToolModule {
     Import-Module $created -Force -DisableNameChecking | Out-Null
     $loaded = Get-Module -Name $Name
     if ($null -eq $loaded) { throw "CCOD_TASK6_TOOL_MODULE_MISSING $Name" }
+    & $loaded { param($Root) $script:CcodGitHubDraftModuleRoot = [IO.Path]::GetFullPath($Root) } (Split-Path (Get-Item -LiteralPath $Path).FullName -Parent)
     return $loaded
 }
 
@@ -3176,6 +3788,25 @@ function Assert-CcodDraftReleaseWorkflowContract {
     if ($preflightIndex -lt 0 -or $buildIndex -lt 0 -or $preflightIndex -ge $buildIndex) { throw $errorId }
     $cleanSteps = @($workflow.Jobs[$preflightIndex].Steps | Where-Object { [string]$_.Run -cmatch 'Test-CcodCleanReleaseRunner' })
     if ($cleanSteps.Count -lt 1) { throw $errorId }
+    $normalized = $release.Replace("`r`n", "`n")
+    $stageBlocks = @([regex]::Matches($normalized, '(?ms)^  stage:\n(?<body>.*?)(?=^  [A-Za-z0-9_-]+:\n|\z)'))
+    if ($stageBlocks.Count -ne 1) { throw $errorId }
+    $stageBody = $stageBlocks[0].Groups['body'].Value
+    if ($normalized -cnotmatch '(?m)^permissions:\n  contents: read$' -or
+        @([regex]::Matches($normalized, '(?m)^[ ]*contents: write[ ]*$')).Count -ne 1 -or
+        $stageBody -cnotmatch '(?m)^    permissions:\n      contents: write$' -or
+        $stageBody -cnotmatch '(?m)^    needs: build$' -or
+        $stageBody -cnotmatch '(?m)^          ref: \$\{\{ needs\.build\.outputs\.commit \}\}$') { throw $errorId }
+    foreach ($transfer in @(
+        [pscustomobject]@{ Job = 'preflight'; Step = 'Upload immutable clean preflight evidence' },
+        [pscustomobject]@{ Job = 'stage'; Step = 'Download immutable clean preflight evidence' },
+        [pscustomobject]@{ Job = 'stage'; Step = 'Materialize transferred clean preflight evidence' }
+    )) {
+        $owner = @($workflow.Jobs | Where-Object { $_.Name -ceq $transfer.Job })
+        if ($owner.Count -ne 1) { throw $errorId }
+        $steps = @($owner[0].Steps | Where-Object { $_.Name -ceq $transfer.Step })
+        if ($steps.Count -ne 1 -or -not [string]::IsNullOrEmpty([string]$steps[0].If)) { throw $errorId }
+    }
     foreach ($job in @($workflow.Jobs)) {
         foreach ($step in @($job.Steps)) {
             if (-not [string]::IsNullOrEmpty([string]$step.ContinueOnError)) { throw $errorId }
@@ -3210,10 +3841,11 @@ function New-CcodTask6CleanAdapterFixture {
 }
 
 function New-CcodTask6DraftAdapterFixture {
-    param([string]$AssetDirectory, [switch]$UploadFails, [switch]$ConcurrentStage)
+    param([string]$AssetDirectory, [switch]$UploadFails, [switch]$UploadFailurePublishes, [switch]$ConcurrentStage, [switch]$ReadbackFails, [switch]$ReadbackFailurePublishes)
     $state = [pscustomobject]@{
         Calls = [Collections.Generic.List[string]]::new()
         DraftPrivate = $true
+        DraftId = '123'
         Created = $false
         Uploaded = [Collections.Generic.List[string]]::new()
         Promoted = $false
@@ -3231,20 +3863,22 @@ function New-CcodTask6DraftAdapterFixture {
     }.GetNewClosure()
     $adapters = @{
         TryStageLock = { param($Tag) $state.Calls.Add('TryStageLock'); if ($ConcurrentStage) { $false } else { $true } }.GetNewClosure()
-        CreateDraft = { param($Tag, $Title, $Notes) $state.Calls.Add('CreateDraft'); $state.Created = $true; $state.DraftPrivate = $true; [pscustomobject]@{ Tag = $Tag; Draft = $true } }.GetNewClosure()
+        CreateDraft = { param($Tag, $Title, $Notes) $state.Calls.Add('CreateDraft'); $state.Created = $true; $state.DraftPrivate = $true; [pscustomobject][ordered]@{ Tag = $Tag; Id = [string]$state.DraftId; Draft = $true; AssetNames = @() } }.GetNewClosure()
         GetTagCommit = { param($Tag, [bool]$ActionsOnly) $state.Calls.Add('GetTagCommit'); 'c' * 40 }.GetNewClosure()
         UploadAsset = { param($Tag, $Name, $Path)
             $state.Calls.Add('UploadAsset:' + $Name)
-            if ($UploadFails) { throw 'upload failed' }
+            if ($UploadFails) { if ($UploadFailurePublishes) { $state.DraftPrivate = $false }; throw 'upload failed' }
             $state.Uploaded.Add($Name)
             $state.Assets[$Name] = & $hashFile $Path
         }.GetNewClosure()
         DownloadAsset = { param($Tag, $Name, $Destination)
             $state.Calls.Add('DownloadAsset:' + $Name)
+            if ($ReadbackFails) { if ($ReadbackFailurePublishes) { $state.DraftPrivate = $false }; throw 'readback failed' }
             $source = Join-Path $state.SourceDirectory $Name
             [IO.File]::Copy($source, $Destination, $true)
         }.GetNewClosure()
-        ViewRelease = { param($Tag) $state.Calls.Add('ViewRelease'); [pscustomobject]@{ Tag = $Tag; Draft = [bool]$state.DraftPrivate; AssetNames = @($state.Uploaded) } }.GetNewClosure()
+        ViewRelease = { param($Tag) $state.Calls.Add('ViewRelease'); [pscustomobject][ordered]@{ Tag = $Tag; Id = [string]$state.DraftId; Draft = [bool]$state.DraftPrivate; AssetNames = @($state.Uploaded) } }.GetNewClosure()
+        ProbeRelease = { param($Tag) $state.Calls.Add('ProbeRelease'); $null }.GetNewClosure()
         SetReleaseDraftState = { param($Tag, [bool]$Draft) $state.Calls.Add('SetReleaseDraftState:' + $Draft); $state.DraftPrivate = [bool]$Draft; if (-not $Draft) { $state.Promoted = $true } }.GetNewClosure()
         InvokeBuild = { param($Version) $state.Calls.Add('InvokeBuild'); $state.Rebuilt = $true }.GetNewClosure()
         InvokeGh = { param($Arguments) $state.Calls.Add('InvokeGh'); throw 'raw gh forbidden' }.GetNewClosure()
@@ -3258,8 +3892,8 @@ function Invoke-CcodTask6CleanCore {
 }
 
 function Invoke-CcodTask6DraftCore {
-    param([Parameter(Mandatory)]$Module,[Parameter(Mandatory)][string]$Mode,[Parameter(Mandatory)][string]$Tag,[Parameter(Mandatory)][string]$AssetDirectory,[Parameter(Mandatory)][string]$EvidenceDirectory,[Parameter(Mandatory)][hashtable]$Adapters)
-    &$Module { param($Mode,$Tag,$AssetDirectory,$EvidenceDirectory,$Adapters) Invoke-CcodGitHubDraftReleaseCore -Mode $Mode -Tag $Tag -AssetDirectory $AssetDirectory -EvidenceDirectory $EvidenceDirectory -Adapters $Adapters } $Mode $Tag $AssetDirectory $EvidenceDirectory $Adapters
+    param([Parameter(Mandatory)]$Module,[Parameter(Mandatory)][string]$Mode,[Parameter(Mandatory)][string]$Tag,[Parameter(Mandatory)][string]$AssetDirectory,[Parameter(Mandatory)][string]$EvidenceDirectory,[Parameter(Mandatory)][hashtable]$Adapters,[string]$NotesPath)
+        &$Module { param($Mode,$Tag,$AssetDirectory,$EvidenceDirectory,$Adapters,$NotesPath) Invoke-CcodGitHubDraftReleaseCore -Mode $Mode -Tag $Tag -AssetDirectory $AssetDirectory -EvidenceDirectory $EvidenceDirectory -Adapters $Adapters -NotesPath $NotesPath } $Mode $Tag $AssetDirectory $EvidenceDirectory $Adapters $NotesPath
 }
 
 Invoke-CcodTask6Test 'runner' 'clean release runner is exported from the production tool' {
@@ -3318,6 +3952,59 @@ Invoke-CcodTask6Test 'workflow' 'CI and release workflows satisfy the draft-only
         -ReleasePath (Join-Path $repositoryRoot '.github\workflows\release.yml')
 }
 
+Invoke-CcodTask6Test 'fix2-workflow-candidate-commit' 'Stage candidate gate rejects commits different from the immutable build output' {
+    $path = Join-Path $repositoryRoot '.github/workflows/release.yml'
+    $raw = [IO.File]::ReadAllText($path, [Text.UTF8Encoding]::new($false))
+    $workflow = Get-CcodWorkflowStructure $path
+    $stage = @($workflow.Jobs | Where-Object { $_.Name -ceq 'stage' })
+    $step = @($stage[0].Steps | Where-Object { $_.Name -ceq 'Verify downloaded release candidate contract' })
+    $tokens = $null; $errors = $null
+    $ast = [Management.Automation.Language.Parser]::ParseInput($step[0].Run, [ref]$tokens, [ref]$errors)
+    $guards = @($ast.FindAll({ param($node) $node -is [Management.Automation.Language.IfStatementAst] -and $node.Extent.Text.Contains('$candidate.GitCommit') }, $true))
+    Assert-CcodEqual 1 $guards.Count 'downloaded candidate has one executable commit guard'
+    Assert-CcodTrue ($raw -cmatch '(?m)^          CCOD_RELEASE_COMMIT: \$\{\{ needs\.build\.outputs\.commit \}\}\r?$') 'commit guard consumes the immutable build output'
+    $guard = [scriptblock]::Create($guards[0].Extent.Text)
+    $saved = [Environment]::GetEnvironmentVariable('CCOD_RELEASE_COMMIT', 'Process')
+    try {
+        $candidate = [pscustomobject]@{ GitCommit = 'c' * 40 }
+        $env:CCOD_RELEASE_COMMIT = 'c' * 40
+        & $guard
+        foreach ($invalid in @(('d' * 40), (('c' * 40) + "`n"), '')) {
+            $env:CCOD_RELEASE_COMMIT = $invalid
+            Assert-CcodThrows { & $guard } 'CCOD_RELEASE_BUILD_COMMIT_MISMATCH'
+        }
+    } finally { [Environment]::SetEnvironmentVariable('CCOD_RELEASE_COMMIT', $saved, 'Process') }
+}
+
+Invoke-CcodTask6Test 'fix2-workflow-authority' 'workflow contract rejects detached Stage checkout authority and skipped preflight transfer' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-workflow-authority-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $ci = Join-Path $repositoryRoot '.github\workflows\ci.yml'
+        $releasePath = Join-Path $root 'release.yml'
+        $raw = [IO.File]::ReadAllText((Join-Path $repositoryRoot '.github\workflows\release.yml'), [Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($releasePath, $raw, [Text.UTF8Encoding]::new($false))
+        Assert-CcodDraftReleaseWorkflowContract -CiPath $ci -ReleasePath $releasePath
+        $mutations = @(
+            [pscustomobject]@{ Name = 'Stage dependency'; From = 'needs: build'; To = 'needs: preflight' }
+            [pscustomobject]@{ Name = 'Stage immutable checkout'; From = 'ref: ${{ needs.build.outputs.commit }}'; To = 'ref: ${{ github.ref }}' }
+            [pscustomobject]@{ Name = 'global write authority'; From = "permissions:`n  contents: read"; To = "permissions:`n  contents: write" }
+            [pscustomobject]@{ Name = 'build write authority'; From = "  build:`n    needs: preflight"; To = "  build:`n    permissions:`n      contents: write`n    needs: preflight" }
+            [pscustomobject]@{ Name = 'Stage write authority absent'; From = '      contents: write'; To = '      contents: read' }
+            [pscustomobject]@{ Name = 'skipped preflight upload'; From = '      - name: Upload immutable clean preflight evidence'; To = "      - name: Upload immutable clean preflight evidence`n        if: false" }
+            [pscustomobject]@{ Name = 'skipped preflight download'; From = '      - name: Download immutable clean preflight evidence'; To = "      - name: Download immutable clean preflight evidence`n        if: false" }
+            [pscustomobject]@{ Name = 'skipped preflight materialization'; From = '      - name: Materialize transferred clean preflight evidence'; To = "      - name: Materialize transferred clean preflight evidence`n        if: false" }
+        )
+        $normalized = $raw.Replace("`r`n", "`n")
+        foreach ($mutation in $mutations) {
+            $changed = $normalized.Replace($mutation.From, $mutation.To)
+            Assert-CcodTrue ($changed -cne $normalized) "$($mutation.Name) mutation reaches the real workflow"
+            [IO.File]::WriteAllText($releasePath, $changed, [Text.UTF8Encoding]::new($false))
+            Assert-CcodThrows { Assert-CcodDraftReleaseWorkflowContract -CiPath $ci -ReleasePath $releasePath } 'CCOD_RELEASE_WORKFLOW_INVALID'
+        }
+    } finally { if ([IO.Directory]::Exists($root)) { [IO.Directory]::Delete($root, $true) } }
+}
+
 Invoke-CcodTask6Test 'workflow-bypass' 'draft workflow contract rejects unpinned actions continue-on-error if-bypass rebuild and missing concurrency' {
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-workflow-' + [guid]::NewGuid().ToString('N'))
     try {
@@ -3334,51 +4021,20 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
 '@
-        $pinnedRelease = @'
-name: fixture release
-concurrency:
-  group: ccod-draft-${{ github.ref }}
-  cancel-in-progress: false
-jobs:
-  preflight:
-    steps:
-      - name: Clean runner
-        shell: pwsh
-        run: Test-CcodCleanReleaseRunner -RepositoryRoot $PWD -ExpectedVersion 2.5.22
-  build:
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
-      - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
-      - name: Build
-        shell: pwsh
-        run: ./build/build.ps1 -Version 2.5.22
-      - name: Upload
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
-  stage:
-    steps:
-      - name: Download
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
-      - name: Stage draft
-        shell: pwsh
-        run: |
-          Import-Module ./tools/ReleaseAssetContract.psm1
-          Get-CcodExpectedReleaseAssetNames -Version 2.5.22
-          Invoke-CcodGitHubDraftRelease -Mode Stage -Tag v2.5.22 -AssetDirectory $PWD -EvidenceDirectory $PWD
-'@
+        $pinnedRelease = [IO.File]::ReadAllText((Join-Path $repositoryRoot '.github/workflows/release.yml'), [Text.UTF8Encoding]::new($false)).Replace("`r`n", "`n")
         [IO.File]::WriteAllText($ciPath, $pinnedCi, [Text.UTF8Encoding]::new($false))
         [IO.File]::WriteAllText($releasePath, $pinnedRelease, [Text.UTF8Encoding]::new($false))
         Assert-CcodDraftReleaseWorkflowContract -CiPath $ciPath -ReleasePath $releasePath
         $invalid = @(
             [pscustomobject]@{ Name = 'unpinned setup-node'; Release = $pinnedRelease.Replace('actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020','actions/setup-node@v4') },
-            [pscustomobject]@{ Name = 'continue-on-error'; Release = $pinnedRelease.Replace('      - name: Clean runner','      - name: Clean runner' + [Environment]::NewLine + '        continue-on-error: true') },
-            [pscustomobject]@{ Name = 'if bypass'; Release = $pinnedRelease.Replace('      - name: Clean runner','      - name: Clean runner' + [Environment]::NewLine + '        if: ${{ false }}') },
-            [pscustomobject]@{ Name = 'missing concurrency'; Release = $pinnedRelease.Replace(('concurrency:' + [Environment]::NewLine + '  group: ccod-draft-${{ github.ref }}' + [Environment]::NewLine + '  cancel-in-progress: false' + [Environment]::NewLine), '') },
+            [pscustomobject]@{ Name = 'continue-on-error'; Release = $pinnedRelease.Replace('      - name: Run clean release runner',"      - name: Run clean release runner`n        continue-on-error: true") },
+            [pscustomobject]@{ Name = 'if bypass'; Release = $pinnedRelease.Replace('      - name: Run clean release runner', '      - name: Run clean release runner' + "`n" + '        if: ${{ false }}') },
+            [pscustomobject]@{ Name = 'missing concurrency'; Release = [regex]::Replace($pinnedRelease, '(?m)^concurrency:\n  group:[^\n]+\n  cancel-in-progress: false\n', '') },
             [pscustomobject]@{ Name = 'rebuild in stage'; Release = $pinnedRelease + [Environment]::NewLine + "        run: ./build/build.ps1 -Version 2.5.22`n" },
-            [pscustomobject]@{ Name = 'extension glob'; Release = $pinnedRelease.Replace('Get-CcodExpectedReleaseAssetNames -Version 2.5.22','Get-ChildItem -File | Where-Object { $_.Extension -in @(''.exe'') }') }
+            [pscustomobject]@{ Name = 'extension glob'; Release = $pinnedRelease.Replace('Get-CcodExpectedReleaseAssetNames -Version $version','Get-ChildItem -File | Where-Object { $_.Extension -in @(''.exe'') }') }
         )
         foreach ($fixture in $invalid) {
+            Assert-CcodTrue ($fixture.Release -cne $pinnedRelease) "$($fixture.Name) mutation changes the workflow"
             [IO.File]::WriteAllText($releasePath, [string]$fixture.Release, [Text.UTF8Encoding]::new($false))
             Assert-CcodThrows { Assert-CcodDraftReleaseWorkflowContract -CiPath $ciPath -ReleasePath $releasePath } 'CCOD_RELEASE_WORKFLOW_INVALID'
         }
@@ -3464,6 +4120,47 @@ Invoke-CcodTask6Test 'fix1-public-module-boundary' 'release workflow imports onl
     }
 }
 
+Invoke-CcodTask6Test 'fix1-fresh-process-module-boundary' 'draft release wrapper exports only its public command in a fresh PowerShell process' {
+    $wrapper = Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.psm1'
+    Assert-CcodTrue (Test-Path -LiteralPath $wrapper -PathType Leaf) 'draft release wrapper exists as a regular file'
+    $escaped = $wrapper.Replace("'", "''")
+    $probe = "`$ErrorActionPreference = 'Stop'; `$ProgressPreference = 'SilentlyContinue'; if ((Get-ExecutionPolicy -Scope Process) -cne 'Undefined' -or -not [string]::IsNullOrEmpty([Environment]::GetEnvironmentVariable('PSExecutionPolicyPreference','Process'))) { exit 24 }; Import-Module '$escaped' -Force; `$public = Get-Command Invoke-CcodGitHubDraftRelease -ErrorAction SilentlyContinue; `$private = Get-Command Invoke-CcodGitHubDraftReleaseCore -ErrorAction SilentlyContinue; if (`$null -eq `$public -or `$null -ne `$private) { exit 23 }; [Console]::WriteLine('CCOD_DRAFT_WRAPPER_POLICY=' + (Get-ExecutionPolicy)); [Console]::WriteLine('CCOD_DRAFT_WRAPPER_OK')"
+    $previous=[Environment]::GetEnvironmentVariable('PSExecutionPolicyPreference','Process')
+    $normalPolicy=$null
+    try {
+        foreach($inherited in @($null,'Bypass','Restricted')) {
+            [Environment]::SetEnvironmentVariable('PSExecutionPolicyPreference',$inherited,'Process')
+            $info=[Diagnostics.ProcessStartInfo]::new()
+            $info.FileName=(Get-Command powershell.exe -CommandType Application -ErrorAction Stop).Source
+            $encoded=[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($probe))
+            $info.Arguments='-NoLogo -NoProfile -NonInteractive -EncodedCommand '+$encoded
+            $info.UseShellExecute=$false;$info.CreateNoWindow=$true
+            $info.RedirectStandardOutput=$true;$info.RedirectStandardError=$true
+            $info.EnvironmentVariables.Remove('PSExecutionPolicyPreference')
+            Assert-CcodTrue (-not$info.EnvironmentVariables.ContainsKey('PSExecutionPolicyPreference')) 'actual child environment excludes the parent policy override'
+            Assert-CcodEqual ('-NoLogo -NoProfile -NonInteractive -EncodedCommand '+$encoded) $info.Arguments 'actual child arguments contain no policy override'
+            $child=[Diagnostics.Process]::new();$child.StartInfo=$info;$started=$false
+            try {
+                $started=$child.Start()
+                Assert-CcodTrue $started 'fresh wrapper process actually starts'
+                $stdout=$child.StandardOutput.ReadToEndAsync();$stderr=$child.StandardError.ReadToEndAsync()
+                Assert-CcodTrue ($child.WaitForExit(60000)) 'fresh wrapper process completes within the timeout'
+                $output=$stdout.GetAwaiter().GetResult();$errorOutput=$stderr.GetAwaiter().GetResult()
+                Assert-CcodEqual 0 $child.ExitCode "fresh PowerShell import uses normal process policy with parent override '$inherited'"
+                Assert-CcodEqual '' $errorOutput 'normal-policy module import has no stderr failure'
+                Assert-CcodTrue $output.Contains('CCOD_DRAFT_WRAPPER_OK') 'fresh PowerShell import exports the expected public command'
+                $policyLines=@($output.Split([char]10)|Where-Object {$_.StartsWith('CCOD_DRAFT_WRAPPER_POLICY=',[StringComparison]::Ordinal)})
+                Assert-CcodEqual 1 $policyLines.Count 'the real child reports exactly one effective policy'
+                $policyValue=$policyLines[0].TrimEnd([char]13).Substring('CCOD_DRAFT_WRAPPER_POLICY='.Length)
+                Assert-CcodTrue (-not[string]::IsNullOrWhiteSpace($policyValue)) 'effective policy is not empty'
+                if($null-eq$normalPolicy){$normalPolicy=$policyValue}else{Assert-CcodEqual $normalPolicy $policyValue 'parent override does not change the actual normal child policy'}
+                Assert-CcodEqual $inherited ([Environment]::GetEnvironmentVariable('PSExecutionPolicyPreference','Process')) 'launch configuration does not mutate the parent environment'
+            } finally {if($started-and-not$child.HasExited){$child.Kill();$child.WaitForExit()};$child.Dispose()}
+        }
+    } finally {[Environment]::SetEnvironmentVariable('PSExecutionPolicyPreference',$previous,'Process')}
+    Assert-CcodEqual $previous ([Environment]::GetEnvironmentVariable('PSExecutionPolicyPreference','Process')) 'test restores its original parent environment'
+}
+
 Invoke-CcodTask6Test 'draft-stage' 'Stage fail-closes missing preflight extra assets upload failure concurrent stage and never promotes' {
     $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools\Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftRelease'
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-draft-' + [guid]::NewGuid().ToString('N'))
@@ -3487,8 +4184,11 @@ Invoke-CcodTask6Test 'draft-stage' 'Stage fail-closes missing preflight extra as
         $preflight = Join-Path $assetFixture.Outside 'CodexRemote-fix-2.5.22-clean-preflight.json'
         $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
         [IO.File]::WriteAllText($preflight, (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
-        $upload = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root -UploadFails
+        $upload = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root -UploadFails -UploadFailurePublishes
         Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $assetFixture.Outside -Adapters $upload.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_UPLOAD_FAILED'
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory 'relative-assets' -EvidenceDirectory $assetFixture.Outside -Adapters $upload.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_ASSET_PATH_INVALID'
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory 'relative-evidence' -Adapters $upload.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID'
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $assetFixture.Outside -NotesPath 'tests/persistence/ReleaseWorkflow.SelfTest.ps1' -Adapters $upload.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_NOTES_INVALID'
         Assert-CcodTrue $upload.State.Created 'upload failure still created a draft'
         Assert-CcodTrue $upload.State.DraftPrivate 'upload failure leaves the draft private'
         Assert-CcodTrue (-not $upload.State.Promoted) 'upload failure never promotes'
@@ -3518,6 +4218,7 @@ Invoke-CcodTask6Test 'draft-verify-promote' 'Verify and Promote cannot rebuild a
         Assert-CcodTrue (-not $verify.State.Created) 'Verify never creates a release'
         Assert-CcodTrue (-not $verify.State.Promoted) 'Verify never promotes'
         $promote = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        [IO.Directory]::CreateDirectory((Join-Path $evidence 'defender')) | Out-Null
         Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Promote -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $promote.Adapters | Out-Null } 'CCOD_RELEASE_PROMOTION_EVIDENCE_INVALID'
         Assert-CcodTrue (-not $promote.State.Promoted) 'missing dual receipt never promotes'
         Assert-CcodTrue (-not $promote.State.Rebuilt) 'Promote never rebuilds'
@@ -3538,6 +4239,59 @@ Invoke-CcodTask6Test 'draft-verify-promote' 'Verify and Promote cannot rebuild a
     }
 }
 
+Invoke-CcodTask6Test 'task9-promote-incomplete' 'Promote rejects the legacy acceptance envelope before changing draft visibility' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools\Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseTask9PromoteIncomplete'
+    $assetFixture = $null
+    $promotion = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $promotion = New-CcodTask5PromotionFixture $assetFixture
+        $defender = Join-Path $promotion.Root 'defender'
+        [IO.Directory]::CreateDirectory($defender) | Out-Null
+        foreach ($name in @($promotion.Names)) {
+            Move-Item -LiteralPath (Join-Path $promotion.Root $name) -Destination (Join-Path $defender $name)
+        }
+        $preflightRecord = [ordered]@{
+            schemaVersion = 1
+            valid = $true
+            version = '2.5.22'
+            gitCommit = [string]$assetFixture.GitCommit
+            repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot)
+        }
+        [IO.File]::WriteAllText(
+            (Join-Path $promotion.Root 'CodexRemote-fix-2.5.22-clean-preflight.json'),
+            (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine),
+            [Text.UTF8Encoding]::new($false))
+        $expected = [string[]]$assetFixture.Names
+        $fixture = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        $fixture.State.Uploaded.AddRange($expected)
+        Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $fixture.Adapters | Out-Null
+        $acceptanceDirectory = Join-Path $promotion.Root 'acceptance'
+        [IO.Directory]::CreateDirectory($acceptanceDirectory) | Out-Null
+        $legacyAcceptance = [ordered]@{
+            schemaVersion = 1
+            kind = 'official-draft-acceptance'
+            version = '2.5.22'
+            gitCommit = [string]$assetFixture.GitCommit
+            candidateManifestSha256 = Get-CcodTestFileSha256 (Join-Path $assetFixture.Root $assetFixture.Names[4])
+            phase = 'Complete'
+            completedAtUtc = '2030-02-03T04:05:07.0000000Z'
+        }
+        [IO.File]::WriteAllText(
+            (Join-Path $acceptanceDirectory 'CodexRemote-fix-2.5.22-official-draft.complete.json'),
+            (($legacyAcceptance | ConvertTo-Json -Depth 8) + [Environment]::NewLine),
+            [Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows {
+            Invoke-CcodTask6DraftCore -Module $module -Mode Promote -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $fixture.Adapters | Out-Null
+        } 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INCOMPLETE'
+        Assert-CcodTrue (-not $fixture.State.Promoted) 'incomplete acceptance never changes draft visibility'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $promotion -and (Test-Path -LiteralPath $promotion.Root)) { Remove-Item -LiteralPath $promotion.Root -Recurse -Force -ErrorAction SilentlyContinue }
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
 Invoke-CcodTask6Test 'fix1-runner-inspection' 'clean runner converts inspection failures into stable fail-closed errors' {
     $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Test-CleanReleaseRunner.ps1') -Name 'CcodCleanReleaseRunnerFix1Inspection'
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-runner-inspection-' + [guid]::NewGuid().ToString('N'))
@@ -3605,7 +4359,7 @@ Invoke-CcodTask6Test 'fix1-preflight-all-modes' 'Verify and Promote require the
         $promote.State.Uploaded.AddRange($expected)
         Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $promote.Adapters | Out-Null
         Remove-Item -LiteralPath $preflightPath -Force
-        $acceptanceRecord = [ordered]@{ schemaVersion = 1; kind = 'official-draft-acceptance'; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; candidateManifestSha256 = Get-CcodTestFileSha256 (Join-Path $assetFixture.Root $assetFixture.Names[4]); phase = 'Complete'; completedAtUtc = '2030-02-03T04:05:07.0000000Z' }
+        $acceptanceRecord = New-CcodTask9AcceptanceRecord -AssetFixture $assetFixture -EvidenceRoot (Get-CcodTask9EvidenceRoot)
         [IO.Directory]::CreateDirectory($acceptanceDirectory) | Out-Null
         [IO.File]::WriteAllText((Join-Path $acceptanceDirectory 'CodexRemote-fix-2.5.22-official-draft.complete.json'), (($acceptanceRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
         Assert-CcodThrows {
@@ -3634,13 +4388,13 @@ Invoke-CcodTask6Test 'fix1-remote-contract' 'Verify rejects null, public, and no
         $publicView = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
         $publicView.State.Uploaded.AddRange([string[]]$expected)
         $publicView.State.DraftPrivate = $false
-        $publicView.Adapters.ViewRelease = { param($Tag) [pscustomobject]@{ Tag = $Tag; Draft = $false; AssetNames = @($expected) } }.GetNewClosure()
+        $publicView.Adapters.ViewRelease = { param($Tag) [pscustomobject][ordered]@{ Tag = $Tag; Id = '123'; Draft = $false; AssetNames = @($expected) } }.GetNewClosure()
         Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $publicView.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_NOT_STAGED'
         $wrongNames = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
         $wrong = @($expected)
         $wrong[0] = 'unexpected-release-asset.zip'
         $wrongNames.State.Uploaded.AddRange([string[]]$wrong)
-        $wrongNames.Adapters.ViewRelease = { param($Tag) [pscustomobject]@{ Tag = $Tag; Draft = $true; AssetNames = @($wrong) } }.GetNewClosure()
+        $wrongNames.Adapters.ViewRelease = { param($Tag) [pscustomobject][ordered]@{ Tag = $Tag; Id = '123'; Draft = $true; AssetNames = @($wrong) } }.GetNewClosure()
         Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $wrongNames.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_ASSET_SET_INVALID'
     } finally {
         Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
@@ -3648,6 +4402,29 @@ Invoke-CcodTask6Test 'fix1-remote-contract' 'Verify rejects null, public, and no
     }
 }
 
+Invoke-CcodTask6Test 'fix1-verify-final-remote-lineage' 'Verify rechecks private draft identity and tag commit after the last asset download' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1VerifyFinalLineage'
+    $assetFixture = $null;$evidence = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture;$evidence = $assetFixture.Outside
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $evidence 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $expected = [string[]]$assetFixture.Names;$remoteRoot = Join-Path $assetFixture.Outside 'verify-remote-assets';[IO.Directory]::CreateDirectory($remoteRoot) | Out-Null
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root;$state = $draft.State;$state.Uploaded.AddRange($expected);$state | Add-Member -NotePropertyName DownloadCount -NotePropertyValue 0
+        $draft.Adapters.ViewRelease = { param($Tag) [pscustomobject][ordered]@{ Tag = $Tag; Id = [string]$state.DraftId; Draft = [bool]$state.DraftPrivate; AssetNames = @($state.Uploaded) } }.GetNewClosure()
+        $draft.Adapters.DownloadAsset = { param($Tag,$Name,$Destination) [IO.File]::Copy((Join-Path $assetFixture.Root $Name),$Destination,$true);$state.DownloadCount++ }.GetNewClosure()
+        $verificationPath = & $module {param($Evidence) Get-CcodGitHubDraftVerificationPath -EvidenceDirectory $Evidence -Version '2.5.22'} $evidence
+        $control=Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $draft.Adapters
+        Assert-CcodEqual $verificationPath $control.VerificationPath 'absence probe points at the proven real publisher destination'
+        Assert-CcodTrue ([IO.File]::Exists($verificationPath)) 'success control materializes the exact target before absence checks'
+        [IO.File]::Delete($verificationPath);$state.DownloadCount=0
+        $draft.Adapters.DownloadAsset = { param($Tag,$Name,$Destination) [IO.File]::Copy((Join-Path $assetFixture.Root $Name),$Destination,$true);$state.DownloadCount++;if($state.DownloadCount -eq $expected.Count){$state.DraftPrivate=$false} }.GetNewClosure()
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $draft.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID'
+        Assert-CcodEqual $expected.Count $state.DownloadCount 'Verify downloaded every asset before the final remote recheck'
+        Assert-CcodTrue (-not [IO.File]::Exists($verificationPath)) 'Verify does not publish evidence after a final remote identity drift'
+    } finally { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue;if($null -ne $assetFixture){Remove-CcodTask5ExactAssetFixture $assetFixture} }
+}
+
 Invoke-CcodTask6Test 'fix1-github-boundary' 'draft release operations are bound to the official Actions repository without an environment bypass' {
     $draftPath = Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1'
     $releasePath = Join-Path $repositoryRoot '.github/workflows/release.yml'
@@ -3656,7 +4433,9 @@ Invoke-CcodTask6Test 'fix1-github-boundary' 'draft release operations are bound
     Assert-CcodTrue (-not ($draftRaw + $releaseRaw).Contains('CCOD_ALLOW_GITHUB_RELEASE')) 'live GitHub operations have no caller-controlled override'
     Assert-CcodTrue ($draftRaw.Contains('naipi11/CodexRemote-fix')) 'GitHub target repository is explicit'
     Assert-CcodTrue ($draftRaw.Contains('GITHUB_SERVER_URL') -and $draftRaw.Contains('GITHUB_RUN_ID') -and $draftRaw.Contains('GH_TOKEN')) 'default GitHub adapter checks the Actions context'
+    Assert-CcodTrue ($draftRaw.Contains("GITHUB_RUN_ID -notmatch '^[1-9][0-9]*\z'")) 'Actions run IDs use an absolute end anchor'
     Assert-CcodTrue ($draftRaw.Contains('$value.isDraft -isnot [bool]')) 'default GitHub adapter rejects non-boolean draft state'
+    Assert-CcodTrue ($draftRaw.Contains("'tagName,isDraft,databaseId,assets'")) 'default GitHub adapter requests a stable draft database identity'
     Assert-CcodTrue ($draftRaw.Contains('$json -join [Environment]::NewLine')) 'default GitHub adapter parses the complete multi-line JSON response'
     $ghLines = @($draftRaw -split "`r?`n" | Where-Object { $_ -match '& gh ' })
     Assert-CcodTrue ($ghLines.Count -gt 0) 'default adapter has explicit GitHub operations'
@@ -3677,7 +4456,7 @@ Invoke-CcodTask6Test 'fix1-local-promote-context' 'authenticated local draft rea
     $saved = @{}
     try {
         [IO.Directory]::CreateDirectory($fakeRoot) | Out-Null
-        [IO.File]::WriteAllText($fakeGh, "@echo off`r`nif `"%1`"==`"release`" if `"%2`"==`"view`" (`r`n  echo {`"isDraft`":true,`"assets`":[]}`r`n)`r`nexit /b 0`r`n", [Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText($fakeGh, "@echo off`r`nif `"%1`"==`"release`" if `"%2`"==`"view`" (`r`n  echo {`"tagName`":`"v2.5.22`",`"isDraft`":true,`"databaseId`":123,`"assets`":[]}`r`n)`r`nexit /b 0`r`n", [Text.UTF8Encoding]::new($false))
         foreach ($name in @('GITHUB_ACTIONS','GITHUB_SERVER_URL','GITHUB_REPOSITORY','GITHUB_RUN_ID','GH_TOKEN','Path')) { $saved[$name] = [Environment]::GetEnvironmentVariable($name, 'Process') }
         Remove-Item Env:GITHUB_ACTIONS,Env:GITHUB_SERVER_URL,Env:GITHUB_REPOSITORY,Env:GITHUB_RUN_ID -ErrorAction SilentlyContinue
         $env:GH_TOKEN = 'x'
@@ -3714,6 +4493,75 @@ Invoke-CcodTask6Test 'fix1-pwsh-schema-version' 'preflight schemaVersion accepts
     }
 }
 
+Invoke-CcodTask6Test 'fix1-release-contract-int64-numeric-fields' 'release Defender receipts accept the Int64 numeric representation emitted by PowerShell Core' {
+    $module = Import-Module $assetContractPath -Force -PassThru -ErrorAction Stop
+    $version = '2.5.22'
+    $commit = 'c' * 40
+    $names = @(&$module { param($Version) Get-CcodExpectedReleaseAssetNames -Version $Version } $version)
+    $scanStart = [datetime]::UtcNow.AddMinutes(-1)
+    $timestamp = $scanStart.ToString('o')
+    $completedTimestamp = $scanStart.AddSeconds(1).ToString('o')
+    $receipt = [pscustomobject][ordered]@{
+        schemaVersion = [int64]2
+        assetType = 'PortableZip'
+        assetName = $names[0]
+        assetSha256 = '0' * 64
+        checksumName = $names[1]
+        checksumSha256 = '1' * 64
+        manifestName = $names[4]
+        manifestSha256 = '2' * 64
+        version = $version
+        gitCommit = $commit
+        origin = 'InternetDownload'
+        workflowArtifactIdentity = $null
+        zoneId = [int64]3
+        defenderServiceEnabled = $true
+        antivirusEnabled = $true
+        realTimeProtectionEnabled = $true
+        defenderPlatformVersion = 'fixture-platform'
+        defenderEngineVersion = 'fixture-engine'
+        signatureVersion = 'fixture-signature'
+        signatureUpdatedAtUtc = $timestamp
+        scanStartedAtUtc = $timestamp
+        scanCompletedAtUtc = $completedTimestamp
+        detectionCount = [int64]0
+        outcome = 'Completed'
+        errorCode = $null
+    }
+    $raw = $receipt | ConvertTo-Json -Compress -Depth 8
+    try {
+        $validated = &$module { param($Receipt,$Raw,$Version,$Commit,$Names) Test-CcodReleasePromotionReceipt -Receipt $Receipt -Raw $Raw -Path 'fixture-receipt.json' -AssetType 'PortableZip' -Version $Version -GitCommit $Commit -AssetNames $Names } $receipt $raw $version $commit $names
+        Assert-CcodEqual 2 ([long]$validated.schemaVersion) 'PowerShell Core Int64 Defender receipt schemaVersion is accepted'
+        Assert-CcodEqual 3 ([long]$validated.zoneId) 'PowerShell Core Int64 Defender receipt zoneId is accepted'
+        Assert-CcodEqual 0 ([long]$validated.detectionCount) 'PowerShell Core Int64 Defender receipt detectionCount is accepted'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-release-manifest-int64-dispatch' 'release manifests dispatch Int64 schemaVersion values to the portable validator' {
+    $module = Import-Module $assetContractPath -Force -PassThru -ErrorAction Stop
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-manifest-dispatch-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $manifestPath = Join-Path $root 'manifest.json'
+        [IO.File]::WriteAllText($manifestPath, '{}', [Text.UTF8Encoding]::new($false))
+        $global:CcodReleaseManifestDispatchValue = [pscustomobject][ordered]@{ schemaVersion = [int64]2 }
+        $global:CcodReleaseManifestDispatchMarker = $null
+        &$module {
+            Set-Item Function:Read-CcodReleaseContractJson -Value { param($Path,$ErrorId) [pscustomobject]@{ Raw = '{}'; Value = $global:CcodReleaseManifestDispatchValue } }
+            Set-Item Function:Test-CcodReleasePortableManifestDeep -Value { param($Manifest,$ManifestRaw,$ManifestPath,$Directory,$Version,$ErrorId) $global:CcodReleaseManifestDispatchMarker = 'portable'; [pscustomobject]@{ Marker = 'portable' } }
+        }
+        $result = &$module { param($ManifestPath,$AssetDirectory) Test-CcodReleaseAssetManifest -ManifestPath $ManifestPath -AssetDirectory $AssetDirectory -ExpectedVersion '2.5.22' } $manifestPath $root
+        Assert-CcodEqual 'portable' ([string]$result.Marker) 'Int64 schemaVersion dispatches to the portable manifest validator'
+        Assert-CcodEqual 'portable' ([string]$global:CcodReleaseManifestDispatchMarker) 'portable dispatch marker is reached'
+    } finally {
+        Remove-Variable -Name CcodReleaseManifestDispatchValue,CcodReleaseManifestDispatchMarker -Scope Global -ErrorAction SilentlyContinue
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
 Invoke-CcodTask6Test 'fix1-preflight-root-canonical' 'preflight rejects drive-relative repository roots' {
     $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1PreflightRoot'
     $path = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-preflight-root-' + [guid]::NewGuid().ToString('N') + '.json')
@@ -3805,72 +4653,1039 @@ Invoke-CcodTask6Test 'fix1-create-private-readback' 'Stage confirms the newly cr
     }
 }
 
-Invoke-CcodTask6Test 'fix1-post-promote-readback' 'Promote re-downloads and re-hashes public assets after changing draft visibility' {
-    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1PostPromote'
+Invoke-CcodTask6Test 'fix1-stage-readback-private-recovery' 'Stage reasserts private visibility when post-upload asset readback fails' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1StageReadback'
     $assetFixture = $null
-    $promotion = $null
-    $remoteRoot = $null
     try {
         $assetFixture = New-CcodTask5ExactAssetFixture
-        $promotion = New-CcodTask5PromotionFixture $assetFixture
-        $defender = Join-Path $promotion.Root 'defender'
-        $acceptanceDirectory = Join-Path $promotion.Root 'acceptance'
-        [IO.Directory]::CreateDirectory($defender) | Out-Null
-        foreach ($name in @($promotion.Names)) { Move-Item -LiteralPath (Join-Path $promotion.Root $name) -Destination (Join-Path $defender $name) }
+        $evidence = $assetFixture.Outside
         $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
-        [IO.File]::WriteAllText((Join-Path $promotion.Root 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
-        $expected = [string[]]$assetFixture.Names
-        $remoteRoot = Join-Path $assetFixture.Outside 'remote-assets'
-        [IO.Directory]::CreateDirectory($remoteRoot) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $evidence 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root -ReadbackFails -ReadbackFailurePublishes
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $draft.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_READBACK_FAILED'
+        Assert-CcodTrue $draft.State.DraftPrivate 'post-upload readback failure restores private draft visibility'
+        Assert-CcodTrue (-not $draft.State.Promoted) 'post-upload readback failure never promotes'
+        $viewCalls = @($draft.State.Calls | Where-Object { $_ -eq 'ViewRelease' })
+        Assert-CcodTrue ($viewCalls.Count -ge 3) 'post-upload readback failure performs a recovery state readback'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-stage-final-private-readback' 'Stage rejects a visibility change after the final asset readback' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1StageFinalPrivate'
+    $assetFixture = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $evidence = $assetFixture.Outside
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $evidence 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
         $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
-        $state = $draft.State
-        $draft.Adapters.UploadAsset = {
-            param($Tag, $Name, $Path)
-            [IO.File]::Copy($Path, (Join-Path $remoteRoot $Name), $true)
-            $state.Uploaded.Add($Name)
-        }.GetNewClosure()
         $draft.Adapters.DownloadAsset = {
             param($Tag, $Name, $Destination)
-            [IO.File]::Copy((Join-Path $remoteRoot $Name), $Destination, $true)
-        }.GetNewClosure()
-        Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
-        Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
-        $acceptanceRecord = [ordered]@{ schemaVersion = 1; kind = 'official-draft-acceptance'; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; candidateManifestSha256 = Get-CcodTestFileSha256 (Join-Path $assetFixture.Root $assetFixture.Names[4]); phase = 'Complete'; completedAtUtc = '2030-02-03T04:05:07.0000000Z' }
-        [IO.Directory]::CreateDirectory($acceptanceDirectory) | Out-Null
-        [IO.File]::WriteAllText((Join-Path $acceptanceDirectory 'CodexRemote-fix-2.5.22-official-draft.complete.json'), (($acceptanceRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
-        $draft.Adapters.SetReleaseDraftState = {
-            param($Tag, [bool]$Draft)
-            $state.DraftPrivate = $Draft
-            $state.Promoted = -not $Draft
-            if (-not $Draft) { [IO.File]::WriteAllText((Join-Path $remoteRoot $expected[0]), 'post-promotion-mutated', [Text.UTF8Encoding]::new($false)) }
+            [IO.File]::Copy((Join-Path $assetFixture.Root $Name), $Destination, $true)
+            $draft.State.DraftPrivate = $false
         }.GetNewClosure()
-        Assert-CcodThrows {
-            Invoke-CcodTask6DraftCore -Module $module -Mode Promote -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
-        } 'CCOD_GITHUB_DRAFT_PROMOTE_READBACK_FAILED'
-        Assert-CcodTrue $state.Promoted 'post-promotion byte mismatch is detected after visibility changed'
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $draft.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_NOT_STAGED'
+        Assert-CcodTrue $draft.State.DraftPrivate 'final stage private readback restores visibility before returning failure'
+        Assert-CcodTrue (-not $draft.State.Promoted) 'final stage visibility drift never promotes'
     } finally {
         Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
-        if ($null -ne $promotion -and (Test-Path -LiteralPath $promotion.Root)) { Remove-Item -LiteralPath $promotion.Root -Recurse -Force -ErrorAction SilentlyContinue }
         if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
     }
 }
 
-Invoke-CcodTask6Test 'fix1-stage-lock' 'default Stage lock serializes same-tag processes and releases after the operation' {
-    $scriptPath = Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1'
-    $ready = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-lock-ready-' + [guid]::NewGuid().ToString('N'))
-    $release = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-lock-release-' + [guid]::NewGuid().ToString('N'))
-    $job = $null
-    $secondModule = $null
+Invoke-CcodTask6Test 'fix1-stage-final-tag-binding' 'Stage checks the remote tag commit after the final asset upload' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1StageFinalTag'
+    $assetFixture = $null
     try {
-        $job = Start-Job -ArgumentList $scriptPath, $ready, $release -ScriptBlock {
-            param($Path, $ReadyPath, $ReleasePath)
-            $text = [IO.File]::ReadAllText($Path, [Text.UTF8Encoding]::new($false))
-            $module = New-Module -Name ('CcodLockHolder-' + [guid]::NewGuid().ToString('N')) -ScriptBlock ([scriptblock]::Create($text))
-            Import-Module $module -Force -DisableNameChecking | Out-Null
-            $held = [bool](&$module { $adapters = Get-CcodGitHubDraftReleaseDefaultAdapters; & $adapters.AcquireStageLock 'v2.5.22' })
-            if (-not $held) { throw 'CCOD_TEST_LOCK_HOLDER_FAILED' }
-            [IO.File]::WriteAllText($ReadyPath, 'held', [Text.UTF8Encoding]::new($false))
-            while (-not [IO.File]::Exists($ReleasePath)) { Start-Sleep -Milliseconds 25 }
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $evidence = $assetFixture.Outside
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $evidence 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        $state = $draft.State
+        $state | Add-Member -NotePropertyName FinalTagDriftObserved -NotePropertyValue $false
+        $expectedNames = [string[]]$assetFixture.Names
+        $draft.Adapters.GetTagCommit = {
+            param($Tag, [bool]$ActionsOnly)
+            if ($state.Uploaded.Count -ge $expectedNames.Count) { $state.FinalTagDriftObserved = $true; return 'd' * 40 }
+            return 'c' * 40
+        }.GetNewClosure()
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $draft.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_UPLOAD_FAILED'
+        Assert-CcodEqual $expectedNames.Count $state.Uploaded.Count 'all fixture assets were uploaded before the final tag change'
+        Assert-CcodTrue $state.FinalTagDriftObserved 'Stage actually reaches and rejects the final tag-commit observation'
+        Assert-CcodTrue $draft.State.DraftPrivate 'final tag mismatch keeps the draft private'
+        Assert-CcodTrue (-not $draft.State.Promoted) 'final tag mismatch never promotes'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-default-adapter-property-order' 'Default GitHub adapter readbacks preserve the strict remote-view property order' {
+    $source = [IO.File]::ReadAllText((Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1'))
+    Assert-CcodTrue ($source.Contains('[pscustomobject][ordered]@{ Tag = $Tag; Id = $id; Draft = $true; AssetNames = @() }')) 'CreateDraft returns an ordered remote view object'
+    Assert-CcodTrue ($source.Contains('[pscustomobject][ordered]@{ Tag = [string]$value.tagName; Id = $id; Draft = $value.isDraft; AssetNames = [string[]]$assetNames }')) 'ViewRelease returns an ordered remote view object'
+}
+
+Invoke-CcodTask6Test 'fix1-stage-private-recovery-validates-view-before-mutation' 'Stage private recovery validates the bound release identity before changing visibility' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1StageRecoveryView'
+    $assetFixture = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        $state = $draft.State
+        $state | Add-Member -NotePropertyName PrivateSetCalls -NotePropertyValue 0
+        $state.DraftPrivate = $false
+        $draft.Adapters.ViewRelease = {
+            param($Tag)
+            [pscustomobject][ordered]@{ Tag = $Tag; Id = [string]$state.DraftId; Draft = [bool]$state.DraftPrivate; AssetNames = @('unexpected.bin') }
+        }.GetNewClosure()
+        $draft.Adapters.SetReleaseDraftState = {
+            param($Tag, [bool]$Draft)
+            if ($Draft) { $state.PrivateSetCalls++ }
+            $state.DraftPrivate = $Draft
+        }.GetNewClosure()
+        & $module {param($Adapters) Restore-CcodGitHubDraftStagePrivateState -Adapters $Adapters -Tag 'v2.5.22' -Version '2.5.22' -DraftId '123' -ExpectedGitCommit ('c'*40)} $draft.Adapters
+        Assert-CcodTrue $state.DraftPrivate 'same-ID control hides unexpected content before mutating only the release ID'
+        $state.PrivateSetCalls = 0
+        $state.DraftPrivate = $false
+        $state.DraftId = '999'
+        Assert-CcodThrows {
+            &$module {
+                param($Adapters)
+                Restore-CcodGitHubDraftStagePrivateState -Adapters $Adapters -Tag 'v2.5.22' -Version '2.5.22' -DraftId '123' -ExpectedGitCommit ('c' * 40)
+            } $draft.Adapters
+        } 'CCOD_GITHUB_DRAFT_UPLOAD_PRIVATE_RECOVERY_FAILED'
+        Assert-CcodEqual 0 $state.PrivateSetCalls 'stage recovery does not mutate an invalid release view'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-acceptance-module-import-path-safety' 'Acceptance validator import is guarded by plain-file and reparse ancestry validation' {
+    $toolPath = Join-Path $repositoryRoot 'tools\Invoke-GitHubDraftRelease.ps1'
+    $source = [IO.File]::ReadAllText($toolPath, [Text.UTF8Encoding]::new($false))
+    Assert-CcodTrue ($source.Contains('Assert-CcodGitHubDraftTrustedModulePath -Path $acceptanceModulePath -Directory $false')) 'acceptance import uses the complete trusted ancestry validator'
+    $module = Import-CcodTask6ToolModule -Path $toolPath -Name 'CcodGitHubDraftTrustedModulePath'
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-trusted-module-' + [guid]::NewGuid().ToString('N'))
+    $link = Join-Path $root 'redirected'
+    try {
+        $modules = Join-Path $root 'plain\modules'
+        [IO.Directory]::CreateDirectory($modules) | Out-Null
+        $plain = Join-Path $modules 'validator.psm1'
+        [IO.File]::WriteAllText($plain, '# inert module path fixture', [Text.UTF8Encoding]::new($false))
+        $validated = &$module { param($Path) Assert-CcodGitHubDraftTrustedModulePath -Path $Path -Directory $false } $plain
+        Assert-CcodEqual $plain $validated 'regular module with plain ancestry is accepted'
+        New-Item -ItemType Junction -Path $link -Target (Join-Path $root 'plain') | Out-Null
+        Assert-CcodThrows {
+            &$module { param($Path) Assert-CcodGitHubDraftTrustedModulePath -Path $Path -Directory $false } (Join-Path $link 'modules\validator.psm1') | Out-Null
+        } 'CCOD_GITHUB_DRAFT_CONTRACT_MISSING'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ([IO.Directory]::Exists($link)) { [IO.Directory]::Delete($link, $false) }
+        if ([IO.Directory]::Exists($root)) { [IO.Directory]::Delete($root, $true) }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-create-attempt-recovery' 'Stage records the create attempt before invoking remote draft creation' {
+    $source = [IO.File]::ReadAllText((Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1'), [Text.UTF8Encoding]::new($false))
+    Assert-CcodTrue ($source.Contains('$createAttempted = $true')) 'Stage records remote create before the adapter call'
+    Assert-CcodTrue ($source.Contains('if ($created -or $createAttempted)')) 'Stage recovery covers a create adapter failure after remote mutation'
+}
+
+Invoke-CcodTask6Test 'fix1-create-attempt-tag-identity' 'Stage rejects ambiguous creation without changing visibility of an unowned release' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1CreateAttemptTagIdentity'
+    $assetFixture = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $evidence = $assetFixture.Outside
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $evidence 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        $state = $draft.State
+        $state | Add-Member -NotePropertyName SetCalls -NotePropertyValue 0
+        $draft.Adapters.CreateDraft = {
+            param($Tag, $Title, $Notes)
+            $state.Created = $true
+            $state.DraftPrivate = $false
+            throw 'create failed after remote mutation'
+        }.GetNewClosure()
+        $draft.Adapters.GetTagCommit = { param($Tag, [bool]$ActionsOnly) if ($state.Created) { 'd' * 40 } else { 'c' * 40 } }.GetNewClosure()
+        $draft.Adapters.SetReleaseDraftState = {
+            param($Tag, [bool]$Draft)
+            $state.SetCalls++
+            $state.DraftPrivate = $Draft
+        }.GetNewClosure()
+        Assert-CcodThrows {
+            Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $draft.Adapters | Out-Null
+        } 'CCOD_GITHUB_DRAFT_CREATE_AMBIGUOUS'
+        Assert-CcodTrue $state.Created 'fixture reaches creation before returning an ambiguous failure'
+        Assert-CcodEqual 0 $state.SetCalls 'ambiguous creation never gains authority to mutate release visibility'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-stage-private-recovery-tag-identity' 'Stage private recovery contains a bound draft when its tag commit drifts' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1StageRecoveryTagIdentity'
+    $assetFixture = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $evidence = $assetFixture.Outside
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $evidence 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        $state = $draft.State
+        $state | Add-Member -NotePropertyName UploadAttempted -NotePropertyValue $false
+        $state | Add-Member -NotePropertyName SetCalls -NotePropertyValue 0
+        $draft.Adapters.GetTagCommit = { param($Tag, [bool]$ActionsOnly) if ($state.UploadAttempted) { 'd' * 40 } else { 'c' * 40 } }.GetNewClosure()
+        $draft.Adapters.UploadAsset = {
+            param($Tag, $Name, $Path)
+            $state.UploadAttempted = $true
+            $state.DraftPrivate = $false
+            throw 'upload failed after remote mutation'
+        }.GetNewClosure()
+        $draft.Adapters.SetReleaseDraftState = {
+            param($Tag, [bool]$Draft, $ExpectedReleaseId)
+            if ($ExpectedReleaseId -cne '123') { throw 'stage recovery ID was not bound' }
+            $state.SetCalls++
+            $state.DraftPrivate = $Draft
+        }.GetNewClosure()
+        Assert-CcodThrows {
+            Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $draft.Adapters | Out-Null
+        } 'CCOD_GITHUB_DRAFT_UPLOAD_FAILED'
+        Assert-CcodEqual 1 $state.SetCalls 'created-draft recovery hides the same release despite tag drift'
+        Assert-CcodTrue $state.DraftPrivate 'a failed Stage is not left public'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-manual-proof-canonical-timestamp' 'Release promotion rejects noncanonical tray and remote proof timestamps' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1ManualProofTimestamp'
+    try {
+        $tray = [pscustomobject][ordered]@{ timestampUtc = '2030-02-03T04:05:06+00:00'; command = 'ShowAbout'; revision = [long]1; code = 'CCOD_TRAY_ACTION_COMPLETED'; status = 'Completed' }
+        $remote = [pscustomobject][ordered]@{
+            schemaVersion = 1; timestampUtc = '2030-02-03T04:05:06+00:00'; kind = 'remote-control-manual-proof'; operation = 'SecondDeviceControl'; deviceRole = 'SecondDevice'; challenge = 'run-1'; candidateVersion = '2.5.22'; runtimeId = 'runtime-2.5.22'; runtimeGeneration = [long]2; runtimeManifestSha256 = ('d' * 64); attestation = 'HumanReviewedStructuredAttestation'; connection = 'Connected'; control = 'Completed'; outcome = 'Completed'; code = 'CCOD_REMOTE_ACTION_COMPLETED'
+        }
+        $trayControl=$tray.PSObject.Copy();$trayControl.timestampUtc='2030-02-03T04:05:06.0000000Z'
+        $remoteControl=$remote.PSObject.Copy();$remoteControl.timestampUtc='2030-02-03T04:05:06.0000000Z'
+        Assert-CcodTrue (&$module {param($Proof)Test-CcodGitHubDraftManualProof -Proof $Proof -Index 0 -Version '2.5.22'} $trayControl) 'canonical tray proof is accepted before mutating only its timestamp'
+        Assert-CcodTrue (&$module {param($Proof)Test-CcodGitHubDraftManualProof -Proof $Proof -Index 4 -Version '2.5.22'} $remoteControl) 'canonical remote proof is accepted before mutating only its timestamp'
+        $trayValid = &$module { param($Proof) Test-CcodGitHubDraftManualProof -Proof $Proof -Index 0 -Version '2.5.22' } $tray
+        $remoteValid = &$module { param($Proof) Test-CcodGitHubDraftManualProof -Proof $Proof -Index 4 -Version '2.5.22' } $remote
+        Assert-CcodTrue (-not [bool]$trayValid -and -not [bool]$remoteValid) 'release manual proof validator rejects offset timestamps'
+        $canonical=&$module {${function:Test-CcodGitHubDraftCanonicalUtc}}
+        try {
+            &$module {Set-Item -LiteralPath Function:script:Test-CcodGitHubDraftCanonicalUtc -Value {param($Value)return $true}}
+            Assert-CcodTrue (&$module {param($Proof)Test-CcodGitHubDraftManualProof -Proof $Proof -Index 0 -Version '2.5.22'} $tray) 'removing only the timestamp guard makes the otherwise-valid tray negative pass'
+            Assert-CcodTrue (&$module {param($Proof)Test-CcodGitHubDraftManualProof -Proof $Proof -Index 4 -Version '2.5.22'} $remote) 'removing only the timestamp guard makes the otherwise-valid remote negative pass'
+        } finally {&$module {param($Original)Set-Item -LiteralPath Function:script:Test-CcodGitHubDraftCanonicalUtc -Value $Original} $canonical}
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+    }
+}
+
+Invoke-CcodTask6Test 'review2-stage-held-upload' 'Stage uploads only originally validated frozen bytes through readback' {
+    $module=Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodStageHeldUpload'
+    $fixture=$null
+    try {
+        $fixture=New-CcodTask5ExactAssetFixture
+        $originals=@{};foreach($name in $fixture.Names){$originals[$name]=[IO.File]::ReadAllBytes((Join-Path $fixture.Root $name))}
+        foreach($mode in @('Clean','AtUpload','AtReadback')) {
+            $evidence=Join-Path $fixture.Outside $mode;[IO.Directory]::CreateDirectory($evidence)|Out-Null
+            Write-CcodTask5Json -Path (Join-Path $evidence 'CodexRemote-fix-2.5.22-clean-preflight.json') -Value ([ordered]@{schemaVersion=1;valid=$true;version='2.5.22';gitCommit=$fixture.GitCommit;repositoryRoot=[IO.Path]::GetFullPath($repositoryRoot)})
+            $draft=New-CcodTask6DraftAdapterFixture -AssetDirectory $fixture.Root;$state=$draft.State
+            $probe=[pscustomobject]@{Attempts=0;Blocked=0;Remote=@{};Frozen=$null;ReadCount=0}
+            $draft.Adapters.UploadAsset={
+                param($Tag,$Name,$Path)
+                $probe.Frozen=Split-Path -Parent $Path
+                if($mode-ceq'AtUpload'-and$Name-ceq$fixture.Names[0]){
+                    $probe.Attempts++
+                    try{[IO.File]::WriteAllText($Path,'replacement-before-native-upload')}catch [IO.IOException]{$probe.Blocked++}
+                }
+                $probe.Remote[$Name]=[IO.File]::ReadAllBytes($Path);$state.Uploaded.Add($Name)
+            }.GetNewClosure()
+            $draft.Adapters.DownloadAsset={
+                param($Tag,$Name,$Destination)
+                $probe.ReadCount++
+                if($mode-ceq'AtReadback'-and$probe.ReadCount-eq1){
+                    $probe.Attempts++
+                    try{[IO.File]::WriteAllText((Join-Path $probe.Frozen $Name),'replacement-before-readback');$probe.Remote[$Name]=[IO.File]::ReadAllBytes((Join-Path $probe.Frozen $Name))}catch [IO.IOException]{$probe.Blocked++}
+                }
+                [IO.File]::WriteAllBytes($Destination,[byte[]]$probe.Remote[$Name])
+            }.GetNewClosure()
+            $result=Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $fixture.Root -EvidenceDirectory $evidence -Adapters $draft.Adapters
+            Assert-CcodTrue $result.Draft 'the isolated adapter keeps publication private'
+            Assert-CcodEqual $fixture.Names.Count $probe.ReadCount 'every uploaded byte set is read from the simulated remote, not the original directory'
+            foreach($name in $fixture.Names){Assert-CcodEqual ([Convert]::ToBase64String($originals[$name])) ([Convert]::ToBase64String($probe.Remote[$name])) 'uploaded bytes retain the independently captured original identity'}
+            if($mode-cne'Clean'){Assert-CcodEqual 1 $probe.Attempts 'one mutation reaches consumption';Assert-CcodEqual 1 $probe.Blocked 'held authority blocks the attempted changed bytes'}
+            Assert-CcodTrue (-not[IO.Directory]::Exists($probe.Frozen)) 'owned frozen directory is removed after all held files are released'
+        }
+    } finally {Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue;if($null-ne$fixture){Remove-CcodTask5ExactAssetFixture $fixture}}
+}
+
+Invoke-CcodTask6Test 'review2-native-commit-shape' 'native tag commits remain one exact lowercase scalar without repairing output' {
+    $module=Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodNativeCommitShape'
+    $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-native-commit-'+[guid]::NewGuid().ToString('N'))
+    $fakeGh=Join-Path $root 'gh.cmd';$acceptedInvalid=[Collections.Generic.List[string]]::new()
+    try {
+        [IO.Directory]::CreateDirectory($root)|Out-Null
+        & $module {
+            param($Path)
+            $script:CcodCommitGh=$Path
+            Set-Item Function:script:Assert-CcodGitHubDraftAuthenticatedContext -Value {param($Tag)}
+            Set-Item Function:script:Assert-CcodGitHubDraftActionsContext -Value {param($Tag)}
+            Set-Alias -Name gh -Value $Path -Scope Script
+        } $fakeGh
+        foreach($mode in @('Valid','Split','Whitespace','Uppercase','BlankBefore','BlankAfter','Duplicate','Empty','ExitFailure')) {
+            $lines=switch($mode) {
+                'Valid' {@('echo('+('c'*40))}
+                'Split' {@(('echo('+('c'*20)),('echo('+('c'*20)))}
+                'Whitespace' {@('echo( '+('c'*40)+' ')}
+                'Uppercase' {@('echo('+('C'*40))}
+                'BlankBefore' {@('echo(',('echo('+('c'*40)))}
+                'BlankAfter' {@(('echo('+('c'*40)),'echo(')}
+                'Duplicate' {@(('echo('+('c'*40)),('echo('+('c'*40)))}
+                'Empty' {@()}
+                'ExitFailure' {@('echo('+('c'*40))}
+            }
+            $exitValue=if($mode-ceq'ExitFailure'){3}else{0}
+            [IO.File]::WriteAllText($fakeGh,(@('@echo off')+@($lines)+@('exit /b '+$exitValue)-join"`r`n")+"`r`n",[Text.UTF8Encoding]::new($false))
+            foreach($actionsOnly in @($false,$true)) {
+                $failure=$null;$value=$null
+                try{$value=&$module {param($Actions) Get-CcodGitHubDraftTagCommit -Tag 'v2.5.22' -ActionsOnly $Actions} $actionsOnly}catch{$failure=$_.FullyQualifiedErrorId}
+                if($mode-ceq'Valid') {
+                    Assert-CcodEqual $null $failure 'ordinary native newline termination is accepted'
+                    Assert-CcodEqual ('c'*40) $value 'one canonical native SHA is returned unchanged'
+                } elseif($null-eq$failure){$acceptedInvalid.Add($mode+':'+$actionsOnly)}
+                else{Assert-CcodTrue ($failure-like'CCOD_GITHUB_DRAFT_TAG_COMMIT_FAILED*') 'invalid native commit uses the specific failure'}
+            }
+        }
+        Assert-CcodEqual '' ($acceptedInvalid-join',') 'no multi-line or noncanonical native SHA is repaired into acceptance'
+    } finally {Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue;if([IO.Directory]::Exists($root)){[IO.Directory]::Delete($root,$true)}}
+}
+
+Invoke-CcodTask6Test 'review2-final-commit-shape' 'Verify never repairs a malformed tag SHA before or after receipt publication' {
+    $module=Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodFinalCommitShape'
+    $fixture=$null
+    try {
+        $fixture=New-CcodTask5ExactAssetFixture
+        foreach($mode in @('Valid','Whitespace','Uppercase','PostPublication')) {
+            $evidence=Join-Path $fixture.Outside $mode;[IO.Directory]::CreateDirectory($evidence)|Out-Null
+            Write-CcodTask5Json -Path (Join-Path $evidence 'CodexRemote-fix-2.5.22-clean-preflight.json') -Value ([ordered]@{schemaVersion=1;valid=$true;version='2.5.22';gitCommit=$fixture.GitCommit;repositoryRoot=[IO.Path]::GetFullPath($repositoryRoot)})
+            $path=&$module {param($Root) Get-CcodGitHubDraftVerificationPath -EvidenceDirectory $Root -Version '2.5.22'} $evidence
+            $draft=New-CcodTask6DraftAdapterFixture -AssetDirectory $fixture.Root;$state=$draft.State
+            $state.Uploaded.AddRange([string[]]$fixture.Names)
+            $probe=[pscustomobject]@{Downloads=0;Injected=0;PublicationSeen=$false}
+            $draft.Adapters.DownloadAsset={param($Tag,$Name,$Destination)[IO.File]::Copy((Join-Path $fixture.Root $Name),$Destination,$false);$probe.Downloads++}.GetNewClosure()
+            $draft.Adapters.GetTagCommit={
+                param($Tag,$ActionsOnly)
+                $published=[IO.File]::Exists($path)
+                if($published){$probe.PublicationSeen=$true}
+                if($mode-cne'Valid'-and$probe.Downloads-eq$fixture.Names.Count-and($mode-cne'PostPublication'-or$published)) {
+                    $probe.Injected++
+                    if($mode-ceq'Uppercase'){return ('C'*40)}
+                    return (' '+$fixture.GitCommit)
+                }
+                return $fixture.GitCommit
+            }.GetNewClosure()
+            if($mode-ceq'Valid') {
+                $result=Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $fixture.Root -EvidenceDirectory $evidence -Adapters $draft.Adapters
+                Assert-CcodTrue $result.Verified 'canonical final observations and real publication are a passing control'
+                Assert-CcodEqual $path $result.VerificationPath 'control uses the actual production verification target'
+                Assert-CcodTrue $probe.PublicationSeen 'passing control covers the readback callback after publication'
+            } else {
+                Assert-CcodThrows {Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $fixture.Root -EvidenceDirectory $evidence -Adapters $draft.Adapters|Out-Null} 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID'
+                Assert-CcodTrue ($probe.Injected-gt0) 'malformed final SHA reaches the target callback'
+                Assert-CcodTrue (-not[IO.File]::Exists($path)) 'invalid final identity leaves no success-shaped verification'
+                if($mode-ceq'PostPublication'){Assert-CcodTrue $probe.PublicationSeen 'late negative crosses actual publication before rollback'}
+            }
+            Assert-CcodEqual $fixture.Names.Count $probe.Downloads 'all exact assets are downloaded before the target seam'
+        }
+    } finally {Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue;if($null-ne$fixture){Remove-CcodTask5ExactAssetFixture $fixture}}
+}
+
+Invoke-CcodTask6Test 'review2-commit-binding-shape' 'tag binding rejects noncanonical adapter SHA before comparison' {
+    $module=Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodCommitBindingShape'
+    try {
+        $state=[pscustomobject]@{Raw=('c'*40)}
+        $adapters=@{GetTagCommit={param($Tag,$ActionsOnly) return ,$state.Raw}.GetNewClosure()}
+        & $module {param($Adapters) Assert-CcodGitHubDraftTagCommit -Tag 'v2.5.22' -ExpectedCommit ('c'*40) -Adapters $Adapters -ActionsOnly $false} $adapters
+        $invalid=[Collections.Generic.List[object]]::new()
+        $invalid.Add([object]@('c'*40));$invalid.Add(' '+('c'*40));$invalid.Add(('c'*40)+"`n");$invalid.Add('C'*40);$invalid.Add([pscustomobject]@{value=('c'*40)})
+        $accepted=0
+        foreach($raw in $invalid) {
+            $state.Raw=$raw;$failure=$null
+            try{&$module {param($Adapters) Assert-CcodGitHubDraftTagCommit -Tag 'v2.5.22' -ExpectedCommit ('c'*40) -Adapters $Adapters -ActionsOnly $false} $adapters}catch{$failure=$_.FullyQualifiedErrorId}
+            if($null-eq$failure){$accepted++}else{Assert-CcodTrue ($failure-like'CCOD_GITHUB_DRAFT_TAG_COMMIT_FAILED*') 'malformed observed SHA fails before equality comparison'}
+        }
+        Assert-CcodEqual 0 $accepted 'caller does not repair whitespace or case after a native or private adapter'
+    } finally {Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue}
+}
+
+Invoke-CcodTask6Test 'review-native-private-id' 'native private recovery addresses a strict numeric release ID rather than a mutable tag' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodNativePrivateId'
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-native-private-id-' + [guid]::NewGuid().ToString('N'))
+    $fakeGh = Join-Path $root 'gh.cmd'
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        [IO.File]::WriteAllText($fakeGh,"@echo off`r`necho %*>>`"%~dp0calls.txt`"`r`necho native-fixture-output`r`nexit /b 0`r`n",[Text.UTF8Encoding]::new($false))
+        & $module {
+            param($Path)
+            $script:CcodPrivateFakeGh=$Path
+            $script:CcodPrivateCalls=0
+            Set-Item Function:script:Assert-CcodGitHubDraftAuthenticatedContext -Value {param($Tag)}
+            Set-Item Function:script:gh -Value { $script:CcodPrivateCalls++; & $script:CcodPrivateFakeGh @args; $script:LASTEXITCODE=$LASTEXITCODE }
+        } $fakeGh
+        $output=@(& $module { $adapters=Get-CcodGitHubDraftReleaseDefaultAdapters; & $adapters.SetReleaseDraftState 'v2.5.22' $true '123' })
+        Assert-CcodEqual 0 $output.Count 'native mutation output is not exposed as a success value'
+        $line=[IO.File]::ReadAllText((Join-Path $root 'calls.txt')).Trim()
+        Assert-CcodEqual 'api repos/naipi11/CodexRemote-fix/releases/123 --method PATCH --field draft=true --silent' $line 'the visibility write is pinned to the authenticated numeric ID'
+        foreach($bad in @($null,'',123,@('123'),'0123','123/../999',"123`n")){
+            $before=& $module {$script:CcodPrivateCalls}
+            Assert-CcodThrows { & $module {param($Id) $adapters=Get-CcodGitHubDraftReleaseDefaultAdapters; & $adapters.SetReleaseDraftState 'v2.5.22' $true $Id} $bad } 'CCOD_GITHUB_DRAFT_PROMOTE_FAILED'
+            Assert-CcodEqual $before (& $module {$script:CcodPrivateCalls}) 'invalid bound ID is rejected before any native call'
+        }
+        & $module {$adapters=Get-CcodGitHubDraftReleaseDefaultAdapters; & $adapters.SetReleaseDraftState 'v2.5.22' $false '123'}
+        $lines=[IO.File]::ReadAllLines((Join-Path $root 'calls.txt'))
+        Assert-CcodEqual 'api repos/naipi11/CodexRemote-fix/releases/123 --method PATCH --field draft=false --silent' $lines[-1].Trim() 'publication uses the same immutable ID and the explicit Boolean requested by its gated caller'
+        $before=& $module {$script:CcodPrivateCalls}
+        Assert-CcodThrows { & $module {$adapters=Get-CcodGitHubDraftReleaseDefaultAdapters; & $adapters.SetReleaseDraftState 'v2.5.22' $false} } 'CCOD_GITHUB_DRAFT_PROMOTE_FAILED'
+        Assert-CcodEqual $before (& $module {$script:CcodPrivateCalls}) 'unbound visibility changes are rejected rather than falling back to tag addressing'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if([IO.Directory]::Exists($root)){[IO.Directory]::Delete($root,$true)}
+    }
+}
+
+Invoke-CcodTask6Test 'review-bound-private-recovery' 'bound release recovery restores privacy despite asset or tag drift' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodBoundPrivateRecovery'
+    $fixture = $null
+    try {
+        & $module { Import-CcodDraftReleaseAssetContract }
+        $fixture = New-CcodTask5ExactAssetFixture
+        foreach ($mode in @('Promote','Stage')) {
+            foreach ($change in @('None','Missing','Extra','TagDrift')) {
+                $state = [pscustomobject]@{ Private=$false; Calls=0; TargetId=$null; Names=[string[]]$fixture.Names; Commit=[string]$fixture.GitCommit }
+                if($change -ceq 'Missing'){$state.Names=@($fixture.Names | Select-Object -Skip 1)}
+                if($change -ceq 'Extra'){$state.Names=@($fixture.Names)+@('unexpected.txt')}
+                if($change -ceq 'TagDrift'){$state.Commit='d'*40}
+                $adapters = @{
+                    ViewRelease = { param($Tag) [pscustomobject][ordered]@{Tag=$Tag;Id='123';Draft=$state.Private;AssetNames=@($state.Names)} }.GetNewClosure()
+                    GetTagCommit = { param($Tag,$ActionsOnly) $state.Commit }.GetNewClosure()
+                    SetReleaseDraftState = { param($Tag,[bool]$Draft,$ExpectedReleaseId) $state.Calls++;$state.TargetId=$ExpectedReleaseId;$state.Private=$Draft }.GetNewClosure()
+                }
+                [Console]::WriteLine('CCOD_BOUND_RECOVERY mode='+$mode+' change='+$change)
+                & $module {
+                    param($Adapters,$Mode,$Commit)
+                    if($Mode -ceq 'Promote'){
+                        Restore-CcodGitHubDraftPrivateState -Adapters $Adapters -Tag 'v2.5.22' -Version '2.5.22' -Verification ([pscustomobject]@{draftId='123'}) -Acceptance ([pscustomobject]@{draft=[pscustomobject]@{id='123'}}) -ExpectedGitCommit $Commit
+                    }else{
+                        Restore-CcodGitHubDraftStagePrivateState -Adapters $Adapters -Tag 'v2.5.22' -Version '2.5.22' -DraftId '123' -ExpectedGitCommit $Commit
+                    }
+                } $adapters $mode $fixture.GitCommit
+                Assert-CcodTrue $state.Private 'failed content must not prevent restoring the authenticated release to private'
+                Assert-CcodEqual 1 $state.Calls 'one private visibility mutation is requested'
+                if($change -cne 'None'){Assert-CcodEqual '123' $state.TargetId 'recovery mutation carries the already-bound release ID'}
+                Assert-CcodEqual ([string]$state.Commit) ([string](& $adapters.GetTagCommit 'v2.5.22' $false)) 'recovery does not repair or silently normalize tag content'
+            }
+        }
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if($null -ne $fixture){Remove-CcodTask5ExactAssetFixture $fixture}
+    }
+}
+
+Invoke-CcodTask6Test 'review-bound-recovery-denials' 'private recovery rejects identity ambiguity and never targets a retargeted release' {
+    $module=Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodRecoveryDenials'
+    try {
+        foreach($case in @('None','AlreadyPrivate','BeforeId','BeforeTag','BeforeDraftType','ReceiptArray','ReceiptMismatch','IdZero','IdLF','AfterId','AfterPublic','WriteThrows','TagRace')){
+            $state=[pscustomobject]@{ Reads=0; Writes=0; Private=$false; OtherPrivate=$false; BeforeId='123'; BeforeTag='v2.5.22'; BoundId=$null }
+            $verification=[pscustomobject]@{draftId='123'}
+            $acceptance=[pscustomobject]@{draft=[pscustomobject]@{id='123'}}
+            if($case -ceq 'AlreadyPrivate'){$state.Private=$true}
+            if($case -ceq 'BeforeId'){$state.BeforeId='999'}
+            if($case -ceq 'BeforeTag'){$state.BeforeTag='v2.5.21'}
+            if($case -ceq 'ReceiptArray'){$verification.draftId=@('123')}
+            if($case -ceq 'ReceiptMismatch'){$acceptance.draft.id='999'}
+            if($case -ceq 'IdZero'){$verification.draftId='0';$acceptance.draft.id='0';$state.BeforeId='0'}
+            if($case -ceq 'IdLF'){$verification.draftId="123`n";$acceptance.draft.id="123`n";$state.BeforeId="123`n"}
+            $adapters=@{
+                ViewRelease={param($Tag)
+                    $state.Reads++
+                    $id=$state.BeforeId;$private=$state.Private
+                    if($state.Reads -gt 1 -and $case -in @('AfterId','TagRace')){$id='999'}
+                    if($case -ceq 'BeforeDraftType'){$private='false'}
+                    if($state.Reads -gt 1 -and $case -ceq 'AfterPublic'){$private=$false}
+                    [pscustomobject][ordered]@{Tag=$state.BeforeTag;Id=$id;Draft=$private;AssetNames=@('untrusted-content.bin')}
+                }.GetNewClosure()
+                SetReleaseDraftState={param($Tag,[bool]$Draft,$ExpectedReleaseId)
+                    $state.Writes++;$state.BoundId=$ExpectedReleaseId
+                    if($case -ceq 'WriteThrows'){throw 'native write failure'}
+                    $target=if($null -ne $ExpectedReleaseId){$ExpectedReleaseId}elseif($case -ceq 'TagRace'){'999'}else{'123'}
+                    if($target -ceq '123'){$state.Private=$Draft}else{$state.OtherPrivate=$Draft}
+                }.GetNewClosure()
+                GetTagCommit={throw 'content validation must not gate containment'}
+            }
+            $invoke={&$module {param($A,$V,$E) Restore-CcodGitHubDraftPrivateState -Adapters $A -Tag 'v2.5.22' -Version '2.5.22' -Verification $V -Acceptance $E -ExpectedGitCommit ('c'*40)} $adapters $verification $acceptance}.GetNewClosure()
+            if($case -in @('None','AlreadyPrivate')){
+                & $invoke
+                Assert-CcodTrue $state.Private 'successful recovery is followed by a private readback'
+                Assert-CcodEqual 2 $state.Reads 'successful recovery reads the bound release before and after'
+            }else{Assert-CcodThrows {& $invoke} 'CCOD_GITHUB_DRAFT_PROMOTE_ROLLBACK_FAILED'}
+            $expectedWrites=if($case -in @('None','AfterId','AfterPublic','WriteThrows','TagRace')){1}else{0}
+            Assert-CcodEqual $expectedWrites $state.Writes "$case does not mutate before identity authorization"
+            Assert-CcodTrue (-not $state.OtherPrivate) 'retargeting cannot cause a different release to be hidden'
+            if($state.Writes){Assert-CcodEqual '123' $state.BoundId 'every recovery write retains the original ID'}
+        }
+    } finally {Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue}
+}
+
+Invoke-CcodTask6Test 'fix1-private-recovery-identity-before-mutation' 'Promote recovery validates release identity before changing visibility' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1RecoveryIdentity'
+    $assetFixture = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        $state = $draft.State
+        $state | Add-Member -NotePropertyName SetCalls -NotePropertyValue 0
+        $expectedNames = [string[]]$assetFixture.Names
+        $draft.Adapters.ViewRelease = {
+            param($Tag)
+            [pscustomobject][ordered]@{ Tag = $Tag; Id = '999'; Draft = $false; AssetNames = $expectedNames }
+        }.GetNewClosure()
+        $draft.Adapters.SetReleaseDraftState = {
+            param($Tag, [bool]$Draft)
+            $state.SetCalls++
+        }.GetNewClosure()
+        $verification = [pscustomobject][ordered]@{ draftId = '123' }
+        $acceptance = [pscustomobject][ordered]@{ draft = [pscustomobject][ordered]@{ id = '123' } }
+        Assert-CcodThrows {
+            &$module {
+                param($Adapters,$Verification,$Acceptance)
+                Restore-CcodGitHubDraftPrivateState -Adapters $Adapters -Tag 'v2.5.22' -Version '2.5.22' -Verification $Verification -Acceptance $Acceptance -ExpectedGitCommit ('c' * 40)
+            } $draft.Adapters $verification $acceptance
+        } 'CCOD_GITHUB_DRAFT_PROMOTE_ROLLBACK_FAILED'
+        Assert-CcodEqual 0 $state.SetCalls 'private recovery does not mutate an unverified release identity'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-post-promote-recovery-uses-identity-first-helper' 'Post-promotion readback recovery delegates identity validation before visibility mutation' {
+    $source = [IO.File]::ReadAllText((Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1'))
+    $start = $source.LastIndexOf('$postReadRoot = $null')
+    $end = $source.Length
+    Assert-CcodTrue ($start -ge 0 -and $end -gt $start) 'post-promotion readback recovery block is present'
+    $block = $source.Substring($start, $end - $start)
+    Assert-CcodTrue ($block.Contains('Restore-CcodGitHubDraftPrivateState -Adapters $adapters')) 'post-promotion recovery uses the identity-first helper'
+    Assert-CcodTrue (-not $block.Contains('& $adapters.SetReleaseDraftState $Tag $true')) 'post-promotion recovery does not mutate visibility before identity validation'
+}
+
+Invoke-CcodTask6Test 'review-native-json-field-order' 'default GitHub adapters accept reordered native JSON without relaxing identity types' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodNativeJsonFieldOrder'
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-native-json-order-' + [guid]::NewGuid().ToString('N'))
+    $fakeGh = Join-Path $root 'gh.cmd'
+    $response = Join-Path $root 'response.json'
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        [IO.File]::WriteAllText($fakeGh, "@echo off`r`nif `"%1`"==`"release`" if `"%2`"==`"create`" exit /b 0`r`nif `"%1`"==`"release`" if `"%2`"==`"view`" (`r`n  type `"%~dp0response.json`"`r`n  exit /b 0`r`n)`r`nexit /b 87`r`n", [Text.UTF8Encoding]::new($false))
+        & $module {
+            param($FakeGh)
+            $script:CcodNativeJsonGh = $FakeGh
+            $script:CcodNativeJsonCalls = 0
+            Set-Item Function:script:Assert-CcodGitHubDraftAuthenticatedContext -Value { param($Tag) }
+            Set-Item Function:script:Assert-CcodGitHubDraftActionsContext -Value { param($Tag) }
+            Set-Item Function:script:gh -Value {
+                if (($args -join '|') -cnotmatch '\|--repo\|naipi11/CodexRemote-fix\|') { throw 'native fixture received an unbound repository' }
+                $script:CcodNativeJsonCalls++
+                & $script:CcodNativeJsonGh @args
+                $script:LASTEXITCODE = $LASTEXITCODE
+            }
+        } $fakeGh
+        $expectedCalls = 0
+        foreach ($mode in @('CreateDraft','ViewRelease')) {
+            $value = [pscustomobject][ordered]@{ databaseId = [long]2147483648; tagName = 'v2.5.22'; isDraft = $true }
+            $orders = @('databaseId,tagName,isDraft','databaseId,isDraft,tagName','isDraft,tagName,databaseId')
+            $errorId = 'CCOD_GITHUB_DRAFT_CREATE_FAILED'
+            $callsPerInvocation = 2
+            if ($mode -ceq 'ViewRelease') {
+                $value | Add-Member -NotePropertyName assets -NotePropertyValue @([pscustomobject]@{name='first.zip'},[pscustomobject]@{name='second.exe'})
+                $orders = @('tagName,isDraft,databaseId,assets','assets,databaseId,isDraft,tagName','isDraft,assets,tagName,databaseId')
+                $errorId = 'CCOD_GITHUB_DRAFT_NOT_STAGED'
+                $callsPerInvocation = 1
+            }
+            $invoke = {
+                & $module { param($Mode) $adapters=Get-CcodGitHubDraftReleaseDefaultAdapters; if($Mode -ceq 'CreateDraft'){& $adapters.CreateDraft 'v2.5.22' 'fixture title' 'fixture notes'}else{& $adapters.ViewRelease 'v2.5.22'} } $mode
+            }.GetNewClosure()
+            foreach ($order in $orders) {
+                $reordered = [ordered]@{}
+                foreach ($name in $order.Split(',')) { $reordered[$name] = $value.$name }
+                [IO.File]::WriteAllText($response,($reordered | ConvertTo-Json -Depth 8),[Text.UTF8Encoding]::new($false))
+                [Console]::WriteLine('CCOD_NATIVE_JSON_ORDER mode=' + $mode + ' fields=' + $order)
+                $result = & $invoke
+                $expectedCalls += $callsPerInvocation
+                Assert-CcodEqual '2147483648' $result.Id "$mode accepts exact fields in native order $order"
+                Assert-CcodTrue ($result.Draft -is [bool] -and $result.Draft) 'draft state remains a strict Boolean'
+                Assert-CcodEqual 'v2.5.22' $result.Tag 'tag identity remains exact'
+                if ($mode -ceq 'ViewRelease') { Assert-CcodEqual 'first.zip,second.exe' ($result.AssetNames -join ',') 'asset array is preserved' }
+            }
+            foreach ($bad in @('Missing','Extra','Case','IdString','IdBoolean','IdFraction','IdZero','TagArray','TagMismatch','DraftString','Null')) {
+                $mutated = $value.PSObject.Copy()
+                switch ($bad) {
+                    'Missing' { $mutated.PSObject.Properties.Remove('databaseId') }
+                    'Extra' { $mutated | Add-Member -NotePropertyName unexpected -NotePropertyValue $true }
+                    'IdString' { $mutated.databaseId = '2147483648' }
+                    'IdBoolean' { $mutated.databaseId = $true }
+                    'IdFraction' { $mutated.databaseId = [double]123.5 }
+                    'IdZero' { $mutated.databaseId = 0 }
+                    'TagArray' { $mutated.tagName = @('v2.5.22') }
+                    'TagMismatch' { $mutated.tagName = 'v2.5.21' }
+                    'DraftString' { $mutated.isDraft = 'true' }
+                }
+                $json = $mutated | ConvertTo-Json -Depth 8 -Compress
+                if ($bad -ceq 'Case') { $json = $json.Replace('"databaseId":','"DatabaseId":') }
+                if ($bad -ceq 'Null') { $json = 'null' }
+                [IO.File]::WriteAllText($response,$json,[Text.UTF8Encoding]::new($false))
+                Assert-CcodThrows { & $invoke | Out-Null } $errorId
+                $expectedCalls += $callsPerInvocation
+            }
+        }
+        Assert-CcodEqual $expectedCalls (& $module {$script:CcodNativeJsonCalls}) 'every adapter invocation used only the local native fixture'
+    } finally {
+        if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        if ([IO.Directory]::Exists($root)) { [IO.Directory]::Delete($root,$true) }
+    }
+}
+
+Invoke-CcodTask6Test 'fix2-view-database-id' 'default GitHub ViewRelease rejects coerced database IDs using only a local gh stub' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodViewDatabaseId'
+    try {
+        &$module {
+            $script:CcodViewGhCalls = 0
+            Set-Item Function:script:Assert-CcodGitHubDraftAuthenticatedContext -Value { param($Tag) }
+            Set-Item Function:script:gh -Value {
+                $script:LASTEXITCODE = 0
+                $script:CcodViewGhCalls++
+                return $script:CcodViewJson
+            }
+        }
+        foreach ($case in @(
+            [pscustomobject]@{ Json = '123'; Valid = $true },
+            [pscustomobject]@{ Json = '2147483648'; Valid = $true },
+            [pscustomobject]@{ Json = '[123]'; Valid = $false },
+            [pscustomobject]@{ Json = '"123"'; Valid = $false },
+            [pscustomobject]@{ Json = 'true'; Valid = $false },
+            [pscustomobject]@{ Json = '123.5'; Valid = $false },
+            [pscustomobject]@{ Json = 'null'; Valid = $false },
+            [pscustomobject]@{ Json = '0'; Valid = $false }
+        )) {
+            &$module { param($Value) $script:CcodViewJson = '{"tagName":"v2.5.22","isDraft":true,"databaseId":' + $Value + ',"assets":[]}' } $case.Json
+            $invoke = { &$module { $adapters = Get-CcodGitHubDraftReleaseDefaultAdapters; & $adapters.ViewRelease 'v2.5.22' } }
+            if ($case.Valid) {
+                $view = & $invoke
+                Assert-CcodEqual $case.Json $view.Id 'canonical JSON Int32/Int64 database ID is accepted'
+            } else { Assert-CcodThrows { & $invoke | Out-Null } 'CCOD_GITHUB_DRAFT_NOT_STAGED' }
+        }
+        Assert-CcodEqual 8 (&$module { $script:CcodViewGhCalls }) 'every view is served by the module-local gh stub'
+    } finally { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+}
+
+Invoke-CcodTask6Test 'fix2-create-tag-type' 'Stage rejects singleton array tags from creation before any asset upload' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodCreateTagType'
+    $fixture = $null
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-create-tag-type-' + [guid]::NewGuid().ToString('N'))
+    try {
+        $fixture = New-CcodTask5ExactAssetFixture
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        Write-CcodTask5Json (Join-Path $root 'CodexRemote-fix-2.5.22-clean-preflight.json') ([ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = $fixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) })
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $fixture.Root
+        $draft.Adapters.CreateDraft = { param($Tag,$Title,$Notes) [pscustomobject][ordered]@{ Tag = @($Tag); Id = '123'; Draft = $true; AssetNames = @() } }
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $fixture.Root -EvidenceDirectory $root -Adapters $draft.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_CREATE_AMBIGUOUS'
+        Assert-CcodEqual 0 $draft.State.Uploaded.Count 'malformed creation identity cannot authorize upload'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ([IO.Directory]::Exists($root)) { [IO.Directory]::Delete($root, $true) }
+        if ($null -ne $fixture) { Remove-CcodTask5ExactAssetFixture $fixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-post-promote-readback' 'Promote re-downloads and re-hashes public assets after changing draft visibility' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1PostPromote'
+    $assetFixture = $null
+    $promotion = $null
+    $remoteRoot = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $promotion = New-CcodTask5PromotionFixture $assetFixture
+        $defender = Join-Path $promotion.Root 'defender'
+        $acceptanceDirectory = Join-Path $promotion.Root 'acceptance'
+        [IO.Directory]::CreateDirectory($defender) | Out-Null
+        foreach ($name in @($promotion.Names)) { Move-Item -LiteralPath (Join-Path $promotion.Root $name) -Destination (Join-Path $defender $name) }
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $promotion.Root 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $expected = [string[]]$assetFixture.Names
+        $remoteRoot = Join-Path $assetFixture.Outside 'remote-assets'
+        [IO.Directory]::CreateDirectory($remoteRoot) | Out-Null
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        $state = $draft.State
+        $draft.Adapters.UploadAsset = {
+            param($Tag, $Name, $Path)
+            [IO.File]::Copy($Path, (Join-Path $remoteRoot $Name), $true)
+            $state.Uploaded.Add($Name)
+        }.GetNewClosure()
+        $draft.Adapters.DownloadAsset = {
+            param($Tag, $Name, $Destination)
+            [IO.File]::Copy((Join-Path $remoteRoot $Name), $Destination, $true)
+        }.GetNewClosure()
+        Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        $acceptanceRecord = New-CcodTask9AcceptanceRecord -AssetFixture $assetFixture -EvidenceRoot (Get-CcodTask9EvidenceRoot)
+        [IO.Directory]::CreateDirectory($acceptanceDirectory) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $acceptanceDirectory 'CodexRemote-fix-2.5.22-official-draft.complete.json'), (($acceptanceRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $state | Add-Member -NotePropertyName PublicAttempts -NotePropertyValue 0
+        $state | Add-Member -NotePropertyName RecoveryWrites -NotePropertyValue 0
+        foreach ($change in @('Bytes','Missing','Extra')) {
+            foreach($name in $expected){[IO.File]::Copy((Join-Path $assetFixture.Root $name),(Join-Path $remoteRoot $name),$true)}
+            $state.Uploaded.Clear();$state.Uploaded.AddRange($expected)
+            $state.DraftPrivate=$true;$state.Promoted=$false
+            $beforePublic=$state.PublicAttempts;$beforeRecovery=$state.RecoveryWrites
+            $draft.Adapters.SetReleaseDraftState = {
+                param($Tag, [bool]$Draft, $ExpectedReleaseId)
+                if($ExpectedReleaseId -cne '123'){throw 'all visibility writes must carry the bound release ID'}
+                $state.DraftPrivate = $Draft
+                $state.Promoted = -not $Draft
+                if (-not $Draft) {
+                    $state.PublicAttempts++
+                    if($change -ceq 'Bytes'){[IO.File]::WriteAllText((Join-Path $remoteRoot $expected[0]),'post-promotion-mutated',[Text.UTF8Encoding]::new($false))}
+                    if($change -ceq 'Missing'){[IO.File]::Delete((Join-Path $remoteRoot $expected[0]));[void]$state.Uploaded.Remove($expected[0])}
+                    if($change -ceq 'Extra'){$state.Uploaded.Add('unexpected.txt');[IO.File]::WriteAllText((Join-Path $remoteRoot 'unexpected.txt'),'unexpected',[Text.UTF8Encoding]::new($false))}
+                }else{
+                    if($ExpectedReleaseId -cne '123'){throw 'post-promotion recovery ID was not bound'}
+                    $state.RecoveryWrites++
+                }
+            }.GetNewClosure()
+            Assert-CcodThrows {
+                Invoke-CcodTask6DraftCore -Module $module -Mode Promote -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+            } 'CCOD_GITHUB_DRAFT_PROMOTE_READBACK_FAILED'
+            Assert-CcodEqual ($beforePublic+1) $state.PublicAttempts "$change occurs only after actual fixture publication"
+            Assert-CcodEqual ($beforeRecovery+1) $state.RecoveryWrites "$change triggers bound-ID recovery"
+            Assert-CcodTrue (-not $state.Promoted -and $state.DraftPrivate) 'post-promotion content failures restore the same draft to private before failing'
+        }
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $promotion -and (Test-Path -LiteralPath $promotion.Root)) { Remove-Item -LiteralPath $promotion.Root -Recurse -Force -ErrorAction SilentlyContinue }
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-post-promote-tag-identity' 'Promote rechecks the immutable tag commit after the final public asset readback' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1PostPromoteTagIdentity'
+    $assetFixture = $null
+    $promotion = $null
+    $remoteRoot = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $promotion = New-CcodTask5PromotionFixture $assetFixture
+        $defender = Join-Path $promotion.Root 'defender'
+        $acceptanceDirectory = Join-Path $promotion.Root 'acceptance'
+        [IO.Directory]::CreateDirectory($defender) | Out-Null
+        foreach ($name in @($promotion.Names)) { Move-Item -LiteralPath (Join-Path $promotion.Root $name) -Destination (Join-Path $defender $name) }
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $promotion.Root 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $expected = [string[]]$assetFixture.Names
+        $remoteRoot = Join-Path $assetFixture.Outside 'remote-assets'
+        [IO.Directory]::CreateDirectory($remoteRoot) | Out-Null
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        $state = $draft.State
+        $state | Add-Member -NotePropertyName PostRootReadyAtPublic -NotePropertyValue $false
+        $mutation = [pscustomobject]@{ DownloadCount = 0; TagSwapped = $false }
+        $draft.Adapters.UploadAsset = {
+            param($Tag, $Name, $Path)
+            [IO.File]::Copy($Path, (Join-Path $remoteRoot $Name), $true)
+            $state.Uploaded.Add($Name)
+        }.GetNewClosure()
+        $draft.Adapters.GetTagCommit = {
+            param($Tag, [bool]$ActionsOnly)
+            if ($mutation.TagSwapped) { 'd' * 40 } else { 'c' * 40 }
+        }.GetNewClosure()
+        $draft.Adapters.DownloadAsset = {
+            param($Tag, $Name, $Destination)
+            [IO.File]::Copy((Join-Path $remoteRoot $Name), $Destination, $true)
+            $mutation.DownloadCount++
+            if ($mutation.DownloadCount -eq 44) { $mutation.TagSwapped = $true }
+        }.GetNewClosure()
+        Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        $acceptanceRecord = New-CcodTask9AcceptanceRecord -AssetFixture $assetFixture -EvidenceRoot (Get-CcodTask9EvidenceRoot)
+        [IO.Directory]::CreateDirectory($acceptanceDirectory) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $acceptanceDirectory 'CodexRemote-fix-2.5.22-official-draft.complete.json'), (($acceptanceRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $draft.Adapters.SetReleaseDraftState = {
+            param($Tag, [bool]$Draft)
+            if (-not $Draft) {
+                $state.PostRootReadyAtPublic = @([IO.Directory]::GetDirectories([IO.Path]::GetTempPath(), 'ccod-draft-post-promote-*')).Count -gt 0
+            }
+            $state.DraftPrivate = $Draft
+            $state.Promoted = -not $Draft
+        }.GetNewClosure()
+        Assert-CcodThrows {
+            Invoke-CcodTask6DraftCore -Module $module -Mode Promote -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        } 'CCOD_GITHUB_DRAFT_TAG_COMMIT_MISMATCH'
+        Assert-CcodTrue $state.PostRootReadyAtPublic 'post-readback root must be prepared before public visibility mutation'
+        Assert-CcodTrue ($mutation.TagSwapped -and $mutation.DownloadCount -eq 44) 'tag identity changes only after the final public asset readback'
+        Assert-CcodTrue (-not $state.Promoted -and $state.DraftPrivate) 'same release ID is restored private while the original tag failure remains reported'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $promotion -and (Test-Path -LiteralPath $promotion.Root)) { Remove-Item -LiteralPath $promotion.Root -Recurse -Force -ErrorAction SilentlyContinue }
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-restore-revalidates-tag-commit' 'Private recovery restores the bound release despite a changed tag commit' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1RestoreTagCommit'
+    $assetFixture = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $names = [string[]]$assetFixture.Names
+        $state = [pscustomobject]@{ Private = $false; TargetId = $null }
+        $adapters = @{
+            ViewRelease = { param($Tag) [pscustomobject][ordered]@{ Tag = $Tag; Id = '123'; Draft = $state.Private; AssetNames = $names } }.GetNewClosure()
+            SetReleaseDraftState = { param($Tag, [bool]$Draft, $ExpectedReleaseId) $state.Private = $Draft; $state.TargetId = $ExpectedReleaseId }.GetNewClosure()
+            GetTagCommit = { param($Tag, [bool]$ActionsOnly) 'd' * 40 }.GetNewClosure()
+        }
+        $verification = [pscustomobject]@{ draftId = '123' }
+        $acceptance = [pscustomobject]@{ draft = [pscustomobject]@{ id = '123' } }
+        &$module { param($Adapters,$Verification,$Acceptance) Restore-CcodGitHubDraftPrivateState -Adapters $Adapters -Tag 'v2.5.22' -Version '2.5.22' -Verification $Verification -Acceptance $Acceptance -ExpectedGitCommit ('c' * 40) } $adapters $verification $acceptance
+        Assert-CcodTrue $state.Private 'content drift does not prevent privacy containment for the authenticated ID'
+        Assert-CcodEqual '123' $state.TargetId 'recovery does not select a release using its changed tag commit'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-promote-final-evidence-hold' 'Promote rejects a valid acceptance replacement after final evidence was initially held' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1FinalEvidenceHold'
+    $assetFixture = $null
+    $promotion = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $promotion = New-CcodTask5PromotionFixture $assetFixture
+        $defender = Join-Path $promotion.Root 'defender'
+        $verification = Join-Path $promotion.Root 'verification'
+        $acceptance = Join-Path $promotion.Root 'acceptance'
+        [IO.Directory]::CreateDirectory($defender) | Out-Null
+        [IO.Directory]::CreateDirectory($verification) | Out-Null
+        [IO.Directory]::CreateDirectory($acceptance) | Out-Null
+        foreach ($name in @($promotion.Names)) { Move-Item -LiteralPath (Join-Path $promotion.Root $name) -Destination (Join-Path $defender $name) }
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $promotion.Root 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        $state = $draft.State
+        $draft.Adapters.UploadAsset = { param($Tag,$Name,$Path); $state.Uploaded.Add($Name); [IO.File]::Copy($Path,(Join-Path $promotion.Root ('remote-' + $Name)),$true) }.GetNewClosure()
+        $draft.Adapters.DownloadAsset = { param($Tag,$Name,$Destination); [IO.File]::Copy((Join-Path $promotion.Root ('remote-' + $Name)),$Destination,$true) }.GetNewClosure()
+        Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        $acceptanceRecord = New-CcodTask9AcceptanceRecord -AssetFixture $assetFixture -EvidenceRoot (Get-CcodTask9EvidenceRoot)
+        $acceptancePath = Join-Path $acceptance 'CodexRemote-fix-2.5.22-official-draft.complete.json'
+        [IO.File]::WriteAllText($acceptancePath, (($acceptanceRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $viewCalls = 0
+        $draft.Adapters.ViewRelease = {
+            param($Tag)
+            $viewCalls++
+            if ($viewCalls -eq 1) {
+                $replacement = [IO.File]::ReadAllText($acceptancePath) | ConvertFrom-Json
+                $replacement.completedAtUtc = '2030-02-03T04:05:08.0000000Z'
+                [IO.File]::WriteAllText($acceptancePath, (($replacement | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+            }
+            return [pscustomobject][ordered]@{ Tag = $Tag; Id = [string]$state.DraftId; Draft = [bool]$state.DraftPrivate; AssetNames = @($state.Uploaded) }
+        }.GetNewClosure()
+        Assert-CcodThrows {
+            Invoke-CcodTask6DraftCore -Module $module -Mode Promote -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        } 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID'
+        Assert-CcodTrue (-not $state.Promoted -and $state.DraftPrivate) 'a changed final acceptance hash never changes draft visibility'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $promotion -and (Test-Path -LiteralPath $promotion.Root)) { Remove-Item -LiteralPath $promotion.Root -Recurse -Force -ErrorAction SilentlyContinue }
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-promote-defender-evidence-hold' 'Promote holds Defender receipt identity through the visibility mutation' {
+    $source = [IO.File]::ReadAllText((Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1'), [Text.UTF8Encoding]::new($false))
+    Assert-CcodTrue ($source.Contains('$heldEvidenceHashes[[string]$preflight]')) 'Promote pins the transferred preflight file through the visibility mutation'
+
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1DefenderEvidenceHold'
+    $assetFixture = $null
+    $promotion = $null
+    $backup = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $promotion = New-CcodTask5PromotionFixture $assetFixture
+        $defender = Join-Path $promotion.Root 'defender'
+        $acceptanceDirectory = Join-Path $promotion.Root 'acceptance'
+        [IO.Directory]::CreateDirectory($defender) | Out-Null
+        foreach ($name in @($promotion.Names)) { Move-Item -LiteralPath (Join-Path $promotion.Root $name) -Destination (Join-Path $defender $name) }
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $promotion.Root 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        $acceptanceRecord = New-CcodTask9AcceptanceRecord -AssetFixture $assetFixture -EvidenceRoot (Get-CcodTask9EvidenceRoot)
+        [IO.Directory]::CreateDirectory($acceptanceDirectory) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $acceptanceDirectory 'CodexRemote-fix-2.5.22-official-draft.complete.json'), (($acceptanceRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $state = $draft.State
+        $state | Add-Member -NotePropertyName DefenderReceiptBlocked -NotePropertyValue $false
+        $receiptPath = Join-Path $defender $promotion.Names[0]
+        $backup = $receiptPath + '.replacement-source'
+        $draft.Adapters.SetReleaseDraftState = {
+            param($Tag, [bool]$Draft)
+            if (-not $Draft) {
+                try {
+                    [IO.File]::Move($receiptPath, $backup)
+                    [IO.File]::Copy($backup, $receiptPath, $false)
+                } catch [IO.IOException] {
+                    $state.DefenderReceiptBlocked = $true
+                }
+            }
+            $state.DraftPrivate = $Draft
+            $state.Promoted = -not $Draft
+        }.GetNewClosure()
+        $result = Invoke-CcodTask6DraftCore -Module $module -Mode Promote -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters
+        Assert-CcodTrue ([bool]$result.Promoted -and $state.Promoted) 'Promote completes while Defender receipt identity remains held'
+        Assert-CcodTrue $state.DefenderReceiptBlocked 'replacement of a held Defender receipt is blocked during visibility mutation'
+    } finally {
+        if ($null -ne $backup -and (Test-Path -LiteralPath $backup)) {
+            if (Test-Path -LiteralPath ($backup.Substring(0, $backup.Length - '.replacement-source'.Length))) { Remove-Item -LiteralPath ($backup.Substring(0, $backup.Length - '.replacement-source'.Length)) -Force -ErrorAction SilentlyContinue }
+            Move-Item -LiteralPath $backup -Destination ($backup.Substring(0, $backup.Length - '.replacement-source'.Length)) -Force -ErrorAction SilentlyContinue
+        }
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $promotion -and (Test-Path -LiteralPath $promotion.Root)) { Remove-Item -LiteralPath $promotion.Root -Recurse -Force -ErrorAction SilentlyContinue }
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-promote-acceptance-evidence-hold' 'Promote holds acceptance and Verify evidence identity through the visibility mutation' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1AcceptanceEvidenceHold'
+    $assetFixture = $null
+    $promotion = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $promotion = New-CcodTask5PromotionFixture $assetFixture
+        $defender = Join-Path $promotion.Root 'defender'
+        $acceptanceDirectory = Join-Path $promotion.Root 'acceptance'
+        $verificationDirectory = Join-Path $promotion.Root 'verification'
+        [IO.Directory]::CreateDirectory($defender) | Out-Null
+        [IO.Directory]::CreateDirectory($acceptanceDirectory) | Out-Null
+        [IO.Directory]::CreateDirectory($verificationDirectory) | Out-Null
+        foreach ($name in @($promotion.Names)) { Move-Item -LiteralPath (Join-Path $promotion.Root $name) -Destination (Join-Path $defender $name) }
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $promotion.Root 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        $acceptanceRecord = New-CcodTask9AcceptanceRecord -AssetFixture $assetFixture -EvidenceRoot (Get-CcodTask9EvidenceRoot)
+        $acceptancePath = Join-Path $acceptanceDirectory 'CodexRemote-fix-2.5.22-official-draft.complete.json'
+        [IO.File]::WriteAllText($acceptancePath, (($acceptanceRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $state = $draft.State
+        $state | Add-Member -NotePropertyName AcceptanceReplacementBlocked -NotePropertyValue $false
+        $state | Add-Member -NotePropertyName VerificationReplacementBlocked -NotePropertyValue $false
+        $state | Add-Member -NotePropertyName AcceptanceStateReplacementBlocked -NotePropertyValue $false
+        $state | Add-Member -NotePropertyName ManualArtifactReplacementBlocked -NotePropertyValue $false
+        $verificationPath = Join-Path $verificationDirectory 'CodexRemote-fix-2.5.22-draft-verified.json'
+        $acceptanceStatePath = Join-Path $promotion.Root 'official-draft-acceptance\01-Preflight.json'
+        $manualArtifactPath = Join-Path $promotion.Root 'official-draft-artifacts\About\screenshot.bin'
+        $draft.Adapters.SetReleaseDraftState = {
+            param($Tag, [bool]$Draft)
+            if (-not $Draft) {
+                try { [IO.File]::AppendAllText($acceptancePath, "tamper`n") } catch [IO.IOException] { $state.AcceptanceReplacementBlocked = $true }
+                try { [IO.File]::AppendAllText($verificationPath, "tamper`n") } catch [IO.IOException] { $state.VerificationReplacementBlocked = $true }
+                try { [IO.File]::AppendAllText($acceptanceStatePath, "tamper`n") } catch [IO.IOException] { $state.AcceptanceStateReplacementBlocked = $true }
+                try { [IO.File]::AppendAllText($manualArtifactPath, "tamper`n") } catch [IO.IOException] { $state.ManualArtifactReplacementBlocked = $true }
+            }
+            $state.DraftPrivate = $Draft
+            $state.Promoted = -not $Draft
+        }.GetNewClosure()
+        $result = Invoke-CcodTask6DraftCore -Module $module -Mode Promote -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters
+        Assert-CcodTrue ([bool]$result.Promoted -and $state.Promoted) 'Promote completes while acceptance and Verify evidence identities remain held'
+        Assert-CcodTrue $state.AcceptanceReplacementBlocked 'replacement of held acceptance evidence is blocked during visibility mutation'
+        Assert-CcodTrue $state.VerificationReplacementBlocked 'replacement of held Verify evidence is blocked during visibility mutation'
+        Assert-CcodTrue $state.AcceptanceStateReplacementBlocked 'replacement of held acceptance state is blocked during visibility mutation'
+        Assert-CcodTrue $state.ManualArtifactReplacementBlocked 'replacement of held manual artifact is blocked during visibility mutation'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $promotion -and (Test-Path -LiteralPath $promotion.Root)) { Remove-Item -LiteralPath $promotion.Root -Recurse -Force -ErrorAction SilentlyContinue }
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-stage-final-identity' 'Stage rejects a release-object identity swap after the last upload' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1StageFinalIdentity'
+    $assetFixture = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $evidence = $assetFixture.Outside
+        $preflightRecord = [ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) }
+        [IO.File]::WriteAllText((Join-Path $evidence 'CodexRemote-fix-2.5.22-clean-preflight.json'), (($preflightRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
+        $state = $draft.State
+        $expected = [string[]]$assetFixture.Names
+        $draft.Adapters.ViewRelease = {
+            param($Tag)
+            $assetNames = [string[]]$state.Uploaded
+            $id = if ($assetNames.Count -eq $expected.Count) { '999' } else { '123' }
+            [pscustomobject][ordered]@{ Tag = $Tag; Id = $id; Draft = $true; AssetNames = $assetNames }
+        }.GetNewClosure()
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $draft.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_UPLOAD_PRIVATE_RECOVERY_FAILED'
+        Assert-CcodTrue (-not $state.Promoted) 'Stage identity swap never promotes the draft'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-defender-plane-required' 'Promote refuses Defender receipts in the shared evidence root' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1DefenderPlane'
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-shared-defender-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $result = &$module { param($Evidence) Get-CcodGitHubDraftDefenderEvidenceDirectory $Evidence } $root
+        throw 'ASSERT_THROWS: shared Defender evidence root was accepted'
+    } catch {
+        Assert-CcodTrue ([string]$_.FullyQualifiedErrorId -like 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID*') 'shared evidence root is rejected when the dedicated Defender plane is absent'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-stage-lock' 'default Stage lock serializes same-tag processes and releases after the operation' {
+    $scriptPath = Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1'
+    $source = [IO.File]::ReadAllText($scriptPath, [Text.UTF8Encoding]::new($false))
+    Assert-CcodTrue ($source.Contains('if ($defaultLockHeld)') -and -not $source.Contains('if ($null -eq $Adapters -and $defaultLockHeld)')) 'injected Stage and Verify adapters release the same-tag lock in finally'
+
+    $ready = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-lock-ready-' + [guid]::NewGuid().ToString('N'))
+    $release = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task6-lock-release-' + [guid]::NewGuid().ToString('N'))
+    $job = $null
+    $secondModule = $null
+    try {
+        $job = Start-Job -ArgumentList $scriptPath, $ready, $release -ScriptBlock {
+            param($Path, $ReadyPath, $ReleasePath)
+            $text = [IO.File]::ReadAllText($Path, [Text.UTF8Encoding]::new($false))
+            $module = New-Module -Name ('CcodLockHolder-' + [guid]::NewGuid().ToString('N')) -ScriptBlock ([scriptblock]::Create($text))
+            Import-Module $module -Force -DisableNameChecking | Out-Null
+            $held = [bool](&$module { $adapters = Get-CcodGitHubDraftReleaseDefaultAdapters; & $adapters.AcquireStageLock 'v2.5.22' })
+            if (-not $held) { throw 'CCOD_TEST_LOCK_HOLDER_FAILED' }
+            [IO.File]::WriteAllText($ReadyPath, 'held', [Text.UTF8Encoding]::new($false))
+            while (-not [IO.File]::Exists($ReleasePath)) { Start-Sleep -Milliseconds 25 }
             &$module { $adapters = Get-CcodGitHubDraftReleaseDefaultAdapters; & $adapters.ReleaseStageLock 'v2.5.22' }
             Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
         }
@@ -3900,6 +5715,149 @@ Invoke-CcodTask6Test 'fix1-stage-lock' 'default Stage lock serializes same-tag p
     }
 }
 
+Invoke-CcodTask6Test 'fix2-operation-lock-release' 'failed Stage Verify and Promote release the real same-tag mutex and reject the old finally mutant' {
+    $fixture = $null; $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-operation-lock-' + [guid]::NewGuid().ToString('N'))
+    try {
+        $fixture = New-CcodTask5ExactAssetFixture
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        Write-CcodTask5Json (Join-Path $root 'CodexRemote-fix-2.5.22-clean-preflight.json') ([ordered]@{ schemaVersion = 1; valid = $false; version = '2.5.22'; gitCommit = $fixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) })
+        foreach ($mutant in @($false, $true)) {
+            foreach ($mode in @('Stage','Verify','Promote')) {
+                $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name ('CcodOperationLock-' + [guid]::NewGuid().ToString('N'))
+                $job = $null
+                try {
+                    if ($mutant) {
+                        &$module {
+                            $source = ${function:Invoke-CcodGitHubDraftReleaseCore}.ToString()
+                            $changed = $source.Replace('if ($defaultLockHeld)', 'if ($null -eq $Adapters -and $defaultLockHeld)').Replace('if ($promoteLockHeld)', 'if ($null -eq $Adapters -and $promoteLockHeld)')
+                            if ($source -ceq $changed) { throw 'CCOD_TEST_LOCK_MUTANT_NOT_APPLIED' }
+                            Set-Item Function:script:Invoke-CcodGitHubDraftReleaseCore -Value ([scriptblock]::Create($changed))
+                        }
+                    }
+                    $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $fixture.Root
+                    $lockProbe = [pscustomobject]@{ Acquired = $false }
+                    $draft.Adapters.TryStageLock = {
+                        param($Tag)
+                        $lockProbe.Acquired = [bool](&$module { param($Tag) Acquire-CcodGitHubDraftStageLock $Tag } $Tag)
+                        return $lockProbe.Acquired
+                    }.GetNewClosure()
+                    Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode $mode -Tag 'v2.5.22' -AssetDirectory $fixture.Root -EvidenceDirectory $root -Adapters $draft.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_PREFLIGHT_INVALID'
+                    Assert-CcodTrue $lockProbe.Acquired "$mode reaches the failure after acquiring the real lock"
+                    $mutexName = &$module { Get-CcodGitHubDraftStageLockName 'v2.5.22' }
+                    $job = Start-Job -ArgumentList $mutexName -ScriptBlock {
+                        param($Name)
+                        $mutex = [Threading.Mutex]::new($false, $Name)
+                        $held = $false
+                        try {
+                            try { $held = $mutex.WaitOne(0) } catch [Threading.AbandonedMutexException] { $held = $true }
+                            return [bool]$held
+                        } finally { if ($held) { $mutex.ReleaseMutex() }; $mutex.Dispose() }
+                    }
+                    $completed = Wait-Job $job -Timeout 20
+                    Assert-CcodTrue ($null -ne $completed -and $job.State -ceq 'Completed') "$mode separate-process lock probe completes"
+                    $result = @(Receive-Job $job -ErrorAction Stop)
+                    Assert-CcodEqual 1 $result.Count 'lock probe returns one explicit result'
+                    Assert-CcodTrue ($result[0] -is [bool]) 'lock probe returns a real boolean'
+                    Assert-CcodEqual (-not $mutant) $result[0] "$mode reacquires only when the operation finally actually releases"
+                } finally {
+                    if ($null -ne $job) { Stop-Job $job -ErrorAction SilentlyContinue | Out-Null; Remove-Job $job -Force -ErrorAction SilentlyContinue }
+                    &$module { Release-CcodGitHubDraftStageLock 'v2.5.22' }
+                    Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+                }
+            }
+        }
+    } finally {
+        if ([IO.Directory]::Exists($root)) { [IO.Directory]::Delete($root, $true) }
+        if ($null -ne $fixture) { Remove-CcodTask5ExactAssetFixture $fixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix2-manual-state-before-hold' 'Promote rejects manual state replacement after validation but before holding its bytes' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodPromoteManualStateBeforeHold'
+    $fixture = $null; $promotion = $null
+    try {
+        $fixture = New-CcodTask5ExactAssetFixture
+        $promotion = New-CcodTask5PromotionFixture $fixture
+        $defender = Join-Path $promotion.Root 'defender'; $acceptance = Join-Path $promotion.Root 'acceptance'
+        [IO.Directory]::CreateDirectory($defender) | Out-Null
+        [IO.Directory]::CreateDirectory($acceptance) | Out-Null
+        foreach ($name in $promotion.Names) { Move-Item -LiteralPath (Join-Path $promotion.Root $name) -Destination (Join-Path $defender $name) }
+        Write-CcodTask5Json (Join-Path $promotion.Root 'CodexRemote-fix-2.5.22-clean-preflight.json') ([ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = $fixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) })
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $fixture.Root
+        $draft.State.Uploaded.AddRange([string[]]$fixture.Names)
+        Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $fixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        Write-CcodTask5Json (Join-Path $acceptance 'CodexRemote-fix-2.5.22-official-draft.complete.json') (New-CcodTask9AcceptanceRecord -AssetFixture $fixture -EvidenceRoot $promotion.Root)
+        $probe = [pscustomobject]@{ Reads = 0; Replaced = $false }
+        &$module {
+            param($Path,$Probe)
+            $script:CcodManualStatePath = $Path; $script:CcodManualStateProbe = $Probe
+            $script:CcodOriginalAcceptanceReader = ${function:Read-CcodGitHubDraftAcceptance}
+            Set-Item Function:script:Read-CcodGitHubDraftAcceptance -Value {
+                param($EvidenceDirectory,$AssetDirectory,$Tag,$Version,$GitCommit)
+                $record = & $script:CcodOriginalAcceptanceReader @PSBoundParameters
+                $script:CcodManualStateProbe.Reads++
+                if ($script:CcodManualStateProbe.Reads -eq 2) {
+                    [IO.File]::WriteAllText($script:CcodManualStatePath, '{"schemaVersion":1}', [Text.UTF8Encoding]::new($false))
+                    $script:CcodManualStateProbe.Replaced = $true
+                }
+                return $record
+            }
+        } (Join-Path $promotion.Root 'official-draft-acceptance/manual-evidence/TrayEvidence-About.json') $probe
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Promote -Tag 'v2.5.22' -AssetDirectory $fixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null } 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID'
+        Assert-CcodTrue $probe.Replaced 'replacement occurs after the final unlocked acceptance read'
+        Assert-CcodTrue (-not $draft.State.Promoted) 'invalid manual state cannot change public visibility'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $promotion -and [IO.Directory]::Exists($promotion.Root)) { [IO.Directory]::Delete($promotion.Root, $true) }
+        if ($null -ne $fixture) { Remove-CcodTask5ExactAssetFixture $fixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix2-preflight-pinned-hash' 'Promote rejects same-meaning preflight replacement after its pinned read' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools\Invoke-GitHubDraftRelease.ps1') -Name 'CcodPromotePinnedPreflight'
+    $fixture = $null; $promotion = $null
+    try {
+        $fixture = New-CcodTask5ExactAssetFixture
+        $promotion = New-CcodTask5PromotionFixture $fixture
+        $defender = Join-Path $promotion.Root 'defender'
+        $acceptance = Join-Path $promotion.Root 'acceptance'
+        [IO.Directory]::CreateDirectory($defender) | Out-Null
+        [IO.Directory]::CreateDirectory($acceptance) | Out-Null
+        foreach ($name in $promotion.Names) { Move-Item -LiteralPath (Join-Path $promotion.Root $name) -Destination (Join-Path $defender $name) }
+        $preflight = Join-Path $promotion.Root 'CodexRemote-fix-2.5.22-clean-preflight.json'
+        Write-CcodTask5Json $preflight ([ordered]@{ schemaVersion = 1; valid = $true; version = '2.5.22'; gitCommit = $fixture.GitCommit; repositoryRoot = [IO.Path]::GetFullPath($repositoryRoot) })
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $fixture.Root
+        $draft.State.Uploaded.AddRange([string[]]$fixture.Names)
+        Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $fixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        Write-CcodTask5Json (Join-Path $acceptance 'CodexRemote-fix-2.5.22-official-draft.complete.json') (New-CcodTask9AcceptanceRecord -AssetFixture $fixture -EvidenceRoot $promotion.Root)
+        $probe = [pscustomobject]@{ Replaced = $false }
+        &$module {
+            param($Path,$Probe)
+            $script:CcodPinnedPreflightPath = $Path
+            $script:CcodPinnedPreflightProbe = $Probe
+            $script:CcodOriginalPinnedReader = ${function:Read-CcodGitHubDraftContractJson}
+            Set-Item Function:script:Read-CcodGitHubDraftContractJson -Value {
+                param($Path,$ErrorId)
+                $document = & $script:CcodOriginalPinnedReader -Path $Path -ErrorId $ErrorId
+                if ($Path -ceq $script:CcodPinnedPreflightPath -and -not $script:CcodPinnedPreflightProbe.Replaced) {
+                    [IO.File]::AppendAllText($Path, ' ', [Text.UTF8Encoding]::new($false))
+                    $script:CcodPinnedPreflightProbe.Replaced = $true
+                }
+                return $document
+            }
+        } $preflight $probe
+        Assert-CcodThrows {
+            Invoke-CcodTask6DraftCore -Module $module -Mode Promote -Tag 'v2.5.22' -AssetDirectory $fixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
+        } 'CCOD_GITHUB_DRAFT_PREFLIGHT_INVALID'
+        Assert-CcodTrue $probe.Replaced 'replacement lands after the validated pinned read'
+        Assert-CcodTrue (-not $draft.State.Promoted) 'no visibility mutation occurs for changed preflight bytes'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $promotion -and [IO.Directory]::Exists($promotion.Root)) { [IO.Directory]::Delete($promotion.Root, $true) }
+        if ($null -ne $fixture) { Remove-CcodTask5ExactAssetFixture $fixture }
+    }
+}
+
 Invoke-CcodTask6Test 'fix1-evidence-layout' 'Promote accepts separate Defender receipts, verification, and acceptance evidence and reads the final draft state back' {
     $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1Evidence'
     $assetFixture = $null
@@ -3921,7 +5879,7 @@ Invoke-CcodTask6Test 'fix1-evidence-layout' 'Promote accepts separate Defender r
         $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
         Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
         Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
-        $acceptanceRecord = [ordered]@{ schemaVersion = 1; kind = 'official-draft-acceptance'; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; candidateManifestSha256 = Get-CcodTestFileSha256 (Join-Path $assetFixture.Root $assetFixture.Names[4]); phase = 'Complete'; completedAtUtc = '2030-02-03T04:05:07.0000000Z' }
+        $acceptanceRecord = New-CcodTask9AcceptanceRecord -AssetFixture $assetFixture -EvidenceRoot (Get-CcodTask9EvidenceRoot)
         [IO.File]::WriteAllText((Join-Path $acceptance 'CodexRemote-fix-2.5.22-official-draft.complete.json'), (($acceptanceRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
         $result = Invoke-CcodTask6DraftCore -Module $module -Mode Promote -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters
         Assert-CcodTrue ([bool]$result.Promoted) 'promotion succeeds with separated evidence planes'
@@ -3976,26 +5934,34 @@ Invoke-CcodTask6Test 'fix1-evidence-types' 'persisted Verify and acceptance reco
         [IO.Directory]::CreateDirectory($acceptanceDirectory) | Out-Null
         [IO.Directory]::CreateDirectory($verificationDirectory) | Out-Null
         $manifestHash = Get-CcodTestFileSha256 (Join-Path $assetFixture.Root $assetFixture.Names[4])
-        $acceptanceRecord = [ordered]@{
-            schemaVersion = 1
-            kind = 'official-draft-acceptance'
-            version = @('2.5.22')
-            gitCommit = [string]$assetFixture.GitCommit
-            candidateManifestSha256 = $manifestHash
-            phase = 'Complete'
-            completedAtUtc = '2030-02-03T04:05:07.0000000Z'
-        }
+        $acceptanceRecord = New-CcodTask9AcceptanceRecord -AssetFixture $assetFixture -EvidenceRoot $evidence
+        [IO.File]::WriteAllText((Join-Path $acceptanceDirectory 'CodexRemote-fix-2.5.22-official-draft.complete.json'), (($acceptanceRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        &$module {param($Evidence,$Assets,$Commit)Read-CcodGitHubDraftAcceptance -EvidenceDirectory $Evidence -AssetDirectory $Assets -Tag 'v2.5.22' -Version '2.5.22' -GitCommit $Commit|Out-Null} $evidence $assetFixture.Root $assetFixture.GitCommit
+        [Console]::WriteLine('CCOD_ACCEPTANCE_SCALAR_CONTROL_PASSED')
+        $acceptanceRecord.version=@('2.5.22')
         [IO.File]::WriteAllText((Join-Path $acceptanceDirectory 'CodexRemote-fix-2.5.22-official-draft.complete.json'), (($acceptanceRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
         Assert-CcodThrows {
-            &$module { param($Evidence,$Assets,$Version,$Commit) Read-CcodGitHubDraftAcceptance -EvidenceDirectory $Evidence -AssetDirectory $Assets -Version $Version -GitCommit $Commit } $evidence $assetFixture.Root '2.5.22' $assetFixture.GitCommit | Out-Null
+            &$module { param($Evidence,$Assets,$Tag,$Version,$Commit) Read-CcodGitHubDraftAcceptance -EvidenceDirectory $Evidence -AssetDirectory $Assets -Tag $Tag -Version $Version -GitCommit $Commit } $evidence $assetFixture.Root 'v2.5.22' '2.5.22' $assetFixture.GitCommit | Out-Null
         } 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID'
         $names = [string[]]$assetFixture.Names
+        $originalAcceptance=&$module {${function:Read-CcodGitHubDraftAcceptance}}
+        try {
+            &$module {
+                param($Original)
+                $body=$Original.ToString();$guard='$record.version -isnot [string] -or '
+                Assert-CcodTrue (([regex]::Matches($body,[regex]::Escape($guard))).Count-eq1) 'one acceptance version type guard exists'
+                Set-Item -LiteralPath Function:script:Read-CcodGitHubDraftAcceptance -Value ([scriptblock]::Create($body.Replace($guard,'')))
+            } $originalAcceptance
+            &$module {param($Evidence,$Assets,$Commit)Read-CcodGitHubDraftAcceptance -EvidenceDirectory $Evidence -AssetDirectory $Assets -Tag 'v2.5.22' -Version '2.5.22' -GitCommit $Commit|Out-Null} $evidence $assetFixture.Root $assetFixture.GitCommit
+            [Console]::WriteLine('CCOD_ACCEPTANCE_VERSION_GUARD_REMOVAL_REACHED')
+        } finally {&$module {param($Original)Set-Item -LiteralPath Function:script:Read-CcodGitHubDraftAcceptance -Value $Original} $originalAcceptance}
         $hashes = [Collections.Generic.List[string]]::new()
         foreach ($name in $names) { $hashes.Add((Get-CcodTestFileSha256 (Join-Path $assetFixture.Root $name))) }
         $verificationRecord = [ordered]@{
             schemaVersion = 1
             kind = 'github-draft-verification'
-            tag = @('v2.5.22')
+            tag = 'v2.5.22'
+            draftId = '123'
             version = '2.5.22'
             gitCommit = [string]$assetFixture.GitCommit
             draft = $true
@@ -4005,10 +5971,16 @@ Invoke-CcodTask6Test 'fix1-evidence-types' 'persisted Verify and acceptance reco
             candidateManifestSha256 = $manifestHash
         }
         [IO.File]::WriteAllText((Join-Path $verificationDirectory 'CodexRemote-fix-2.5.22-draft-verified.json'), (($verificationRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        &$module {param($Evidence,$Assets,$Commit)Read-CcodGitHubDraftVerification -EvidenceDirectory $Evidence -AssetDirectory $Assets -Tag 'v2.5.22' -Version '2.5.22' -GitCommit $Commit|Out-Null} $evidence $assetFixture.Root $assetFixture.GitCommit
+        [Console]::WriteLine('CCOD_VERIFY_SCALAR_CONTROL_PASSED')
+        $verificationRecord.tag=@('v2.5.22')
+        [IO.File]::WriteAllText((Join-Path $verificationDirectory 'CodexRemote-fix-2.5.22-draft-verified.json'), (($verificationRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
         Assert-CcodThrows {
             &$module { param($Evidence,$Assets,$Tag,$Version,$Commit) Read-CcodGitHubDraftVerification -EvidenceDirectory $Evidence -AssetDirectory $Assets -Tag $Tag -Version $Version -GitCommit $Commit } $evidence $assetFixture.Root 'v2.5.22' '2.5.22' $assetFixture.GitCommit | Out-Null
         } 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID'
         $verificationRecord.tag = 'v2.5.22'
+        [IO.File]::WriteAllText((Join-Path $verificationDirectory 'CodexRemote-fix-2.5.22-draft-verified.json'), (($verificationRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        &$module {param($Evidence,$Assets,$Commit)Read-CcodGitHubDraftVerification -EvidenceDirectory $Evidence -AssetDirectory $Assets -Tag 'v2.5.22' -Version '2.5.22' -GitCommit $Commit|Out-Null} $evidence $assetFixture.Root $assetFixture.GitCommit
         $malformedNames = New-Object object[] $names.Count
         $nestedName = New-Object object[] 1
         $nestedName[0] = $names[0]
@@ -4018,6 +5990,7 @@ Invoke-CcodTask6Test 'fix1-evidence-types' 'persisted Verify and acceptance reco
             schemaVersion = 1
             kind = 'github-draft-verification'
             tag = 'v2.5.22'
+            draftId = '123'
             version = '2.5.22'
             gitCommit = [string]$assetFixture.GitCommit
             draft = $true
@@ -4036,6 +6009,222 @@ Invoke-CcodTask6Test 'fix1-evidence-types' 'persisted Verify and acceptance reco
     }
 }
 
+Invoke-CcodTask6Test 'review-verify-frozen-authority' 'Verify never attests a frozen asset changed after its remote comparison' {
+    foreach ($attack in @($false,$true)) {
+        $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name ('CcodVerifyFrozenAuthority'+[guid]::NewGuid().ToString('N'))
+        $fixture = $null
+        try {
+            $fixture = New-CcodTask5ExactAssetFixture
+            $preflight = [ordered]@{schemaVersion=1;valid=$true;version='2.5.22';gitCommit=$fixture.GitCommit;repositoryRoot=[IO.Path]::GetFullPath($repositoryRoot)}
+            Write-CcodTask5Json -Path (Join-Path $fixture.Outside 'CodexRemote-fix-2.5.22-clean-preflight.json') -Value $preflight
+            $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $fixture.Root
+            Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $fixture.Root -EvidenceDirectory $fixture.Outside -Adapters $draft.Adapters | Out-Null
+            $firstName = [string]$fixture.Names[0]
+            $originalHash = Get-CcodTestFileSha256 (Join-Path $fixture.Root $firstName)
+            $state = [pscustomobject]@{Frozen=$null;Downloads=0;Attempted=$false;Changed=$false;Attack=$attack;Names=[string[]]$fixture.Names;RemoteRoot=$fixture.Root}
+            & $module {
+                param($State)
+                $script:CcodVerifyFreezeState=$State
+                $script:CcodVerifyOriginalFreeze=${function:New-CcodGitHubDraftFrozenAssetSet}
+                function script:New-CcodGitHubDraftFrozenAssetSet {
+                    param($AssetDirectory,$Version,$Contract)
+                    $result=& $script:CcodVerifyOriginalFreeze -AssetDirectory $AssetDirectory -Version $Version -Contract $Contract
+                    $script:CcodVerifyFreezeState.Frozen=$result.Directory
+                    return $result
+                }
+            } $state
+            $draft.Adapters.DownloadAsset = {
+                param($Tag,$Name,$Destination)
+                [IO.File]::Copy((Join-Path $state.RemoteRoot $Name),$Destination,$false)
+                $state.Downloads++
+                if ($state.Attack -and $state.Downloads -eq $state.Names.Count) {
+                    $state.Attempted=$true
+                    [IO.File]::WriteAllText((Join-Path $state.Frozen $state.Names[0]),'changed after the earlier comparison',[Text.UTF8Encoding]::new($false))
+                    $state.Changed=$true
+                }
+            }.GetNewClosure()
+            $outcome = try {
+                $result = Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $fixture.Root -EvidenceDirectory $fixture.Outside -Adapters $draft.Adapters
+                [pscustomobject]@{Success=$true;Result=$result;ErrorId=$null}
+            } catch { [pscustomobject]@{Success=$false;Result=$null;ErrorId=$_.FullyQualifiedErrorId} }
+            Assert-CcodEqual $fixture.Names.Count $state.Downloads 'all remote comparisons are reached before the mutation seam'
+            Assert-CcodTrue (-not [string]::IsNullOrWhiteSpace($state.Frozen)) 'the actual production freeze helper was invoked'
+            if (-not $attack) {
+                Assert-CcodTrue $outcome.Success 'an unchanged frozen candidate has a passing control'
+                $receipt = [IO.File]::ReadAllText($outcome.Result.VerificationPath) | ConvertFrom-Json
+                Assert-CcodEqual $originalHash $receipt.assetSha256[0] 'the control attests the original remote bytes'
+                $manifestName = & $module { Get-CcodGitHubDraftManifestName '2.5.22' }
+                Assert-CcodEqual (Get-CcodTestFileSha256 (Join-Path $fixture.Root $manifestName)) $receipt.candidateManifestSha256 'the candidate manifest hash remains bound to the initially validated bytes'
+                [Console]::WriteLine('CCOD_VERIFY_FROZEN_CONTROL_PASSED')
+            } else {
+                Assert-CcodTrue $state.Attempted 'the writer reaches an already-compared frozen asset'
+                Assert-CcodTrue (-not $outcome.Success) 'Verify must not mark changed local bytes as remotely verified'
+                Assert-CcodTrue (-not $state.Changed) 'the held frozen file excludes the writer'
+                Assert-CcodTrue ($outcome.ErrorId -like 'CCOD_GITHUB_DRAFT_READBACK_FAILED*') 'the failed download boundary stays fail-closed'
+            }
+            Assert-CcodTrue (-not [IO.Directory]::Exists($state.Frozen)) 'frozen handles are released before temporary cleanup'
+        } finally {
+            Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+            if ($null -ne $fixture) { Remove-CcodTask5ExactAssetFixture $fixture }
+        }
+    }
+}
+
+Invoke-CcodTask6Test 'review-verify-ancestor' 'Verify excludes ancestor rename while comparing frozen assets' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name ('CcodVerifyAncestor'+[guid]::NewGuid().ToString('N'))
+    $fixture = $null
+    try {
+        $fixture = New-CcodTask5ExactAssetFixture
+        Write-CcodTask5Json -Path (Join-Path $fixture.Outside 'CodexRemote-fix-2.5.22-clean-preflight.json') -Value ([ordered]@{schemaVersion=1;valid=$true;version='2.5.22';gitCommit=$fixture.GitCommit;repositoryRoot=[IO.Path]::GetFullPath($repositoryRoot)})
+        $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $fixture.Root
+        Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $fixture.Root -EvidenceDirectory $fixture.Outside -Adapters $draft.Adapters | Out-Null
+        $parent = Join-Path $fixture.Outside 'owned-freeze-parent'
+        [IO.Directory]::CreateDirectory($parent) | Out-Null
+        $state = [pscustomobject]@{Parent=$parent;Frozen=$null;Downloads=0;Attempted=$false;Renamed=$false;Names=[string[]]$fixture.Names;RemoteRoot=$fixture.Root}
+        & $module {
+            param($State)
+            $script:CcodVerifyAncestorState=$State
+            $script:CcodVerifyOriginalFreeze=${function:New-CcodGitHubDraftFrozenAssetSet}
+            function script:New-CcodGitHubDraftFrozenAssetSet {
+                param($AssetDirectory,$Version,$Contract)
+                $result=& $script:CcodVerifyOriginalFreeze -AssetDirectory $AssetDirectory -Version $Version -Contract $Contract
+                $target=Join-Path $script:CcodVerifyAncestorState.Parent 'frozen'
+                [IO.Directory]::Move($result.Directory,$target)
+                $result.Directory=$target
+                $script:CcodVerifyAncestorState.Frozen=$target
+                return $result
+            }
+        } $state
+        $draft.Adapters.DownloadAsset = {
+            param($Tag,$Name,$Destination)
+            [IO.File]::Copy((Join-Path $state.RemoteRoot $Name),$Destination,$false)
+            $state.Downloads++
+            if ($state.Downloads -eq $state.Names.Count) {
+                $state.Attempted=$true
+                $moved=$state.Parent+'.moved'
+                try {[IO.Directory]::Move($state.Parent,$moved);$state.Renamed=$true}
+                finally {if($state.Renamed){[IO.Directory]::Move($moved,$state.Parent)}}
+            }
+        }.GetNewClosure()
+        $outcome = try {
+            Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $fixture.Root -EvidenceDirectory $fixture.Outside -Adapters $draft.Adapters | Out-Null
+            [pscustomobject]@{Success=$true;ErrorId=$null}
+        } catch {[pscustomobject]@{Success=$false;ErrorId=$_.FullyQualifiedErrorId}}
+        Assert-CcodEqual $fixture.Names.Count $state.Downloads 'the real held comparison path reaches its last download'
+        Assert-CcodTrue $state.Attempted 'only the fixture-owned ancestor was targeted'
+        Assert-CcodTrue (-not $state.Renamed) 'frozen ancestor authority excludes an ABA rename'
+        Assert-CcodTrue (-not $outcome.Success) 'the blocked adapter operation cannot produce verification evidence'
+        Assert-CcodTrue ($outcome.ErrorId -like 'CCOD_GITHUB_DRAFT_READBACK_FAILED*') 'ancestor failure is not disguised as an unrelated fixture error'
+        Assert-CcodTrue (-not [IO.Directory]::Exists($state.Frozen)) 'the frozen subtree is cleaned after releasing authorities'
+        [IO.Directory]::Move($parent,$parent+'.released')
+        [IO.Directory]::Move($parent+'.released',$parent)
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $fixture) {Remove-CcodTask5ExactAssetFixture $fixture}
+    }
+}
+
+Invoke-CcodTask6Test 'review-verify-authority-boundaries' 'Verify pins original bytes before callbacks and holds them through receipt readback' {
+    foreach ($mode in @('Control','ChangedBeforePin','ExistingWriter','ReceiptWrite','ReceiptDirectory')) {
+        $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name ('CcodVerifyAuthorityBoundary'+[guid]::NewGuid().ToString('N'))
+        $fixture=$null;$state=$null
+        try {
+            $fixture=New-CcodTask5ExactAssetFixture
+            Write-CcodTask5Json -Path (Join-Path $fixture.Outside 'CodexRemote-fix-2.5.22-clean-preflight.json') -Value ([ordered]@{schemaVersion=1;valid=$true;version='2.5.22';gitCommit=$fixture.GitCommit;repositoryRoot=[IO.Path]::GetFullPath($repositoryRoot)})
+            $draft=New-CcodTask6DraftAdapterFixture -AssetDirectory $fixture.Root
+            Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $fixture.Root -EvidenceDirectory $fixture.Outside -Adapters $draft.Adapters | Out-Null
+            $receiptPath=& $module {param($Root) Get-CcodGitHubDraftVerificationPath $Root '2.5.22' -CreatePlane} $fixture.Outside
+            $state=[pscustomobject]@{Mode=$mode;Frozen=$null;Writer=$null;Names=[string[]]$fixture.Names;Downloads=0;RemoteRoot=$fixture.Root;Attempted=$false;Changed=$false;PublishedSeen=$false;Receipt=$receiptPath}
+            & $module {
+                param($State)
+                $script:CcodVerifyBoundaryState=$State
+                $script:CcodVerifyOriginalFreeze=${function:New-CcodGitHubDraftFrozenAssetSet}
+                function script:New-CcodGitHubDraftFrozenAssetSet {
+                    param($AssetDirectory,$Version,$Contract)
+                    $result=& $script:CcodVerifyOriginalFreeze -AssetDirectory $AssetDirectory -Version $Version -Contract $Contract
+                    $script:CcodVerifyBoundaryState.Frozen=$result.Directory
+                    $target=Join-Path $result.Directory $script:CcodVerifyBoundaryState.Names[1]
+                    if ($script:CcodVerifyBoundaryState.Mode -ceq 'ChangedBeforePin') {
+                        [IO.File]::WriteAllText($target,'changed before pin',[Text.UTF8Encoding]::new($false))
+                        $script:CcodVerifyBoundaryState.Attempted=$true
+                    }
+                    if ($script:CcodVerifyBoundaryState.Mode -ceq 'ExistingWriter') {
+                        $script:CcodVerifyBoundaryState.Writer=[IO.File]::Open($target,[IO.FileMode]::Open,[IO.FileAccess]::ReadWrite,([IO.FileShare]::ReadWrite -bor [IO.FileShare]::Delete))
+                        $script:CcodVerifyBoundaryState.Attempted=$true
+                    }
+                    return $result
+                }
+            } $state
+            $draft.Adapters.DownloadAsset={param($Tag,$Name,$Destination) $state.Downloads++;[IO.File]::Copy((Join-Path $state.RemoteRoot $Name),$Destination,$false)}.GetNewClosure()
+            $draft.Adapters.GetTagCommit={
+                param($Tag,[bool]$ActionsOnly)
+                if ($state.Mode -in @('ReceiptWrite','ReceiptDirectory') -and [IO.File]::Exists($state.Receipt)) {
+                    $state.PublishedSeen=$true;$state.Attempted=$true
+                    if ($state.Mode -ceq 'ReceiptWrite') {
+                        [IO.File]::WriteAllText((Join-Path $state.Frozen $state.Names[0]),'changed during receipt readback',[Text.UTF8Encoding]::new($false));$state.Changed=$true
+                    } else {
+                        try {[IO.Directory]::Move($state.Frozen,$state.Frozen+'.moved');$state.Changed=$true}
+                        finally {if($state.Changed){[IO.Directory]::Move($state.Frozen+'.moved',$state.Frozen)}}
+                    }
+                }
+                return 'c'*40
+            }.GetNewClosure()
+            $outcome=try {
+                $result=Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $fixture.Root -EvidenceDirectory $fixture.Outside -Adapters $draft.Adapters
+                [pscustomobject]@{Success=$true;ErrorId=$null;Result=$result}
+            } catch {[pscustomobject]@{Success=$false;ErrorId=$_.FullyQualifiedErrorId;Result=$null}}
+            if ($mode -ceq 'Control') {
+                Assert-CcodTrue $outcome.Success 'an unchanged candidate verifies before introducing any boundary fault'
+                Assert-CcodTrue ([IO.File]::Exists($receiptPath)) 'the control produces a verification receipt'
+            } else {
+                Assert-CcodTrue $state.Attempted "$mode reaches its intended mutation seam"
+                Assert-CcodTrue (-not $outcome.Success) "$mode cannot yield a successful Verify"
+                Assert-CcodTrue (-not [IO.File]::Exists($receiptPath)) "$mode leaves no verification receipt"
+                if ($mode -in @('ChangedBeforePin','ExistingWriter')) {
+                    Assert-CcodEqual 0 $state.Downloads 'invalid or writable frozen bytes are rejected before download comparisons'
+                    Assert-CcodTrue ($outcome.ErrorId -like 'CCOD_GITHUB_DRAFT_ASSET_FREEZE_FAILED*') 'the acquisition rejects the exact asset authority'
+                } else {
+                    Assert-CcodEqual $fixture.Names.Count $state.Downloads 'the published-receipt probe follows all remote comparisons'
+                    Assert-CcodTrue $state.PublishedSeen 'readback failure is injected only after actual receipt publication'
+                    Assert-CcodTrue (-not $state.Changed) 'the held file/directory blocks the callback mutation'
+                    Assert-CcodTrue ($outcome.ErrorId -like 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID*') "owned evidence rollback retains the plane-specific error mode=$mode actual=$($outcome.ErrorId)"
+                }
+            }
+            if ($null -ne $state.Writer) {$state.Writer.Dispose();$state.Writer=$null}
+            Assert-CcodTrue (-not [IO.Directory]::Exists($state.Frozen)) 'partial and complete authority acquisition both release before cleanup'
+        } finally {
+            if ($null -ne $state -and $null -ne $state.Writer) {$state.Writer.Dispose()}
+            Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+            if ($null -ne $fixture) {Remove-CcodTask5ExactAssetFixture $fixture}
+        }
+    }
+}
+
+Invoke-CcodTask6Test 'review-verify-rejected-receipt' 'A rejected draft receipt closes its deleted handle before proving absence' {
+    $module=Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name ('CcodRejectedDraftReceipt'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-draft-receipt-rejection-'+[guid]::NewGuid().ToString('N'))
+    [IO.Directory]::CreateDirectory($root) | Out-Null
+    try {
+        $record=[ordered]@{schemaVersion=1;kind='synthetic-self-test'}
+        $good=Join-Path $root 'control.json'
+        & $module {param($Path,$Record) Write-CcodGitHubDraftJsonCreateOnly -Path $Path -Record $Record -ErrorId 'CCOD_TEST_VERIFY_WRITE_FAILED' -ReadbackVerifier {param($PublishedPath) return $true} | Out-Null} $good $record
+        Assert-CcodTrue ([IO.File]::Exists($good)) 'a valid control publishes and reads back successfully'
+        $target=Join-Path $root 'rejected.json'
+        $state=[pscustomobject]@{Calls=0;PublishedSeen=$false}
+        $reject={param($Path) $state.Calls++;$state.PublishedSeen=[IO.File]::Exists($Path);return $false}.GetNewClosure()
+        Assert-CcodThrows {
+            & $module {param($Path,$Record,$Verifier) Write-CcodGitHubDraftJsonCreateOnly -Path $Path -Record $Record -ErrorId 'CCOD_TEST_VERIFY_WRITE_FAILED' -ReadbackVerifier $Verifier | Out-Null} $target $record $reject
+        } 'CCOD_TEST_VERIFY_WRITE_FAILED'
+        Assert-CcodEqual 1 $state.Calls 'the callback rejects exactly one actual publication'
+        Assert-CcodTrue $state.PublishedSeen 'the callback does not delete or hide the file itself'
+        Assert-CcodTrue (-not [IO.File]::Exists($target)) 'production cleanup proves its rejected receipt absent'
+        Assert-CcodTrue ([IO.File]::Exists($good)) 'cleanup preserves the unrelated control receipt'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ([IO.Directory]::Exists($root)) {Remove-Item -LiteralPath $root -Recurse -Force}
+    }
+}
+
 Invoke-CcodTask6Test 'fix1-freeze-assets' 'Stage uploads the exact candidate bytes even when a source asset changes after validation' {
     $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1FreezeAssets'
     $assetFixture = $null
@@ -4066,7 +6255,7 @@ Invoke-CcodTask6Test 'fix1-freeze-assets' 'Stage uploads the exact candidate byt
             [IO.File]::WriteAllText((Join-Path $sourceRoot $expected[0]), 'mutated-after-exact-set', [Text.UTF8Encoding]::new($false))
             $state.Created = $true
             $state.DraftPrivate = $true
-            [pscustomobject]@{ Tag = $Tag; Draft = $true }
+            [pscustomobject][ordered]@{ Tag = $Tag; Id = [string]$state.DraftId; Draft = $true; AssetNames = @() }
         }.GetNewClosure()
         $draft.Adapters.UploadAsset = {
             param($Tag, $Name, $Path)
@@ -4079,6 +6268,9 @@ Invoke-CcodTask6Test 'fix1-freeze-assets' 'Stage uploads the exact candidate byt
             param($Tag, $Name, $Destination)
             [IO.File]::Copy((Join-Path $uploadedRoot $Name), $Destination, $true)
         }.GetNewClosure()
+        $notesFile = Join-Path $assetFixture.Outside 'notes.txt'
+        [IO.File]::WriteAllText($notesFile, 'outside notes', [Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows { Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $draft.Adapters -NotesPath $notesFile | Out-Null } 'CCOD_GITHUB_DRAFT_NOTES_INVALID'
         Invoke-CcodTask6DraftCore -Module $module -Mode Stage -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $draft.Adapters | Out-Null
         Assert-CcodEqual $originalHash ([string]$state.Assets[$expected[0]]) 'Stage uploads the pre-validation bytes rather than the raced source bytes'
     } finally {
@@ -4089,6 +6281,8 @@ Invoke-CcodTask6Test 'fix1-freeze-assets' 'Stage uploads the exact candidate byt
 
 Invoke-CcodTask6Test 'fix1-promote-lock' 'Promote refuses an occupied same-tag lock before changing draft visibility' {
     $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseFix1PromoteLock'
+    $source = [IO.File]::ReadAllText((Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1'), [Text.UTF8Encoding]::new($false))
+    Assert-CcodTrue ($source.Contains('$frozen = $null')) 'Promote initializes frozen state before any failure-prone acquisition'
     $assetFixture = $null
     $promotion = $null
     try {
@@ -4104,7 +6298,7 @@ Invoke-CcodTask6Test 'fix1-promote-lock' 'Promote refuses an occupied same-tag l
         $draft = New-CcodTask6DraftAdapterFixture -AssetDirectory $assetFixture.Root
         $draft.State.Uploaded.AddRange($expected)
         Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $promotion.Root -Adapters $draft.Adapters | Out-Null
-        $acceptanceRecord = [ordered]@{ schemaVersion = 1; kind = 'official-draft-acceptance'; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; candidateManifestSha256 = Get-CcodTestFileSha256 (Join-Path $assetFixture.Root $assetFixture.Names[4]); phase = 'Complete'; completedAtUtc = '2030-02-03T04:05:07.0000000Z' }
+        $acceptanceRecord = New-CcodTask9AcceptanceRecord -AssetFixture $assetFixture -EvidenceRoot (Get-CcodTask9EvidenceRoot)
         [IO.Directory]::CreateDirectory($acceptanceDirectory) | Out-Null
         [IO.File]::WriteAllText((Join-Path $acceptanceDirectory 'CodexRemote-fix-2.5.22-official-draft.complete.json'), (($acceptanceRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
         $draft.Adapters.TryStageLock = { param($Tag) $false }.GetNewClosure()
@@ -4150,10 +6344,10 @@ Invoke-CcodTask6Test 'fix1-evidence-paths' 'verification and acceptance evidence
             Invoke-CcodTask6DraftCore -Module $module -Mode Verify -Tag 'v2.5.22' -AssetDirectory $assetFixture.Root -EvidenceDirectory $evidence -Adapters $verify.Adapters | Out-Null
         } 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID'
         Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $verificationOutside 'CodexRemote-fix-2.5.22-draft-verified.json') -PathType Leaf)) 'Verify does not write through an external verification junction'
-        $acceptanceRecord = [ordered]@{ schemaVersion = 1; kind = 'official-draft-acceptance'; version = '2.5.22'; gitCommit = [string]$assetFixture.GitCommit; candidateManifestSha256 = Get-CcodTestFileSha256 (Join-Path $assetFixture.Root $assetFixture.Names[4]); phase = 'Complete'; completedAtUtc = '2030-02-03T04:05:07.0000000Z' }
+        $acceptanceRecord = New-CcodTask9AcceptanceRecord -AssetFixture $assetFixture -EvidenceRoot (Get-CcodTask9EvidenceRoot)
         [IO.File]::WriteAllText((Join-Path $acceptanceOutside 'CodexRemote-fix-2.5.22-official-draft.complete.json'), (($acceptanceRecord | ConvertTo-Json -Depth 8) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
         Assert-CcodThrows {
-            &$module { param($Evidence,$Assets,$Version,$Commit) Read-CcodGitHubDraftAcceptance -EvidenceDirectory $Evidence -AssetDirectory $Assets -Version $Version -GitCommit $Commit } $evidence $assetFixture.Root '2.5.22' $assetFixture.GitCommit | Out-Null
+            &$module { param($Evidence,$Assets,$Tag,$Version,$Commit) Read-CcodGitHubDraftAcceptance -EvidenceDirectory $Evidence -AssetDirectory $Assets -Tag $Tag -Version $Version -GitCommit $Commit } $evidence $assetFixture.Root 'v2.5.22' '2.5.22' $assetFixture.GitCommit | Out-Null
         } 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID'
     } finally {
         Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
@@ -4161,19 +6355,270 @@ Invoke-CcodTask6Test 'fix1-evidence-paths' 'verification and acceptance evidence
     }
 }
 
+Invoke-CcodTask6Test 'fix1-notes-pinned-read' 'Stage reads approved release notes through a held file authority' {
+    $source = [IO.File]::ReadAllText((Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1'), [Text.UTF8Encoding]::new($false))
+    $start = $source.IndexOf('if (-not [string]::IsNullOrWhiteSpace($NotesPath))')
+    $end = $source.IndexOf('$expected = [string[]]$frozen.Names', $start)
+    Assert-CcodTrue ($start -ge 0 -and $end -gt $start) 'Stage notes block is present'
+    $block = $source.Substring($start, $end - $start)
+    Assert-CcodTrue ($block.Contains('Read-CcodGitHubDraftNotesPinned')) 'Stage notes use the pinned authority reader'
+    Assert-CcodTrue (-not $block.Contains('[IO.File]::ReadAllText($notesFile')) 'Stage notes do not reopen the pathname directly'
+}
+
 Invoke-CcodTask6Test 'fix1-concurrency-canonical' 'workflow dispatch rejects whitespace tag variants instead of normalizing them after concurrency grouping' {
     $releasePath = Join-Path $repositoryRoot '.github/workflows/release.yml'
     $raw = [IO.File]::ReadAllText($releasePath, [Text.UTF8Encoding]::new($false))
     Assert-CcodTrue ($raw -cnotmatch '\$tag\s*=\s*\$tag\.Trim\(\)') 'dispatch tag is validated without post-group normalization'
 }
 
+Invoke-CcodTask6Test 'fix2-defender-absolute' 'Defender entrypoint version commit and artifact digest reject trailing newlines before scan' {
+    $module = Import-Module $releaseDefenderModulePath -Force -PassThru -DisableNameChecking
+    try {
+        $commands = @((Get-Command $defenderPath), (&$module { Get-Command Invoke-CcodReleaseDefenderCheck }), (&$module { Get-Command Invoke-CcodReleaseDefenderCheckCore }))
+        foreach ($command in $commands) {
+            foreach ($parameter in @('ExpectedVersion','ExpectedGitCommit')) {
+                $value = if ($parameter -ceq 'ExpectedVersion') { '2.5.22' } else { 'a' * 40 }
+                $patterns = @($command.Parameters[$parameter].Attributes | Where-Object { $_ -is [Management.Automation.ValidatePatternAttribute] })
+                Assert-CcodEqual 1 $patterns.Count "$($command.Name) has one strict $parameter validator"
+                Assert-CcodTrue ([regex]::IsMatch($value, $patterns[0].RegexPattern)) 'canonical input remains valid'
+                foreach ($suffix in @("`n","`r`n",' ')) {
+                    Assert-CcodTrue (-not [regex]::IsMatch($value + $suffix, $patterns[0].RegexPattern)) "$($command.Name) $parameter rejects a noncanonical suffix"
+                }
+            }
+        }
+        $identity = New-CcodTask5WorkflowIdentity
+        $valid = &$module { param($Identity) Assert-CcodReleaseDefenderOrigin -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $Identity -ExpectedGitCommit ('a' * 40) } $identity
+        Assert-CcodEqual $identity.artifactDigest $valid.artifactDigest 'canonical workflow digest remains valid'
+        $identity.artifactDigest += "`n"
+        Assert-CcodThrows {
+            &$module { param($Identity) Assert-CcodReleaseDefenderOrigin -Origin TrustedWorkflowArtifact -WorkflowArtifactIdentity $Identity -ExpectedGitCommit ('a' * 40) } $identity | Out-Null
+        } 'CCOD_DEFENDER_ORIGIN_INVALID'
+    } finally { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+}
+
 Invoke-CcodTask6Test 'fix1-absolute-tag-anchor' 'release tag and version validators reject trailing newline variants' {
     $release = [IO.File]::ReadAllText((Join-Path $repositoryRoot '.github/workflows/release.yml'), [Text.UTF8Encoding]::new($false))
     $draft = [IO.File]::ReadAllText((Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1'), [Text.UTF8Encoding]::new($false))
     $clean = [IO.File]::ReadAllText((Join-Path $repositoryRoot 'tools/Test-CleanReleaseRunner.ps1'), [Text.UTF8Encoding]::new($false))
+    $assetContract = [IO.File]::ReadAllText((Join-Path $repositoryRoot 'tools/ReleaseAssetContract.psm1'), [Text.UTF8Encoding]::new($false))
     Assert-CcodTrue ($release.Contains('^v\d+\.\d+\.\d+\z')) 'release workflow uses an absolute tag end anchor'
     Assert-CcodTrue ($draft.Contains('^v\d+\.\d+\.\d+\z')) 'draft command uses an absolute tag end anchor'
     Assert-CcodTrue ($clean.Contains('^\d+\.\d+\.\d+\z')) 'clean runner uses an absolute version end anchor'
+    Assert-CcodTrue (-not $assetContract.Contains('^\d+\.\d+\.\d+$')) 'release asset contract has no weak version end anchor'
+    Assert-CcodTrue (-not $assetContract.Contains("'^[0-9a-f]{64}$'")) 'release asset contract has no weak hash end anchor'
+    Assert-CcodTrue (-not $assetContract.Contains("'^[0-9a-f]{40}$'")) 'release asset contract has no weak commit end anchor'
+    Assert-CcodTrue (-not $draft.Contains("'^[0-9a-f]{64}$'")) 'draft command has no weak hash end anchor'
+    Assert-CcodTrue (-not $draft.Contains("'^[0-9a-f]{40}$'")) 'draft command has no weak commit end anchor'
+}
+
+Invoke-CcodTask6Test 'task9-manual-acceptance-strict-parser' 'Promote rejects array-typed phases and newline-suffixed manual hashes' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseTask9StrictManual'
+    $assetFixture = $null
+    $evidence = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $evidence = Join-Path $assetFixture.Outside 'task9-strict-manual'
+        $acceptanceDirectory = Join-Path $evidence 'acceptance'
+        [IO.Directory]::CreateDirectory($acceptanceDirectory) | Out-Null
+        $acceptancePath = Join-Path $acceptanceDirectory 'CodexRemote-fix-2.5.22-official-draft.complete.json'
+        $record = New-CcodTask9AcceptanceRecord -AssetFixture $assetFixture -EvidenceRoot (Get-CcodTask9EvidenceRoot)
+        $record.manualEvidence[0].phase = @('TrayEvidence')
+        [IO.File]::WriteAllText($acceptancePath, (($record | ConvertTo-Json -Depth 12) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows {
+            &$module { param($Evidence,$Assets,$Tag,$Version,$Commit) Read-CcodGitHubDraftAcceptance -EvidenceDirectory $Evidence -AssetDirectory $Assets -Tag $Tag -Version $Version -GitCommit $Commit } $evidence $assetFixture.Root 'v2.5.22' '2.5.22' $assetFixture.GitCommit | Out-Null
+        } 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID'
+        $record = New-CcodTask9AcceptanceRecord -AssetFixture $assetFixture -EvidenceRoot (Get-CcodTask9EvidenceRoot)
+        $record.manualEvidence[0].screenshotSha256 = ('1' * 64) + [char]10
+        [IO.File]::WriteAllText($acceptancePath, (($record | ConvertTo-Json -Depth 12) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows {
+            &$module { param($Evidence,$Assets,$Tag,$Version,$Commit) Read-CcodGitHubDraftAcceptance -EvidenceDirectory $Evidence -AssetDirectory $Assets -Tag $Tag -Version $Version -GitCommit $Commit } $evidence $assetFixture.Root 'v2.5.22' '2.5.22' $assetFixture.GitCommit | Out-Null
+        } 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID'
+    } finally {
+        Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'task9-promote-binds-manual-state' 'Promote rejects acceptance manual hashes that differ from the persisted Complete state' {
+    $module = $null
+    $assetFixture = $null
+    $root = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $root = Join-Path $assetFixture.Outside 'task9-promote-manual-state'
+        $acceptanceDirectory = Join-Path $root 'acceptance'
+        [IO.Directory]::CreateDirectory($acceptanceDirectory) | Out-Null
+        $record = New-CcodTask9AcceptanceRecord -AssetFixture $assetFixture -EvidenceRoot $root
+        $acceptancePath = Join-Path $acceptanceDirectory 'CodexRemote-fix-2.5.22-official-draft.complete.json'
+        [IO.File]::WriteAllText($acceptancePath, (($record | ConvertTo-Json -Depth 12) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseTask9ManualState'
+        $control=&$module {param($Evidence,$Assets,$Commit) Read-CcodGitHubDraftAcceptance -EvidenceDirectory $Evidence -AssetDirectory $Assets -Tag 'v2.5.22' -Version '2.5.22' -GitCommit $Commit} $root $assetFixture.Root $assetFixture.GitCommit
+        Assert-CcodEqual 'Complete' $control.phase 'complete persisted state and artifact control passes before mutation'
+        $statePaths=@((Join-Path $root 'official-draft-acceptance\08-Complete.json'),(Join-Path $root 'official-draft-acceptance\manual-evidence\TrayEvidence-About.json'))
+        $stateHashes=@($statePaths|ForEach-Object {Get-CcodTestFileSha256 $_})
+        $screenshotPath=Join-Path $root 'official-draft-artifacts\About\screenshot.bin'
+        [IO.File]::AppendAllText($screenshotPath,'replacement-reviewed-screenshot',[Text.UTF8Encoding]::new($false))
+        $record.manualEvidence[0].screenshotSha256 = Get-CcodTestFileSha256 $screenshotPath
+        Write-CcodTask5Json -Path $acceptancePath -Value $record
+        Assert-CcodTrue (&$module {param($Root,$Manual) Assert-CcodGitHubDraftManualEvidenceArtifacts -EvidenceDirectory $Root -ManualEvidence $Manual} $root $record.manualEvidence) 'updated acceptance and artifact agree independently of the original persisted state'
+        Assert-CcodThrows { &$module { param($Evidence,$Assets,$Tag,$Commit) Read-CcodGitHubDraftAcceptance -EvidenceDirectory $Evidence -AssetDirectory $Assets -Tag $Tag -Version '2.5.22' -GitCommit $Commit } $root $assetFixture.Root 'v2.5.22' $assetFixture.GitCommit } 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID'
+        $original=&$module {${function:Read-CcodGitHubDraftAcceptance}}
+        try {
+            &$module {
+                param($Original)
+                $body=$Original.ToString();$start=$body.IndexOf('$stateCompleteManual =');$end=$body.IndexOf('[void](Assert-CcodGitHubDraftManualEvidenceArtifacts', $start)
+                if($start-lt0-or$end-le$start){throw 'manual-state mutant boundary missing'}
+                Set-Item Function:script:Read-CcodGitHubDraftAcceptance -Value ([scriptblock]::Create($body.Remove($start,$end-$start)))
+            } $original
+            $mutant=&$module {param($Evidence,$Assets,$Commit) Read-CcodGitHubDraftAcceptance -EvidenceDirectory $Evidence -AssetDirectory $Assets -Tag 'v2.5.22' -Version '2.5.22' -GitCommit $Commit} $root $assetFixture.Root $assetFixture.GitCommit
+            Assert-CcodEqual 'Complete' $mutant.phase 'removing only persisted-state comparison admits the otherwise-valid negative'
+        } finally {&$module {param($Original) Set-Item Function:script:Read-CcodGitHubDraftAcceptance -Value $Original} $original}
+        for($index=0;$index-lt$statePaths.Count;$index++){Assert-CcodEqual $stateHashes[$index] (Get-CcodTestFileSha256 $statePaths[$index]) 'independent persisted state was never rewritten with the acceptance mutation'}
+        Assert-CcodThrows {&$module {param($Evidence,$Assets,$Commit) Read-CcodGitHubDraftAcceptance -EvidenceDirectory $Evidence -AssetDirectory $Assets -Tag 'v2.5.22' -Version '2.5.22' -GitCommit $Commit} $root $assetFixture.Root $assetFixture.GitCommit} 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID'
+    } finally {
+        if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'task9-promote-binds-all-assets' 'Promote rejects changed Setup bytes even when portable and manifest bytes are unchanged' {
+    $module = $null
+    $assetFixture = $null
+    $root = $null
+    try {
+        $assetFixture = New-CcodTask5ExactAssetFixture
+        $root = Join-Path $assetFixture.Outside 'task9-promote-all-assets'
+        $acceptanceDirectory = Join-Path $root 'acceptance'
+        [IO.Directory]::CreateDirectory($acceptanceDirectory) | Out-Null
+        $record = New-CcodTask9AcceptanceRecord -AssetFixture $assetFixture -EvidenceRoot $root
+        $acceptancePath = Join-Path $acceptanceDirectory 'CodexRemote-fix-2.5.22-official-draft.complete.json'
+        [IO.File]::WriteAllText($acceptancePath, (($record | ConvertTo-Json -Depth 12) + [Environment]::NewLine), [Text.UTF8Encoding]::new($false))
+        $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseTask9AllAssets'
+        $control=&$module {param($Evidence,$Assets,$Commit) Read-CcodGitHubDraftAcceptance -EvidenceDirectory $Evidence -AssetDirectory $Assets -Tag 'v2.5.22' -Version '2.5.22' -GitCommit $Commit} $root $assetFixture.Root $assetFixture.GitCommit
+        Assert-CcodEqual 'Complete' $control.phase 'original complete candidate passes before changing Setup'
+        $portableHash=Get-CcodTestFileSha256 (Join-Path $assetFixture.Root $assetFixture.Names[4])
+        $completePath=Join-Path $root 'official-draft-acceptance\08-Complete.json'
+        $completeHash=Get-CcodTestFileSha256 $completePath
+        [IO.File]::AppendAllText((Join-Path $assetFixture.Root $assetFixture.Names[5]), 'candidate-drift', [Text.UTF8Encoding]::new($false))
+        [IO.File]::WriteAllText((Join-Path $assetFixture.Root $assetFixture.Names[6]),((Get-CcodTestFileSha256 (Join-Path $assetFixture.Root $assetFixture.Names[5]))+' *'+$assetFixture.Names[5]),[Text.UTF8Encoding]::new($false))
+        Sync-CcodTask5OuterAssetHash -Fixture $assetFixture -Distribution Setup -AssetName $assetFixture.Names[5]
+        Sync-CcodTask5OuterAssetHash -Fixture $assetFixture -Distribution Setup -AssetName $assetFixture.Names[6]
+        $contract=&$module {param($Root) Test-CcodExactReleaseAssetSet -AssetDirectory $Root -Version '2.5.22'} $assetFixture.Root
+        Assert-CcodTrue $contract.Valid 'changed Setup fixture independently satisfies the complete asset contract'
+        Assert-CcodThrows { &$module { param($Evidence,$Assets,$Tag,$Commit) Read-CcodGitHubDraftAcceptance -EvidenceDirectory $Evidence -AssetDirectory $Assets -Tag $Tag -Version '2.5.22' -GitCommit $Commit } $root $assetFixture.Root 'v2.5.22' $assetFixture.GitCommit } 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID'
+        $original=&$module {${function:Read-CcodGitHubDraftAcceptance}}
+        try {
+            &$module {
+                param($Original)
+                $body=$Original.ToString();$start=$body.IndexOf('$currentAssets =');$end=$body.IndexOf('if ([string]$completeCandidate.version', $start)
+                if($start-lt0-or$end-le$start){throw 'all-assets mutant boundary missing'}
+                Set-Item Function:script:Read-CcodGitHubDraftAcceptance -Value ([scriptblock]::Create($body.Remove($start,$end-$start)))
+            } $original
+            $mutant=&$module {param($Evidence,$Assets,$Commit) Read-CcodGitHubDraftAcceptance -EvidenceDirectory $Evidence -AssetDirectory $Assets -Tag 'v2.5.22' -Version '2.5.22' -GitCommit $Commit} $root $assetFixture.Root $assetFixture.GitCommit
+            Assert-CcodEqual 'Complete' $mutant.phase 'removing only the persisted asset comparison admits a valid replacement candidate'
+        } finally {&$module {param($Original) Set-Item Function:script:Read-CcodGitHubDraftAcceptance -Value $Original} $original}
+        Assert-CcodEqual $portableHash (Get-CcodTestFileSha256 (Join-Path $assetFixture.Root $assetFixture.Names[4])) 'portable release identity was not changed'
+        Assert-CcodEqual $completeHash (Get-CcodTestFileSha256 $completePath) 'original completed candidate was not rebound to new Setup bytes'
+        Assert-CcodThrows {&$module {param($Evidence,$Assets,$Commit) Read-CcodGitHubDraftAcceptance -EvidenceDirectory $Evidence -AssetDirectory $Assets -Tag 'v2.5.22' -Version '2.5.22' -GitCommit $Commit} $root $assetFixture.Root $assetFixture.GitCommit} 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID'
+    } finally {
+        if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        if ($null -ne $assetFixture) { Remove-CcodTask5ExactAssetFixture $assetFixture }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-promote-requires-manual-artifacts' 'Promote rejects manual hashes without matching evidence artifacts' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftReleaseTask9ManualArtifacts'
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-task9-manual-artifacts-' + [guid]::NewGuid().ToString('N'))
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $manual = @(New-CcodTask9ManualEvidenceFixture -ManifestHash ('a' * 64) -Commit ('b' * 40))
+        Assert-CcodThrows { &$module { param($Evidence,$Entries) Assert-CcodGitHubDraftManualEvidenceArtifacts -EvidenceDirectory $Evidence -ManualEvidence $Entries } $root $manual } 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID'
+    } finally {
+        if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-json-writer-rollback' 'Draft JSON writer removes a published destination when readback fails' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftJsonWriter'
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-draft-json-writer-' + [guid]::NewGuid().ToString('N'))
+    $path = Join-Path $root 'verification.json'
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $record = [pscustomobject][ordered]@{ schemaVersion = 1; kind = 'fixture' }
+        $control=Join-Path $root 'control.json'
+        &$module {param($Path,$Value) Write-CcodGitHubDraftJsonCreateOnly -Path $Path -Record $Value -ErrorId 'CCOD_TEST_VERIFY_WRITE_FAILED' -ReadbackVerifier {param($Target) return $true} | Out-Null} $control $record
+        Assert-CcodTrue ([IO.File]::Exists($control)) 'the same writer succeeds with a valid readback'
+        $state=[pscustomobject]@{Calls=0;PublishedSeen=$false}
+        $verifier = {param($Target) $state.Calls++;$state.PublishedSeen=[IO.File]::Exists($Target);return $false}.GetNewClosure()
+        Assert-CcodThrows { &$module { param($Path,$Value,$Verifier) Write-CcodGitHubDraftJsonCreateOnly -Path $Path -Record $Value -ErrorId 'CCOD_TEST_VERIFY_WRITE_FAILED' -ReadbackVerifier $Verifier } $path $record $verifier } 'CCOD_TEST_VERIFY_WRITE_FAILED'
+        Assert-CcodEqual 1 $state.Calls 'readback rejection is actually invoked'
+        Assert-CcodTrue $state.PublishedSeen 'the callback leaves the published file for production cleanup'
+        Assert-CcodTrue (-not [IO.File]::Exists($path)) 'failed draft JSON readback leaves no destination'
+        Assert-CcodTrue ([IO.File]::Exists($control)) 'failed write cleanup preserves an unrelated existing receipt'
+    } finally {
+        if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-json-writer-holds-directory-authority' 'Draft JSON writer holds the evidence directory while publishing and reading back' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftJsonWriterAuthority'
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-draft-json-authority-' + [guid]::NewGuid().ToString('N'))
+    $moved = $root + '.moved'
+    $path = Join-Path $root 'verification.json'
+    try {
+        [IO.Directory]::CreateDirectory($root) | Out-Null
+        $record = [pscustomobject][ordered]@{ schemaVersion = 1; kind = 'fixture' }
+        $bytes = [Text.UTF8Encoding]::new($false).GetBytes((($record | ConvertTo-Json -Depth 8) + [Environment]::NewLine))
+        $attack = [pscustomobject]@{ Succeeded = $false; Attempted = $false }
+        $verifier = {
+            param($Target)
+            try {
+                $replacement = [byte[]]$bytes.Clone()
+                $directory = Split-Path -Parent $Target
+                $attack.Attempted = $true
+                Move-Item -LiteralPath $directory -Destination $moved -Force -ErrorAction Stop
+                [IO.Directory]::CreateDirectory($directory) | Out-Null
+                [IO.File]::WriteAllBytes((Join-Path $directory ([IO.Path]::GetFileName($Target))), $replacement)
+                $attack.Succeeded = $true
+            } catch { $attack.Succeeded = $false }
+            return $true
+        }.GetNewClosure()
+        &$module { param($Path,$Value,$Verifier) Write-CcodGitHubDraftJsonCreateOnly -Path $Path -Record $Value -ErrorId 'CCOD_TEST_VERIFY_WRITE_FAILED' -ReadbackVerifier $Verifier | Out-Null } $path $record $verifier
+        Assert-CcodTrue $attack.Attempted 'the actual directory rename is attempted, not masked by an earlier file read failure'
+        Assert-CcodTrue (-not $attack.Succeeded) 'held evidence directory authority blocks same-path replacement during readback'
+    } finally {
+        if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        foreach ($directory in @($root,$moved)) { if (Test-Path -LiteralPath $directory) { Remove-Item -LiteralPath $directory -Recurse -Force -ErrorAction SilentlyContinue } }
+    }
+}
+
+Invoke-CcodTask6Test 'fix1-json-reader-pins-parent-authority' 'Draft JSON reader rejects a junction parent instead of following pathname substitution' {
+    $module = Import-CcodTask6ToolModule -Path (Join-Path $repositoryRoot 'tools/Invoke-GitHubDraftRelease.ps1') -Name 'CcodGitHubDraftJsonReaderAuthority'
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-draft-json-reader-' + [guid]::NewGuid().ToString('N'))
+    $outside = Join-Path $root 'outside'
+    $link = Join-Path $root 'link'
+    try {
+        [IO.Directory]::CreateDirectory($outside) | Out-Null
+        [IO.File]::WriteAllText((Join-Path $outside 'verification.json'), '{"schemaVersion":1}', [Text.UTF8Encoding]::new($false))
+        New-Item -ItemType Junction -Path $link -Target $outside | Out-Null
+        Assert-CcodThrows {
+            &$module { param($Path) Read-CcodGitHubDraftContractJson -Path $Path -ErrorId 'CCOD_TEST_PINNED_READ_INVALID' } (Join-Path $link 'verification.json') | Out-Null
+        } 'CCOD_TEST_PINNED_READ_INVALID'
+    } finally {
+        if ($null -ne $module) { Remove-Module -Name $module.Name -Force -ErrorAction SilentlyContinue }
+        if (Test-Path -LiteralPath $link) {
+            try { [IO.Directory]::Delete($link, $false) } catch { & cmd.exe /d /c rmdir /s /q $link | Out-Null }
+        }
+        if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+    }
 }
 
-Write-Host 'Release workflow self-tests passed.'
+if ($script:CcodReleaseExecuted -le 0) { throw 'CCOD_RELEASE_TEST_SELECTION_INVALID: no tests executed.' }
+if ($script:CcodReleaseFocus) {
+    Write-Host "CCOD_RELEASE_FOCUSED_TESTS_PASSED case=$script:CcodReleaseFocus executed=$script:CcodReleaseExecuted skipped=$script:CcodReleaseSkipped"
+} else {
+    if ($script:CcodReleaseSkipped -ne 0) { throw 'CCOD_RELEASE_TEST_SELECTION_INVALID: full suite skipped tests.' }
+    Write-Host "Release workflow self-tests passed: $script:CcodReleaseExecuted; skipped=0."
+}
diff --git a/tests/persistence/RuntimeManifest.SelfTest.ps1 b/tests/persistence/RuntimeManifest.SelfTest.ps1
index 0b4269d..15ed16c 100644
--- a/tests/persistence/RuntimeManifest.SelfTest.ps1
+++ b/tests/persistence/RuntimeManifest.SelfTest.ps1
@@ -44,14 +44,65 @@ function Set-CcodTestActiveRuntime {
         $current = if ([IO.File]::Exists((Join-Path $InstallRoot 'active.json'))) { Read-CcodActiveRuntime -InstallRoot $InstallRoot } else { $null }
         $owner = [pscustomobject][ordered]@{ pid=[int]$process.Id; creationTimeUtc=$process.StartTime.ToUniversalTime().ToString('o') }
         $ownership = Enter-CcodLifecycleOwnership -InstallRoot $InstallRoot -RuntimeId $(if ($null -eq $current) { $NewRuntimeId } else { $current.activeRuntime }) -RuntimeGeneration $(if ($null -eq $current) { [UInt64]1 } else { [UInt64]$current.generation }) -OwnerIdentity $owner -UserSid $identity.User.Value -SessionId ([int]$process.SessionId)
-        return Set-CcodActiveRuntime -InstallRoot $InstallRoot -NewRuntimeId $NewRuntimeId -Ownership $ownership -Adapters $Adapters
+        return Invoke-CcodRuntimeCoreSet -InstallRoot $InstallRoot -NewRuntimeId $NewRuntimeId -Ownership $ownership -Adapters $Adapters
     } finally {
         if ($null -ne $ownership -and -not $ownership.released) { Exit-CcodLifecycleOwnership -Ownership $ownership | Out-Null }
         $process.Dispose(); $identity.Dispose()
     }
 }
 
+function Invoke-CcodRuntimeCoreSet {
+    param([Parameter(Mandatory)][string]$InstallRoot,[string]$NewRuntimeId,$TargetGeneration,$FileTransaction,$Ownership,[hashtable]$Adapters)
+    $module = Get-Module -Name RuntimeManifest
+    return & $module { param($Root,$Runtime,$Generation,$Transaction,$Lease,$Injected) Set-CcodActiveRuntimeCore -InstallRoot $Root -NewRuntimeId $Runtime -TargetGeneration $Generation -FileTransaction $Transaction -Ownership $Lease -Adapters $Injected } $InstallRoot $NewRuntimeId $TargetGeneration $FileTransaction $Ownership $Adapters
+}
+
 try {
+    Invoke-CcodTest 'runtime manifest file records preserve strict property order' {
+        $source = [IO.File]::ReadAllText((Join-Path $repositoryRoot 'src/persistence/modules/RuntimeManifest.psm1'), [Text.UTF8Encoding]::new($false))
+        Assert-CcodTrue ($source.Contains('$records.Add([pscustomobject][ordered]@{')) 'runtime file records use deterministic property order'
+    }
+
+    Invoke-CcodTest 'runtime root existence probe preserves lookup failures' {
+        $source = [IO.File]::ReadAllText((Join-Path $repositoryRoot 'src/persistence/modules/RuntimeManifest.psm1'), [Text.UTF8Encoding]::new($false))
+        $start = $source.IndexOf('function Get-CcodRuntimeRoot')
+        $end = $source.IndexOf('function Get-CcodRuntimeFileSha256')
+        Assert-CcodTrue ($start -ge 0 -and $end -gt $start) 'runtime root helper is present as one inspectable definition'
+        $body = $source.Substring($start, $end - $start)
+        Assert-CcodTrue (-not $body.Contains('[IO.Directory]::Exists($root)')) 'runtime root does not collapse access failures through Directory.Exists'
+        Assert-CcodTrue ($body.Contains('catch [Management.Automation.ItemNotFoundException]')) 'runtime root handles only an explicit missing-item exception as absence'
+        $manifestStart = $source.IndexOf('function Test-CcodRuntimeManifest')
+        $manifestEnd = $source.IndexOf('function Get-CcodRuntimeDirectoryForId')
+        Assert-CcodTrue ($manifestStart -ge 0 -and $manifestEnd -gt $manifestStart) 'runtime manifest validator is present as one inspectable definition'
+        Assert-CcodTrue (-not $source.Substring($manifestStart, $manifestEnd - $manifestStart).Contains("'^[0-9a-f]{64}$'")) 'runtime manifest hash validation uses an absolute end anchor'
+        }
+
+    Invoke-CcodTest 'runtime root propagates an injected access failure instead of treating it as missing' {
+        $module = Get-Module -Name RuntimeManifest
+        Assert-CcodTrue ($null -ne $module) 'RuntimeManifest module is loaded for the behavioral probe'
+        try {
+            $error = & $module {
+                function Get-Item { throw [UnauthorizedAccessException]::new('fixture access denied') }
+                try {
+                    Get-CcodRuntimeRoot -RuntimeDirectory ([IO.Path]::GetFullPath((Join-Path $root 'access-denied')))
+                    return $null
+                } catch {
+                    return $_
+                } finally {
+                    Remove-Item -LiteralPath Function:\Get-Item -Force -ErrorAction SilentlyContinue
+                }
+            }
+            Assert-CcodTrue ($null -ne $error -and $error.Exception -is [UnauthorizedAccessException]) 'access failures escape the runtime-root probe'
+        } finally {
+            Remove-Item -LiteralPath Function:\Get-Item -Force -ErrorAction SilentlyContinue
+        }
+    }
+
+    Invoke-CcodTest 'public active runtime setter does not expose adapter injection' {
+        $command = Get-Command Set-CcodActiveRuntime -Module RuntimeManifest
+        Assert-CcodTrue (-not $command.Parameters.ContainsKey('Adapters')) 'public active runtime mutation cannot replace lifecycle fence adapters'
+    }
+
     Invoke-CcodTest 'includes the External renderer integration module in the staged runtime manifest input' {
         $sourceFiles = @(& $installLifecycleModule { param($sourceRoot) Get-CcodLifecycleSourceFiles -SourceRoot $sourceRoot } $repositoryRoot)
         $rendererModule = @($sourceFiles | Where-Object { $_.Relative -ceq 'src\persistence\modules\RendererIntegration.psm1' })
@@ -79,6 +130,26 @@ try {
         Assert-CcodTrue ($first.files[0].sha256 -cmatch '^[0-9a-f]{64}$') 'file hash must be lowercase SHA-256'
     }
 
+    Invoke-CcodTest 'runtime IDs use canonical TAB delimiters' {
+        $files = @(
+            [pscustomobject]@{ path = 'a.txt'; length = [int64]5; sha256 = ('a' * 64) }
+            [pscustomobject]@{ path = 'b.txt'; length = [int64]4; sha256 = ('b' * 64) }
+        )
+        $nonce = '0123456789abcdef0123456789abcdef'
+        $expected = '2.5.22-e71f4818a0f8e98f-0123456789abcdef0123456789abcdef'
+        Assert-CcodEqual $expected (Get-CcodRuntimeId -ProjectVersion '2.5.22' -Files $files -Nonce $nonce) 'runtime ID digest input must use literal TAB delimiters'
+    }
+
+    Invoke-CcodTest 'runtime manifest producer and validator agree on filenames containing consecutive dots' {
+        $runtime = Join-Path $root 'consecutive-dots'
+        New-Item -ItemType Directory -Path $runtime | Out-Null
+        [IO.File]::WriteAllText((Join-Path $runtime 'foo..bar'), 'dot filename', [Text.UTF8Encoding]::new($false))
+        $manifest = New-CcodRuntimeManifest -RuntimeDirectory $runtime -ProjectVersion '2.5.22'
+        Write-CcodAtomicJson -Path (Join-Path $runtime 'manifest.json') -Value $manifest
+        $validation = Test-CcodRuntimeManifest -RuntimeDirectory $runtime -ExpectedRuntimeId $manifest.runtimeId
+        Assert-CcodTrue $validation.Valid 'a safe filename with consecutive dots must validate after production'
+    }
+
     Invoke-CcodTest 'verifies exact runtime bytes and rejects tampering' {
         $runtime = Join-Path $root 'verify'
         New-Item -ItemType Directory -Path $runtime | Out-Null
@@ -121,6 +192,49 @@ try {
         Assert-CcodThrows { Test-CcodRuntimeManifest -RuntimeDirectory $runtime -ExpectedRuntimeId '2.0.0-safe' } 'CCOD_PATH_OUTSIDE_ROOT'
     }
 
+    Invoke-CcodTest 'rejects a runtime directory reached through a reparse ancestor' {
+        $outsideRuntime = Join-Path $outside 'reparse-runtime'
+        $junctionParent = Join-Path $root 'reparse-runtime-parent'
+        New-Item -ItemType Directory -Path $outsideRuntime | Out-Null
+        [IO.File]::WriteAllText((Join-Path $outsideRuntime 'payload.txt'), 'outside runtime', [Text.UTF8Encoding]::new($false))
+        $outsideManifest = New-CcodRuntimeManifest -RuntimeDirectory $outsideRuntime -ProjectVersion '2.0.0'
+        Write-CcodAtomicJson -Path (Join-Path $outsideRuntime 'manifest.json') -Value $outsideManifest
+        New-Item -ItemType Junction -Path $junctionParent -Target $outside | Out-Null
+        $runtime = Join-Path $junctionParent 'reparse-runtime'
+        Assert-CcodThrows { New-CcodRuntimeManifest -RuntimeDirectory $runtime -ProjectVersion '2.0.0' } 'CCOD_REPARSE_PATH'
+        Assert-CcodThrows { Test-CcodRuntimeManifest -RuntimeDirectory $runtime -ExpectedRuntimeId $outsideManifest.runtimeId } 'CCOD_REPARSE_PATH'
+    }
+
+    Invoke-CcodTest 'runtime manifest rejects a noncanonical runtime directory' {
+        $fixture = New-CcodRuntimeFixture -InstallRoot $root -ProjectVersion '2.0.0' -AContent 'a' -BContent 'b'
+        $noncanonical = [string]$fixture.Runtime + '\.'
+        Assert-CcodThrows { Test-CcodRuntimeManifest -RuntimeDirectory $noncanonical -ExpectedRuntimeId $fixture.Manifest.runtimeId } 'CCOD_RUNTIME_PATH_INVALID'
+    }
+
+    Invoke-CcodTest 'runtime manifest rejects a directory at its manifest leaf instead of treating it as missing' {
+        $runtime = Join-Path $root 'manifest-leaf-directory'
+        New-Item -ItemType Directory -Path $runtime | Out-Null
+        [IO.File]::WriteAllText((Join-Path $runtime 'payload.txt'), 'payload', [Text.UTF8Encoding]::new($false))
+        $manifest = New-CcodRuntimeManifest -RuntimeDirectory $runtime -ProjectVersion '2.0.0'
+        New-Item -ItemType Directory -Path (Join-Path $runtime 'manifest.json') | Out-Null
+        $result = Test-CcodRuntimeManifest -RuntimeDirectory $runtime -ExpectedRuntimeId $manifest.runtimeId
+        Assert-CcodEqual 'CCOD_RUNTIME_MANIFEST_INVALID' $result.Code 'manifest directory is invalid state rather than missing file'
+    }
+
+    Invoke-CcodTest 'active pointer rejects a noninteger schema version' {
+        $runtime = New-CcodRuntimeFixture -InstallRoot $root -ProjectVersion '2.5.0' -AContent 'a' -BContent 'b'
+        $pointer = '{"schemaVersion":2.0,"activeRuntime":"' + $runtime.Manifest.runtimeId + '","previousRuntime":null,"generation":1,"updatedAtUtc":"2030-02-03T04:05:06.0000000Z"}'
+        [IO.File]::WriteAllText((Join-Path $root 'active.json'), $pointer, [Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows { Read-CcodActiveRuntime -InstallRoot $root } 'CCOD_RUNTIME_POINTER_INVALID'
+    }
+
+    Invoke-CcodTest 'active pointer rejects a noncanonical UTC timestamp' {
+        $runtime = New-CcodRuntimeFixture -InstallRoot $root -ProjectVersion '2.5.0' -AContent 'a' -BContent 'b'
+        $pointer = [ordered]@{ schemaVersion = 2; activeRuntime = $runtime.Manifest.runtimeId; previousRuntime = $null; generation = [UInt64]1; updatedAtUtc = 123 }
+        [IO.File]::WriteAllText((Join-Path $root 'active.json'), ($pointer | ConvertTo-Json -Compress), [Text.UTF8Encoding]::new($false))
+        Assert-CcodThrows { Read-CcodActiveRuntime -InstallRoot $root } 'CCOD_RUNTIME_POINTER_INVALID'
+    }
+
     Invoke-CcodTest 'rotates an active pointer only to a verified runtime' {
         $installRoot = Join-Path $root 'install'
         New-Item -ItemType Directory -Path $installRoot | Out-Null
@@ -177,6 +291,21 @@ try {
         Assert-CcodThrows { Read-CcodActiveRuntime -InstallRoot $installRoot } 'CCOD_RUNTIME_ID_INVALID'
     }
 
+    Invoke-CcodTest 'rejects dot-only runtime IDs before resolving active runtime paths' {
+        foreach ($runtimeId in @('.', '..')) {
+            $installRoot = Join-Path $root ('dot-runtime-' + [guid]::NewGuid().ToString('N'))
+            New-Item -ItemType Directory -Path $installRoot | Out-Null
+            Write-CcodAtomicJson -Path (Join-Path $installRoot 'active.json') -Value ([ordered]@{
+                schemaVersion = 1
+                activeRuntime = $runtimeId
+                previousRuntime = $null
+                updatedAtUtc = '2030-02-03T04:05:06.0000000Z'
+            })
+            Assert-CcodThrows { Read-CcodActiveRuntime -InstallRoot $installRoot } 'CCOD_RUNTIME_ID_INVALID'
+            if (Test-Path -LiteralPath $installRoot) { Remove-Item -LiteralPath $installRoot -Recurse -Force }
+        }
+    }
+
     Invoke-CcodTest 'default immutable pointer fence commits fresh and append-only upgrade with real ownership' {
         $installRoot=Join-Path $root 'default-immutable-fence';[IO.Directory]::CreateDirectory($installRoot)|Out-Null;$identity=[Security.Principal.WindowsIdentity]::GetCurrent();$process=[Diagnostics.Process]::GetCurrentProcess();$firstTx=$null;$secondTx=$null;$ownership=$null
         $makeGeneration={param($Root,$Content,$Nonce)$source=Join-Path $Root ("source-$Nonce.txt");[IO.File]::WriteAllText($source,$Content,[Text.UTF8Encoding]::new($false));$sha=(Get-FileHash -LiteralPath $source -Algorithm SHA256).Hash.ToLowerInvariant();$records=@([pscustomobject]@{path='payload.txt';length=[int64](Get-Item $source).Length;sha256=$sha});$id=Get-CcodRuntimeId -ProjectVersion '2.5.22' -Files $records -Nonce $Nonce;$tx=Open-CcodInstallGeneration -InstallRoot $Root -RuntimeId $id;Copy-CcodInstallSealedSource -Generation $tx -SourcePath $source -Leaf 'payload.txt' -ExpectedLength $records[0].length -ExpectedSha256 $sha|Out-Null;$runtime=Join-Path $Root "runtime\$id";$manifest=New-CcodRuntimeManifest -RuntimeDirectory $runtime -ProjectVersion '2.5.22' -RuntimeId $id;Write-CcodInstallGenerationManifest -Generation $tx -Manifest $manifest|Out-Null;[pscustomobject]@{Id=$id;Transaction=$tx;Generation=$tx}}
@@ -216,7 +345,7 @@ try {
                 $pointerRoot=Join-Path $installRoot 'state\active-generation';if($kind-ceq'root-file'){[IO.Directory]::CreateDirectory((Split-Path $pointerRoot -Parent))|Out-Null;[IO.File]::WriteAllText($pointerRoot,'not-a-directory',[Text.UTF8Encoding]::new($false))}
                 $owner=[pscustomobject][ordered]@{pid=[int]$process.Id;creationTimeUtc=$process.StartTime.ToUniversalTime().ToString('o')};$ownership=Enter-CcodLifecycleOwnership -InstallRoot $installRoot -RuntimeId $runtimeId -RuntimeGeneration 1 -OwnerIdentity $owner -UserSid $identity.User.Value -SessionId ([int]$process.SessionId)
                 $adapters=if($kind-ceq'lookup-error'){@{GetSelectorRootItem={param($Path)throw [UnauthorizedAccessException]::new('selector lookup denied')}}}else{$null}
-                Assert-CcodThrows {Set-CcodActiveRuntime -InstallRoot $installRoot -NewRuntimeId $runtimeId -TargetGeneration $transaction -FileTransaction $transaction -Ownership $ownership -Adapters $adapters|Out-Null} 'CCOD_RUNTIME_POINTER_INVALID'
+                Assert-CcodThrows { Invoke-CcodRuntimeCoreSet -InstallRoot $installRoot -NewRuntimeId $runtimeId -TargetGeneration $transaction -FileTransaction $transaction -Ownership $ownership -Adapters $adapters | Out-Null } 'CCOD_RUNTIME_POINTER_INVALID'
                 Assert-CcodEqual $false ([IO.File]::Exists((Join-Path $pointerRoot '00000000000000000001.json'))) "$kind failure publishes no active generation"
             }finally{if($null-ne$ownership-and-not$ownership.released){Exit-CcodLifecycleOwnership $ownership|Out-Null};if($null-ne$transaction){Close-CcodInstallFileTransaction $transaction Failed};$process.Dispose();$identity.Dispose()}
         }
@@ -351,7 +480,7 @@ try {
                 }
                 return $true
             }.GetNewClosure()
-            Assert-CcodThrows { Set-CcodActiveRuntime -InstallRoot $installRoot -NewRuntimeId $second.Manifest.runtimeId -Ownership $ownership -Adapters @{ AssertLifecycleFence=$raceFence } } 'CCOD_RUNTIME_FENCE_STALE'
+            Assert-CcodThrows { Invoke-CcodRuntimeCoreSet -InstallRoot $installRoot -NewRuntimeId $second.Manifest.runtimeId -Ownership $ownership -Adapters @{ AssertLifecycleFence=$raceFence } } 'CCOD_RUNTIME_FENCE_STALE'
             $unchanged = Read-CcodActiveRuntime -InstallRoot $installRoot
             Assert-CcodEqual 2 ([UInt64]$unchanged.generation) 'concurrent generation remains committed instead of being reused'
             Assert-CcodEqual $first.Manifest.runtimeId $unchanged.activeRuntime 'stale owner cannot replace the concurrent active runtime'
@@ -374,6 +503,55 @@ try {
         [IO.File]::WriteAllText((Join-Path $installRoot 'active.json'), '{"schemaVersion":2,"activeRuntime":"2.5.0-a","previousRuntime":null,"generation":18446744073709551616,"updatedAtUtc":"2030-02-03T04:05:06.0000000Z"}', [Text.UTF8Encoding]::new($false))
         Assert-CcodThrows { Read-CcodActiveRuntime -InstallRoot $installRoot } 'CCOD_RUNTIME_GENERATION_INVALID'
     }
+
+    Invoke-CcodTest 'accepts Decimal previousGeneration values in active-generation records' {
+        $installRoot = Join-Path $root 'decimal-previous-generation'
+        $pointerRoot = Join-Path $installRoot 'state\active-generation'
+        New-Item -ItemType Directory -Path $pointerRoot -Force | Out-Null
+        $record = [ordered]@{ schemaVersion = 1; generation = [decimal]2; activeRuntime = '2.5.22-a'; previousGeneration = [decimal]1 }
+        [IO.File]::WriteAllText((Join-Path $pointerRoot '00000000000000000002.json'), ($record | ConvertTo-Json -Compress), [Text.UTF8Encoding]::new($false))
+        $first = [ordered]@{ schemaVersion = 1; generation = 1; activeRuntime = '2.5.22-b'; previousGeneration = 0 }
+        [IO.File]::WriteAllText((Join-Path $pointerRoot '00000000000000000001.json'), ($first | ConvertTo-Json -Compress), [Text.UTF8Encoding]::new($false))
+        $actual = Read-CcodActiveRuntime -InstallRoot $installRoot
+        Assert-CcodTrue ([UInt64]$actual.generation -eq [UInt64]2) 'Decimal previousGeneration must not invalidate an otherwise canonical selector chain'
+    }
+
+    Invoke-CcodTest 'rejects legacy active pointer files with alternate data streams' {
+        $installRoot = Join-Path $root 'legacy-pointer-stream'
+        New-Item -ItemType Directory -Path $installRoot | Out-Null
+        $runtime = New-CcodRuntimeFixture -InstallRoot $installRoot -ProjectVersion '2.3.0' -AContent 'ads alpha' -BContent 'ads beta'
+        Write-CcodAtomicJson -Path (Join-Path $installRoot 'active.json') -Value ([ordered]@{ schemaVersion = 1; activeRuntime = $runtime.Manifest.runtimeId; previousRuntime = $null; updatedAtUtc = '2030-02-03T04:05:06.0000000Z' })
+        Add-Content -LiteralPath (Join-Path $installRoot 'active.json') -Stream 'unexpected' -Value 'tampered'
+        Assert-CcodThrows { Read-CcodActiveRuntime -InstallRoot $installRoot } 'CCOD_RUNTIME_POINTER_INVALID'
+    }
+
+    Invoke-CcodTest 'runtime manifest rejects scalar files and noninteger lengths' {
+        $installRoot = Join-Path $root 'manifest-strict-shape'
+        New-Item -ItemType Directory -Path $installRoot | Out-Null
+        $fixture = New-CcodRuntimeFixture -InstallRoot $installRoot -ProjectVersion '2.3.1' -AContent 'shape alpha' -BContent 'shape beta'
+        $path = Join-Path $fixture.Runtime 'manifest.json'
+        $valid = $fixture.Manifest
+        $scalar = [ordered]@{ schemaVersion = 1; projectVersion = '2.3.1'; runtimeId = $valid.runtimeId; files = [ordered]@{ path = 'a.txt'; length = 1; sha256 = ('0' * 64) } }
+        Write-CcodAtomicJson -Path $path -Value $scalar
+        Assert-CcodEqual 'CCOD_RUNTIME_MANIFEST_INVALID' (Test-CcodRuntimeManifest -RuntimeDirectory $fixture.Runtime -ExpectedRuntimeId $valid.runtimeId).Code 'scalar files are rejected by shape'
+        $fraction = [ordered]@{ schemaVersion = 1; projectVersion = '2.3.1'; runtimeId = $valid.runtimeId; files = @([ordered]@{ path = 'a.txt'; length = 1.5; sha256 = ('0' * 64) }) }
+        Write-CcodAtomicJson -Path $path -Value $fraction
+        Assert-CcodEqual 'CCOD_RUNTIME_MANIFEST_INVALID' (Test-CcodRuntimeManifest -RuntimeDirectory $fixture.Runtime -ExpectedRuntimeId $valid.runtimeId).Code 'fractional lengths are rejected by shape'
+    }
+
+    Invoke-CcodTest 'runtime manifest rejects extra properties and string schema versions' {
+        $installRoot = Join-Path $root 'manifest-strict-extra'
+        New-Item -ItemType Directory -Path $installRoot | Out-Null
+        $fixture = New-CcodRuntimeFixture -InstallRoot $installRoot -ProjectVersion '2.3.2' -AContent 'extra alpha' -BContent 'extra beta'
+        $path = Join-Path $fixture.Runtime 'manifest.json'
+        $valid = $fixture.Manifest
+        $extra = [ordered]@{ schemaVersion = 1; projectVersion = '2.3.2'; runtimeId = $valid.runtimeId; files = @(); unexpected = 'x' }
+        Write-CcodAtomicJson -Path $path -Value $extra
+        Assert-CcodEqual 'CCOD_RUNTIME_MANIFEST_INVALID' (Test-CcodRuntimeManifest -RuntimeDirectory $fixture.Runtime -ExpectedRuntimeId $valid.runtimeId).Code 'extra manifest fields are rejected'
+        $stringSchema = [ordered]@{ schemaVersion = '1'; projectVersion = '2.3.2'; runtimeId = $valid.runtimeId; files = @() }
+        Write-CcodAtomicJson -Path $path -Value $stringSchema
+        Assert-CcodEqual 'CCOD_RUNTIME_MANIFEST_INVALID' (Test-CcodRuntimeManifest -RuntimeDirectory $fixture.Runtime -ExpectedRuntimeId $valid.runtimeId).Code 'string schema version is rejected'
+    }
 } finally {
     if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
     if (Test-Path -LiteralPath $outside) { Remove-Item -LiteralPath $outside -Recurse -Force }
diff --git a/tests/persistence/StaticProbeWorker.SelfTest.ps1 b/tests/persistence/StaticProbeWorker.SelfTest.ps1
index 8eb04a2..c0e04f3 100644
--- a/tests/persistence/StaticProbeWorker.SelfTest.ps1
+++ b/tests/persistence/StaticProbeWorker.SelfTest.ps1
@@ -180,7 +180,7 @@ function New-CcodWorkerSuccessResult {
 
 function Get-CcodTestRuntimeId {
     param([string]$ProjectVersion, [object[]]$Files)
-    $lines = foreach ($file in $Files) { '{0}`t{1}`t{2}' -f $file.path,[int64]$file.length,$file.sha256 }
+    $lines = foreach ($file in $Files) { "{0}`t{1}`t{2}" -f $file.path,[int64]$file.length,$file.sha256 }
     $canonical = $lines -join "`n"
     $sha = [Security.Cryptography.SHA256]::Create()
     try { $digest = [BitConverter]::ToString($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes($canonical))).Replace('-','').ToLowerInvariant() }
@@ -1379,6 +1379,16 @@ try {
         Assert-CcodTrue ($identity.UserSid -is [string] -and $identity.UserSid -ceq ([Security.Principal.WindowsIdentity]::GetCurrent().User.Value)) 'identity owner SID is exact'
         Assert-CcodEqual ([int](Get-Process -Id $PID).SessionId) $identity.SessionId 'identity session is exact'
     }
+
+    Invoke-CcodTest 'static probe runtime IDs use canonical TAB delimiters' {
+        $files = @(
+            [pscustomobject]@{ path = 'a.txt'; length = [int64]5; sha256 = ('a' * 64) }
+            [pscustomobject]@{ path = 'b.txt'; length = [int64]4; sha256 = ('b' * 64) }
+        )
+        $nonce = '0123456789abcdef0123456789abcdef'
+        $expected = '2.0.0-e71f4818a0f8e98f-0123456789abcdef0123456789abcdef'
+        Assert-CcodEqual $expected (Get-CcodStaticRuntimeIdFromRecords -ProjectVersion '2.0.0' -Files $files -ExpectedRuntimeId $expected) 'static probe runtime ID digest input must use literal TAB delimiters'
+    }
 } catch {
     Write-Error $_
     exit 1
diff --git a/tests/persistence/Supervisor.SelfTest.ps1 b/tests/persistence/Supervisor.SelfTest.ps1
index 7cda07f..dc8e39a 100644
--- a/tests/persistence/Supervisor.SelfTest.ps1
+++ b/tests/persistence/Supervisor.SelfTest.ps1
@@ -102,6 +102,7 @@ function New-CcodSupervisorFake {
         [pscustomobject][ordered]@{SchemaVersion=1;Name="Fake-$Kind";Kind=$Kind;CreatedNew=$false;Handle=[pscustomobject]@{Kind=$Kind};Disposed=$false}
     }
     $adapters.GetIdentity={$world.Calls.Add('Identity');$identity}.GetNewClosure()
+    $adapters.GetTrayHostIdentity={param($ProcessId,$ExpectedCreationTimeUtc)$world.Calls.Add("TrayIdentity:$ProcessId");[pscustomobject][ordered]@{Outcome='SameIdentity';Pid=[int]$ProcessId;CreationTimeUtc=[string]$ExpectedCreationTimeUtc}}.GetNewClosure()
     $adapters.ResolveLayout={$world.Calls.Add('Layout');$layout}.GetNewClosure()
     $adapters.StartClock={$world.Calls.Add('Clock');[pscustomobject]@{Kind='Clock'}}.GetNewClosure()
     $adapters.GetElapsedMilliseconds={param($Clock)if($world.Elapsed.Count){[long]$world.Elapsed.Dequeue()}else{[long]0}}.GetNewClosure()
@@ -152,7 +153,7 @@ function New-CcodSupervisorFake {
         $world.Calls.Add("New:Lifecycle:$Kind")
         & $transactionModule {param($K,$O,$R,$G,$E,$Owner,$Logon,$Now)New-CcodLifecycleRequest -Kind $K -Origin $O -RuntimeId $R -RuntimeGeneration $G -LeaseEpoch $E -OwnerIdentity $Owner -LogonIdentity $Logon -NowUtc $Now} $Kind $Origin $RuntimeId $RuntimeGeneration $LeaseEpoch $OwnerIdentity $LogonIdentity $NowUtc
     }.GetNewClosure()
-    $adapters.WriteLifecycleRequest={param($StateRoot,$Request)$world.Calls.Add("Write:Lifecycle:$($Request.phase)");$world.ActiveLifecycleRequest=$Request;$world.LifecycleWrites.Add($Request)}.GetNewClosure()
+    $adapters.WriteLifecycleRequest={param($StateRoot,$Request)$world.Calls.Add("Write:Lifecycle:$($Request.phase)");if($world.FailAt -ceq 'WriteLifecycleRequest'){throw 'PRIVATE_LIFECYCLE_WRITE_SECRET'};$world.ActiveLifecycleRequest=$Request;$world.LifecycleWrites.Add($Request)}.GetNewClosure()
     $adapters.MoveLifecyclePhase={param($Request,$NextPhase,$NowUtc)$world.Calls.Add("Move:Lifecycle:$NextPhase");$world.LifecycleMoves.Add($NextPhase);& $transactionModule {param($Value,$Phase,$Now)Move-CcodLifecyclePhase -Request $Value -NextPhase $Phase -NowUtc $Now} $Request $NextPhase $NowUtc}.GetNewClosure()
     $adapters.CompleteLifecycleRequest={param($StateRoot,$Request)$world.Calls.Add("Complete:Lifecycle:$($Request.phase)");$world.CompletedLifecycleRequests.Add($Request);$world.ActiveLifecycleRequest=$null}.GetNewClosure()
     $adapters.GetLifecycleStep={param($Request,$Observation,$NowUtc)& $coordinatorModule {param($Value,$Observed,$Now)Get-CcodLifecycleStep -Request $Value -Observation $Observed -NowUtc $Now} $Request $Observation $NowUtc}.GetNewClosure()
@@ -191,7 +192,7 @@ function New-CcodSupervisorFake {
     $adapters.NewQueue={param($Kind)$world.Calls.Add("Queue:$Kind");if($Kind -ceq 'Command'){Write-Output -NoEnumerate $world.CommandQueue}else{Write-Output -NoEnumerate $world.EventQueue}}.GetNewClosure()
     $adapters.GetQueueCount={param($Queue)[int]$Queue.Count}.GetNewClosure()
     $adapters.TryDequeue={param($Queue)$world.TryDequeueSawRealQueue=[object]::ReferenceEquals($Queue,$world.CommandQueue);if($Queue.Count){[pscustomobject][ordered]@{Succeeded=$true;Value=$Queue.Dequeue()}}else{[pscustomobject][ordered]@{Succeeded=$false;Value=$null}}}.GetNewClosure()
-    $adapters.NewTray={param($Queue,$OnTick,$Catalog,$LanguageMode,$SystemCultureName)$world.NewTraySawRealQueue=[object]::ReferenceEquals($Queue,$world.CommandQueue);$world.Calls.Add('New:Tray');if($world.FailAt -ceq 'NewTray'){throw 'PRIVATE_TRAY_SECRET'};$world.OnTick=$OnTick;$world.TrayArguments=[pscustomobject][ordered]@{Queue=$Queue;OnTick=$OnTick;Catalog=$Catalog;LanguageMode=$LanguageMode;SystemCultureName=$SystemCultureName};[pscustomobject]@{Kind='Tray';CurrentRevision=[UInt64]1;Timer=[pscustomobject]@{Kind='Timer'};ApplicationContext=[pscustomobject]@{Kind='App'}}}.GetNewClosure()
+    $adapters.NewTray={param($Queue,$OnTick,$Catalog,$LanguageMode,$SystemCultureName)$world.NewTraySawRealQueue=[object]::ReferenceEquals($Queue,$world.CommandQueue);$world.Calls.Add('New:Tray');if($world.FailAt -ceq 'NewTray'){throw 'PRIVATE_TRAY_SECRET'};$world.OnTick=$OnTick;$world.TrayArguments=[pscustomobject][ordered]@{Queue=$Queue;OnTick=$OnTick;Catalog=$Catalog;LanguageMode=$LanguageMode;SystemCultureName=$SystemCultureName};[pscustomobject]@{Kind='Tray';CurrentRevision=[UInt64]1;Timer=[pscustomobject]@{Kind='Timer'};ApplicationContext=[pscustomobject]@{Kind='App'};Client=[pscustomobject]@{Receipt=[pscustomobject]@{HostPid=700;HostCreationFileTimeUtc=[DateTime]::Parse('2030-02-03T03:04:00Z').ToFileTimeUtc();RuntimeId=$layout.RuntimeId;ProtocolMajor=[UInt16]2;Capabilities=[UInt64]2}}}}.GetNewClosure()
     $adapters.SetTrayPresentation={param($Tray,$Presentation,$Catalog,$LanguageMode,$SystemCultureName,$WaitForAcknowledgement)$world.Calls.Add('Set:Presentation');if($world.FailAt -ceq 'SetTrayPresentation'){throw 'PRIVATE_PRESENTATION_SECRET'};$world.PresentationArguments.Add([pscustomobject][ordered]@{Tray=$Tray;Presentation=$Presentation;Catalog=$Catalog;LanguageMode=$LanguageMode;SystemCultureName=$SystemCultureName;WaitForAcknowledgement=[bool]$WaitForAcknowledgement})}.GetNewClosure()
     $adapters.SendTrayActionResult={param($Tray,$ActionId,$Revision,$Status,$ErrorCode,$TransactionId)$world.Calls.Add("ActionResult:$Status");$world.TrayActionResults.Add([pscustomobject][ordered]@{ActionId=$ActionId;Revision=[UInt64]$Revision;Status=$Status;ErrorCode=$ErrorCode;TransactionId=$TransactionId});return $true}.GetNewClosure()
     $adapters.VerifyActiveRuntimeForAbout={param($InstallRoot,$RuntimeId)$world.Calls.Add('Verify:About');[pscustomobject][ordered]@{RuntimeId=$RuntimeId;Version='2.5.0'}}.GetNewClosure()
@@ -355,6 +356,14 @@ Invoke-CcodTest 'exposes only the frozen ReadyToken CLI and rejects an invalid t
     Assert-CcodEqual 0 $fake.World.Calls.Count 'invalid token invokes no adapter'
 }
 
+Invoke-CcodTest 'Supervisor strict identifiers reject regex end-anchor variants' {
+    $source = [IO.File]::ReadAllText($supervisorPath, [Text.UTF8Encoding]::new($false))
+    Assert-CcodTrue (-not ($source -cmatch '\[0-9a-f\]\{64\}\$')) 'Supervisor SHA-256 validators use absolute end anchors'
+    Assert-CcodTrue (-not ($source -cmatch 'A-Za-z0-9\.\._-\]\{0,127\}\$')) 'Supervisor runtime identifiers use absolute end anchors'
+    Assert-CcodTrue (-not ($source -cmatch '\\d\+\\\.\\d\+\\\.\\d\+\$')) 'Supervisor version and UTC validators use absolute end anchors'
+    Assert-CcodTrue (-not ($source -cmatch 'ProcessId.*\\}\$')) 'Supervisor transaction and process identifiers use absolute end anchors'
+}
+
 Invoke-CcodTest 'accepts the canonical five-field active runtime pointer returned by RuntimeManifest' {
     $root=Join-Path ([IO.Path]::GetTempPath()) ('ccod-supervisor-active-' + [guid]::NewGuid().ToString('N'))
     try {
@@ -372,6 +381,59 @@ Invoke-CcodTest 'accepts the canonical five-field active runtime pointer returne
     }
 }
 
+Invoke-CcodTest 'TrayHost readiness rejects receipt objects with extra fields' {
+    $creation = [DateTime]::Parse('2030-02-03T03:04:00Z').ToFileTimeUtc()
+    $state = [pscustomobject]@{
+        Tray = [pscustomobject]@{ Client = [pscustomobject]@{ Receipt = [pscustomobject][ordered]@{ HostPid = [int]700; HostCreationFileTimeUtc = [long]$creation; RuntimeId = 'runtime-1'; ProtocolMajor = [UInt16]2; Capabilities = [UInt64]2; Unexpected = 'fixture' } } }
+        Layout = [pscustomobject]@{ RuntimeId = 'runtime-1' }
+        RuntimeCleanupCodes = [Collections.Generic.List[string]]::new()
+    }
+    $adapters = @{
+        GetUtcNow = { [DateTime]::Parse('2030-02-03T03:04:05Z').ToUniversalTime() }
+        WriteLog = { param($Record) }
+        GetTrayHostIdentity = { param($Pid,$CreationTimeUtc) [pscustomobject][ordered]@{ Outcome = 'SameIdentity'; Pid = [int]$Pid; CreationTimeUtc = [string]$CreationTimeUtc } }
+    }
+    Assert-CcodEqual $false (Write-CcodSupervisorTrayHostReady -HostState $state -Adapters $adapters) 'unexpected tray receipt fields are rejected'
+}
+
+Invoke-CcodTest 'TrayHost readiness accepts the real CLR start receipt property shape' {
+    if($null -eq ('CcodClrTrayHostReceiptFixture' -as [type])) {
+        Add-Type -TypeDefinition @'
+public sealed class CcodClrTrayHostReceiptFixture {
+    public int HostPid { get; set; }
+    public long HostCreationFileTimeUtc { get; set; }
+    public string RuntimeId { get; set; }
+    public ushort ProtocolMajor { get; set; }
+    public ulong Capabilities { get; set; }
+}
+'@
+    }
+    $fixture=New-CcodTickFixture
+    $fake=$fixture.Fake
+    $state=$fixture.Host
+    $creation=[datetime]::Parse('2030-02-03T03:04:00Z').ToFileTimeUtc()
+    $receipt=[CcodClrTrayHostReceiptFixture]::new()
+    $receipt.HostPid=700;$receipt.HostCreationFileTimeUtc=$creation;$receipt.RuntimeId='runtime-1';$receipt.ProtocolMajor=[uint16]2;$receipt.Capabilities=[uint64]2
+    $state.Tray=[pscustomobject]@{Client=[pscustomobject]@{Receipt=$receipt}}
+    Assert-CcodEqual $true (Write-CcodSupervisorTrayHostReady -HostState $state -Adapters $fake.Adapters) 'CLR TrayHostStartReceipt passes readiness validation'
+    Assert-CcodEqual 1 @($fake.World.UiFailureRecords|Where-Object{$_.stage -ceq 'TrayHostReady'}).Count 'CLR receipt emits authenticated readiness proof'
+}
+
+Invoke-CcodTest 'TrayHost readiness rejects a receipt whose process identity is not trusted' {
+    $creation = [DateTime]::Parse('2030-02-03T03:04:00Z').ToFileTimeUtc()
+    $state = [pscustomobject]@{
+        Tray = [pscustomobject]@{ Client = [pscustomobject]@{ Receipt = [pscustomobject][ordered]@{ HostPid = [int]700; HostCreationFileTimeUtc = [long]$creation; RuntimeId = 'runtime-1'; ProtocolMajor = [UInt16]2; Capabilities = [UInt64]2 } } }
+        Layout = [pscustomobject]@{ RuntimeId = 'runtime-1' }
+        RuntimeCleanupCodes = [Collections.Generic.List[string]]::new()
+    }
+    $adapters = @{
+        GetUtcNow = { [DateTime]::Parse('2030-02-03T03:04:05Z').ToUniversalTime() }
+        WriteLog = { param($Record) }
+        GetTrayHostIdentity = { param($Pid,$CreationTimeUtc) [pscustomobject][ordered]@{ Outcome = 'IdentityChanged'; Pid = [int]$Pid; CreationTimeUtc = [string]$CreationTimeUtc } }
+    }
+    Assert-CcodEqual $false (Write-CcodSupervisorTrayHostReady -HostState $state -Adapters $adapters) 'untrusted tray process identity is rejected'
+}
+
 Invoke-CcodTest 'acquires both lifetime leases and signals Ready only after all prerequisites' {
     $fake=New-CcodSupervisorFake
     $receipt=Invoke-CcodSupervisorHost -ReadyToken $readyToken -Adapters $fake.Adapters
@@ -379,6 +441,9 @@ Invoke-CcodTest 'acquires both lifetime leases and signals Ready only after all
     Assert-CcodEqual 1 $fake.World.ReadySignals 'Ready signals once'
     Assert-CcodTrue $fake.World.NewTraySawRealQueue 'tray receives the command queue itself'
     Assert-CcodTrue $fake.World.NewWatcherSawRealQueue 'watcher receives the event queue itself'
+    $readyRecords=@($fake.World.UiFailureRecords|Where-Object{$_.stage -ceq 'TrayHostReady'})
+    Assert-CcodEqual 1 $readyRecords.Count 'authenticated TrayHost readiness is written after NewTray returns'
+    Assert-CcodEqual 'CCOD_TRAYHOST_READY' ([string]$readyRecords[0].code) 'TrayHost readiness uses the canonical code'
     $calls=@($fake.World.Calls)
     foreach($before in @('Enter:AccountSupervisor:30000','Enter:Supervisor:30000','Read:ActiveRuntime','Read:LogonIdentity','Enter:LifecycleOwnership:7','Open:Ready','Open:Shutdown','Open:LifecycleWake','Read:State','Read:Journal','Read:LifecycleRequest','Read:UiPreference','Get:SystemCulture','Get:UiCatalog:System','Queue:Command','Queue:Event','New:Tray','New:Watcher')){
         Assert-CcodTrue ([Array]::IndexOf($calls,$before) -ge 0) "$before occurs"
@@ -394,6 +459,15 @@ Invoke-CcodTest 'acquires both lifetime leases and signals Ready only after all
     Assert-CcodTrue ([Array]::IndexOf($calls,'Exit:Supervisor') -lt [Array]::IndexOf($calls,'Exit:AccountSupervisor')) 'leases release in reverse order'
 }
 
+Invoke-CcodTest 'does not signal Ready when authenticated TrayHost evidence cannot be written' {
+    $fake=New-CcodSupervisorFake -FailAt 'WriteLog'
+    $receipt=Invoke-CcodSupervisorHost -ReadyToken $readyToken -Adapters $fake.Adapters
+    Assert-CcodReceipt $receipt 'Failed' 1
+    Assert-CcodEqual 0 $fake.World.ReadySignals 'TrayHost evidence failure prevents Ready signaling'
+    Assert-CcodTrue (-not $fake.World.Calls.Contains('Run:UI')) 'TrayHost evidence failure prevents entering the UI loop'
+    Assert-CcodTrue (@($receipt.CleanupCodes) -contains 'CCOD_SUPERVISOR_TRAY_READY_LOG_FAILED') 'TrayHost evidence failure keeps the stable cleanup code'
+}
+
 Invoke-CcodTest 'uses one monotonic 30000ms acquisition budget' {
     $fake=New-CcodSupervisorFake
     $fake.World.Elapsed.Enqueue([long]0);$fake.World.Elapsed.Enqueue([long]4200)
@@ -458,6 +532,22 @@ Invoke-CcodTest 'continues cleanup after timer watcher tray event and lease fail
     }
 }
 
+Invoke-CcodTest 'propagates a structured tray close cleanup receipt into the supervisor receipt' {
+    $fake=New-CcodSupervisorFake
+    $fake.Adapters.CloseTray={param($Tray)[pscustomobject][ordered]@{SchemaVersion=1;Closed=$true;CleanupCodes=@('CCOD_TRAY_CLEANUP_MENU_DISPOSE_FAILED')}}
+    $receipt=Invoke-CcodSupervisorHost -ReadyToken $readyToken -Adapters $fake.Adapters
+    Assert-CcodReceipt $receipt 'Stopped' 0
+    Assert-CcodTrue (@($receipt.CleanupCodes) -contains 'CCOD_SUPERVISOR_TRAY_CLOSE_FAILED') 'tray cleanup receipt failure is retained as a stable supervisor code'
+}
+
+Invoke-CcodTest 'propagates a structured watcher cleanup receipt into the supervisor receipt' {
+    $fake=New-CcodSupervisorFake
+    $fake.Adapters.StopWatcher={param($Watcher)[pscustomobject][ordered]@{SchemaVersion=1;Stopped=$true;CleanupCodes=@('CCOD_WATCHER_CLEANUP_QUEUE_DRAIN_FAILED')}}
+    $receipt=Invoke-CcodSupervisorHost -ReadyToken $readyToken -Adapters $fake.Adapters
+    Assert-CcodReceipt $receipt 'Stopped' 0
+    Assert-CcodTrue (@($receipt.CleanupCodes) -contains 'CCOD_SUPERVISOR_WATCHER_STOP_FAILED') 'watcher cleanup receipt failure is retained as a stable supervisor code'
+}
+
 Invoke-CcodTest 'surviving lifecycle worker keeps framing and lifecycle ownership contained' {
     $fake=New-CcodSupervisorFake
     $fake.World.LifecycleSubmissions.Enqueue([pscustomobject][ordered]@{schemaVersion=1;submissionId='dddddddd-eeee-ffff-0000-111111111111';kind='RestartAndRepair';origin='Installer';runtimeId='runtime-1';runtimeGeneration=[UInt64]7;createdAtUtc='2030-02-03T03:04:05.0000000Z'})
@@ -565,6 +655,90 @@ Invoke-CcodTest 'SafeExit refuses UI shutdown when its correlated terminal resul
     Assert-CcodEqual 0 $world.CompletedLifecycleRequests.Count 'undelivered terminal result preserves the active request for resume'
 }
 
+Invoke-CcodTest 'recovered language failure history remains readable by the installed Ready collector' {
+    $root=Join-Path $env:TEMP ('ccod-language-ready-history-'+[guid]::NewGuid().ToString('N'))
+    $integration=$null
+    try {
+        [IO.Directory]::CreateDirectory((Join-Path $root 'logs'))|Out-Null
+        $log=Join-Path $root 'logs/supervisor.log'
+        $integration=New-Module -ArgumentList (Join-Path $repositoryRoot 'tests/installed/Invoke-InstalledLifecycleIntegration.ps1') -ScriptBlock {param($Path). $Path -Library;Export-ModuleMember -Function Get-CcodInstalledLifecycleTrayHostReadyProof}
+        $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
+        $fixture.Fake.Adapters.WriteLog={param($Record)[IO.File]::AppendAllText($log,(($Record|ConvertTo-Json -Compress)+[Environment]::NewLine),[Text.UTF8Encoding]::new($false))}.GetNewClosure()
+        $created='2030-02-03T04:05:01.0000006Z'
+        $hostState.Tray|Add-Member -NotePropertyName Client -NotePropertyValue ([pscustomobject]@{Receipt=[pscustomobject]@{HostPid=201;HostCreationFileTimeUtc=[DateTime]::Parse($created).ToFileTimeUtc();RuntimeId=$hostState.Layout.RuntimeId;ProtocolMajor=[uint16]2;Capabilities=[uint64]2}})
+        $fixture.Fake.Adapters.GetTrayHostIdentity={param($ProcessId,$Created)[pscustomobject][ordered]@{Outcome='SameIdentity';Pid=[int]$ProcessId;CreationTimeUtc=$Created}}
+        Assert-CcodTrue (Write-CcodSupervisorTrayHostReady $hostState $fixture.Fake.Adapters) 'real Ready producer produces baseline'
+        $hosts=@([pscustomobject]@{Pid=201;CreationTimeUtc=$created})
+        Assert-CcodTrue (&$integration {param($Root,$Runtime,$Hosts)Get-CcodInstalledLifecycleTrayHostReadyProof -InstallRoot $Root -RuntimeId $Runtime -TrayHost $Hosts} $root $hostState.Layout.RuntimeId $hosts) 'plain real Ready baseline succeeds'
+        $action=[pscustomobject][ordered]@{ActionId=[guid]::NewGuid();Command='SetLanguageEnglish';Revision=[uint64]1}
+        $world.FailAt='SetTrayPresentation'
+        $failed=Invoke-CcodSupervisorLanguageAction $hostState $fixture.Fake.Adapters $action 'en-US'
+        Assert-CcodEqual 'Failed' $failed.Status 'real language presentation failure reaches rollback log'
+        $world.FailAt=$null
+        $recovered=Invoke-CcodSupervisorLanguageAction $hostState $fixture.Fake.Adapters $action 'en-US'
+        Assert-CcodEqual 'Completed' $recovered.Status 'real language retry completes'
+        Assert-CcodTrue (Write-CcodSupervisorTrayHostReady $hostState $fixture.Fake.Adapters) 'actual Ready producer records recovered host'
+        $records=@([IO.File]::ReadAllLines($log)|ForEach-Object{$_|ConvertFrom-Json})
+        Assert-CcodEqual 1 @($records|Where-Object{$_.stage-ceq'LanguageChange'-and$_.code-ceq'CCOD_LANGUAGE_CHANGE_ROLLED_BACK'}).Count 'target producer frame exists in history'
+        Assert-CcodTrue (&$integration {param($Root,$Runtime,$Hosts)Get-CcodInstalledLifecycleTrayHostReadyProof -InstallRoot $Root -RuntimeId $Runtime -TrayHost $Hosts} $root $hostState.Layout.RuntimeId $hosts) 'recovered language history does not poison current Ready'
+        foreach($event in @(@('ErrorDialog','CCOD_TRAY_ACTION_RESULT_FAILED'),@('TrayCallback','CCOD_TRAY_CALLBACK_FAILED'))){
+            Write-CcodSupervisorUiFailure $hostState $fixture.Fake.Adapters $event[0] $event[1]
+            Assert-CcodTrue (&$integration {param($Root,$Runtime,$Hosts)Get-CcodInstalledLifecycleTrayHostReadyProof -InstallRoot $Root -RuntimeId $Runtime -TrayHost $Hosts} $root $hostState.Layout.RuntimeId $hosts) 'known UI failure producer remains well-formed history'
+        }
+        $good=[IO.File]::ReadAllText($log)
+        $bad=@($records|Where-Object{$_.stage-ceq'LanguageChange'})[0].PSObject.Copy();$bad.outcome='Completed'
+        [IO.File]::WriteAllText($log,($good+($bad|ConvertTo-Json -Compress)+[Environment]::NewLine))
+        $errorId=$null;try{&$integration {param($Root,$Runtime,$Hosts)Get-CcodInstalledLifecycleTrayHostReadyProof -InstallRoot $Root -RuntimeId $Runtime -TrayHost $Hosts} $root $hostState.Layout.RuntimeId $hosts|Out-Null}catch{$errorId=$_.FullyQualifiedErrorId}
+        Assert-CcodTrue ($errorId-like'CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE*') 'malformed UI history still rejects'
+    } finally {
+        if($null-ne$integration){Remove-Module $integration -Force -ErrorAction SilentlyContinue}
+        if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Recurse -Force}
+    }
+}
+
+Invoke-CcodTest 'ordinary terminal delivery requires a current lifecycle fence before publishing success' {
+    foreach($stale in @($false,$true)){
+        $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
+        $request=New-CcodPersistedLifecycleRequest -Kind CheckAndRepair
+        $request.phase='Completed';$request.error=$null
+        $hostState.LifecycleRequest=$request;$world.ActiveLifecycleRequest=$request
+        $action=[pscustomobject][ordered]@{ActionId=[guid]::NewGuid();Command='CheckAndRepair';Revision=[UInt64]1}
+        $entry=[pscustomobject][ordered]@{Action=$action;TransactionId=$request.transactionId;TerminalSent=$false}
+        $hostState.TrayActionIds[$action.ActionId.ToString('D')]=$entry
+        if($stale){$fixture.Fake.Adapters.AssertLifecycleFence={param($InstallRoot,$Ownership)$world.Calls.Add('Fence:Lost');throw 'CCOD_TEST_TERMINAL_FENCE_LOST'}.GetNewClosure()}
+        $failure=$null
+        try{Complete-CcodSupervisorLifecycleTerminal $hostState $fixture.Fake.Adapters|Out-Null}catch{$failure=$_.Exception.Message}
+        if(-not$stale){
+            Assert-CcodEqual $null $failure 'valid ownership permits terminal completion'
+            Assert-CcodEqual 1 $world.TrayActionResults.Count 'valid control delivered one terminal result'
+            Assert-CcodEqual 'Completed' $world.TrayActionResults[0].Status 'valid control reports success'
+            Assert-CcodTrue $entry.TerminalSent 'valid control acknowledges terminal delivery'
+            Assert-CcodEqual 1 $world.CompletedLifecycleRequests.Count 'valid control commits completion'
+        }else{
+            Assert-CcodEqual 'The supervisor adapter failed safely.' $failure 'negative preserves the safe adapter error'
+            Assert-CcodTrue ($world.Calls-contains'Fence:Lost') 'negative reaches actual fence refusal'
+            Assert-CcodEqual 0 $world.TrayActionResults.Count 'stale ownership publishes no terminal result'
+            Assert-CcodEqual $false $entry.TerminalSent 'stale ownership does not mark terminal delivery'
+            Assert-CcodEqual 0 $world.CompletedLifecycleRequests.Count 'stale ownership commits no completion'
+            Assert-CcodTrue ($null-ne$hostState.LifecycleRequest) 'stale request remains retained'
+        }
+    }
+}
+
+Invoke-CcodTest 'ordinary lifecycle retains a terminal request when tray result delivery is not acknowledged' {
+    $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
+    $request=New-CcodPersistedLifecycleRequest -Kind CheckAndRepair
+    $request.phase='Completed';$request.error=$null
+    $hostState.LifecycleRequest=$request;$world.ActiveLifecycleRequest=$request
+    $action=[pscustomobject][ordered]@{ActionId=[guid]'77777777-8888-9999-aaaa-bbbbbbbbbbbb';Command='CheckAndRepair';Revision=[UInt64]1}
+    $hostState.TrayActionIds[$action.ActionId.ToString('D')]=[pscustomobject][ordered]@{Action=$action;TransactionId=$request.transactionId;TerminalSent=$false}
+    $fixture.Fake.Adapters.SendTrayActionResult={param($Tray,$ActionId,$Revision,$Status,$ErrorCode,$TransactionId)$world.Calls.Add('ActionResult:Undelivered');return $false}.GetNewClosure()
+    Complete-CcodSupervisorLifecycleTerminal $hostState $fixture.Fake.Adapters
+    Assert-CcodEqual 0 $world.CompletedLifecycleRequests.Count 'undelivered ordinary terminal result does not complete the durable request'
+    Assert-CcodTrue ($null -ne $hostState.LifecycleRequest -and $hostState.LifecycleRequest.phase -ceq 'Completed') 'undelivered ordinary terminal result retains the terminal request for retry'
+    Assert-CcodEqual $false $hostState.TrayActionIds[$action.ActionId.ToString('D')].TerminalSent 'undelivered ordinary terminal result remains retryable'
+}
+
 Invoke-CcodTest 'SafeExit completes only after the terminal result is acknowledged' {
     # Production mutation caught: writing the completion receipt and deleting the active request before terminal action acknowledgement.
     $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
@@ -619,9 +793,67 @@ Invoke-CcodTest 'SafeExit fence loss stays running and records the stable recove
     Assert-CcodEqual 0 @($world.Calls|Where-Object { $_ -ceq 'Exit:UI' }).Count 'fence loss never requests UI exit'
 }
 
+Invoke-CcodTest 'SafeExit recovery reasserts the lifecycle fence before persisting its failure' {
+    $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
+    $request=New-CcodPersistedLifecycleRequest -Kind SafeExit
+    $transactionModule=Import-Module $lifecycleTransactionPath -Force -PassThru
+    $request=& $transactionModule {param($Value) Move-CcodLifecyclePhase -Request $Value -NextPhase CancelledBeforeClose -NowUtc '2030-02-03T03:04:06.0000000Z'} $request
+    $hostState.LifecycleRequest=$request;$world.ActiveLifecycleRequest=$request
+    $action=[pscustomobject][ordered]@{ActionId=[guid]::NewGuid();Command='Exit';Revision=[UInt64]1}
+    $hostState.TrayActionIds[$action.ActionId.ToString('D')]=[pscustomobject][ordered]@{Action=$action;TransactionId=$request.transactionId;TerminalSent=$false}
+    $world | Add-Member -NotePropertyName FenceCalls -NotePropertyValue 0
+    $fixture.Fake.Adapters.AssertLifecycleFence={param($InstallRoot,$Ownership)$world.FenceCalls++;if($world.FenceCalls -ge 2){throw 'FENCE_LOST_AFTER_TERMINAL'};$true}.GetNewClosure()
+    Assert-CcodEqual 'SafeExit' $request.kind 'SafeExit recovery fixture kind'
+    Assert-CcodEqual 'CancelledBeforeClose' $request.phase 'SafeExit recovery fixture phase'
+    Assert-CcodEqual $true (Test-CcodSupervisorLifecycleTerminal $request.phase) 'SafeExit recovery fixture phase is terminal'
+    Assert-CcodEqual $null $request.error 'SafeExit recovery fixture has no terminal error'
+    Complete-CcodSupervisorLifecycleTerminal $hostState $fixture.Fake.Adapters
+    Assert-CcodTrue ($world.FenceCalls -ge 2) "SafeExit test reached the post-terminal fence (calls=$($world.FenceCalls))"
+    Assert-CcodEqual 0 @($world.Calls|Where-Object{$_ -like 'Write:Lifecycle:*'}).Count 'stale SafeExit recovery does not write without a revalidated fence'
+    Assert-CcodEqual 'Error' $hostState.SessionState 'stale SafeExit recovery enters bounded error state'
+    Assert-CcodTrue ($world.Calls -contains 'Log:CCOD_SUPERVISOR_SAFE_EXIT_RECOVERY_PERSIST_FAILED') 'stale SafeExit recovery records the persistence diagnostic'
+}
+
+Invoke-CcodTest 'SafeExit Completed recovery remains disarmed on the next lifecycle tick' {
+    foreach($failure in @('None','WriteSafeExitIntent','SetTrayPresentation')){
+        $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
+        $request=New-CcodPersistedLifecycleRequest -Kind SafeExit
+        foreach($observation in @('Special','Closed','Ordinary','Ordinary')){
+            $step=& $fixture.Fake.Adapters.GetLifecycleStep $request $observation '2030-02-03T03:04:05.0000000Z'
+            $request=& $fixture.Fake.Adapters.MoveLifecyclePhase $request $step.nextPhase '2030-02-03T03:04:05.0000000Z'
+        }
+        Assert-CcodEqual 'RemoteVerified' $request.phase 'real coordinator transitions reach the Completed predecessor'
+        $hostState.LifecycleRequest=$request;$world.ActiveLifecycleRequest=$request;$hostState.LifecycleObservation='Ordinary'
+        $action=[pscustomobject][ordered]@{ActionId=[guid]::NewGuid();Command='Exit';Revision=[UInt64]1}
+        $entry=[pscustomobject][ordered]@{Action=$action;TransactionId=$request.transactionId;TerminalSent=$false}
+        $hostState.TrayActionIds[$action.ActionId.ToString('D')]=$entry
+        $world.FailAt=$failure
+        Invoke-CcodSupervisorDriveLifecycle $hostState $fixture.Fake.Adapters|Out-Null
+        Assert-CcodTrue ($world.LifecycleMoves-contains'Completed') 'real drive reaches Completed'
+        if($failure-ceq'None'){
+            Assert-CcodTrue $hostState.ShutdownRequested 'successful Completed control permits shutdown'
+            Assert-CcodEqual 1 @($world.Calls|Where-Object{$_-ceq'Exit:UI'}).Count 'successful control exits UI once'
+            Assert-CcodEqual 'Completed' $world.TrayActionResults[0].Status 'successful control sends Completed'
+            continue
+        }
+        Assert-CcodEqual 'Completed' $hostState.LifecycleRequest.phase 'failed recovery retains the actual terminal phase'
+        Assert-CcodEqual 'SAFE_EXIT_RECOVERY_FAILED' $hostState.LifecycleRequest.error 'first tick durably disarms SafeExit'
+        Assert-CcodEqual 0 $world.TrayActionResults.Count 'failure occurs before terminal delivery'
+        Assert-CcodEqual 0 @($world.Calls|Where-Object{$_-ceq'Exit:UI'}).Count 'first tick never exits'
+        $markerAttempts=@($world.Calls|Where-Object{$_-ceq'Write:SafeExitIntent'}).Count
+        $world.FailAt=$null
+        Invoke-CcodSupervisorDriveLifecycle $hostState $fixture.Fake.Adapters|Out-Null
+        Assert-CcodEqual 0 @($world.Calls|Where-Object{$_-ceq'Exit:UI'}).Count 'recovered adapter cannot rearm a failed Completed SafeExit'
+        Assert-CcodEqual $false $hostState.ShutdownRequested 'second tick keeps protection running'
+        Assert-CcodEqual $markerAttempts @($world.Calls|Where-Object{$_-ceq'Write:SafeExitIntent'}).Count 'second tick does not retry successful exit intent'
+        Assert-CcodEqual 'Failed' $world.TrayActionResults[0].Status 'second tick reports failure instead of success'
+        Assert-CcodEqual 'SAFE_EXIT_RECOVERY_FAILED' $world.CompletedLifecycleRequests[0].error 'completed failure remains disarmed in durable output'
+    }
+}
+
 Invoke-CcodTest 'SafeExit marker presentation and completion failures are durably disarmed' {
     # Production mutations caught: allowing any pre-terminal boundary failure to retain an armed successful SafeExit request.
-    foreach($failure in @('WriteSafeExitIntent','SetTrayPresentation','CompleteLifecycleRequest')){
+    foreach($failure in @('WriteSafeExitIntent','SetTrayPresentation','CompleteLifecycleRequest','WriteLifecycleRequest')){
         $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
         $request=& (Get-Module LifecycleTransaction | Select-Object -First 1) {
             param($RuntimeId,$Generation,$Epoch,$Owner,$Logon)
@@ -632,10 +864,12 @@ Invoke-CcodTest 'SafeExit marker presentation and completion failures are durabl
         if($failure-ceq'WriteSafeExitIntent'){$fixture.Fake.Adapters.WriteSafeExitIntent={param($a,$b,$c,$d,$e)throw 'fail'}.GetNewClosure()}
         if($failure-ceq'SetTrayPresentation'){$fixture.Fake.Adapters.SetTrayPresentation={param($a,$b,$c,$d,$e,$f)throw 'fail'}.GetNewClosure()}
         if($failure-ceq'CompleteLifecycleRequest'){$fixture.Fake.Adapters.CompleteLifecycleRequest={param($a,$b)throw 'fail'}.GetNewClosure()}
+        if($failure-ceq'WriteLifecycleRequest'){$world.FailAt='WriteLifecycleRequest';$fixture.Fake.Adapters.SetTrayPresentation={param($a,$b,$c,$d,$e,$f)throw 'fail'}.GetNewClosure()}
         Complete-CcodSupervisorLifecycleTerminal $hostState $fixture.Fake.Adapters
         Assert-CcodEqual 'Running' $hostState.ProtectionState "$failure keeps protection running"
         Assert-CcodEqual 'SAFE_EXIT_RECOVERY_FAILED' $hostState.LifecycleRequest.error "$failure stores a stable disarmed SafeExit error"
         Assert-CcodEqual $(if($failure-ceq'CompleteLifecycleRequest'){1}else{0}) @($world.Calls|Where-Object{$_-ceq'Exit:UI'}).Count "$failure has the expected pre-completion UI boundary"
+        if($failure-ceq'WriteLifecycleRequest'){Assert-CcodTrue ($hostState.RuntimeCleanupCodes -contains 'CCOD_SUPERVISOR_SAFE_EXIT_RECOVERY_PERSIST_FAILED') 'SafeExit lifecycle persistence failure is retained as a bounded diagnostic'}
     }
 }
 
@@ -714,6 +948,14 @@ Invoke-CcodTest 'accepts at most one of two simultaneous durable submissions and
     Assert-CcodEqual 0 @($fake.World.Calls|Where-Object{$_ -like 'Start:Controller:*'}).Count 'submission acceptance never dispatches legacy controller mutation'
 }
 
+Invoke-CcodTest 'rejects lifecycle submissions with coercible runtime generations' {
+    foreach($badGeneration in @('7',[double]7,[decimal]7)){
+        $fake=New-CcodSupervisorFake
+        $submission=[pscustomobject][ordered]@{schemaVersion=1;submissionId='bbbbbbbb-cccc-dddd-eeee-ffffffffffff';kind='RestartAndRepair';origin='Installer';runtimeId='runtime-1';runtimeGeneration=$badGeneration;createdAtUtc='2030-02-03T03:04:05.0000000Z'}
+        Assert-CcodTrue (-not (Test-CcodSupervisorLifecycleSubmission $submission)) "submission generation type $($badGeneration.GetType().FullName) is rejected before coercion"
+    }
+}
+
 Invoke-CcodTest 'rejects a durable submission for a stale runtime generation without creating a transaction' {
     $fake=New-CcodSupervisorFake
     $fake.World.LifecycleSubmissions.Enqueue([pscustomobject][ordered]@{schemaVersion=1;submissionId='cccccccc-dddd-eeee-ffff-000000000000';kind='RestartAndRepair';origin='Installer';runtimeId='runtime-1';runtimeGeneration=[UInt64]6;createdAtUtc='2030-02-03T03:04:05.0000000Z'})
@@ -753,6 +995,30 @@ Invoke-CcodTest 'resumes WaitingForManualLaunch after Supervisor restart and com
     Assert-CcodEqual 0 @($fake.World.Calls|Where-Object{$_ -like 'Start:Controller:*'}).Count 'resume performs no mutation outside LifecycleWorker slot'
 }
 
+Invoke-CcodTest 'terminal lifecycle results preserve output-free tray ticks and normal shutdown' {
+    $fake=New-CcodSupervisorFake
+    $fake.World.ActiveLifecycleRequest=New-CcodPersistedLifecycleRequest -Kind CheckAndRepair
+    $special=New-CcodSupervisorTestSnapshot -ProcessId 201 -CreationTimeUtc '2030-02-03T03:02:00.0000000Z'
+    $special.Mode='Special';$special.RendererPort=[int]41001;$special.MainPort=[int]41002
+    $fake.World.ProcessIds=@([int]201);$fake.World.Snapshots[[int]201]=$special
+    $fake.World.AutoCompleteLifecycleWorkers=$true;$fake.World.TickCount=4
+    $receipt=Invoke-CcodSupervisorHost -ReadyToken $readyToken -Adapters $fake.Adapters
+    Assert-CcodEqual 1 $fake.World.CompletedLifecycleRequests.Count 'real lifecycle reduction reaches its terminal callback before shutdown'
+    Assert-CcodEqual 'Inspect' (@($fake.World.StartedLifecycleRequests.action)-join '|') 'the worker-poll completion path was reached'
+    Assert-CcodReceipt $receipt 'Stopped' 0
+    foreach($phase in @('Completed','RemoteVerified')){
+        $fixture=New-CcodTickFixture
+        $request=New-CcodPersistedLifecycleRequest -Kind CheckAndRepair
+        $request.phase=$phase;$request.error=$null
+        $fixture.Host.LifecycleRequest=$request;$fixture.Fake.World.ActiveLifecycleRequest=$request
+        $fixture.Host.LifecycleObservation='RemoteVerified'
+        $routing=@(Invoke-CcodSupervisorDriveLifecycle $fixture.Host $fixture.Fake.Adapters)
+        Assert-CcodEqual 1 $routing.Count "the $phase drive branch returns only its routing result"
+        Assert-CcodTrue ($routing[0] -is [bool] -and $routing[0]) 'the routing result remains one true Boolean'
+        Assert-CcodEqual 1 $fixture.Fake.World.CompletedLifecycleRequests.Count 'the drive branch completes its request exactly once'
+    }
+}
+
 Invoke-CcodTest 'supervisor restart performs one strong Inspect before adopting a persisted special session' {
     $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
     $special=New-CcodSupervisorTestSnapshot -ProcessId 201 -CreationTimeUtc '2030-02-03T03:02:00.0000000Z'
@@ -1026,6 +1292,40 @@ Invoke-CcodTest 'ordinary observation uses the durable transaction start as its
     Assert-CcodTrue ($workerRequest.notBeforeUtc -cne '2030-02-03T03:04:05.0000000Z') 'observation does not move the lower bound to the current worker tick'
 }
 
+Invoke-CcodTest 'rejects malformed renderer handoff receipts instead of accepting partial identity' {
+    $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
+    $slot=[pscustomobject][ordered]@{Action='Apply'}
+    $result=[pscustomobject][ordered]@{ok=$true;safeState='SpecialValidated';special=[pscustomobject][ordered]@{rendererPort=[int]41002}}
+    $fixture.Fake.Adapters.HandoffRenderer={param($WorkerResult,$RendererPort)[pscustomobject][ordered]@{Outcome='Started';Code='not-canonical';ProcessId=$null}}.GetNewClosure()
+    Invoke-CcodSupervisorRendererHandoff $hostState $slot $result $fixture.Fake.Adapters
+    Assert-CcodTrue (@($world.UiFailureRecords|Where-Object{$_.code -ceq 'CCOD_RENDERER_HANDOFF_FAILED'}).Count -eq 1) 'malformed renderer receipt produces a correlated handoff failure'
+}
+
+Invoke-CcodTest 'rejects lifecycle worker poll frames with non-boolean overflow or negative byte counts' {
+    foreach($case in @(
+        [pscustomobject]@{StdoutByteCount=[int]-1;StdoutOverflow=$false;StderrByteCount=[int]0;StderrOverflow=$false},
+        [pscustomobject]@{StdoutByteCount=[int]0;StdoutOverflow=[int]0;StderrByteCount=[int]0;StderrOverflow=$false},
+        [pscustomobject]@{StdoutByteCount=[int]0;StdoutOverflow=$false;StderrByteCount=[int]-1;StderrOverflow=$false},
+        [pscustomobject]@{StdoutByteCount=[int]0;StdoutOverflow=$false;StderrByteCount=[int]0;StderrOverflow=[int]0}
+    )){
+        $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
+        $transactionModule=Import-Module $lifecycleTransactionPath -Force -PassThru
+        $request=New-CcodPersistedLifecycleRequest -Kind RestartAndRepair
+        foreach($phase in @('CloseRequested','CloseConfirmed','RepairRequested')){
+            $request=& $transactionModule {param($Value,$NextPhase) Move-CcodLifecyclePhase -Request $Value -NextPhase $NextPhase -NowUtc '2030-02-03T03:01:05.0000000Z'} $request $phase
+        }
+        $world.ActiveLifecycleRequest=$request;$hostState.LifecycleRequest=$request
+        Start-CcodSupervisorLifecycleWorkerSlot $hostState $fixture.Fake.Adapters 'Apply' $null | Out-Null
+        $world.WorkerResult=[pscustomobject][ordered]@{schemaVersion=1;transactionId=$request.transactionId;action='Apply';ok=$true;outcome='Activated';observation='Special';error=$null}
+        $json=$world.WorkerResult|ConvertTo-Json -Depth 8 -Compress
+        $world.Poll=[pscustomobject][ordered]@{Completed=$true;ExitCode=[int]0;StdoutText=$json;StdoutByteCount=$case.StdoutByteCount;StdoutOverflow=$case.StdoutOverflow;StderrByteCount=$case.StderrByteCount;StderrOverflow=$case.StderrOverflow}
+        $failure=$null
+        try{Invoke-CcodSupervisorPollLifecycleSlot $hostState $fixture.Fake.Adapters}catch{$failure=$_}
+        Assert-CcodTrue ($null-ne$failure) 'malformed lifecycle poll framing is rejected before result reduction'
+        Assert-CcodEqual 0 @($world.Calls|Where-Object{$_ -eq 'Reduce:Lifecycle:Apply'}).Count 'malformed lifecycle poll framing is never reduced'
+    }
+}
+
 Invoke-CcodTest 'rejects a nonzero lifecycle worker exit even when its result frame claims success' {
     $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
     $transactionModule=Import-Module $lifecycleTransactionPath -Force -PassThru
@@ -1047,6 +1347,43 @@ Invoke-CcodTest 'rejects a nonzero lifecycle worker exit even when its result fr
     Assert-CcodEqual 1 $world.LifecycleOwnershipResumes 'Supervisor safely reacquires ownership before rejecting the frame'
 }
 
+Invoke-CcodTest 'retains a lifecycle worker slot when malformed framing cannot prove termination' {
+    $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
+    $transactionModule=Import-Module $lifecycleTransactionPath -Force -PassThru
+    $request=New-CcodPersistedLifecycleRequest -Kind RestartAndRepair
+    foreach($phase in @('CloseRequested','CloseConfirmed','RepairRequested')){$request=& $transactionModule {param($Value,$NextPhase) Move-CcodLifecyclePhase -Request $Value -NextPhase $NextPhase -NowUtc '2030-02-03T03:01:05.0000000Z'} $request $phase}
+    $world.ActiveLifecycleRequest=$request;$hostState.LifecycleRequest=$request
+    Start-CcodSupervisorLifecycleWorkerSlot $hostState $fixture.Fake.Adapters 'Apply' $null | Out-Null
+    $world.WorkerWaitResults.Enqueue($false);$world.WorkerWaitResults.Enqueue($false);$world.WorkerWaitResults.Enqueue($false);$world.WorkerTerminateResults.Enqueue($false);$world.WorkerTerminateResults.Enqueue($false)
+    $world.Poll=[pscustomobject][ordered]@{Completed='invalid';ExitCode=[int]0;StdoutText='';StdoutByteCount=[int]0;StdoutOverflow=$false;StderrByteCount=[int]0;StderrOverflow=$false}
+    try { Invoke-CcodSupervisorPollLifecycleSlot $hostState $fixture.Fake.Adapters } catch { }
+    Assert-CcodTrue ($null -ne $hostState.LifecycleWorkerSlot) 'malformed framing retains a live worker slot when termination is unproven'
+    Assert-CcodEqual 0 @($world.Calls|Where-Object{$_ -like 'Dispose:*'}).Count 'unproven worker is not disposed as if terminated'
+    Assert-CcodTrue ($hostState.ConnectionState -ceq 'Error') 'unproven malformed worker enters bounded error state'
+}
+
+Invoke-CcodTest 'rejects an empty completed Controller frame instead of silently clearing the result' {
+    $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
+    Start-CcodSupervisorWorkerSlot $hostState $fixture.Fake.Adapters Controller Inspect $null | Out-Null
+    $world.Poll=[pscustomobject][ordered]@{Completed=$true;ExitCode=[int]0;StdoutText='';StdoutByteCount=[int]0;StdoutOverflow=$false;StderrByteCount=[int]0;StderrOverflow=$false}
+    Invoke-CcodSupervisorPollSlot $hostState $fixture.Fake.Adapters
+    Assert-CcodEqual 'Error' $hostState.SessionState 'empty completed Controller output enters error state'
+    Assert-CcodTrue $hostState.BlockAutomaticActions 'empty completed Controller output blocks automatic actions'
+    Assert-CcodEqual 0 @($world.Calls|Where-Object{$_ -like 'Reduce:Inspect'}).Count 'empty Controller output never reaches the reducer'
+}
+
+Invoke-CcodTest 'rejects a Controller exit-code and result-ok mismatch before reduction' {
+    $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
+    Start-CcodSupervisorWorkerSlot $hostState $fixture.Fake.Adapters Controller Inspect $null | Out-Null
+    $world.WorkerResult=[pscustomobject][ordered]@{schemaVersion=1;transactionId='11111111-2222-3333-4444-555555555555';action='Inspect';ok=$true;outcome='Inspected';observation='RemoteVerified';error=$null}
+    $json=$world.WorkerResult|ConvertTo-Json -Depth 8 -Compress
+    $world.Poll=[pscustomobject][ordered]@{Completed=$true;ExitCode=[int]1;StdoutText=$json;StdoutByteCount=[Text.Encoding]::UTF8.GetByteCount($json);StdoutOverflow=$false;StderrByteCount=[int]0;StderrOverflow=$false}
+    Invoke-CcodSupervisorPollSlot $hostState $fixture.Fake.Adapters
+    Assert-CcodEqual 'Error' $hostState.SessionState 'Controller exit/result mismatch enters error state'
+    Assert-CcodTrue $hostState.BlockAutomaticActions 'Controller exit/result mismatch blocks automatic actions'
+    Assert-CcodEqual 0 @($world.Calls|Where-Object{$_ -like 'Reduce:Inspect'}).Count 'Controller exit/result mismatch never reaches the reducer'
+}
+
 Invoke-CcodTest 'reclaims exact stale lifecycle worker framing left by a killed prior Supervisor job' {
     $fixture=New-CcodTickFixture;$world=$fixture.Fake.World;$hostState=$fixture.Host
     $request=New-CcodPersistedLifecycleRequest -Kind RestartAndRepair
@@ -1336,7 +1673,7 @@ Invoke-CcodTest 'bounds stale-package special reconciliation to one live process
     }.GetNewClosure()
     $world.WorkerResult=[pscustomobject][ordered]@{ok=$false;outcome='Error';safeState='Error';special=$null}
     $stdout=$world.WorkerResult|ConvertTo-Json -Depth 20 -Compress
-    $world.Poll=[pscustomobject][ordered]@{Completed=$true;ExitCode=[int]0;StdoutText=$stdout;StdoutByteCount=[int]$stdout.Length;StdoutOverflow=$false;StderrByteCount=[int]0;StderrOverflow=$false}
+    $world.Poll=[pscustomobject][ordered]@{Completed=$true;ExitCode=[int]1;StdoutText=$stdout;StdoutByteCount=[int]$stdout.Length;StdoutOverflow=$false;StderrByteCount=[int]0;StderrOverflow=$false}
     Start-CcodSupervisorWorkerSlot $hostState $fixture.Fake.Adapters 'Controller' 'Inspect' $null|Out-Null
     Invoke-CcodSupervisorPollSlot $hostState $fixture.Fake.Adapters
     Assert-CcodEqual 'StalePackageStatus' $hostState.Reason 'stale worker result exposes only the fixed reason'
diff --git a/tests/persistence/TrustedModuleImport.SelfTest.ps1 b/tests/persistence/TrustedModuleImport.SelfTest.ps1
new file mode 100644
index 0000000..8f74a28
--- /dev/null
+++ b/tests/persistence/TrustedModuleImport.SelfTest.ps1
@@ -0,0 +1,549 @@
+[CmdletBinding()]
+param([ValidateSet('Draft','Wrapper','Contract','Acceptance','Lease')][string]$Case)
+
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'TestSupport.ps1')
+$repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+$script:executed = 0
+$script:skipped = 0
+function Invoke-CcodImportTest {
+    param([string]$Area,[string]$Name,[scriptblock]$Action)
+    if ($Case -and $Case -cne $Area) { $script:skipped++; return }
+    $script:executed++
+    Invoke-CcodTest $Name $Action
+}
+
+function New-CcodImportFixture {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-import-' + [guid]::NewGuid().ToString('N'))
+    $tools = Join-Path $root 'repo\tools'
+    [IO.Directory]::CreateDirectory($tools) | Out-Null
+    [pscustomobject]@{ Root = $root; Tools = $tools; Marker = (Join-Path $root 'substitution-executed.txt') }
+}
+
+function New-CcodImportDraftModule {
+    param($Fixture)
+    $source = Join-Path $repositoryRoot 'tools\Invoke-GitHubDraftRelease.ps1'
+    $module = New-Module -Name ('CcodImportDraft-' + [guid]::NewGuid().ToString('N')) -ScriptBlock ([scriptblock]::Create([IO.File]::ReadAllText($source)))
+    & $module { param($Tools) $script:CcodGitHubDraftModuleRoot = $Tools } $Fixture.Tools
+    return $module
+}
+
+Invoke-CcodImportTest 'Draft' 'draft first dependency cannot be replaced after path validation before real import' {
+    $fixture = New-CcodImportFixture
+    $module = $null
+    try {
+        $path = Join-Path $fixture.Tools 'ReleaseAssetContract.psm1'
+        [IO.File]::WriteAllText($path, 'function Get-CcodI8Origin { $PSScriptRoot }; Export-ModuleMember -Function Get-CcodI8Origin', [Text.UTF8Encoding]::new($false))
+        $module = New-CcodImportDraftModule $fixture
+        $observed = & $module {
+            param($Marker)
+            $script:I8Marker = $Marker
+            $script:I8Reached = $false
+            $script:I8Blocked = $false
+            $script:I8OriginalValidator = ${function:Assert-CcodGitHubDraftTrustedModulePath}
+            function Assert-CcodGitHubDraftTrustedModulePath {
+                param([string]$Path,[bool]$Directory)
+                $result = & $script:I8OriginalValidator -Path $Path -Directory $Directory
+                if (-not $Directory) {
+                    $script:I8Reached = $true
+                    $replacement = '[IO.File]::WriteAllText(''' + $script:I8Marker.Replace("'", "''") + ''',''substituted'')'
+                    try { [IO.File]::WriteAllText($Path, $replacement) }
+                    catch [IO.IOException] { $script:I8Blocked = $true }
+                }
+                return $result
+            }
+            Import-CcodDraftReleaseAssetContract
+            [pscustomobject]@{
+                Reached = $script:I8Reached
+                Blocked = $script:I8Blocked
+                Imported = $script:CcodDraftReleaseAssetContractModule
+            }
+        } $fixture.Marker
+        Assert-CcodTrue $observed.Reached 'mutation seam follows the real successful path validator'
+        Assert-CcodTrue (-not (Test-Path -LiteralPath $fixture.Marker)) 'replacement initializer never executes through the real loader'
+        Assert-CcodTrue $observed.Blocked 'module overwrite is denied while import authority is held'
+        Assert-CcodTrue ($observed.Imported -is [Management.Automation.PSModuleInfo]) 'real import returns a PSModuleInfo'
+        Assert-CcodEqual $fixture.Tools (& $observed.Imported { Get-CcodI8Origin }) 'original module retains PSScriptRoot and private callback semantics'
+        Remove-Module $observed.Imported -Force
+        [IO.File]::WriteAllText($path, '# writable after import')
+    } finally {
+        if ($null -ne $module) { Remove-Module $module -Force -ErrorAction SilentlyContinue }
+        Get-Module | Where-Object { $_.Path -and $_.Path.StartsWith($fixture.Root, [StringComparison]::OrdinalIgnoreCase) } | Remove-Module -Force -ErrorAction SilentlyContinue
+        Remove-Item -LiteralPath $fixture.Root -Recurse -Force
+    }
+}
+
+function Set-CcodImportMutationTrap {
+    param($Module,[string]$Target)
+    & $Module {
+        param($Target)
+        $script:I8Target = $Target
+        $script:I8LoaderReached = $false
+        $script:I8Denied = [Collections.Generic.List[string]]::new()
+        function script:Import-Module {
+            [CmdletBinding()]
+            param([Parameter(Position=0)]$Name,[switch]$Force,[switch]$PassThru,[switch]$DisableNameChecking)
+            if ([string]::Equals([string]$Name, $script:I8Target, [StringComparison]::OrdinalIgnoreCase)) {
+                $script:I8LoaderReached = $true
+                foreach ($operation in @('Write','Delete','Parent','Ancestor')) {
+                    try {
+                        if ($operation -in @('Write','Delete')) {
+                            $bytes = [IO.File]::ReadAllBytes($Name)
+                            if ($operation -ceq 'Write') { [IO.File]::WriteAllBytes($Name, $bytes) }
+                            else { [IO.File]::Delete($Name); [IO.File]::WriteAllBytes($Name, $bytes) }
+                        } else {
+                            $directory = [IO.Path]::GetDirectoryName($Name)
+                            if ($operation -ceq 'Ancestor') { $directory = [IO.Path]::GetDirectoryName($directory) }
+                            [IO.Directory]::Move($directory, $directory + '-moved')
+                            [IO.Directory]::Move($directory + '-moved', $directory)
+                        }
+                    } catch [IO.IOException] { $script:I8Denied.Add($operation) }
+                }
+            }
+            $arguments = @{}
+            foreach ($key in $PSBoundParameters.Keys) { $arguments[$key] = $PSBoundParameters[$key] }
+            $arguments.PassThru = $true
+            $script:I8Imported = Microsoft.PowerShell.Core\Import-Module @arguments
+            if ($PassThru) { return $script:I8Imported }
+        }
+    } $Target
+}
+
+function Assert-CcodImportMutationTrap {
+    param($Module)
+    $state = & $Module { [pscustomobject]@{ Reached = $script:I8LoaderReached; Denied = @($script:I8Denied.ToArray()) } }
+    Assert-CcodTrue $state.Reached 'the real import boundary was reached'
+    Assert-CcodEqual 'Write,Delete,Parent,Ancestor' ($state.Denied -join ',') 'leaf and complete ancestor chain are held through the real loader call'
+}
+
+function Get-CcodImportSlice {
+    param([string]$Source,[string]$Start,[string]$End)
+    $text = [IO.File]::ReadAllText($Source)
+    $begin = $text.IndexOf($Start, [StringComparison]::Ordinal)
+    $finish = $text.IndexOf($End, [StringComparison]::Ordinal)
+    Assert-CcodTrue ($begin -ge 0 -and $finish -gt $begin) 'the actual dependency import slice is present'
+    Assert-CcodEqual $begin $text.LastIndexOf($Start, [StringComparison]::Ordinal) 'the import slice start is unique'
+    return [scriptblock]::Create($text.Substring($begin, $finish - $begin))
+}
+
+Invoke-CcodImportTest 'Draft' 'draft acceptance dependency keeps file and ancestor authority through the real loader' {
+    $fixture = New-CcodImportFixture
+    $module = $null
+    $imported = $null
+    try {
+        $directory = Join-Path (Split-Path $fixture.Tools -Parent) 'tests\installed'
+        [IO.Directory]::CreateDirectory($directory) | Out-Null
+        $target = Join-Path $directory 'OfficialDraftAcceptance.psm1'
+        [IO.File]::WriteAllText($target, 'function Get-CcodI8Origin { $PSScriptRoot }; Export-ModuleMember -Function Get-CcodI8Origin')
+        $module = New-CcodImportDraftModule $fixture
+        Set-CcodImportMutationTrap $module $target
+        $slice = Get-CcodImportSlice (Join-Path $repositoryRoot 'tools\Invoke-GitHubDraftRelease.ps1') '$acceptanceModulePath = Join-Path' '$state = & $acceptanceModule'
+        $imported = & $module { param($Slice,$toolRoot) . $Slice; return $acceptanceModule } $slice $fixture.Tools
+        Assert-CcodImportMutationTrap $module
+        Assert-CcodEqual $directory (& $imported { Get-CcodI8Origin }) 'acceptance import retains its real module path'
+    } finally {
+        if ($null -ne $imported) { Remove-Module $imported -Force -ErrorAction SilentlyContinue }
+        if ($null -ne $module) { Remove-Module $module -Force -ErrorAction SilentlyContinue }
+        Remove-Item -LiteralPath $fixture.Root -Recurse -Force
+    }
+}
+
+function Invoke-CcodImportFreshProcess {
+    param([string]$Root,[string]$Body)
+    $probe = Join-Path $Root ('probe-' + [guid]::NewGuid().ToString('N') + '.ps1')
+    [IO.File]::WriteAllText($probe, ('$ErrorActionPreference = ''Stop''' + "`n" + $Body), [Text.UTF8Encoding]::new($false))
+    $start = [Diagnostics.ProcessStartInfo]::new()
+    $start.FileName = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+    $start.Arguments = '-NoLogo -NoProfile -NonInteractive -File "' + $probe + '"'
+    $start.UseShellExecute = $false
+    $start.CreateNoWindow = $true
+    $start.RedirectStandardOutput = $true
+    $start.RedirectStandardError = $true
+    $start.EnvironmentVariables.Remove('PSExecutionPolicyPreference')
+    $process = [Diagnostics.Process]::new()
+    $process.StartInfo = $start
+    try {
+        [void]$process.Start()
+        $stdout = $process.StandardOutput.ReadToEndAsync()
+        $stderr = $process.StandardError.ReadToEndAsync()
+        if (-not $process.WaitForExit(120000)) { $process.Kill(); $process.WaitForExit(); throw 'fresh import probe timed out' }
+        return [pscustomobject]@{ ExitCode = $process.ExitCode; Output = $stdout.GetAwaiter().GetResult() + $stderr.GetAwaiter().GetResult() }
+    } finally { $process.Dispose(); [IO.File]::Delete($probe) }
+}
+
+function Get-CcodImportSelfMutationScript {
+    return @'
+$script:I8Blocked = 0
+try { [IO.File]::WriteAllBytes($PSCommandPath, [IO.File]::ReadAllBytes($PSCommandPath)) } catch [IO.IOException] { $script:I8Blocked++ }
+foreach ($directory in @($PSScriptRoot, (Split-Path $PSScriptRoot -Parent))) {
+    try { [IO.Directory]::Move($directory, $directory + '-moved'); [IO.Directory]::Move($directory + '-moved', $directory) }
+    catch [IO.IOException] { $script:I8Blocked++ }
+}
+function Get-CcodI8State { [pscustomobject]@{ Blocked = $script:I8Blocked; Root = $PSScriptRoot } }
+'@
+}
+
+Invoke-CcodImportTest 'Wrapper' 'draft wrapper bootstraps in a fresh process and holds through dot sourced initialization' {
+    $fixture = New-CcodImportFixture
+    try {
+        $wrapper = Join-Path $fixture.Tools 'Invoke-GitHubDraftRelease.psm1'
+        Copy-Item -LiteralPath (Join-Path $repositoryRoot 'tools\Invoke-GitHubDraftRelease.psm1') -Destination $wrapper
+        $scriptPath = Join-Path $fixture.Tools 'Invoke-GitHubDraftRelease.ps1'
+        [IO.File]::WriteAllText($scriptPath, (Get-CcodImportSelfMutationScript) + "`nfunction Invoke-CcodGitHubDraftRelease { Get-CcodI8State }", [Text.UTF8Encoding]::new($false))
+        $body = @'
+if ($null -ne ('CcodTrustedImportLeaseV1' -as [type])) { throw 'probe was not fresh' }
+$module = Import-Module '__WRAPPER__' -Force -PassThru
+try {
+    if ((@($module.ExportedCommands.Keys) -join ',') -cne 'Invoke-CcodGitHubDraftRelease') { throw 'unexpected public exports' }
+    $state = Invoke-CcodGitHubDraftRelease
+    if ($state.Blocked -ne 3) { throw ('import authority ended before initializer: blocked=' + $state.Blocked) }
+    if ($state.Root -cne '__TOOLS__') { throw 'dot source root changed' }
+} finally { Remove-Module $module -Force }
+[IO.File]::WriteAllText('__SCRIPT__', '# released after dot source')
+'@
+        $body = $body.Replace('__WRAPPER__', $wrapper.Replace("'", "''")).Replace('__TOOLS__', $fixture.Tools.Replace("'", "''")).Replace('__SCRIPT__', $scriptPath.Replace("'", "''"))
+        $result = Invoke-CcodImportFreshProcess $fixture.Root $body
+        Assert-CcodEqual 0 $result.ExitCode ('fresh wrapper holds authority through initializer: ' + $result.Output)
+    } finally { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+}
+
+Invoke-CcodImportTest 'Contract' 'standalone asset contract pins SetupArtifact through its actual import slice' {
+    $fixture = New-CcodImportFixture
+    $module = $null
+    try {
+        $source = Join-Path $repositoryRoot 'tools\ReleaseAssetContract.psm1'
+        $copy = Join-Path $fixture.Tools 'ReleaseAssetContract.psm1'
+        Copy-Item -LiteralPath $source -Destination $copy
+        $build = Join-Path (Split-Path $fixture.Tools -Parent) 'build'
+        [IO.Directory]::CreateDirectory($build) | Out-Null
+        $target = Join-Path $build 'SetupArtifact.psm1'
+        [IO.File]::WriteAllText($target, 'function Get-CcodI8Origin { $PSScriptRoot }; Export-ModuleMember -Function Get-CcodI8Origin')
+        $module = Import-Module $copy -Force -PassThru -DisableNameChecking
+        Set-CcodImportMutationTrap $module $target
+        $slice = Get-CcodImportSlice $source '$setupModule=Join-Path' 'try{$setup=Test-CcodSetupArtifact'
+        $slice = [scriptblock]::Create('param($PSScriptRoot)' + "`n" + $slice.ToString())
+        & $module { param($Slice,$Tools) $ErrorId = 'CCOD_RELEASE_ASSET_SET_INVALID'; . $Slice $Tools } $slice $fixture.Tools
+        Assert-CcodImportMutationTrap $module
+        $imported = & $module { $script:I8Imported }
+        Assert-CcodEqual $build (& $imported { Get-CcodI8Origin }) 'SetupArtifact module keeps its true root'
+    } finally {
+        if ($null -ne $module) { Remove-Module $module -Force -ErrorAction SilentlyContinue }
+        Get-Module | Where-Object { $_.Path -and $_.Path.StartsWith($fixture.Root, [StringComparison]::OrdinalIgnoreCase) } | Remove-Module -Force -ErrorAction SilentlyContinue
+        Remove-Item -LiteralPath $fixture.Root -Recurse -Force
+    }
+}
+
+foreach ($dependency in @(
+    @{ Leaf = 'ReleaseAssetContract.psm1'; Getter = 'Get-CcodOfficialDraftAssetModule' },
+    @{ Leaf = 'ReleaseDefender.psm1'; Getter = 'Get-CcodOfficialDraftDefenderModule' }
+)) {
+    Invoke-CcodImportTest 'Acceptance' ('standalone acceptance protects dependency ' + $dependency.Leaf) {
+        $fixture = New-CcodImportFixture
+        $module = $null
+        $imported = $null
+        try {
+            $directory = Join-Path (Split-Path $fixture.Tools -Parent) 'tests\installed'
+            [IO.Directory]::CreateDirectory($directory) | Out-Null
+            $copy = Join-Path $directory 'OfficialDraftAcceptance.psm1'
+            Copy-Item -LiteralPath (Join-Path $repositoryRoot 'tests\installed\OfficialDraftAcceptance.psm1') -Destination $copy
+            $target = Join-Path $fixture.Tools $dependency.Leaf
+            [IO.File]::WriteAllText($target, 'function Get-CcodI8Origin { $PSScriptRoot }; Export-ModuleMember -Function Get-CcodI8Origin')
+            $module = Import-Module $copy -Force -PassThru -DisableNameChecking
+            Set-CcodImportMutationTrap $module $target
+            $imported = & $module { param($Getter) & $Getter } $dependency.Getter
+            Assert-CcodImportMutationTrap $module
+            Assert-CcodEqual $fixture.Tools (& $imported { Get-CcodI8Origin }) 'dependency keeps its real root and module identity'
+        } finally {
+            if ($null -ne $imported) { Remove-Module $imported -Force -ErrorAction SilentlyContinue }
+            if ($null -ne $module) { Remove-Module $module -Force -ErrorAction SilentlyContinue }
+            Remove-Item -LiteralPath $fixture.Root -Recurse -Force
+        }
+    }
+}
+
+Invoke-CcodImportTest 'Acceptance' 'Defender dependency reimport is protected in a fresh process without running a scan' {
+    $fixture = New-CcodImportFixture
+    try {
+        $entry = Join-Path $fixture.Tools 'ReleaseDefender.psm1'
+        Copy-Item -LiteralPath (Join-Path $repositoryRoot 'tools\ReleaseDefender.psm1') -Destination $entry
+        $dependency = Join-Path $fixture.Tools 'ReleaseAssetContract.psm1'
+        [IO.File]::WriteAllText($dependency, (Get-CcodImportSelfMutationScript) + "`nExport-ModuleMember -Function Get-CcodI8State", [Text.UTF8Encoding]::new($false))
+        $body = @'
+if ($null -ne ('CcodTrustedImportLeaseV1' -as [type])) { throw 'probe was not fresh' }
+$module = Import-Module '__ENTRY__' -Force -PassThru -DisableNameChecking
+try {
+    if ((@($module.ExportedCommands.Keys) -join ',') -cne 'Invoke-CcodReleaseDefenderCheck') { throw 'unexpected Defender exports' }
+    $state = & $module { & $script:CcodReleaseAssetContractModule { Get-CcodI8State } }
+    if ($state.Blocked -ne 3) { throw ('nested contract import was unprotected: blocked=' + $state.Blocked) }
+} finally { Remove-Module $module -Force }
+[IO.File]::WriteAllText('__DEPENDENCY__', '# released')
+'@
+        $result = Invoke-CcodImportFreshProcess $fixture.Root ($body.Replace('__ENTRY__', $entry.Replace("'", "''")).Replace('__DEPENDENCY__', $dependency.Replace("'", "''")))
+        Assert-CcodEqual 0 $result.ExitCode ('nested dependency retains import authority: ' + $result.Output)
+    } finally { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+}
+
+function Assert-CcodImportFixtureReleased {
+    param($Fixture,[string]$Target)
+    [IO.File]::WriteAllText($Target, '# lease released')
+    foreach ($directory in @($Fixture.Tools, (Split-Path $Fixture.Tools -Parent), $Fixture.Root)) {
+        [IO.Directory]::Move($directory, $directory + '-released')
+        [IO.Directory]::Move($directory + '-released', $directory)
+    }
+}
+
+Invoke-CcodImportTest 'Lease' 'preexisting writable handle rejects loading and releases every partially acquired ancestor' {
+    $fixture = New-CcodImportFixture
+    $module = New-CcodImportDraftModule $fixture
+    $writer = $null
+    try {
+        $marker = Join-Path $fixture.Root 'unexpected-loader.txt'
+        $target = Join-Path $fixture.Tools 'ReleaseAssetContract.psm1'
+        [IO.File]::WriteAllText($target, "[IO.File]::WriteAllText('" + $marker.Replace("'", "''") + "', 'executed')")
+        $writer = [IO.File]::Open($target, [IO.FileMode]::Open, [IO.FileAccess]::Write, ([IO.FileShare]::ReadWrite -bor [IO.FileShare]::Delete))
+        $failure = $null
+        try { & $module { param($Root) $script:CcodGitHubDraftModuleRoot = $Root; Import-CcodDraftReleaseAssetContract } $fixture.Tools } catch { $failure = $_ }
+        Assert-CcodTrue ($null -ne $failure) 'existing writable access prevents acquisition rather than merely checking path twice'
+        Assert-CcodEqual 'CCOD_GITHUB_DRAFT_CONTRACT_MISSING' ($failure.FullyQualifiedErrorId.Split(',')[0]) 'caller keeps stable failure identity'
+        Assert-CcodTrue (-not [IO.File]::Exists($marker)) 'no dependency code runs after failed acquisition'
+        $writer.Dispose(); $writer = $null
+        Assert-CcodImportFixtureReleased $fixture $target
+    } finally {
+        if ($null -ne $writer) { $writer.Dispose() }
+        Remove-Module $module -Force -ErrorAction SilentlyContinue
+        Remove-Item -LiteralPath $fixture.Root -Recurse -Force
+    }
+}
+
+foreach ($failureKind in @('Initializer','Parser','Validation')) {
+    Invoke-CcodImportTest 'Lease' ('real loader or validation failure releases leases: ' + $failureKind) {
+        $fixture = New-CcodImportFixture
+        $module = New-CcodImportDraftModule $fixture
+        try {
+            $target = Join-Path $fixture.Tools 'ReleaseAssetContract.psm1'
+            $body = if ($failureKind -eq 'Parser') { 'function {' } elseif ($failureKind -eq 'Initializer') { "throw 'CCOD_I8_INITIALIZER_THROW'" } else { '# never execute' }
+            [IO.File]::WriteAllText($target, $body)
+            $failure = $null
+            try {
+                & $module {
+                    param($Root,$Kind)
+                    $script:CcodGitHubDraftModuleRoot = $Root
+                    if ($Kind -eq 'Validation') { function Assert-CcodGitHubDraftTrustedModulePath { throw 'CCOD_I8_VALIDATION_THROW' } }
+                    Import-CcodDraftReleaseAssetContract
+                } $fixture.Tools $failureKind
+            } catch { $failure = $_ }
+            Assert-CcodTrue ($null -ne $failure) 'probe actually reaches a terminal failure'
+            if ($failureKind -ne 'Parser') { Assert-CcodTrue ($failure.Exception.Message -match ('CCOD_I8_' + $failureKind.ToUpperInvariant() + '_THROW')) 'the intended failure boundary was reached' }
+            else { Assert-CcodTrue ($failure.FullyQualifiedErrorId -notlike 'CCOD_GITHUB_DRAFT_CONTRACT_MISSING*') 'parser failure occurs after successful acquisition' }
+            Assert-CcodImportFixtureReleased $fixture $target
+        } finally {
+            Remove-Module $module -Force -ErrorAction SilentlyContinue
+            Remove-Item -LiteralPath $fixture.Root -Recurse -Force
+        }
+    }
+}
+
+Invoke-CcodImportTest 'Lease' 'lease rejects junction ancestry without executing target and releases the junction handle' {
+    $fixture = New-CcodImportFixture
+    $module = New-CcodImportDraftModule $fixture
+    $junction = Join-Path $fixture.Root 'alias'
+    try {
+        $target = Join-Path $fixture.Tools 'ReleaseAssetContract.psm1'
+        [IO.File]::WriteAllText($target, '# innocent module')
+        New-Item -ItemType Junction -Path $junction -Target $fixture.Tools | Out-Null
+        $failure = $null
+        try { & $module { param($Root) $script:CcodGitHubDraftModuleRoot = $Root; Import-CcodDraftReleaseAssetContract } $junction } catch { $failure = $_ }
+        Assert-CcodTrue ($null -ne $failure) 'junction ancestry fails closed'
+        Assert-CcodEqual 'CCOD_GITHUB_DRAFT_CONTRACT_MISSING' ($failure.FullyQualifiedErrorId.Split(',')[0]) 'junction failure remains classified'
+        [IO.Directory]::Delete($junction)
+        Assert-CcodImportFixtureReleased $fixture $target
+    } finally {
+        Remove-Module $module -Force -ErrorAction SilentlyContinue
+        if ([IO.Directory]::Exists($junction)) { [IO.Directory]::Delete($junction) }
+        Remove-Item -LiteralPath $fixture.Root -Recurse -Force
+    }
+}
+
+Invoke-CcodImportTest 'Lease' 'all owned ancestors remain held until dispose and dispose is idempotent' {
+    $fixture = New-CcodImportFixture
+    $module = New-CcodImportDraftModule $fixture
+    $lease = $null
+    try {
+        $target = Join-Path $fixture.Tools 'probe.psm1'
+        [IO.File]::WriteAllText($target, '# probe')
+        $lease = & $module { param($Target) Open-CcodTrustedImportLease -Path $Target -ErrorId 'CCOD_I8_LEASE_FAILED' } $target
+        foreach ($directory in @($fixture.Tools, (Split-Path $fixture.Tools -Parent), $fixture.Root)) {
+            $denied = $false
+            try { [IO.Directory]::Move($directory, $directory + '-moved'); [IO.Directory]::Move($directory + '-moved', $directory) } catch [IO.IOException] { $denied = $true }
+            Assert-CcodTrue $denied 'even the fixture ancestor above the repository is held'
+        }
+        $lease.Revalidate(); $lease.Dispose(); $lease.Dispose()
+        $failure = $null
+        try { $lease.Revalidate() } catch { $failure = $_ }
+        Assert-CcodTrue ($null -ne $failure) 'disposed authority cannot be reused'
+        Assert-CcodImportFixtureReleased $fixture $target
+    } finally {
+        if ($null -ne $lease) { $lease.Dispose() }
+        Remove-Module $module -Force -ErrorAction SilentlyContinue
+        Remove-Item -LiteralPath $fixture.Root -Recurse -Force
+    }
+}
+
+$bootstrapEntries = @('tools\Invoke-GitHubDraftRelease.ps1','tools\Invoke-GitHubDraftRelease.psm1','tools\ReleaseAssetContract.psm1','tools\ReleaseDefender.psm1','tests\installed\OfficialDraftAcceptance.psm1')
+Invoke-CcodImportTest 'Lease' 'independently trusted entrypoints embed identical bootstrap code' {
+    $expected = $null
+    foreach ($entry in ($bootstrapEntries + @('tests\installed\Invoke-OfficialDraftAcceptance.ps1','tools\Test-ReleaseDefender.ps1','tests\installed\Invoke-InstalledLifecycleIntegration.ps1'))) {
+        $text = [IO.File]::ReadAllText((Join-Path $repositoryRoot $entry))
+        $matches = [regex]::Matches($text, '(?s)# BEGIN CCOD TRUSTED IMPORT BOOTSTRAP.*?# END CCOD TRUSTED IMPORT BOOTSTRAP')
+        Assert-CcodEqual 1 $matches.Count ('exactly one locally trusted bootstrap: ' + $entry)
+        $current = $matches[0].Value.Replace("`r`n", "`n")
+        if ($null -eq $expected) { $expected = $current }
+        else { Assert-CcodEqual $expected $current ('bootstrap copies must not drift: ' + $entry) }
+    }
+}
+
+foreach ($entry in $bootstrapEntries) {
+    Invoke-CcodImportTest 'Lease' ('bootstrap does not depend on prior imports in Windows PowerShell 5.1: ' + $entry) {
+        $fixture = New-CcodImportFixture
+        try {
+            $target = Join-Path $fixture.Tools 'probe.psm1'
+            [IO.File]::WriteAllText($target, '# benign probe')
+            $body = @'
+if ($PSVersionTable.PSVersion.Major -ne 5 -or $PSVersionTable.PSVersion.Minor -ne 1) { throw 'not Windows PowerShell 5.1' }
+if ($null -ne ('CcodTrustedImportLeaseV1' -as [type])) { throw 'probe was not fresh' }
+$entry = '__ENTRY__'
+if ([IO.Path]::GetExtension($entry) -eq '.ps1') { $module = New-Module -ArgumentList $entry -ScriptBlock { param($Path) . $Path } }
+else { $module = Import-Module $entry -Force -PassThru -DisableNameChecking }
+& $module { Initialize-CcodTrustedImportLease }
+$lease = [CcodTrustedImportLeaseV1]::Acquire('__TARGET__')
+try { $lease.Revalidate() } finally { $lease.Dispose() }
+[IO.File]::WriteAllText('__TARGET__', '# released')
+'@
+            $body = $body.Replace('__ENTRY__', (Join-Path $repositoryRoot $entry).Replace("'", "''")).Replace('__TARGET__', $target.Replace("'", "''"))
+            $result = Invoke-CcodImportFreshProcess $fixture.Root $body
+            Assert-CcodEqual 0 $result.ExitCode ('each entry bootstraps independently: ' + $result.Output)
+        } finally { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+    }
+}
+
+foreach ($wrapper in @(
+    @{ Entry = 'tests\installed\Invoke-OfficialDraftAcceptance.ps1'; Leaf = 'OfficialDraftAcceptance.psm1'; Command = 'Invoke-CcodOfficialDraftAcceptance'; Arguments = "@{ Phase='Preflight'; AssetDirectory='unused'; PreviousAssetDirectory='unused'; EvidenceRoot='unused' }"; Parameters = 'Phase,AssetDirectory,PreviousAssetDirectory,EvidenceRoot,DraftId,AllowMachineMutation,AllowCodexRestart,AllowWindowsReboot' },
+    @{ Entry = 'tools\Test-ReleaseDefender.ps1'; Leaf = 'ReleaseDefender.psm1'; Command = 'Invoke-CcodReleaseDefenderCheck'; Arguments = "@{ CandidatePath='unused'; ChecksumPath='unused'; ManifestPath='unused'; Origin='InternetDownload'; ExpectedVersion='2.5.22'; ExpectedGitCommit=('c'*40); EvidencePath='unused' }"; Parameters = 'CandidatePath,ChecksumPath,ManifestPath,Origin,WorkflowArtifactIdentity,ExpectedVersion,ExpectedGitCommit,EvidencePath' }
+)) {
+    Invoke-CcodImportTest 'Wrapper' ('public wrapper protects first dependency in a fresh process: ' + $wrapper.Entry) {
+        $fixture = New-CcodImportFixture
+        try {
+            $entry = Join-Path $fixture.Tools ([IO.Path]::GetFileName($wrapper.Entry))
+            Copy-Item -LiteralPath (Join-Path $repositoryRoot $wrapper.Entry) -Destination $entry
+            $parameters = @($wrapper.Parameters.Split(',') | ForEach-Object { '$' + $_ }) -join ','
+            $fixtureCommand = 'function ' + $wrapper.Command + ' { param(' + $parameters + '); $state=Get-CcodI8State; [pscustomobject]@{ I8Fixture=''no scan or machine mutation''; Blocked=$state.Blocked } }; Export-ModuleMember -Function ' + $wrapper.Command
+            $dependency = Join-Path $fixture.Tools $wrapper.Leaf
+            [IO.File]::WriteAllText($dependency, (Get-CcodImportSelfMutationScript) + "`n" + $fixtureCommand, [Text.UTF8Encoding]::new($false))
+            $body = @'
+if ($null -ne ('CcodTrustedImportLeaseV1' -as [type])) { throw 'probe was not fresh' }
+$arguments = __ARGUMENTS__
+$result = & '__ENTRY__' @arguments | ConvertFrom-Json
+if ($result.I8Fixture -cne 'no scan or machine mutation' -or $result.Blocked -ne 3) { throw ('public wrapper load was unprotected: blocked=' + $result.Blocked) }
+[IO.File]::WriteAllText('__DEPENDENCY__', '# released')
+'@
+            $body = $body.Replace('__ENTRY__', $entry.Replace("'", "''")).Replace('__DEPENDENCY__', $dependency.Replace("'", "''")).Replace('__ARGUMENTS__', $wrapper.Arguments)
+            $result = Invoke-CcodImportFreshProcess $fixture.Root $body
+            Assert-CcodEqual 0 $result.ExitCode ('public first dependency authority: ' + $result.Output)
+        } finally { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+    }
+}
+
+Invoke-CcodImportTest 'Acceptance' 'acceptance holds its integration library script through dot sourced initialization' {
+    $fixture = New-CcodImportFixture
+    $module = $null
+    $library = $null
+    try {
+        $directory = Join-Path (Split-Path $fixture.Tools -Parent) 'tests\installed'
+        [IO.Directory]::CreateDirectory($directory) | Out-Null
+        $copy = Join-Path $directory 'OfficialDraftAcceptance.psm1'
+        Copy-Item -LiteralPath (Join-Path $repositoryRoot 'tests\installed\OfficialDraftAcceptance.psm1') -Destination $copy
+        $target = Join-Path $directory 'Invoke-InstalledLifecycleIntegration.ps1'
+        [IO.File]::WriteAllText($target, ('param([switch]$Library)' + "`n" + (Get-CcodImportSelfMutationScript)), [Text.UTF8Encoding]::new($false))
+        $module = Import-Module $copy -Force -PassThru -DisableNameChecking
+        $library = & $module { Get-CcodOfficialDraftIntegrationModule }
+        $state = & $library { Get-CcodI8State }
+        Assert-CcodEqual 3 $state.Blocked 'existing New-Module dot source keeps authority until initialization ends'
+        Assert-CcodEqual $directory $state.Root 'integration library keeps original script root'
+        [IO.File]::WriteAllText($target, '# released after library load')
+    } finally {
+        if ($null -ne $library) { Remove-Module $library -Force -ErrorAction SilentlyContinue }
+        if ($null -ne $module) { Remove-Module $module -Force -ErrorAction SilentlyContinue }
+        Remove-Item -LiteralPath $fixture.Root -Recurse -Force
+    }
+}
+
+Invoke-CcodImportTest 'Acceptance' 'integration library retains its complete eager dependency closure through nested imports' {
+    $fixture = New-CcodImportFixture
+    try {
+        $repo = Split-Path $fixture.Tools -Parent
+        $installed = Join-Path $repo 'tests\installed'
+        $modules = Join-Path $repo 'src\persistence\modules'
+        [IO.Directory]::CreateDirectory($installed) | Out-Null
+        [IO.Directory]::CreateDirectory($modules) | Out-Null
+        $entry = Join-Path $installed 'Invoke-InstalledLifecycleIntegration.ps1'
+        Copy-Item -LiteralPath (Join-Path $repositoryRoot 'tests\installed\Invoke-InstalledLifecycleIntegration.ps1') -Destination $entry
+        $names = @('PersistenceIO.psm1','StateStore.psm1','TrustedLogonIdentity.psm1','LifecycleTransaction.psm1')
+        foreach ($name in $names) {
+            $nested = if ($name -eq 'StateStore.psm1') { "Import-Module (Join-Path `$PSScriptRoot 'TrustedLogonIdentity.psm1') -Force`n" } else { '' }
+            [IO.File]::WriteAllText((Join-Path $modules $name), ($nested + (Get-CcodImportSelfMutationScript) + "`nExport-ModuleMember -Function Get-CcodI8State"), [Text.UTF8Encoding]::new($false))
+        }
+        $body = @'
+if ($null -ne ('CcodTrustedImportLeaseV1' -as [type])) { throw 'probe was not fresh' }
+$library = New-Module -ArgumentList '__ENTRY__' -ScriptBlock { param($Path) . $Path -Library }
+$paths = [Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+foreach ($module in @(Get-Module -All | Where-Object { $_.Path -and $_.Path.StartsWith('__MODULES__', [StringComparison]::OrdinalIgnoreCase) })) {
+    [void]$paths.Add($module.Path)
+    $state = & $module { Get-CcodI8State }
+    if ($state.Blocked -ne 3) { throw ('eager dependency not held: ' + $module.Name + ' blocked=' + $state.Blocked) }
+}
+if ($paths.Count -ne 4) { throw 'nested dependency probe did not execute the complete eager closure' }
+foreach ($path in $paths) { [IO.File]::WriteAllText($path, '# released') }
+'@
+        $result = Invoke-CcodImportFreshProcess $fixture.Root ($body.Replace('__ENTRY__', $entry.Replace("'", "''")).Replace('__MODULES__', $modules.Replace("'", "''")))
+        Assert-CcodEqual 0 $result.ExitCode ('all eager and nested dependencies protected: ' + $result.Output)
+    } finally { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
+}
+
+Invoke-CcodImportTest 'Lease' 'integration eager import graph cannot grow beyond its pinned closure unnoticed' {
+    $queue = [Collections.Generic.Queue[string]]::new()
+    $queue.Enqueue((Join-Path $repositoryRoot 'tests\installed\Invoke-InstalledLifecycleIntegration.ps1'))
+    $observed = [Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+    $declared = $null
+    while ($queue.Count -gt 0) {
+        $path = $queue.Dequeue()
+        $tokens = $null; $parseErrors = $null
+        $ast = [Management.Automation.Language.Parser]::ParseFile($path, [ref]$tokens, [ref]$parseErrors)
+        Assert-CcodEqual 0 @($parseErrors).Count 'dependency graph source parses'
+        if ($null -eq $declared) {
+            $assignment = @($ast.FindAll({ param($Node) $Node -is [Management.Automation.Language.AssignmentStatementAst] -and $Node.Left.Extent.Text -ceq '$importClosure' }, $true))
+            Assert-CcodEqual 1 $assignment.Count 'one explicit import closure'
+            $declared = @($assignment[0].Right.FindAll({ param($Node) $Node -is [Management.Automation.Language.StringConstantExpressionAst] -and $Node.Value.EndsWith('.psm1') }, $true) | ForEach-Object Value)
+        }
+        foreach ($command in @($ast.FindAll({ param($Node) $Node -is [Management.Automation.Language.CommandAst] -and $Node.GetCommandName() -eq 'Import-Module' }, $true))) {
+            $parent = $command.Parent
+            while ($null -ne $parent -and $parent -isnot [Management.Automation.Language.FunctionDefinitionAst]) { $parent = $parent.Parent }
+            if ($null -ne $parent) { continue }
+            $literals = @($command.FindAll({ param($Node) $Node -is [Management.Automation.Language.StringConstantExpressionAst] -and $Node.Value.EndsWith('.psm1') }, $true))
+            Assert-CcodEqual 1 $literals.Count 'every eager import has one statically auditable dependency'
+            $leaf = [IO.Path]::GetFileName($literals[0].Value)
+            if ($observed.Add($leaf)) { $queue.Enqueue((Join-Path (Join-Path $repositoryRoot 'src\persistence\modules') $leaf)) }
+        }
+    }
+    Assert-CcodEqual (($declared | Sort-Object) -join ',') ((@($observed) | Sort-Object) -join ',') 'lease set exactly covers actual transitive eager imports'
+}
+
+Invoke-CcodImportTest 'Lease' 'main validation requires the import regression harness instead of silently dropping it' {
+    $validation = [IO.File]::ReadAllText((Join-Path $repositoryRoot 'tests\Validate.ps1'))
+    Assert-CcodTrue $validation.Contains("'tests\persistence\TrustedModuleImport.SelfTest.ps1'") 'main validation must require the I8 self-test file'
+    $discovered = @(Get-ChildItem -LiteralPath $PSScriptRoot -Filter '*.SelfTest.ps1' | Where-Object Name -CEQ 'TrustedModuleImport.SelfTest.ps1')
+    Assert-CcodEqual 1 $discovered.Count 'serial persistence discovery registers the harness once'
+}
+
+if ($script:executed -eq 0) { throw 'CCOD_IMPORT_TEST_SELECTION_INVALID' }
+if ($Case) { Write-Host "CCOD_IMPORT_FOCUSED_PASSED area=$Case executed=$script:executed skipped=$script:skipped" }
+else { Write-Host "Trusted module import self-tests passed: $script:executed; skipped=$script:skipped." }
diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index ceecabd..9dce499 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -15,6 +15,17 @@ if (-not (Test-Path -LiteralPath $installedFinalizerScript -PathType Leaf)) { th
 Import-Module (Join-Path $repositoryRoot 'src\persistence\modules\RuntimeManifest.psm1') -Force
 $canonicalTaskTarget=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'schtasks.exe'))
 
+$results=@()
+
+$results+=Invoke-CcodTest 'uninstall bootstrap runtime IDs use canonical TAB delimiters' {
+    $records=@(
+        [pscustomobject]@{ path='a.txt'; length=[int64]5; sha256=('a'*64) }
+        [pscustomobject]@{ path='b.txt'; length=[int64]4; sha256=('b'*64) }
+    )
+    $expected='2.5.22-e71f4818a0f8e98f-0123456789abcdef0123456789abcdef'
+    Assert-CcodEqual $expected (Get-CcodUninstallBootstrapRuntimeId -ProjectVersion '2.5.22' -Records $records -Nonce '0123456789abcdef0123456789abcdef') 'uninstall runtime ID digest input must use literal TAB delimiters'
+}
+
 function New-CcodUninstallBootstrapTestPayloadRecords {
     $records=@(New-CcodUninstallBootstrapPayloadRecords -ResumeOnly);foreach($record in $records){$record.length=[int64]1;$record.sha256=('d'*64)};$resume=@($records|Where-Object{$_.path-ceq'src/persistence/InstalledUninstallFinalizer.ps1'})[0];$resume.length=[int64]123;$resume.sha256=('e'*64);return $records
 }
@@ -225,8 +236,6 @@ function New-CcodVerifiedUninstallRuntimeFixture {
     return [pscustomobject][ordered]@{RuntimeRoot=$finalRuntime;RuntimeId=$manifest.runtimeId}
 }
 
-$results = @()
-
 $results += Invoke-CcodTest 'Prepare stages only the manifest-bound cleanup payload and reaches the Inno boundary' {
     $world = [pscustomobject]@{
         Calls = [Collections.Generic.List[string]]::new()
@@ -305,6 +314,7 @@ function New-CcodInstalledFinalizerMemoryAdapters {
         ReclaimSelectedGeneration={param($Runtime,$Transaction)$World.Calls.Add('Reclaim');$World.EntryPresentAtReclaim=[bool]$World.PublicEntry;$World.RootPresent=$false;[pscustomobject]@{phase='Completed';result='Reclaimed';runtimeId=$Transaction.runtimeId}}.GetNewClosure()
         WriteReadyForInno={param($Transaction)$World.Calls.Add('Write:ReadyForInno');if($World.Failure-ceq'PhaseWrite'-and-not$World.FailureInjected){$World.FailureInjected=$true;throw [Management.Automation.ErrorRecord]::new([IO.IOException]::new('durable phase write failed after reclaim'),'CCOD_UNINSTALL_TRANSACTION_WRITE_FAILED',[Management.Automation.ErrorCategory]::WriteError,$Transaction.transactionId)};$Transaction.phase='ReadyForInno';$Transaction.resumePhase='ReadyForInno';$World.Transaction=$Transaction;$Transaction}.GetNewClosure()
         RemoveMatchedProductShortcuts={param($Transaction)$World.Calls.Add('ProductShortcuts');if($World.Failure-ceq'ProductShortcuts'-and-not$World.FailureInjected){$World.FailureInjected=$true;throw [IO.IOException]::new('shortcut cleanup failed')};$World.ShortcutsPresent=$false}.GetNewClosure()
+        CleanupProductResidue={param($Transaction)$World.Calls.Add('ProductResidue');[pscustomobject]@{phase='Completed';result='Removed'}}.GetNewClosure()
         FinalizeReceipt={param($Transaction)$World.Calls.Add('FinalizeReceipt');$Transaction.phase='Completed';$Transaction.resumePhase='Completed';$World.Transaction=$Transaction;if($World.Failure-ceq'FinalReceipt'-and-not$World.FailureInjected){$World.FailureInjected=$true;$World.CompletedReceipt=$false;throw [IO.IOException]::new('receipt write failed after Completed transaction')};$World.CompletedReceipt=$true;$Transaction}.GetNewClosure()
         TestCompletedReceipt={param($Transaction)$World.Calls.Add('TestReceipt');[bool]$World.CompletedReceipt}.GetNewClosure()
         RemoveResumeProductRegistration={param($Transaction)$World.Calls.Add('RemoveRegistry');if($World.Failure-ceq'FinalRegistry'-and-not$World.FailureInjected){$World.FailureInjected=$true;throw [IO.IOException]::new('final recovery registry delete failed')};$World.PublicEntry=$false;$World.PublicCommand=$null;$true}.GetNewClosure()
@@ -913,17 +923,40 @@ $results += Invoke-CcodTest 'fresh and stored Ready evidence require one exact c
     }
 }
 
-$results += Invoke-CcodTest 'default installed finalizer validates and removes only the exact selected generation fixture' {
+function Invoke-CcodDefaultInstalledProductCleanupCase {
+    param([switch]$PartialFailure)
     $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-installed-finalizer-'+[guid]::NewGuid().ToString('N'));$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
     try{
-        [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$install=Join-Path $local 'CodexControlOtherDevices';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$identity=Get-CcodUninstallBootstrapCurrentIdentity;$transactionRoot=Get-CcodUninstallBootstrapDefaultTransactionRoot;$id='11111111-2222-3333-4444-555555555555';$directory=New-CcodUninstallBootstrapTransactionDirectory -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid
+        [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$install=Join-Path $local 'CodexControlOtherDevices';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly -ProjectVersion '2.5.22';$identity=Get-CcodUninstallBootstrapCurrentIdentity;$transactionRoot=Get-CcodUninstallBootstrapDefaultTransactionRoot;$id='11111111-2222-3333-4444-555555555555';$directory=New-CcodUninstallBootstrapTransactionDirectory -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid
         $payload=Join-Path $directory 'payload';$recordMap=@{};foreach($relative in $script:CcodUninstallPayloadEntries){$source=Join-Path $fixture.RuntimeRoot $relative.Replace('/','\');$destination=Join-Path $payload $relative.Replace('/','\');[IO.Directory]::CreateDirectory((Split-Path $destination -Parent))|Out-Null;[IO.File]::Copy($source,$destination,$true);$recordMap[$relative]=Get-CcodUninstallBootstrapFileFingerprint $source};$payloadRecords=New-CcodUninstallBootstrapPayloadRecords -RecordMap $recordMap
         $tx=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$tx.runtimeId=$fixture.RuntimeId;$tx.runtimeGeneration=[uint64]7;$tx.userSid=$identity.userSid;$tx.sessionId=$identity.sessionId;$tx.readyEvidence.runtimeId=$fixture.RuntimeId;$tx.readyEvidence.runtimeGeneration=[uint64]7;$tx.readyEvidence.installRoot=$install;$manifest=(Get-FileHash (Join-Path $fixture.RuntimeRoot 'manifest.json') -Algorithm SHA256).Hash.ToLowerInvariant();$tx.readyEvidence.manifestSha256=$manifest;$tx.installedBinding=New-CcodUninstallBootstrapTestInstalledBinding -TransactionId $id -RuntimeRoot $fixture.RuntimeRoot -InstallRoot $install -UserSid $identity.userSid -SessionId $identity.sessionId -PayloadRecords $payloadRecords -TransactionDirectory $directory -RuntimeManifestSha256 $manifest;$timestamp=[DateTime]::UtcNow.AddMinutes(-1).ToString('o',[Globalization.CultureInfo]::InvariantCulture);$tx.startedAtUtc=$timestamp;$tx.updatedAtUtc=$timestamp;Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory $directory -Transaction $tx;Publish-CcodUninstallBootstrapCurrentTransaction -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid
         $resume=[pscustomobject]@{Present=$false};$overrides=@{WaitWrapperExit={param($I,$T)[pscustomobject]@{verifiedAtStart=$true;exited=$true}};InstallResumeProductRegistration={param($T)$resume.Present=$true}.GetNewClosure();GetResumeProductRegistrationState={param($T)if($resume.Present){'Exact'}else{'Absent'}}.GetNewClosure();RemoveMatchedProductShortcuts={param($T)};RemoveResumeProductRegistration={param($T)$resume.Present=$false;$true}.GetNewClosure()};$adapters=Get-CcodInstalledFinalizerAdapters -Adapters $overrides -TransactionRoot $transactionRoot -PayloadRoot $payload -RuntimeRoot $fixture.RuntimeRoot -InstallRoot $install
-        $receipt=Invoke-CcodInstalledUninstallFinalizer -TransactionId $id -RuntimeRoot $fixture.RuntimeRoot -InstallRoot $install -WrapperIdentity ([pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=$identity.sessionId;userSid=$identity.userSid}) -Adapters $adapters;Assert-CcodEqual 'Completed' $receipt.phase 'default finalizer reaches completion';Assert-CcodTrue (-not(Test-Path $fixture.RuntimeRoot)) 'default finalizer deletes exact selected runtime';Assert-CcodTrue (Test-Path (Join-Path $install 'state')) 'default finalizer preserves sibling install state';Assert-CcodTrue (-not$resume.Present) 'default finalizer removes the public anchor last'
+        $wrapper=[pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=$identity.sessionId;userSid=$identity.userSid}
+        if($PartialFailure){
+            $defaultCleanup=$adapters.CleanupProductResidue
+            $adapters.CleanupProductResidue={param($Transaction)
+                $path=Join-Path $payload 'src/persistence/modules/GenerationReclamation.psm1'
+                $reclamation=Import-Module $path -Force -PassThru -DisableNameChecking
+                &$reclamation {$script:CcodProductResidueFailCommitAtForTest=18}
+                try {&$reclamation {param($Root,$Tx,$Directory)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId $Tx.runtimeId -ExpectedEpoch ([uint64]$Tx.leaseEpoch) -TransactionDirectory $Directory -TransactionId $Tx.transactionId} $install $Transaction $directory}
+                finally {&$reclamation {$script:CcodProductResidueFailCommitAtForTest=-1}}
+            }.GetNewClosure()
+            Assert-CcodThrows {Invoke-CcodInstalledUninstallFinalizer -TransactionId $id -RuntimeRoot $fixture.RuntimeRoot -InstallRoot $install -WrapperIdentity $wrapper -Adapters $adapters|Out-Null} 'CCOD_PRODUCT_RESIDUE_INVALID'
+            Assert-CcodTrue $resume.Present 'actual cleanup failure retains the public resume entry'
+            Assert-CcodTrue (-not(Test-Path (Join-Path $install 'state/lifecycle-epoch.json'))) 'failure occurs after the live epoch file was deleted'
+            $adapters.CleanupProductResidue=$defaultCleanup
+            $receipt=Invoke-CcodInstalledUninstallFinalizer -TransactionId $id -RuntimeRoot $fixture.RuntimeRoot -InstallRoot $install -Resume -Adapters $adapters
+        }else{$receipt=Invoke-CcodInstalledUninstallFinalizer -TransactionId $id -RuntimeRoot $fixture.RuntimeRoot -InstallRoot $install -WrapperIdentity $wrapper -Adapters $adapters}
+        Assert-CcodEqual 'Completed' $receipt.phase 'default finalizer reaches completion'
+        Assert-CcodTrue (-not(Test-Path $fixture.RuntimeRoot)) 'default finalizer deletes exact selected runtime'
+        Assert-CcodTrue (-not(Test-Path $install)) 'completion receipt requires the product root and state to be absent'
+        Assert-CcodTrue (-not$resume.Present) 'default finalizer removes the public anchor last'
     }finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $local){Remove-Item $local -Recurse -Force}}
 }
 
+$results += Invoke-CcodTest 'default installed finalizer completes bounded product cleanup before its completion receipt' {Invoke-CcodDefaultInstalledProductCleanupCase}
+$results += Invoke-CcodTest 'default installed finalizer resumes after product cleanup removed the live epoch file' {Invoke-CcodDefaultInstalledProductCleanupCase -PartialFailure}
+
 function Invoke-CcodInstalledReclamationMutationCase {
     param([Parameter(Mandatory)][ValidateSet('UnexpectedFile','UnexpectedDirectory','Reparse','Hardlink','Ads','OpenChild')][string]$Mutation)
     $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-installed-reclamation-red-'+[guid]::NewGuid().ToString('N'));$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process');$attackState=[pscustomobject]@{Path=$null;OpenHandle=$null}
diff --git a/tools/Invoke-GitHubDraftRelease.ps1 b/tools/Invoke-GitHubDraftRelease.ps1
index 8663145..e8cf995 100644
--- a/tools/Invoke-GitHubDraftRelease.ps1
+++ b/tools/Invoke-GitHubDraftRelease.ps1
@@ -1,6 +1,154 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 $script:CcodDraftReleaseAssetContractModule = $null
+$script:CcodGitHubDraftModuleRoot = if (-not [string]::IsNullOrWhiteSpace($PSScriptRoot)) { [IO.Path]::GetFullPath($PSScriptRoot) } else { $null }
+
+# BEGIN CCOD TRUSTED IMPORT BOOTSTRAP
+# Embedded in each independently trusted entrypoint; an unheld helper import
+# cannot bootstrap its own protection. Keep copies identical (self-test enforced).
+function Initialize-CcodTrustedImportLease {
+    if ($null -ne ('CcodTrustedImportLeaseV1' -as [type])) { return }
+    Add-Type -ErrorAction Stop -TypeDefinition @'
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+
+public sealed class CcodTrustedImportLeaseV1 : IDisposable
+{
+    [StructLayout(LayoutKind.Sequential)] private struct NativeTime { public uint Low, High; }
+    [StructLayout(LayoutKind.Sequential)] private struct NativeInfo
+    {
+        public uint Attributes;
+        public NativeTime Creation, Access, Write;
+        public uint Volume, SizeHigh, SizeLow, Links, IndexHigh, IndexLow;
+    }
+    private sealed class Entry
+    {
+        public SafeFileHandle Handle;
+        public string Path;
+        public bool Directory;
+        public uint Volume;
+        public ulong FileId;
+    }
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern SafeFileHandle CreateFileW(string path, uint access, uint share, IntPtr security, uint creation, uint flags, IntPtr template);
+    [DllImport("kernel32.dll", SetLastError=true)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle handle, out NativeInfo info);
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern uint GetFinalPathNameByHandleW(SafeFileHandle handle, StringBuilder value, uint length, uint flags);
+
+    private readonly List<Entry> entries = new List<Entry>();
+    private bool disposed;
+    public string Path { get; private set; }
+    private CcodTrustedImportLeaseV1(string path) { Path = path; }
+
+    public static CcodTrustedImportLeaseV1 Acquire(string path)
+    {
+        if (String.IsNullOrWhiteSpace(path) || !System.IO.Path.IsPathRooted(path) ||
+            path.StartsWith(@"\\?\", StringComparison.Ordinal) || path.StartsWith(@"\\.\", StringComparison.Ordinal))
+            throw new ArgumentException("Unsupported module path");
+        string full = System.IO.Path.GetFullPath(path);
+        string root = System.IO.Path.GetPathRoot(full);
+        string extension = System.IO.Path.GetExtension(full);
+        if (!String.Equals(full, path, StringComparison.OrdinalIgnoreCase) || String.IsNullOrEmpty(root) ||
+            full.Substring(root.Length).IndexOf(':') >= 0 ||
+            (!String.Equals(extension, ".psm1", StringComparison.OrdinalIgnoreCase) && !String.Equals(extension, ".ps1", StringComparison.OrdinalIgnoreCase)))
+            throw new ArgumentException("Noncanonical module path");
+        var lease = new CcodTrustedImportLeaseV1(full);
+        try
+        {
+            var parents = new List<string>();
+            for (DirectoryInfo parent = Directory.GetParent(full); parent != null; parent = parent.Parent)
+                parents.Add(parent.FullName);
+            parents.Reverse();
+            if (parents.Count == 0 || !SamePath(parents[0], root)) throw new IOException("Missing module root");
+            // Retain root-to-leaf authority before traversing the next component.
+            foreach (string parent in parents) lease.Open(parent, true);
+            lease.Open(full, false);
+            lease.Revalidate();
+            return lease;
+        }
+        catch { lease.Dispose(); throw; }
+    }
+
+    private void Open(string path, bool directory)
+    {
+        uint access = directory ? 0x00100081U : 0x80100080U;
+        uint flags = 0x00200000U | (directory ? 0x02000000U : 0U);
+        // FILE_SHARE_READ only: preexisting writers/deleters must fail closed.
+        SafeFileHandle handle = CreateFileW(path, access, 1U, IntPtr.Zero, 3U, flags, IntPtr.Zero);
+        if (handle.IsInvalid) { int error = Marshal.GetLastWin32Error(); handle.Dispose(); throw new Win32Exception(error); }
+        try
+        {
+            NativeInfo info = Inspect(handle, path, directory);
+            entries.Add(new Entry { Handle = handle, Path = path, Directory = directory, Volume = info.Volume, FileId = FileId(info) });
+        }
+        catch { handle.Dispose(); throw; }
+    }
+
+    private static ulong FileId(NativeInfo info) { return ((ulong)info.IndexHigh << 32) | info.IndexLow; }
+    private static bool SamePath(string left, string right)
+    {
+        return String.Equals(left.TrimEnd('\\'), right.TrimEnd('\\'), StringComparison.OrdinalIgnoreCase);
+    }
+    private static NativeInfo Inspect(SafeFileHandle handle, string expected, bool directory)
+    {
+        NativeInfo info;
+        if (!GetFileInformationByHandle(handle, out info)) throw new Win32Exception(Marshal.GetLastWin32Error());
+        if ((info.Attributes & 0x400U) != 0 || ((info.Attributes & 0x10U) != 0) != directory)
+            throw new IOException("Unsafe module path kind");
+        var value = new StringBuilder(512);
+        uint length = GetFinalPathNameByHandleW(handle, value, (uint)value.Capacity, 0);
+        if (length == 0) throw new Win32Exception(Marshal.GetLastWin32Error());
+        if (length >= value.Capacity)
+        {
+            value.Capacity = checked((int)length + 1);
+            length = GetFinalPathNameByHandleW(handle, value, (uint)value.Capacity, 0);
+            if (length == 0 || length >= value.Capacity) throw new IOException("Module final path unavailable");
+        }
+        string final = value.ToString();
+        if (final.StartsWith(@"\\?\UNC\", StringComparison.OrdinalIgnoreCase)) final = @"\\" + final.Substring(8);
+        else if (final.StartsWith(@"\\?\", StringComparison.OrdinalIgnoreCase)) final = final.Substring(4);
+        if (!SamePath(final, expected)) throw new IOException("Module final path mismatch");
+        return info;
+    }
+
+    public void Revalidate()
+    {
+        if (disposed) throw new ObjectDisposedException("trusted module import lease");
+        foreach (Entry entry in entries)
+        {
+            NativeInfo info = Inspect(entry.Handle, entry.Path, entry.Directory);
+            if (info.Volume != entry.Volume || FileId(info) != entry.FileId) throw new IOException("Module identity changed");
+        }
+    }
+    public void Dispose()
+    {
+        if (disposed) return;
+        disposed = true;
+        for (int index = entries.Count - 1; index >= 0; index--) entries[index].Handle.Dispose();
+        entries.Clear();
+    }
+}
+'@
+}
+
+function Open-CcodTrustedImportLease {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$ErrorId)
+    try {
+        Initialize-CcodTrustedImportLease
+        return [CcodTrustedImportLeaseV1]::Acquire($Path)
+    } catch {
+        throw [Management.Automation.ErrorRecord]::new(
+            [InvalidOperationException]::new('Trusted module import authority could not be acquired.'),
+            $ErrorId,[Management.Automation.ErrorCategory]::InvalidData,$Path)
+    }
+}
+# END CCOD TRUSTED IMPORT BOOTSTRAP
 
 function Throw-CcodGitHubDraftError {
     param([Parameter(Mandatory)][string]$Id,[Parameter(Mandatory)][string]$Message,$Target)
@@ -26,31 +174,119 @@ function Test-CcodGitHubDraftCanonicalAbsolutePath($Path) {
     }
 }
 
-function Import-CcodDraftReleaseAssetContract {
-    $candidates = [Collections.Generic.List[string]]::new()
-    if (-not [string]::IsNullOrWhiteSpace($PSScriptRoot)) { $candidates.Add((Join-Path $PSScriptRoot 'ReleaseAssetContract.psm1')) }
-    $candidates.Add((Join-Path (Get-Location) 'tools\ReleaseAssetContract.psm1'))
-    foreach ($path in $candidates) {
-        if ([IO.File]::Exists($path)) {
-            $script:CcodDraftReleaseAssetContractModule = Import-Module $path -Force -DisableNameChecking -PassThru
-            return
+function Test-CcodGitHubDraftCanonicalUtc($Value) {
+    if ($Value -isnot [string] -or [string]::IsNullOrWhiteSpace($Value)) { return $false }
+    $parsed = [datetime]::MinValue
+    return [datetime]::TryParseExact(
+        $Value,
+        'o',
+        [Globalization.CultureInfo]::InvariantCulture,
+        [Globalization.DateTimeStyles]::RoundtripKind,
+        [ref]$parsed
+    ) -and $parsed.Kind -eq [DateTimeKind]::Utc -and
+        $parsed.ToUniversalTime().ToString('o', [Globalization.CultureInfo]::InvariantCulture) -ceq $Value
+}
+
+function Test-CcodGitHubDraftMissingError($ErrorRecord) {
+    return $ErrorRecord.CategoryInfo.Category -eq 'ObjectNotFound' -or
+        $ErrorRecord.Exception -is [IO.FileNotFoundException] -or $ErrorRecord.Exception -is [IO.DirectoryNotFoundException]
+}
+
+function Assert-CcodGitHubDraftTrustedModulePath {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][bool]$Directory)
+    try {
+        if ([string]::IsNullOrWhiteSpace($Path) -or -not [IO.Path]::IsPathRooted($Path)) { throw 'module path' }
+        $full = [IO.Path]::GetFullPath($Path)
+        if (-not [string]::Equals($full, $Path, [StringComparison]::OrdinalIgnoreCase)) { throw 'module canonical path' }
+        $item = Get-Item -LiteralPath $full -Force -ErrorAction Stop
+        if (($Directory -and $item -isnot [IO.DirectoryInfo]) -or (-not $Directory -and $item -isnot [IO.FileInfo])) { throw 'module kind' }
+        $root = [IO.Path]::GetPathRoot($full)
+        $current = $full
+        while ($true) {
+            $ancestor = Get-Item -LiteralPath $current -Force -ErrorAction Stop
+            if (($ancestor.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'module reparse' }
+            if ($current.TrimEnd('\') -ceq $root.TrimEnd('\')) { break }
+            $parent = [IO.Directory]::GetParent($current)
+            if ($null -eq $parent) { break }
+            $current = $parent.FullName.TrimEnd('\')
         }
+        return $full
+    } catch {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CONTRACT_MISSING' 'Trusted validation module path has missing or reparse ancestry.' $Path
     }
-    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CONTRACT_MISSING' 'Release asset contract module is missing.' $null
+}
+
+function Test-CcodGitHubDraftExactProperties($Value,[string[]]$Expected) {
+    if ($null -eq $Value -or ($Value -isnot [pscustomobject] -and $Value -isnot [Collections.IDictionary])) { return $false }
+    if ($Value -is [Collections.IDictionary]) { $actual = @($Value.Keys | ForEach-Object { [string]$_ }) } else { $actual = @($Value.PSObject.Properties.Name) }
+    return $actual.Count -eq $Expected.Count -and ($actual -join "`0") -ceq ($Expected -join "`0")
+}
+
+function Test-CcodGitHubDraftPositiveInteger($Value) {
+    if ($null -eq $Value -or $Value -is [bool] -or $Value.GetType() -notin @([int32],[int64])) { return $false }
+    try { return [uint64]$Value -gt 0 } catch { return $false }
+}
+
+function Import-CcodDraftReleaseAssetContract {
+    $toolRoot = if (-not [string]::IsNullOrWhiteSpace($PSScriptRoot)) { [IO.Path]::GetFullPath($PSScriptRoot) } else { [string]$script:CcodGitHubDraftModuleRoot }
+    $path = Join-Path $toolRoot 'ReleaseAssetContract.psm1'
+    $lease = Open-CcodTrustedImportLease -Path $path -ErrorId 'CCOD_GITHUB_DRAFT_CONTRACT_MISSING'
+    try {
+        $toolRoot = Assert-CcodGitHubDraftTrustedModulePath -Path $toolRoot -Directory $true
+        $path = Assert-CcodGitHubDraftTrustedModulePath -Path $path -Directory $false
+        $lease.Revalidate()
+        $script:CcodDraftReleaseAssetContractModule = Import-Module $path -Force -DisableNameChecking -PassThru -ErrorAction Stop
+        $lease.Revalidate()
+    } finally { $lease.Dispose() }
 }
 
 function Read-CcodGitHubDraftContractJson {
     param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$ErrorId)
     if ($null -eq $script:CcodDraftReleaseAssetContractModule) { Import-CcodDraftReleaseAssetContract }
+    $directory = $null
+    $file = $null
     try {
-        return & $script:CcodDraftReleaseAssetContractModule { param($JsonPath,$ContractErrorId) Read-CcodReleaseContractJson -Path $JsonPath -ErrorId $ContractErrorId } $Path $ErrorId
+        $full = [IO.Path]::GetFullPath($Path)
+        $directory = & $script:CcodDraftReleaseAssetContractModule { param($Parent,$Id) Open-CcodReleaseDirectoryAuthority -Path $Parent -ErrorId $Id } ([IO.Path]::GetDirectoryName($full)) $ErrorId
+        $file = & $script:CcodDraftReleaseAssetContractModule { param($Parent,$Leaf,$Id) Open-CcodReleaseFileAuthority -Directory $Parent -Leaf $Leaf -ErrorId $Id -MaximumBytes 4194304 } $directory ([IO.Path]::GetFileName($full)) $ErrorId
+        $pinned = & $script:CcodDraftReleaseAssetContractModule { param($Authority,$Id) Read-CcodReleaseContractPinnedJson -Authority $Authority -ErrorId $Id -MaximumBytes 4194304 } $file $ErrorId
+        return [pscustomobject]@{ Raw = $pinned.Raw; Value = $pinned.Value; Bytes = $pinned.Bytes; Sha256 = $file.Sha256; Path = $file.Path }
     } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_*') { throw }
         Throw-CcodGitHubDraftError $ErrorId 'Draft evidence JSON is malformed or outside its contract.' $Path
+    } finally {
+        if ($null -ne $file) { & $script:CcodDraftReleaseAssetContractModule { param($Value) Close-CcodReleaseAuthority $Value } $file }
+        if ($null -ne $directory) { & $script:CcodDraftReleaseAssetContractModule { param($Value) Close-CcodReleaseAuthority $Value } $directory }
+    }
+}
+
+function Read-CcodGitHubDraftNotesPinned {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$ErrorId)
+    if ($null -eq $script:CcodDraftReleaseAssetContractModule) { Import-CcodDraftReleaseAssetContract }
+    $directory = $null
+    $file = $null
+    try {
+        $full = [IO.Path]::GetFullPath($Path)
+        $directory = & $script:CcodDraftReleaseAssetContractModule { param($Parent,$Id) Open-CcodReleaseDirectoryAuthority -Path $Parent -ErrorId $Id } ([IO.Path]::GetDirectoryName($full)) $ErrorId
+        $file = & $script:CcodDraftReleaseAssetContractModule { param($Parent,$Leaf,$Id) Open-CcodReleaseFileAuthority -Directory $Parent -Leaf $Leaf -ErrorId $Id -MaximumBytes 1048576 } $directory ([IO.Path]::GetFileName($full)) $ErrorId
+        $bytes = & $script:CcodDraftReleaseAssetContractModule {
+            param($Authority,$Id)
+            Assert-CcodReleaseAuthorityCurrent -Authority $Authority -ErrorId $Id -CheckBytes | Out-Null
+            Get-CcodReleaseAuthorityStreamBytes -Stream $Authority.Stream -MaximumBytes 1048576
+        } $file $ErrorId
+        & $script:CcodDraftReleaseAssetContractModule { param($Authority,$Id) Assert-CcodReleaseAuthorityCurrent -Authority $Authority -ErrorId $Id -CheckBytes | Out-Null } $file $ErrorId
+        return [Text.UTF8Encoding]::new($false, $true).GetString([byte[]]$bytes)
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_*') { throw }
+        Throw-CcodGitHubDraftError $ErrorId 'Release notes are missing, invalid, or changed during the pinned read.' $Path
+    } finally {
+        if ($null -ne $file) { & $script:CcodDraftReleaseAssetContractModule { param($Value) Close-CcodReleaseAuthority $Value } $file }
+        if ($null -ne $directory) { & $script:CcodDraftReleaseAssetContractModule { param($Value) Close-CcodReleaseAuthority $Value } $directory }
     }
 }
 
 function Read-CcodGitHubDraftPreflight {
-    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$Version,[Parameter(Mandatory)][string]$GitCommit)
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$Version,[Parameter(Mandatory)][string]$GitCommit,[ref]$PinnedSha256)
     if (-not [IO.File]::Exists($Path)) {
         Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PREFLIGHT_MISSING' 'Stage requires transferred clean-runner preflight evidence.' $Path
     }
@@ -63,11 +299,17 @@ function Read-CcodGitHubDraftPreflight {
         $record.valid -isnot [bool] -or -not [bool]$record.valid -or
         $record.version -isnot [string] -or $record.version -cne $Version -or
         $record.gitCommit -isnot [string] -or $record.gitCommit -cne $GitCommit -or
-        $record.gitCommit -cnotmatch '^[0-9a-f]{40}$' -or
+        $record.gitCommit -cnotmatch '^[0-9a-f]{40}\z' -or
         $record.repositoryRoot -isnot [string] -or [string]::IsNullOrWhiteSpace($record.repositoryRoot) -or
         -not (Test-CcodGitHubDraftCanonicalAbsolutePath $record.repositoryRoot)) {
         Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PREFLIGHT_INVALID' 'Transferred clean-runner preflight is not bound to this candidate.' $Path
     }
+    if ($null -ne $PinnedSha256) {
+        if ($parsed.Sha256 -isnot [string] -or $parsed.Sha256 -cnotmatch '^[0-9a-f]{64}\z') {
+            Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PREFLIGHT_INVALID' 'Transferred preflight pinned byte hash is unavailable.' $Path
+        }
+        $PinnedSha256.Value = $parsed.Sha256
+    }
     return $record
 }
 
@@ -78,7 +320,7 @@ function Assert-CcodGitHubDraftRemoteView {
         Throw-CcodGitHubDraftError $notStagedId 'GitHub returned no structured release state.' $Tag
     }
     $fields = @($View.PSObject.Properties.Name)
-    if (($fields -join ',') -cne 'Tag,Draft,AssetNames' -or $View.Tag -isnot [string] -or $View.Tag -cne $Tag -or $View.Draft -isnot [bool]) {
+    if (($fields -join ',') -cne 'Tag,Id,Draft,AssetNames' -or $View.Tag -isnot [string] -or $View.Tag -cne $Tag -or $View.Id -isnot [string] -or $View.Id -notmatch '^[1-9][0-9]*\z' -or $View.Draft -isnot [bool]) {
         Throw-CcodGitHubDraftError $notStagedId 'GitHub release state has an invalid schema.' $Tag
     }
     if ((-not $AfterPromotion -and -not [bool]$View.Draft) -or ($AfterPromotion -and [bool]$View.Draft)) {
@@ -89,7 +331,7 @@ function Assert-CcodGitHubDraftRemoteView {
     if ($actual.Count -ne $expected.Count) {
         Throw-CcodGitHubDraftError $notStagedId 'GitHub draft does not contain the complete release asset set.' $Tag
     }
-    if ((($actual | ForEach-Object { [string]$_ }) -join "`n") -cne ($expected -join "`n")) {
+    if (@($actual | Where-Object { $_ -isnot [string] }).Count -ne 0 -or (($actual -join "`n") -cne ($expected -join "`n"))) {
         Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ASSET_SET_INVALID' 'GitHub draft assets are not the exact ordered release set.' $Tag
     }
     return [string[]]$actual
@@ -101,7 +343,7 @@ function Assert-CcodGitHubDraftPrivateView {
         Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CREATE_FAILED' 'GitHub returned no structured private draft state.' $Tag
     }
     $fields = @($View.PSObject.Properties.Name)
-    if (($fields -join ',') -cne 'Tag,Draft,AssetNames' -or $View.Tag -isnot [string] -or $View.Tag -cne $Tag -or $View.Draft -isnot [bool] -or -not [bool]$View.Draft -or $null -eq $View.AssetNames) {
+    if (($fields -join ',') -cne 'Tag,Id,Draft,AssetNames' -or $View.Tag -isnot [string] -or $View.Tag -cne $Tag -or $View.Id -isnot [string] -or $View.Id -notmatch '^[1-9][0-9]*\z' -or $View.Draft -isnot [bool] -or -not [bool]$View.Draft -or $null -eq $View.AssetNames) {
         Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CREATE_FAILED' 'GitHub returned an invalid or non-private draft state.' $Tag
     }
     $expected = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
@@ -159,7 +401,7 @@ function Release-CcodGitHubDraftStageLock {
 function Assert-CcodGitHubDraftActionsContext {
     param([Parameter(Mandatory)][string]$Tag)
     $repository = 'naipi11/CodexRemote-fix'
-    if ($env:GITHUB_ACTIONS -cne 'true' -or $env:GITHUB_SERVER_URL -cne 'https://github.com' -or $env:GITHUB_REPOSITORY -cne $repository -or $env:GITHUB_RUN_ID -notmatch '^[1-9][0-9]*$' -or [string]::IsNullOrWhiteSpace($env:GH_TOKEN)) {
+    if ($env:GITHUB_ACTIONS -cne 'true' -or $env:GITHUB_SERVER_URL -cne 'https://github.com' -or $env:GITHUB_REPOSITORY -cne $repository -or $env:GITHUB_RUN_ID -notmatch '^[1-9][0-9]*\z' -or [string]::IsNullOrWhiteSpace($env:GH_TOKEN)) {
         Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_GH_FORBIDDEN' 'GitHub draft adapters require the official CodexRemote-fix Actions context.' $Tag
     }
 }
@@ -183,24 +425,25 @@ function Get-CcodGitHubDraftTagCommit {
     if ($LASTEXITCODE -ne 0) {
         Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_TAG_COMMIT_FAILED' 'Could not resolve the official remote tag commit.' $Tag
     }
-    $commit = (($lines | ForEach-Object { [string]$_ }) -join '').Trim().ToLowerInvariant()
-    if ($commit -notmatch '^[0-9a-f]{40}\z') {
+    if ($lines.Count -ne 1 -or $lines[0] -isnot [string] -or $lines[0] -cnotmatch '^[0-9a-f]{40}\z') {
         Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_TAG_COMMIT_FAILED' 'GitHub returned an invalid remote tag commit.' $Tag
     }
-    $commit
+    $lines[0]
 }
 
 function Assert-CcodGitHubDraftTagCommit {
     param([Parameter(Mandatory)][string]$Tag,[Parameter(Mandatory)][string]$ExpectedCommit,[Parameter(Mandatory)]$Adapters,[Parameter(Mandatory)][bool]$ActionsOnly)
-    if ($ExpectedCommit -notmatch '^[0-9a-f]{40}\z') {
+    if ($ExpectedCommit -cnotmatch '^[0-9a-f]{40}\z') {
         Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_TAG_COMMIT_INVALID' 'Candidate commit is not canonical.' $ExpectedCommit
     }
     try {
-        $actualCommit = ([string](& $Adapters.GetTagCommit $Tag $ActionsOnly)).Trim().ToLowerInvariant()
+        $rawCommit = & $Adapters.GetTagCommit $Tag $ActionsOnly
+        if ($rawCommit -isnot [string] -or $rawCommit -cnotmatch '^[0-9a-f]{40}\z') { throw 'remote commit type or value' }
+        $actualCommit = $rawCommit
     } catch {
         Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_TAG_COMMIT_FAILED' 'Could not read the remote tag commit.' $Tag
     }
-    if ($actualCommit -cne $ExpectedCommit.ToLowerInvariant()) {
+    if ($actualCommit -cne $ExpectedCommit) {
         Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_TAG_COMMIT_MISMATCH' 'Remote tag does not resolve to the immutable candidate commit.' $Tag
     }
 }
@@ -224,7 +467,19 @@ function Get-CcodGitHubDraftReleaseDefaultAdapters {
             Assert-CcodGitHubDraftActionsContext $Tag
             & gh release create $Tag '--repo' 'naipi11/CodexRemote-fix' '--draft' '--verify-tag' '--title' $Title '--notes' $Notes | Out-Null
             if ($LASTEXITCODE -ne 0) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CREATE_FAILED' 'Could not create a private draft.' $Tag }
-            [pscustomobject]@{ Tag = $Tag; Draft = $true }
+            $json = & gh release view $Tag '--repo' 'naipi11/CodexRemote-fix' '--json' 'databaseId,tagName,isDraft'
+            if ($LASTEXITCODE -ne 0) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CREATE_FAILED' 'Could not read back the created draft identity.' $Tag }
+            try {
+                $value = ($json -join [Environment]::NewLine) | ConvertFrom-Json -ErrorAction Stop
+                $fields = @($value.PSObject.Properties.Name)
+                if ($value -isnot [pscustomobject] -or $fields.Count -ne 3 -or (($fields | Sort-Object -CaseSensitive) -join ',') -cne 'databaseId,isDraft,tagName' -or
+                    ($value.databaseId -isnot [int] -and $value.databaseId -isnot [long]) -or [long]$value.databaseId -le 0 -or
+                    $value.tagName -isnot [string] -or $value.tagName -cne $Tag -or $value.isDraft -isnot [bool] -or -not [bool]$value.isDraft) { throw 'schema' }
+                $id = [string]$value.databaseId
+                [pscustomobject][ordered]@{ Tag = $Tag; Id = $id; Draft = $true; AssetNames = @() }
+            } catch {
+                Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CREATE_FAILED' 'GitHub returned malformed created draft identity.' $Tag
+            }
         }
         UploadAsset = {
             param($Tag, $Name, $Path)
@@ -246,26 +501,58 @@ function Get-CcodGitHubDraftReleaseDefaultAdapters {
         ViewRelease = {
             param($Tag)
             Assert-CcodGitHubDraftAuthenticatedContext $Tag
-            $json = & gh release view $Tag '--repo' 'naipi11/CodexRemote-fix' '--json' 'isDraft,assets'
+            $json = & gh release view $Tag '--repo' 'naipi11/CodexRemote-fix' '--json' 'tagName,isDraft,databaseId,assets'
             if ($LASTEXITCODE -ne 0) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_NOT_STAGED' 'Could not read the GitHub draft state.' $Tag }
             try {
                 $value = ($json -join [Environment]::NewLine) | ConvertFrom-Json -ErrorAction Stop
                 $fields = @($value.PSObject.Properties.Name)
-                if ($null -eq $value -or $fields.Count -ne 2 -or $fields -notcontains 'isDraft' -or $fields -notcontains 'assets' -or $value.isDraft -isnot [bool] -or $null -eq $value.assets) { throw 'schema' }
+                if ($value -isnot [pscustomobject] -or $fields.Count -ne 4 -or (($fields | Sort-Object -CaseSensitive) -join ',') -cne 'assets,databaseId,isDraft,tagName' -or $value.tagName -isnot [string] -or $value.tagName -cne $Tag -or $value.isDraft -isnot [bool] -or
+                    ($value.databaseId -isnot [int] -and $value.databaseId -isnot [long]) -or [long]$value.databaseId -le 0 -or $null -eq $value.assets) { throw 'schema' }
+                $id = [string]$value.databaseId
                 $assetNames = [Collections.Generic.List[string]]::new()
                 foreach ($asset in @($value.assets)) {
                     if ($null -eq $asset -or $null -eq $asset.PSObject.Properties['name'] -or $asset.name -isnot [string] -or [string]::IsNullOrWhiteSpace($asset.name)) { throw 'asset schema' }
                     $assetNames.Add([string]$asset.name)
                 }
-                [pscustomobject]@{ Tag = $Tag; Draft = $value.isDraft; AssetNames = [string[]]$assetNames }
+                [pscustomobject][ordered]@{ Tag = [string]$value.tagName; Id = $id; Draft = $value.isDraft; AssetNames = [string[]]$assetNames }
             } catch {
                 Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_NOT_STAGED' 'GitHub returned malformed release state.' $Tag
             }
         }
+        ProbeRelease = {
+            param($Tag)
+            Assert-CcodGitHubDraftActionsContext $Tag
+            $endpoint = 'repos/naipi11/CodexRemote-fix/releases/tags/' + $Tag
+            $raw = @(& gh api $endpoint '--jq' '{tagName:.tag_name,databaseId:.id,isDraft:.draft,assets:[.assets[].name]}' 2>&1)
+            if ($LASTEXITCODE -ne 0) {
+                $message = ($raw | ForEach-Object { [string]$_ }) -join [Environment]::NewLine
+                if ($message -match '(?i)\b404\b|not found') { return $null }
+                Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CREATE_FAILED' 'Could not prove that the release tag is absent before Stage.' $Tag
+            }
+            try {
+                $value = ($raw -join [Environment]::NewLine) | ConvertFrom-Json -ErrorAction Stop
+                if ($null -eq $value -or $value.tagName -isnot [string] -or $value.databaseId -isnot [int] -and $value.databaseId -isnot [long] -or
+                    $value.isDraft -isnot [bool] -or $null -eq $value.assets) { throw 'schema' }
+                [pscustomobject][ordered]@{
+                    Tag = [string]$value.tagName
+                    Id = [string]$value.databaseId
+                    Draft = [bool]$value.isDraft
+                    AssetNames = @($value.assets | ForEach-Object { [string]$_ })
+                }
+            } catch {
+                Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CREATE_FAILED' 'Pre-create release probe returned malformed state.' $Tag
+            }
+        }
         SetReleaseDraftState = {
-            param($Tag, [bool]$Draft)
+            param($Tag, [bool]$Draft, $ExpectedReleaseId)
+            $boundRecovery = $PSBoundParameters.ContainsKey('ExpectedReleaseId')
+            if (-not $boundRecovery -or $ExpectedReleaseId -isnot [string] -or $ExpectedReleaseId -notmatch '^[1-9][0-9]*\z') {
+                Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PROMOTE_FAILED' 'Visibility changes require an exact bound release ID.' $Tag
+            }
             Assert-CcodGitHubDraftAuthenticatedContext $Tag
-            if ($Draft) { & gh release edit $Tag '--repo' 'naipi11/CodexRemote-fix' '--draft' | Out-Null } else { & gh release edit $Tag '--repo' 'naipi11/CodexRemote-fix' '--draft=false' | Out-Null }
+            $endpoint = 'repos/naipi11/CodexRemote-fix/releases/' + $ExpectedReleaseId
+            $draftField = if ($Draft) { 'draft=true' } else { 'draft=false' }
+            & gh api $endpoint '--method' 'PATCH' '--field' $draftField '--silent' | Out-Null
             if ($LASTEXITCODE -ne 0) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PROMOTE_FAILED' 'Could not change draft visibility.' $Tag }
         }
         InvokeBuild = {
@@ -294,9 +581,10 @@ function Resolve-CcodGitHubDraftReleaseAdapters {
 
 function Get-CcodGitHubDraftFileSha256 {
     param([Parameter(Mandatory)][string]$Path)
+    $full = Assert-CcodGitHubDraftPlainPath -Path $Path -Directory $false
     $sha = [Security.Cryptography.SHA256]::Create()
     try {
-        $stream = [IO.File]::OpenRead([IO.Path]::GetFullPath($Path))
+        $stream = [IO.File]::OpenRead($full)
         try {
             return [BitConverter]::ToString($sha.ComputeHash($stream)).Replace('-', '').ToLowerInvariant()
         } finally {
@@ -307,6 +595,24 @@ function Get-CcodGitHubDraftFileSha256 {
     }
 }
 
+function Remove-CcodGitHubDraftDirectoryIfPresent {
+    param([Parameter(Mandatory)][string]$Path,[string]$ErrorId='CCOD_GITHUB_DRAFT_EVIDENCE_CLEANUP_FAILED')
+    if ([string]::IsNullOrWhiteSpace($Path)) { return }
+    try {
+        $item = $null
+        try { $item = Get-Item -LiteralPath $Path -Force -ErrorAction Stop } catch { if (-not (Test-CcodGitHubDraftMissingError $_)) { throw } }
+        if ($null -eq $item) { return }
+        if ($item -isnot [IO.DirectoryInfo] -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'directory cleanup target' }
+        Remove-Item -LiteralPath $Path -Recurse -Force -ErrorAction Stop
+        $residual = $null
+        try { $residual = Get-Item -LiteralPath $Path -Force -ErrorAction Stop } catch { if (-not (Test-CcodGitHubDraftMissingError $_)) { throw } }
+        if ($null -ne $residual) { throw 'directory cleanup residue' }
+    } catch {
+        if ($_.FullyQualifiedErrorId -like 'CCOD_GITHUB_DRAFT_*') { throw }
+        Throw-CcodGitHubDraftError $ErrorId 'Draft temporary directory cleanup could not be proven.' $Path
+    }
+}
+
 function New-CcodGitHubDraftFrozenAssetSet {
     param([Parameter(Mandatory)][string]$AssetDirectory,[Parameter(Mandatory)][string]$Version,[Parameter(Mandatory)]$Contract)
     $frozenDirectory = Join-Path ([IO.Path]::GetTempPath()) ('ccod-draft-frozen-' + [guid]::NewGuid().ToString('N'))
@@ -317,7 +623,7 @@ function New-CcodGitHubDraftFrozenAssetSet {
         if ($contractAssets.Count -ne $expected.Count) { throw 'candidate contract asset count' }
         for ($index = 0; $index -lt $expected.Count; $index++) {
             $name = $expected[$index]
-            if ($contractAssets[$index].name -isnot [string] -or [string]$contractAssets[$index].name -cne $name -or $contractAssets[$index].sha256 -isnot [string] -or [string]$contractAssets[$index].sha256 -cnotmatch '^[0-9a-f]{64}$') { throw 'candidate contract asset identity' }
+            if ($contractAssets[$index].name -isnot [string] -or [string]$contractAssets[$index].name -cne $name -or $contractAssets[$index].sha256 -isnot [string] -or [string]$contractAssets[$index].sha256 -cnotmatch '^[0-9a-f]{64}\z') { throw 'candidate contract asset identity' }
             $source = Join-Path $AssetDirectory $name
             $destination = Join-Path $frozenDirectory $name
             [IO.File]::Copy($source, $destination, $false)
@@ -325,15 +631,15 @@ function New-CcodGitHubDraftFrozenAssetSet {
         }
         return [pscustomobject][ordered]@{ Directory = $frozenDirectory; Names = [string[]]$expected; GitCommit = [string]$Contract.GitCommit }
     } catch {
-        if ([IO.Directory]::Exists($frozenDirectory)) { Remove-Item -LiteralPath $frozenDirectory -Recurse -Force -ErrorAction SilentlyContinue }
+        Remove-CcodGitHubDraftDirectoryIfPresent -Path $frozenDirectory
         Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ASSET_FREEZE_FAILED' 'The release candidate changed or could not be frozen.' $AssetDirectory
     }
 }
 
 function Remove-CcodGitHubDraftFrozenAssetSet {
     param($Frozen)
-    if ($null -ne $Frozen -and [string]::IsNullOrWhiteSpace([string]$Frozen.Directory) -eq $false -and [IO.Directory]::Exists([string]$Frozen.Directory)) {
-        Remove-Item -LiteralPath ([string]$Frozen.Directory) -Recurse -Force -ErrorAction SilentlyContinue
+    if ($null -ne $Frozen -and -not [string]::IsNullOrWhiteSpace([string]$Frozen.Directory)) {
+        Remove-CcodGitHubDraftDirectoryIfPresent -Path ([string]$Frozen.Directory)
     }
 }
 
@@ -360,14 +666,13 @@ function Get-CcodGitHubDraftVerificationName([string]$Version) {
 }
 
 function Get-CcodGitHubDraftDefenderEvidenceDirectory([string]$EvidenceDirectory) {
-    $dedicated = Join-Path $EvidenceDirectory 'defender'
-    if ([IO.File]::Exists($dedicated)) {
-        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'The Defender evidence plane is not a directory.' $dedicated
-    }
-    if ([IO.Directory]::Exists($dedicated)) {
-        return Assert-CcodGitHubDraftPlainPath -Path $dedicated -Directory $true
+    $root = Assert-CcodGitHubDraftPlainPath -Path $EvidenceDirectory -Directory $true
+    $dedicated = Join-Path $root 'defender'
+    try { $item = Get-Item -LiteralPath $dedicated -Force -ErrorAction Stop } catch { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'The dedicated Defender evidence plane is missing or unavailable.' $dedicated }
+    if ($item -isnot [IO.DirectoryInfo] -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'The dedicated Defender evidence plane is not a plain directory.' $dedicated
     }
-    return Assert-CcodGitHubDraftPlainPath -Path $EvidenceDirectory -Directory $true
+    return Assert-CcodGitHubDraftPlainPath -Path $dedicated -Directory $true
 }
 
 function Assert-CcodGitHubDraftPlainPath {
@@ -384,10 +689,12 @@ function Get-CcodGitHubDraftEvidencePlanePath {
     param([Parameter(Mandatory)][string]$EvidenceDirectory,[Parameter(Mandatory)][ValidateSet('verification','acceptance')][string]$Plane,[switch]$Create)
     $root = Assert-CcodGitHubDraftPlainPath -Path $EvidenceDirectory -Directory $true
     $path = Join-Path $root $Plane
-    if ([IO.File]::Exists($path)) {
-        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'Draft evidence plane is a file, not a directory.' $path
+    $item = $null
+    try { $item = Get-Item -LiteralPath $path -Force -ErrorAction Stop } catch { if (-not (Test-CcodGitHubDraftMissingError $_)) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'Draft evidence plane could not be inspected safely.' $path } }
+    if ($null -ne $item -and ($item -isnot [IO.DirectoryInfo] -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'Draft evidence plane is not a plain directory.' $path
     }
-    if (-not [IO.Directory]::Exists($path)) {
+    if ($null -eq $item) {
         if (-not $Create) { return $path }
         try { [IO.Directory]::CreateDirectory($path) | Out-Null } catch { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'Draft evidence plane could not be created safely.' $path }
     }
@@ -398,10 +705,12 @@ function Get-CcodGitHubDraftEvidenceFilePath {
     param([Parameter(Mandatory)][string]$EvidenceDirectory,[Parameter(Mandatory)][ValidateSet('verification','acceptance')][string]$Plane,[Parameter(Mandatory)][string]$Leaf,[switch]$CreatePlane)
     $planePath = Get-CcodGitHubDraftEvidencePlanePath -EvidenceDirectory $EvidenceDirectory -Plane $Plane -Create:$CreatePlane
     $path = Join-Path $planePath $Leaf
-    if ([IO.Directory]::Exists($path)) {
-        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'Draft evidence target is a directory, not a file.' $path
+    $item = $null
+    try { $item = Get-Item -LiteralPath $path -Force -ErrorAction Stop } catch { if (-not (Test-CcodGitHubDraftMissingError $_)) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'Draft evidence target could not be inspected safely.' $path } }
+    if ($null -ne $item) {
+        if ($item -isnot [IO.FileInfo] -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'Draft evidence target is not a plain file.' $path }
+        return Assert-CcodGitHubDraftPlainPath -Path $path -Directory $false
     }
-    if ([IO.File]::Exists($path)) { return Assert-CcodGitHubDraftPlainPath -Path $path -Directory $false }
     if ([IO.Path]::GetFullPath($path) -cne $path) {
         Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'Draft evidence target is not canonical.' $path
     }
@@ -411,10 +720,12 @@ function Get-CcodGitHubDraftEvidenceFilePath {
 function Get-CcodGitHubDraftRootEvidenceFilePath([string]$EvidenceDirectory,[string]$Leaf) {
     $root = Assert-CcodGitHubDraftPlainPath -Path $EvidenceDirectory -Directory $true
     $path = Join-Path $root $Leaf
-    if ([IO.Directory]::Exists($path)) {
-        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'Draft evidence target is a directory, not a file.' $path
+    $item = $null
+    try { $item = Get-Item -LiteralPath $path -Force -ErrorAction Stop } catch { if (-not (Test-CcodGitHubDraftMissingError $_)) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'Draft evidence target could not be inspected safely.' $path } }
+    if ($null -ne $item) {
+        if ($item -isnot [IO.FileInfo] -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'Draft evidence target is not a plain file.' $path }
+        return Assert-CcodGitHubDraftPlainPath -Path $path -Directory $false
     }
-    if ([IO.File]::Exists($path)) { return Assert-CcodGitHubDraftPlainPath -Path $path -Directory $false }
     return $path
 }
 
@@ -426,47 +737,151 @@ function Get-CcodGitHubDraftAcceptancePath([string]$EvidenceDirectory,[string]$V
     Get-CcodGitHubDraftEvidenceFilePath -EvidenceDirectory $EvidenceDirectory -Plane acceptance -Leaf (Get-CcodGitHubDraftAcceptanceName $Version)
 }
 
+function Get-CcodGitHubDraftManualArtifactPaths {
+    param([Parameter(Mandatory)][string]$EvidenceDirectory,[Parameter(Mandatory)][string]$Operation)
+    $artifactRoot = Assert-CcodGitHubDraftPlainPath -Path (Join-Path ([IO.Path]::GetFullPath($EvidenceDirectory)) 'official-draft-artifacts') -Directory $true
+    $operationDirectory = Assert-CcodGitHubDraftPlainPath -Path (Join-Path $artifactRoot $Operation) -Directory $true
+    return [pscustomobject][ordered]@{
+        Screenshot = Assert-CcodGitHubDraftPlainPath -Path (Join-Path $operationDirectory 'screenshot.bin') -Directory $false
+        RedactedLog = Assert-CcodGitHubDraftPlainPath -Path (Join-Path $operationDirectory 'redacted.log') -Directory $false
+    }
+}
+
+function Test-CcodGitHubDraftManualProof {
+    param([Parameter(Mandatory)]$Proof,[Parameter(Mandatory)][int]$Index,[Parameter(Mandatory)][string]$Version)
+    try {
+        if ($Index -lt 4) {
+            $commandSets = @(
+                ,@('ShowAbout')
+                ,@('SetLanguageSystem','SetLanguageChinese','SetLanguageEnglish')
+                ,@('OpenLogs')
+                ,@('CheckAndRepair')
+            )
+            $commands = $commandSets[$Index]
+            if (-not (Test-CcodGitHubDraftExactProperties -Value $Proof -Expected @('timestampUtc','command','revision','code','status')) -or
+                $Proof.timestampUtc -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$Proof.timestampUtc) -or
+                $Proof.command -isnot [string] -or $commands -cnotcontains [string]$Proof.command -or
+                -not (Test-CcodGitHubDraftPositiveInteger $Proof.revision) -or
+                $Proof.code -isnot [string] -or $Proof.code -cne 'CCOD_TRAY_ACTION_COMPLETED' -or
+                $Proof.status -isnot [string] -or $Proof.status -cne 'Completed') { return $false }
+            if (-not (Test-CcodGitHubDraftCanonicalUtc $Proof.timestampUtc)) { return $false }
+            return $true
+        }
+        $expected = @('schemaVersion','timestampUtc','kind','operation','deviceRole','challenge','candidateVersion','runtimeId','runtimeGeneration','runtimeManifestSha256','attestation','connection','control','outcome','code')
+        if (-not (Test-CcodGitHubDraftExactProperties -Value $Proof -Expected $expected) -or
+            -not (Test-CcodGitHubDraftPositiveInteger $Proof.schemaVersion) -or [uint64]$Proof.schemaVersion -ne 1 -or
+            $Proof.timestampUtc -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$Proof.timestampUtc) -or
+            $Proof.kind -isnot [string] -or $Proof.kind -cne 'remote-control-manual-proof' -or
+            $Proof.operation -isnot [string] -or $Proof.operation -cne 'SecondDeviceControl' -or
+            $Proof.deviceRole -isnot [string] -or $Proof.deviceRole -cne 'SecondDevice' -or
+            $Proof.challenge -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$Proof.challenge) -or
+            $Proof.candidateVersion -isnot [string] -or $Proof.candidateVersion -cne $Version -or
+            $Proof.runtimeId -isnot [string] -or $Proof.runtimeId -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\z' -or
+            -not (Test-CcodGitHubDraftPositiveInteger $Proof.runtimeGeneration) -or
+            $Proof.runtimeManifestSha256 -isnot [string] -or $Proof.runtimeManifestSha256 -cnotmatch '^[0-9a-f]{64}\z' -or
+            $Proof.attestation -isnot [string] -or $Proof.attestation -cne 'HumanReviewedStructuredAttestation' -or
+            $Proof.connection -isnot [string] -or $Proof.connection -cne 'Connected' -or
+            $Proof.control -isnot [string] -or $Proof.control -cne 'Completed' -or
+            $Proof.outcome -isnot [string] -or $Proof.outcome -cne 'Completed' -or
+            $Proof.code -isnot [string] -or $Proof.code -cne 'CCOD_REMOTE_ACTION_COMPLETED') { return $false }
+        if (-not (Test-CcodGitHubDraftCanonicalUtc $Proof.timestampUtc)) { return $false }
+        return $true
+    } catch { return $false }
+}
+
+function Assert-CcodGitHubDraftManualEvidenceArtifacts {
+    param([Parameter(Mandatory)][string]$EvidenceDirectory,[Parameter(Mandatory)]$ManualEvidence)
+    try {
+        $expectedOperations = @('About','Language','OpenLogs','Repair','SecondDeviceControl')
+        $entries = @($ManualEvidence)
+        if ($entries.Count -ne $expectedOperations.Count) { throw 'manual artifact count' }
+        for ($index = 0; $index -lt $expectedOperations.Count; $index++) {
+            $entry = $entries[$index]
+            if ($null -eq $entry -or $entry.operation -isnot [string] -or $entry.operation -cne $expectedOperations[$index]) { throw 'manual artifact operation' }
+            $paths = Get-CcodGitHubDraftManualArtifactPaths -EvidenceDirectory $EvidenceDirectory -Operation ([string]$entry.operation)
+            if ((Get-CcodGitHubDraftFileSha256 $paths.Screenshot) -cne [string]$entry.screenshotSha256 -or
+                (Get-CcodGitHubDraftFileSha256 $paths.RedactedLog) -cne [string]$entry.redactedLogSha256) { throw 'manual artifact hash' }
+        }
+        return $true
+    } catch {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID' 'Manual acceptance hashes are not backed by the expected evidence artifacts.' $EvidenceDirectory
+    }
+}
+
 function Write-CcodGitHubDraftJsonCreateOnly {
-    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)]$Record,[Parameter(Mandatory)][string]$ErrorId)
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)]$Record,[Parameter(Mandatory)][string]$ErrorId,[scriptblock]$ReadbackVerifier)
+    if ($null -eq $script:CcodDraftReleaseAssetContractModule) { Import-CcodDraftReleaseAssetContract }
     $Path = [IO.Path]::GetFullPath($Path)
-    $directory = [IO.Path]::GetDirectoryName($Path)
-    [void](Assert-CcodGitHubDraftPlainPath -Path $directory -Directory $true)
-    if ([IO.Directory]::Exists($Path)) { Throw-CcodGitHubDraftError $ErrorId 'Draft evidence target is a directory, not a file.' $Path }
-    if ([IO.File]::Exists($Path)) { [void](Assert-CcodGitHubDraftPlainPath -Path $Path -Directory $false) }
-    $json = (($Record | ConvertTo-Json -Depth 12) + [Environment]::NewLine)
+    $directoryPath = [IO.Path]::GetDirectoryName($Path)
+    $leaf = [IO.Path]::GetFileName($Path)
+    $directory = $null
+    $published = $null
     $encoding = [Text.UTF8Encoding]::new($false)
-    $bytes = $encoding.GetBytes($json)
-    $stream = $null
+    $bytes = $encoding.GetBytes((($Record | ConvertTo-Json -Depth 12) + [Environment]::NewLine))
+    $sha = [Security.Cryptography.SHA256]::Create()
+    try { $expectedHash = ([BitConverter]::ToString($sha.ComputeHash($bytes))).Replace('-', '').ToLowerInvariant() } finally { $sha.Dispose() }
     try {
-        $stream = [IO.File]::Open($Path, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::None)
-        $stream.Write($bytes, 0, $bytes.Length)
-        $stream.Flush($true)
+        $directory = & $script:CcodDraftReleaseAssetContractModule { param($Path,$Id) Open-CcodReleaseDirectoryAuthority -Path $Path -ErrorId $Id -AllowChildMutation } $directoryPath $ErrorId
+        $published = & $script:CcodDraftReleaseAssetContractModule { param($Directory,$Leaf,$Bytes,$Id) Publish-CcodReleaseReceiptAuthority -Directory $Directory -Leaf $Leaf -Bytes $Bytes -ErrorId $Id } $directory $leaf $bytes $ErrorId
+        if ($null -ne $ReadbackVerifier -and -not [bool](& $ReadbackVerifier $published.Path)) { throw 'draft evidence readback' }
+        $pinned = & $script:CcodDraftReleaseAssetContractModule {
+            param($Authority,$Id,$ExpectedHash,$ExpectedBytes)
+            Assert-CcodReleaseAuthorityCurrent -Authority $Authority -ErrorId $Id -CheckBytes | Out-Null
+            $read = Read-CcodReleaseContractPinnedJson -Authority $Authority -ErrorId $Id -MaximumBytes 65536
+            if ([Convert]::ToBase64String([byte[]]$read.Bytes) -cne [Convert]::ToBase64String([byte[]]$ExpectedBytes) -or $Authority.Sha256 -cne $ExpectedHash) { throw 'draft evidence readback' }
+            return $read
+        } $published $ErrorId $expectedHash $bytes
+        if ($null -eq $pinned.Value) { throw 'draft evidence readback' }
+        return $published.Path
     } catch {
-        Throw-CcodGitHubDraftError $ErrorId 'Draft evidence is not create-only or could not be published.' $Path
+        $failure = $_
+        if ($null -ne $published) {
+            try {
+                & $script:CcodDraftReleaseAssetContractModule {
+                    param($Authority,$Directory,$Leaf,$Id)
+                    $members = [string[]]([CcodReleaseFileAuthorityV1]::EnumerateDirectory($Directory.Handle))
+                    if ([Array]::IndexOf($members, $Leaf) -ge 0) {
+                        Assert-CcodReleaseAuthorityCurrent -Authority $Authority -ErrorId $Id | Out-Null
+                        if ([CcodReleaseFileAuthorityV1]::Delete($Authority.Stream.SafeFileHandle) -ne 0) { throw 'draft evidence delete' }
+                        # NTFS keeps the delete-pending name until our last file handle closes.
+                        Close-CcodReleaseAuthority $Authority
+                        $remaining = [string[]]([CcodReleaseFileAuthorityV1]::EnumerateDirectory($Directory.Handle))
+                        if ([Array]::IndexOf($remaining, $Leaf) -ge 0) { throw 'draft evidence cleanup residue' }
+                    }
+                } $published $directory $leaf $ErrorId
+            } catch {
+                Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_CLEANUP_FAILED' 'Draft evidence cleanup could not prove the published target was removed.' $Path
+            }
+        }
+        if ($failure.FullyQualifiedErrorId -like 'CCOD_GITHUB_*') { throw $failure }
+        Throw-CcodGitHubDraftError $ErrorId 'Draft evidence is not create-only or could not be published and read back safely.' $Path
     } finally {
-        if ($null -ne $stream) { $stream.Dispose() }
+        if ($null -ne $published) { & $script:CcodDraftReleaseAssetContractModule { param($Value) Close-CcodReleaseAuthority $Value } $published }
+        if ($null -ne $directory) { & $script:CcodDraftReleaseAssetContractModule { param($Value) Close-CcodReleaseAuthority $Value } $directory }
     }
-    if (-not [IO.File]::Exists($Path)) { Throw-CcodGitHubDraftError $ErrorId 'Draft evidence write did not produce a file.' $Path }
 }
 
 function Read-CcodGitHubDraftVerification {
     param([Parameter(Mandatory)][string]$EvidenceDirectory,[Parameter(Mandatory)][string]$AssetDirectory,[Parameter(Mandatory)][string]$Tag,[Parameter(Mandatory)][string]$Version,[Parameter(Mandatory)][string]$GitCommit)
     $path = Get-CcodGitHubDraftVerificationPath $EvidenceDirectory $Version
-    if (-not [IO.File]::Exists($path)) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_MISSING' 'Promote requires a persisted successful Verify record.' $path }
+    $receiptItem = $null
+    try { $receiptItem = Get-Item -LiteralPath $path -Force -ErrorAction Stop } catch { if (Test-CcodGitHubDraftMissingError $_) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_MISSING' 'Promote requires a persisted successful Verify record.' $path } Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID' 'Persisted Verify evidence could not be inspected safely.' $path }
+    if ($receiptItem -isnot [IO.FileInfo] -or ($receiptItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID' 'Persisted Verify evidence is not a plain file.' $path }
     $record = (Read-CcodGitHubDraftContractJson -Path $path -ErrorId 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID').Value
     $expected = @(Get-CcodExpectedReleaseAssetNames -Version $Version)
     $fields = @($record.PSObject.Properties.Name)
     $hashes = @($record.assetSha256)
     $names = @($record.assetNames)
     $localManifest = Join-Path $AssetDirectory (Get-CcodGitHubDraftManifestName $Version)
-    if ($record -isnot [pscustomobject] -or ($fields -join ',') -cne 'schemaVersion,kind,tag,version,gitCommit,draft,verified,assetNames,assetSha256,candidateManifestSha256' -or
+    if ($record -isnot [pscustomobject] -or ($fields -join ',') -cne 'schemaVersion,kind,tag,draftId,version,gitCommit,draft,verified,assetNames,assetSha256,candidateManifestSha256' -or
         -not (Test-CcodGitHubDraftSchemaVersion $record.schemaVersion) -or
         $record.kind -isnot [string] -or $record.kind -cne 'github-draft-verification' -or $record.tag -isnot [string] -or $record.tag -cne $Tag -or
+        $record.draftId -isnot [string] -or $record.draftId -notmatch '^[1-9][0-9]*\z' -or
         $record.version -isnot [string] -or $record.version -cne $Version -or $record.gitCommit -isnot [string] -or $record.gitCommit -cne $GitCommit -or
         $record.draft -isnot [bool] -or -not [bool]$record.draft -or
         $record.verified -isnot [bool] -or -not [bool]$record.verified -or
         $names.Count -ne $expected.Count -or (@($names | Where-Object { $_ -isnot [string] }).Count -ne 0) -or (($names | ForEach-Object { [string]$_ }) -join "`n") -cne ($expected -join "`n") -or
-        $hashes.Count -ne $expected.Count -or (@($hashes | Where-Object { $_ -isnot [string] -or $_ -cnotmatch '^[0-9a-f]{64}$' }).Count -ne 0) -or
+        $hashes.Count -ne $expected.Count -or (@($hashes | Where-Object { $_ -isnot [string] -or $_ -cnotmatch '^[0-9a-f]{64}\z' }).Count -ne 0) -or
         $record.candidateManifestSha256 -isnot [string] -or $record.candidateManifestSha256 -cne (Get-CcodGitHubDraftFileSha256 $localManifest)) {
         Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID' 'Persisted Verify evidence is not bound to the exact candidate.' $path
     }
@@ -483,27 +898,213 @@ function Get-CcodGitHubDraftManifestName([string]$Version) {
 }
 
 function Read-CcodGitHubDraftAcceptance {
-    param([Parameter(Mandatory)][string]$EvidenceDirectory,[Parameter(Mandatory)][string]$AssetDirectory,[Parameter(Mandatory)][string]$Version,[Parameter(Mandatory)][string]$GitCommit)
+    param([Parameter(Mandatory)][string]$EvidenceDirectory,[Parameter(Mandatory)][string]$AssetDirectory,[Parameter(Mandatory)][string]$Tag,[Parameter(Mandatory)][string]$Version,[Parameter(Mandatory)][string]$GitCommit)
     $path = Get-CcodGitHubDraftAcceptancePath $EvidenceDirectory $Version
-    if (-not [IO.File]::Exists($path)) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_MISSING' 'Promotion requires Task 8/9 official-draft acceptance evidence.' $path }
+    $acceptanceItem = $null
+    try { $acceptanceItem = Get-Item -LiteralPath $path -Force -ErrorAction Stop } catch { if (Test-CcodGitHubDraftMissingError $_) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_MISSING' 'Promotion requires Task 8/9 official-draft acceptance evidence.' $path } Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID' 'Official-draft acceptance evidence could not be inspected safely.' $path }
+    if ($acceptanceItem -isnot [IO.FileInfo] -or ($acceptanceItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID' 'Official-draft acceptance evidence is not a plain file.' $path }
     $record = (Read-CcodGitHubDraftContractJson -Path $path -ErrorId 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID').Value
     $fields = @($record.PSObject.Properties.Name)
+    $baseFields = @('schemaVersion','kind','version','gitCommit','candidateManifestSha256','phase','completedAtUtc')
+    if ($record -is [pscustomobject] -and ($fields -join ',') -ceq ($baseFields -join ',')) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INCOMPLETE' 'Promotion requires all four tray records and the distinct second-device record.' $path
+    }
     $manifestPath = Join-Path $AssetDirectory (Get-CcodGitHubDraftManifestName $Version)
     $canonicalCompletedAtUtc = $null
     try {
         $parsedCompletedAtUtc = [DateTimeOffset]::ParseExact([string]$record.completedAtUtc, "yyyy-MM-dd'T'HH:mm:ss.fffffff'Z'", [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AssumeUniversal)
         $canonicalCompletedAtUtc = $parsedCompletedAtUtc.ToUniversalTime().ToString("yyyy-MM-dd'T'HH:mm:ss.fffffff'Z'", [Globalization.CultureInfo]::InvariantCulture)
     } catch { }
-    if ($record -isnot [pscustomobject] -or ($fields -join ',') -cne 'schemaVersion,kind,version,gitCommit,candidateManifestSha256,phase,completedAtUtc' -or
+    if ($record -isnot [pscustomobject] -or ($fields -join ',') -cne 'schemaVersion,kind,version,gitCommit,draft,candidateManifestSha256,phase,completedAtUtc,automatedReceiptSha256,manualEvidence' -or
         -not (Test-CcodGitHubDraftSchemaVersion $record.schemaVersion) -or $record.kind -isnot [string] -or $record.kind -cne 'official-draft-acceptance' -or
-        $record.version -isnot [string] -or $record.version -cne $Version -or $record.gitCommit -isnot [string] -or $record.gitCommit -cne $GitCommit -or $record.gitCommit -cnotmatch '^[0-9a-f]{40}$' -or
-        $record.candidateManifestSha256 -isnot [string] -or $record.candidateManifestSha256 -cnotmatch '^[0-9a-f]{64}$' -or $record.candidateManifestSha256 -cne (Get-CcodGitHubDraftFileSha256 $manifestPath) -or
+        $record.version -isnot [string] -or $record.version -cne $Version -or $record.gitCommit -isnot [string] -or $record.gitCommit -cne $GitCommit -or $record.gitCommit -cnotmatch '^[0-9a-f]{40}\z' -or
+        $record.draft -isnot [pscustomobject] -or (@($record.draft.PSObject.Properties.Name) -join ',') -cne 'tag,id' -or
+        $record.draft.tag -isnot [string] -or $record.draft.tag -cne $Tag -or $record.draft.id -isnot [string] -or $record.draft.id -notmatch '^[1-9][0-9]*\z' -or
+        $record.candidateManifestSha256 -isnot [string] -or $record.candidateManifestSha256 -cnotmatch '^[0-9a-f]{64}\z' -or $record.candidateManifestSha256 -cne (Get-CcodGitHubDraftFileSha256 $manifestPath) -or
         $record.phase -isnot [string] -or $record.phase -cne 'Complete' -or $record.completedAtUtc -isnot [string] -or [string]$record.completedAtUtc -cne $canonicalCompletedAtUtc) {
         Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID' 'Official-draft acceptance evidence is malformed or not bound to this candidate.' $path
     }
+    $stateDirectory = Join-Path $EvidenceDirectory 'official-draft-acceptance'
+    try {
+        $toolRoot = if (-not [string]::IsNullOrWhiteSpace($PSScriptRoot)) { [IO.Path]::GetFullPath($PSScriptRoot) } else { [string]$script:CcodGitHubDraftModuleRoot }
+        if ([string]::IsNullOrWhiteSpace($toolRoot)) { throw 'acceptance module root unavailable' }
+        $acceptanceModulePath = Join-Path (Split-Path $toolRoot -Parent) 'tests\installed\OfficialDraftAcceptance.psm1'
+        $acceptanceLease = Open-CcodTrustedImportLease -Path $acceptanceModulePath -ErrorId 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID'
+        try {
+            $acceptanceModulePath = Assert-CcodGitHubDraftTrustedModulePath -Path $acceptanceModulePath -Directory $false
+            $acceptanceLease.Revalidate()
+            $acceptanceModule = Import-Module $acceptanceModulePath -Force -PassThru -DisableNameChecking -ErrorAction Stop
+            $acceptanceLease.Revalidate()
+        } finally { $acceptanceLease.Dispose() }
+        $state = & $acceptanceModule {
+            param($Directory)
+            $value = Read-CcodOfficialDraftState -StateDirectory $Directory
+            [void](Assert-CcodOfficialDraftAutomatedReceiptChain -Records $value -StateDirectory $Directory)
+            if (-not $value.ContainsKey('Complete')) { throw 'complete state missing' }
+            return $value
+        } $stateDirectory
+        $completeCandidate = $state.Complete.candidate
+        Import-CcodDraftReleaseAssetContract
+        $currentContract = Test-CcodExactReleaseAssetSet -AssetDirectory $AssetDirectory -Version $Version
+        if ($currentContract.Valid -isnot [bool] -or -not [bool]$currentContract.Valid -or $currentContract.GitCommit -isnot [string] -or $currentContract.GitCommit -cne $GitCommit) { throw 'current candidate contract' }
+        $currentAssets = @($currentContract.Assets)
+        $completeAssets = @($completeCandidate.assetHashes)
+        if ($currentAssets.Count -ne 11 -or $completeAssets.Count -ne $currentAssets.Count) { throw 'complete candidate asset count' }
+        for ($assetIndex = 0; $assetIndex -lt $currentAssets.Count; $assetIndex++) {
+            if ($completeAssets[$assetIndex].name -isnot [string] -or $completeAssets[$assetIndex].name -cne [string]$currentAssets[$assetIndex].name -or
+                $completeAssets[$assetIndex].sha256 -isnot [string] -or $completeAssets[$assetIndex].sha256 -cne [string]$currentAssets[$assetIndex].sha256) { throw 'complete candidate asset binding' }
+        }
+        if ([string]$completeCandidate.version -cne [string]$record.version -or
+            [string]$completeCandidate.gitCommit -cne [string]$record.gitCommit -or
+            [string]$completeCandidate.manifestHashes.portable -cne [string]$record.candidateManifestSha256 -or
+            [string]$state.Complete.draft.tag -cne [string]$record.draft.tag -or
+            [string]$state.Complete.draft.id -cne [string]$record.draft.id) { throw 'complete candidate binding' }
+        $expectedStatePhases = @('Preflight','LegacyUpgrade','Uninstall','FreshInstall','PreReboot','PostReboot','ReadyForManualEvidence','Complete')
+        $stateHashes = @($record.automatedReceiptSha256)
+        if ($stateHashes.Count -ne $expectedStatePhases.Count) { throw 'automated receipt hash count' }
+        for ($index = 0; $index -lt $expectedStatePhases.Count; $index++) {
+            $entry = $stateHashes[$index]
+            if ($entry -isnot [pscustomobject] -or (@($entry.PSObject.Properties.Name) -join ',') -cne 'phase,sha256' -or
+                $entry.phase -isnot [string] -or $entry.phase -cne $expectedStatePhases[$index] -or
+                $entry.sha256 -isnot [string] -or $entry.sha256 -cnotmatch '^[0-9a-f]{64}\z') { throw 'automated receipt hash shape' }
+            $leaf = if ($entry.phase -ceq 'Complete') { '08-Complete.json' } else { '{0}-{1}.json' -f ('{0:d2}' -f ($index + 1)), $entry.phase }
+            $statePath = Join-Path $stateDirectory $leaf
+            if ((Get-CcodGitHubDraftFileSha256 $statePath) -cne [string]$entry.sha256) { throw 'automated receipt hash binding' }
+        }
+    } catch {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID' 'Promotion requires the complete, candidate-bound automated official-draft receipt chain.' $stateDirectory
+    }
+    $expectedOperations = @('About','Language','OpenLogs','Repair','SecondDeviceControl')
+    $expectedStates = @('AboutVisible','LanguageChanged','LogsOpened','RepairCompleted','SecondDeviceControlled')
+    $expectedResults = @('CCOD_TRAYABOUT_COMPLETED','CCOD_TRAYLANGUAGE_COMPLETED','CCOD_TRAYOPENLOGS_COMPLETED','CCOD_TRAYREPAIR_COMPLETED','CCOD_SECONDDEVICE_COMPLETED')
+    $manual = @($record.manualEvidence)
+    if ($manual.Count -ne $expectedOperations.Count) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INCOMPLETE' 'Promotion requires all four tray records and the distinct second-device record.' $path
+    }
+    $seenHashes = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    for ($index = 0; $index -lt $expectedOperations.Count; $index++) {
+        $entry = $manual[$index]
+        if ($entry -isnot [pscustomobject] -or (@($entry.PSObject.Properties.Name) -join ',') -cne 'schemaVersion,kind,phase,operation,terminalState,result,proof,reviewState,version,gitCommit,candidateManifestSha256,screenshotSha256,redactedLogSha256' -or
+            -not (Test-CcodGitHubDraftSchemaVersion $entry.schemaVersion) -or $entry.schemaVersion -ne 1 -or $entry.kind -isnot [string] -or $entry.kind -cne 'manual-evidence' -or
+            $entry.phase -isnot [string] -or $entry.operation -isnot [string] -or $entry.operation -cne $expectedOperations[$index] -or
+            $entry.terminalState -isnot [string] -or $entry.terminalState -cne $expectedStates[$index] -or
+            $entry.result -isnot [string] -or $entry.result -cne $expectedResults[$index] -or $entry.reviewState -isnot [string] -or $entry.reviewState -cne 'Reviewed' -or
+            $entry.version -isnot [string] -or $entry.version -cne $Version -or $entry.gitCommit -isnot [string] -or $entry.gitCommit -cne $GitCommit -or
+            $entry.candidateManifestSha256 -isnot [string] -or $entry.candidateManifestSha256 -cne $record.candidateManifestSha256 -or
+            $entry.screenshotSha256 -isnot [string] -or $entry.screenshotSha256 -cnotmatch '^[0-9a-f]{64}\z' -or
+            $entry.redactedLogSha256 -isnot [string] -or $entry.redactedLogSha256 -cnotmatch '^[0-9a-f]{64}\z' -or
+            $entry.screenshotSha256 -ceq $entry.redactedLogSha256 -or
+            -not (Test-CcodGitHubDraftManualProof -Proof $entry.proof -Index $index -Version $Version) -or
+            -not $seenHashes.Add([string]$entry.screenshotSha256) -or -not $seenHashes.Add([string]$entry.redactedLogSha256)) {
+            Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID' 'Manual acceptance evidence is malformed, duplicated, or not bound to this candidate.' $path
+        }
+        if (($index -lt 4 -and $entry.phase -cne 'TrayEvidence') -or ($index -eq 4 -and $entry.phase -cne 'RemoteEvidence')) {
+            Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID' 'Manual acceptance evidence has the wrong phase for its operation.' $path
+        }
+    }
+    $stateCompleteManual = @($state.Complete.facts.manualEvidence)
+    $stateFileManual = @()
+    foreach ($operation in $expectedOperations) {
+        if (-not $state.ManualEvidence.ContainsKey($operation)) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID' 'Persisted manual acceptance state is incomplete.' $stateDirectory }
+        $stateFileManual += $state.ManualEvidence[$operation]
+    }
+    if ($stateCompleteManual.Count -ne $manual.Count -or $stateFileManual.Count -ne $manual.Count) {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID' 'Acceptance manual evidence is not bound to persisted manual state.' $path
+    }
+    $manualCompareFields = @('schemaVersion','kind','phase','operation','terminalState','result','proof','reviewState','version','gitCommit','candidateManifestSha256','screenshotSha256','redactedLogSha256')
+    for ($index = 0; $index -lt $manual.Count; $index++) {
+        foreach ($source in @($stateCompleteManual[$index],$stateFileManual[$index])) {
+            foreach ($field in $manualCompareFields) {
+                $leftProperty = @($manual[$index].PSObject.Properties | Where-Object { $_.Name -ceq $field })
+                $rightProperty = @($source.PSObject.Properties | Where-Object { $_.Name -ceq $field })
+                if ($leftProperty.Count -ne 1 -or $rightProperty.Count -ne 1) {
+                    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID' 'Acceptance manual evidence is not bound to persisted manual state.' $path
+                }
+                $leftValue = [string]$leftProperty[0].Value
+                $rightValue = [string]$rightProperty[0].Value
+                if ($field -ceq 'proof') {
+                    $leftValue = $leftProperty[0].Value | ConvertTo-Json -Depth 12 -Compress
+                    $rightValue = $rightProperty[0].Value | ConvertTo-Json -Depth 12 -Compress
+                }
+                if ($leftValue -cne $rightValue) {
+                    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID' 'Acceptance manual evidence is not bound to persisted manual state.' $path
+                }
+            }
+        }
+    }
+    [void](Assert-CcodGitHubDraftManualEvidenceArtifacts -EvidenceDirectory $EvidenceDirectory -ManualEvidence $manual)
     return $record
 }
 
+function Invoke-CcodGitHubDraftBoundPrivateRecovery {
+    param([Parameter(Mandatory)]$Adapters,[Parameter(Mandatory)][string]$Tag,[Parameter(Mandatory)]$DraftId)
+    if ($DraftId -isnot [string] -or $DraftId -notmatch '^[1-9][0-9]*\z') { throw 'bound recovery ID' }
+    # Hide only the previously authenticated release. Content/tag failures must not block containment.
+    for ($observation = 0; $observation -lt 2; $observation++) {
+        $view = & $Adapters.ViewRelease $Tag
+        if ($view -isnot [pscustomobject] -or (@($view.PSObject.Properties.Name) -join ',') -cne 'Tag,Id,Draft,AssetNames' -or
+            $view.Tag -isnot [string] -or $view.Tag -cne $Tag -or $view.Id -isnot [string] -or $view.Id -cne $DraftId -or
+            $view.Draft -isnot [bool]) { throw 'bound recovery identity' }
+        if ($observation -eq 0) {
+            if (-not $view.Draft) { & $Adapters.SetReleaseDraftState $Tag $true $DraftId | Out-Null }
+        } elseif (-not $view.Draft) { throw 'bound recovery private readback' }
+    }
+}
+
+function Restore-CcodGitHubDraftPrivateState {
+    param([Parameter(Mandatory)]$Adapters,[Parameter(Mandatory)][string]$Tag,[Parameter(Mandatory)][string]$Version,[Parameter(Mandatory)]$Verification,[Parameter(Mandatory)]$Acceptance,[Parameter(Mandatory)][string]$ExpectedGitCommit)
+    try {
+        if ($Verification.draftId -isnot [string] -or $Acceptance.draft.id -isnot [string] -or
+            $Verification.draftId -cne $Acceptance.draft.id) { throw 'recovery receipt identity' }
+        Invoke-CcodGitHubDraftBoundPrivateRecovery -Adapters $Adapters -Tag $Tag -DraftId $Verification.draftId
+    } catch {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PROMOTE_ROLLBACK_FAILED' 'Promotion failed after changing visibility and private recovery was not proven.' $Tag
+    }
+}
+
+function Assert-CcodGitHubDraftRecoveryView {
+    param([Parameter(Mandatory)][string]$Tag,[Parameter(Mandatory)][string]$Version,[Parameter(Mandatory)][string]$DraftId,$View)
+    if ($null -eq $View -or $View -isnot [pscustomobject]) { throw 'recovery view' }
+    $fields = @($View.PSObject.Properties.Name)
+    if (($fields -join ',') -cne 'Tag,Id,Draft,AssetNames' -or
+        $View.Tag -isnot [string] -or $View.Tag -cne $Tag -or
+        $View.Id -isnot [string] -or $View.Id -cne $DraftId -or
+        $View.Draft -isnot [bool] -or $null -eq $View.AssetNames) { throw 'recovery view schema' }
+    $expected = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    foreach ($name in @(Get-CcodExpectedReleaseAssetNames -Version $Version)) { [void]$expected.Add($name) }
+    $seen = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    foreach ($name in @($View.AssetNames)) {
+        if ($name -isnot [string] -or -not $expected.Contains([string]$name) -or -not $seen.Add([string]$name)) { throw 'recovery asset set' }
+    }
+    [string[]]$seen
+}
+
+function Restore-CcodGitHubDraftStagePrivateState {
+    param([Parameter(Mandatory)][hashtable]$Adapters,[Parameter(Mandatory)][string]$Tag,[Parameter(Mandatory)][string]$Version,[Parameter(Mandatory)]$DraftId,[Parameter(Mandatory)][string]$ExpectedGitCommit)
+    try {
+        Invoke-CcodGitHubDraftBoundPrivateRecovery -Adapters $Adapters -Tag $Tag -DraftId $DraftId
+    } catch {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_UPLOAD_PRIVATE_RECOVERY_FAILED' 'Stage upload failed and the draft could not be proven private again.' $Tag
+    }
+}
+
+function Restore-CcodGitHubDraftStageAttemptPrivateState {
+    param([Parameter(Mandatory)][hashtable]$Adapters,[Parameter(Mandatory)][string]$Tag,[Parameter(Mandatory)][string]$Version,[Parameter(Mandatory)][string]$ExpectedGitCommit)
+    try {
+        $view = & $Adapters.ViewRelease $Tag
+        if ($null -eq $view -or $view -isnot [pscustomobject] -or $view.Id -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$view.Id)) { throw 'create attempt view' }
+        [void](Assert-CcodGitHubDraftRecoveryView -Tag $Tag -Version $Version -DraftId ([string]$view.Id) -View $view)
+        Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit $ExpectedGitCommit -Adapters $Adapters -ActionsOnly $false
+        if (-not [bool]$view.Draft) { & $Adapters.SetReleaseDraftState $Tag $true ([string]$view.Id) }
+        $privateView = & $Adapters.ViewRelease $Tag
+        [void](Assert-CcodGitHubDraftRecoveryView -Tag $Tag -Version $Version -DraftId ([string]$view.Id) -View $privateView)
+        if (-not [bool]$privateView.Draft) { throw 'create attempt private readback visibility' }
+        Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit $ExpectedGitCommit -Adapters $Adapters -ActionsOnly $false
+    } catch {
+        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_UPLOAD_PRIVATE_RECOVERY_FAILED' 'Stage create failed and the created draft could not be proven private again.' $Tag
+    }
+}
+
 function Invoke-CcodGitHubDraftReleaseCore {
     [CmdletBinding()]
     param(
@@ -517,12 +1118,20 @@ function Invoke-CcodGitHubDraftReleaseCore {
     $Mode = if ($Mode -ieq 'Stage') { 'Stage' } elseif ($Mode -ieq 'Verify') { 'Verify' } elseif ($Mode -ieq 'Promote') { 'Promote' } else { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_MODE_INVALID' 'Release mode is invalid.' $Mode }
     $adapters = Resolve-CcodGitHubDraftReleaseAdapters $Adapters
     $version = $Tag.Substring(1)
-    $assetDir = [IO.Path]::GetFullPath($AssetDirectory)
-    $evidenceDir = [IO.Path]::GetFullPath($EvidenceDirectory)
+    if (-not (Test-CcodGitHubDraftCanonicalAbsolutePath $AssetDirectory)) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ASSET_PATH_INVALID' 'Asset directory must be an absolute canonical path.' $AssetDirectory }
+    if (-not (Test-CcodGitHubDraftCanonicalAbsolutePath $EvidenceDirectory)) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_EVIDENCE_PATH_INVALID' 'Evidence directory must be an absolute canonical path.' $EvidenceDirectory }
+    $assetDir = [string]$AssetDirectory
+    $evidenceDir = [string]$EvidenceDirectory
     Import-CcodDraftReleaseAssetContract
     $evidenceDir = Assert-CcodGitHubDraftPlainPath -Path $evidenceDir -Directory $true
     if ($Mode -ceq 'Promote') {
         $promoteLockHeld = $false
+        $publicMutationAttempted = $false
+        $postReadRoot = $null
+        $frozen = $null
+        $verification = $null
+        $acceptance = $null
+        $assets = $null
         try {
             if ($null -eq $Adapters) {
                 $promoteLockHeld = [bool](& $adapters.AcquireStageLock $Tag)
@@ -535,7 +1144,11 @@ function Invoke-CcodGitHubDraftReleaseCore {
             $assets = Test-CcodExactReleaseAssetSet -AssetDirectory $assetDir -Version $version
             Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit ([string]$assets.GitCommit) -Adapters $adapters -ActionsOnly $false
             $preflight = Join-Path $evidenceDir (Get-CcodGitHubDraftPreflightName $version)
-            Read-CcodGitHubDraftPreflight -Path $preflight -Version $version -GitCommit ([string]$assets.GitCommit) | Out-Null
+            $preflightHash = $null
+            $preflightRecord = Read-CcodGitHubDraftPreflight -Path $preflight -Version $version -GitCommit ([string]$assets.GitCommit) -PinnedSha256 ([ref]$preflightHash)
+            if ((Get-CcodGitHubDraftFileSha256 $preflight) -cne $preflightHash) {
+                Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PREFLIGHT_INVALID' 'Transferred preflight evidence changed after its pinned read.' $preflight
+            }
             $frozen = New-CcodGitHubDraftFrozenAssetSet -AssetDirectory $assetDir -Version $version -Contract $assets
             try {
                 $frozenDirectory = [string]$frozen.Directory
@@ -547,14 +1160,21 @@ function Invoke-CcodGitHubDraftReleaseCore {
                     if ($id -ceq 'CCOD_RELEASE_PROMOTION_EVIDENCE_INVALID' -or $id -ceq 'CCOD_RELEASE_ASSET_SET_INVALID') { throw }
                     Throw-CcodGitHubDraftError 'CCOD_RELEASE_PROMOTION_EVIDENCE_INVALID' 'Promotion requires Task 5 dual InternetDownload receipts.' $defenderEvidence
                 }
-                Read-CcodGitHubDraftAcceptance -EvidenceDirectory $evidenceDir -AssetDirectory $frozenDirectory -Version $version -GitCommit ([string]$assets.GitCommit) | Out-Null
+                $acceptance = Read-CcodGitHubDraftAcceptance -EvidenceDirectory $evidenceDir -AssetDirectory $frozenDirectory -Tag $Tag -Version $version -GitCommit ([string]$assets.GitCommit)
                 $verification = Read-CcodGitHubDraftVerification -EvidenceDirectory $evidenceDir -AssetDirectory $frozenDirectory -Tag $Tag -Version $version -GitCommit ([string]$assets.GitCommit)
+                $acceptancePath = Get-CcodGitHubDraftAcceptancePath $evidenceDir $version
+                $verificationPath = Get-CcodGitHubDraftVerificationPath $evidenceDir $version
+                $acceptanceHash = Get-CcodGitHubDraftFileSha256 $acceptancePath
+                $verificationHash = Get-CcodGitHubDraftFileSha256 $verificationPath
                 try {
                     $view = & $adapters.ViewRelease $Tag
                 } catch {
                     Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_NOT_STAGED' 'Could not read the already verified GitHub draft state.' $Tag
                 }
                 $expected = @(Assert-CcodGitHubDraftRemoteView -Tag $Tag -Version $version -View $view)
+                if ([string]$view.Id -cne [string]$verification.draftId -or [string]$view.Id -cne [string]$acceptance.draft.id) {
+                    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PROMOTE_READBACK_FAILED' 'The acceptance, Verify receipt, and current GitHub draft do not share one release identity.' $Tag
+                }
                 $readRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-draft-promote-' + [guid]::NewGuid().ToString('N'))
                 [IO.Directory]::CreateDirectory($readRoot) | Out-Null
                 try {
@@ -568,7 +1188,7 @@ function Invoke-CcodGitHubDraftReleaseCore {
                         }
                     }
                 } finally {
-                    if ([IO.Directory]::Exists($readRoot)) { Remove-Item -LiteralPath $readRoot -Recurse -Force -ErrorAction SilentlyContinue }
+                    Remove-CcodGitHubDraftDirectoryIfPresent -Path $readRoot
                 }
                 try {
                     $beforePublishView = & $adapters.ViewRelease $Tag
@@ -576,21 +1196,85 @@ function Invoke-CcodGitHubDraftReleaseCore {
                     Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PROMOTE_READBACK_FAILED' 'Could not re-read the private draft before promotion.' $Tag
                 }
                 [void](Assert-CcodGitHubDraftRemoteView -Tag $Tag -Version $version -View $beforePublishView)
+                if ([string]$beforePublishView.Id -cne [string]$verification.draftId -or [string]$beforePublishView.Id -cne [string]$acceptance.draft.id) {
+                    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PROMOTE_READBACK_FAILED' 'The GitHub draft identity changed before promotion.' $Tag
+                }
                 Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit ([string]$assets.GitCommit) -Adapters $adapters -ActionsOnly $false
+                if ((Get-CcodGitHubDraftFileSha256 $acceptancePath) -cne $acceptanceHash -or (Get-CcodGitHubDraftFileSha256 $verificationPath) -cne $verificationHash) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID' 'Acceptance or Verify evidence changed before promotion.' $evidenceDir }
+                Test-CcodReleasePromotionEvidence -EvidenceDirectory $defenderEvidence -AssetDirectory $frozenDirectory -Version $version -ExpectedGitCommit $assets.GitCommit | Out-Null
+                $finalAcceptance = Read-CcodGitHubDraftAcceptance -EvidenceDirectory $evidenceDir -AssetDirectory $frozenDirectory -Tag $Tag -Version $version -GitCommit ([string]$assets.GitCommit)
+                $finalVerification = Read-CcodGitHubDraftVerification -EvidenceDirectory $evidenceDir -AssetDirectory $frozenDirectory -Tag $Tag -Version $version -GitCommit ([string]$assets.GitCommit)
+                if ([string]$finalAcceptance.draft.id -cne [string]$acceptance.draft.id -or [string]$finalVerification.draftId -cne [string]$verification.draftId) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID' 'Acceptance evidence identity changed before promotion.' $evidenceDir }
+                if ((Get-CcodGitHubDraftFileSha256 $acceptancePath) -cne $acceptanceHash -or (Get-CcodGitHubDraftFileSha256 $verificationPath) -cne $verificationHash) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID' 'Acceptance or Verify evidence changed after the final evidence read and before promotion.' $evidenceDir }
+                $postReadRoot = $null
                 try {
-                    & $adapters.SetReleaseDraftState $Tag $false
+                    $postReadRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-draft-post-promote-' + [guid]::NewGuid().ToString('N'))
+                    [IO.Directory]::CreateDirectory($postReadRoot) | Out-Null
                 } catch {
-                    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PROMOTE_FAILED' 'Could not change draft visibility.' $Tag
+                    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PROMOTE_READBACK_FAILED' 'The post-promotion readback workspace could not be prepared before visibility changed.' $null
+                }
+                $setReleaseDraftState = $adapters.SetReleaseDraftState
+                $heldEvidenceHashes = @{}
+                $heldEvidenceHashes[[string]$preflight] = [string]$preflightHash
+                $heldEvidenceHashes[[string]$acceptancePath] = [string]$acceptanceHash
+                $heldEvidenceHashes[[string]$verificationPath] = [string]$verificationHash
+                $acceptanceStateRoot = Join-Path $evidenceDir 'official-draft-acceptance'
+                $acceptanceStatePhases = @('Preflight','LegacyUpgrade','Uninstall','FreshInstall','PreReboot','PostReboot','ReadyForManualEvidence','Complete')
+                foreach ($stateHash in @($acceptance.automatedReceiptSha256)) {
+                    $stateIndex = [array]::IndexOf($acceptanceStatePhases, [string]$stateHash.phase)
+                    if ($stateIndex -lt 0) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID' 'Acceptance automated receipt phase is not recognized.' $acceptancePath }
+                    $stateLeaf = if ([string]$stateHash.phase -ceq 'Complete') { '08-Complete.json' } else { '{0}-{1}.json' -f ('{0:d2}' -f ($stateIndex + 1)), [string]$stateHash.phase }
+                    $heldEvidenceHashes[(Join-Path $acceptanceStateRoot $stateLeaf)] = [string]$stateHash.sha256
+                }
+                $manualArtifactRoot = Join-Path $evidenceDir 'official-draft-artifacts'
+                $manualStateRoot = Join-Path $acceptanceStateRoot 'manual-evidence'
+                $manualStateLeaves = @{
+                    About = 'TrayEvidence-About.json'
+                    Language = 'TrayEvidence-Language.json'
+                    OpenLogs = 'TrayEvidence-OpenLogs.json'
+                    Repair = 'TrayEvidence-Repair.json'
+                    SecondDeviceControl = 'RemoteEvidence-SecondDeviceControl.json'
+                }
+                foreach ($manualEntry in @($acceptance.manualEvidence)) {
+                    if ($manualEntry.operation -isnot [string] -or -not $manualStateLeaves.ContainsKey([string]$manualEntry.operation)) {
+                        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ACCEPTANCE_INVALID' 'Acceptance manual operation is not recognized.' $acceptancePath
+                    }
+                    $manualStatePath = Join-Path $manualStateRoot $manualStateLeaves[[string]$manualEntry.operation]
+                    $heldEvidenceHashes[$manualStatePath] = [string](Get-CcodGitHubDraftFileSha256 $manualStatePath)
+                    $manualDirectory = Join-Path $manualArtifactRoot ([string]$manualEntry.operation)
+                    $heldEvidenceHashes[(Join-Path $manualDirectory 'screenshot.bin')] = [string]$manualEntry.screenshotSha256
+                    $heldEvidenceHashes[(Join-Path $manualDirectory 'redacted.log')] = [string]$manualEntry.redactedLogSha256
+                }
+                $publicMutationAttempted = $true
+                try {
+                    & $script:CcodDraftReleaseAssetContractModule {
+                        param($EvidenceDirectory,$AssetDirectory,$Version,$GitCommit,$SetReleaseDraftState,$Tag,$HeldFileHashes,$DraftModule,$AcceptanceEvidenceDirectory,$BoundReleaseId)
+                        $publish = {
+                            param($AssetAuthority,$EvidenceAuthority,$ReceiptAuthorities)
+                            # Validate semantics again while every acceptance byte and parent is held.
+                            & $DraftModule {
+                                param($EvidenceDirectory,$AssetDirectory,$Tag,$Version,$GitCommit)
+                                Read-CcodGitHubDraftAcceptance -EvidenceDirectory $EvidenceDirectory -AssetDirectory $AssetDirectory -Tag $Tag -Version $Version -GitCommit $GitCommit | Out-Null
+                            } $AcceptanceEvidenceDirectory $AssetDirectory $Tag $Version $GitCommit
+                            & $SetReleaseDraftState $Tag $false $BoundReleaseId
+                        }.GetNewClosure()
+                        Test-CcodReleasePromotionEvidenceCore -EvidenceDirectory $EvidenceDirectory -AssetDirectory $AssetDirectory -Version $Version -ExpectedGitCommit $GitCommit -BeforeReturn $publish -HeldFileHashes $HeldFileHashes | Out-Null
+                    } $defenderEvidence $frozenDirectory $version ([string]$assets.GitCommit) $setReleaseDraftState $Tag $heldEvidenceHashes $ExecutionContext.SessionState.Module $evidenceDir $verification.draftId
+                } catch {
+                    $promotionFailure = $_
+                    Restore-CcodGitHubDraftPrivateState -Adapters $adapters -Tag $Tag -Version $version -Verification $verification -Acceptance $acceptance -ExpectedGitCommit ([string]$assets.GitCommit)
+                    throw $promotionFailure
                 }
                 try {
                     $postView = & $adapters.ViewRelease $Tag
+                    [void](Assert-CcodGitHubDraftRemoteView -Tag $Tag -Version $version -View $postView -AfterPromotion)
+                    if ([string]$postView.Id -cne [string]$verification.draftId -or [string]$postView.Id -cne [string]$acceptance.draft.id) { throw 'post-promotion identity' }
+                    Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit ([string]$assets.GitCommit) -Adapters $adapters -ActionsOnly $false
                 } catch {
-                    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PROMOTE_READBACK_FAILED' 'Could not read the final GitHub release state.' $Tag
+                    $promotionFailure = $_
+                    Restore-CcodGitHubDraftPrivateState -Adapters $adapters -Tag $Tag -Version $version -Verification $verification -Acceptance $acceptance -ExpectedGitCommit ([string]$assets.GitCommit)
+                    throw $promotionFailure
                 }
-                [void](Assert-CcodGitHubDraftRemoteView -Tag $Tag -Version $version -View $postView -AfterPromotion)
-                Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit ([string]$assets.GitCommit) -Adapters $adapters -ActionsOnly $false
-                $postReadRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-draft-post-promote-' + [guid]::NewGuid().ToString('N'))
-                [IO.Directory]::CreateDirectory($postReadRoot) | Out-Null
                 try {
                     for ($index = 0; $index -lt $expected.Count; $index++) {
                         $name = $expected[$index]
@@ -601,16 +1285,37 @@ function Invoke-CcodGitHubDraftReleaseCore {
                             Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PROMOTE_READBACK_FAILED' 'Public release asset changed after promotion.' $name
                         }
                     }
+                    $finalPostView = & $adapters.ViewRelease $Tag
+                    [void](Assert-CcodGitHubDraftRemoteView -Tag $Tag -Version $version -View $finalPostView -AfterPromotion)
+                    if ([string]$finalPostView.Id -cne [string]$verification.draftId -or [string]$finalPostView.Id -cne [string]$acceptance.draft.id) { throw 'post-promotion final identity' }
+                    Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit ([string]$assets.GitCommit) -Adapters $adapters -ActionsOnly $false
+                } catch {
+                    $promotionFailure = $_
+                    try {
+                        Restore-CcodGitHubDraftPrivateState -Adapters $adapters -Tag $Tag -Version $version -Verification $verification -Acceptance $acceptance -ExpectedGitCommit ([string]$assets.GitCommit)
+                    } catch {
+                        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PROMOTE_ROLLBACK_FAILED' 'Public promotion readback failed and the draft could not be proven private again.' $Tag
+                    }
+                    throw $promotionFailure
                 } finally {
-                    if ([IO.Directory]::Exists($postReadRoot)) { Remove-Item -LiteralPath $postReadRoot -Recurse -Force -ErrorAction SilentlyContinue }
+                    try { Remove-CcodGitHubDraftDirectoryIfPresent -Path $postReadRoot } catch { $promotionFailure = $_; Restore-CcodGitHubDraftPrivateState -Adapters $adapters -Tag $Tag -Version $version -Verification $verification -Acceptance $acceptance -ExpectedGitCommit ([string]$assets.GitCommit); throw $promotionFailure }
                 }
                 return [pscustomobject][ordered]@{ Mode = $Mode; Tag = $Tag; Draft = $false; Promoted = $true }
             } finally {
-                Remove-CcodGitHubDraftFrozenAssetSet $frozen
+                try {
+                    if ($null -ne $postReadRoot) { Remove-CcodGitHubDraftDirectoryIfPresent -Path $postReadRoot }
+                } catch {
+                    $cleanupFailure = $_
+                    if ($publicMutationAttempted -and $null -ne $verification -and $null -ne $acceptance) {
+                        try { Restore-CcodGitHubDraftPrivateState -Adapters $adapters -Tag $Tag -Version $version -Verification $verification -Acceptance $acceptance -ExpectedGitCommit ([string]$assets.GitCommit) } catch { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PROMOTE_ROLLBACK_FAILED' 'Promotion cleanup failed and the draft could not be proven private again.' $Tag }
+                    }
+                    throw $cleanupFailure
+                }
+                try { Remove-CcodGitHubDraftFrozenAssetSet $frozen } catch { $cleanupFailure = $_; if ($publicMutationAttempted -and $null -ne $verification -and $null -ne $acceptance) { Restore-CcodGitHubDraftPrivateState -Adapters $adapters -Tag $Tag -Version $version -Verification $verification -Acceptance $acceptance -ExpectedGitCommit ([string]$assets.GitCommit) }; throw $cleanupFailure }
             }
         } finally {
             if ($promoteLockHeld) {
-                & $adapters.ReleaseStageLock $Tag
+                try { & $adapters.ReleaseStageLock $Tag } catch { $cleanupFailure = $_; if ($publicMutationAttempted -and $null -ne $verification -and $null -ne $acceptance) { Restore-CcodGitHubDraftPrivateState -Adapters $adapters -Tag $Tag -Version $version -Verification $verification -Acceptance $acceptance -ExpectedGitCommit ([string]$assets.GitCommit) }; throw $cleanupFailure }
             }
         }
     }
@@ -627,9 +1332,9 @@ function Invoke-CcodGitHubDraftReleaseCore {
         $preflight = Join-Path $evidenceDir (Get-CcodGitHubDraftPreflightName $version)
     $assets = $null
     if ($Mode -ceq 'Stage') {
-        if (-not [IO.File]::Exists($preflight)) {
-            Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PREFLIGHT_MISSING' 'Stage requires transferred clean-runner preflight evidence.' $preflight
-        }
+        $preflightItem = $null
+        try { $preflightItem = Get-Item -LiteralPath $preflight -Force -ErrorAction Stop } catch { if (Test-CcodGitHubDraftMissingError $_) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PREFLIGHT_MISSING' 'Stage requires transferred clean-runner preflight evidence.' $preflight } Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PREFLIGHT_INVALID' 'Transferred clean-runner preflight evidence could not be inspected safely.' $preflight }
+        if ($preflightItem.PSIsContainer -or ($preflightItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_PREFLIGHT_INVALID' 'Transferred clean-runner preflight evidence is not a plain file.' $preflight }
         $assets = Test-CcodExactReleaseAssetSet -AssetDirectory $assetDir -Version $version
         Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit ([string]$assets.GitCommit) -Adapters $adapters -ActionsOnly $true
         Read-CcodGitHubDraftPreflight -Path $preflight -Version $version -GitCommit ([string]$assets.GitCommit) | Out-Null
@@ -639,62 +1344,131 @@ function Invoke-CcodGitHubDraftReleaseCore {
         Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit ([string]$assets.GitCommit) -Adapters $adapters -ActionsOnly $false
         Read-CcodGitHubDraftPreflight -Path $preflight -Version $version -GitCommit ([string]$assets.GitCommit) | Out-Null
         $frozen = New-CcodGitHubDraftFrozenAssetSet -AssetDirectory $assetDir -Version $version -Contract $assets
+        $frozenAuthority = $null
         try {
             $frozenDirectory = [string]$frozen.Directory
+            $contractModule = $script:CcodDraftReleaseAssetContractModule
+            $frozenAuthority = & $contractModule {
+                param($Path,$Version)
+                Open-CcodExactReleaseAssetAuthority -AssetDirectory $Path -Version $Version -ErrorId 'CCOD_GITHUB_DRAFT_ASSET_FREEZE_FAILED'
+            } $frozenDirectory $version
+            $contractAssets = @($assets.Assets)
+            $verificationHashes = [Collections.Generic.List[string]]::new()
+            if ($contractAssets.Count -ne $frozenAuthority.Files.Count) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ASSET_FREEZE_FAILED' 'Frozen candidate membership changed before authority acquisition.' $Tag }
+            for ($index = 0; $index -lt $contractAssets.Count; $index++) {
+                $heldFile = $frozenAuthority.Files[$index]
+                if ($contractAssets[$index].name -isnot [string] -or $contractAssets[$index].name -cne $heldFile.Leaf -or
+                    $contractAssets[$index].sha256 -isnot [string] -or $contractAssets[$index].sha256 -cne $heldFile.Sha256) {
+                    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ASSET_FREEZE_FAILED' 'Held frozen bytes do not match the original validated contract.' $Tag
+                }
+                $verificationHashes.Add([string]$heldFile.Sha256)
+            }
+            $manifestIndex = [Array]::IndexOf([string[]]$frozenAuthority.Names, (Get-CcodGitHubDraftManifestName $version))
+            if ($manifestIndex -lt 0) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ASSET_FREEZE_FAILED' 'The held candidate manifest is missing.' $Tag }
+            $candidateManifestHash = [string]$verificationHashes[$manifestIndex]
             try {
                 $view = & $adapters.ViewRelease $Tag
             } catch {
                 Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_NOT_STAGED' 'Could not read the staged GitHub draft state.' $Tag
             }
             $expected = @(Assert-CcodGitHubDraftRemoteView -Tag $Tag -Version $version -View $view)
+            $draftId = [string]$view.Id
             $readRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-draft-verify-' + [guid]::NewGuid().ToString('N'))
             [IO.Directory]::CreateDirectory($readRoot) | Out-Null
             try {
+                $index = 0
                 foreach ($name in $expected) {
                     $destination = Join-Path $readRoot $name
                     Invoke-CcodGitHubDraftDownloadAsset -Adapters $adapters -Tag $Tag -Name $name -Destination $destination -ErrorId 'CCOD_GITHUB_DRAFT_READBACK_FAILED'
-                    $expectedHash = Get-CcodGitHubDraftFileSha256 (Join-Path $frozenDirectory $name)
+                    $expectedHash = [string]$verificationHashes[$index]
                     $actualHash = Get-CcodGitHubDraftFileSha256 $destination
                     if ($expectedHash -cne $actualHash) {
                         Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_READBACK_FAILED' 'Verified draft asset hash does not match the frozen candidate.' $name
                     }
+                    $index++
                 }
             } finally {
-                if ([IO.Directory]::Exists($readRoot)) { Remove-Item -LiteralPath $readRoot -Recurse -Force -ErrorAction SilentlyContinue }
+                Remove-CcodGitHubDraftDirectoryIfPresent -Path $readRoot
+            }
+            $assertFinalPrivateLineage = {
+                try {
+                    & $contractModule { param($Authority) Assert-CcodExactReleaseAssetAuthorityCurrent -Authority $Authority -ErrorId 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID' | Out-Null } $frozenAuthority
+                    $finalView = & $adapters.ViewRelease $Tag
+                    if ($null -eq $finalView -or $finalView -isnot [pscustomobject] -or (@($finalView.PSObject.Properties.Name) -join ',') -cne 'Tag,Id,Draft,AssetNames' -or
+                        $finalView.Tag -isnot [string] -or $finalView.Tag -cne $Tag -or $finalView.Id -isnot [string] -or $finalView.Id -notmatch '^[1-9][0-9]*\z' -or $finalView.Id -cne $draftId -or
+                        $finalView.Draft -isnot [bool] -or -not [bool]$finalView.Draft) { return $false }
+                    $finalNames = @($finalView.AssetNames)
+                    if ($finalNames.Count -ne $expected.Count -or @($finalNames | Where-Object { $_ -isnot [string] }).Count -ne 0 -or (($finalNames -join "`n") -cne ($expected -join "`n"))) { return $false }
+                    $rawFinalCommit = & $adapters.GetTagCommit $Tag $false
+                    if ($rawFinalCommit -isnot [string] -or $rawFinalCommit -cnotmatch '^[0-9a-f]{40}\z' -or $rawFinalCommit -cne [string]$assets.GitCommit) { return $false }
+                    & $contractModule { param($Authority) Assert-CcodExactReleaseAssetAuthorityCurrent -Authority $Authority -ErrorId 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID' | Out-Null } $frozenAuthority
+                    return $true
+                } catch { return $false }
+            }.GetNewClosure()
+            if (-not [bool](& $assertFinalPrivateLineage)) {
+                Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID' 'The private draft identity or tag commit changed before Verify evidence was published.' $Tag
             }
-            $verificationHashes = [Collections.Generic.List[string]]::new()
-            foreach ($name in $expected) { $verificationHashes.Add((Get-CcodGitHubDraftFileSha256 (Join-Path $frozenDirectory $name))) }
             $verificationRecord = [ordered]@{
                 schemaVersion = 1
                 kind = 'github-draft-verification'
                 tag = $Tag
+                draftId = $draftId
                 version = $version
                 gitCommit = [string]$assets.GitCommit
                 draft = $true
                 verified = $true
                 assetNames = [string[]]$expected
                 assetSha256 = [string[]]$verificationHashes
-                candidateManifestSha256 = Get-CcodGitHubDraftFileSha256 (Join-Path $frozenDirectory (Get-CcodGitHubDraftManifestName $version))
+                candidateManifestSha256 = $candidateManifestHash
             }
             $verificationPath = Get-CcodGitHubDraftVerificationPath $evidenceDir $version -CreatePlane
-            Write-CcodGitHubDraftJsonCreateOnly -Path $verificationPath -Record $verificationRecord -ErrorId 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID'
+            Write-CcodGitHubDraftJsonCreateOnly -Path $verificationPath -Record $verificationRecord -ErrorId 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID' -ReadbackVerifier $assertFinalPrivateLineage
             Read-CcodGitHubDraftVerification -EvidenceDirectory $evidenceDir -AssetDirectory $frozenDirectory -Tag $Tag -Version $version -GitCommit ([string]$assets.GitCommit) | Out-Null
+            & $contractModule { param($Authority) Assert-CcodExactReleaseAssetAuthorityCurrent -Authority $Authority -ErrorId 'CCOD_GITHUB_DRAFT_VERIFY_EVIDENCE_INVALID' | Out-Null } $frozenAuthority
             return [pscustomobject][ordered]@{ Mode = $Mode; Tag = $Tag; Draft = $true; Verified = $true; VerificationPath = $verificationPath }
         } finally {
+            if ($null -ne $frozenAuthority) { & $contractModule { param($Authority) Close-CcodExactReleaseAssetAuthority $Authority } $frozenAuthority }
             Remove-CcodGitHubDraftFrozenAssetSet $frozen
         }
     }
     $assets = Test-CcodExactReleaseAssetSet -AssetDirectory $assetDir -Version $version
     $frozen = New-CcodGitHubDraftFrozenAssetSet -AssetDirectory $assetDir -Version $version -Contract $assets
+    $stageAuthority = $null
+    $contractModule = $script:CcodDraftReleaseAssetContractModule
     try {
         $frozenDirectory = [string]$frozen.Directory
+        $stageAuthority = & $contractModule {
+            param($Path,$Version)
+            Open-CcodExactReleaseAssetAuthority -AssetDirectory $Path -Version $Version -ErrorId 'CCOD_GITHUB_DRAFT_ASSET_FREEZE_FAILED'
+        } $frozenDirectory $version
+        $stageHashes = [Collections.Generic.Dictionary[string,string]]::new([StringComparer]::Ordinal)
+        $contractAssets = @($assets.Assets)
+        if ($contractAssets.Count -ne $stageAuthority.Files.Count) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ASSET_FREEZE_FAILED' 'Stage frozen membership changed before authority acquisition.' $Tag }
+        for ($index = 0; $index -lt $contractAssets.Count; $index++) {
+            $file = $stageAuthority.Files[$index]
+            if ($contractAssets[$index].name -isnot [string] -or $contractAssets[$index].name -cne $file.Leaf -or
+                $contractAssets[$index].sha256 -isnot [string] -or $contractAssets[$index].sha256 -cne $file.Sha256) {
+                Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_ASSET_FREEZE_FAILED' 'Stage held bytes do not match the original validated contract.' $Tag
+            }
+            $stageHashes.Add([string]$file.Leaf,[string]$file.Sha256)
+        }
         $notes = ''
         if (-not [string]::IsNullOrWhiteSpace($NotesPath)) {
-            $notesFile = [IO.Path]::GetFullPath($NotesPath)
+            if (-not (Test-CcodGitHubDraftCanonicalAbsolutePath $NotesPath)) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_NOTES_INVALID' 'Release notes must be an absolute canonical path.' $NotesPath }
+            $notesFile = Assert-CcodGitHubDraftPlainPath -Path $NotesPath -Directory $false
+            $repositoryRoot = if ([string]::IsNullOrWhiteSpace([string]$script:CcodGitHubDraftModuleRoot)) { $null } else { [IO.Path]::GetFullPath((Split-Path -Parent $script:CcodGitHubDraftModuleRoot)) }
+            if ($null -eq $repositoryRoot) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_NOTES_INVALID' 'Trusted release tool root is unavailable.' $notesFile }
+            $approvedNotes = $notesFile.StartsWith($repositoryRoot.TrimEnd([IO.Path]::DirectorySeparatorChar,[IO.Path]::AltDirectorySeparatorChar) + [IO.Path]::DirectorySeparatorChar, [StringComparison]::OrdinalIgnoreCase)
+            $runnerTemp = $env:RUNNER_TEMP
+            if (-not $approvedNotes -and -not [string]::IsNullOrWhiteSpace($runnerTemp)) {
+                $runnerRoot = [IO.Path]::GetFullPath($runnerTemp)
+                $approvedNotes = $notesFile.StartsWith($runnerRoot.TrimEnd([IO.Path]::DirectorySeparatorChar,[IO.Path]::AltDirectorySeparatorChar) + [IO.Path]::DirectorySeparatorChar, [StringComparison]::OrdinalIgnoreCase)
+            }
+            if (-not $approvedNotes) { Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_NOTES_INVALID' 'Release notes must be inside the approved checkout or runner-temp root.' $notesFile }
             try {
                 $notesItem = Get-Item -LiteralPath $notesFile -Force -ErrorAction Stop
                 if (-not $notesItem.PSIsContainer -and $notesItem.Length -le 1048576) {
-                    $notes = [IO.File]::ReadAllText($notesFile, [Text.UTF8Encoding]::new($false, $true))
+                    $notes = Read-CcodGitHubDraftNotesPinned -Path $notesFile -ErrorId 'CCOD_GITHUB_DRAFT_NOTES_INVALID'
                 } else { throw 'notes bounds' }
             } catch {
                 Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_NOTES_INVALID' 'Release notes are missing, invalid, or too large.' $notesFile
@@ -702,50 +1476,95 @@ function Invoke-CcodGitHubDraftReleaseCore {
         }
         $expected = [string[]]$frozen.Names
         $created = $false
+        $createAttempted = $false
         try {
+            $preCreateView = & $adapters.ProbeRelease $Tag
+            if ($null -ne $preCreateView) {
+                if ($preCreateView -isnot [pscustomobject] -or (@($preCreateView.PSObject.Properties.Name) -join ',') -cne 'Tag,Id,Draft,AssetNames' -or
+                    $preCreateView.Tag -isnot [string] -or $preCreateView.Tag -cne $Tag -or
+                    $preCreateView.Id -isnot [string] -or $preCreateView.Id -notmatch '^[1-9][0-9]*\z' -or
+                    $preCreateView.Draft -isnot [bool] -or $null -eq $preCreateView.AssetNames) {
+                    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CREATE_FAILED' 'Pre-create release probe returned invalid release identity.' $Tag
+                }
+                Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CREATE_FAILED' 'A release already exists for the requested tag; Stage will not mutate it.' $Tag
+            }
+            $createAttempted = $true
             $createdResult = & $adapters.CreateDraft $Tag ("CodexRemote-fix $version") $notes
-            if ($null -eq $createdResult -or $createdResult -isnot [pscustomobject] -or @($createdResult.PSObject.Properties.Name) -join ',' -cne 'Tag,Draft' -or $createdResult.Tag -cne $Tag -or $createdResult.Draft -isnot [bool] -or -not [bool]$createdResult.Draft) {
+            if ($null -eq $createdResult -or $createdResult -isnot [pscustomobject] -or (@($createdResult.PSObject.Properties.Name) -join ',') -cne 'Tag,Id,Draft,AssetNames' -or $createdResult.Tag -isnot [string] -or $createdResult.Tag -cne $Tag -or $createdResult.Id -isnot [string] -or $createdResult.Id -notmatch '^[1-9][0-9]*\z' -or $createdResult.Draft -isnot [bool] -or -not [bool]$createdResult.Draft -or $null -eq $createdResult.AssetNames) {
                 Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CREATE_FAILED' 'Draft creation did not return a private draft state.' $Tag
             }
             $created = $true
             Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit ([string]$assets.GitCommit) -Adapters $adapters -ActionsOnly $true
             $createdView = & $adapters.ViewRelease $Tag
             [void](Assert-CcodGitHubDraftPrivateView -Tag $Tag -Version $version -View $createdView)
+            if ([string]$createdView.Id -cne [string]$createdResult.Id) {
+                Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CREATE_FAILED' 'The created draft identity changed before asset upload.' $Tag
+            }
             foreach ($name in $expected) {
                 Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit ([string]$assets.GitCommit) -Adapters $adapters -ActionsOnly $true
                 $beforeUploadView = & $adapters.ViewRelease $Tag
                 [void](Assert-CcodGitHubDraftPrivateView -Tag $Tag -Version $version -View $beforeUploadView)
+                if ([string]$beforeUploadView.Id -cne [string]$createdResult.Id) {
+                    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CREATE_FAILED' 'The draft identity changed during asset upload.' $Tag
+                }
+                & $contractModule {param($Authority) Assert-CcodExactReleaseAssetAuthorityCurrent -Authority $Authority -ErrorId 'CCOD_GITHUB_DRAFT_ASSET_FREEZE_FAILED' | Out-Null} $stageAuthority
                 & $adapters.UploadAsset $Tag $name (Join-Path $frozenDirectory $name)
+                & $contractModule {param($Authority) Assert-CcodExactReleaseAssetAuthorityCurrent -Authority $Authority -ErrorId 'CCOD_GITHUB_DRAFT_ASSET_FREEZE_FAILED' | Out-Null} $stageAuthority
             }
             $stageView = & $adapters.ViewRelease $Tag
             [void](Assert-CcodGitHubDraftRemoteView -Tag $Tag -Version $version -View $stageView)
+            if ([string]$stageView.Id -cne [string]$createdResult.Id) {
+                Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CREATE_FAILED' 'The draft identity changed after asset upload.' $Tag
+            }
+            Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit ([string]$assets.GitCommit) -Adapters $adapters -ActionsOnly $true
         } catch {
-            if ($created) {
-                Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_UPLOAD_FAILED' 'Draft upload failed; the draft remains private.' $Tag
+            if ($created -or $createAttempted) {
+                if ($created -and $null -ne $createdResult -and $createdResult.Id -is [string] -and -not [string]::IsNullOrWhiteSpace([string]$createdResult.Id)) {
+                    Restore-CcodGitHubDraftStagePrivateState -Adapters $adapters -Tag $Tag -Version $version -DraftId ([string]$createdResult.Id) -ExpectedGitCommit ([string]$assets.GitCommit)
+                    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_UPLOAD_FAILED' 'Draft upload failed; the draft was re-read and proven private.' $Tag
+                }
+                Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CREATE_AMBIGUOUS' 'Draft creation failed after an absence probe; no existing release was mutated because creation ownership is unproven.' $Tag
             }
             throw
         }
-        $readRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-draft-stage-' + [guid]::NewGuid().ToString('N'))
-        [IO.Directory]::CreateDirectory($readRoot) | Out-Null
         try {
-            foreach ($name in $expected) {
-                $destination = Join-Path $readRoot $name
-                Invoke-CcodGitHubDraftDownloadAsset -Adapters $adapters -Tag $Tag -Name $name -Destination $destination -ErrorId 'CCOD_GITHUB_DRAFT_READBACK_FAILED'
-                $expectedHash = Get-CcodGitHubDraftFileSha256 (Join-Path $frozenDirectory $name)
-                $actualHash = Get-CcodGitHubDraftFileSha256 $destination
-                if ($expectedHash -cne $actualHash) {
-                    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_READBACK_FAILED' 'Staged draft asset hash does not match the frozen candidate.' $name
+            $readRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-draft-stage-' + [guid]::NewGuid().ToString('N'))
+            [IO.Directory]::CreateDirectory($readRoot) | Out-Null
+            try {
+                foreach ($name in $expected) {
+                    $destination = Join-Path $readRoot $name
+                    & $contractModule {param($Authority) Assert-CcodExactReleaseAssetAuthorityCurrent -Authority $Authority -ErrorId 'CCOD_GITHUB_DRAFT_READBACK_FAILED' | Out-Null} $stageAuthority
+                    Invoke-CcodGitHubDraftDownloadAsset -Adapters $adapters -Tag $Tag -Name $name -Destination $destination -ErrorId 'CCOD_GITHUB_DRAFT_READBACK_FAILED'
+                    $expectedHash = $stageHashes[$name]
+                    $actualHash = Get-CcodGitHubDraftFileSha256 $destination
+                    if ($expectedHash -cne $actualHash) {
+                        Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_READBACK_FAILED' 'Staged draft asset hash does not match the frozen candidate.' $name
+                    }
+                    & $contractModule {param($Authority) Assert-CcodExactReleaseAssetAuthorityCurrent -Authority $Authority -ErrorId 'CCOD_GITHUB_DRAFT_READBACK_FAILED' | Out-Null} $stageAuthority
+                }
+                $finalStageView = & $adapters.ViewRelease $Tag
+                [void](Assert-CcodGitHubDraftRemoteView -Tag $Tag -Version $version -View $finalStageView)
+                if ([string]$finalStageView.Id -cne [string]$createdResult.Id) {
+                    Throw-CcodGitHubDraftError 'CCOD_GITHUB_DRAFT_CREATE_FAILED' 'The draft identity changed after staged asset readback.' $Tag
                 }
+                Assert-CcodGitHubDraftTagCommit -Tag $Tag -ExpectedCommit ([string]$assets.GitCommit) -Adapters $adapters -ActionsOnly $true
+            } finally {
+                Remove-CcodGitHubDraftDirectoryIfPresent -Path $readRoot
             }
-        } finally {
-            if ([IO.Directory]::Exists($readRoot)) { Remove-Item -LiteralPath $readRoot -Recurse -Force -ErrorAction SilentlyContinue }
+        } catch {
+            if ($created) {
+                Restore-CcodGitHubDraftStagePrivateState -Adapters $adapters -Tag $Tag -Version $version -DraftId ([string]$createdResult.Id) -ExpectedGitCommit ([string]$assets.GitCommit)
+            }
+            throw
         }
+        & $contractModule {param($Authority) Assert-CcodExactReleaseAssetAuthorityCurrent -Authority $Authority -ErrorId 'CCOD_GITHUB_DRAFT_ASSET_FREEZE_FAILED' | Out-Null} $stageAuthority
         return [pscustomobject][ordered]@{ Mode = $Mode; Tag = $Tag; Draft = $true; Uploaded = $expected }
     } finally {
-        Remove-CcodGitHubDraftFrozenAssetSet $frozen
+        try { if ($null -ne $stageAuthority) { & $contractModule {param($Authority) Close-CcodExactReleaseAssetAuthority $Authority} $stageAuthority } }
+        finally { Remove-CcodGitHubDraftFrozenAssetSet $frozen }
     }
     } finally {
-        if ($null -eq $Adapters -and $defaultLockHeld) {
+        if ($defaultLockHeld) {
             & $adapters.ReleaseStageLock $Tag
         }
     }
diff --git a/tools/Invoke-GitHubDraftRelease.psm1 b/tools/Invoke-GitHubDraftRelease.psm1
index c71b2cd..94acbb9 100644
--- a/tools/Invoke-GitHubDraftRelease.psm1
+++ b/tools/Invoke-GitHubDraftRelease.psm1
@@ -1,4 +1,158 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
-. (Join-Path $PSScriptRoot 'Invoke-GitHubDraftRelease.ps1')
+
+# BEGIN CCOD TRUSTED IMPORT BOOTSTRAP
+# Embedded in each independently trusted entrypoint; an unheld helper import
+# cannot bootstrap its own protection. Keep copies identical (self-test enforced).
+function Initialize-CcodTrustedImportLease {
+    if ($null -ne ('CcodTrustedImportLeaseV1' -as [type])) { return }
+    Add-Type -ErrorAction Stop -TypeDefinition @'
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+
+public sealed class CcodTrustedImportLeaseV1 : IDisposable
+{
+    [StructLayout(LayoutKind.Sequential)] private struct NativeTime { public uint Low, High; }
+    [StructLayout(LayoutKind.Sequential)] private struct NativeInfo
+    {
+        public uint Attributes;
+        public NativeTime Creation, Access, Write;
+        public uint Volume, SizeHigh, SizeLow, Links, IndexHigh, IndexLow;
+    }
+    private sealed class Entry
+    {
+        public SafeFileHandle Handle;
+        public string Path;
+        public bool Directory;
+        public uint Volume;
+        public ulong FileId;
+    }
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern SafeFileHandle CreateFileW(string path, uint access, uint share, IntPtr security, uint creation, uint flags, IntPtr template);
+    [DllImport("kernel32.dll", SetLastError=true)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle handle, out NativeInfo info);
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern uint GetFinalPathNameByHandleW(SafeFileHandle handle, StringBuilder value, uint length, uint flags);
+
+    private readonly List<Entry> entries = new List<Entry>();
+    private bool disposed;
+    public string Path { get; private set; }
+    private CcodTrustedImportLeaseV1(string path) { Path = path; }
+
+    public static CcodTrustedImportLeaseV1 Acquire(string path)
+    {
+        if (String.IsNullOrWhiteSpace(path) || !System.IO.Path.IsPathRooted(path) ||
+            path.StartsWith(@"\\?\", StringComparison.Ordinal) || path.StartsWith(@"\\.\", StringComparison.Ordinal))
+            throw new ArgumentException("Unsupported module path");
+        string full = System.IO.Path.GetFullPath(path);
+        string root = System.IO.Path.GetPathRoot(full);
+        string extension = System.IO.Path.GetExtension(full);
+        if (!String.Equals(full, path, StringComparison.OrdinalIgnoreCase) || String.IsNullOrEmpty(root) ||
+            full.Substring(root.Length).IndexOf(':') >= 0 ||
+            (!String.Equals(extension, ".psm1", StringComparison.OrdinalIgnoreCase) && !String.Equals(extension, ".ps1", StringComparison.OrdinalIgnoreCase)))
+            throw new ArgumentException("Noncanonical module path");
+        var lease = new CcodTrustedImportLeaseV1(full);
+        try
+        {
+            var parents = new List<string>();
+            for (DirectoryInfo parent = Directory.GetParent(full); parent != null; parent = parent.Parent)
+                parents.Add(parent.FullName);
+            parents.Reverse();
+            if (parents.Count == 0 || !SamePath(parents[0], root)) throw new IOException("Missing module root");
+            // Retain root-to-leaf authority before traversing the next component.
+            foreach (string parent in parents) lease.Open(parent, true);
+            lease.Open(full, false);
+            lease.Revalidate();
+            return lease;
+        }
+        catch { lease.Dispose(); throw; }
+    }
+
+    private void Open(string path, bool directory)
+    {
+        uint access = directory ? 0x00100081U : 0x80100080U;
+        uint flags = 0x00200000U | (directory ? 0x02000000U : 0U);
+        // FILE_SHARE_READ only: preexisting writers/deleters must fail closed.
+        SafeFileHandle handle = CreateFileW(path, access, 1U, IntPtr.Zero, 3U, flags, IntPtr.Zero);
+        if (handle.IsInvalid) { int error = Marshal.GetLastWin32Error(); handle.Dispose(); throw new Win32Exception(error); }
+        try
+        {
+            NativeInfo info = Inspect(handle, path, directory);
+            entries.Add(new Entry { Handle = handle, Path = path, Directory = directory, Volume = info.Volume, FileId = FileId(info) });
+        }
+        catch { handle.Dispose(); throw; }
+    }
+
+    private static ulong FileId(NativeInfo info) { return ((ulong)info.IndexHigh << 32) | info.IndexLow; }
+    private static bool SamePath(string left, string right)
+    {
+        return String.Equals(left.TrimEnd('\\'), right.TrimEnd('\\'), StringComparison.OrdinalIgnoreCase);
+    }
+    private static NativeInfo Inspect(SafeFileHandle handle, string expected, bool directory)
+    {
+        NativeInfo info;
+        if (!GetFileInformationByHandle(handle, out info)) throw new Win32Exception(Marshal.GetLastWin32Error());
+        if ((info.Attributes & 0x400U) != 0 || ((info.Attributes & 0x10U) != 0) != directory)
+            throw new IOException("Unsafe module path kind");
+        var value = new StringBuilder(512);
+        uint length = GetFinalPathNameByHandleW(handle, value, (uint)value.Capacity, 0);
+        if (length == 0) throw new Win32Exception(Marshal.GetLastWin32Error());
+        if (length >= value.Capacity)
+        {
+            value.Capacity = checked((int)length + 1);
+            length = GetFinalPathNameByHandleW(handle, value, (uint)value.Capacity, 0);
+            if (length == 0 || length >= value.Capacity) throw new IOException("Module final path unavailable");
+        }
+        string final = value.ToString();
+        if (final.StartsWith(@"\\?\UNC\", StringComparison.OrdinalIgnoreCase)) final = @"\\" + final.Substring(8);
+        else if (final.StartsWith(@"\\?\", StringComparison.OrdinalIgnoreCase)) final = final.Substring(4);
+        if (!SamePath(final, expected)) throw new IOException("Module final path mismatch");
+        return info;
+    }
+
+    public void Revalidate()
+    {
+        if (disposed) throw new ObjectDisposedException("trusted module import lease");
+        foreach (Entry entry in entries)
+        {
+            NativeInfo info = Inspect(entry.Handle, entry.Path, entry.Directory);
+            if (info.Volume != entry.Volume || FileId(info) != entry.FileId) throw new IOException("Module identity changed");
+        }
+    }
+    public void Dispose()
+    {
+        if (disposed) return;
+        disposed = true;
+        for (int index = entries.Count - 1; index >= 0; index--) entries[index].Handle.Dispose();
+        entries.Clear();
+    }
+}
+'@
+}
+
+function Open-CcodTrustedImportLease {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$ErrorId)
+    try {
+        Initialize-CcodTrustedImportLease
+        return [CcodTrustedImportLeaseV1]::Acquire($Path)
+    } catch {
+        throw [Management.Automation.ErrorRecord]::new(
+            [InvalidOperationException]::new('Trusted module import authority could not be acquired.'),
+            $ErrorId,[Management.Automation.ErrorCategory]::InvalidData,$Path)
+    }
+}
+# END CCOD TRUSTED IMPORT BOOTSTRAP
+
+$entryPath = Join-Path $PSScriptRoot 'Invoke-GitHubDraftRelease.ps1'
+$entryLease = Open-CcodTrustedImportLease -Path $entryPath -ErrorId 'CCOD_GITHUB_DRAFT_CONTRACT_MISSING'
+try {
+    $entryLease.Revalidate()
+    . $entryPath
+    $entryLease.Revalidate()
+} finally { $entryLease.Dispose() }
 Export-ModuleMember -Function Invoke-CcodGitHubDraftRelease
diff --git a/tools/ReleaseAssetContract.psm1 b/tools/ReleaseAssetContract.psm1
index b41df43..9a47864 100644
--- a/tools/ReleaseAssetContract.psm1
+++ b/tools/ReleaseAssetContract.psm1
@@ -1,6 +1,153 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
+# BEGIN CCOD TRUSTED IMPORT BOOTSTRAP
+# Embedded in each independently trusted entrypoint; an unheld helper import
+# cannot bootstrap its own protection. Keep copies identical (self-test enforced).
+function Initialize-CcodTrustedImportLease {
+    if ($null -ne ('CcodTrustedImportLeaseV1' -as [type])) { return }
+    Add-Type -ErrorAction Stop -TypeDefinition @'
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+
+public sealed class CcodTrustedImportLeaseV1 : IDisposable
+{
+    [StructLayout(LayoutKind.Sequential)] private struct NativeTime { public uint Low, High; }
+    [StructLayout(LayoutKind.Sequential)] private struct NativeInfo
+    {
+        public uint Attributes;
+        public NativeTime Creation, Access, Write;
+        public uint Volume, SizeHigh, SizeLow, Links, IndexHigh, IndexLow;
+    }
+    private sealed class Entry
+    {
+        public SafeFileHandle Handle;
+        public string Path;
+        public bool Directory;
+        public uint Volume;
+        public ulong FileId;
+    }
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern SafeFileHandle CreateFileW(string path, uint access, uint share, IntPtr security, uint creation, uint flags, IntPtr template);
+    [DllImport("kernel32.dll", SetLastError=true)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle handle, out NativeInfo info);
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern uint GetFinalPathNameByHandleW(SafeFileHandle handle, StringBuilder value, uint length, uint flags);
+
+    private readonly List<Entry> entries = new List<Entry>();
+    private bool disposed;
+    public string Path { get; private set; }
+    private CcodTrustedImportLeaseV1(string path) { Path = path; }
+
+    public static CcodTrustedImportLeaseV1 Acquire(string path)
+    {
+        if (String.IsNullOrWhiteSpace(path) || !System.IO.Path.IsPathRooted(path) ||
+            path.StartsWith(@"\\?\", StringComparison.Ordinal) || path.StartsWith(@"\\.\", StringComparison.Ordinal))
+            throw new ArgumentException("Unsupported module path");
+        string full = System.IO.Path.GetFullPath(path);
+        string root = System.IO.Path.GetPathRoot(full);
+        string extension = System.IO.Path.GetExtension(full);
+        if (!String.Equals(full, path, StringComparison.OrdinalIgnoreCase) || String.IsNullOrEmpty(root) ||
+            full.Substring(root.Length).IndexOf(':') >= 0 ||
+            (!String.Equals(extension, ".psm1", StringComparison.OrdinalIgnoreCase) && !String.Equals(extension, ".ps1", StringComparison.OrdinalIgnoreCase)))
+            throw new ArgumentException("Noncanonical module path");
+        var lease = new CcodTrustedImportLeaseV1(full);
+        try
+        {
+            var parents = new List<string>();
+            for (DirectoryInfo parent = Directory.GetParent(full); parent != null; parent = parent.Parent)
+                parents.Add(parent.FullName);
+            parents.Reverse();
+            if (parents.Count == 0 || !SamePath(parents[0], root)) throw new IOException("Missing module root");
+            // Retain root-to-leaf authority before traversing the next component.
+            foreach (string parent in parents) lease.Open(parent, true);
+            lease.Open(full, false);
+            lease.Revalidate();
+            return lease;
+        }
+        catch { lease.Dispose(); throw; }
+    }
+
+    private void Open(string path, bool directory)
+    {
+        uint access = directory ? 0x00100081U : 0x80100080U;
+        uint flags = 0x00200000U | (directory ? 0x02000000U : 0U);
+        // FILE_SHARE_READ only: preexisting writers/deleters must fail closed.
+        SafeFileHandle handle = CreateFileW(path, access, 1U, IntPtr.Zero, 3U, flags, IntPtr.Zero);
+        if (handle.IsInvalid) { int error = Marshal.GetLastWin32Error(); handle.Dispose(); throw new Win32Exception(error); }
+        try
+        {
+            NativeInfo info = Inspect(handle, path, directory);
+            entries.Add(new Entry { Handle = handle, Path = path, Directory = directory, Volume = info.Volume, FileId = FileId(info) });
+        }
+        catch { handle.Dispose(); throw; }
+    }
+
+    private static ulong FileId(NativeInfo info) { return ((ulong)info.IndexHigh << 32) | info.IndexLow; }
+    private static bool SamePath(string left, string right)
+    {
+        return String.Equals(left.TrimEnd('\\'), right.TrimEnd('\\'), StringComparison.OrdinalIgnoreCase);
+    }
+    private static NativeInfo Inspect(SafeFileHandle handle, string expected, bool directory)
+    {
+        NativeInfo info;
+        if (!GetFileInformationByHandle(handle, out info)) throw new Win32Exception(Marshal.GetLastWin32Error());
+        if ((info.Attributes & 0x400U) != 0 || ((info.Attributes & 0x10U) != 0) != directory)
+            throw new IOException("Unsafe module path kind");
+        var value = new StringBuilder(512);
+        uint length = GetFinalPathNameByHandleW(handle, value, (uint)value.Capacity, 0);
+        if (length == 0) throw new Win32Exception(Marshal.GetLastWin32Error());
+        if (length >= value.Capacity)
+        {
+            value.Capacity = checked((int)length + 1);
+            length = GetFinalPathNameByHandleW(handle, value, (uint)value.Capacity, 0);
+            if (length == 0 || length >= value.Capacity) throw new IOException("Module final path unavailable");
+        }
+        string final = value.ToString();
+        if (final.StartsWith(@"\\?\UNC\", StringComparison.OrdinalIgnoreCase)) final = @"\\" + final.Substring(8);
+        else if (final.StartsWith(@"\\?\", StringComparison.OrdinalIgnoreCase)) final = final.Substring(4);
+        if (!SamePath(final, expected)) throw new IOException("Module final path mismatch");
+        return info;
+    }
+
+    public void Revalidate()
+    {
+        if (disposed) throw new ObjectDisposedException("trusted module import lease");
+        foreach (Entry entry in entries)
+        {
+            NativeInfo info = Inspect(entry.Handle, entry.Path, entry.Directory);
+            if (info.Volume != entry.Volume || FileId(info) != entry.FileId) throw new IOException("Module identity changed");
+        }
+    }
+    public void Dispose()
+    {
+        if (disposed) return;
+        disposed = true;
+        for (int index = entries.Count - 1; index >= 0; index--) entries[index].Handle.Dispose();
+        entries.Clear();
+    }
+}
+'@
+}
+
+function Open-CcodTrustedImportLease {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$ErrorId)
+    try {
+        Initialize-CcodTrustedImportLease
+        return [CcodTrustedImportLeaseV1]::Acquire($Path)
+    } catch {
+        throw [Management.Automation.ErrorRecord]::new(
+            [InvalidOperationException]::new('Trusted module import authority could not be acquired.'),
+            $ErrorId,[Management.Automation.ErrorCategory]::InvalidData,$Path)
+    }
+}
+# END CCOD TRUSTED IMPORT BOOTSTRAP
+
 function Initialize-CcodReleaseFileAuthority {
     if ($null -ne ('CcodReleaseFileAuthorityV1' -as [type])) { return }
     Add-Type -TypeDefinition @'
@@ -53,7 +200,7 @@ public static class CcodReleaseFileAuthorityV1
 
     public static SafeFileHandle OpenDirectory(string path,bool allowChildMutation)
     {
-        uint share=allowChildMutation?ShareRead|ShareWrite|ShareDelete:ShareRead;SafeFileHandle handle=CreateFileW(Path.GetFullPath(path),ListDirectory|ReadAttributes|Synchronize,share,IntPtr.Zero,OpenExisting,FlagBackup|FlagReparse,IntPtr.Zero);
+        uint share=allowChildMutation?ShareRead|ShareWrite:ShareRead;SafeFileHandle handle=CreateFileW(Path.GetFullPath(path),ListDirectory|ReadAttributes|Synchronize,share,IntPtr.Zero,OpenExisting,FlagBackup|FlagReparse,IntPtr.Zero);
         if(handle.IsInvalid){int error=Marshal.GetLastWin32Error();handle.Dispose();throw new Win32Exception(error);}return handle;
     }
 
@@ -73,6 +220,12 @@ public static class CcodReleaseFileAuthorityV1
         finally{if(unicodePointer!=IntPtr.Zero)Marshal.FreeHGlobal(unicodePointer);if(nameBuffer!=IntPtr.Zero)Marshal.FreeHGlobal(nameBuffer);if(added)directory.DangerousRelease();}
     }
 
+    public static FileStream OpenExclusiveOperationFile(string path)
+    {
+        SafeFileHandle handle=CreateFileW(Path.GetFullPath(path),GenericRead|GenericWrite|ReadAttributes|Synchronize,0U,IntPtr.Zero,4U,AttributeNormal|FlagReparse,IntPtr.Zero);
+        if(handle.IsInvalid){int error=Marshal.GetLastWin32Error();handle.Dispose();throw new Win32Exception(error);}try{return new FileStream(handle,FileAccess.ReadWrite,4096,false);}catch{handle.Dispose();throw;}
+    }
+
     public static FileStream OpenReadFile(string path,bool shareExistingWriter)
     {
         uint share=ShareRead|(shareExistingWriter?ShareWrite|ShareDelete:0U);SafeFileHandle handle=CreateFileW(path,GenericRead|ReadAttributes|Synchronize,share,IntPtr.Zero,OpenExisting,FlagReparse,IntPtr.Zero);
@@ -194,7 +347,7 @@ function Open-CcodReleaseFileAuthority {
     param([Parameter(Mandatory)]$Directory,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)][string]$ErrorId,[long]$MaximumBytes=536870912,[switch]$AllowZone,[switch]$ShareDelete)
     $stream=$null
     try{
-        if($null-eq$Directory-or$Directory.Closed-or$Directory.Kind-cne'Directory'-or$Leaf-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$'-or$Leaf.EndsWith('.')-or$Leaf.EndsWith(' ')){throw 'file leaf'}
+        if($null-eq$Directory-or$Directory.Closed-or$Directory.Kind-cne'Directory'-or$Leaf-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,255}\z'-or$Leaf.EndsWith('.')-or$Leaf.EndsWith(' ')){throw 'file leaf'}
         [void](Assert-CcodReleaseAuthorityCurrent -Authority $Directory -ErrorId $ErrorId)
         $path=Join-Path $Directory.Path $Leaf;$full=Assert-CcodReleaseContractPlainPath -Path $path -Directory $false -ErrorId $ErrorId
         $stream=[CcodReleaseFileAuthorityV1]::OpenReadFile($full,[bool]$ShareDelete);$identity=[CcodReleaseFileAuthorityV1]::Identity($stream.SafeFileHandle)
@@ -240,10 +393,10 @@ function Close-CcodReleaseAuthority {
 
 function Publish-CcodReleaseReceiptAuthority {
     param([Parameter(Mandatory)]$Directory,[Parameter(Mandatory)][string]$Leaf,[Parameter(Mandatory)][byte[]]$Bytes,[Parameter(Mandatory)][string]$ErrorId)
-    $stream=$null;$temporary=$null;$committed=$false
+    $stream=$null;$temporary=$null;$target=$null;$committed=$false
     try{
         [void](Assert-CcodReleaseAuthorityCurrent -Authority $Directory -ErrorId $ErrorId)
-        if($Leaf-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,255}\.json$'-or$Bytes.Length-lt1-or$Bytes.Length-gt65536){throw 'receipt input'}
+        if($Leaf-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._-]{0,255}\.json\z'-or$Bytes.Length-lt1-or$Bytes.Length-gt65536){throw 'receipt input'}
         $target=Join-Path $Directory.Path $Leaf;if([IO.File]::Exists($target)-or[IO.Directory]::Exists($target)){throw 'receipt exists'}
         $temporaryLeaf='.ccod-defender-receipt-'+[guid]::NewGuid().ToString('N')+'.tmp';$temporary=Join-Path $Directory.Path $temporaryLeaf;$stream=[CcodReleaseFileAuthorityV1]::CreateReceiptFileRelative($Directory.Handle,$temporaryLeaf);$stream.Write($Bytes,0,$Bytes.Length);$stream.Flush($true)
         $before=[CcodReleaseFileAuthorityV1]::Identity($stream.SafeFileHandle);if([CcodReleaseFileAuthorityV1]::IsDirectory($before)-or[CcodReleaseFileAuthorityV1]::IsReparse($before)-or$before.Links-ne1-or-not(Test-CcodReleaseAuthorityFinalPath $before.FinalPath $temporary)-or-not(Test-CcodReleaseAuthorityStreams $before)){throw 'temporary identity'}
@@ -252,14 +405,19 @@ function Publish-CcodReleaseReceiptAuthority {
         $sha=Get-CcodReleaseAuthorityStreamSha256 $stream;$result=[pscustomobject]@{Kind='File';Path=$target;Leaf=$Leaf;Stream=$stream;Identity=$after;Length=[long]$stream.Length;Sha256=$sha;AllowZone=$false;Closed=$false};$stream=$null;return $result
     }catch{
         $detail=$_.Exception.Message
-        if($null-ne$stream){if(-not$committed){try{[void][CcodReleaseFileAuthorityV1]::Delete($stream.SafeFileHandle)}catch{}};$stream.Dispose()}
+        $cleanupFailed=$false
+        if($null-ne$stream){
+            try{if([CcodReleaseFileAuthorityV1]::Delete($stream.SafeFileHandle)-ne0){$cleanupFailed=$true}}catch{$cleanupFailed=$true}
+            try{$stream.Dispose()}catch{$cleanupFailed=$true}
+        }
+        if($committed-and$null-ne$target-and($cleanupFailed-or[IO.File]::Exists($target)-or[IO.Directory]::Exists($target))){$detail+='; committed receipt cleanup could not be proven'}
         Throw-CcodReleaseContractError $ErrorId ('Defender receipt could not be durably published: '+$detail) $Leaf
     }
 }
 
 function Get-CcodExpectedReleaseAssetNames {
     [CmdletBinding()]
-    param([Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$Version)
+    param([Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+\z')][string]$Version)
     @(
         "CodexRemote-fix-$Version-windows-x64.zip",
         "CodexRemote-fix-$Version-windows-x64.zip.sha256.txt",
@@ -384,7 +542,7 @@ function Read-CcodReleaseContractJsonStringToken {
             if ($index -ge $Json.Length) { throw 'json escape' }
             $escape = $Json[$index]
             if ($escape -eq [char]117) {
-                if (($index+4) -ge $Json.Length -or $Json.Substring($index+1,4) -cnotmatch '^[0-9a-fA-F]{4}$') { throw 'json unicode escape' }
+                if (($index+4) -ge $Json.Length -or $Json.Substring($index+1,4) -cnotmatch '^[0-9a-fA-F]{4}\z') { throw 'json unicode escape' }
                 $index += 5
                 continue
             }
@@ -476,36 +634,36 @@ function Test-CcodReleaseContractTrayProvenance {
     param([string]$Path,[string]$Version,[string]$GitCommit,[string]$Timestamp,[string]$ErrorId)
     $record=(Read-CcodReleaseContractJson -Path $Path -ErrorId $ErrorId).Value
     $top='schemaVersion,product,version,gitCommit,buildTimestampUtc,targetFramework,compiler,referenceRoot,sourceFiles,iconSha256,manifestSha256,configSha256,artifactSha256,configArtifactSha256'
-    if((@($record.PSObject.Properties.Name)-join',')-cne$top-or$record.schemaVersion-isnot[int]-or$record.schemaVersion-ne1-or$record.product-cne'CodexRemote-fix'-or$record.version-cne$Version-or$record.gitCommit-cne$GitCommit-or$record.buildTimestampUtc-cne$Timestamp-or-not(Test-CcodReleaseContractCanonicalUtc $record.buildTimestampUtc)-or$record.targetFramework-cne'net48'-or$record.referenceRoot-cne'locked-net48'-or
-       $record.compiler-isnot[pscustomobject]-or(@($record.compiler.PSObject.Properties.Name)-join',')-cne'name,sha256'-or$record.compiler.name-cne'csc.exe'-or$record.compiler.sha256-cnotmatch'^[0-9a-f]{64}$'){
+    if((@($record.PSObject.Properties.Name)-join',')-cne$top-or-not(Test-CcodReleaseContractJsonInteger $record.schemaVersion 1)-or[long]$record.schemaVersion-ne1-or$record.product-isnot[string]-or$record.product-cne'CodexRemote-fix'-or$record.version-isnot[string]-or$record.version-cne$Version-or$record.gitCommit-isnot[string]-or$record.gitCommit-cne$GitCommit-or$record.buildTimestampUtc-isnot[string]-or$record.buildTimestampUtc-cne$Timestamp-or-not(Test-CcodReleaseContractCanonicalUtc $record.buildTimestampUtc)-or$record.targetFramework-isnot[string]-or$record.targetFramework-cne'net48'-or$record.referenceRoot-isnot[string]-or$record.referenceRoot-cne'locked-net48'-or
+       $record.compiler-isnot[pscustomobject]-or(@($record.compiler.PSObject.Properties.Name)-join',')-cne'name,sha256'-or$record.compiler.name-isnot[string]-or$record.compiler.name-cne'csc.exe'-or$record.compiler.sha256-isnot[string]-or$record.compiler.sha256-cnotmatch'^[0-9a-f]{64}\z'){
         Throw-CcodReleaseContractError $ErrorId 'TrayHost provenance schema or common identity is invalid.' $Path
     }
     $previous=$null;$seen=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
     foreach($source in @($record.sourceFiles)){
-        if($source-isnot[pscustomobject]-or(@($source.PSObject.Properties.Name)-join',')-cne'name,sha256'-or$source.name-isnot[string]-or$source.name-cnotmatch'^[A-Za-z0-9._-]{1,128}$'-or$source.sha256-isnot[string]-or$source.sha256-cnotmatch'^[0-9a-f]{64}$'-or-not$seen.Add([string]$source.name)-or($null-ne$previous-and[StringComparer]::Ordinal.Compare($previous,[string]$source.name)-ge0)){Throw-CcodReleaseContractError $ErrorId 'TrayHost provenance source records are malformed, duplicate, or unordered.' $Path};$previous=[string]$source.name
+        if($source-isnot[pscustomobject]-or(@($source.PSObject.Properties.Name)-join',')-cne'name,sha256'-or$source.name-isnot[string]-or$source.name-cnotmatch'^[A-Za-z0-9._-]{1,128}\z'-or$source.sha256-isnot[string]-or$source.sha256-cnotmatch'^[0-9a-f]{64}\z'-or-not$seen.Add([string]$source.name)-or($null-ne$previous-and[StringComparer]::Ordinal.Compare($previous,[string]$source.name)-ge0)){Throw-CcodReleaseContractError $ErrorId 'TrayHost provenance source records are malformed, duplicate, or unordered.' $Path};$previous=[string]$source.name
     }
     if($seen.Count-eq0){Throw-CcodReleaseContractError $ErrorId 'TrayHost provenance source records are empty.' $Path}
-    foreach($field in @('iconSha256','manifestSha256','configSha256','artifactSha256','configArtifactSha256')){if($record.$field-isnot[string]-or$record.$field-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodReleaseContractError $ErrorId 'TrayHost provenance hashes are malformed.' $Path}}
+    foreach($field in @('iconSha256','manifestSha256','configSha256','artifactSha256','configArtifactSha256')){if($record.$field-isnot[string]-or$record.$field-cnotmatch'^[0-9a-f]{64}\z'){Throw-CcodReleaseContractError $ErrorId 'TrayHost provenance hashes are malformed.' $Path}}
     return $record
 }
 
 function Test-CcodReleaseContractInventory {
     param([string]$Path,[string]$ErrorId)
-    try{$text=[IO.File]::ReadAllText($Path,[Text.UTF8Encoding]::new($false,$true));if($text.Length-lt70-or$text.Length-gt1048576){throw 'inventory bounds'};$lines=@($text-split'\r?\n');while($lines.Count-gt0-and$lines[-1]-ceq''){$lines=$lines[0..($lines.Count-2)]};if($lines.Count-lt3-or$lines[0]-cne'procedure AddCcodExpectedSetupDirectories(Directories: TStrings);'-or$lines[1]-cne'begin'-or$lines[-1]-cne'end;'){throw 'inventory frame'};$previous=$null;$seen=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal);for($index=2;$index-lt$lines.Count-1;$index++){if($lines[$index]-cnotmatch"^  Directories\.Add\('(?<path>[A-Za-z0-9._-]+(?:\\[A-Za-z0-9._-]+)*)'\);$"){throw 'inventory line'};$value=[string]$Matches.path;if(-not$seen.Add($value)-or($null-ne$previous-and[StringComparer]::Ordinal.Compare($previous,$value)-ge0)){throw 'inventory order'};$previous=$value};return $text}catch{Throw-CcodReleaseContractError $ErrorId 'Setup destination inventory is not the exact generated grammar.' $Path}
+    try{$text=[IO.File]::ReadAllText($Path,[Text.UTF8Encoding]::new($false,$true));if($text.Length-lt70-or$text.Length-gt1048576){throw 'inventory bounds'};$lines=@($text-split'\r?\n');while($lines.Count-gt0-and$lines[-1]-ceq''){$lines=$lines[0..($lines.Count-2)]};if($lines.Count-lt3-or$lines[0]-cne'procedure AddCcodExpectedSetupDirectories(Directories: TStrings);'-or$lines[1]-cne'begin'-or$lines[-1]-cne'end;'){throw 'inventory frame'};$previous=$null;$seen=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal);for($index=2;$index-lt$lines.Count-1;$index++){if($lines[$index]-cnotmatch"^  Directories\.Add\('(?<path>[A-Za-z0-9._-]+(?:\\[A-Za-z0-9._-]+)*)'\);\z"){throw 'inventory line'};$value=[string]$Matches.path;if(-not$seen.Add($value)-or($null-ne$previous-and[StringComparer]::Ordinal.Compare($previous,$value)-ge0)){throw 'inventory order'};$previous=$value};return $text}catch{Throw-CcodReleaseContractError $ErrorId 'Setup destination inventory is not the exact generated grammar.' $Path}
 }
 
 function Test-CcodReleasePortableManifestDeep {
     param($Manifest,[string]$ManifestRaw,[string]$ManifestPath,[string]$Directory,[string]$Version,[string]$ErrorId)
     $names=@(Get-CcodExpectedReleaseAssetNames -Version $Version);$expected=@($names[0],$names[1],$names[2],$names[3],'CodexRemote-fix.exe','CodexRemote-fix.exe.config')
-    if((@($Manifest.PSObject.Properties.Name)-join',')-cne'schemaVersion,product,version,gitCommit,buildTimestampUtc,distribution,assets'-or$Manifest.schemaVersion-isnot[int]-or$Manifest.schemaVersion-ne2-or$Manifest.product-cne'CodexRemote-fix'-or$Manifest.version-cne$Version-or$Manifest.gitCommit-isnot[string]-or$Manifest.gitCommit-cnotmatch'^[0-9a-f]{40}$'-or-not(Test-CcodReleaseContractCanonicalUtc $Manifest.buildTimestampUtc)-or$Manifest.distribution-cne'portable-zip'){Throw-CcodReleaseContractError $ErrorId 'Portable release manifest metadata is invalid.' $ManifestPath}
+    if((@($Manifest.PSObject.Properties.Name)-join',')-cne'schemaVersion,product,version,gitCommit,buildTimestampUtc,distribution,assets'-or-not(Test-CcodReleaseContractJsonInteger $Manifest.schemaVersion 2)-or[long]$Manifest.schemaVersion-ne2-or$Manifest.product-isnot[string]-or$Manifest.product-cne'CodexRemote-fix'-or$Manifest.version-isnot[string]-or$Manifest.version-cne$Version-or$Manifest.gitCommit-isnot[string]-or$Manifest.gitCommit-cnotmatch'^[0-9a-f]{40}\z'-or-not(Test-CcodReleaseContractCanonicalUtc $Manifest.buildTimestampUtc)-or$Manifest.distribution-isnot[string]-or$Manifest.distribution-cne'portable-zip'){Throw-CcodReleaseContractError $ErrorId 'Portable release manifest metadata is invalid.' $ManifestPath}
     $map=Get-CcodReleaseContractManifestMap -Manifest $Manifest -ExpectedNames $expected -ErrorId $ErrorId -Target $ManifestPath
     foreach($name in $expected[0..3]){if((Get-CcodReleaseContractHash (Join-Path $Directory $name))-cne$map[$name]){Throw-CcodReleaseContractError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Portable public asset hash mismatch.' $name}}
     $checksum=[IO.File]::ReadAllText((Join-Path $Directory $names[1]),[Text.UTF8Encoding]::new($false,$true)).TrimEnd("`r","`n");if($checksum-cne("$($map[$names[0]]) *$($names[0])")){Throw-CcodReleaseContractError $ErrorId 'Portable checksum is invalid.' $names[1]}
     [void](Test-CcodReleaseContractTrayProvenance -Path (Join-Path $Directory $names[2]) -Version $Version -GitCommit $Manifest.gitCommit -Timestamp $Manifest.buildTimestampUtc -ErrorId $ErrorId)
     $payloadPath=Join-Path $Directory $names[3];$payload=(Read-CcodReleaseContractJson -Path $payloadPath -ErrorId $ErrorId).Value
-    if((@($payload.PSObject.Properties.Name)-join',')-cne'schemaVersion,product,version,gitCommit,buildTimestampUtc,files'-or$payload.schemaVersion-isnot[int]-or$payload.schemaVersion-ne1-or$payload.product-cne'CodexRemote-fix'-or$payload.version-cne$Version-or$payload.gitCommit-cne$Manifest.gitCommit-or$payload.buildTimestampUtc-cne$Manifest.buildTimestampUtc){Throw-CcodReleaseContractError $ErrorId 'Portable payload manifest metadata is invalid.' $payloadPath}
+    if((@($payload.PSObject.Properties.Name)-join',')-cne'schemaVersion,product,version,gitCommit,buildTimestampUtc,files'-or-not(Test-CcodReleaseContractJsonInteger $payload.schemaVersion 1)-or[long]$payload.schemaVersion-ne1-or$payload.product-isnot[string]-or$payload.product-cne'CodexRemote-fix'-or$payload.version-isnot[string]-or$payload.version-cne$Version-or$payload.gitCommit-isnot[string]-or$payload.gitCommit-cne$Manifest.gitCommit-or$payload.buildTimestampUtc-isnot[string]-or$payload.buildTimestampUtc-cne$Manifest.buildTimestampUtc){Throw-CcodReleaseContractError $ErrorId 'Portable payload manifest metadata is invalid.' $payloadPath}
     $fileRecords=[Collections.Generic.Dictionary[string,object]]::new([StringComparer]::Ordinal);$previous=$null
-    foreach($record in @($payload.files)){if($record-isnot[pscustomobject]-or(@($record.PSObject.Properties.Name)-join',')-cne'path,length,sha256'-or$record.path-isnot[string]-or$record.path-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$'-or$record.path.Contains('//')-or$record.path.Contains(':')-or$record.path-match'(^|/)\.\.?(?:/|$)'-or($record.length-isnot[int]-and$record.length-isnot[long])-or[long]$record.length-lt0-or$record.sha256-isnot[string]-or$record.sha256-cnotmatch'^[0-9a-f]{64}$'-or$fileRecords.ContainsKey([string]$record.path)-or($null-ne$previous-and[StringComparer]::Ordinal.Compare($previous,[string]$record.path)-ge0)){Throw-CcodReleaseContractError $ErrorId 'Portable payload records are malformed, duplicate, or unordered.' $payloadPath};$fileRecords.Add([string]$record.path,$record);$previous=[string]$record.path}
+    foreach($record in @($payload.files)){if($record-isnot[pscustomobject]-or(@($record.PSObject.Properties.Name)-join',')-cne'path,length,sha256'-or$record.path-isnot[string]-or$record.path-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}\z'-or$record.path.Contains('//')-or$record.path.Contains(':')-or$record.path-match'(^|/)\.\.?(?:/|$)'-or($record.length-isnot[int]-and$record.length-isnot[long])-or[long]$record.length-lt0-or$record.sha256-isnot[string]-or$record.sha256-cnotmatch'^[0-9a-f]{64}\z'-or$fileRecords.ContainsKey([string]$record.path)-or($null-ne$previous-and[StringComparer]::Ordinal.Compare($previous,[string]$record.path)-ge0)){Throw-CcodReleaseContractError $ErrorId 'Portable payload records are malformed, duplicate, or unordered.' $payloadPath};$fileRecords.Add([string]$record.path,$record);$previous=[string]$record.path}
     if($fileRecords.Count-eq0){Throw-CcodReleaseContractError $ErrorId 'Portable payload manifest is empty.' $payloadPath}
     Add-Type -AssemblyName System.IO.Compression.FileSystem -ErrorAction Stop;$archive=$null
     try{
@@ -523,33 +681,47 @@ function Test-CcodReleasePortableManifestDeep {
 function Test-CcodReleaseSetupManifestDeep {
     param($Manifest,[string]$ManifestPath,[string]$Directory,[string]$Version,[string]$ErrorId)
     $names=@(Get-CcodExpectedReleaseAssetNames -Version $Version);$expected=@($names[5],$names[6],$names[2],$names[7],$names[8],$names[9])
-    if((@($Manifest.PSObject.Properties.Name)-join',')-cne'schemaVersion,product,version,gitCommit,buildTimestampUtc,assets'-or$Manifest.schemaVersion-isnot[int]-or$Manifest.schemaVersion-ne1-or$Manifest.product-cne'CodexRemote-fix'-or$Manifest.version-cne$Version-or$Manifest.gitCommit-isnot[string]-or$Manifest.gitCommit-cnotmatch'^[0-9a-f]{40}$'-or-not(Test-CcodReleaseContractCanonicalUtc $Manifest.buildTimestampUtc)){Throw-CcodReleaseContractError $ErrorId 'Setup release manifest metadata is invalid.' $ManifestPath}
+    if((@($Manifest.PSObject.Properties.Name)-join',')-cne'schemaVersion,product,version,gitCommit,buildTimestampUtc,assets'-or-not(Test-CcodReleaseContractJsonInteger $Manifest.schemaVersion 1)-or[long]$Manifest.schemaVersion-ne1-or$Manifest.product-isnot[string]-or$Manifest.product-cne'CodexRemote-fix'-or$Manifest.version-isnot[string]-or$Manifest.version-cne$Version-or$Manifest.gitCommit-isnot[string]-or$Manifest.gitCommit-cnotmatch'^[0-9a-f]{40}\z'-or-not(Test-CcodReleaseContractCanonicalUtc $Manifest.buildTimestampUtc)){Throw-CcodReleaseContractError $ErrorId 'Setup release manifest metadata is invalid.' $ManifestPath}
     $map=Get-CcodReleaseContractManifestMap -Manifest $Manifest -ExpectedNames $expected -ErrorId $ErrorId -Target $ManifestPath;foreach($name in $expected){if((Get-CcodReleaseContractHash (Join-Path $Directory $name))-cne$map[$name]){Throw-CcodReleaseContractError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Setup public asset hash mismatch.' $name}}
     $checksum=[IO.File]::ReadAllText((Join-Path $Directory $names[6]),[Text.UTF8Encoding]::new($false,$true)).TrimEnd("`r","`n");if($checksum-cne("$($map[$names[5]]) *$($names[5])")){Throw-CcodReleaseContractError $ErrorId 'Setup checksum is invalid.' $names[6]}
     [void](Test-CcodReleaseContractTrayProvenance -Path (Join-Path $Directory $names[2]) -Version $Version -GitCommit $Manifest.gitCommit -Timestamp $Manifest.buildTimestampUtc -ErrorId $ErrorId)
     $packageManifestPath=Join-Path $Directory $names[8];$package=(Read-CcodReleaseContractJson -Path $packageManifestPath -ErrorId $ErrorId).Value
-    if((@($package.PSObject.Properties.Name)-join',')-cne'schemaVersion,product,version,gitCommit,payloadManifest,files'-or$package.schemaVersion-isnot[int]-or$package.schemaVersion-ne1-or$package.product-cne'CodexRemote-fix'-or$package.version-cne$Version-or$package.gitCommit-cne$Manifest.gitCommit-or$package.payloadManifest-isnot[pscustomobject]-or(@($package.payloadManifest.PSObject.Properties.Name)-join',')-cne'name,length,sha256'-or$package.payloadManifest.name-cne'installer-payload.manifest.json'-or($package.payloadManifest.length-isnot[int]-and$package.payloadManifest.length-isnot[long])-or[long]$package.payloadManifest.length-lt1-or$package.payloadManifest.sha256-cnotmatch'^[0-9a-f]{64}$'){Throw-CcodReleaseContractError $ErrorId 'Setup package manifest nested payload binding is invalid.' $packageManifestPath}
-    $previous=$null;$seen=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal);foreach($file in @($package.files)){if($file-isnot[pscustomobject]-or(@($file.PSObject.Properties.Name)-join',')-cne'path,length,sha256'-or$file.path-isnot[string]-or$file.path-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$'-or$file.path-cmatch'(^|/)\.\.?(?:/|$)|:'-or($file.length-isnot[int]-and$file.length-isnot[long])-or[long]$file.length-lt0-or$file.sha256-cnotmatch'^[0-9a-f]{64}$'-or-not$seen.Add([string]$file.path)-or($null-ne$previous-and[StringComparer]::Ordinal.Compare($previous,[string]$file.path)-ge0)){Throw-CcodReleaseContractError $ErrorId 'Setup package manifest files are malformed, duplicate, or unordered.' $packageManifestPath};$previous=[string]$file.path};if($seen.Count-eq0){Throw-CcodReleaseContractError $ErrorId 'Setup package manifest files are empty.' $packageManifestPath}
+    if((@($package.PSObject.Properties.Name)-join',')-cne'schemaVersion,product,version,gitCommit,payloadManifest,files'-or-not(Test-CcodReleaseContractJsonInteger $package.schemaVersion 1)-or[long]$package.schemaVersion-ne1-or$package.product-isnot[string]-or$package.product-cne'CodexRemote-fix'-or$package.version-isnot[string]-or$package.version-cne$Version-or$package.gitCommit-isnot[string]-or$package.gitCommit-cne$Manifest.gitCommit-or$package.payloadManifest-isnot[pscustomobject]-or(@($package.payloadManifest.PSObject.Properties.Name)-join',')-cne'name,length,sha256'-or$package.payloadManifest.name-isnot[string]-or$package.payloadManifest.name-cne'installer-payload.manifest.json'-or($package.payloadManifest.length-isnot[int]-and$package.payloadManifest.length-isnot[long])-or[long]$package.payloadManifest.length-lt1-or$package.payloadManifest.sha256-isnot[string]-or$package.payloadManifest.sha256-cnotmatch'^[0-9a-f]{64}\z'){Throw-CcodReleaseContractError $ErrorId 'Setup package manifest nested payload binding is invalid.' $packageManifestPath}
+    $previous=$null;$seen=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal);foreach($file in @($package.files)){if($file-isnot[pscustomobject]-or(@($file.PSObject.Properties.Name)-join',')-cne'path,length,sha256'-or$file.path-isnot[string]-or$file.path-cnotmatch'^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}\z'-or$file.path-cmatch'(^|/)\.\.?(?:/|$)|:'-or($file.length-isnot[int]-and$file.length-isnot[long])-or[long]$file.length-lt0-or$file.sha256-isnot[string]-or$file.sha256-cnotmatch'^[0-9a-f]{64}\z'-or-not$seen.Add([string]$file.path)-or($null-ne$previous-and[StringComparer]::Ordinal.Compare($previous,[string]$file.path)-ge0)){Throw-CcodReleaseContractError $ErrorId 'Setup package manifest files are malformed, duplicate, or unordered.' $packageManifestPath};$previous=[string]$file.path};if($seen.Count-eq0){Throw-CcodReleaseContractError $ErrorId 'Setup package manifest files are empty.' $packageManifestPath}
     $provenancePath=Join-Path $Directory $names[7];$provenance=(Read-CcodReleaseContractJson -Path $provenancePath -ErrorId $ErrorId).Value;$top='schemaVersion,product,version,gitCommit,buildTimestampUtc,installerPackage,installerPackageManifest,activationBootstrap,buildInputs,peContract'
     $artifactFields='name,length,sha256';$manifestFields='name,length,sha256,fileCount,payloadManifestSha256';$buildFields='innoTemplateSha256,destinationInventorySha256,compilerSha256,compilerFileVersion';$peFields='fileVersion,packageManifestFirst,packageManifestLast,bootstrapFirst,bootstrapLast,companyName,legalCopyright'
-    if((@($provenance.PSObject.Properties.Name)-join',')-cne$top-or$provenance.schemaVersion-isnot[int]-or$provenance.schemaVersion-ne2-or$provenance.product-cne'CodexRemote-fix'-or$provenance.version-cne$Version-or$provenance.gitCommit-cne$Manifest.gitCommit-or$provenance.buildTimestampUtc-cne$Manifest.buildTimestampUtc-or
+    if((@($provenance.PSObject.Properties.Name)-join',')-cne$top-or-not(Test-CcodReleaseContractJsonInteger $provenance.schemaVersion 2)-or[long]$provenance.schemaVersion-ne2-or$provenance.product-isnot[string]-or$provenance.product-cne'CodexRemote-fix'-or$provenance.version-isnot[string]-or$provenance.version-cne$Version-or$provenance.gitCommit-isnot[string]-or$provenance.gitCommit-cne$Manifest.gitCommit-or$provenance.buildTimestampUtc-isnot[string]-or$provenance.buildTimestampUtc-cne$Manifest.buildTimestampUtc-or
        (@($provenance.installerPackage.PSObject.Properties.Name)-join',')-cne$artifactFields-or(@($provenance.installerPackageManifest.PSObject.Properties.Name)-join',')-cne$manifestFields-or(@($provenance.activationBootstrap.PSObject.Properties.Name)-join',')-cne$artifactFields-or(@($provenance.buildInputs.PSObject.Properties.Name)-join',')-cne$buildFields-or(@($provenance.peContract.PSObject.Properties.Name)-join',')-cne$peFields){Throw-CcodReleaseContractError $ErrorId 'Setup provenance nested property schema is invalid.' $provenancePath}
+    foreach($artifact in @($provenance.installerPackage,$provenance.installerPackageManifest,$provenance.activationBootstrap)){
+        if($artifact.name-isnot[string]-or$artifact.length-isnot[int]-and$artifact.length-isnot[long]-or$artifact.sha256-isnot[string]){Throw-CcodReleaseContractError $ErrorId 'Setup provenance artifact scalar types are invalid.' $provenancePath}
+    }
+    if($provenance.installerPackageManifest.fileCount-isnot[int]-and$provenance.installerPackageManifest.fileCount-isnot[long]-or$provenance.installerPackageManifest.payloadManifestSha256-isnot[string]){Throw-CcodReleaseContractError $ErrorId 'Setup provenance manifest scalar types are invalid.' $provenancePath}
+    foreach($name in @('innoTemplateSha256','destinationInventorySha256','compilerSha256')){if($provenance.buildInputs.$name-isnot[string]){Throw-CcodReleaseContractError $ErrorId 'Setup provenance build hash type is invalid.' $provenancePath}}
+    foreach($name in @('compilerFileVersion')){if($provenance.buildInputs.$name-isnot[string]){Throw-CcodReleaseContractError $ErrorId 'Setup provenance build version type is invalid.' $provenancePath}}
+    foreach($name in @('fileVersion','packageManifestFirst','packageManifestLast','bootstrapFirst','bootstrapLast','companyName','legalCopyright')){if($provenance.peContract.$name-isnot[string]){Throw-CcodReleaseContractError $ErrorId 'Setup provenance PE scalar type is invalid.' $provenancePath}}
     $packageManifestHash=Get-CcodReleaseContractHash $packageManifestPath;$inventoryPath=Join-Path $Directory $names[9];[void](Test-CcodReleaseContractInventory $inventoryPath $ErrorId)
-    if($provenance.installerPackage.name-cne'installer-package.zip'-or$provenance.installerPackage.length-isnot[long]-and$provenance.installerPackage.length-isnot[int]-or[long]$provenance.installerPackage.length-lt1-or$provenance.installerPackage.sha256-cnotmatch'^[0-9a-f]{64}$'-or
-       $provenance.installerPackageManifest.name-cne'installer-package.manifest.json'-or[long]$provenance.installerPackageManifest.length-ne[long](Get-Item $packageManifestPath -Force).Length-or$provenance.installerPackageManifest.sha256-cne$packageManifestHash-or$provenance.installerPackageManifest.fileCount-isnot[int]-or$provenance.installerPackageManifest.fileCount-ne@($package.files).Count-or$provenance.installerPackageManifest.payloadManifestSha256-cne$package.payloadManifest.sha256-or
-       $provenance.activationBootstrap.name-cne'Activate-CcodRemoteFix.ps1'-or[long]$provenance.activationBootstrap.length-lt1-or$provenance.activationBootstrap.sha256-cnotmatch'^[0-9a-f]{64}$'-or$provenance.buildInputs.innoTemplateSha256-cnotmatch'^[0-9a-f]{64}$'-or$provenance.buildInputs.destinationInventorySha256-cne(Get-CcodReleaseContractHash $inventoryPath)-or$provenance.buildInputs.compilerSha256-cnotmatch'^[0-9a-f]{64}$'-or[string]::IsNullOrWhiteSpace([string]$provenance.buildInputs.compilerFileVersion)-or
+    if($provenance.installerPackage.name-cne'installer-package.zip'-or$provenance.installerPackage.length-isnot[long]-and$provenance.installerPackage.length-isnot[int]-or[long]$provenance.installerPackage.length-lt1-or$provenance.installerPackage.sha256-cnotmatch'^[0-9a-f]{64}\z'-or
+       $provenance.installerPackageManifest.name-cne'installer-package.manifest.json'-or[long]$provenance.installerPackageManifest.length-ne[long](Get-Item $packageManifestPath -Force).Length-or$provenance.installerPackageManifest.sha256-cne$packageManifestHash-or-not(Test-CcodReleaseContractJsonInteger $provenance.installerPackageManifest.fileCount 0)-or[long]$provenance.installerPackageManifest.fileCount-ne@($package.files).Count-or$provenance.installerPackageManifest.payloadManifestSha256-cne$package.payloadManifest.sha256-or
+       $provenance.activationBootstrap.name-cne'Activate-CcodRemoteFix.ps1'-or[long]$provenance.activationBootstrap.length-lt1-or$provenance.activationBootstrap.sha256-cnotmatch'^[0-9a-f]{64}\z'-or$provenance.buildInputs.innoTemplateSha256-cnotmatch'^[0-9a-f]{64}\z'-or$provenance.buildInputs.destinationInventorySha256-cne(Get-CcodReleaseContractHash $inventoryPath)-or$provenance.buildInputs.compilerSha256-cnotmatch'^[0-9a-f]{64}\z'-or[string]::IsNullOrWhiteSpace([string]$provenance.buildInputs.compilerFileVersion)-or
        $provenance.peContract.fileVersion-cne"$Version.0"-or$provenance.peContract.packageManifestFirst-cne$packageManifestHash.Substring(0,32)-or$provenance.peContract.packageManifestLast-cne$packageManifestHash.Substring(32,32)-or$provenance.peContract.bootstrapFirst-cne$provenance.activationBootstrap.sha256.Substring(0,32)-or$provenance.peContract.bootstrapLast-cne$provenance.activationBootstrap.sha256.Substring(32,32)-or$provenance.peContract.companyName-cne$Manifest.gitCommit-or$provenance.peContract.legalCopyright-cne$provenance.installerPackage.sha256){Throw-CcodReleaseContractError $ErrorId 'Setup provenance values do not bind package manifest, inventory, PE, and common identity.' $provenancePath}
-    $setupModule=Join-Path (Split-Path $PSScriptRoot -Parent) 'build\SetupArtifact.psm1';Import-Module $setupModule -Force -ErrorAction Stop
+    $setupModule=Join-Path (Split-Path $PSScriptRoot -Parent) 'build\SetupArtifact.psm1'
+    $setupLease = Open-CcodTrustedImportLease -Path $setupModule -ErrorId $ErrorId
+    try {
+        $setupModule = Assert-CcodReleaseContractPlainPath -Path $setupModule -Directory $false -ErrorId $ErrorId
+        $setupLease.Revalidate()
+        Import-Module $setupModule -Force -ErrorAction Stop
+        $setupLease.Revalidate()
+    } finally { $setupLease.Dispose() }
     try{$setup=Test-CcodSetupArtifact -SetupPath (Join-Path $Directory $names[5]) -ExpectedVersion $Version -ExpectedGitCommit $Manifest.gitCommit -ExpectedPackageSha256 $provenance.installerPackage.sha256 -ExpectedPackageManifestSha256 $packageManifestHash -ExpectedActivationBootstrapSha256 $provenance.activationBootstrap.sha256}catch{Throw-CcodReleaseContractError $ErrorId 'Setup PE does not bind its nested provenance.' $names[5]}
     return [pscustomobject][ordered]@{Valid=$true;Version=$Version;GitCommit=[string]$Manifest.gitCommit;BuildTimestampUtc=[string]$Manifest.buildTimestampUtc;InstallerSha256=[string]$map[$names[5]];InstallerName=$names[5];PackageManifestSha256=$packageManifestHash;SetupProvenanceName=$names[7];SetupPayloadInputName=$names[8];SetupInventoryInputName=$names[9]}
 }
 
 function Test-CcodReleaseAssetManifest {
     [CmdletBinding()]
-    param([Parameter(Mandatory)][string]$ManifestPath,[Parameter(Mandatory)][string]$AssetDirectory,[Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion)
+    param([Parameter(Mandatory)][string]$ManifestPath,[Parameter(Mandatory)][string]$AssetDirectory,[Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+\z')][string]$ExpectedVersion)
     $errorId='CCOD_RELEASE_MANIFEST_INVALID';$directory=Assert-CcodReleaseContractPlainPath -Path $AssetDirectory -Directory $true -ErrorId $errorId;$manifestFile=Assert-CcodReleaseContractPlainPath -Path $ManifestPath -Directory $false -ErrorId $errorId;$json=Read-CcodReleaseContractJson -Path $manifestFile -ErrorId $errorId;$manifest=$json.Value
-    if($manifest.schemaVersion-is[int]-and$manifest.schemaVersion-eq2){return Test-CcodReleasePortableManifestDeep -Manifest $manifest -ManifestRaw $json.Raw -ManifestPath $manifestFile -Directory $directory -Version $ExpectedVersion -ErrorId $errorId}
-    if($manifest.schemaVersion-is[int]-and$manifest.schemaVersion-eq1){return Test-CcodReleaseSetupManifestDeep -Manifest $manifest -ManifestPath $manifestFile -Directory $directory -Version $ExpectedVersion -ErrorId $errorId}
+    if((Test-CcodReleaseContractJsonInteger $manifest.schemaVersion 2)-and[long]$manifest.schemaVersion-eq2){return Test-CcodReleasePortableManifestDeep -Manifest $manifest -ManifestRaw $json.Raw -ManifestPath $manifestFile -Directory $directory -Version $ExpectedVersion -ErrorId $errorId}
+    if((Test-CcodReleaseContractJsonInteger $manifest.schemaVersion 1)-and[long]$manifest.schemaVersion-eq1){return Test-CcodReleaseSetupManifestDeep -Manifest $manifest -ManifestPath $manifestFile -Directory $directory -Version $ExpectedVersion -ErrorId $errorId}
     Throw-CcodReleaseContractError $errorId 'Release manifest schema is unsupported.' $manifestFile
 }
 
@@ -582,7 +754,7 @@ function Get-CcodReleaseContractManifestMap {
         if ($null -eq $record -or $record -isnot [pscustomobject] -or
             (@($record.PSObject.Properties.Name) -join ',') -cne 'name,sha256' -or
             $record.name -isnot [string] -or $record.name -cne $ExpectedNames[$index] -or
-            $record.sha256 -isnot [string] -or $record.sha256 -cnotmatch '^[0-9a-f]{64}$' -or
+            $record.sha256 -isnot [string] -or $record.sha256 -cnotmatch '^[0-9a-f]{64}\z' -or
             $map.ContainsKey([string]$record.name)) {
             Throw-CcodReleaseContractError $ErrorId 'Release manifest asset records are malformed, duplicated, or out of order.' $Target
         }
@@ -595,7 +767,7 @@ function Test-CcodExactReleaseAssetSet {
     [CmdletBinding()]
     param(
         [Parameter(Mandatory)][string]$AssetDirectory,
-        [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$Version
+        [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+\z')][string]$Version
     )
     $errorId = 'CCOD_RELEASE_ASSET_SET_INVALID'
     $authority=Open-CcodExactReleaseAssetAuthority -AssetDirectory $AssetDirectory -Version $Version -ErrorId $errorId
@@ -630,14 +802,14 @@ function Test-CcodExactReleaseAssetSet {
     $setupJson = Read-CcodReleaseContractJson -Path $setupPath -ErrorId $errorId
     $portable = $portableJson.Value; $setup = $setupJson.Value
     if ((@($portable.PSObject.Properties.Name) -join ',') -cne 'schemaVersion,product,version,gitCommit,buildTimestampUtc,distribution,assets' -or
-        $portable.schemaVersion -isnot [int] -or $portable.schemaVersion -ne 2 -or $portable.product -cne 'CodexRemote-fix' -or
-        $portable.version -cne $Version -or $portable.gitCommit -isnot [string] -or $portable.gitCommit -cnotmatch '^[0-9a-f]{40}$' -or
+        -not (Test-CcodReleaseContractJsonInteger $portable.schemaVersion 2) -or [long]$portable.schemaVersion -ne 2 -or $portable.product -isnot [string] -or $portable.product -cne 'CodexRemote-fix' -or
+        $portable.version -isnot [string] -or $portable.version -cne $Version -or $portable.gitCommit -isnot [string] -or $portable.gitCommit -cnotmatch '^[0-9a-f]{40}\z' -or
         -not (Test-CcodReleaseContractCanonicalUtc $portable.buildTimestampUtc) -or $portable.distribution -cne 'portable-zip') {
         Throw-CcodReleaseContractError $errorId 'Portable release manifest metadata is not exact.' $portablePath
     }
     if ((@($setup.PSObject.Properties.Name) -join ',') -cne 'schemaVersion,product,version,gitCommit,buildTimestampUtc,assets' -or
-        $setup.schemaVersion -isnot [int] -or $setup.schemaVersion -ne 1 -or $setup.product -cne 'CodexRemote-fix' -or
-        $setup.version -cne $Version -or $setup.gitCommit -isnot [string] -or $setup.gitCommit -cne $portable.gitCommit -or
+        -not (Test-CcodReleaseContractJsonInteger $setup.schemaVersion 1) -or [long]$setup.schemaVersion -ne 1 -or $setup.product -isnot [string] -or $setup.product -cne 'CodexRemote-fix' -or
+        $setup.version -isnot [string] -or $setup.version -cne $Version -or $setup.gitCommit -isnot [string] -or $setup.gitCommit -cne $portable.gitCommit -or
         -not (Test-CcodReleaseContractCanonicalUtc $setup.buildTimestampUtc) -or $setup.buildTimestampUtc -cne $portable.buildTimestampUtc) {
         Throw-CcodReleaseContractError $errorId 'Setup release manifest metadata is not exact or does not share provenance.' $setupPath
     }
@@ -679,7 +851,7 @@ function Get-CcodReleasePromotionReceiptNames {
 }
 
 function Test-CcodReleasePromotionReceipt {
-    param($Receipt,[string]$Raw,[string]$Path,[string]$AssetType,[string]$Version,[string]$GitCommit,[string[]]$AssetNames)
+    param($Receipt,[string]$Raw,[string]$Path,[string]$AssetType,[string]$Version,[string]$GitCommit,[string[]]$AssetNames,[datetime]$NowUtc = [datetime]::UtcNow)
     $errorId = 'CCOD_RELEASE_PROMOTION_EVIDENCE_INVALID'
     if ((@($Receipt.PSObject.Properties.Name) -join ',') -cne ($script:CcodReleaseReceiptFields -join ',')) { Throw-CcodReleaseContractError $errorId 'Defender receipt fields or order are not exact.' $Path }
     foreach ($field in $script:CcodReleaseReceiptFields) {
@@ -689,18 +861,18 @@ function Test-CcodReleasePromotionReceipt {
     $expectedAsset = if ($setup) { $AssetNames[5] } else { $AssetNames[0] }
     $expectedChecksum = if ($setup) { $AssetNames[6] } else { $AssetNames[1] }
     $expectedManifest = if ($setup) { $AssetNames[10] } else { $AssetNames[4] }
-    if ($Receipt.schemaVersion -isnot [int] -or $Receipt.schemaVersion -ne 2 -or
+    if (-not (Test-CcodReleaseContractJsonInteger $Receipt.schemaVersion 2) -or [long]$Receipt.schemaVersion -ne 2 -or
         $Receipt.assetType -isnot [string] -or $Receipt.assetType -cne $AssetType -or
         $Receipt.assetName -isnot [string] -or $Receipt.assetName -cne $expectedAsset -or
-        $Receipt.assetSha256 -isnot [string] -or $Receipt.assetSha256 -cnotmatch '^[0-9a-f]{64}$' -or
+        $Receipt.assetSha256 -isnot [string] -or $Receipt.assetSha256 -cnotmatch '^[0-9a-f]{64}\z' -or
         $Receipt.checksumName -isnot [string] -or $Receipt.checksumName -cne $expectedChecksum -or
-        $Receipt.checksumSha256 -isnot [string] -or $Receipt.checksumSha256 -cnotmatch '^[0-9a-f]{64}$' -or
+        $Receipt.checksumSha256 -isnot [string] -or $Receipt.checksumSha256 -cnotmatch '^[0-9a-f]{64}\z' -or
         $Receipt.manifestName -isnot [string] -or $Receipt.manifestName -cne $expectedManifest -or
-        $Receipt.manifestSha256 -isnot [string] -or $Receipt.manifestSha256 -cnotmatch '^[0-9a-f]{64}$' -or
+        $Receipt.manifestSha256 -isnot [string] -or $Receipt.manifestSha256 -cnotmatch '^[0-9a-f]{64}\z' -or
         $Receipt.version -isnot [string] -or $Receipt.version -cne $Version -or
         $Receipt.gitCommit -isnot [string] -or $Receipt.gitCommit -cne $GitCommit -or
         $Receipt.origin -isnot [string] -or $Receipt.origin -cne 'InternetDownload' -or
-        $null -ne $Receipt.workflowArtifactIdentity -or $Receipt.zoneId -isnot [int] -or $Receipt.zoneId -ne 3 -or
+        $null -ne $Receipt.workflowArtifactIdentity -or -not (Test-CcodReleaseContractJsonInteger $Receipt.zoneId 3) -or [long]$Receipt.zoneId -ne 3 -or
         $Receipt.defenderServiceEnabled -isnot [bool] -or -not $Receipt.defenderServiceEnabled -or
         $Receipt.antivirusEnabled -isnot [bool] -or -not $Receipt.antivirusEnabled -or
         $Receipt.realTimeProtectionEnabled -isnot [bool] -or -not $Receipt.realTimeProtectionEnabled -or
@@ -710,14 +882,16 @@ function Test-CcodReleasePromotionReceipt {
         -not (Test-CcodReleaseContractCanonicalUtc $Receipt.signatureUpdatedAtUtc) -or
         -not (Test-CcodReleaseContractCanonicalUtc $Receipt.scanStartedAtUtc) -or
         -not (Test-CcodReleaseContractCanonicalUtc $Receipt.scanCompletedAtUtc) -or
-        $Receipt.detectionCount -isnot [int] -or $Receipt.detectionCount -ne 0 -or
+        -not (Test-CcodReleaseContractJsonInteger $Receipt.detectionCount 0) -or [long]$Receipt.detectionCount -ne 0 -or
         $Receipt.outcome -isnot [string] -or $Receipt.outcome -cne 'Completed' -or $null -ne $Receipt.errorCode) {
         Throw-CcodReleaseContractError $errorId 'Defender receipt does not bind a completed official download scan.' $Path
     }
     $signature = [datetime]::ParseExact($Receipt.signatureUpdatedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
     $started = [datetime]::ParseExact($Receipt.scanStartedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
     $completed = [datetime]::ParseExact($Receipt.scanCompletedAtUtc,'o',[Globalization.CultureInfo]::InvariantCulture,[Globalization.DateTimeStyles]::RoundtripKind)
-    if ($signature -lt $started.AddHours(-72) -or $signature -gt $started.AddMinutes(5) -or $completed -lt $started -or $completed -gt $started.AddHours(2)) {
+    if ($NowUtc.Kind -ne [DateTimeKind]::Utc -or $NowUtc -eq [datetime]::MinValue -or $NowUtc -eq [datetime]::MaxValue -or
+        $started -gt $NowUtc.AddMinutes(5) -or $completed -gt $NowUtc.AddMinutes(5) -or
+        $signature -lt $started.AddHours(-72) -or $signature -gt $started.AddMinutes(5) -or $completed -lt $started -or $completed -gt $started.AddHours(2)) {
         Throw-CcodReleaseContractError $errorId 'Defender receipt timestamps are stale, future-dated, reversed, or too long.' $Path
     }
     return $Receipt
@@ -728,12 +902,14 @@ function Test-CcodReleasePromotionEvidenceCore {
     param(
         [Parameter(Mandatory)][string]$EvidenceDirectory,
         [Parameter(Mandatory)][string]$AssetDirectory,
-        [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$Version,
-        [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit,
-        [scriptblock]$BeforeReturn
+        [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+\z')][string]$Version,
+        [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}\z')][string]$ExpectedGitCommit,
+        [scriptblock]$BeforeReturn,
+        [hashtable]$HeldFileHashes
     )
     $errorId = 'CCOD_RELEASE_PROMOTION_EVIDENCE_INVALID'
-    $assetAuthority=$null;$evidenceAuthority=$null;$receiptAuthorities=[Collections.Generic.List[object]]::new()
+    $nowUtc = [datetime]::UtcNow
+    $assetAuthority=$null;$evidenceAuthority=$null;$receiptAuthorities=[Collections.Generic.List[object]]::new();$heldFileDirectories=[Collections.Generic.List[object]]::new();$heldFileAuthorities=[Collections.Generic.List[object]]::new()
     try {
     $assetAuthority=Open-CcodExactReleaseAssetAuthority -AssetDirectory $AssetDirectory -Version $Version -ErrorId $errorId
     $directory = Assert-CcodReleaseContractPlainPath -Path $EvidenceDirectory -Directory $true -ErrorId $errorId
@@ -750,7 +926,7 @@ function Test-CcodReleasePromotionEvidenceCore {
         $receiptAuthority=Open-CcodReleaseFileAuthority -Directory $evidenceAuthority -Leaf $names[$index] -ErrorId $errorId -MaximumBytes 65536;$receiptAuthorities.Add($receiptAuthority);$path=$receiptAuthority.Path
         $json = Read-CcodReleaseContractPinnedJson -Authority $receiptAuthority -ErrorId $errorId -MaximumBytes 65536
         $type = if ($index -eq 0) { 'Setup' } else { 'PortableZip' }
-        $receipts.Add((Test-CcodReleasePromotionReceipt -Receipt $json.Value -Raw $json.Raw -Path $path -AssetType $type -Version $Version -GitCommit $ExpectedGitCommit -AssetNames $assets))
+        $receipts.Add((Test-CcodReleasePromotionReceipt -Receipt $json.Value -Raw $json.Raw -Path $path -AssetType $type -Version $Version -GitCommit $ExpectedGitCommit -AssetNames $assets -NowUtc $nowUtc))
     }
     foreach ($binding in @(
         [pscustomobject]@{Receipt=0;Asset=5;Checksum=6;Manifest=10},
@@ -768,15 +944,33 @@ function Test-CcodReleasePromotionEvidenceCore {
         $receipts[0].manifestSha256 -ceq $receipts[1].manifestSha256) {
         Throw-CcodReleaseContractError $errorId 'Setup and portable receipts reuse an evidence identity.' $directory
     }
-    if($null-ne$BeforeReturn){&$BeforeReturn $assetAuthority $evidenceAuthority @($receiptAuthorities)}
     Assert-CcodExactReleaseAssetAuthorityCurrent $assetAuthority $errorId|Out-Null;Assert-CcodReleaseAuthorityCurrent $evidenceAuthority $errorId|Out-Null;foreach($authority in @($receiptAuthorities)){Assert-CcodReleaseAuthorityCurrent $authority $errorId -CheckBytes|Out-Null}
+    if($null -ne $HeldFileHashes){foreach($entry in @($HeldFileHashes.GetEnumerator())){
+        if($entry.Key-isnot[string]-or$entry.Value-isnot[string]-or$entry.Value-cnotmatch'^[0-9a-f]{64}\z'){throw 'held evidence hash'}
+        $heldPath=Assert-CcodReleaseContractPlainPath -Path ([string]$entry.Key) -Directory $false -ErrorId $errorId
+        $heldDirectory=Open-CcodReleaseDirectoryAuthority -Path ([IO.Path]::GetDirectoryName($heldPath)) -ErrorId $errorId
+        $heldFileDirectories.Add($heldDirectory)
+        $heldFile=Open-CcodReleaseFileAuthority -Directory $heldDirectory -Leaf ([IO.Path]::GetFileName($heldPath)) -ErrorId $errorId -MaximumBytes 4194304
+        $heldFileAuthorities.Add($heldFile)
+        if($heldFile.Sha256-cne[string]$entry.Value){throw 'held evidence bytes'}
+    }}
+    foreach($directoryAuthority in @($heldFileDirectories)){Assert-CcodReleaseAuthorityCurrent $directoryAuthority $errorId|Out-Null}
+    foreach($authority in @($heldFileAuthorities)){Assert-CcodReleaseAuthorityCurrent $authority $errorId -CheckBytes|Out-Null}
+    if($null-ne$BeforeReturn){
+        &$BeforeReturn $assetAuthority $evidenceAuthority @($receiptAuthorities)
+        Assert-CcodExactReleaseAssetAuthorityCurrent $assetAuthority $errorId|Out-Null
+        Assert-CcodReleaseAuthorityCurrent $evidenceAuthority $errorId|Out-Null
+        foreach($authority in @($receiptAuthorities)){Assert-CcodReleaseAuthorityCurrent $authority $errorId -CheckBytes|Out-Null}
+        foreach($directoryAuthority in @($heldFileDirectories)){Assert-CcodReleaseAuthorityCurrent $directoryAuthority $errorId|Out-Null}
+    foreach($authority in @($heldFileAuthorities)){Assert-CcodReleaseAuthorityCurrent $authority $errorId -CheckBytes|Out-Null}
+    }
     return [pscustomobject][ordered]@{Valid=$true;Version=$Version;GitCommit=$ExpectedGitCommit;Receipts=@($receipts)}
-    } finally {for($index=$receiptAuthorities.Count-1;$index-ge0;$index--){Close-CcodReleaseAuthority $receiptAuthorities[$index]};Close-CcodReleaseAuthority $evidenceAuthority;Close-CcodExactReleaseAssetAuthority $assetAuthority}
+    } finally {for($index=$heldFileAuthorities.Count-1;$index-ge0;$index--){Close-CcodReleaseAuthority $heldFileAuthorities[$index]};for($index=$heldFileDirectories.Count-1;$index-ge0;$index--){Close-CcodReleaseAuthority $heldFileDirectories[$index]};for($index=$receiptAuthorities.Count-1;$index-ge0;$index--){Close-CcodReleaseAuthority $receiptAuthorities[$index]};Close-CcodReleaseAuthority $evidenceAuthority;Close-CcodExactReleaseAssetAuthority $assetAuthority}
 }
 
 function Test-CcodReleasePromotionEvidence {
     [CmdletBinding()]
-    param([Parameter(Mandatory)][string]$EvidenceDirectory,[Parameter(Mandatory)][string]$AssetDirectory,[Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$Version,[Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit)
+    param([Parameter(Mandatory)][string]$EvidenceDirectory,[Parameter(Mandatory)][string]$AssetDirectory,[Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+\z')][string]$Version,[Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}\z')][string]$ExpectedGitCommit)
     Test-CcodReleasePromotionEvidenceCore -EvidenceDirectory $EvidenceDirectory -AssetDirectory $AssetDirectory -Version $Version -ExpectedGitCommit $ExpectedGitCommit
 }
 
diff --git a/tools/ReleaseDefender.psm1 b/tools/ReleaseDefender.psm1
index 84d75de..f8478be 100644
--- a/tools/ReleaseDefender.psm1
+++ b/tools/ReleaseDefender.psm1
@@ -1,9 +1,161 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
+# BEGIN CCOD TRUSTED IMPORT BOOTSTRAP
+# Embedded in each independently trusted entrypoint; an unheld helper import
+# cannot bootstrap its own protection. Keep copies identical (self-test enforced).
+function Initialize-CcodTrustedImportLease {
+    if ($null -ne ('CcodTrustedImportLeaseV1' -as [type])) { return }
+    Add-Type -ErrorAction Stop -TypeDefinition @'
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+
+public sealed class CcodTrustedImportLeaseV1 : IDisposable
+{
+    [StructLayout(LayoutKind.Sequential)] private struct NativeTime { public uint Low, High; }
+    [StructLayout(LayoutKind.Sequential)] private struct NativeInfo
+    {
+        public uint Attributes;
+        public NativeTime Creation, Access, Write;
+        public uint Volume, SizeHigh, SizeLow, Links, IndexHigh, IndexLow;
+    }
+    private sealed class Entry
+    {
+        public SafeFileHandle Handle;
+        public string Path;
+        public bool Directory;
+        public uint Volume;
+        public ulong FileId;
+    }
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern SafeFileHandle CreateFileW(string path, uint access, uint share, IntPtr security, uint creation, uint flags, IntPtr template);
+    [DllImport("kernel32.dll", SetLastError=true)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle handle, out NativeInfo info);
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern uint GetFinalPathNameByHandleW(SafeFileHandle handle, StringBuilder value, uint length, uint flags);
+
+    private readonly List<Entry> entries = new List<Entry>();
+    private bool disposed;
+    public string Path { get; private set; }
+    private CcodTrustedImportLeaseV1(string path) { Path = path; }
+
+    public static CcodTrustedImportLeaseV1 Acquire(string path)
+    {
+        if (String.IsNullOrWhiteSpace(path) || !System.IO.Path.IsPathRooted(path) ||
+            path.StartsWith(@"\\?\", StringComparison.Ordinal) || path.StartsWith(@"\\.\", StringComparison.Ordinal))
+            throw new ArgumentException("Unsupported module path");
+        string full = System.IO.Path.GetFullPath(path);
+        string root = System.IO.Path.GetPathRoot(full);
+        string extension = System.IO.Path.GetExtension(full);
+        if (!String.Equals(full, path, StringComparison.OrdinalIgnoreCase) || String.IsNullOrEmpty(root) ||
+            full.Substring(root.Length).IndexOf(':') >= 0 ||
+            (!String.Equals(extension, ".psm1", StringComparison.OrdinalIgnoreCase) && !String.Equals(extension, ".ps1", StringComparison.OrdinalIgnoreCase)))
+            throw new ArgumentException("Noncanonical module path");
+        var lease = new CcodTrustedImportLeaseV1(full);
+        try
+        {
+            var parents = new List<string>();
+            for (DirectoryInfo parent = Directory.GetParent(full); parent != null; parent = parent.Parent)
+                parents.Add(parent.FullName);
+            parents.Reverse();
+            if (parents.Count == 0 || !SamePath(parents[0], root)) throw new IOException("Missing module root");
+            // Retain root-to-leaf authority before traversing the next component.
+            foreach (string parent in parents) lease.Open(parent, true);
+            lease.Open(full, false);
+            lease.Revalidate();
+            return lease;
+        }
+        catch { lease.Dispose(); throw; }
+    }
+
+    private void Open(string path, bool directory)
+    {
+        uint access = directory ? 0x00100081U : 0x80100080U;
+        uint flags = 0x00200000U | (directory ? 0x02000000U : 0U);
+        // FILE_SHARE_READ only: preexisting writers/deleters must fail closed.
+        SafeFileHandle handle = CreateFileW(path, access, 1U, IntPtr.Zero, 3U, flags, IntPtr.Zero);
+        if (handle.IsInvalid) { int error = Marshal.GetLastWin32Error(); handle.Dispose(); throw new Win32Exception(error); }
+        try
+        {
+            NativeInfo info = Inspect(handle, path, directory);
+            entries.Add(new Entry { Handle = handle, Path = path, Directory = directory, Volume = info.Volume, FileId = FileId(info) });
+        }
+        catch { handle.Dispose(); throw; }
+    }
+
+    private static ulong FileId(NativeInfo info) { return ((ulong)info.IndexHigh << 32) | info.IndexLow; }
+    private static bool SamePath(string left, string right)
+    {
+        return String.Equals(left.TrimEnd('\\'), right.TrimEnd('\\'), StringComparison.OrdinalIgnoreCase);
+    }
+    private static NativeInfo Inspect(SafeFileHandle handle, string expected, bool directory)
+    {
+        NativeInfo info;
+        if (!GetFileInformationByHandle(handle, out info)) throw new Win32Exception(Marshal.GetLastWin32Error());
+        if ((info.Attributes & 0x400U) != 0 || ((info.Attributes & 0x10U) != 0) != directory)
+            throw new IOException("Unsafe module path kind");
+        var value = new StringBuilder(512);
+        uint length = GetFinalPathNameByHandleW(handle, value, (uint)value.Capacity, 0);
+        if (length == 0) throw new Win32Exception(Marshal.GetLastWin32Error());
+        if (length >= value.Capacity)
+        {
+            value.Capacity = checked((int)length + 1);
+            length = GetFinalPathNameByHandleW(handle, value, (uint)value.Capacity, 0);
+            if (length == 0 || length >= value.Capacity) throw new IOException("Module final path unavailable");
+        }
+        string final = value.ToString();
+        if (final.StartsWith(@"\\?\UNC\", StringComparison.OrdinalIgnoreCase)) final = @"\\" + final.Substring(8);
+        else if (final.StartsWith(@"\\?\", StringComparison.OrdinalIgnoreCase)) final = final.Substring(4);
+        if (!SamePath(final, expected)) throw new IOException("Module final path mismatch");
+        return info;
+    }
+
+    public void Revalidate()
+    {
+        if (disposed) throw new ObjectDisposedException("trusted module import lease");
+        foreach (Entry entry in entries)
+        {
+            NativeInfo info = Inspect(entry.Handle, entry.Path, entry.Directory);
+            if (info.Volume != entry.Volume || FileId(info) != entry.FileId) throw new IOException("Module identity changed");
+        }
+    }
+    public void Dispose()
+    {
+        if (disposed) return;
+        disposed = true;
+        for (int index = entries.Count - 1; index >= 0; index--) entries[index].Handle.Dispose();
+        entries.Clear();
+    }
+}
+'@
+}
+
+function Open-CcodTrustedImportLease {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$ErrorId)
+    try {
+        Initialize-CcodTrustedImportLease
+        return [CcodTrustedImportLeaseV1]::Acquire($Path)
+    } catch {
+        throw [Management.Automation.ErrorRecord]::new(
+            [InvalidOperationException]::new('Trusted module import authority could not be acquired.'),
+            $ErrorId,[Management.Automation.ErrorCategory]::InvalidData,$Path)
+    }
+}
+# END CCOD TRUSTED IMPORT BOOTSTRAP
+
 $assetContractPath = Join-Path $PSScriptRoot 'ReleaseAssetContract.psm1'
 if (-not [IO.File]::Exists($assetContractPath)) { throw 'CCOD_RELEASE_ASSET_CONTRACT_MISSING' }
-$script:CcodReleaseAssetContractModule = Import-Module $assetContractPath -Force -PassThru -ErrorAction Stop
+$assetContractLease = Open-CcodTrustedImportLease -Path $assetContractPath -ErrorId 'CCOD_RELEASE_ASSET_CONTRACT_MISSING'
+try {
+    $assetContractLease.Revalidate()
+    $script:CcodReleaseAssetContractModule = Import-Module $assetContractPath -Force -PassThru -ErrorAction Stop
+    $assetContractLease.Revalidate()
+} finally { $assetContractLease.Dispose() }
 
 function Throw-CcodReleaseDefenderError {
     param([Parameter(Mandatory)][string]$Id,[Parameter(Mandatory)][string]$Message,$Target)
@@ -55,10 +207,57 @@ function Resolve-CcodReleaseDefenderAdapters {
 function Get-CcodReleaseDefenderDetectionKeys {
     param($Records)
     $keys=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
-    foreach($record in @($Records)){if($null-eq$record){continue};$threat=if($null-ne$record.PSObject.Properties['ThreatID']){[string]$record.ThreatID}else{''};$time=if($null-ne$record.PSObject.Properties['InitialDetectionTime']){[string]$record.InitialDetectionTime}else{''};$resources=if($null-ne$record.PSObject.Properties['Resources']){(@($record.Resources)-join'|')}else{''};if(-not[string]::IsNullOrWhiteSpace($threat)-or-not[string]::IsNullOrWhiteSpace($time)-or-not[string]::IsNullOrWhiteSpace($resources)){[void]$keys.Add("$threat|$time|$resources")}}
+    foreach($record in @($Records)){if($null-eq$record){continue};$threat=if($null-ne$record.PSObject.Properties['ThreatID']){[string]$record.ThreatID}else{''};$time=if($null-ne$record.PSObject.Properties['InitialDetectionTime']){[string]$record.InitialDetectionTime}else{''};$resources=if($null-ne$record.PSObject.Properties['Resources']){(@($record.Resources)-join'|')}else{''};if(-not[string]::IsNullOrWhiteSpace($threat)-or-not[string]::IsNullOrWhiteSpace($time)-or-not[string]::IsNullOrWhiteSpace($resources)){[void]$keys.Add("$threat|$time|$resources")}else{Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_DETECTIONS_INVALID' 'A threat observation contains an unidentified record.' $null}}
     Write-Output -NoEnumerate $keys
 }
 
+function Get-CcodReleaseDefenderDetectionSnapshot {
+    param($Records,[Parameter(Mandatory)][string]$CandidatePath)
+    $keys=Get-CcodReleaseDefenderDetectionKeys $Records
+    $unresolved=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+    $states=[Collections.Generic.Dictionary[string,string]]::new([StringComparer]::Ordinal)
+    foreach($record in @($Records)) {
+        if($null-eq$record){continue}
+        # Unknown resource syntax cannot prove that an old detection is unrelated.
+        $related=$false;$unknown=$false
+        $resources=@(if($null-ne$record.PSObject.Properties['Resources']){$record.Resources})
+        if($resources.Count-eq0){$unknown=$true}
+        foreach($resource in $resources) {
+            if($resource-isnot[string]-or[string]::IsNullOrWhiteSpace($resource)){$unknown=$true;continue}
+            foreach($part in [regex]::Split($resource,';(?=(?:containerfile|file|webfile):_)',[Text.RegularExpressions.RegexOptions]::IgnoreCase)) {
+                $path=[regex]::Replace($part,'^(?:containerfile|file|webfile):_','',[Text.RegularExpressions.RegexOptions]::IgnoreCase)
+                if($path-notmatch'^[A-Za-z]:\\'-or$path.Substring(2).IndexOfAny([IO.Path]::GetInvalidPathChars())-ge0-or$path.Substring(2).Contains(':')){$unknown=$true;continue}
+                try{$path=[IO.Path]::GetFullPath($path)}catch{$unknown=$true;continue}
+                if([StringComparer]::OrdinalIgnoreCase.Equals($path,$CandidatePath)){$related=$true}
+            }
+        }
+        if(-not$related-and-not$unknown){continue}
+        $resolved=$true
+        foreach($field in @('ThreatStatusID','CurrentThreatExecutionStatusID','ThreatStatusErrorCode','AdditionalActionsBitMask')) {
+            $property=$record.PSObject.Properties[$field]
+            if($null-eq$property-or($property.Value-isnot[byte]-and$property.Value-isnot[int]-and$property.Value-isnot[uint32]-and$property.Value-isnot[long])){$resolved=$false}
+        }
+        # Native status 2/3/4 = cleaned/quarantined/removed; execution 1/4 = blocked/not executing.
+        # Allowed, unknown, unsuccessful remediation and outstanding actions are not clean.
+        if($resolved) {
+            $resolved=$record.ThreatStatusID-in@(2,3,4)-and$record.CurrentThreatExecutionStatusID-in@(1,4)-and$record.ThreatStatusErrorCode-eq0-and$record.AdditionalActionsBitMask-eq0
+        }
+        $action=$record.PSObject.Properties['ActionSuccess']
+        if($null-eq$action-or$action.Value-isnot[bool]-or-not$action.Value){$resolved=$false}
+        $state=[ordered]@{}
+        foreach($field in @('ThreatStatusID','CurrentThreatExecutionStatusID','ThreatStatusErrorCode','AdditionalActionsBitMask','ActionSuccess','LastThreatStatusChangeTime','RemediationTime')) {
+            $property=$record.PSObject.Properties[$field]
+            $state[$field]=if($null-ne$property){$property.Value}else{$null}
+        }
+        $fingerprint=$state|ConvertTo-Json -Depth 4 -Compress
+        foreach($key in (Get-CcodReleaseDefenderDetectionKeys @($record))) {
+            if(-not$resolved-or($states.ContainsKey($key)-and$states[$key]-cne$fingerprint)){[void]$unresolved.Add($key)}
+            $states[$key]=$fingerprint
+        }
+    }
+    return [pscustomobject]@{Keys=$keys;Unresolved=$unresolved;States=$states}
+}
+
 function Test-CcodReleaseDefenderPositiveInteger {
     param($Value)
     if($Value-is[bool]-or$Value-isnot[ValueType]){return $false};try{return [decimal]$Value-eq[decimal][uint64]$Value-and[uint64]$Value-gt0}catch{return $false}
@@ -67,7 +266,7 @@ function Test-CcodReleaseDefenderPositiveInteger {
 function Assert-CcodReleaseDefenderOrigin {
     param([Parameter(Mandatory)][string]$Origin,$WorkflowArtifactIdentity,[Parameter(Mandatory)][string]$ExpectedGitCommit)
     if($Origin-ceq'InternetDownload'){if($null-ne$WorkflowArtifactIdentity){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_ORIGIN_INVALID' 'Internet-download evidence cannot claim a workflow artifact identity.' $WorkflowArtifactIdentity};return $null}
-    if($Origin-cne'TrustedWorkflowArtifact'-or$null-eq$WorkflowArtifactIdentity-or$WorkflowArtifactIdentity-isnot[pscustomobject]-or(@($WorkflowArtifactIdentity.PSObject.Properties.Name)-join',')-cne'provider,repository,runId,runAttempt,artifactId,artifactName,artifactDigest,gitCommit'-or$WorkflowArtifactIdentity.provider-cne'GitHubActions'-or$WorkflowArtifactIdentity.repository-cne'naipi11/CodexRemote-fix'-or-not(Test-CcodReleaseDefenderPositiveInteger $WorkflowArtifactIdentity.runId)-or-not(Test-CcodReleaseDefenderPositiveInteger $WorkflowArtifactIdentity.runAttempt)-or-not(Test-CcodReleaseDefenderPositiveInteger $WorkflowArtifactIdentity.artifactId)-or$WorkflowArtifactIdentity.artifactName-cne'CodexRemote-fix portable bundle'-or$WorkflowArtifactIdentity.artifactDigest-cnotmatch'^sha256:[0-9a-f]{64}$'-or$WorkflowArtifactIdentity.gitCommit-cne$ExpectedGitCommit){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_ORIGIN_INVALID' 'Trusted workflow evidence requires one exact GitHub Actions artifact identity.' $WorkflowArtifactIdentity}
+    if($Origin-cne'TrustedWorkflowArtifact'-or$null-eq$WorkflowArtifactIdentity-or$WorkflowArtifactIdentity-isnot[pscustomobject]-or(@($WorkflowArtifactIdentity.PSObject.Properties.Name)-join',')-cne'provider,repository,runId,runAttempt,artifactId,artifactName,artifactDigest,gitCommit'-or$WorkflowArtifactIdentity.provider-cne'GitHubActions'-or$WorkflowArtifactIdentity.repository-cne'naipi11/CodexRemote-fix'-or-not(Test-CcodReleaseDefenderPositiveInteger $WorkflowArtifactIdentity.runId)-or-not(Test-CcodReleaseDefenderPositiveInteger $WorkflowArtifactIdentity.runAttempt)-or-not(Test-CcodReleaseDefenderPositiveInteger $WorkflowArtifactIdentity.artifactId)-or$WorkflowArtifactIdentity.artifactName-cne'CodexRemote-fix portable bundle'-or$WorkflowArtifactIdentity.artifactDigest-cnotmatch'^sha256:[0-9a-f]{64}\z'-or$WorkflowArtifactIdentity.gitCommit-cne$ExpectedGitCommit){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_ORIGIN_INVALID' 'Trusted workflow evidence requires one exact GitHub Actions artifact identity.' $WorkflowArtifactIdentity}
     return [pscustomobject][ordered]@{provider=[string]$WorkflowArtifactIdentity.provider;repository=[string]$WorkflowArtifactIdentity.repository;runId=[uint64]$WorkflowArtifactIdentity.runId;runAttempt=[uint64]$WorkflowArtifactIdentity.runAttempt;artifactId=[uint64]$WorkflowArtifactIdentity.artifactId;artifactName=[string]$WorkflowArtifactIdentity.artifactName;artifactDigest=[string]$WorkflowArtifactIdentity.artifactDigest;gitCommit=[string]$WorkflowArtifactIdentity.gitCommit}
 }
 
@@ -123,24 +322,55 @@ function Confirm-CcodReleaseDefenderReceiptReadback {
     }catch{Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED' 'Defender receipt durable read-back did not match.' $ExpectedPath}
 }
 
+function Remove-CcodReleaseDefenderPublishedReceipt {
+    param([Parameter(Mandatory)]$Authority,$Readback,[Parameter(Mandatory)]$Directory,[Parameter(Mandatory)][string]$ExpectedPath)
+    $assetModule=$script:CcodReleaseAssetContractModule
+    try {
+        &$assetModule {
+            param($Authority,$Readback,$Directory,$ExpectedPath)
+            if($Authority.Closed-or$Directory.Closed-or$Authority.Kind-cne'File'-or$Directory.Kind-cne'Directory'-or$Authority.Path-cne$ExpectedPath-or([IO.Path]::GetDirectoryName($ExpectedPath))-cne$Directory.Path){throw 'receipt ownership unavailable'}
+            # Membership may be the failure being rolled back; retain directory identity instead.
+            foreach($entry in @($Directory,$Authority)) {
+                $handle=if($entry.Kind-ceq'Directory'){$entry.Handle}else{$entry.Stream.SafeFileHandle}
+                $current=[CcodReleaseFileAuthorityV1]::Identity($handle)
+                if($current.Volume-ne$entry.Identity.Volume-or$current.FileId-ne$entry.Identity.FileId-or$current.Links-ne$entry.Identity.Links-or$current.Attributes-ne$entry.Identity.Attributes-or-not(Test-CcodReleaseAuthorityFinalPath $current.FinalPath $entry.Path)){throw 'receipt rollback identity changed'}
+            }
+            Close-CcodReleaseAuthority $Readback
+            if([CcodReleaseFileAuthorityV1]::Delete($Authority.Stream.SafeFileHandle)-ne0){throw 'receipt rollback delete failed'}
+            Close-CcodReleaseAuthority $Authority
+            foreach($leaf in [CcodReleaseFileAuthorityV1]::EnumerateDirectory($Directory.Handle)) {
+                if([StringComparer]::OrdinalIgnoreCase.Equals($leaf,[IO.Path]::GetFileName($ExpectedPath))){throw 'receipt rollback residue'}
+            }
+        } $Authority $Readback $Directory $ExpectedPath
+    } catch {Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_EVIDENCE_CLEANUP_FAILED' 'The owned Defender receipt could not be removed and proven absent.' $ExpectedPath}
+}
+
 function Invoke-CcodReleaseDefenderCheckCore {
     [CmdletBinding()]
-    param([Parameter(Mandatory)][string]$CandidatePath,[Parameter(Mandatory)][string]$ChecksumPath,[Parameter(Mandatory)][string]$ManifestPath,[Parameter(Mandatory)][string]$Origin,$WorkflowArtifactIdentity,[Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion,[Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit,[Parameter(Mandatory)][string]$EvidencePath,[hashtable]$Adapters)
-    $adapters=Resolve-CcodReleaseDefenderAdapters $Adapters;$evidenceTarget=Assert-CcodReleaseDefenderEvidenceTarget $EvidencePath;$workflowIdentity=Assert-CcodReleaseDefenderOrigin $Origin $WorkflowArtifactIdentity $ExpectedGitCommit;$held=$null;$receiptAuthority=$null;$receiptReadbackAuthority=$null;$assetModule=$script:CcodReleaseAssetContractModule
+    param([Parameter(Mandatory)][string]$CandidatePath,[Parameter(Mandatory)][string]$ChecksumPath,[Parameter(Mandatory)][string]$ManifestPath,[Parameter(Mandatory)][string]$Origin,$WorkflowArtifactIdentity,[Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+\z')][string]$ExpectedVersion,[Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}\z')][string]$ExpectedGitCommit,[Parameter(Mandatory)][string]$EvidencePath,[hashtable]$Adapters)
+    $adapters=Resolve-CcodReleaseDefenderAdapters $Adapters;$evidenceTarget=Assert-CcodReleaseDefenderEvidenceTarget $EvidencePath;$workflowIdentity=Assert-CcodReleaseDefenderOrigin $Origin $WorkflowArtifactIdentity $ExpectedGitCommit;$held=$null;$receiptAuthority=$null;$receiptReadbackAuthority=$null;$receiptValidated=$false;$assetModule=$script:CcodReleaseAssetContractModule
     try{
         $held=Open-CcodReleaseDefenderHeldInputs $CandidatePath $ChecksumPath $ManifestPath $evidenceTarget $Origin;$candidateDirectory=$held.CandidateDirectory.Path;$candidateLeaf=$held.Candidate.Leaf;$names=@(Get-CcodExpectedReleaseAssetNames $ExpectedVersion);$assetType=if($candidateLeaf-ceq$names[5]){'Setup'}elseif($candidateLeaf-ceq$names[0]){'PortableZip'}else{$null};if($null-eq$assetType){Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Candidate is not the exact versioned Setup or portable ZIP asset.' $candidateLeaf};$checksumName=if($assetType-ceq'Setup'){$names[6]}else{$names[1]};$manifestName=if($assetType-ceq'Setup'){$names[10]}else{$names[4]};if($held.Checksum.Leaf-cne$checksumName-or$held.Manifest.Leaf-cne$manifestName){Throw-CcodReleaseDefenderError 'CCOD_RELEASE_MANIFEST_INVALID' 'Checksum or manifest does not match the selected asset.' $candidateLeaf}
         $checksumText=[Text.UTF8Encoding]::new($false,$true).GetString((Get-CcodReleaseDefenderPinnedBytes $held.Checksum 65536)).TrimEnd("`r","`n");if($checksumText-cne("$($held.Candidate.Sha256) *$candidateLeaf")){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CHECKSUM_INVALID' 'Held checksum does not bind candidate bytes.' $held.Checksum.Path};$manifest=Test-CcodReleaseAssetManifest $held.Manifest.Path $candidateDirectory $ExpectedVersion;if($manifest.GitCommit-cne$ExpectedGitCommit-or$manifest.InstallerName-cne$candidateLeaf-or$manifest.InstallerSha256-cne$held.Candidate.Sha256){Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Manifest, commit, and candidate identity differ.' $candidateLeaf}
-        $zone=if($Origin-ceq'InternetDownload'){Get-CcodReleaseDefenderPinnedZoneId $held.Zone}else{$null};$started=&$adapters.GetUtcNow;if($started-isnot[datetime]){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CLOCK_INVALID' 'Defender start clock is invalid.' $started};$started=([datetime]$started).ToUniversalTime();$status=Get-CcodReleaseDefenderStatusEvidence (&$adapters.GetDefenderStatus) $started;$before=Get-CcodReleaseDefenderDetectionKeys (&$adapters.GetThreatDetections);$scanError=$null;try{&$adapters.StartCustomScan $held.Candidate.Path}catch{$scanError=$_};$completed=&$adapters.GetUtcNow;if($completed-isnot[datetime]){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CLOCK_INVALID' 'Defender completion clock is invalid.' $completed};$completed=([datetime]$completed).ToUniversalTime();if($completed-lt$started-or$completed-gt$started.AddHours(2)){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CLOCK_INVALID' 'Defender scan clock is reversed or too long.' $completed};$after=Get-CcodReleaseDefenderDetectionKeys (&$adapters.GetThreatDetections);$detections=@($after|Where-Object{-not$before.Contains($_)})
+        $zone=if($Origin-ceq'InternetDownload'){Get-CcodReleaseDefenderPinnedZoneId $held.Zone}else{$null};$started=&$adapters.GetUtcNow;if($started-isnot[datetime]){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CLOCK_INVALID' 'Defender start clock is invalid.' $started};$started=([datetime]$started).ToUniversalTime();$status=Get-CcodReleaseDefenderStatusEvidence (&$adapters.GetDefenderStatus) $started;$before=Get-CcodReleaseDefenderDetectionSnapshot (&$adapters.GetThreatDetections) $held.Candidate.Path;$scanError=$null;try{&$adapters.StartCustomScan $held.Candidate.Path}catch{$scanError=$_};$completed=&$adapters.GetUtcNow;if($completed-isnot[datetime]){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CLOCK_INVALID' 'Defender completion clock is invalid.' $completed};$completed=([datetime]$completed).ToUniversalTime();if($completed-lt$started-or$completed-gt$started.AddHours(2)){Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_CLOCK_INVALID' 'Defender scan clock is reversed or too long.' $completed};$after=Get-CcodReleaseDefenderDetectionSnapshot (&$adapters.GetThreatDetections) $held.Candidate.Path
+        $detections=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+        foreach($key in $after.Keys){if(-not$before.Keys.Contains($key)){[void]$detections.Add($key)}}
+        foreach($snapshot in @($before,$after)){foreach($key in $snapshot.Unresolved){[void]$detections.Add($key)}}
+        foreach($key in $after.States.Keys){if($before.States.ContainsKey($key)-and$before.States[$key]-cne$after.States[$key]){[void]$detections.Add($key)}}
         Assert-CcodReleaseDefenderHeldInputsCurrent $held;$revalidated=Test-CcodReleaseAssetManifest $held.Manifest.Path $candidateDirectory $ExpectedVersion;if($revalidated.GitCommit-cne$ExpectedGitCommit-or$revalidated.InstallerSha256-cne$held.Candidate.Sha256){Throw-CcodReleaseDefenderError 'CCOD_RELEASE_ASSET_HASH_MISMATCH' 'Held identity changed during scan.' $candidateLeaf};if($Origin-ceq'InternetDownload'){[void](Get-CcodReleaseDefenderPinnedZoneId $held.Zone)};$errorCode=if($null-ne$scanError){'CCOD_DEFENDER_SCAN_FAILED'}elseif($detections.Count-gt0){'CCOD_DEFENDER_DETECTIONS_FOUND'}else{$null}
         $receipt=[pscustomobject][ordered]@{schemaVersion=2;assetType=$assetType;assetName=$candidateLeaf;assetSha256=$held.Candidate.Sha256;checksumName=$checksumName;checksumSha256=$held.Checksum.Sha256;manifestName=$manifestName;manifestSha256=$held.Manifest.Sha256;version=$ExpectedVersion;gitCommit=$ExpectedGitCommit;origin=$Origin;workflowArtifactIdentity=$workflowIdentity;zoneId=$zone;defenderServiceEnabled=[bool]$status.ServiceEnabled;antivirusEnabled=[bool]$status.AntivirusEnabled;realTimeProtectionEnabled=[bool]$status.RealTimeProtectionEnabled;defenderPlatformVersion=[string]$status.PlatformVersion;defenderEngineVersion=[string]$status.EngineVersion;signatureVersion=[string]$status.SignatureVersion;signatureUpdatedAtUtc=[string]$status.SignatureUpdatedAtUtc;scanStartedAtUtc=$started.ToString('o',[Globalization.CultureInfo]::InvariantCulture);scanCompletedAtUtc=$completed.ToString('o',[Globalization.CultureInfo]::InvariantCulture);detectionCount=[int]$detections.Count;outcome=if($null-eq$errorCode){'Completed'}else{'Failed'};errorCode=$errorCode};$bytes=[Text.UTF8Encoding]::new($false).GetBytes((($receipt|ConvertTo-Json -Depth 12)+[Environment]::NewLine))
-        try{$receiptAuthority=&$adapters.PublishReceiptBytes $held.EvidenceDirectory ([IO.Path]::GetFileName($evidenceTarget)) $bytes;$children=[Collections.Generic.List[string]]::new();foreach($name in @($held.EvidenceDirectory.Children)){$children.Add([string]$name)};$children.Add([IO.Path]::GetFileName($evidenceTarget));$ordered=[string[]]@($children);[Array]::Sort($ordered,[StringComparer]::Ordinal);$held.EvidenceDirectory.Children=$ordered;&$assetModule {param($Value)Assert-CcodReleaseAuthorityCurrent -Authority $Value -ErrorId 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED'|Out-Null} $held.EvidenceDirectory;$receiptReadbackAuthority=&$assetModule {param($Directory,$Leaf)Open-CcodReleaseFileAuthority -Directory $Directory -Leaf $Leaf -ErrorId 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED' -MaximumBytes 65536 -ShareDelete} $held.EvidenceDirectory ([IO.Path]::GetFileName($evidenceTarget));[void](Confirm-CcodReleaseDefenderReceiptReadback $receiptAuthority $receiptReadbackAuthority $evidenceTarget $bytes $receipt)}catch{$detail=$_.Exception.Message;foreach($value in @($receiptReadbackAuthority,$receiptAuthority)){if($null-ne$value){&$assetModule {param($Value)Close-CcodReleaseAuthority $Value} $value}};$receiptReadbackAuthority=$null;$receiptAuthority=$null;Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED' ('Defender receipt could not be durably read back: '+$detail) $evidenceTarget}
-        Assert-CcodReleaseDefenderHeldInputsCurrent $held;if($null-ne$errorCode){Throw-CcodReleaseDefenderError $errorCode 'The Defender final-asset gate did not complete cleanly.' $held.Candidate.Sha256};return $receipt
+        try{$receiptAuthority=&$adapters.PublishReceiptBytes $held.EvidenceDirectory ([IO.Path]::GetFileName($evidenceTarget)) $bytes;$children=[Collections.Generic.List[string]]::new();foreach($name in @($held.EvidenceDirectory.Children)){$children.Add([string]$name)};$children.Add([IO.Path]::GetFileName($evidenceTarget));$ordered=[string[]]@($children);[Array]::Sort($ordered,[StringComparer]::Ordinal);$held.EvidenceDirectory.Children=$ordered;&$assetModule {param($Value)Assert-CcodReleaseAuthorityCurrent -Authority $Value -ErrorId 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED'|Out-Null} $held.EvidenceDirectory;$receiptReadbackAuthority=&$assetModule {param($Directory,$Leaf)Open-CcodReleaseFileAuthority -Directory $Directory -Leaf $Leaf -ErrorId 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED' -MaximumBytes 65536 -ShareDelete} $held.EvidenceDirectory ([IO.Path]::GetFileName($evidenceTarget));[void](Confirm-CcodReleaseDefenderReceiptReadback $receiptAuthority $receiptReadbackAuthority $evidenceTarget $bytes $receipt)}catch{$detail=$_.Exception.Message;Throw-CcodReleaseDefenderError 'CCOD_DEFENDER_EVIDENCE_WRITE_FAILED' ('Defender receipt could not be durably read back: '+$detail) $evidenceTarget}
+        Assert-CcodReleaseDefenderHeldInputsCurrent $held;$receiptValidated=$true;if($null-ne$errorCode){Throw-CcodReleaseDefenderError $errorCode 'The Defender final-asset gate did not complete cleanly.' $held.Candidate.Sha256};return $receipt
+    }catch{
+        $failure=$_
+        if($null-ne$receiptAuthority-and-not$receiptValidated){Remove-CcodReleaseDefenderPublishedReceipt -Authority $receiptAuthority -Readback $receiptReadbackAuthority -Directory $held.EvidenceDirectory -ExpectedPath $evidenceTarget}
+        throw $failure
     }finally{foreach($value in @($receiptReadbackAuthority,$receiptAuthority)){if($null-ne$value){&$assetModule {param($Value)Close-CcodReleaseAuthority $Value} $value}};Close-CcodReleaseDefenderHeldInputs $held}
 }
 
 function Invoke-CcodReleaseDefenderCheck {
     [CmdletBinding()]
-    param([Parameter(Mandatory)][string]$CandidatePath,[Parameter(Mandatory)][string]$ChecksumPath,[Parameter(Mandatory)][string]$ManifestPath,[Parameter(Mandatory)][ValidateSet('TrustedWorkflowArtifact','InternetDownload')][string]$Origin,$WorkflowArtifactIdentity,[Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion,[Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit,[Parameter(Mandatory)][string]$EvidencePath)
+    param([Parameter(Mandatory)][string]$CandidatePath,[Parameter(Mandatory)][string]$ChecksumPath,[Parameter(Mandatory)][string]$ManifestPath,[Parameter(Mandatory)][ValidateSet('TrustedWorkflowArtifact','InternetDownload')][string]$Origin,$WorkflowArtifactIdentity,[Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+\z')][string]$ExpectedVersion,[Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}\z')][string]$ExpectedGitCommit,[Parameter(Mandatory)][string]$EvidencePath)
     Invoke-CcodReleaseDefenderCheckCore $CandidatePath $ChecksumPath $ManifestPath $Origin $WorkflowArtifactIdentity $ExpectedVersion $ExpectedGitCommit $EvidencePath $null
 }
 
diff --git a/tools/Test-ReleaseDefender.ps1 b/tools/Test-ReleaseDefender.ps1
index 90408c5..f1c405a 100644
--- a/tools/Test-ReleaseDefender.ps1
+++ b/tools/Test-ReleaseDefender.ps1
@@ -5,19 +5,171 @@ param(
     [Parameter(Mandatory)][string]$ManifestPath,
     [Parameter(Mandatory)][ValidateSet('TrustedWorkflowArtifact','InternetDownload')][string]$Origin,
     $WorkflowArtifactIdentity,
-    [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$ExpectedVersion,
-    [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}$')][string]$ExpectedGitCommit,
+    [Parameter(Mandatory)][ValidatePattern('^\d+\.\d+\.\d+\z')][string]$ExpectedVersion,
+    [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{40}\z')][string]$ExpectedGitCommit,
     [Parameter(Mandatory)][string]$EvidencePath
 )
 
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
+# BEGIN CCOD TRUSTED IMPORT BOOTSTRAP
+# Embedded in each independently trusted entrypoint; an unheld helper import
+# cannot bootstrap its own protection. Keep copies identical (self-test enforced).
+function Initialize-CcodTrustedImportLease {
+    if ($null -ne ('CcodTrustedImportLeaseV1' -as [type])) { return }
+    Add-Type -ErrorAction Stop -TypeDefinition @'
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+
+public sealed class CcodTrustedImportLeaseV1 : IDisposable
+{
+    [StructLayout(LayoutKind.Sequential)] private struct NativeTime { public uint Low, High; }
+    [StructLayout(LayoutKind.Sequential)] private struct NativeInfo
+    {
+        public uint Attributes;
+        public NativeTime Creation, Access, Write;
+        public uint Volume, SizeHigh, SizeLow, Links, IndexHigh, IndexLow;
+    }
+    private sealed class Entry
+    {
+        public SafeFileHandle Handle;
+        public string Path;
+        public bool Directory;
+        public uint Volume;
+        public ulong FileId;
+    }
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern SafeFileHandle CreateFileW(string path, uint access, uint share, IntPtr security, uint creation, uint flags, IntPtr template);
+    [DllImport("kernel32.dll", SetLastError=true)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle handle, out NativeInfo info);
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern uint GetFinalPathNameByHandleW(SafeFileHandle handle, StringBuilder value, uint length, uint flags);
+
+    private readonly List<Entry> entries = new List<Entry>();
+    private bool disposed;
+    public string Path { get; private set; }
+    private CcodTrustedImportLeaseV1(string path) { Path = path; }
+
+    public static CcodTrustedImportLeaseV1 Acquire(string path)
+    {
+        if (String.IsNullOrWhiteSpace(path) || !System.IO.Path.IsPathRooted(path) ||
+            path.StartsWith(@"\\?\", StringComparison.Ordinal) || path.StartsWith(@"\\.\", StringComparison.Ordinal))
+            throw new ArgumentException("Unsupported module path");
+        string full = System.IO.Path.GetFullPath(path);
+        string root = System.IO.Path.GetPathRoot(full);
+        string extension = System.IO.Path.GetExtension(full);
+        if (!String.Equals(full, path, StringComparison.OrdinalIgnoreCase) || String.IsNullOrEmpty(root) ||
+            full.Substring(root.Length).IndexOf(':') >= 0 ||
+            (!String.Equals(extension, ".psm1", StringComparison.OrdinalIgnoreCase) && !String.Equals(extension, ".ps1", StringComparison.OrdinalIgnoreCase)))
+            throw new ArgumentException("Noncanonical module path");
+        var lease = new CcodTrustedImportLeaseV1(full);
+        try
+        {
+            var parents = new List<string>();
+            for (DirectoryInfo parent = Directory.GetParent(full); parent != null; parent = parent.Parent)
+                parents.Add(parent.FullName);
+            parents.Reverse();
+            if (parents.Count == 0 || !SamePath(parents[0], root)) throw new IOException("Missing module root");
+            // Retain root-to-leaf authority before traversing the next component.
+            foreach (string parent in parents) lease.Open(parent, true);
+            lease.Open(full, false);
+            lease.Revalidate();
+            return lease;
+        }
+        catch { lease.Dispose(); throw; }
+    }
+
+    private void Open(string path, bool directory)
+    {
+        uint access = directory ? 0x00100081U : 0x80100080U;
+        uint flags = 0x00200000U | (directory ? 0x02000000U : 0U);
+        // FILE_SHARE_READ only: preexisting writers/deleters must fail closed.
+        SafeFileHandle handle = CreateFileW(path, access, 1U, IntPtr.Zero, 3U, flags, IntPtr.Zero);
+        if (handle.IsInvalid) { int error = Marshal.GetLastWin32Error(); handle.Dispose(); throw new Win32Exception(error); }
+        try
+        {
+            NativeInfo info = Inspect(handle, path, directory);
+            entries.Add(new Entry { Handle = handle, Path = path, Directory = directory, Volume = info.Volume, FileId = FileId(info) });
+        }
+        catch { handle.Dispose(); throw; }
+    }
+
+    private static ulong FileId(NativeInfo info) { return ((ulong)info.IndexHigh << 32) | info.IndexLow; }
+    private static bool SamePath(string left, string right)
+    {
+        return String.Equals(left.TrimEnd('\\'), right.TrimEnd('\\'), StringComparison.OrdinalIgnoreCase);
+    }
+    private static NativeInfo Inspect(SafeFileHandle handle, string expected, bool directory)
+    {
+        NativeInfo info;
+        if (!GetFileInformationByHandle(handle, out info)) throw new Win32Exception(Marshal.GetLastWin32Error());
+        if ((info.Attributes & 0x400U) != 0 || ((info.Attributes & 0x10U) != 0) != directory)
+            throw new IOException("Unsafe module path kind");
+        var value = new StringBuilder(512);
+        uint length = GetFinalPathNameByHandleW(handle, value, (uint)value.Capacity, 0);
+        if (length == 0) throw new Win32Exception(Marshal.GetLastWin32Error());
+        if (length >= value.Capacity)
+        {
+            value.Capacity = checked((int)length + 1);
+            length = GetFinalPathNameByHandleW(handle, value, (uint)value.Capacity, 0);
+            if (length == 0 || length >= value.Capacity) throw new IOException("Module final path unavailable");
+        }
+        string final = value.ToString();
+        if (final.StartsWith(@"\\?\UNC\", StringComparison.OrdinalIgnoreCase)) final = @"\\" + final.Substring(8);
+        else if (final.StartsWith(@"\\?\", StringComparison.OrdinalIgnoreCase)) final = final.Substring(4);
+        if (!SamePath(final, expected)) throw new IOException("Module final path mismatch");
+        return info;
+    }
+
+    public void Revalidate()
+    {
+        if (disposed) throw new ObjectDisposedException("trusted module import lease");
+        foreach (Entry entry in entries)
+        {
+            NativeInfo info = Inspect(entry.Handle, entry.Path, entry.Directory);
+            if (info.Volume != entry.Volume || FileId(info) != entry.FileId) throw new IOException("Module identity changed");
+        }
+    }
+    public void Dispose()
+    {
+        if (disposed) return;
+        disposed = true;
+        for (int index = entries.Count - 1; index >= 0; index--) entries[index].Handle.Dispose();
+        entries.Clear();
+    }
+}
+'@
+}
+
+function Open-CcodTrustedImportLease {
+    param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$ErrorId)
+    try {
+        Initialize-CcodTrustedImportLease
+        return [CcodTrustedImportLeaseV1]::Acquire($Path)
+    } catch {
+        throw [Management.Automation.ErrorRecord]::new(
+            [InvalidOperationException]::new('Trusted module import authority could not be acquired.'),
+            $ErrorId,[Management.Automation.ErrorCategory]::InvalidData,$Path)
+    }
+}
+# END CCOD TRUSTED IMPORT BOOTSTRAP
+
 $modulePath = Join-Path $PSScriptRoot 'ReleaseDefender.psm1'
 if (-not [IO.File]::Exists($modulePath)) { Write-Error 'CCOD_RELEASE_DEFENDER_MODULE_MISSING'; exit 1 }
 
 try {
-    Import-Module $modulePath -Force -ErrorAction Stop
+    $moduleLease = Open-CcodTrustedImportLease -Path $modulePath -ErrorId 'CCOD_RELEASE_DEFENDER_MODULE_MISSING'
+    try {
+        $moduleLease.Revalidate()
+        Import-Module $modulePath -Force -ErrorAction Stop
+        $moduleLease.Revalidate()
+    } finally { $moduleLease.Dispose() }
     Invoke-CcodReleaseDefenderCheck -CandidatePath $CandidatePath -ChecksumPath $ChecksumPath -ManifestPath $ManifestPath -Origin $Origin -WorkflowArtifactIdentity $WorkflowArtifactIdentity -ExpectedVersion $ExpectedVersion -ExpectedGitCommit $ExpectedGitCommit -EvidencePath $EvidencePath | ConvertTo-Json -Depth 12
 } catch {
     Write-Error $_

From 79b6aa04417e0e4ef096956125261e4ce193e33e Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sat, 12 Sep 2026 06:17:17 +0800
Subject: [PATCH 165/187] fix: harden runtime payload containment

---
 src/persistence/StaticProbeWorker.ps1         | 15 +++-
 src/persistence/modules/RuntimeManifest.psm1  | 63 ++++++++++++-
 .../persistence/RuntimeManifest.SelfTest.ps1  | 18 ++++
 .../StaticProbeWorker.SelfTest.ps1            | 89 ++++++++++++++++++-
 .../TrustedModuleImport.SelfTest.ps1          | 78 +++++++++++++++-
 5 files changed, 258 insertions(+), 5 deletions(-)

diff --git a/src/persistence/StaticProbeWorker.ps1 b/src/persistence/StaticProbeWorker.ps1
index 7adb9b7..16cc097 100644
--- a/src/persistence/StaticProbeWorker.ps1
+++ b/src/persistence/StaticProbeWorker.ps1
@@ -114,6 +114,19 @@ function Test-CcodStaticRuntimeId {
     return $Value -is [string] -and $Value -cmatch '^[A-Za-z0-9._-]{1,96}$'
 }
 
+function ConvertTo-CcodStaticRuntimeGeneration {
+    param([Parameter(Mandatory)]$Value,[Parameter(Mandatory)][string]$Path,[switch]$AllowZero)
+    $minimum=if($AllowZero){[decimal]0}else{[decimal]1}
+    $integerTypes=@([byte],[uint16],[uint32],[uint64],[int16],[int32],[int64])
+    $typed=$Value -is [decimal]
+    if(-not$typed){foreach($type in $integerTypes){if($Value -is $type){$typed=$true;break}}}
+    if(-not$typed){Throw-CcodStaticProbeError 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Active generation is not an unsigned integer' $Path}
+    try{
+        if([decimal]$Value -lt $minimum -or ($Value -is [decimal] -and [decimal]::Truncate($Value)-ne$Value)){throw 'range'}
+        return [uint64]$Value
+    }catch{Throw-CcodStaticProbeError 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Active generation is outside UInt64' $Path}
+}
+
 function Test-CcodStaticCanonicalSid {
     param($Value)
     if ($Value -isnot [string]) { return $false }
@@ -490,7 +503,7 @@ function Get-CcodStaticProbeRuntimeAuthorization {
         if($null-ne$pointerRootItem-and-not$pointerRootItem.PSIsContainer){throw 'selector root type'}
         if($null-ne$pointerRootItem){
             Assert-CcodStaticProbeNoReparse $installRoot $pointerRoot -Adapters $Adapters;$entries=@(Get-ChildItem -LiteralPath $pointerRoot -Force -ErrorAction Stop);if($entries.Count-eq0){throw 'empty active chain'};$records=[Collections.Generic.List[object]]::new()
-            foreach($entry in $entries){if($entry.PSIsContainer-or$entry.Name-cnotmatch'^\d{20}\.json$'){throw 'active entry'};Assert-CcodStaticSelectorFile $installRoot $entry.FullName $Adapters;$record=Read-CcodStaticProbeLocalJson $entry.FullName;Assert-CcodStaticExactObject $record @('schemaVersion','generation','activeRuntime','previousGeneration') 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Active generation'|Out-Null;if($record.schemaVersion -isnot [int] -or $record.schemaVersion -ne 1){throw 'active generation schema'};if($record.generation-isnot[long]-and$record.generation-isnot[int]-or$record.previousGeneration-isnot[long]-and$record.previousGeneration-isnot[int]-or-not(Test-CcodStaticRuntimeId $record.activeRuntime)){throw 'active generation'};try{[uint64]$generation=$record.generation;[uint64]$previousGeneration=$record.previousGeneration}catch{throw 'active generation range'};if($generation-eq0-or$previousGeneration-eq[uint64]::MaxValue-or$generation-ne($previousGeneration+1)-or$entry.Name-cne('{0:D20}.json'-f$generation)){throw 'active generation canonical'};$records.Add([pscustomobject]@{generation=$generation;previousGeneration=$previousGeneration;activeRuntime=[string]$record.activeRuntime;path=$entry.FullName})}
+            foreach($entry in $entries){if($entry.PSIsContainer-or$entry.Name-cnotmatch'^\d{20}\.json$'){throw 'active entry'};Assert-CcodStaticSelectorFile $installRoot $entry.FullName $Adapters;$record=Read-CcodStaticProbeLocalJson $entry.FullName;Assert-CcodStaticExactObject $record @('schemaVersion','generation','activeRuntime','previousGeneration') 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Active generation'|Out-Null;if($record.schemaVersion -isnot [int] -or $record.schemaVersion -ne 1){throw 'active generation schema'};if(-not(Test-CcodStaticRuntimeId $record.activeRuntime)){throw 'active generation'};$generation=ConvertTo-CcodStaticRuntimeGeneration -Value $record.generation -Path $entry.FullName;$previousGeneration=ConvertTo-CcodStaticRuntimeGeneration -Value $record.previousGeneration -Path $entry.FullName -AllowZero;if($generation-eq0-or$previousGeneration-eq[uint64]::MaxValue-or$generation-ne($previousGeneration+1)-or$entry.Name-cne('{0:D20}.json'-f$generation)){throw 'active generation canonical'};$records.Add([pscustomobject]@{generation=$generation;previousGeneration=$previousGeneration;activeRuntime=[string]$record.activeRuntime;path=$entry.FullName})}
             $ordered=@($records|Sort-Object generation);for($i=0;$i-lt$ordered.Count;$i++){if([uint64]$ordered[$i].generation-ne[uint64]($i+1)-or[uint64]$ordered[$i].previousGeneration-ne[uint64]$i){throw 'active chain'}};$latest=$ordered[-1];$active=[pscustomobject]@{activeRuntime=$latest.activeRuntime};$activePath=$latest.path
         }else{$activePath=[IO.Path]::GetFullPath((Join-Path $installRoot 'active.json'));Assert-CcodStaticProbeNoReparse $installRoot $activePath -Adapters $Adapters;$active=Read-CcodStaticProbeLocalJson $activePath;Assert-CcodStaticExactObject $active @('schemaVersion','activeRuntime','previousRuntime','updatedAtUtc') 'CCOD_STATIC_RUNTIME_UNAUTHORIZED' 'Active pointer'|Out-Null;if($active.schemaVersion -isnot [int] -or $active.schemaVersion -ne 1 -or -not(Test-CcodStaticRuntimeId $active.activeRuntime) -or($null -ne $active.previousRuntime -and (-not(Test-CcodStaticRuntimeId $active.previousRuntime) -or $active.previousRuntime -ceq $active.activeRuntime)) -or-not(Test-CcodStaticCanonicalUtc $active.updatedAtUtc)){throw 'active pointer'}}
         if($active.activeRuntime-cne$runtimeId){throw 'active runtime'}
diff --git a/src/persistence/modules/RuntimeManifest.psm1 b/src/persistence/modules/RuntimeManifest.psm1
index 61340f5..c425bde 100644
--- a/src/persistence/modules/RuntimeManifest.psm1
+++ b/src/persistence/modules/RuntimeManifest.psm1
@@ -134,6 +134,56 @@ function Get-CcodRuntimeFileSha256 {
     }
 }
 
+function Get-CcodRuntimeFileLinkCount {
+    param([Parameter(Mandatory)][string]$Path)
+
+    if ($null -eq ('CcodRuntimeFileIdentity' -as [type])) {
+        Add-Type -TypeDefinition @'
+using System;
+using System.ComponentModel;
+using System.IO;
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+
+public static class CcodRuntimeFileIdentity
+{
+    [StructLayout(LayoutKind.Sequential)]
+    private struct FILETIME_NATIVE { public uint Low; public uint High; }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct FILE_INFO
+    {
+        public uint FileAttributes;
+        public FILETIME_NATIVE CreationTime;
+        public FILETIME_NATIVE LastAccessTime;
+        public FILETIME_NATIVE LastWriteTime;
+        public uint VolumeSerialNumber;
+        public uint FileSizeHigh;
+        public uint FileSizeLow;
+        public uint NumberOfLinks;
+        public uint FileIndexHigh;
+        public uint FileIndexLow;
+    }
+
+    [DllImport("kernel32.dll", SetLastError=true)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle handle, out FILE_INFO info);
+
+    public static uint Links(string path)
+    {
+        using (FileStream stream = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.Read))
+        {
+            FILE_INFO info;
+            if (!GetFileInformationByHandle(stream.SafeFileHandle, out info))
+                throw new Win32Exception(Marshal.GetLastWin32Error());
+            return info.NumberOfLinks;
+        }
+    }
+}
+'@
+    }
+    return [CcodRuntimeFileIdentity]::Links($Path)
+}
+
 function ConvertTo-CcodRuntimeRelativePath {
     param(
         [Parameter(Mandatory)][string]$Root,
@@ -144,15 +194,23 @@ function ConvertTo-CcodRuntimeRelativePath {
     if (-not $FullName.StartsWith($rootPrefix, [StringComparison]::OrdinalIgnoreCase)) {
         Throw-CcodRuntimeError 'CCOD_PATH_OUTSIDE_ROOT' 'Runtime file is outside its runtime root' $FullName
     }
-    return $FullName.Substring($rootPrefix.Length).Replace('\', '/')
+    $relative = $FullName.Substring($rootPrefix.Length).Replace('\', '/')
+    return Assert-CcodManifestRelativePath -Path $relative
 }
 
 function Assert-CcodManifestRelativePath {
     param([Parameter(Mandatory)][string]$Path)
 
+    foreach ($character in $Path.ToCharArray()) {
+        if ([char]::IsControl($character) -or
+            [Globalization.CharUnicodeInfo]::GetUnicodeCategory($character) -eq [Globalization.UnicodeCategory]::Format) {
+            Throw-CcodRuntimeError 'CCOD_PATH_OUTSIDE_ROOT' 'Manifest file path contains a control or format character' $Path
+        }
+    }
     if ([IO.Path]::IsPathRooted($Path) -or
         $Path.StartsWith('/') -or
         $Path.IndexOf('\') -ge 0 -or
+        $Path.IndexOf(':') -ge 0 -or
         $Path -match '(^|/)(\.|\.\.)(/|$)' -or
         $Path.Contains('//')) {
         Throw-CcodRuntimeError 'CCOD_PATH_OUTSIDE_ROOT' 'Manifest file path is not a safe relative path' $Path
@@ -176,6 +234,9 @@ function Get-CcodRuntimeFileRecords {
         if (-not $item.PSIsContainer) {
             $relative = ConvertTo-CcodRuntimeRelativePath -Root $root -FullName $item.FullName
             if (-not $relative.Equals('manifest.json', [StringComparison]::OrdinalIgnoreCase)) {
+                if ((Get-CcodRuntimeFileLinkCount -Path $item.FullName) -ne 1) {
+                    Throw-CcodRuntimeError 'CCOD_RUNTIME_FILE_INVALID' 'Runtime payload file must be a single-link regular file' $item.FullName
+                }
                 $records.Add([pscustomobject][ordered]@{
                     path = $relative
                     length = [int64]$item.Length
diff --git a/tests/persistence/RuntimeManifest.SelfTest.ps1 b/tests/persistence/RuntimeManifest.SelfTest.ps1
index 15ed16c..a1799bc 100644
--- a/tests/persistence/RuntimeManifest.SelfTest.ps1
+++ b/tests/persistence/RuntimeManifest.SelfTest.ps1
@@ -150,6 +150,15 @@ try {
         Assert-CcodTrue $validation.Valid 'a safe filename with consecutive dots must validate after production'
     }
 
+    Invoke-CcodTest 'runtime manifest rejects control and format characters in relative paths' {
+        $module = Get-Module -Name RuntimeManifest
+        foreach ($control in @("`t", "`n", "`r", [char]1, [char]0x7f, [char]0x200b)) {
+            Assert-CcodThrows { & $module { param($Path) Assert-CcodManifestRelativePath -Path $Path | Out-Null } ('safe' + $control + 'name.txt') } 'CCOD_PATH_OUTSIDE_ROOT'
+            $fullName = Join-Path $root ('safe' + $control + 'name.txt')
+            Assert-CcodThrows { & $module { param($Root, $FullName) ConvertTo-CcodRuntimeRelativePath -Root $Root -FullName $FullName | Out-Null } $root $fullName } 'CCOD_PATH_OUTSIDE_ROOT'
+        }
+    }
+
     Invoke-CcodTest 'verifies exact runtime bytes and rejects tampering' {
         $runtime = Join-Path $root 'verify'
         New-Item -ItemType Directory -Path $runtime | Out-Null
@@ -205,6 +214,15 @@ try {
         Assert-CcodThrows { Test-CcodRuntimeManifest -RuntimeDirectory $runtime -ExpectedRuntimeId $outsideManifest.runtimeId } 'CCOD_REPARSE_PATH'
     }
 
+    Invoke-CcodTest 'runtime manifest rejects hardlinked payload files' {
+        $runtime = Join-Path $root 'hardlink-payload'
+        $outsidePayload = Join-Path $outside 'hardlink-payload.txt'
+        New-Item -ItemType Directory -Path $runtime | Out-Null
+        [IO.File]::WriteAllText($outsidePayload, 'hardlinked payload', [Text.UTF8Encoding]::new($false))
+        New-Item -ItemType HardLink -Path (Join-Path $runtime 'payload.txt') -Target $outsidePayload | Out-Null
+        Assert-CcodThrows { New-CcodRuntimeManifest -RuntimeDirectory $runtime -ProjectVersion '2.0.0' } 'CCOD_RUNTIME_FILE_INVALID'
+    }
+
     Invoke-CcodTest 'runtime manifest rejects a noncanonical runtime directory' {
         $fixture = New-CcodRuntimeFixture -InstallRoot $root -ProjectVersion '2.0.0' -AContent 'a' -BContent 'b'
         $noncanonical = [string]$fixture.Runtime + '\.'
diff --git a/tests/persistence/StaticProbeWorker.SelfTest.ps1 b/tests/persistence/StaticProbeWorker.SelfTest.ps1
index c0e04f3..02f9c58 100644
--- a/tests/persistence/StaticProbeWorker.SelfTest.ps1
+++ b/tests/persistence/StaticProbeWorker.SelfTest.ps1
@@ -202,6 +202,76 @@ function Get-CcodTestRuntimeRecords {
     return $records.ToArray()
 }
 
+function Test-CcodTransientFixtureMoveFailure {
+    param([Parameter(Mandatory)]$ErrorRecord)
+    $transientHresults = @(-2146232800,-2147024891,-2147024864,-2147024863,-2147024726)
+    foreach ($exception in @($ErrorRecord.Exception, $ErrorRecord.Exception.InnerException)) {
+        if ($null -eq $exception) { continue }
+        if (($exception -is [IO.IOException] -or $exception -is [UnauthorizedAccessException]) -and [int64]$exception.HResult -in $transientHresults) { return $true }
+    }
+    return $false
+}
+
+function Move-CcodTestFixtureDirectory {
+    param([Parameter(Mandatory)][string]$Source,[Parameter(Mandatory)][string]$Destination,[Parameter(Mandatory)][scriptblock]$Move)
+    $lastFailure = $null
+    for ($attempt = 1; $attempt -le 8; $attempt++) {
+        try { & $Move $Source $Destination; return }
+        catch {
+            $lastFailure = $_
+            if ($attempt -ge 8 -or -not (Test-CcodTransientFixtureMoveFailure -ErrorRecord $_)) { throw }
+            Start-Sleep -Milliseconds ([Math]::Min(200, 10 * $attempt))
+        }
+    }
+    throw $lastFailure
+}
+
+Invoke-CcodTest 'fixture directory move retries a transient Windows file-system failure' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-static-move-retry-' + [guid]::NewGuid().ToString('N'))
+    $source = Join-Path $root 'source'
+    $destination = Join-Path $root 'destination'
+    try {
+        [IO.Directory]::CreateDirectory($source) | Out-Null
+        $state = [pscustomobject]@{ Calls = 0 }
+        $move = {
+            param($From,$To)
+            $state.Calls++
+            if ($state.Calls -lt 3) { throw [IO.IOException]::new('transient fixture sharing violation') }
+            [IO.Directory]::Move($From,$To)
+        }.GetNewClosure()
+        Move-CcodTestFixtureDirectory -Source $source -Destination $destination -Move $move
+        Assert-CcodEqual 3 $state.Calls 'fixture move retries transient failures before succeeding'
+        Assert-CcodTrue ([IO.Directory]::Exists($destination)) 'fixture move publishes the destination after retry'
+        Assert-CcodTrue (-not [IO.Directory]::Exists($source)) 'fixture move leaves no source directory after retry'
+    } finally {
+        if ([IO.Directory]::Exists($root)) { [IO.Directory]::Delete($root,$true) }
+    }
+}
+
+Invoke-CcodTest 'fixture directory move does not retry a non-I/O exception with an I/O HResult' {
+    $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-static-move-nonio-' + [guid]::NewGuid().ToString('N'))
+    $source = Join-Path $root 'source'
+    $destination = Join-Path $root 'destination'
+    try {
+        [IO.Directory]::CreateDirectory($source) | Out-Null
+        $state = [pscustomobject]@{ Calls = 0 }
+        $failure = $null
+        $move = {
+            param($From,$To)
+            $state.Calls++
+            $exception = [Exception]::new('non-I/O fixture failure')
+            $field = [Exception].GetField('_HResult', [Reflection.BindingFlags]'NonPublic,Instance')
+            $field.SetValue($exception, [int32]-2146232800)
+            throw $exception
+        }.GetNewClosure()
+        try { Move-CcodTestFixtureDirectory -Source $source -Destination $destination -Move $move } catch { $failure = $_ }
+        Assert-CcodEqual 1 $state.Calls 'non-I/O exceptions are not retried from a coincidental I/O HResult'
+        Assert-CcodEqual 'non-I/O fixture failure' $failure.Exception.Message 'the original non-I/O failure is preserved'
+    } finally {
+        if ([IO.Directory]::Exists($root)) { [IO.Directory]::Delete($root,$true) }
+    }
+}
+
 function New-CcodAuthorizedRuntimeFixture {
     param([string]$Root,[string]$ReadStrictJsonMarker,[switch]$AppendOnly)
     $install = Join-Path $Root 'install'
@@ -232,7 +302,7 @@ function New-CcodAuthorizedRuntimeFixture {
     $runtimeId = Get-CcodTestRuntimeId -ProjectVersion '2.0.0' -Files $records
     $runtime = Join-Path (Join-Path $install 'runtime') $runtimeId
     [IO.Directory]::CreateDirectory((Split-Path $runtime -Parent)) | Out-Null
-    [IO.Directory]::Move($staging,$runtime)
+    Move-CcodTestFixtureDirectory -Source $staging -Destination $runtime -Move { param($Source,$Destination) [IO.Directory]::Move($Source,$Destination) }
     $manifest = [pscustomobject][ordered]@{schemaVersion=1;projectVersion='2.0.0';runtimeId=$runtimeId;files=$records}
     [IO.File]::WriteAllText((Join-Path $runtime 'manifest.json'),($manifest|ConvertTo-Json -Depth 12),[Text.UTF8Encoding]::new($false))
     if($AppendOnly){$pointerRoot=Join-Path $install 'state\active-generation';[IO.Directory]::CreateDirectory($pointerRoot)|Out-Null;$active=[pscustomobject][ordered]@{schemaVersion=1;generation=[uint64]1;activeRuntime=$runtimeId;previousGeneration=[uint64]0};[IO.File]::WriteAllText((Join-Path $pointerRoot '00000000000000000001.json'),($active|ConvertTo-Json -Compress),[Text.UTF8Encoding]::new($false))}
@@ -511,6 +581,23 @@ try {
         Assert-CcodEqual $fixture.RuntimeId $context.RuntimeId 'static worker binds the append-only selected runtime'
     }
 
+    Invoke-CcodTest 'append-only authorization accepts integral Decimal generation records' {
+        $large=[decimal]::Parse('9223372036854775808',[Globalization.CultureInfo]::InvariantCulture)
+        $maximum=[decimal]::Parse('18446744073709551615',[Globalization.CultureInfo]::InvariantCulture)
+        Assert-CcodEqual '9223372036854775808' ([string](ConvertTo-CcodStaticRuntimeGeneration -Value $large -Path 'fixture')) 'static worker accepts integral Decimal generations above Int64'
+        Assert-CcodEqual '18446744073709551615' ([string](ConvertTo-CcodStaticRuntimeGeneration -Value $maximum -Path 'fixture')) 'static worker accepts the maximum UInt64 generation represented as Decimal'
+        Assert-CcodEqual '0' ([string](ConvertTo-CcodStaticRuntimeGeneration -Value ([decimal]0) -Path 'fixture' -AllowZero)) 'static worker accepts Decimal zero for previousGeneration'
+        Assert-CcodThrows { ConvertTo-CcodStaticRuntimeGeneration -Value ([decimal]1.5) -Path 'fixture' } 'CCOD_STATIC_RUNTIME_UNAUTHORIZED'
+        Assert-CcodThrows { ConvertTo-CcodStaticRuntimeGeneration -Value ([decimal]-1) -Path 'fixture' } 'CCOD_STATIC_RUNTIME_UNAUTHORIZED'
+        Assert-CcodThrows { ConvertTo-CcodStaticRuntimeGeneration -Value ([decimal]::Parse('18446744073709551616',[Globalization.CultureInfo]::InvariantCulture)) -Path 'fixture' } 'CCOD_STATIC_RUNTIME_UNAUTHORIZED'
+        $fixture=New-CcodAuthorizedRuntimeFixture -Root (Join-Path $root 'append-decimal-generations') -AppendOnly
+        $pointerRoot=Join-Path $fixture.InstallRoot 'state\active-generation'
+        $json='{"schemaVersion":1,"generation":1.0,"activeRuntime":"'+$fixture.RuntimeId+'","previousGeneration":0.0}'
+        [IO.File]::WriteAllText((Join-Path $pointerRoot '00000000000000000001.json'),$json,[Text.UTF8Encoding]::new($false))
+        $authorization=Get-CcodStaticProbeRuntimeAuthorization -ScriptPath $fixture.WorkerPath
+        Assert-CcodEqual $fixture.RuntimeId $authorization.RuntimeId 'static worker accepts integral Decimal append-only generations'
+    }
+
     Invoke-CcodTest 'append-only authorization rejects unsafe roots leaves JSON and generations' {
         foreach($kind in @('root-file','root-reparse','leaf-reparse','ads','multilink','malformed','schema','duplicate','fractional','noncanonical')){
             $fixture=New-CcodAuthorizedRuntimeFixture -Root (Join-Path $root ("append-hostile-$kind")) -AppendOnly;$pointerRoot=Join-Path $fixture.InstallRoot 'state\active-generation';$leaf=Join-Path $pointerRoot '00000000000000000001.json';$target=Join-Path $fixture.InstallRoot ("target-$kind")
diff --git a/tests/persistence/TrustedModuleImport.SelfTest.ps1 b/tests/persistence/TrustedModuleImport.SelfTest.ps1
index 8f74a28..85492df 100644
--- a/tests/persistence/TrustedModuleImport.SelfTest.ps1
+++ b/tests/persistence/TrustedModuleImport.SelfTest.ps1
@@ -283,12 +283,86 @@ try {
     } finally { Remove-Item -LiteralPath $fixture.Root -Recurse -Force }
 }
 
+function Move-CcodImportDirectoryWithRetry {
+    param([Parameter(Mandatory)][string]$Source,[Parameter(Mandatory)][string]$Destination,[Parameter(Mandatory)][scriptblock]$Move)
+    $lastFailure = $null
+    for ($attempt = 1; $attempt -le 8; $attempt++) {
+        try { & $Move $Source $Destination; return }
+        catch {
+            $lastFailure = $_
+            if ($attempt -ge 8 -or -not (Test-CcodTransientImportMoveFailure -ErrorRecord $_)) { throw }
+            Start-Sleep -Milliseconds ([Math]::Min(200, 10 * $attempt))
+        }
+    }
+    throw $lastFailure
+}
+
+function Test-CcodTransientImportMoveFailure {
+    param([Parameter(Mandatory)]$ErrorRecord)
+    $transientHresults = @(-2146232800,-2147024891,-2147024864,-2147024863,-2147024726)
+    foreach ($exception in @($ErrorRecord.Exception, $ErrorRecord.Exception.InnerException)) {
+        if ($null -eq $exception) { continue }
+        if (($exception -is [IO.IOException] -or $exception -is [UnauthorizedAccessException]) -and [int64]$exception.HResult -in $transientHresults) { return $true }
+    }
+    return $false
+}
+
+Invoke-CcodImportTest 'Lease' 'fixture directory move retries transient access failures' {
+    $fixture = New-CcodImportFixture
+    $source = Join-Path $fixture.Root 'retry-source'
+    $destination = Join-Path $fixture.Root 'retry-destination'
+    try {
+        [IO.Directory]::CreateDirectory($source) | Out-Null
+        $state = [pscustomobject]@{ Calls = 0 }
+        $move = {
+            param($From,$To)
+            $state.Calls++
+            if ($state.Calls -lt 3) { throw [IO.IOException]::new('transient fixture access failure') }
+            [IO.Directory]::Move($From,$To)
+        }.GetNewClosure()
+        Move-CcodImportDirectoryWithRetry -Source $source -Destination $destination -Move $move
+        Assert-CcodEqual 3 $state.Calls 'fixture move retries transient access failures before succeeding'
+        Assert-CcodTrue ([IO.Directory]::Exists($destination)) 'fixture move publishes the destination after retry'
+        Assert-CcodTrue (-not [IO.Directory]::Exists($source)) 'fixture move leaves no source directory after retry'
+    } finally {
+        if ([IO.Directory]::Exists($source)) { [IO.Directory]::Delete($source, $true) }
+        if ([IO.Directory]::Exists($destination)) { [IO.Directory]::Delete($destination, $true) }
+        if ([IO.Directory]::Exists($fixture.Root)) { [IO.Directory]::Delete($fixture.Root, $true) }
+    }
+}
+
+Invoke-CcodImportTest 'Lease' 'fixture directory move does not retry a non-I/O exception with an I/O HResult' {
+    $fixture = New-CcodImportFixture
+    $source = Join-Path $fixture.Root 'nonio-source'
+    $destination = Join-Path $fixture.Root 'nonio-destination'
+    try {
+        [IO.Directory]::CreateDirectory($source) | Out-Null
+        $state = [pscustomobject]@{ Calls = 0 }
+        $failure = $null
+        $move = {
+            param($From,$To)
+            $state.Calls++
+            $exception = [Exception]::new('non-I/O fixture failure')
+            $field = [Exception].GetField('_HResult', [Reflection.BindingFlags]'NonPublic,Instance')
+            $field.SetValue($exception, [int32]-2146232800)
+            throw $exception
+        }.GetNewClosure()
+        try { Move-CcodImportDirectoryWithRetry -Source $source -Destination $destination -Move $move } catch { $failure = $_ }
+        Assert-CcodEqual 1 $state.Calls 'non-I/O exceptions are not retried from a coincidental I/O HResult'
+        Assert-CcodEqual 'non-I/O fixture failure' $failure.Exception.Message 'the original non-I/O failure is preserved'
+    } finally {
+        if ([IO.Directory]::Exists($source)) { [IO.Directory]::Delete($source, $true) }
+        if ([IO.Directory]::Exists($destination)) { [IO.Directory]::Delete($destination, $true) }
+        if ([IO.Directory]::Exists($fixture.Root)) { [IO.Directory]::Delete($fixture.Root, $true) }
+    }
+}
+
 function Assert-CcodImportFixtureReleased {
     param($Fixture,[string]$Target)
     [IO.File]::WriteAllText($Target, '# lease released')
     foreach ($directory in @($Fixture.Tools, (Split-Path $Fixture.Tools -Parent), $Fixture.Root)) {
-        [IO.Directory]::Move($directory, $directory + '-released')
-        [IO.Directory]::Move($directory + '-released', $directory)
+        Move-CcodImportDirectoryWithRetry -Source $directory -Destination ($directory + '-released') -Move { param($From,$To) [IO.Directory]::Move($From,$To) }
+        Move-CcodImportDirectoryWithRetry -Source ($directory + '-released') -Destination $directory -Move { param($From,$To) [IO.Directory]::Move($From,$To) }
     }
 }
 

From 0124dfbec9920cc2b056c056e5f5abf7d2ea3128 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sat, 12 Sep 2026 06:51:21 +0800
Subject: [PATCH 166/187] test: remove uninstall wrapper timing race

---
 tests/persistence/UninstallBootstrap.SelfTest.ps1 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index 9dce499..1bbc351 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -1056,7 +1056,7 @@ function Invoke-CcodDefaultInstalledFinalizerNegative {
         if($Mutation-ceq'Sibling'){$runtime=Join-Path $install 'runtime\same-bootstrap-sibling';Copy-Item -LiteralPath $selected -Destination $runtime -Recurse -Force}
         elseif($Mutation-ceq'WrongPath'){$runtime=Join-Path $selected 'nested-wrong-runtime'}
         $identity=Get-CcodUninstallBootstrapCurrentIdentity;$id=[guid]::NewGuid().ToString('D');$transactionRoot=Get-CcodUninstallBootstrapDefaultTransactionRoot;$directory=New-CcodUninstallBootstrapTransactionDirectory -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid
-        $wrapper=Start-Process -FilePath 'powershell.exe' -ArgumentList @('-NoProfile','-Command','Start-Sleep -Milliseconds 1400') -WindowStyle Hidden -PassThru;$wrapperCreation=$wrapper.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)
+        $wrapper=Start-Process -FilePath 'powershell.exe' -ArgumentList @('-NoProfile','-Command','Start-Sleep -Milliseconds 5000') -WindowStyle Hidden -PassThru;$wrapperCreation=$wrapper.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture)
         $payload=Join-Path $directory 'payload';$recordMap=@{};foreach($relative in $script:CcodUninstallPayloadEntries){$source=Join-Path $selected $relative.Replace('/','\');$destination=Join-Path $payload $relative.Replace('/','\');[IO.Directory]::CreateDirectory((Split-Path $destination -Parent))|Out-Null;[IO.File]::Copy($source,$destination,$true);$recordMap[$relative]=Get-CcodUninstallBootstrapFileFingerprint $source};$payloadRecords=New-CcodUninstallBootstrapPayloadRecords -RecordMap $recordMap
         $tx=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$tx.transactionId=$id;$tx.runtimeId=[IO.Path]::GetFileName($runtime);$tx.runtimeGeneration=[uint64]7;$tx.leaseEpoch=if($Mutation-ceq'StaleEpoch'){[uint64]12}else{[uint64]11};$tx.userSid=$identity.userSid;$tx.sessionId=$identity.sessionId;$tx.readyEvidence.installRoot=$install;$tx.readyEvidence.runtimeId=$tx.runtimeId;$tx.readyEvidence.runtimeGeneration=[uint64]7;$manifest=(Get-FileHash (Join-Path $selected 'manifest.json') -Algorithm SHA256).Hash.ToLowerInvariant();$tx.readyEvidence.manifestSha256=$manifest;$tx.installedBinding=New-CcodUninstallBootstrapTestInstalledBinding -TransactionId $id -RuntimeRoot $runtime -InstallRoot $install -UserSid $identity.userSid -SessionId $identity.sessionId -WrapperPid $wrapper.Id -WrapperCreationTimeUtc $wrapperCreation -PayloadRecords $payloadRecords -TransactionDirectory $directory -RuntimeManifestSha256 $manifest
         Write-CcodUninstallBootstrapStoredTransaction -TransactionDirectory $directory -Transaction $tx;Publish-CcodUninstallBootstrapCurrentTransaction -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid

From 7d383c240e8720311a98940bd7ce54d6b89d6576 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sat, 12 Sep 2026 07:18:39 +0800
Subject: [PATCH 167/187] test: avoid platform-specific uninstall timing
 assertion

---
 tests/persistence/UninstallBootstrap.SelfTest.ps1 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index 1bbc351..b6c1951 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -1065,7 +1065,7 @@ function Invoke-CcodDefaultInstalledFinalizerNegative {
         elseif($Mutation-ceq'PayloadHash'){[IO.File]::AppendAllText((Join-Path $payload 'src\persistence\modules\ProductRegistration.psm1'),'# changed after staging',[Text.UTF8Encoding]::new($false))}
         $creationArgument=if($Mutation-ceq'WrapperIdentity'){'2001-02-03T04:05:06.0000000Z'}else{$wrapperCreation};$previousPreference=$ErrorActionPreference;try{$ErrorActionPreference='Continue';$output=& powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $payload 'src\persistence\InstalledUninstallFinalizer.ps1') -TransactionId $id -RuntimeRoot $runtime -InstallRoot $install -WrapperProcessId $wrapper.Id -WrapperCreationTimeUtc $creationArgument 2>&1;$exit=$LASTEXITCODE}finally{$ErrorActionPreference=$previousPreference}
         if($exit-ne3){throw("FINALIZER_DIAGNOSTIC mutation={0} exit={1} output={2}"-f$Mutation,$exit,(@($output)-join' | '))};Assert-CcodEqual 3 $exit "$Mutation default child rejects before finalization";Assert-CcodTrue (Test-Path -LiteralPath $selected -PathType Container) "$Mutation preserves the selected generation";Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $install 'state') -PathType Container) "$Mutation preserves sibling/root state"
-        if($Mutation-ceq'Sibling'){$wrapper.Refresh();Assert-CcodTrue $wrapper.HasExited 'Sibling reaches the default wrapper wait before its generation mismatch boundary'}
+
     }finally{if($null-ne$wrapper){try{if(-not$wrapper.HasExited){$wrapper.Kill();$wrapper.WaitForExit()}}catch{};$wrapper.Dispose()};[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path -LiteralPath $local){Remove-Item -LiteralPath $local -Recurse -Force}}
 }
 

From ea27909ccf7f7dc8b15318ae2cb43ff6102ae077 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Sun, 13 Sep 2026 04:47:38 +0800
Subject: [PATCH 168/187] fix: harden v2.5.22 install lifecycle reliability

---
 src/persistence/modules/InstallLifecycle.psm1 | 13 +++---
 tests/persistence/Bootstrap.SelfTest.ps1      |  2 +-
 .../persistence/InstallLifecycle.SelfTest.ps1 | 37 +++++++++++++++-
 .../InstalledLifecycleHarness.SelfTest.ps1    |  2 +-
 .../ProductResidueCleanup.SelfTest.ps1        |  2 +-
 tests/persistence/StateStore.SelfTest.ps1     |  2 +-
 .../StaticProbeWorker.SelfTest.ps1            |  6 +--
 .../UninstallBootstrap.SelfTest.ps1           | 43 +++++++++++--------
 8 files changed, 74 insertions(+), 33 deletions(-)

diff --git a/src/persistence/modules/InstallLifecycle.psm1 b/src/persistence/modules/InstallLifecycle.psm1
index 08c2453..1912df1 100644
--- a/src/persistence/modules/InstallLifecycle.psm1
+++ b/src/persistence/modules/InstallLifecycle.psm1
@@ -3317,13 +3317,6 @@ function Invoke-CcodInstall {
     }
     $nodeCandidates = @(Get-CcodLifecycleNodeCandidates -Adapters $adapters)
     if (-not $payloadBound) { $files = @(Get-CcodLifecycleSourceFiles -SourceRoot $sourceRoot -RequireTrayHost) }
-    $productShortcutTemporaryRoot=$null
-    if([string]$projectVersion-ceq$script:CcodProductVersion){
-        $preparedProductFiles=&$adapters.AddProductShortcutCandidates $files
-        if($null-eq$preparedProductFiles-or$null-eq$preparedProductFiles.Files){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product shortcut candidate preparation returned no files' $null}
-        $files=@($preparedProductFiles.Files);$productShortcutTemporaryRoot=[string]$preparedProductFiles.TemporaryRoot
-    }
-
     $oldManifestSha256=$null;$activeValidation=$null;$upgradeCompatibility=$null
     if($null-ne$existingPointer){
         $activeRuntimeRoot=[IO.Path]::GetFullPath((Join-Path (Join-Path $root 'runtime') ([string]$existingPointer.activeRuntime)))
@@ -3346,6 +3339,12 @@ function Invoke-CcodInstall {
             }
         }
     }
+    $productShortcutTemporaryRoot=$null
+    if([string]$projectVersion-ceq$script:CcodProductVersion){
+        $preparedProductFiles=&$adapters.AddProductShortcutCandidates $files
+        if($null-eq$preparedProductFiles-or$null-eq$preparedProductFiles.Files){Throw-CcodLifecycleError 'CCOD_PRODUCT_REGISTRATION_FAILED' 'Product shortcut candidate preparation returned no files' $null}
+        $files=@($preparedProductFiles.Files);$productShortcutTemporaryRoot=[string]$preparedProductFiles.TemporaryRoot
+    }
     if($null-ne$upgradeCompatibility-and$upgradeCompatibility.Kind-ceq'LegacyMigrationRetry'){
         [void](Assert-CcodLegacyMigrationRetryPackage -CompatibilityContext $upgradeCompatibility -ProjectVersion ([string]$projectVersion) -SealedPackageSha256 $SealedPackageSha256 -Files $files)
     }
diff --git a/tests/persistence/Bootstrap.SelfTest.ps1 b/tests/persistence/Bootstrap.SelfTest.ps1
index 080ad09..39e18d1 100644
--- a/tests/persistence/Bootstrap.SelfTest.ps1
+++ b/tests/persistence/Bootstrap.SelfTest.ps1
@@ -157,7 +157,7 @@ function Exit-CcodLifecycleOwnership {
             [IO.File]::AppendAllText((Join-Path $kernelDirectory 'LifecycleEpoch.psm1'), $releaseFailureInjection.Replace('__CCOD_RELEASE_MARKER_BASE64__',$releaseMarkerBase64), [Text.UTF8Encoding]::new($false))
         }
     }
-    $manifest = New-CcodRuntimeManifest -RuntimeDirectory $runtimeDirectory -ProjectVersion '0.0.0-bootstrap-test'
+    $manifest = New-CcodRuntimeManifest -RuntimeDirectory $runtimeDirectory -ProjectVersion '0.0.0-b'
     if ([string]::IsNullOrWhiteSpace($RuntimeId)) {
         $RuntimeId = $manifest.runtimeId
         $targetDirectory = Join-Path $Root "runtime\$RuntimeId"
diff --git a/tests/persistence/InstallLifecycle.SelfTest.ps1 b/tests/persistence/InstallLifecycle.SelfTest.ps1
index e8612ef..c8e985f 100644
--- a/tests/persistence/InstallLifecycle.SelfTest.ps1
+++ b/tests/persistence/InstallLifecycle.SelfTest.ps1
@@ -26,7 +26,11 @@ $v2521LifecycleShortcutNames=@(
 )
 
 function New-CcodLifecycleTempRoot {
-    return (Join-Path ([IO.Path]::GetTempPath()) ("ccod-lifecycle-" + [guid]::NewGuid().ToString('N')))
+    $tempPath = [IO.Path]::GetFullPath(([IO.Path]::GetTempPath()).TrimEnd('\'))
+    $tempLeaf = Split-Path $tempPath -Leaf
+    $parent = Split-Path $tempPath -Parent
+    $base = if ($tempLeaf.Length -gt 8 -and -not [string]::IsNullOrWhiteSpace($parent) -and [IO.Directory]::Exists($parent)) { $parent } else { $tempPath }
+    return (Join-Path $base ('c-' + [guid]::NewGuid().ToString('N').Substring(0,8)))
 }
 
 function New-CcodLifecycleSourceFixture {
@@ -2455,7 +2459,7 @@ $results += Invoke-CcodTest 'upgrade boundaries fail closed with phase receipts
         $install = New-CcodLifecycleTempRoot
         $nodeRoot = New-CcodLifecycleTempRoot
         try {
-            New-CcodLifecycleSourceFixture -Root $source -Version ('2.5.0-boundary-' + ($case.Name -replace '[^A-Za-z0-9]','-')) | Out-Null
+            New-CcodLifecycleSourceFixture -Root $source -Version '2.5.0-b' | Out-Null
             $nodePath = New-CcodLifecycleFakeNode -Root $nodeRoot
             $first = Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -Adapters (New-CcodLifecycleFake -NodePath $nodePath).Adapters
             Set-CcodLifecycleTestStatus -InstallRoot $install -RuntimeId $first.RuntimeId
@@ -4240,6 +4244,35 @@ $results += Invoke-CcodTest 'product registration runs exactly once only after t
     }finally{foreach($path in @($source,$install,$nodeRoot)){if(Test-Path $path){Remove-Item $path -Recurse -Force}}}
 }
 
+# Production mutation caught: an AlreadyInstalled return must not strand the
+# temporary shortcut candidates prepared before the idempotence check.
+$results += Invoke-CcodTest 'AlreadyInstalled product reconciliation removes temporary shortcut candidates before returning' {
+    $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot;$temporaryRoot=$null
+    try{
+        New-CcodLifecycleSourceFixture -Root $source -Version '2.5.22'|Out-Null
+        $node=New-CcodLifecycleFakeNode -Root $nodeRoot;$first=New-CcodLifecycleFake -NodePath $node
+        $firstResult=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('a'*64) -Adapters $first.Adapters
+        Assert-CcodEqual 'Installed' $firstResult.Outcome 'fixture reaches a Ready install before idempotent reconciliation'
+        $second=New-CcodLifecycleFake -NodePath $node
+        $preparedState=@{Calls=0;TemporaryRoot=$null}
+        $second.Adapters.AddProductShortcutCandidates={
+            param($Files)
+            $preparedState.Calls++
+            $temporaryRoot=Join-Path ([IO.Path]::GetTempPath()) ('ccod-lifecycle-same-identity-'+[guid]::NewGuid().ToString('N'))
+            [IO.Directory]::CreateDirectory($temporaryRoot)|Out-Null
+            [IO.File]::WriteAllText((Join-Path $temporaryRoot 'candidate.tmp'),'fixture',[Text.UTF8Encoding]::new($false))
+            $preparedState.TemporaryRoot=$temporaryRoot
+            [pscustomobject]@{Files=@($Files);TemporaryRoot=$temporaryRoot}
+        }.GetNewClosure()
+        $secondResult=Invoke-CcodInstall -SourceRoot $source -InstallRoot $install -SealedPackageSha256 ('a'*64) -Adapters $second.Adapters
+        Assert-CcodEqual 'AlreadyInstalled' $secondResult.Outcome 'same package takes the idempotent reconciliation path'
+        Assert-CcodEqual 0 $preparedState.Calls 'idempotent reconciliation checks package identity before preparing product candidates'
+        Assert-CcodTrue ([string]::IsNullOrWhiteSpace([string]$preparedState.TemporaryRoot)) 'idempotent reconciliation creates no temporary product candidates'
+    }finally{
+        foreach($path in @($source,$install,$nodeRoot,$temporaryRoot)){if(-not[string]::IsNullOrWhiteSpace([string]$path)-and(Test-Path -LiteralPath $path)){Remove-Item -LiteralPath $path -Recurse -Force -ErrorAction SilentlyContinue}}
+    }
+}
+
 # Production mutation caught: treating post-Ready registration failure as an install rollback or Failed lifecycle snapshot.
 $results += Invoke-CcodTest 'registration failure preserves durable Ready without rollback or Failed transaction' {
     $source=New-CcodLifecycleTempRoot;$install=New-CcodLifecycleTempRoot;$nodeRoot=New-CcodLifecycleTempRoot
diff --git a/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1 b/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1
index 336d09b..842172c 100644
--- a/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1
+++ b/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1
@@ -1232,7 +1232,7 @@ try {
 }
 
 Invoke-CcodTest 'default finalizer pins its staged closure before validating the envelope' {
-    $root=Join-Path $env:TEMP ('ccod-finalizer-consumer-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path $env:TEMP ('ccod-finalizer-c-'+[guid]::NewGuid().ToString('N'))
     $previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process');$module=$null
     try {
         [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$root,'Process')
diff --git a/tests/persistence/ProductResidueCleanup.SelfTest.ps1 b/tests/persistence/ProductResidueCleanup.SelfTest.ps1
index e286c33..590c011 100644
--- a/tests/persistence/ProductResidueCleanup.SelfTest.ps1
+++ b/tests/persistence/ProductResidueCleanup.SelfTest.ps1
@@ -120,7 +120,7 @@ $results+=Invoke-CcodTest 'bounded cleanup accepts the actual installer state-pl
 
 function Invoke-CcodFullInstallerResidueCase {
     param([switch]$LegacyUpgrade)
-    $root=Join-Path $env:TEMP ('ccod-product-real-writers-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path $env:TEMP ('c-'+[guid]::NewGuid().ToString('N').Substring(0,8))
     $install=Join-Path $root 'CodexControlOtherDevices';$source=Join-Path $root 'source';$nodeRoot=Join-Path $root 'node'
     try {
         Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/InstallLifecycle.psm1') -Force -DisableNameChecking
diff --git a/tests/persistence/StateStore.SelfTest.ps1 b/tests/persistence/StateStore.SelfTest.ps1
index 14033a0..096ed36 100644
--- a/tests/persistence/StateStore.SelfTest.ps1
+++ b/tests/persistence/StateStore.SelfTest.ps1
@@ -124,7 +124,7 @@ function Assert-CcodFailedAttemptClearReceipt {
     Assert-CcodEqual $Outcome $Receipt.Outcome "$Message receipt outcome"
 }
 
-$root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-state-selftest-' + [Guid]::NewGuid().ToString('N'))
+$root = Join-Path ([IO.Path]::GetTempPath()) ('c-s-' + [Guid]::NewGuid().ToString('N'))
 try {
     Invoke-CcodTest 'exposes trusted safe-exit persistence with the state-store contract' {
         $commands = @('Get-CcodTrustedLogonIdentity', 'Read-CcodSafeExitIntent', 'Write-CcodSafeExitIntent', 'Test-CcodSafeExitIntentForCurrentLogon', 'Clear-CcodSafeExitIntent')
diff --git a/tests/persistence/StaticProbeWorker.SelfTest.ps1 b/tests/persistence/StaticProbeWorker.SelfTest.ps1
index 02f9c58..dddc9e1 100644
--- a/tests/persistence/StaticProbeWorker.SelfTest.ps1
+++ b/tests/persistence/StaticProbeWorker.SelfTest.ps1
@@ -372,7 +372,7 @@ function New-CcodWorkerHarness {
     [pscustomobject][ordered]@{RequestPath=$requestPath;ResultPath=$resultPath;Context=$context;Adapters=$adapters;Events=$events;Stdout=$stdout;Written=$written;ProbeCalls=$probeCalls}
 }
 
-$root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-static-worker-'+[guid]::NewGuid().ToString('N'))
+$root = Join-Path ([IO.Path]::GetTempPath()) 's'
 try {
     Invoke-CcodTest 'strictly rejects every request shape, order, type, case, and correlation mutation' {
         $base=New-CcodWorkerRequest
@@ -717,7 +717,7 @@ try {
             Assert-CcodEqual $(if($boundary -ceq 'ImportRuntime'){'CCOD_STATIC_MODULE_LOAD_FAILED'}else{'CCOD_STATIC_RUNTIME_UNAUTHORIZED'}) $harness.Written[0].error.code "$boundary failure keeps its fixed code"
         }
 
-        $fixture=New-CcodAuthorizedRuntimeFixture -Root (Join-Path $root 'production-module-failure-publication')
+        $fixture=New-CcodAuthorizedRuntimeFixture -Root (Join-Path $root 'mod-fail-pub')
         $request=New-CcodWorkerRequest;$request.runtimeId=$fixture.RuntimeId
         $requestPath=[IO.Path]::GetFullPath((Join-Path $fixture.WorkersRoot ("static-probe-$($request.requestId).request.json")))
         $resultPath=[IO.Path]::GetFullPath((Join-Path $fixture.WorkersRoot ("static-probe-$($request.requestId).result.json")))
@@ -738,7 +738,7 @@ try {
         Assert-CcodEqual 1 $stdout.Count 'successful fallback atomic publication emits one stdout frame'
         Assert-CcodEqual 0 $stderr.Count 'successful fallback atomic publication emits no stderr frame'
 
-        $raceFixture=New-CcodAuthorizedRuntimeFixture -Root (Join-Path $root 'production-module-failure-result-race')
+        $raceFixture=New-CcodAuthorizedRuntimeFixture -Root (Join-Path $root 'mod-fail-race')
         $raceRequest=New-CcodWorkerRequest;$raceRequest.runtimeId=$raceFixture.RuntimeId
         $raceRequestPath=[IO.Path]::GetFullPath((Join-Path $raceFixture.WorkersRoot ("static-probe-$($raceRequest.requestId).request.json")))
         $raceResultPath=[IO.Path]::GetFullPath((Join-Path $raceFixture.WorkersRoot ("static-probe-$($raceRequest.requestId).result.json")))
diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index b6c1951..b142d92 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -17,6 +17,15 @@ $canonicalTaskTarget=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolder
 
 $results=@()
 
+function New-CcodUninstallBootstrapTestRoot {
+    param([AllowNull()][string]$Tag)
+    $tempPath=[IO.Path]::GetFullPath(([IO.Path]::GetTempPath()).TrimEnd('\'))
+    $tempLeaf=Split-Path $tempPath -Leaf
+    $parent=Split-Path $tempPath -Parent
+    $base=if($tempLeaf.Length -gt 8 -and -not [string]::IsNullOrWhiteSpace($parent) -and [IO.Directory]::Exists($parent)){$parent}else{$tempPath}
+    return Join-Path $base ('u-' + [guid]::NewGuid().ToString('N').Substring(0,8))
+}
+
 $results+=Invoke-CcodTest 'uninstall bootstrap runtime IDs use canonical TAB delimiters' {
     $records=@(
         [pscustomobject]@{ path='a.txt'; length=[int64]5; sha256=('a'*64) }
@@ -258,7 +267,7 @@ $results += Invoke-CcodTest 'Prepare stages only the manifest-bound cleanup payl
 }
 
 $results += Invoke-CcodTest 'production runtime verification binds the installed bootstrap to an exact manifest and rejects a hash change' {
-    $localAppData = Join-Path ([IO.Path]::GetTempPath()) ('ccod-uninstall-bootstrap-' + [guid]::NewGuid().ToString('N'))
+    $localAppData = New-CcodUninstallBootstrapTestRoot ('u-b-' + [guid]::NewGuid().ToString('N').Substring(0,12))
     $installRoot = Join-Path $localAppData 'CodexControlOtherDevices'
     $previousLocalAppData = [Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
     try {
@@ -329,12 +338,12 @@ function Invoke-CcodInstalledFinalizerPublicResume {
 }
 
 $results += Invoke-CcodTest 'production uninstall authorization consumes append-only selector before legacy active json' {
-    $localAppData=Join-Path ([IO.Path]::GetTempPath()) ('ccod-uninstall-append-'+[guid]::NewGuid().ToString('N'));$installRoot=Join-Path $localAppData 'CodexControlOtherDevices';$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
+    $localAppData=New-CcodUninstallBootstrapTestRoot ('u-a-'+[guid]::NewGuid().ToString('N').Substring(0,12));$installRoot=Join-Path $localAppData 'CodexControlOtherDevices';$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
     try{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$localAppData,'Process');$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $installRoot -AppendOnly;$context=Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $installRoot;Assert-CcodEqual $fixture.RuntimeId $context.runtimeId 'uninstall context binds append-only active runtime';Assert-CcodEqual 7 ([uint64]$context.runtimeGeneration) 'uninstall context binds latest append-only generation';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $installRoot 'active.json')) 'append-only uninstall authorization needs no legacy pointer'}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $localAppData){Remove-Item $localAppData -Recurse -Force}}
 }
 
 $results += Invoke-CcodTest 'uninstall legacy fallback accepts a valid pointer when the entire state plane is absent' {
-    $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-uninstall-no-state-'+[guid]::NewGuid().ToString('N'));$install=Join-Path $local 'CodexControlOtherDevices';$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
+    $local=New-CcodUninstallBootstrapTestRoot ('u-n-'+[guid]::NewGuid().ToString('N').Substring(0,12));$install=Join-Path $local 'CodexControlOtherDevices';$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
     try{
         [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install|Out-Null
         $state=Join-Path $install 'state';Remove-Item -LiteralPath $state -Recurse -Force
@@ -354,16 +363,16 @@ $results += Invoke-CcodTest 'uninstall legacy fallback accepts a valid pointer w
 
 $results += Invoke-CcodTest 'uninstall append-only authorization rejects unsafe roots leaves JSON and generations' {
     $previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
-    try{foreach($kind in @('root-file','root-reparse','leaf-reparse','ads','multilink','malformed','schema','duplicate','fractional','noncanonical')){$local=Join-Path ([IO.Path]::GetTempPath()) ("ccod-uninstall-hostile-$kind-"+[guid]::NewGuid().ToString('N'));$install=Join-Path $local 'CodexControlOtherDevices';[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$pointerRoot=Join-Path $install 'state\active-generation';$leaf=Join-Path $pointerRoot '00000000000000000007.json';$target=Join-Path $install ("target-$kind");if($kind-ceq'root-file'){Remove-Item $pointerRoot -Recurse -Force;[IO.File]::WriteAllText($pointerRoot,'x',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'root-reparse'){Remove-Item $pointerRoot -Recurse -Force;[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $pointerRoot -Target $target|Out-Null}elseif($kind-ceq'leaf-reparse'){[IO.File]::Delete($leaf);[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $leaf -Target $target|Out-Null}elseif($kind-ceq'ads'){Set-Content -LiteralPath $leaf -Stream evidence -Value x -NoNewline}elseif($kind-ceq'multilink'){$text=[IO.File]::ReadAllText($leaf);[IO.File]::Delete($leaf);$outside=Join-Path $install 'outside-pointer.json';[IO.File]::WriteAllText($outside,$text,[Text.UTF8Encoding]::new($false));New-Item -ItemType HardLink -Path $leaf -Target $outside|Out-Null}elseif($kind-ceq'malformed'){[IO.File]::WriteAllText($leaf,'{',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'schema'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":2,"generation":7,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'duplicate'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"schemaVersion":1,"generation":7,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'fractional'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"generation":7.5,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}else{Move-Item $leaf (Join-Path $pointerRoot '00000000000000000008.json')};Assert-CcodThrows {Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $install|Out-Null} 'CCOD_UNINSTALL_RUNTIME_INVALID';if(Test-Path $local){Remove-Item $local -Recurse -Force}}}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process')}
+    try{foreach($kind in @('root-file','root-reparse','leaf-reparse','ads','multilink','malformed','schema','duplicate','fractional','noncanonical')){$local=New-CcodUninstallBootstrapTestRoot $kind;$install=Join-Path $local 'CodexControlOtherDevices';[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$pointerRoot=Join-Path $install 'state\active-generation';$leaf=Join-Path $pointerRoot '00000000000000000007.json';$target=Join-Path $install ("target-$kind");if($kind-ceq'root-file'){Remove-Item $pointerRoot -Recurse -Force;[IO.File]::WriteAllText($pointerRoot,'x',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'root-reparse'){Remove-Item $pointerRoot -Recurse -Force;[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $pointerRoot -Target $target|Out-Null}elseif($kind-ceq'leaf-reparse'){[IO.File]::Delete($leaf);[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $leaf -Target $target|Out-Null}elseif($kind-ceq'ads'){Set-Content -LiteralPath $leaf -Stream evidence -Value x -NoNewline}elseif($kind-ceq'multilink'){$text=[IO.File]::ReadAllText($leaf);[IO.File]::Delete($leaf);$outside=Join-Path $install 'outside-pointer.json';[IO.File]::WriteAllText($outside,$text,[Text.UTF8Encoding]::new($false));New-Item -ItemType HardLink -Path $leaf -Target $outside|Out-Null}elseif($kind-ceq'malformed'){[IO.File]::WriteAllText($leaf,'{',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'schema'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":2,"generation":7,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'duplicate'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"schemaVersion":1,"generation":7,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'fractional'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"generation":7.5,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}else{Move-Item $leaf (Join-Path $pointerRoot '00000000000000000008.json')};Assert-CcodThrows {Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $install|Out-Null} 'CCOD_UNINSTALL_RUNTIME_INVALID';if(Test-Path $local){Remove-Item $local -Recurse -Force}}}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process')}
 }
 
 $results += Invoke-CcodTest 'uninstall selector fallback requires proven ItemNotFound instead of a lookup error' {
-    $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-uninstall-lookup-'+[guid]::NewGuid().ToString('N'));$install=Join-Path $local 'CodexControlOtherDevices';$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
+    $local=New-CcodUninstallBootstrapTestRoot ('ccod-uninstall-lookup-'+[guid]::NewGuid().ToString('N'));$install=Join-Path $local 'CodexControlOtherDevices';$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
     try{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install|Out-Null;Assert-CcodThrows {Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $install -SelectorAdapters @{GetSelectorRootItem={param($Path)throw [UnauthorizedAccessException]::new('selector lookup denied')}}|Out-Null} 'CCOD_UNINSTALL_RUNTIME_INVALID'}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $local){Remove-Item $local -Recurse -Force}}
 }
 
 $results += Invoke-CcodTest 'uninstall legacy fallback rejects a state ancestor file at the selector boundary' {
-    $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-uninstall-state-file-'+[guid]::NewGuid().ToString('N'));$install=Join-Path $local 'CodexControlOtherDevices';$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
+    $local=New-CcodUninstallBootstrapTestRoot ('ccod-uninstall-state-file-'+[guid]::NewGuid().ToString('N'));$install=Join-Path $local 'CodexControlOtherDevices';$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
     try{
         [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install|Out-Null
         $state=Join-Path $install 'state';Remove-Item -LiteralPath $state -Recurse -Force;[IO.File]::WriteAllText($state,'not-a-directory',[Text.UTF8Encoding]::new($false))
@@ -374,7 +383,7 @@ $results += Invoke-CcodTest 'uninstall legacy fallback rejects a state ancestor
 }
 
 $results += Invoke-CcodTest 'external staging refuses a cleanup source changed after runtime verification' {
-    $localAppData = Join-Path ([IO.Path]::GetTempPath()) ('ccod-uninstall-race-' + [guid]::NewGuid().ToString('N'))
+    $localAppData = New-CcodUninstallBootstrapTestRoot ('ccod-uninstall-race-' + [guid]::NewGuid().ToString('N'))
     $installRoot = Join-Path $localAppData 'CodexControlOtherDevices'
     $previousLocalAppData = [Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
     try {
@@ -396,7 +405,7 @@ $results += Invoke-CcodTest 'external staging refuses a cleanup source changed a
 }
 
 $results += Invoke-CcodTest 'real external staging uses a protected current-user transaction directory and copies only verified cleanup inputs' {
-    $testRoot = Join-Path ([IO.Path]::GetTempPath()) ('ccod-uninstall-stage-' + [guid]::NewGuid().ToString('N'))
+    $testRoot = New-CcodUninstallBootstrapTestRoot ('ccod-uninstall-stage-' + [guid]::NewGuid().ToString('N'))
     $localAppData = Join-Path $testRoot 'local-app-data'
     $installRoot = Join-Path $localAppData 'CodexControlOtherDevices'
     $transactionRoot = Join-Path $localAppData 'CodexRemote-fix-uninstall'
@@ -504,7 +513,7 @@ $results += Invoke-CcodTest 'Prepare resumes only the exact durable transaction
 }
 
 $results += Invoke-CcodTest 'Prepare resumes a TaskRemoved transaction even after the runtime root and active pointer have been deleted' {
-    $localAppData = Join-Path ([IO.Path]::GetTempPath()) ('ccod-uninstall-resume-' + [guid]::NewGuid().ToString('N'))
+    $localAppData = New-CcodUninstallBootstrapTestRoot ('ccod-uninstall-resume-' + [guid]::NewGuid().ToString('N'))
     $installRoot = Join-Path $localAppData 'CodexControlOtherDevices'
     $previousLocalAppData = [Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
     try {
@@ -534,7 +543,7 @@ $results += Invoke-CcodTest 'Prepare resumes a TaskRemoved transaction even afte
 }
 
 $results += Invoke-CcodTest 'Prepare rejects a partial-deletion transaction from a different user before cleanup can resume' {
-    $localAppData = Join-Path ([IO.Path]::GetTempPath()) ('ccod-uninstall-other-user-' + [guid]::NewGuid().ToString('N'))
+    $localAppData = New-CcodUninstallBootstrapTestRoot ('ccod-uninstall-other-user-' + [guid]::NewGuid().ToString('N'))
     $installRoot = Join-Path $localAppData 'CodexControlOtherDevices'
     $previousLocalAppData = [Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
     try {
@@ -673,7 +682,7 @@ $results += Invoke-CcodTest 'same-SID new-session TaskRemoved replacement persis
 }
 
 $results += Invoke-CcodTest 'disk-backed new-session replacement uses real verified runtime and independent durable read-back' {
-    $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-task1-disk-'+[guid]::NewGuid().ToString('N'));$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
+    $local=New-CcodUninstallBootstrapTestRoot ('ccod-task1-disk-'+[guid]::NewGuid().ToString('N'));$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
     try{
         [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$install=Join-Path $local 'CodexControlOtherDevices';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly -ProjectVersion '2.5.22';$runtimeBootstrap=Join-Path $fixture.RuntimeRoot 'src\persistence\UninstallBootstrap.ps1';$context=Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $fixture.RuntimeRoot -InstallRoot $install -InvocationPath $runtimeBootstrap
         $identity=Get-CcodUninstallBootstrapCurrentIdentity;$process=[Diagnostics.Process]::GetCurrentProcess();try{$creation=$process.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture);$wrapper=[pscustomobject]@{pid=[int]$process.Id;creationTimeUtc=$creation;sessionId=[int]$identity.sessionId;userSid=[string]$identity.userSid}}finally{$process.Dispose()}
@@ -925,7 +934,7 @@ $results += Invoke-CcodTest 'fresh and stored Ready evidence require one exact c
 
 function Invoke-CcodDefaultInstalledProductCleanupCase {
     param([switch]$PartialFailure)
-    $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-installed-finalizer-'+[guid]::NewGuid().ToString('N'));$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
+    $local=New-CcodUninstallBootstrapTestRoot ('ccod-installed-finalizer-'+[guid]::NewGuid().ToString('N'));$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
     try{
         [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$install=Join-Path $local 'CodexControlOtherDevices';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly -ProjectVersion '2.5.22';$identity=Get-CcodUninstallBootstrapCurrentIdentity;$transactionRoot=Get-CcodUninstallBootstrapDefaultTransactionRoot;$id='11111111-2222-3333-4444-555555555555';$directory=New-CcodUninstallBootstrapTransactionDirectory -TransactionRoot $transactionRoot -TransactionId $id -UserSid $identity.userSid
         $payload=Join-Path $directory 'payload';$recordMap=@{};foreach($relative in $script:CcodUninstallPayloadEntries){$source=Join-Path $fixture.RuntimeRoot $relative.Replace('/','\');$destination=Join-Path $payload $relative.Replace('/','\');[IO.Directory]::CreateDirectory((Split-Path $destination -Parent))|Out-Null;[IO.File]::Copy($source,$destination,$true);$recordMap[$relative]=Get-CcodUninstallBootstrapFileFingerprint $source};$payloadRecords=New-CcodUninstallBootstrapPayloadRecords -RecordMap $recordMap
@@ -959,7 +968,7 @@ $results += Invoke-CcodTest 'default installed finalizer resumes after product c
 
 function Invoke-CcodInstalledReclamationMutationCase {
     param([Parameter(Mandatory)][ValidateSet('UnexpectedFile','UnexpectedDirectory','Reparse','Hardlink','Ads','OpenChild')][string]$Mutation)
-    $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-installed-reclamation-red-'+[guid]::NewGuid().ToString('N'));$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process');$attackState=[pscustomobject]@{Path=$null;OpenHandle=$null}
+    $local=New-CcodUninstallBootstrapTestRoot ('ccod-installed-reclamation-red-'+[guid]::NewGuid().ToString('N'));$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process');$attackState=[pscustomobject]@{Path=$null;OpenHandle=$null}
     try{
         [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$install=Join-Path $local 'CodexControlOtherDevices';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly
         $originalFiles=@(Get-ChildItem -LiteralPath $fixture.RuntimeRoot -File -Recurse -Force|ForEach-Object{[pscustomobject]@{Path=$_.FullName;Length=[int64]$_.Length;Sha256=Get-CcodTestFileSha256 $_.FullName}});$originalDirectories=@(Get-ChildItem -LiteralPath $fixture.RuntimeRoot -Directory -Recurse -Force|ForEach-Object FullName)
@@ -1007,7 +1016,7 @@ function Assert-CcodGenerationReclamationTreeProof {
 if([string]::IsNullOrWhiteSpace($env:CCOD_RECLAMATION_RED_CASE)-or$env:CCOD_RECLAMATION_RED_CASE-ceq'IdentityChange'){
     $results += Invoke-CcodTest 'generation reclamation pins the selected identity before the final pre-delete hook' {
         $modulePath=Join-Path $repositoryRoot 'src\persistence\modules\GenerationReclamation.psm1';if(-not(Test-Path -LiteralPath $modulePath -PathType Leaf)){throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new('generation reclamation module is missing'),'CCOD_RECLAMATION_RED_MODULE_MISSING',[Management.Automation.ErrorCategory]::ObjectNotFound,$modulePath)};$module=Import-Module $modulePath -Force -PassThru -DisableNameChecking
-        $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-reclamation-identity-'+[guid]::NewGuid().ToString('N'))
+        $local=New-CcodUninstallBootstrapTestRoot ('ccod-reclamation-identity-'+[guid]::NewGuid().ToString('N'))
         try{
             $install=Join-Path $local 'install';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$proof=Get-CcodGenerationReclamationTreeProof $fixture.RuntimeRoot;$manifest=Get-CcodTestFileSha256 (Join-Path $fixture.RuntimeRoot 'manifest.json')
             $replacement=Join-Path $local 'replacement-generation';Copy-Item -LiteralPath $fixture.RuntimeRoot -Destination $replacement -Recurse -Force;$replacementProof=Get-CcodGenerationReclamationTreeProof $replacement;$parked=Join-Path $local 'original-generation';$attack=[pscustomobject]@{Result=$null}
@@ -1022,7 +1031,7 @@ if([string]::IsNullOrWhiteSpace($env:CCOD_RECLAMATION_RED_CASE)-or$env:CCOD_RECL
 if([string]::IsNullOrWhiteSpace($env:CCOD_RECLAMATION_RED_CASE)-or$env:CCOD_RECLAMATION_RED_CASE-ceq'MarkFailure'){
     $results += Invoke-CcodTest 'file-arm failure disarms every held identity validates the complete tree and permits an exact retry' {
         $modulePath=Join-Path $repositoryRoot 'src\persistence\modules\GenerationReclamation.psm1';if(-not(Test-Path -LiteralPath $modulePath -PathType Leaf)){throw [Management.Automation.ErrorRecord]::new([InvalidOperationException]::new('generation reclamation module is missing'),'CCOD_RECLAMATION_RED_MODULE_MISSING',[Management.Automation.ErrorCategory]::ObjectNotFound,$modulePath)};$module=Import-Module $modulePath -Force -PassThru -DisableNameChecking
-        $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-reclamation-disarm-'+[guid]::NewGuid().ToString('N'))
+        $local=New-CcodUninstallBootstrapTestRoot ('ccod-reclamation-disarm-'+[guid]::NewGuid().ToString('N'))
         try{
             $install=Join-Path $local 'install';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$proof=Get-CcodGenerationReclamationTreeProof $fixture.RuntimeRoot;$manifest=Get-CcodTestFileSha256 (Join-Path $fixture.RuntimeRoot 'manifest.json');$sibling=Join-Path $install 'runtime\sibling';[IO.Directory]::CreateDirectory($sibling)|Out-Null;$siblingFile=Join-Path $sibling 'sentinel.bin';[IO.File]::WriteAllText($siblingFile,'sibling',[Text.UTF8Encoding]::new($false));$siblingHash=Get-CcodTestFileSha256 $siblingFile;$deviceKey=Join-Path $install 'state\device-key\private.bin';[IO.Directory]::CreateDirectory((Split-Path $deviceKey -Parent))|Out-Null;[IO.File]::WriteAllText($deviceKey,'device-key',[Text.UTF8Encoding]::new($false));$deviceKeyHash=Get-CcodTestFileSha256 $deviceKey
             &$module {$script:CcodGenerationReclamationFailFileArmAtForTest=2}
@@ -1035,7 +1044,7 @@ if([string]::IsNullOrWhiteSpace($env:CCOD_RECLAMATION_RED_CASE)-or$env:CCOD_RECL
 
 if([string]::IsNullOrWhiteSpace($env:CCOD_RECLAMATION_RED_CASE)-or$env:CCOD_RECLAMATION_RED_CASE-ceq'CommitFailure'){
     $results += Invoke-CcodTest 'irreversible reclamation failure reports CommitStarted and never touches sibling or lifecycle state' {
-        $modulePath=Join-Path $repositoryRoot 'src\persistence\modules\GenerationReclamation.psm1';$module=Import-Module $modulePath -Force -PassThru -DisableNameChecking;$local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-reclamation-commit-failure-'+[guid]::NewGuid().ToString('N'))
+        $modulePath=Join-Path $repositoryRoot 'src\persistence\modules\GenerationReclamation.psm1';$module=Import-Module $modulePath -Force -PassThru -DisableNameChecking;$local=New-CcodUninstallBootstrapTestRoot ('ccod-reclamation-commit-failure-'+[guid]::NewGuid().ToString('N'))
         try{
             $install=Join-Path $local 'install';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$proof=Get-CcodGenerationReclamationTreeProof $fixture.RuntimeRoot;$manifest=Get-CcodTestFileSha256 (Join-Path $fixture.RuntimeRoot 'manifest.json');$outside=Join-Path $local 'outside';[IO.Directory]::CreateDirectory($outside)|Out-Null;$outsideFile=Join-Path $outside 'sentinel.bin';[IO.File]::WriteAllText($outsideFile,'outside',[Text.UTF8Encoding]::new($false));$outsideHash=Get-CcodTestFileSha256 $outsideFile;$sibling=Join-Path $install 'runtime\sibling';[IO.Directory]::CreateDirectory($sibling)|Out-Null;$siblingFile=Join-Path $sibling 'sentinel.bin';[IO.File]::WriteAllText($siblingFile,'sibling',[Text.UTF8Encoding]::new($false));$siblingHash=Get-CcodTestFileSha256 $siblingFile;$deviceKey=Join-Path $install 'state\device-key\private.bin';[IO.Directory]::CreateDirectory((Split-Path $deviceKey -Parent))|Out-Null;[IO.File]::WriteAllText($deviceKey,'device-key',[Text.UTF8Encoding]::new($false));$deviceKeyHash=Get-CcodTestFileSha256 $deviceKey
             &$module {param($Index)$script:CcodGenerationReclamationFailCommitAtForTest=$Index} ($proof.Files.Count+1)
@@ -1050,7 +1059,7 @@ if([string]::IsNullOrWhiteSpace($env:CCOD_RECLAMATION_RED_CASE)-or$env:CCOD_RECL
 
 function Invoke-CcodDefaultInstalledFinalizerNegative {
     param([Parameter(Mandatory)][ValidateSet('Sibling','WrongPath','StaleEpoch','WrapperIdentity','WrongReadyRoot','ExtraReadyField','PayloadHash')][string]$Mutation)
-    $local=Join-Path ([IO.Path]::GetTempPath()) ('ccod-finalizer-negative-'+[guid]::NewGuid().ToString('N'));$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process');$wrapper=$null
+    $local=New-CcodUninstallBootstrapTestRoot ('ccod-finalizer-negative-'+[guid]::NewGuid().ToString('N'));$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process');$wrapper=$null
     try{
         [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$install=Join-Path $local 'CodexControlOtherDevices';$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$selected=$fixture.RuntimeRoot;$runtime=$selected
         if($Mutation-ceq'Sibling'){$runtime=Join-Path $install 'runtime\same-bootstrap-sibling';Copy-Item -LiteralPath $selected -Destination $runtime -Recurse -Force}

From c80502c928a402a0af233a5d9079d81bca0c4aa1 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Mon, 14 Sep 2026 01:16:40 +0800
Subject: [PATCH 169/187] test: harden temporary residue cleanup

---
 .../ProductResidueCleanup.SelfTest.ps1        | 26 ++++++------
 tests/persistence/TestSupport.SelfTest.ps1    | 35 ++++++++++++++++
 tests/persistence/TestSupport.ps1             | 42 ++++++++++++++++++-
 3 files changed, 89 insertions(+), 14 deletions(-)
 create mode 100644 tests/persistence/TestSupport.SelfTest.ps1

diff --git a/tests/persistence/ProductResidueCleanup.SelfTest.ps1 b/tests/persistence/ProductResidueCleanup.SelfTest.ps1
index 590c011..60c66b2 100644
--- a/tests/persistence/ProductResidueCleanup.SelfTest.ps1
+++ b/tests/persistence/ProductResidueCleanup.SelfTest.ps1
@@ -1,4 +1,4 @@
-$ErrorActionPreference='Stop'
+$ErrorActionPreference='Stop'
 . (Join-Path $PSScriptRoot 'TestSupport.ps1')
 $repositoryRoot=Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
 $module=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/GenerationReclamation.psm1') -Force -PassThru
@@ -36,7 +36,7 @@ $results+=Invoke-CcodTest 'bounded product residue cleanup removes only the veri
         Assert-CcodEqual 'Removed' $result.result 'product cleanup returns exact terminal result'
         Assert-CcodTrue (-not(Test-Path -LiteralPath $install)) 'complete uninstall removes the product root'
         Assert-CcodEqual $outsideHash (Get-CcodTestFileSha256 $outside) 'sibling project is unchanged'
-    } finally {if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+    } finally {if(Test-Path $root){Remove-CcodTestOwnedTree -Path $root}}
 }
 $results+=Invoke-CcodTest 'bounded product residue cleanup accepts real initialized state and retained manifest files' {
     $root=Join-Path $env:TEMP ('ccod-product-state-'+[guid]::NewGuid().ToString('N'))
@@ -63,7 +63,7 @@ $results+=Invoke-CcodTest 'bounded product residue cleanup accepts real initiali
         $result=&$module {param($Install,$Runtime)Remove-CcodVerifiedProductResidue -InstallRoot $Install -SelectedRuntimeId $Runtime -ExpectedEpoch ([uint64]11)} $install $runtimeId
         Assert-CcodEqual 'Removed' $result.result 'actual producers are accepted without loosening unknown-file handling'
         Assert-CcodTrue (-not(Test-Path -LiteralPath $install)) 'known state and verified retained product files are removed'
-    } finally {foreach($imported in $modules){Remove-Module $imported -Force -ErrorAction SilentlyContinue};if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+    } finally {foreach($imported in $modules){Remove-Module $imported -Force -ErrorAction SilentlyContinue};if(Test-Path $root){Remove-CcodTestOwnedTree -Path $root}}
 }
 
 foreach($mutation in @('UnknownFile','UnknownDirectory','DeviceKey','Reparse','Hardlink','Ads','OpenFile','EpochDrift')){
@@ -94,7 +94,7 @@ foreach($mutation in @('UnknownFile','UnknownDirectory','DeviceKey','Reparse','H
             Assert-CcodTrue (Test-Path $pointer) "$mutation leaves the product selector untouched"
             Assert-CcodTrue (Test-Path $epoch) "$mutation leaves the epoch untouched"
             Assert-CcodEqual $outsideHash (Get-CcodTestFileSha256 $outside) "$mutation leaves outside data untouched"
-        } finally {if($null-ne$held){$held.Dispose()};if(Test-Path (Join-Path $install 'projects') -PathType Container){$item=Get-Item (Join-Path $install 'projects') -Force;if($item.Attributes-band[IO.FileAttributes]::ReparsePoint){[IO.Directory]::Delete($item.FullName)}};if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+        } finally {if($null-ne$held){$held.Dispose()};if(Test-Path (Join-Path $install 'projects') -PathType Container){$item=Get-Item (Join-Path $install 'projects') -Force;if($item.Attributes-band[IO.FileAttributes]::ReparsePoint){[IO.Directory]::Delete($item.FullName)}};if(Test-Path $root){Remove-CcodTestOwnedTree -Path $root}}
     }
 }
 
@@ -115,7 +115,7 @@ $results+=Invoke-CcodTest 'bounded cleanup accepts the actual installer state-pl
         [IO.File]::WriteAllText((Join-Path $install 'state/active-generation/00000000000000000001.json'),('{"schemaVersion":1,"generation":1,"activeRuntime":"'+$runtimeId+'","previousGeneration":0}'))
         $result=&$module {param($Install,$Runtime)Remove-CcodVerifiedProductResidue -InstallRoot $Install -SelectedRuntimeId $Runtime -ExpectedEpoch ([uint64]11)} $install $runtimeId
         Assert-CcodEqual 'Removed' $result.result 'actual installer initialization records are recognized'
-    } finally {if($null-ne$fileTransaction){Close-CcodInstallFileTransaction -Transaction $fileTransaction -Disposition Failed|Out-Null};foreach($m in @($installModule,$fileModule)){if($null-ne$m){Remove-Module $m -Force -ErrorAction SilentlyContinue}};if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+    } finally {if($null-ne$fileTransaction){Close-CcodInstallFileTransaction -Transaction $fileTransaction -Disposition Failed|Out-Null};foreach($m in @($installModule,$fileModule)){if($null-ne$m){Remove-Module $m -Force -ErrorAction SilentlyContinue}};if(Test-Path $root){Remove-CcodTestOwnedTree -Path $root}}
 }
 
 function Invoke-CcodFullInstallerResidueCase {
@@ -150,7 +150,7 @@ function Invoke-CcodFullInstallerResidueCase {
         [IO.File]::WriteAllText((Join-Path $install 'state/lifecycle-epoch.json'),'{"schemaVersion":1,"epoch":11}')
         $result=&$module {param($Root,$Id)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId $Id -ExpectedEpoch ([uint64]11)} $install $active.activeRuntime
         Assert-CcodEqual 'Removed' $result.result 'full installer output is recognized without a fabricated state layout'
-    } finally {if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+    } finally {if(Test-Path $root){Remove-CcodTestOwnedTree -Path $root}}
 }
 
 $results+=Invoke-CcodTest 'bounded cleanup consumes the full actual installer output with isolated machine adapters' {Invoke-CcodFullInstallerResidueCase}
@@ -176,7 +176,7 @@ $results+=Invoke-CcodTest 'an existing cleanup journal cannot authorize an unkno
         [IO.File]::WriteAllText((Join-Path $directory 'product-residue-plan.json'),($plan|ConvertTo-Json -Depth 8 -Compress))
         Assert-CcodThrows {&$module {param($Root,$Runtime,$Directory,$Id)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId $Runtime -ExpectedEpoch ([uint64]11) -TransactionDirectory $Directory -TransactionId $Id} $install $runtimeId $directory $id|Out-Null} 'CCOD_PRODUCT_RESIDUE_INVALID'
         Assert-CcodEqual $originalHash (Get-CcodTestFileSha256 $userFile) 'forged journal cannot expand the approved deletion inventory'
-    } finally {if($null-ne$native){$native.Dispose()};if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+    } finally {if($null-ne$native){$native.Dispose()};if(Test-Path $root){Remove-CcodTestOwnedTree -Path $root}}
 }
 
 function Invoke-CcodResiduePartialRetryCase {
@@ -210,7 +210,7 @@ function Invoke-CcodResiduePartialRetryCase {
         $result=&$module {param($Root,$Runtime,$Directory,$Id)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId $Runtime -ExpectedEpoch ([uint64]11) -TransactionDirectory $Directory -TransactionId $Id} $install $runtimeId $directory $id
         Assert-CcodEqual 'Removed' $result.result 'same-root retry validates the saved inventory and completes'
         Assert-CcodTrue (-not(Test-Path $install)) 'retried cleanup removes the exact residual root'
-    } finally {&$module {$script:CcodProductResidueFailCommitAtForTest=-1};if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+    } finally {&$module {$script:CcodProductResidueFailCommitAtForTest=-1};if(Test-Path $root){Remove-CcodTestOwnedTree -Path $root}}
 }
 
 $results+=Invoke-CcodTest 'bounded cleanup resumes the exact residual tree after a native partial commit failure' {Invoke-CcodResiduePartialRetryCase}
@@ -239,7 +239,7 @@ $results+=Invoke-CcodTest 'bounded cleanup accepts real epoch initialization and
         Assert-CcodEqual 0 $hostState.RuntimeCleanupCodes.Count 'log writing itself succeeded'
         $result=&$module {param($Root,$Id)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId $Id -ExpectedEpoch ([uint64]11)} $install $runtimeId
         Assert-CcodEqual 'Removed' $result.result 'product diagnostics and epoch initializer are recognized'
-    } finally {if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+    } finally {if(Test-Path $root){Remove-CcodTestOwnedTree -Path $root}}
 }
 
 $results+=Invoke-CcodTest 'protected user data is rejected before opening or hashing its contents' {
@@ -252,7 +252,7 @@ $results+=Invoke-CcodTest 'protected user data is rejected before opening or has
         $failure=$null
         try {&$module {param($Root)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId ('2.5.22-'+('a'*16)+'-'+('b'*32)) -ExpectedEpoch ([uint64]11)} $install|Out-Null}catch{$failure=$_}
         Assert-CcodTrue ($null-ne$failure-and$failure.Exception.Message.Contains('protected user data')) 'policy rejects the directory name before the exclusive file can cause a read error'
-    } finally {if($null-ne$held){$held.Dispose()};if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+    } finally {if($null-ne$held){$held.Dispose()};if(Test-Path $root){Remove-CcodTestOwnedTree -Path $root}}
 }
 
 $results+=Invoke-CcodTest 'bounded cleanup accepts actual terminal lifecycle receipts and transaction archive output' {
@@ -286,7 +286,7 @@ $results+=Invoke-CcodTest 'bounded cleanup accepts actual terminal lifecycle rec
         &$io {param($Root,$Archive,$Completion)Write-CcodRotatingLog -Path (Join-Path $Root 'logs/transactions.log') -Message ($Archive|ConvertTo-Json -Depth 8 -Compress);Write-CcodAtomicJson -Path (Join-Path $Root 'state/transaction-completion.receipt.json') -Value $Completion -Compress} $install $archive $completion
         $result=&$module {param($Root,$Runtime)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId $Runtime -ExpectedEpoch ([uint64]11)} $install $runtimeId
         Assert-CcodEqual 'Removed' $result.result 'actual completed lifecycle evidence is disposable product state'
-    } finally {if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+    } finally {if(Test-Path $root){Remove-CcodTestOwnedTree -Path $root}}
 }
 
 $results+=Invoke-CcodTest 'bounded cleanup accepts real session and legacy install diagnostic writers' {
@@ -309,7 +309,7 @@ $results+=Invoke-CcodTest 'bounded cleanup accepts real session and legacy insta
         &$lifecycle {param($Root)$adapter=Get-CcodLifecycleAdapters;Write-CcodLifecycleLog -InstallRoot $Root -Adapters $adapter -Stage Install -Code CCOD_INSTALL_COMPLETED -Outcome Installed -ThrowOnFailure} $install
         $result=&$module {param($Root,$Id)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId $Id -ExpectedEpoch ([uint64]11)} $install $runtimeId
         Assert-CcodEqual 'Removed' $result.result 'actual session and legacy install diagnostics are recognized'
-    } finally {if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+    } finally {if(Test-Path $root){Remove-CcodTestOwnedTree -Path $root}}
 }
 
 $results+=Invoke-CcodTest 'bounded cleanup accepts the exact abandoned-lease warning produced by Supervisor' {
@@ -341,7 +341,7 @@ $results+=Invoke-CcodTest 'bounded cleanup accepts the exact abandoned-lease war
         &$io {param($Root,$Value)Write-CcodRotatingLog -Path (Join-Path $Root 'logs/supervisor.log') -Message ($Value|ConvertTo-Json -Compress)} $install $record
         $result=&$module {param($Root,$Runtime)Remove-CcodVerifiedProductResidue -InstallRoot $Root -SelectedRuntimeId $Runtime -ExpectedEpoch ([uint64]11)} $install $runtimeId
         Assert-CcodEqual 'Removed' $result.result 'real abandoned-lease diagnostic does not block uninstall'
-    } finally {if(Test-Path $root){Remove-Item $root -Recurse -Force}}
+    } finally {if(Test-Path $root){Remove-CcodTestOwnedTree -Path $root}}
 }
 
 $results|ForEach-Object {"PASS $($_.Name)"}
diff --git a/tests/persistence/TestSupport.SelfTest.ps1 b/tests/persistence/TestSupport.SelfTest.ps1
new file mode 100644
index 0000000..7effb04
--- /dev/null
+++ b/tests/persistence/TestSupport.SelfTest.ps1
@@ -0,0 +1,35 @@
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'TestSupport.ps1')
+
+$root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-test-support-' + [guid]::NewGuid().ToString('N'))
+$plain = Join-Path ([IO.Path]::GetTempPath()) ('plain-test-support-root-' + [guid]::NewGuid().ToString('N'))
+try {
+    [IO.Directory]::CreateDirectory((Join-Path $root 'nested/deep')) | Out-Null
+    [IO.File]::WriteAllText((Join-Path $root 'nested/deep/payload.txt'), 'payload')
+    [IO.Directory]::Move((Join-Path $root 'nested'), (Join-Path $root 'nested-released'))
+    Remove-CcodTestOwnedTree -Path $root
+    if ([IO.Directory]::Exists($root)) { throw 'ASSERT_TRUE: renamed payload tree was not removed' }
+
+    [IO.Directory]::CreateDirectory($plain) | Out-Null
+    $failure = $null
+    try { Remove-CcodTestOwnedTree -Path $plain } catch { $failure = $_ }
+    if ($null -eq $failure -or $failure.Exception.Message -notlike '*unnamed*') {
+        throw 'ASSERT_THROWS: unnamed temp tree was accepted'
+    }
+
+    $outside = Join-Path ([IO.Path]::GetTempPath()) ('ccod-test-support-outside-' + [guid]::NewGuid().ToString('N'))
+    [IO.Directory]::CreateDirectory($outside) | Out-Null
+    $reparse = Join-Path $root 'reparse-child'
+    New-Item -ItemType Junction -Path $reparse -Target $outside | Out-Null
+    $failure = $null
+    try { Remove-CcodTestOwnedTree -Path $root } catch { $failure = $_ }
+    if ($null -eq $failure -or $failure.Exception.Message -notlike '*reparse-point*') {
+        throw 'ASSERT_THROWS: reparse-point child was accepted'
+    }
+} finally {
+    if ([IO.Directory]::Exists($root)) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+    if ([IO.Directory]::Exists($plain)) { [IO.Directory]::Delete($plain, $true) }
+    if ($outside -and [IO.Directory]::Exists($outside)) { Remove-Item -LiteralPath $outside -Recurse -Force -ErrorAction SilentlyContinue }
+}
+
+'TestSupport self-tests passed.'
diff --git a/tests/persistence/TestSupport.ps1 b/tests/persistence/TestSupport.ps1
index 301ea9b..a54f581 100644
--- a/tests/persistence/TestSupport.ps1
+++ b/tests/persistence/TestSupport.ps1
@@ -1,4 +1,4 @@
-function Assert-CcodTrue([bool]$Condition, [string]$Message) {
+function Assert-CcodTrue([bool]$Condition, [string]$Message) {
     if (-not $Condition) { throw "ASSERT_TRUE: $Message" }
 }
 
@@ -39,3 +39,43 @@ function Get-CcodTestFileSha256 {
         $sha.Dispose()
     }
 }
+
+function Remove-CcodTestOwnedTree {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][string]$Path)
+
+    $full = [IO.Path]::GetFullPath($Path)
+    $temp = [IO.Path]::GetFullPath(([IO.Path]::GetTempPath()).TrimEnd('\'))
+    if ($full -eq $temp -or -not $full.StartsWith($temp + '\', [StringComparison]::OrdinalIgnoreCase)) {
+        throw 'Refusing to remove a non-temporary test tree.'
+    }
+    $leaf = [IO.Path]::GetFileName($full)
+    if ($leaf -notmatch '^(?:ccod-[A-Za-z0-9_.-]+|c-[0-9a-f]{8})$') {
+        throw 'Refusing to remove an unnamed test tree.'
+    }
+    if (-not [IO.Directory]::Exists($full)) { return }
+
+    $root = Get-Item -LiteralPath $full -Force -ErrorAction Stop
+    if ($root.Attributes -band [IO.FileAttributes]::ReparsePoint) {
+        throw 'Refusing to remove a reparse-point test root.'
+    }
+    $items = @(Get-ChildItem -LiteralPath $full -Force -Recurse -ErrorAction Stop |
+        Sort-Object { $_.FullName.Length } -Descending)
+    foreach ($item in $items) {
+        if ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) {
+            throw ('Refusing to remove a reparse-point test child: ' + $item.FullName)
+        }
+        try {
+            if ($item.PSIsContainer) {
+                [IO.Directory]::Delete($item.FullName, $false)
+            } else {
+                [IO.File]::SetAttributes($item.FullName, [IO.FileAttributes]::Normal)
+                [IO.File]::Delete($item.FullName)
+            }
+        } catch [IO.FileNotFoundException] { }
+          catch [IO.DirectoryNotFoundException] { }
+    }
+    try { [IO.Directory]::Delete($full, $false) }
+    catch [IO.DirectoryNotFoundException] { }
+    if ([IO.Directory]::Exists($full)) { throw ('Test-owned cleanup left residue: ' + $full) }
+}

From 2269f06bb64a1cf26585500819f1c5f7768aa94f Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Mon, 14 Sep 2026 01:32:55 +0800
Subject: [PATCH 170/187] test: harden state store teardown

---
 tests/persistence/StateStore.SelfTest.ps1 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/persistence/StateStore.SelfTest.ps1 b/tests/persistence/StateStore.SelfTest.ps1
index 096ed36..e130193 100644
--- a/tests/persistence/StateStore.SelfTest.ps1
+++ b/tests/persistence/StateStore.SelfTest.ps1
@@ -124,7 +124,7 @@ function Assert-CcodFailedAttemptClearReceipt {
     Assert-CcodEqual $Outcome $Receipt.Outcome "$Message receipt outcome"
 }
 
-$root = Join-Path ([IO.Path]::GetTempPath()) ('c-s-' + [Guid]::NewGuid().ToString('N'))
+$root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-state-store-' + [Guid]::NewGuid().ToString('N'))
 try {
     Invoke-CcodTest 'exposes trusted safe-exit persistence with the state-store contract' {
         $commands = @('Get-CcodTrustedLogonIdentity', 'Read-CcodSafeExitIntent', 'Write-CcodSafeExitIntent', 'Test-CcodSafeExitIntentForCurrentLogon', 'Clear-CcodSafeExitIntent')
@@ -841,5 +841,5 @@ try {
     Write-Error $_
     exit 1
 } finally {
-    if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    if (Test-Path -LiteralPath $root) { Remove-CcodTestOwnedTree -Path $root }
 }

From dbb4ee3f0b7ffb6ac6f829068bd7aa14c63c97a8 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Mon, 14 Sep 2026 03:13:44 +0800
Subject: [PATCH 171/187] test: harden static probe teardown

---
 .../StaticProbeWorker.SelfTest.ps1            |  4 +-
 tests/persistence/TestSupport.SelfTest.ps1    | 43 ++++++++-----------
 tests/persistence/TestSupport.ps1             | 12 +++++-
 3 files changed, 31 insertions(+), 28 deletions(-)

diff --git a/tests/persistence/StaticProbeWorker.SelfTest.ps1 b/tests/persistence/StaticProbeWorker.SelfTest.ps1
index dddc9e1..17a35cb 100644
--- a/tests/persistence/StaticProbeWorker.SelfTest.ps1
+++ b/tests/persistence/StaticProbeWorker.SelfTest.ps1
@@ -372,7 +372,7 @@ function New-CcodWorkerHarness {
     [pscustomobject][ordered]@{RequestPath=$requestPath;ResultPath=$resultPath;Context=$context;Adapters=$adapters;Events=$events;Stdout=$stdout;Written=$written;ProbeCalls=$probeCalls}
 }
 
-$root = Join-Path ([IO.Path]::GetTempPath()) 's'
+$root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-static-worker-' + [guid]::NewGuid().ToString('N'))
 try {
     Invoke-CcodTest 'strictly rejects every request shape, order, type, case, and correlation mutation' {
         $base=New-CcodWorkerRequest
@@ -1480,5 +1480,5 @@ try {
     Write-Error $_
     exit 1
 } finally {
-    if (Test-Path -LiteralPath $root) { Remove-Item -LiteralPath $root -Recurse -Force }
+    if ([IO.Directory]::Exists($root)) { Remove-CcodTestOwnedTree -Path $root }
 }
diff --git a/tests/persistence/TestSupport.SelfTest.ps1 b/tests/persistence/TestSupport.SelfTest.ps1
index 7effb04..321d073 100644
--- a/tests/persistence/TestSupport.SelfTest.ps1
+++ b/tests/persistence/TestSupport.SelfTest.ps1
@@ -1,35 +1,30 @@
-$ErrorActionPreference = 'Stop'
+$ErrorActionPreference = 'Stop'
 . (Join-Path $PSScriptRoot 'TestSupport.ps1')
 
 $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-test-support-' + [guid]::NewGuid().ToString('N'))
-$plain = Join-Path ([IO.Path]::GetTempPath()) ('plain-test-support-root-' + [guid]::NewGuid().ToString('N'))
+$plain = Join-Path $root 'plain'
+$sentinel = Join-Path ([IO.Path]::GetTempPath()) ('sentinel-' + [guid]::NewGuid().ToString('N'))
 try {
-    [IO.Directory]::CreateDirectory((Join-Path $root 'nested/deep')) | Out-Null
-    [IO.File]::WriteAllText((Join-Path $root 'nested/deep/payload.txt'), 'payload')
-    [IO.Directory]::Move((Join-Path $root 'nested'), (Join-Path $root 'nested-released'))
+    [IO.Directory]::CreateDirectory($plain) | Out-Null
+    [IO.File]::WriteAllText((Join-Path $plain 'a.txt'), 'a')
+    [IO.Directory]::CreateDirectory((Join-Path $plain 'nested')) | Out-Null
+    [IO.File]::WriteAllText((Join-Path $plain 'nested/b.txt'), 'b')
     Remove-CcodTestOwnedTree -Path $root
-    if ([IO.Directory]::Exists($root)) { throw 'ASSERT_TRUE: renamed payload tree was not removed' }
+    if ([IO.Directory]::Exists($root)) { throw 'ASSERT_TRUE: plain test tree was not removed' }
 
-    [IO.Directory]::CreateDirectory($plain) | Out-Null
+    [IO.Directory]::CreateDirectory($sentinel) | Out-Null
     $failure = $null
-    try { Remove-CcodTestOwnedTree -Path $plain } catch { $failure = $_ }
-    if ($null -eq $failure -or $failure.Exception.Message -notlike '*unnamed*') {
-        throw 'ASSERT_THROWS: unnamed temp tree was accepted'
-    }
+    try { Remove-CcodTestOwnedTree -Path $sentinel } catch { $failure = $_ }
+    if ($null -eq $failure -or $failure.Exception.Message -notlike '*unnamed*') { throw 'ASSERT_THROWS: ordinary temp tree was accepted' }
+    if (-not [IO.Directory]::Exists($sentinel)) { throw 'ASSERT_TRUE: rejected sentinel was removed' }
 
-    $outside = Join-Path ([IO.Path]::GetTempPath()) ('ccod-test-support-outside-' + [guid]::NewGuid().ToString('N'))
-    [IO.Directory]::CreateDirectory($outside) | Out-Null
-    $reparse = Join-Path $root 'reparse-child'
-    New-Item -ItemType Junction -Path $reparse -Target $outside | Out-Null
     $failure = $null
-    try { Remove-CcodTestOwnedTree -Path $root } catch { $failure = $_ }
-    if ($null -eq $failure -or $failure.Exception.Message -notlike '*reparse-point*') {
-        throw 'ASSERT_THROWS: reparse-point child was accepted'
-    }
+    try { Remove-CcodTestOwnedTree -Path ([IO.Path]::GetTempPath()).TrimEnd('\') } catch { $failure = $_ }
+    if ($null -eq $failure -or $failure.Exception.Message -notlike '*non-temporary*') { throw 'ASSERT_THROWS: temp root was accepted' }
+
+    Write-Output 'TestSupport self-tests passed.'
 } finally {
-    if ([IO.Directory]::Exists($root)) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
-    if ([IO.Directory]::Exists($plain)) { [IO.Directory]::Delete($plain, $true) }
-    if ($outside -and [IO.Directory]::Exists($outside)) { Remove-Item -LiteralPath $outside -Recurse -Force -ErrorAction SilentlyContinue }
+    if ([IO.Directory]::Exists($sentinel)) { [IO.Directory]::Delete($sentinel, $true) }
+    if ([IO.Directory]::Exists($root)) { Remove-CcodTestOwnedTree -Path $root }
 }
-
-'TestSupport self-tests passed.'
+	exit 0
diff --git a/tests/persistence/TestSupport.ps1 b/tests/persistence/TestSupport.ps1
index a54f581..cf0d8a4 100644
--- a/tests/persistence/TestSupport.ps1
+++ b/tests/persistence/TestSupport.ps1
@@ -50,7 +50,7 @@ function Remove-CcodTestOwnedTree {
         throw 'Refusing to remove a non-temporary test tree.'
     }
     $leaf = [IO.Path]::GetFileName($full)
-    if ($leaf -notmatch '^(?:ccod-[A-Za-z0-9_.-]+|c-[0-9a-f]{8})$') {
+    if ($leaf -notmatch '^ccod-[A-Za-z0-9_.-]+$') {
         throw 'Refusing to remove an unnamed test tree.'
     }
     if (-not [IO.Directory]::Exists($full)) { return }
@@ -63,7 +63,15 @@ function Remove-CcodTestOwnedTree {
         Sort-Object { $_.FullName.Length } -Descending)
     foreach ($item in $items) {
         if ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) {
-            throw ('Refusing to remove a reparse-point test child: ' + $item.FullName)
+            if ($item.PSIsContainer) {
+                try { [IO.Directory]::Delete($item.FullName, $false) }
+                catch [IO.DirectoryNotFoundException] { }
+            } else {
+                try { [IO.File]::SetAttributes($item.FullName, [IO.FileAttributes]::Normal); [IO.File]::Delete($item.FullName) }
+                catch [IO.FileNotFoundException] { }
+                catch [IO.DirectoryNotFoundException] { }
+            }
+            continue
         }
         try {
             if ($item.PSIsContainer) {

From 17526cf0ab3a18d1c96a9c203f5c662b4adeded2 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Mon, 14 Sep 2026 03:42:51 +0800
Subject: [PATCH 172/187] test: use safe root for full residue fixture

---
 tests/persistence/ProductResidueCleanup.SelfTest.ps1 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/persistence/ProductResidueCleanup.SelfTest.ps1 b/tests/persistence/ProductResidueCleanup.SelfTest.ps1
index 60c66b2..b576db4 100644
--- a/tests/persistence/ProductResidueCleanup.SelfTest.ps1
+++ b/tests/persistence/ProductResidueCleanup.SelfTest.ps1
@@ -120,7 +120,7 @@ $results+=Invoke-CcodTest 'bounded cleanup accepts the actual installer state-pl
 
 function Invoke-CcodFullInstallerResidueCase {
     param([switch]$LegacyUpgrade)
-    $root=Join-Path $env:TEMP ('c-'+[guid]::NewGuid().ToString('N').Substring(0,8))
+    $root=Join-Path $env:TEMP ('ccod-product-full-'+[guid]::NewGuid().ToString('N').Substring(0,8))
     $install=Join-Path $root 'CodexControlOtherDevices';$source=Join-Path $root 'source';$nodeRoot=Join-Path $root 'node'
     try {
         Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/InstallLifecycle.psm1') -Force -DisableNameChecking

From f9dc47630adf834fe38335dcd9222a30d76c90f2 Mon Sep 17 00:00:00 2001
From: naipi11 <101078423+naipi11@users.noreply.github.com>
Date: Mon, 14 Sep 2026 09:15:18 +0800
Subject: [PATCH 173/187] test: harden uninstall bootstrap teardown

---
 .../UninstallBootstrap.SelfTest.ps1           | 37 ++++++++++---------
 1 file changed, 19 insertions(+), 18 deletions(-)

diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index b142d92..8b8db80 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -23,7 +23,7 @@ function New-CcodUninstallBootstrapTestRoot {
     $tempLeaf=Split-Path $tempPath -Leaf
     $parent=Split-Path $tempPath -Parent
     $base=if($tempLeaf.Length -gt 8 -and -not [string]::IsNullOrWhiteSpace($parent) -and [IO.Directory]::Exists($parent)){$parent}else{$tempPath}
-    return Join-Path $base ('u-' + [guid]::NewGuid().ToString('N').Substring(0,8))
+    return Join-Path $base ('ccod-uninstall-' + [guid]::NewGuid().ToString('N').Substring(0,8))
 }
 
 $results+=Invoke-CcodTest 'uninstall bootstrap runtime IDs use canonical TAB delimiters' {
@@ -282,7 +282,7 @@ $results += Invoke-CcodTest 'production runtime verification binds the installed
         Assert-CcodThrows { Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $installRoot | Out-Null } 'CCOD_UNINSTALL_RUNTIME_INVALID'
     } finally {
         [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previousLocalAppData,'Process')
-        if (Test-Path -LiteralPath $localAppData) { Remove-Item -LiteralPath $localAppData -Recurse -Force }
+        if ([IO.Directory]::Exists($localAppData)) { Remove-CcodTestOwnedTree -Path $localAppData }
     }
 }
 
@@ -339,7 +339,7 @@ function Invoke-CcodInstalledFinalizerPublicResume {
 
 $results += Invoke-CcodTest 'production uninstall authorization consumes append-only selector before legacy active json' {
     $localAppData=New-CcodUninstallBootstrapTestRoot ('u-a-'+[guid]::NewGuid().ToString('N').Substring(0,12));$installRoot=Join-Path $localAppData 'CodexControlOtherDevices';$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
-    try{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$localAppData,'Process');$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $installRoot -AppendOnly;$context=Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $installRoot;Assert-CcodEqual $fixture.RuntimeId $context.runtimeId 'uninstall context binds append-only active runtime';Assert-CcodEqual 7 ([uint64]$context.runtimeGeneration) 'uninstall context binds latest append-only generation';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $installRoot 'active.json')) 'append-only uninstall authorization needs no legacy pointer'}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $localAppData){Remove-Item $localAppData -Recurse -Force}}
+    try{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$localAppData,'Process');$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $installRoot -AppendOnly;$context=Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $installRoot;Assert-CcodEqual $fixture.RuntimeId $context.runtimeId 'uninstall context binds append-only active runtime';Assert-CcodEqual 7 ([uint64]$context.runtimeGeneration) 'uninstall context binds latest append-only generation';Assert-CcodEqual $false (Test-Path -LiteralPath (Join-Path $installRoot 'active.json')) 'append-only uninstall authorization needs no legacy pointer'}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if([IO.Directory]::Exists($localAppData)){Remove-CcodTestOwnedTree -Path $localAppData}}
 }
 
 $results += Invoke-CcodTest 'uninstall legacy fallback accepts a valid pointer when the entire state plane is absent' {
@@ -358,17 +358,17 @@ $results += Invoke-CcodTest 'uninstall legacy fallback accepts a valid pointer w
         $failure=$null;try{Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $install|Out-Null}catch{$failure=$_}
         Assert-CcodTrue ($null-ne$failure-and$failure.FullyQualifiedErrorId-like'CCOD_UNINSTALL_REPARSE_OR_PATH_INVALID*') 'missing lifecycle epoch still fails closed after legacy authorization'
         Assert-CcodEqual ([IO.Path]::GetFullPath($state)) ([string]$failure.TargetObject) 'valid legacy selector fallback reaches the later lifecycle epoch validation'
-    }finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $local){Remove-Item $local -Recurse -Force}}
+    }finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if([IO.Directory]::Exists($local)){Remove-CcodTestOwnedTree -Path $local}}
 }
 
 $results += Invoke-CcodTest 'uninstall append-only authorization rejects unsafe roots leaves JSON and generations' {
     $previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
-    try{foreach($kind in @('root-file','root-reparse','leaf-reparse','ads','multilink','malformed','schema','duplicate','fractional','noncanonical')){$local=New-CcodUninstallBootstrapTestRoot $kind;$install=Join-Path $local 'CodexControlOtherDevices';[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$pointerRoot=Join-Path $install 'state\active-generation';$leaf=Join-Path $pointerRoot '00000000000000000007.json';$target=Join-Path $install ("target-$kind");if($kind-ceq'root-file'){Remove-Item $pointerRoot -Recurse -Force;[IO.File]::WriteAllText($pointerRoot,'x',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'root-reparse'){Remove-Item $pointerRoot -Recurse -Force;[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $pointerRoot -Target $target|Out-Null}elseif($kind-ceq'leaf-reparse'){[IO.File]::Delete($leaf);[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $leaf -Target $target|Out-Null}elseif($kind-ceq'ads'){Set-Content -LiteralPath $leaf -Stream evidence -Value x -NoNewline}elseif($kind-ceq'multilink'){$text=[IO.File]::ReadAllText($leaf);[IO.File]::Delete($leaf);$outside=Join-Path $install 'outside-pointer.json';[IO.File]::WriteAllText($outside,$text,[Text.UTF8Encoding]::new($false));New-Item -ItemType HardLink -Path $leaf -Target $outside|Out-Null}elseif($kind-ceq'malformed'){[IO.File]::WriteAllText($leaf,'{',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'schema'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":2,"generation":7,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'duplicate'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"schemaVersion":1,"generation":7,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'fractional'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"generation":7.5,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}else{Move-Item $leaf (Join-Path $pointerRoot '00000000000000000008.json')};Assert-CcodThrows {Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $install|Out-Null} 'CCOD_UNINSTALL_RUNTIME_INVALID';if(Test-Path $local){Remove-Item $local -Recurse -Force}}}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process')}
+    try{foreach($kind in @('root-file','root-reparse','leaf-reparse','ads','multilink','malformed','schema','duplicate','fractional','noncanonical')){$local=New-CcodUninstallBootstrapTestRoot $kind;$install=Join-Path $local 'CodexControlOtherDevices';[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');$fixture=New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install -AppendOnly;$pointerRoot=Join-Path $install 'state\active-generation';$leaf=Join-Path $pointerRoot '00000000000000000007.json';$target=Join-Path $install ("target-$kind");if($kind-ceq'root-file'){Remove-Item $pointerRoot -Recurse -Force;[IO.File]::WriteAllText($pointerRoot,'x',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'root-reparse'){Remove-Item $pointerRoot -Recurse -Force;[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $pointerRoot -Target $target|Out-Null}elseif($kind-ceq'leaf-reparse'){[IO.File]::Delete($leaf);[IO.Directory]::CreateDirectory($target)|Out-Null;New-Item -ItemType Junction -Path $leaf -Target $target|Out-Null}elseif($kind-ceq'ads'){Set-Content -LiteralPath $leaf -Stream evidence -Value x -NoNewline}elseif($kind-ceq'multilink'){$text=[IO.File]::ReadAllText($leaf);[IO.File]::Delete($leaf);$outside=Join-Path $install 'outside-pointer.json';[IO.File]::WriteAllText($outside,$text,[Text.UTF8Encoding]::new($false));New-Item -ItemType HardLink -Path $leaf -Target $outside|Out-Null}elseif($kind-ceq'malformed'){[IO.File]::WriteAllText($leaf,'{',[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'schema'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":2,"generation":7,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'duplicate'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"schemaVersion":1,"generation":7,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}elseif($kind-ceq'fractional'){$id=$fixture.RuntimeId;[IO.File]::WriteAllText($leaf,('{"schemaVersion":1,"generation":7.5,"activeRuntime":"'+$id+'","previousGeneration":6}'),[Text.UTF8Encoding]::new($false))}else{Move-Item $leaf (Join-Path $pointerRoot '00000000000000000008.json')};Assert-CcodThrows {Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $install|Out-Null} 'CCOD_UNINSTALL_RUNTIME_INVALID';if([IO.Directory]::Exists($local)){Remove-CcodTestOwnedTree -Path $local}}}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process')}
 }
 
 $results += Invoke-CcodTest 'uninstall selector fallback requires proven ItemNotFound instead of a lookup error' {
     $local=New-CcodUninstallBootstrapTestRoot ('ccod-uninstall-lookup-'+[guid]::NewGuid().ToString('N'));$install=Join-Path $local 'CodexControlOtherDevices';$previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process')
-    try{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install|Out-Null;Assert-CcodThrows {Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $install -SelectorAdapters @{GetSelectorRootItem={param($Path)throw [UnauthorizedAccessException]::new('selector lookup denied')}}|Out-Null} 'CCOD_UNINSTALL_RUNTIME_INVALID'}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $local){Remove-Item $local -Recurse -Force}}
+    try{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$local,'Process');New-CcodVerifiedUninstallRuntimeFixture -InstallRoot $install|Out-Null;Assert-CcodThrows {Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $install -SelectorAdapters @{GetSelectorRootItem={param($Path)throw [UnauthorizedAccessException]::new('selector lookup denied')}}|Out-Null} 'CCOD_UNINSTALL_RUNTIME_INVALID'}finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if([IO.Directory]::Exists($local)){Remove-CcodTestOwnedTree -Path $local}}
 }
 
 $results += Invoke-CcodTest 'uninstall legacy fallback rejects a state ancestor file at the selector boundary' {
@@ -379,7 +379,7 @@ $results += Invoke-CcodTest 'uninstall legacy fallback rejects a state ancestor
         $failure=$null;try{Get-CcodUninstallBootstrapVerifiedRuntimeContext -InstallerRoot $repositoryRoot -InstallRoot $install|Out-Null}catch{$failure=$_}
         Assert-CcodTrue ($null-ne$failure-and$failure.FullyQualifiedErrorId-like'CCOD_UNINSTALL_RUNTIME_INVALID*') 'state ancestor file fails uninstall authorization'
         Assert-CcodTrue ($failure.Exception.Message-like'*selector*') 'state ancestor file is rejected at the selector boundary'
-    }finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $local){Remove-Item $local -Recurse -Force}}
+    }finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if([IO.Directory]::Exists($local)){Remove-CcodTestOwnedTree -Path $local}}
 }
 
 $results += Invoke-CcodTest 'external staging refuses a cleanup source changed after runtime verification' {
@@ -400,7 +400,7 @@ $results += Invoke-CcodTest 'external staging refuses a cleanup source changed a
         Assert-CcodTrue (-not (Test-Path -LiteralPath (Join-Path $payloadRoot 'src\persistence\PortableUninstallFinalizer.ps1'))) 'the changed cleanup source is never staged'
     } finally {
         [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previousLocalAppData,'Process')
-        if (Test-Path -LiteralPath $localAppData) { Remove-Item -LiteralPath $localAppData -Recurse -Force }
+        if ([IO.Directory]::Exists($localAppData)) { Remove-CcodTestOwnedTree -Path $localAppData }
     }
 }
 
@@ -475,7 +475,7 @@ $results += Invoke-CcodTest 'real external staging uses a protected current-user
         Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $transactionDirectory 'receipt.json') -PathType Leaf) 'staged finalization writes a separate durable receipt'
     } finally {
         [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previousLocalAppData,'Process')
-        if (Test-Path -LiteralPath $testRoot) { Remove-Item -LiteralPath $testRoot -Recurse -Force }
+        if ([IO.Directory]::Exists($testRoot)) { Remove-CcodTestOwnedTree -Path $testRoot }
     }
 }
 
@@ -538,7 +538,7 @@ $results += Invoke-CcodTest 'Prepare resumes a TaskRemoved transaction even afte
         Assert-CcodEqual 'Validate,GetRoot,Read,Cleanup,Write:ReadyForInno,RemoveProduct,Receipt:ReadyForInno' ($world.Calls -join ',') 'partial deletion resume neither creates another transaction nor restages payload'
     } finally {
         [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previousLocalAppData,'Process')
-        if (Test-Path -LiteralPath $localAppData) { Remove-Item -LiteralPath $localAppData -Recurse -Force }
+        if ([IO.Directory]::Exists($localAppData)) { Remove-CcodTestOwnedTree -Path $localAppData }
     }
 }
 
@@ -565,7 +565,7 @@ $results += Invoke-CcodTest 'Prepare rejects a partial-deletion transaction from
         Assert-CcodEqual 'Validate,GetRoot,Read' ($world.Calls -join ',') 'another user cannot cause cleanup of a partial transaction'
     } finally {
         [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previousLocalAppData,'Process')
-        if (Test-Path -LiteralPath $localAppData) { Remove-Item -LiteralPath $localAppData -Recurse -Force }
+        if ([IO.Directory]::Exists($localAppData)) { Remove-CcodTestOwnedTree -Path $localAppData }
     }
 }
 
@@ -700,7 +700,7 @@ $results += Invoke-CcodTest 'disk-backed new-session replacement uses real verif
         Assert-CcodTrue (Test-CcodUninstallBootstrapReceiptMatchesTransaction -Receipt $receipt -Transaction $disk) 'disk receipt binds the fresh replacement timestamp'
         Assert-CcodEqual $freshSession $disk.installedBinding.resumeWrapperSessionId 'disk transaction persists only the new wrapper session seam'
         Assert-CcodEqual 0 $cleanup.Count 'real disk-backed TaskRemoved recovery never enters RunCleanup'
-    }finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path -LiteralPath $local){Remove-Item -LiteralPath $local -Recurse -Force}}
+    }finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if([IO.Directory]::Exists($local)){Remove-CcodTestOwnedTree -Path $local}}
 }
 
 $results += Invoke-CcodTest 'Failed resume TaskRemoved recovers in same and new sessions without RunCleanup' {
@@ -960,7 +960,7 @@ function Invoke-CcodDefaultInstalledProductCleanupCase {
         Assert-CcodTrue (-not(Test-Path $fixture.RuntimeRoot)) 'default finalizer deletes exact selected runtime'
         Assert-CcodTrue (-not(Test-Path $install)) 'completion receipt requires the product root and state to be absent'
         Assert-CcodTrue (-not$resume.Present) 'default finalizer removes the public anchor last'
-    }finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path $local){Remove-Item $local -Recurse -Force}}
+    }finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if([IO.Directory]::Exists($local)){Remove-CcodTestOwnedTree -Path $local}}
 }
 
 $results += Invoke-CcodTest 'default installed finalizer completes bounded product cleanup before its completion receipt' {Invoke-CcodDefaultInstalledProductCleanupCase}
@@ -986,7 +986,8 @@ function Invoke-CcodInstalledReclamationMutationCase {
         if(([string]$failure.FullyQualifiedErrorId-split',')[0]-cne'CCOD_GENERATION_RECLAMATION_INVALID'){throw $failure}
         Assert-CcodEqual $outsideHash (Get-CcodTestFileSha256 $outsideSentinel) "$Mutation preserves outside bytes";Assert-CcodEqual $siblingHash (Get-CcodTestFileSha256 $siblingSentinel) "$Mutation preserves sibling generation bytes";Assert-CcodEqual $deviceKeyHash (Get-CcodTestFileSha256 $deviceKey) "$Mutation preserves device-key bytes"
         if($Mutation-ceq'Ads'){Assert-CcodTrue ($null-ne(Get-Item -LiteralPath $attackState.Path -Stream 'ccod-evidence' -ErrorAction SilentlyContinue)) 'ADS hostile object remains after zero deletion'}else{Assert-CcodTrue (Test-Path -LiteralPath $attackState.Path) "$Mutation hostile object remains after zero deletion"}
-    }finally{if($null-ne$attackState.OpenHandle){$attackState.OpenHandle.Dispose()};[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path -LiteralPath $local){Remove-Item -LiteralPath $local -Recurse -Force}}
+        if($null-ne$attackState.OpenHandle){$attackState.OpenHandle.Dispose();$attackState.OpenHandle=$null}
+    }finally{[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if([IO.Directory]::Exists($local)){Remove-CcodTestOwnedTree -Path $local}}
 }
 
 # Production mutation caught: validation and deletion must remain bound across every hostile
@@ -1024,7 +1025,7 @@ if([string]::IsNullOrWhiteSpace($env:CCOD_RECLAMATION_RED_CASE)-or$env:CCOD_RECL
             &$module {param($Value)$script:CcodGenerationReclamationBeforeArmForTest=$Value} $hook
             try{Assert-CcodThrows {Remove-CcodVerifiedGenerationTree -InstallRoot $install -RuntimeRoot $fixture.RuntimeRoot -RuntimeId $fixture.RuntimeId -ExpectedManifestSha256 $manifest|Out-Null} 'CCOD_GENERATION_RECLAMATION_INVALID'}finally{&$module {$script:CcodGenerationReclamationBeforeArmForTest=$null}}
             Assert-CcodEqual 'blocked' $attack.Result 'pinned selected root rejects identity replacement';Assert-CcodGenerationReclamationTreeProof $proof 'identity replacement failure preserves selected tree';Assert-CcodGenerationReclamationTreeProof $replacementProof 'identity replacement failure preserves outside replacement tree';Assert-CcodTrue (-not(Test-Path -LiteralPath $parked)) 'identity replacement creates no renamed selected alias'
-        }finally{if(Test-Path -LiteralPath $local){Remove-Item -LiteralPath $local -Recurse -Force}}
+        }finally{if([IO.Directory]::Exists($local)){Remove-CcodTestOwnedTree -Path $local}}
     }
 }
 
@@ -1038,7 +1039,7 @@ if([string]::IsNullOrWhiteSpace($env:CCOD_RECLAMATION_RED_CASE)-or$env:CCOD_RECL
             try{Assert-CcodThrows {Remove-CcodVerifiedGenerationTree -InstallRoot $install -RuntimeRoot $fixture.RuntimeRoot -RuntimeId $fixture.RuntimeId -ExpectedManifestSha256 $manifest|Out-Null} 'CCOD_GENERATION_RECLAMATION_INVALID'}finally{&$module {$script:CcodGenerationReclamationFailFileArmAtForTest=-1}}
             Assert-CcodGenerationReclamationTreeProof $proof 'file-arm rollback preserves the complete selected tree';Assert-CcodEqual $siblingHash (Get-CcodTestFileSha256 $siblingFile) 'file-arm rollback preserves sibling';Assert-CcodEqual $deviceKeyHash (Get-CcodTestFileSha256 $deviceKey) 'file-arm rollback preserves device-key state'
             $result=Remove-CcodVerifiedGenerationTree -InstallRoot $install -RuntimeRoot $fixture.RuntimeRoot -RuntimeId $fixture.RuntimeId -ExpectedManifestSha256 $manifest;Assert-CcodEqual 'Completed' $result.phase 'successful retry reaches terminal reclamation phase';Assert-CcodEqual 'Reclaimed' $result.result 'successful retry reports exact reclamation';Assert-CcodTrue (-not(Test-Path -LiteralPath $fixture.RuntimeRoot)) 'successful retry removes only selected generation';Assert-CcodEqual $siblingHash (Get-CcodTestFileSha256 $siblingFile) 'successful retry preserves sibling';Assert-CcodEqual $deviceKeyHash (Get-CcodTestFileSha256 $deviceKey) 'successful retry preserves device-key state';Assert-CcodTrue (Test-Path -LiteralPath $install -PathType Container) 'successful retry preserves install root'
-        }finally{if(Test-Path -LiteralPath $local){Remove-Item -LiteralPath $local -Recurse -Force}}
+        }finally{if([IO.Directory]::Exists($local)){Remove-CcodTestOwnedTree -Path $local}}
     }
 }
 
@@ -1050,7 +1051,7 @@ if([string]::IsNullOrWhiteSpace($env:CCOD_RECLAMATION_RED_CASE)-or$env:CCOD_RECL
             &$module {param($Index)$script:CcodGenerationReclamationFailCommitAtForTest=$Index} ($proof.Files.Count+1)
             try{Assert-CcodThrows {Remove-CcodVerifiedGenerationTree -InstallRoot $install -RuntimeRoot $fixture.RuntimeRoot -RuntimeId $fixture.RuntimeId -ExpectedManifestSha256 $manifest|Out-Null} 'CCOD_GENERATION_RECLAMATION_COMMIT_FAILED'}finally{&$module {$script:CcodGenerationReclamationFailCommitAtForTest=-1}}
             Assert-CcodTrue (Test-Path -LiteralPath $fixture.RuntimeRoot -PathType Container) 'CommitStarted failure retains a selected-root failure boundary';Assert-CcodEqual $outsideHash (Get-CcodTestFileSha256 $outsideFile) 'CommitStarted failure preserves outside';Assert-CcodEqual $siblingHash (Get-CcodTestFileSha256 $siblingFile) 'CommitStarted failure preserves sibling';Assert-CcodEqual $deviceKeyHash (Get-CcodTestFileSha256 $deviceKey) 'CommitStarted failure preserves lifecycle/device-key state';Assert-CcodTrue (Test-Path -LiteralPath $install -PathType Container) 'CommitStarted failure preserves install root'
-        }finally{if(Test-Path -LiteralPath $local){Remove-Item -LiteralPath $local -Recurse -Force}}
+        }finally{if([IO.Directory]::Exists($local)){Remove-CcodTestOwnedTree -Path $local}}
 
         $tx=New-CcodUninstallBootstrapTestTransaction -Phase 'TaskRemoved';$tx.installedBinding=New-CcodUninstallBootstrapTestInstalledBinding;$world=[pscustomobject]@{Calls=[Collections.Generic.List[string]]::new();Transaction=$tx;RootPresent=$true;PublicEntry=$false;PublicCommand=$null;ShortcutsPresent=$true;CompletedReceipt=$false;Failure=$null;FailureInjected=$false;EntryPresentAtReclaim=$false};$adapters=New-CcodInstalledFinalizerMemoryAdapters $world;$adapters.ReclaimSelectedGeneration={param($Runtime,$Transaction)$world.Calls.Add('Reclaim');throw [Management.Automation.ErrorRecord]::new([IO.IOException]::new('commit failed'),'CCOD_GENERATION_RECLAMATION_COMMIT_FAILED',[Management.Automation.ErrorCategory]::WriteError,$Runtime)}.GetNewClosure()
         Assert-CcodThrows {Invoke-CcodInstalledUninstallFinalizer -TransactionId $tx.transactionId -RuntimeRoot $tx.installedBinding.selectedRuntimeRoot -InstallRoot 'C:\install' -WrapperIdentity ([pscustomobject]@{pid=42;creationTimeUtc='2030-02-03T03:04:05.0000000Z';sessionId=1;userSid='S-1-5-21-111-222-333-1001'}) -Adapters $adapters|Out-Null} 'CCOD_GENERATION_RECLAMATION_COMMIT_FAILED';Assert-CcodEqual 0 @($world.Calls|Where-Object{$_-in@('Write:ReadyForInno','ProductShortcuts','FinalizeReceipt','RemoveRegistry')}).Count 'CommitStarted failure reaches no phase write product removal or completion receipt'
@@ -1075,7 +1076,7 @@ function Invoke-CcodDefaultInstalledFinalizerNegative {
         $creationArgument=if($Mutation-ceq'WrapperIdentity'){'2001-02-03T04:05:06.0000000Z'}else{$wrapperCreation};$previousPreference=$ErrorActionPreference;try{$ErrorActionPreference='Continue';$output=& powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $payload 'src\persistence\InstalledUninstallFinalizer.ps1') -TransactionId $id -RuntimeRoot $runtime -InstallRoot $install -WrapperProcessId $wrapper.Id -WrapperCreationTimeUtc $creationArgument 2>&1;$exit=$LASTEXITCODE}finally{$ErrorActionPreference=$previousPreference}
         if($exit-ne3){throw("FINALIZER_DIAGNOSTIC mutation={0} exit={1} output={2}"-f$Mutation,$exit,(@($output)-join' | '))};Assert-CcodEqual 3 $exit "$Mutation default child rejects before finalization";Assert-CcodTrue (Test-Path -LiteralPath $selected -PathType Container) "$Mutation preserves the selected generation";Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $install 'state') -PathType Container) "$Mutation preserves sibling/root state"
 
-    }finally{if($null-ne$wrapper){try{if(-not$wrapper.HasExited){$wrapper.Kill();$wrapper.WaitForExit()}}catch{};$wrapper.Dispose()};[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if(Test-Path -LiteralPath $local){Remove-Item -LiteralPath $local -Recurse -Force}}
+    }finally{if($null-ne$wrapper){try{if(-not$wrapper.HasExited){$wrapper.Kill();$wrapper.WaitForExit()}}catch{};$wrapper.Dispose()};[Environment]::SetEnvironmentVariable('LOCALAPPDATA',$previous,'Process');if([IO.Directory]::Exists($local)){Remove-CcodTestOwnedTree -Path $local}}
 }
 
 $results += Invoke-CcodTest 'default staged installed finalizer child rejects the full negative authorization matrix without deletion' {

From 2e8a23bd4142dcc093514c2793656b9938f5c878 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sat, 19 Sep 2026 15:21:07 +0800
Subject: [PATCH 174/187] test: pin temp roots and child stdin to canonical
 utf-8

Windows hosted runners expose two ambient conditions that the installed
lifecycle observation boundary and the native child handshakes cannot tolerate:

- %TEMP% is the 8.3 short name C:\Users\RUNNER~1\AppData\Local\Temp, while
  the observation boundary requires canonical long-form paths and therefore
  rejected every fixture root built from the alias.
- The console code page is UTF-8, so Windows PowerShell 5.1 derives
  Console.InputEncoding from it and Process.StandardInput emits a UTF-8
  byte-order mark that corrupts the first JSON token a child reads.
  Windows PowerShell 5.1 has no ProcessStartInfo.StandardInputEncoding.

Add shared helpers in tests/persistence/TestSupport.ps1 that canonicalize the
temp root and that read and write child stdio as explicit BOM-free UTF-8
bytes, then use them for every fixture root and every child handoff.

Evidence: the installed lifecycle harness and the TestSupport suite both pass
locally under a reproduced runner condition (an 8.3 temp alias plus code page
65001); both previously failed with CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE
and 'Invalid JSON primitive: .'. On the runner the installed lifecycle
harness now passes and a pre-existing unrelated InstallFileTransaction case is
the next failure.
---
 .../Invoke-InstalledLifecycleIntegration.ps1  | 26 ++++--
 .../InstalledLifecycleHarness.SelfTest.ps1    | 89 ++++++++++---------
 ...fficialDraftAcceptanceHarness.SelfTest.ps1 |  4 +-
 .../ProductResidueCleanup.SelfTest.ps1        | 24 ++---
 .../persistence/ReleaseWorkflow.SelfTest.ps1  |  2 +-
 tests/persistence/Supervisor.SelfTest.ps1     |  5 +-
 tests/persistence/TestSupport.SelfTest.ps1    | 66 +++++++++++++-
 tests/persistence/TestSupport.ps1             | 45 ++++++++++
 tests/persistence/TrayHostBuild.SelfTest.ps1  | 14 +--
 9 files changed, 199 insertions(+), 76 deletions(-)

diff --git a/tests/installed/Invoke-InstalledLifecycleIntegration.ps1 b/tests/installed/Invoke-InstalledLifecycleIntegration.ps1
index 4db8ded..f0bbb6a 100644
--- a/tests/installed/Invoke-InstalledLifecycleIntegration.ps1
+++ b/tests/installed/Invoke-InstalledLifecycleIntegration.ps1
@@ -1758,16 +1758,27 @@ function Start-CcodInstalledLifecycleVerifiedUninstall {
         $start.Arguments='-NoLogo -NoProfile -NonInteractive -File "'+$entry+'" -VerifiedUninstallChild -AllowMachineMutation -AllowCodexRestart'
         $start.UseShellExecute=$false;$start.CreateNoWindow=$true
         $start.RedirectStandardInput=$true;$start.RedirectStandardOutput=$true;$start.RedirectStandardError=$true
+        # Windows PowerShell 5.1 has no StandardInputEncoding, so the child must own
+        # its input decoding: the default stdin writer can emit a UTF-8 BOM that a
+        # legacy console input page would then decode into a corrupt first token.
         $start.StandardOutputEncoding=[Text.UTF8Encoding]::new($false)
         $start.StandardErrorEncoding=[Text.UTF8Encoding]::new($false)
         [void]$start.EnvironmentVariables.Remove('PSExecutionPolicyPreference')
         Assert-CcodInstalledLifecycleExecutionLease $sourceLease
         $process=[Diagnostics.Process]::Start($start)
         $stdout=$process.StandardOutput.ReadToEndAsync();$stderr=$process.StandardError.ReadToEndAsync()
-        $process.StandardInput.Write($inputJson);$process.StandardInput.Close()
+        # Write explicit UTF-8 bytes with no byte-order mark: Windows PowerShell 5.1
+        # cannot pin ProcessStartInfo.StandardInputEncoding, so the inherited console
+        # page could otherwise prepend a BOM and corrupt the child's first JSON token.
+        $inputBytes=[Text.UTF8Encoding]::new($false).GetBytes($inputJson)
+        $process.StandardInput.BaseStream.Write($inputBytes,0,$inputBytes.Length)
+        $process.StandardInput.BaseStream.Flush()
+        $process.StandardInput.Close()
         if (-not $process.WaitForExit(600000)) { throw 'verified uninstall child timeout' }
         $output=$stdout.GetAwaiter().GetResult();$errorOutput=$stderr.GetAwaiter().GetResult()
-        if ($process.ExitCode -ne 0 -or $output -cne ('CCOD_UNINSTALL_WRAPPER_COMPLETED'+[Environment]::NewLine) -or $errorOutput.Length -ne 0) { throw 'verified uninstall child result' }
+        if ($process.ExitCode -ne 0 -or $output -cne ('CCOD_UNINSTALL_WRAPPER_COMPLETED'+[Environment]::NewLine) -or $errorOutput.Length -ne 0) {
+            throw 'verified uninstall child result'
+        }
         Assert-CcodInstalledLifecycleExecutionLease $sourceLease
         return [pscustomobject]@{ExitCode=0}
     } catch { Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_INSTALLER_FAILED' 'The verified uninstall child did not complete its wrapper handoff.' $null }
@@ -2286,12 +2297,11 @@ if ($VerifiedUninstallChild) {
             Throw-CcodInstalledLifecycleError 'CCOD_INTEGRATION_MUTATION_NOT_ALLOWED' 'The uninstall child requires both explicit mutation and restart authorization.' $null
         }
         [Console]::OutputEncoding=[Text.UTF8Encoding]::new($false)
-        $text=[Text.StringBuilder]::new();$buffer=[char[]]::new(4096)
-        while (($length=[Console]::In.Read($buffer,0,$buffer.Length)) -gt 0) {
-            if ($text.Length+$length -gt 1048576) { throw 'uninstall input bounds' }
-            [void]$text.Append($buffer,0,$length)
-        }
-        $json=$text.ToString()
+        # Read the wrapper input as explicit UTF-8 bytes instead of the ambient
+        # console code page, and tolerate an optional byte-order mark.
+        $reader=[IO.StreamReader]::new([Console]::OpenStandardInput(),[Text.UTF8Encoding]::new($false),$true)
+        try{$json=$reader.ReadToEnd()}finally{$reader.Dispose()}
+        if ($json.Length -gt 1048576) { throw 'uninstall input bounds' }
         if (-not (& $script:CcodInstalledLifecyclePersistenceIoModule {param($Json) Test-CcodJsonHasNoDuplicateProperties -Json $Json} $json)) { throw 'duplicate uninstall input' }
         $spec=$json|ConvertFrom-Json -ErrorAction Stop
         $expectedRoot=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)) 'CodexControlOtherDevices'))
diff --git a/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1 b/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1
index 842172c..beea18e 100644
--- a/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1
+++ b/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1
@@ -5,7 +5,7 @@ $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
 $harnessPath = Join-Path $repositoryRoot 'tests\installed\Invoke-InstalledLifecycleIntegration.ps1'
 
 function New-CcodHarnessFixture {
-    $root = Join-Path $env:TEMP ('ccod-installed-harness-' + [guid]::NewGuid().ToString('N'))
+    $root = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-installed-harness-' + [guid]::NewGuid().ToString('N'))
     $null = [IO.Directory]::CreateDirectory($root)
     $installer = Join-Path $root 'CodexRemote-fix-2.5.0-setup.exe'
     [IO.File]::WriteAllBytes($installer, [byte[]](1,2,3,4,5,6,7,8))
@@ -527,7 +527,7 @@ Invoke-CcodTest 'rejects FreshRestart without current Active status Idle transit
 # Production mutation caught: querying Codex.exe instead of the Windows app root ChatGPT.exe.
 Invoke-CcodTest 'captures exactly the top-level ChatGPT root and excludes Electron type children' {
     . $harnessPath -Library
-    $root = Join-Path $env:TEMP ('ccod-installed-capture-' + [guid]::NewGuid().ToString('N'))
+    $root = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-installed-capture-' + [guid]::NewGuid().ToString('N'))
     try {
         $null = [IO.Directory]::CreateDirectory($root)
         $created = '2026-08-24T00:00:04.0000006Z'
@@ -549,7 +549,7 @@ Invoke-CcodTest 'captures exactly the top-level ChatGPT root and excludes Electr
 
 Invoke-CcodTest 'normalizes only supported CIM creation-time evidence for complete ChatGPT roots' {
     . $harnessPath -Library
-    $root = Join-Path $env:TEMP ('ccod-installed-cim-creation-' + [guid]::NewGuid().ToString('N'))
+    $root = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-installed-cim-creation-' + [guid]::NewGuid().ToString('N'))
     try {
         $null = [IO.Directory]::CreateDirectory($root)
         $commandLine = '"C:\Program Files\WindowsApps\OpenAI.Codex\ChatGPT.exe"'
@@ -593,7 +593,7 @@ Invoke-CcodTest 'normalizes only supported CIM creation-time evidence for comple
 Invoke-CcodTest 'fails closed when any enumerated ChatGPT process cannot be proven root or Electron child' {
     . $harnessPath -Library
     foreach($case in @('null command line','empty command line','unparsable command line','invalid creation time','zero PID','string PID','nonstring command line','missing command line')){
-        $root=Join-Path $env:TEMP ("ccod-installed-indeterminate-$($case.Replace(' ','-'))-"+[guid]::NewGuid().ToString('N'))
+        $root=Join-Path (Get-CcodTestCanonicalTempRoot) ("ccod-installed-indeterminate-$($case.Replace(' ','-'))-"+[guid]::NewGuid().ToString('N'))
         try{
             $null=[IO.Directory]::CreateDirectory($root)
             $valid=New-CcodHarnessCimProcess -Name 'ChatGPT.exe' -ProcessId 13948 -CreationTimeUtc '2026-08-24T00:00:04.0000000Z' -CommandLine '"C:\Program Files\WindowsApps\OpenAI.Codex\ChatGPT.exe"'
@@ -619,7 +619,7 @@ Invoke-CcodTest 'fails closed when any enumerated ChatGPT process cannot be prov
 
 Invoke-CcodTest 'captures bounded current-runtime status transition and latest installer receipt facts from complete schemas' {
     . $harnessPath -Library
-    $root = Join-Path $env:TEMP ('ccod-installed-state-' + [guid]::NewGuid().ToString('N'))
+    $root = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-installed-state-' + [guid]::NewGuid().ToString('N'))
     try {
         $null = [IO.Directory]::CreateDirectory($root)
         New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -ActiveGeneration ([UInt64]8) `
@@ -651,7 +651,7 @@ Invoke-CcodTest 'captures bounded current-runtime status transition and latest i
 
 Invoke-CcodTest 'selects only an unambiguous latest current-runtime installer restart receipt' {
     . $harnessPath -Library
-    $root = Join-Path $env:TEMP ('ccod-installed-receipts-' + [guid]::NewGuid().ToString('N'))
+    $root = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-installed-receipts-' + [guid]::NewGuid().ToString('N'))
     try {
         $null = [IO.Directory]::CreateDirectory($root)
         New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -ActiveGeneration ([UInt64]8) `
@@ -678,7 +678,7 @@ Invoke-CcodTest 'selects only an unambiguous latest current-runtime installer re
 # Production mutation caught: choosing latest by runtime before filtering the active generation.
 Invoke-CcodTest 'ignores a newer wrong-generation receipt when selecting the current-generation terminal result' {
     . $harnessPath -Library
-    $root = Join-Path $env:TEMP ('ccod-installed-receipt-generation-' + [guid]::NewGuid().ToString('N'))
+    $root = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-installed-receipt-generation-' + [guid]::NewGuid().ToString('N'))
     try {
         $null = [IO.Directory]::CreateDirectory($root)
         New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -ActiveGeneration ([UInt64]8) `
@@ -698,7 +698,7 @@ Invoke-CcodTest 'ignores a newer wrong-generation receipt when selecting the cur
 
 Invoke-CcodTest 'does not treat tied wrong-generation receipts as current-generation ambiguity' {
     . $harnessPath -Library
-    $root = Join-Path $env:TEMP ('ccod-installed-receipt-generation-tie-' + [guid]::NewGuid().ToString('N'))
+    $root = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-installed-receipt-generation-tie-' + [guid]::NewGuid().ToString('N'))
     try {
         $null = [IO.Directory]::CreateDirectory($root)
         New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -ActiveGeneration ([UInt64]8) `
@@ -721,7 +721,7 @@ Invoke-CcodTest 'does not treat tied wrong-generation receipts as current-genera
 Invoke-CcodTest 'fails closed on receipt filename duplicate-property and nonterminal boundaries' {
     . $harnessPath -Library
     foreach ($case in @('filename','duplicate-json','nonterminal')) {
-        $root = Join-Path $env:TEMP ("ccod-installed-receipt-$case-" + [guid]::NewGuid().ToString('N'))
+        $root = Join-Path (Get-CcodTestCanonicalTempRoot) ("ccod-installed-receipt-$case-" + [guid]::NewGuid().ToString('N'))
         try {
             $null = [IO.Directory]::CreateDirectory($root)
             New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -ActiveGeneration ([UInt64]8) `
@@ -780,7 +780,7 @@ Invoke-CcodTest 'lifecycle receipt inspection rejects non-json residue and non-p
 Invoke-CcodTest 'fails closed on malformed active status and transition schemas' {
     . $harnessPath -Library
     foreach ($case in @('active','status','transition')) {
-        $root = Join-Path $env:TEMP ("ccod-installed-state-$case-" + [guid]::NewGuid().ToString('N'))
+        $root = Join-Path (Get-CcodTestCanonicalTempRoot) ("ccod-installed-state-$case-" + [guid]::NewGuid().ToString('N'))
         try {
             $null = [IO.Directory]::CreateDirectory($root)
             New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -ActiveGeneration ([UInt64]8) `
@@ -815,7 +815,7 @@ Invoke-CcodTest 'fails closed on malformed active status and transition schemas'
 # Production mutation caught: treating a Codex.exe-only observation as installed app process evidence.
 Invoke-CcodTest 'does not accept a Codex.exe-only fixture as Codex process evidence' {
     . $harnessPath -Library
-    $root = Join-Path $env:TEMP ('ccod-installed-capture-' + [guid]::NewGuid().ToString('N'))
+    $root = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-installed-capture-' + [guid]::NewGuid().ToString('N'))
     try {
         $null = [IO.Directory]::CreateDirectory($root)
         Set-CcodHarnessProcessFixture -ChatGPT @() -Codex @(
@@ -831,7 +831,7 @@ Invoke-CcodTest 'does not accept a Codex.exe-only fixture as Codex process evide
 
 Invoke-CcodTest 'sealed direct uninstall launches the active public uninstaller rather than removed Inno executable' {
     . $harnessPath -Library
-    $root=Join-Path $env:TEMP ('ccod-modern-uninstall-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-modern-uninstall-'+[guid]::NewGuid().ToString('N'))
     $originalStart=${function:Start-Process};$originalAck=${function:Read-CcodInstalledLifecycleOperatorAck}
     $originalCommand=${function:Get-CcodInstalledLifecycleUninstallCommand}
     $originalLaunch=${function:Start-CcodInstalledLifecycleVerifiedUninstall}
@@ -871,7 +871,7 @@ Invoke-CcodTest 'public finalizer launch arguments round trip through native par
     foreach($converter in $converters){. ([scriptblock]::Create($converter.Extent.Text))}
     $launchArguments=@($ast.FindAll({param($node)$node-is[Management.Automation.Language.AssignmentStatementAst]-and$node.Left-is[Management.Automation.Language.VariableExpressionAst]-and$node.Left.VariablePath.UserPath-ceq'arguments'},$true))
     Assert-CcodEqual 2 $launchArguments.Count 'installed and portable native argument builders are uniquely identified'
-    $root=Join-Path $env:TEMP ('ccod native args '+[char]0x6d4b+[char]0x8bd5+" O'Brien "+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod native args '+[char]0x6d4b+[char]0x8bd5+" O'Brien "+[guid]::NewGuid().ToString('N'))
     $powershellPath=Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) 'WindowsPowerShell/v1.0/powershell.exe'
     $oldPolicy=[Environment]::GetEnvironmentVariable('PSExecutionPolicyPreference','Process')
     try {
@@ -933,7 +933,7 @@ Invoke-CcodTest 'public uninstall bootstrap invocation returns the actual functi
     Assert-CcodEqual 1 $tail.Count 'actual CLI-only entry is unambiguous'
     $calls=@($publicAst.FindAll({param($Node)$Node-is[Management.Automation.Language.AssignmentStatementAst]-and$Node.Left-is[Management.Automation.Language.VariableExpressionAst]-and$Node.Left.VariablePath.UserPath-ceq'prepared'},$true))
     Assert-CcodEqual 2 $calls.Count 'installed and portable actual caller expressions are exercised'
-    $root=Join-Path $env:TEMP ('ccod-bootstrap-receipt-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-bootstrap-receipt-'+[guid]::NewGuid().ToString('N'))
     [IO.Directory]::CreateDirectory($root)|Out-Null
     try {
         $bootstrapPath=Join-Path $root 'bootstrap.ps1';$installerRoot=$root;$expectedInstallRoot=Join-Path $root 'install'
@@ -960,7 +960,7 @@ function Invoke-CcodUninstallBootstrap {
 
 Invoke-CcodTest 'direct uninstall never consumes a substituted dependency after resolution' {
     . $harnessPath -Library
-    $root=Join-Path $env:TEMP ('ccod-uninstall-consumption-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-uninstall-consumption-'+[guid]::NewGuid().ToString('N'))
     $originalFacts=${function:Get-CcodInstalledLifecycleFacts};$originalActive=${function:Read-CcodInstalledLifecycleActiveFact}
     $originalStart=${function:Start-Process};$originalAck=${function:Read-CcodInstalledLifecycleOperatorAck}
     $originalLaunch=${function:Start-CcodInstalledLifecycleVerifiedUninstall}
@@ -1009,7 +1009,7 @@ Invoke-CcodTest 'direct uninstall never consumes a substituted dependency after
 
 Invoke-CcodTest 'verified uninstall launcher uses normal-policy native process and exact completion framing' {
     . $harnessPath -Library
-    $root=Join-Path $env:TEMP ('ccod child '+[char]0x6d4b+[char]0x8bd5+" O'Brien "+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod child '+[char]0x6d4b+[char]0x8bd5+" O'Brien "+[guid]::NewGuid().ToString('N'))
     $oldRoot=$script:CcodInstalledLifecycleRepositoryRoot
     try {
         foreach($relative in @('tests/installed','tools','src/persistence/modules')){[IO.Directory]::CreateDirectory((Join-Path $root $relative))|Out-Null}
@@ -1020,7 +1020,9 @@ Invoke-CcodTest 'verified uninstall launcher uses normal-policy native process a
 param([switch]$VerifiedUninstallChild,[switch]$AllowMachineMutation,[switch]$AllowCodexRestart)
 $ErrorActionPreference='Stop'
 [Console]::OutputEncoding=[Text.UTF8Encoding]::new($false)
-$spec=[Console]::In.ReadToEnd()|ConvertFrom-Json
+$reader=[IO.StreamReader]::new([Console]::OpenStandardInput(),[Text.UTF8Encoding]::new($false),$true)
+$raw=$reader.ReadToEnd();$reader.Dispose()
+$spec=$raw|ConvertFrom-Json
 if(-not$VerifiedUninstallChild){throw 'child mode missing'}
 if(-not[string]::IsNullOrEmpty($env:PSExecutionPolicyPreference)){throw 'inherited policy override'}
 $root=Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
@@ -1050,7 +1052,7 @@ Invoke-CcodTest 'native uninstall child requires both machine and host restart a
     Assert-CcodEqual 0 @($errors).Count 'real child entry parses'
     $tail=@($ast.EndBlock.Statements|Where-Object {$_-is[Management.Automation.Language.IfStatementAst]-and$_.Extent.Text.StartsWith('if ($VerifiedUninstallChild)')})
     Assert-CcodEqual 1 $tail.Count 'one actual native child dispatch is selected'
-    $root=Join-Path $env:TEMP ('ccod-child-consent-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-child-consent-'+[guid]::NewGuid().ToString('N'))
     [IO.Directory]::CreateDirectory($root)|Out-Null
     try {
         $probe=Join-Path $root 'child.ps1'
@@ -1070,7 +1072,7 @@ function Invoke-CcodInstalledLifecycleVerifiedUninstall {param($Spec)[IO.File]::
             $child=[Diagnostics.Process]::Start($start)
             try {
                 $output=$child.StandardOutput.ReadToEndAsync();$errorOutput=$child.StandardError.ReadToEndAsync()
-                $child.StandardInput.Write(($spec|ConvertTo-Json -Compress));$child.StandardInput.Close()
+                Write-CcodTestProcessInput -Process $child -Text ($spec|ConvertTo-Json -Compress);$child.StandardInput.Close()
                 Assert-CcodTrue ($child.WaitForExit(15000)) 'inert child gate completes'
                 $authorized=$arguments-ceq' -AllowMachineMutation -AllowCodexRestart'
                 Assert-CcodEqual $authorized ([IO.File]::Exists((Join-Path $root 'consumed.txt'))) 'only both explicit consents allow reaching the consumer'
@@ -1083,7 +1085,7 @@ function Invoke-CcodInstalledLifecycleVerifiedUninstall {param($Spec)[IO.File]::
 
 Invoke-CcodTest 'native verified consumer retains dependencies until wrapper return and releases before process exit' {
     . $harnessPath -Library
-    $root=Join-Path $env:TEMP ('ccod-consumer-native-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-consumer-native-'+[guid]::NewGuid().ToString('N'))
     $child=$null
     try {
         $runtimeId='2.5.22-'+('a'*16)+'-'+('b'*32);$runtime=Join-Path $root ('runtime\'+$runtimeId)
@@ -1097,7 +1099,8 @@ try{[IO.Directory]::Move($PSScriptRoot,$PSScriptRoot+'-moved')}catch [IO.IOExcep
 . (Join-Path $PSScriptRoot 'src/persistence/UninstallBootstrap.ps1')
 if($bootstrapProof-cne'original-bootstrap'){throw 'changed bootstrap consumed'}
 [Console]::Out.WriteLine('CCOD_HELD='+$blocked);[Console]::Out.Flush()
-if([Console]::In.ReadLine()-cne'continue'){throw 'handshake failed'}
+$reader=[IO.StreamReader]::new([Console]::OpenStandardInput(),[Text.UTF8Encoding]::new($false),$true)
+if($reader.ReadLine()-cne'continue'){throw 'handshake failed'}
 [pscustomobject][ordered]@{Outcome='InstalledFinalizationStarted';TransactionId='11111111-2222-3333-4444-555555555555';FinalizerProcessId=[int]$PID;KeptDeviceKeyStore=$true}
 '@
         [IO.File]::WriteAllText($wrapper,$body,[Text.UTF8Encoding]::new($false));[IO.File]::WriteAllText($dependency,'$bootstrapProof=''original-bootstrap''')
@@ -1131,7 +1134,7 @@ if($result.Outcome-cne'InstalledFinalizationStarted'){throw 'wrong completion'}
         Assert-CcodTrue ($line.Wait(20000)) 'real consumer reaches the explicit held checkpoint'
         Assert-CcodEqual 'CCOD_HELD=3' $line.Result 'actual child cannot rewrite wrapper dependency or ancestor while executing'
         $blocked=$false;try{[IO.File]::WriteAllText($dependency,'outside writer')}catch [IO.IOException]{$blocked=$true};Assert-CcodTrue $blocked 'parent also cannot alter held dependency'
-        $child.StandardInput.WriteLine('continue');$child.StandardInput.Close();$rest=$child.StandardOutput.ReadToEndAsync()
+        Write-CcodTestProcessInput -Process $child -Text 'continue' -AddNewLine;$child.StandardInput.Close();$rest=$child.StandardOutput.ReadToEndAsync()
         Assert-CcodTrue ($child.WaitForExit(20000)) 'actual consumer exits after dependency handoff'
         Assert-CcodEqual 0 $child.ExitCode ('real consumer failure: '+$errors.Result)
         Assert-CcodEqual ('CCOD_RELEASED_BEFORE_EXIT'+[Environment]::NewLine) $rest.Result 'directory authority is released before wrapper process exit'
@@ -1141,7 +1144,7 @@ if($result.Outcome-cne'InstalledFinalizationStarted'){throw 'wrong completion'}
 }
 
 Invoke-CcodTest 'staged uninstall dependency cannot change at its real module import boundary' {
-    $root=Join-Path $env:TEMP ('ccod-stage-load-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-stage-load-'+[guid]::NewGuid().ToString('N'))
     $module=$null;$loaded=$null
     try {
         $payload=Join-Path $root 'payload';$modules=Join-Path $payload 'src/persistence/modules'
@@ -1177,7 +1180,7 @@ Invoke-CcodTest 'staged uninstall dependency cannot change at its real module im
 }
 
 Invoke-CcodTest 'public installed finalizer retains staged bytes through native child acquisition' {
-    $root=Join-Path $env:TEMP ('ccod-finalizer-launch-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-finalizer-launch-'+[guid]::NewGuid().ToString('N'))
     $originalStart=${function:Start-Process};$process=$null
     $tokens=$null;$errors=$null;$ast=[Management.Automation.Language.Parser]::ParseFile((Join-Path $repositoryRoot 'Uninstall-CodexControlOtherDevices.ps1'),[ref]$tokens,[ref]$errors)
     Assert-CcodEqual 0 @($errors).Count 'public wrapper parses'
@@ -1232,7 +1235,7 @@ try {
 }
 
 Invoke-CcodTest 'default finalizer pins its staged closure before validating the envelope' {
-    $root=Join-Path $env:TEMP ('ccod-finalizer-c-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-finalizer-c-'+[guid]::NewGuid().ToString('N'))
     $previous=[Environment]::GetEnvironmentVariable('LOCALAPPDATA','Process');$module=$null
     try {
         [Environment]::SetEnvironmentVariable('LOCALAPPDATA',$root,'Process')
@@ -1277,7 +1280,7 @@ Invoke-CcodTest 'default finalizer never treats an unavailable wrapper observati
         $identity=[pscustomobject]@{pid=[int]$current.Id;creationTimeUtc=$current.StartTime.ToUniversalTime().ToString('o',[Globalization.CultureInfo]::InvariantCulture);sessionId=[int]$current.SessionId;userSid=[string]$windowsIdentity.User.Value}
         $control=&$module {
             param($Identity)
-            $adapters=Get-CcodInstalledFinalizerAdapters -TransactionRoot $env:TEMP -PayloadRoot $env:TEMP -RuntimeRoot $env:TEMP -InstallRoot $env:TEMP
+            $adapters=Get-CcodInstalledFinalizerAdapters -TransactionRoot (Get-CcodTestCanonicalTempRoot) -PayloadRoot (Get-CcodTestCanonicalTempRoot) -RuntimeRoot (Get-CcodTestCanonicalTempRoot) -InstallRoot (Get-CcodTestCanonicalTempRoot)
             &$adapters.WaitWrapperExit $Identity 0
         } $identity
         Assert-CcodTrue $control.verifiedAtStart 'real current wrapper identity is observable'
@@ -1292,7 +1295,7 @@ Invoke-CcodTest 'default finalizer never treats an unavailable wrapper observati
         $child.Dispose();$child=$null
         $exited=&$module {
             param($Identity)
-            $adapters=Get-CcodInstalledFinalizerAdapters -TransactionRoot $env:TEMP -PayloadRoot $env:TEMP -RuntimeRoot $env:TEMP -InstallRoot $env:TEMP
+            $adapters=Get-CcodInstalledFinalizerAdapters -TransactionRoot (Get-CcodTestCanonicalTempRoot) -PayloadRoot (Get-CcodTestCanonicalTempRoot) -RuntimeRoot (Get-CcodTestCanonicalTempRoot) -InstallRoot (Get-CcodTestCanonicalTempRoot)
             &$adapters.WaitWrapperExit $Identity 1000
         } $exitedIdentity
         Assert-CcodTrue ($exited.verifiedAtStart-and$exited.exited) 'exact native process-not-found proves the already exited wrapper is absent'
@@ -1314,7 +1317,7 @@ Invoke-CcodTest 'default finalizer never treats an unavailable wrapper observati
                 try {
                     $result=&$module {
                         param($Identity)
-                        $adapters=Get-CcodInstalledFinalizerAdapters -TransactionRoot $env:TEMP -PayloadRoot $env:TEMP -RuntimeRoot $env:TEMP -InstallRoot $env:TEMP
+                        $adapters=Get-CcodInstalledFinalizerAdapters -TransactionRoot (Get-CcodTestCanonicalTempRoot) -PayloadRoot (Get-CcodTestCanonicalTempRoot) -RuntimeRoot (Get-CcodTestCanonicalTempRoot) -InstallRoot (Get-CcodTestCanonicalTempRoot)
                         &$adapters.WaitWrapperExit $Identity 1000
                     } $identity
                 } catch {$failure=$_}
@@ -1359,7 +1362,7 @@ Invoke-CcodTest 'actual product module naming warning does not pollute the verif
 
 Invoke-CcodTest 'sealed uninstall resolver requires active manifest file identity' {
     . $harnessPath -Library
-    $root=Join-Path $env:TEMP ('ccod-uninstall-resolver-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-uninstall-resolver-'+[guid]::NewGuid().ToString('N'))
     $originalFacts=${function:Get-CcodInstalledLifecycleFacts};$originalActive=${function:Read-CcodInstalledLifecycleActiveFact}
     try {
         $runtimeId='2.5.22-'+('a'*16)+'-'+('b'*32);$runtime=Join-Path $root ('runtime\'+$runtimeId)
@@ -1389,7 +1392,7 @@ Invoke-CcodTest 'sealed uninstall resolver requires active manifest file identit
 
 Invoke-CcodTest 'sealed payload comparison validates generated shortcuts rather than ignoring extras' {
     . $harnessPath -Library
-    $root=Join-Path $env:TEMP ('ccod-product-proof-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-product-proof-'+[guid]::NewGuid().ToString('N'))
     $original=${function:Get-CcodInstalledLifecycleProductState}
     try {
         $payload=@([pscustomobject][ordered]@{path='package.json';length=[long]25;sha256=('a'*64)})
@@ -1410,7 +1413,7 @@ Invoke-CcodTest 'sealed payload comparison validates generated shortcuts rather
 Invoke-CcodTest 'installed runtime validator agrees with the actual manifest producer digest' {
     . $harnessPath -Library
     $module=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/RuntimeManifest.psm1') -PassThru -Force
-    $root=Join-Path $env:TEMP ('ccod-producer-digest-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-producer-digest-'+[guid]::NewGuid().ToString('N'))
     try {
         [IO.Directory]::CreateDirectory($root)|Out-Null
         [IO.File]::WriteAllText((Join-Path $root 'payload.txt'),'actual producer fixture')
@@ -1429,7 +1432,7 @@ Invoke-CcodTest 'installed runtime validator agrees with the actual manifest pro
 Invoke-CcodTest 'installed runtime ordering matches mixed-case producer paths across cultures' {
     . $harnessPath -Library
     $module=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/RuntimeManifest.psm1') -PassThru -Force
-    $root=Join-Path $env:TEMP ('ccod-producer-order-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-producer-order-'+[guid]::NewGuid().ToString('N'))
     $originalCulture=[Threading.Thread]::CurrentThread.CurrentCulture
     try {
         [IO.Directory]::CreateDirectory((Join-Path $root 'bin'))|Out-Null
@@ -1459,7 +1462,7 @@ Invoke-CcodTest 'installed runtime ordering matches mixed-case producer paths ac
 
 Invoke-CcodTest 'sealed runtime metadata does not depend on the obsolete Inno directory' {
     . $harnessPath -Library
-    $root=Join-Path $env:TEMP ('ccod-modern-app-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-modern-app-'+[guid]::NewGuid().ToString('N'))
     $originalManifest=${function:Assert-CcodInstalledLifecycleRuntimeManifest}
     $originalOptional=${function:Get-CcodInstalledLifecycleOptionalDirectoryState};$previousHome=$env:CODEX_HOME
     try {
@@ -1490,7 +1493,7 @@ Invoke-CcodTest 'sealed runtime metadata does not depend on the obsolete Inno di
 
 Invoke-CcodTest 'native CIM timestamps are preserved for installed supervisor and tray' {
     . $harnessPath -Library
-    $root = Join-Path $env:TEMP ('ccod-installed-native-cim-' + [guid]::NewGuid().ToString('N'))
+    $root = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-installed-native-cim-' + [guid]::NewGuid().ToString('N'))
     $hadCodexHome = Test-Path -LiteralPath Env:CODEX_HOME
     $previousCodexHome = $env:CODEX_HOME
     try {
@@ -1570,7 +1573,7 @@ Invoke-CcodTest 'actual local process retains native precision through CIM corre
 
 Invoke-CcodTest 'installed tray observation selects active runtime bin rather than top-level decoy' {
     . $harnessPath -Library
-    $root=Join-Path $env:TEMP ('ccod-tray-runtime-path-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-tray-runtime-path-'+[guid]::NewGuid().ToString('N'))
     $previousHome=$env:CODEX_HOME
     try {
         [IO.Directory]::CreateDirectory($root)|Out-Null
@@ -1600,7 +1603,7 @@ Invoke-CcodTest 'installed tray observation selects active runtime bin rather th
 
 Invoke-CcodTest 'legacy readiness uses protected event and exact current process identities without new logs' {
     . $harnessPath -Library
-    $root=Join-Path $env:TEMP ('ccod-legacy-ready-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-legacy-ready-'+[guid]::NewGuid().ToString('N'))
     $kernel=Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/KernelObjects.psm1') -PassThru -Force
     $event=$null
     $originalNative=${function:Get-CcodInstalledLifecycleNativeProcessCreationTimeUtc}
@@ -1664,7 +1667,7 @@ Invoke-CcodTest 'legacy readiness uses protected event and exact current process
 
 Invoke-CcodTest 'installed readiness selects current Ready across valid supervisor history' {
     . $harnessPath -Library
-    $root = Join-Path $env:TEMP ('ccod-installed-ready-history-' + [guid]::NewGuid().ToString('N'))
+    $root = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-installed-ready-history-' + [guid]::NewGuid().ToString('N'))
     try {
         [IO.Directory]::CreateDirectory((Join-Path $root 'logs')) | Out-Null
         $log = Join-Path $root 'logs\supervisor.log'
@@ -1696,7 +1699,7 @@ Invoke-CcodTest 'installed readiness selects current Ready across valid supervis
 
 Invoke-CcodTest 'expected debug ports survive the installed lifecycle facts boundary' {
     . $harnessPath -Library
-    $root = Join-Path $env:TEMP ('ccod-installed-expected-ports-' + [guid]::NewGuid().ToString('N'))
+    $root = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-installed-expected-ports-' + [guid]::NewGuid().ToString('N'))
     $originalNetTcp = ${function:Get-NetTCPConnection}
     $originalDirectoryProbe = ${function:Get-CcodInstalledLifecycleOptionalDirectoryState}
     $originalFileProbe = ${function:Get-CcodInstalledLifecycleOptionalRegularFileState}
@@ -1745,7 +1748,7 @@ Invoke-CcodTest 'expected debug ports survive the installed lifecycle facts boun
 
 Invoke-CcodTest 'rejects non-integer debug port facts before endpoint observation' {
     . $harnessPath -Library
-    $root = Join-Path $env:TEMP ('ccod-installed-noninteger-port-' + [guid]::NewGuid().ToString('N'))
+    $root = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-installed-noninteger-port-' + [guid]::NewGuid().ToString('N'))
     $originalNetTcp = ${function:Get-NetTCPConnection}
     $originalStatusReader = ${function:Read-CcodInstalledLifecycleStatusFact}
     try {
@@ -1793,7 +1796,7 @@ Invoke-CcodTest 'uses absolute end anchors for lifecycle candidate and version v
 
 Invoke-CcodTest 'rejects expected debug ports detached from the current runtime declaration' {
     . $harnessPath -Library
-    $root = Join-Path $env:TEMP ('ccod-installed-port-binding-' + [guid]::NewGuid().ToString('N'))
+    $root = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-installed-port-binding-' + [guid]::NewGuid().ToString('N'))
     $originalStatusReader = ${function:Read-CcodInstalledLifecycleStatusFact}
     $originalNetTcp = ${function:Get-NetTCPConnection}
     try {
@@ -1826,7 +1829,7 @@ Invoke-CcodTest 'rejects expected debug ports detached from the current runtime
 
 Invoke-CcodTest 'rejects fractional expected debug ports before endpoint observation' {
     . $harnessPath -Library
-    $root = Join-Path $env:TEMP ('ccod-installed-port-type-' + [guid]::NewGuid().ToString('N'))
+    $root = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-installed-port-type-' + [guid]::NewGuid().ToString('N'))
     $originalNetTcp = ${function:Get-NetTCPConnection}
     try {
         $null = [IO.Directory]::CreateDirectory($root)
@@ -1850,7 +1853,7 @@ Invoke-CcodTest 'rejects fractional expected debug ports before endpoint observa
 
 Invoke-CcodTest 'rejects listener endpoint fields whose scalar types are not exact integers' {
     . $harnessPath -Library
-    $root = Join-Path $env:TEMP ('ccod-installed-listener-type-' + [guid]::NewGuid().ToString('N'))
+    $root = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-installed-listener-type-' + [guid]::NewGuid().ToString('N'))
     $originalNetTcp = ${function:Get-NetTCPConnection}
     $global:InstalledLifecycleListenerObserved = 0
     try {
@@ -1916,7 +1919,7 @@ Invoke-CcodTest 'rejects listener endpoint fields whose scalar types are not exa
 
 Invoke-CcodTest 'verifies FreshRestart only with one correlated ChatGPT root and Completed current-runtime installer receipt' {
     . $harnessPath -Library
-    $root = Join-Path $env:TEMP ('ccod-installed-success-' + [guid]::NewGuid().ToString('N'))
+    $root = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-installed-success-' + [guid]::NewGuid().ToString('N'))
     try {
         $null = [IO.Directory]::CreateDirectory($root)
         New-CcodHarnessInstalledStateFixture -Root $root -ActiveRuntimeId '2.5.21-e3b0c44298fc1c14-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' -ActiveGeneration ([UInt64]8) `
diff --git a/tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1 b/tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1
index 13ebedf..345cb81 100644
--- a/tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1
+++ b/tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1
@@ -1297,7 +1297,7 @@ try {
     }
 
     Invoke-CcodTest 'default capture preserves exact native tray readiness and collector rejection' {
-        $root=Join-Path $env:TEMP ('ccod-native-ready-capture-'+[guid]::NewGuid().ToString('N'))
+        $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-native-ready-capture-'+[guid]::NewGuid().ToString('N'))
         $logs=Join-Path $root 'logs';$log=Join-Path $logs 'supervisor.log';$module=$null;$integration=$null
         try {
             [IO.Directory]::CreateDirectory($logs)|Out-Null
@@ -2346,7 +2346,7 @@ try {
             Assert-CcodEqual 'CCOD_OPERATION_LEASE_HELD' $line.Result 'child reached actual native lease'
             Remove-Module $module.Name -Force;$module=Import-Module $modulePath -Force -PassThru -DisableNameChecking
             Assert-CcodThrows {&$module {param($Root)Open-CcodOfficialDraftOperationLease -EvidenceRoot $Root} $evidence|Out-Null} 'CCOD_ACCEPTANCE_OPERATION_BUSY'
-            $process.StandardInput.WriteLine('release');$process.StandardInput.Flush()
+            Write-CcodTestProcessInput -Process $process -Text 'release' -AddNewLine
             Assert-CcodTrue ($process.WaitForExit(15000)) 'owned inert child exits after explicit release'
             Assert-CcodEqual 0 $process.ExitCode 'child lease release succeeds'
             Assert-CcodEqual '' $errors.Result 'native child has no hidden lock error'
diff --git a/tests/persistence/ProductResidueCleanup.SelfTest.ps1 b/tests/persistence/ProductResidueCleanup.SelfTest.ps1
index b576db4..04cb93f 100644
--- a/tests/persistence/ProductResidueCleanup.SelfTest.ps1
+++ b/tests/persistence/ProductResidueCleanup.SelfTest.ps1
@@ -19,7 +19,7 @@ $results+=Invoke-CcodTest 'generation reclamation runtime IDs use canonical TAB
 }
 
 $results+=Invoke-CcodTest 'bounded product residue cleanup removes only the verified disposable product root' {
-    $root=Join-Path $env:TEMP ('ccod-product-tail-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-product-tail-'+[guid]::NewGuid().ToString('N'))
     $install=Join-Path $root 'CodexControlOtherDevices'
     try {
         [IO.Directory]::CreateDirectory((Join-Path $install 'state/active-generation'))|Out-Null
@@ -39,7 +39,7 @@ $results+=Invoke-CcodTest 'bounded product residue cleanup removes only the veri
     } finally {if(Test-Path $root){Remove-CcodTestOwnedTree -Path $root}}
 }
 $results+=Invoke-CcodTest 'bounded product residue cleanup accepts real initialized state and retained manifest files' {
-    $root=Join-Path $env:TEMP ('ccod-product-state-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-product-state-'+[guid]::NewGuid().ToString('N'))
     $install=Join-Path $root 'CodexControlOtherDevices'
     $modules=@()
     try {
@@ -68,7 +68,7 @@ $results+=Invoke-CcodTest 'bounded product residue cleanup accepts real initiali
 
 foreach($mutation in @('UnknownFile','UnknownDirectory','DeviceKey','Reparse','Hardlink','Ads','OpenFile','EpochDrift')){
     $results+=Invoke-CcodTest "bounded product residue rejects $mutation without deleting any file" {
-        $root=Join-Path $env:TEMP ('ccod-product-hostile-'+[guid]::NewGuid().ToString('N'))
+        $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-product-hostile-'+[guid]::NewGuid().ToString('N'))
         $install=Join-Path $root 'CodexControlOtherDevices';$held=$null
         try {
             [IO.Directory]::CreateDirectory((Join-Path $install 'state/active-generation'))|Out-Null
@@ -99,7 +99,7 @@ foreach($mutation in @('UnknownFile','UnknownDirectory','DeviceKey','Reparse','H
 }
 
 $results+=Invoke-CcodTest 'bounded cleanup accepts the actual installer state-plane writer output' {
-    $root=Join-Path $env:TEMP ('ccod-product-install-plane-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-product-install-plane-'+[guid]::NewGuid().ToString('N'))
     $install=Join-Path $root 'CodexControlOtherDevices';$fileTransaction=$null;$installModule=$null;$fileModule=$null
     try {
         [IO.Directory]::CreateDirectory((Join-Path $install 'state/active-generation'))|Out-Null
@@ -120,7 +120,7 @@ $results+=Invoke-CcodTest 'bounded cleanup accepts the actual installer state-pl
 
 function Invoke-CcodFullInstallerResidueCase {
     param([switch]$LegacyUpgrade)
-    $root=Join-Path $env:TEMP ('ccod-product-full-'+[guid]::NewGuid().ToString('N').Substring(0,8))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-product-full-'+[guid]::NewGuid().ToString('N').Substring(0,8))
     $install=Join-Path $root 'CodexControlOtherDevices';$source=Join-Path $root 'source';$nodeRoot=Join-Path $root 'node'
     try {
         Import-Module (Join-Path $repositoryRoot 'src/persistence/modules/InstallLifecycle.psm1') -Force -DisableNameChecking
@@ -157,7 +157,7 @@ $results+=Invoke-CcodTest 'bounded cleanup consumes the full actual installer ou
 $results+=Invoke-CcodTest 'bounded cleanup consumes the historical v2521 upgrade output without retaining product files' {Invoke-CcodFullInstallerResidueCase -LegacyUpgrade}
 
 $results+=Invoke-CcodTest 'an existing cleanup journal cannot authorize an unknown user file' {
-    $root=Join-Path $env:TEMP ('ccod-product-journal-forgery-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-product-journal-forgery-'+[guid]::NewGuid().ToString('N'))
     $install=Join-Path $root 'CodexControlOtherDevices';$native=$null
     try {
         [IO.Directory]::CreateDirectory((Join-Path $install 'state/active-generation'))|Out-Null
@@ -181,7 +181,7 @@ $results+=Invoke-CcodTest 'an existing cleanup journal cannot authorize an unkno
 
 function Invoke-CcodResiduePartialRetryCase {
     param([ValidateSet('None','AddedFile','ReplacementRoot','JournalMutation')][string]$Attack='None')
-    $root=Join-Path $env:TEMP ('ccod-product-partial-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-product-partial-'+[guid]::NewGuid().ToString('N'))
     $install=Join-Path $root 'CodexControlOtherDevices'
     try {
         [IO.Directory]::CreateDirectory((Join-Path $install 'state/active-generation'))|Out-Null
@@ -219,7 +219,7 @@ foreach($retryAttack in @('AddedFile','ReplacementRoot','JournalMutation')){
 }
 
 $results+=Invoke-CcodTest 'bounded cleanup accepts real epoch initialization and supervisor log writers' {
-    $root=Join-Path $env:TEMP ('ccod-product-observation-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-product-observation-'+[guid]::NewGuid().ToString('N'))
     $install=Join-Path $root 'CodexControlOtherDevices'
     try {
         [IO.Directory]::CreateDirectory((Join-Path $install 'state/active-generation'))|Out-Null
@@ -243,7 +243,7 @@ $results+=Invoke-CcodTest 'bounded cleanup accepts real epoch initialization and
 }
 
 $results+=Invoke-CcodTest 'protected user data is rejected before opening or hashing its contents' {
-    $root=Join-Path $env:TEMP ('ccod-product-protected-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-product-protected-'+[guid]::NewGuid().ToString('N'))
     $install=Join-Path $root 'CodexControlOtherDevices';$held=$null
     try {
         [IO.Directory]::CreateDirectory((Join-Path $install 'state/device-key'))|Out-Null
@@ -256,7 +256,7 @@ $results+=Invoke-CcodTest 'protected user data is rejected before opening or has
 }
 
 $results+=Invoke-CcodTest 'bounded cleanup accepts actual terminal lifecycle receipts and transaction archive output' {
-    $root=Join-Path $env:TEMP ('ccod-product-terminal-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-product-terminal-'+[guid]::NewGuid().ToString('N'))
     $install=Join-Path $root 'CodexControlOtherDevices';$state=Join-Path $install 'state'
     try {
         [IO.Directory]::CreateDirectory((Join-Path $state 'active-generation'))|Out-Null
@@ -290,7 +290,7 @@ $results+=Invoke-CcodTest 'bounded cleanup accepts actual terminal lifecycle rec
 }
 
 $results+=Invoke-CcodTest 'bounded cleanup accepts real session and legacy install diagnostic writers' {
-    $root=Join-Path $env:TEMP ('ccod-product-session-log-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-product-session-log-'+[guid]::NewGuid().ToString('N'))
     $install=Join-Path $root 'CodexControlOtherDevices'
     try {
         [IO.Directory]::CreateDirectory((Join-Path $install 'state/active-generation'))|Out-Null
@@ -313,7 +313,7 @@ $results+=Invoke-CcodTest 'bounded cleanup accepts real session and legacy insta
 }
 
 $results+=Invoke-CcodTest 'bounded cleanup accepts the exact abandoned-lease warning produced by Supervisor' {
-    $root=Join-Path $env:TEMP ('ccod-product-warning-'+[guid]::NewGuid().ToString('N'))
+    $root=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-product-warning-'+[guid]::NewGuid().ToString('N'))
     $install=Join-Path $root 'CodexControlOtherDevices'
     try {
         [IO.Directory]::CreateDirectory((Join-Path $install 'state/active-generation'))|Out-Null
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 7710937..948dcba 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -202,7 +202,7 @@ function Assert-CcodAuthenticatedTraceWorkflowContract {
 }
 
 function New-CcodPortableReleaseFixture {
-    $root = Join-Path $env:TEMP ('ccod-portable-release-workflow-' + [guid]::NewGuid().ToString('N'))
+    $root = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-portable-release-workflow-' + [guid]::NewGuid().ToString('N'))
     $stage = Join-Path $root 'stage'
     $payload = Join-Path $stage 'payload'
     [IO.Directory]::CreateDirectory($payload) | Out-Null
diff --git a/tests/persistence/Supervisor.SelfTest.ps1 b/tests/persistence/Supervisor.SelfTest.ps1
index dc8e39a..13ddaba 100644
--- a/tests/persistence/Supervisor.SelfTest.ps1
+++ b/tests/persistence/Supervisor.SelfTest.ps1
@@ -656,7 +656,10 @@ Invoke-CcodTest 'SafeExit refuses UI shutdown when its correlated terminal resul
 }
 
 Invoke-CcodTest 'recovered language failure history remains readable by the installed Ready collector' {
-    $root=Join-Path $env:TEMP ('ccod-language-ready-history-'+[guid]::NewGuid().ToString('N'))
+    # $env:TEMP can be a Windows 8.3 short-name alias such as C:\Users\RUNNER~1\AppData\Local\Temp
+    # on hosted runners, and the installed Ready collector rejects noncanonical evidence paths.
+    $tempRoot = [IO.Path]::GetFullPath(([IO.Path]::GetTempPath()).TrimEnd('\'))
+    $root=Join-Path $tempRoot ('ccod-language-ready-history-'+[guid]::NewGuid().ToString('N'))
     $integration=$null
     try {
         [IO.Directory]::CreateDirectory((Join-Path $root 'logs'))|Out-Null
diff --git a/tests/persistence/TestSupport.SelfTest.ps1 b/tests/persistence/TestSupport.SelfTest.ps1
index 321d073..c1ba04e 100644
--- a/tests/persistence/TestSupport.SelfTest.ps1
+++ b/tests/persistence/TestSupport.SelfTest.ps1
@@ -1,9 +1,10 @@
 $ErrorActionPreference = 'Stop'
 . (Join-Path $PSScriptRoot 'TestSupport.ps1')
 
-$root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-test-support-' + [guid]::NewGuid().ToString('N'))
+$tempRoot = Get-CcodTestCanonicalTempRoot
+$root = Join-Path $tempRoot ('ccod-test-support-' + [guid]::NewGuid().ToString('N'))
 $plain = Join-Path $root 'plain'
-$sentinel = Join-Path ([IO.Path]::GetTempPath()) ('sentinel-' + [guid]::NewGuid().ToString('N'))
+$sentinel = Join-Path $tempRoot ('sentinel-' + [guid]::NewGuid().ToString('N'))
 try {
     [IO.Directory]::CreateDirectory($plain) | Out-Null
     [IO.File]::WriteAllText((Join-Path $plain 'a.txt'), 'a')
@@ -22,6 +23,67 @@ try {
     try { Remove-CcodTestOwnedTree -Path ([IO.Path]::GetTempPath()).TrimEnd('\') } catch { $failure = $_ }
     if ($null -eq $failure -or $failure.Exception.Message -notlike '*non-temporary*') { throw 'ASSERT_THROWS: temp root was accepted' }
 
+
+    # A hosted runner can expose an 8.3 short-name TEMP alias. Fixture roots built
+    # from that alias are rejected by the installed lifecycle observation boundary,
+    # so the shared helper must always return the canonical long form.
+    $canonical = Get-CcodTestCanonicalTempRoot
+    if ([string]::IsNullOrWhiteSpace($canonical) -or -not [IO.Path]::IsPathRooted($canonical)) {
+        throw 'ASSERT_TRUE: canonical temp root must be an absolute path'
+    }
+    if ($canonical.Contains('~')) { throw 'ASSERT_TRUE: canonical temp root still contains a short-name alias' }
+    if ($canonical -cne [IO.Path]::GetFullPath($canonical)) { throw 'ASSERT_EQUAL: canonical temp root is not canonical' }
+    if ($canonical -cne [IO.Path]::GetFullPath(([IO.Path]::GetTempPath()).TrimEnd('\'))) { throw 'ASSERT_EQUAL: canonical temp root is detached from the ambient temp path' }
+    if ($canonical.TrimEnd('\') -cne ($canonical + '\').TrimEnd('\')) { throw 'ASSERT_TRUE: canonical temp root keeps a stable trailing boundary' }
+
+
+    # A hosted runner can present a UTF-8 console page. Windows PowerShell 5.1 then
+    # makes Process.StandardInput emit a byte-order mark unless the payload is written
+    # as explicit bytes, and the receiving child must tolerate a BOM either way.
+    $handshakeRoot = Join-Path $tempRoot ('ccod-handshake-' + [guid]::NewGuid().ToString('N'))
+    [IO.Directory]::CreateDirectory($handshakeRoot) | Out-Null
+    $childScript = Join-Path $handshakeRoot 'handshake.ps1'
+    [IO.File]::WriteAllText($childScript, @'
+$reader = [IO.StreamReader]::new([Console]::OpenStandardInput(), [Text.UTF8Encoding]::new($false), $true)
+$line = $reader.ReadLine()
+if ($line -cne 'continue') { [Console]::Error.WriteLine('handshake failed'); exit 1 }
+[Console]::Out.WriteLine('CCOD_HANDSHAKE_OK')
+'@, [Text.UTF8Encoding]::new($false))
+
+    $previousInputEncoding = [Console]::InputEncoding
+    $handshake = $null
+    try {
+        [Console]::InputEncoding = [Text.UTF8Encoding]::new($true)
+        $start = [Diagnostics.ProcessStartInfo]::new()
+        $start.FileName = Join-Path $PSHOME 'powershell.exe'
+        $start.Arguments = '-NoLogo -NoProfile -NonInteractive -File "' + $childScript + '"'
+        $start.UseShellExecute = $false
+        $start.CreateNoWindow = $true
+        $start.RedirectStandardInput = $true
+        $start.RedirectStandardOutput = $true
+        $start.RedirectStandardError = $true
+        $start.StandardOutputEncoding = [Text.UTF8Encoding]::new($false)
+        $start.StandardErrorEncoding = [Text.UTF8Encoding]::new($false)
+        [void]$start.EnvironmentVariables.Remove('PSExecutionPolicyPreference')
+        $handshake = [Diagnostics.Process]::Start($start)
+        $stdout = $handshake.StandardOutput.ReadToEndAsync()
+        $stderr = $handshake.StandardError.ReadToEndAsync()
+        Write-CcodTestProcessInput -Process $handshake -Text 'continue' -AddNewLine
+        $handshake.StandardInput.Close()
+        if (-not $handshake.WaitForExit(30000)) { throw 'ASSERT_TRUE: handshake child did not exit' }
+        if ($handshake.ExitCode -ne 0) { throw ('ASSERT_EQUAL: handshake child failed: ' + $stderr.Result) }
+        if ($stdout.Result -cne ('CCOD_HANDSHAKE_OK' + [Environment]::NewLine)) { throw ('ASSERT_EQUAL: handshake output mismatch: ' + $stdout.Result) }
+        if ($stderr.Result.Length -ne 0) { throw ('ASSERT_EQUAL: handshake child stderr: ' + $stderr.Result) }
+        if ((Read-CcodTestStandardInputText) -cne '') { throw 'ASSERT_EQUAL: helper read no explicit input as non-empty' }
+    } finally {
+        [Console]::InputEncoding = $previousInputEncoding
+        if ($null -ne $handshake) {
+            try { if (-not $handshake.HasExited) { $handshake.Kill(); $handshake.WaitForExit() } } finally { $handshake.Dispose() }
+        }
+        if ([IO.Directory]::Exists($handshakeRoot)) { Remove-CcodTestOwnedTree -Path $handshakeRoot }
+        if ([IO.Directory]::Exists($root)) { Remove-CcodTestOwnedTree -Path $root }
+    }
+
     Write-Output 'TestSupport self-tests passed.'
 } finally {
     if ([IO.Directory]::Exists($sentinel)) { [IO.Directory]::Delete($sentinel, $true) }
diff --git a/tests/persistence/TestSupport.ps1 b/tests/persistence/TestSupport.ps1
index cf0d8a4..dcbf7bb 100644
--- a/tests/persistence/TestSupport.ps1
+++ b/tests/persistence/TestSupport.ps1
@@ -40,6 +40,51 @@ function Get-CcodTestFileSha256 {
     }
 }
 
+function Write-CcodTestProcessInput {
+    # Windows PowerShell 5.1 has no ProcessStartInfo.StandardInputEncoding, and
+    # Process.StandardInput inherits Console.InputEncoding. Under a UTF-8 console
+    # (for example chcp 65001 on a hosted runner) that writer emits a leading
+    # byte-order mark, which corrupts the first token a child reads. Write explicit
+    # UTF-8 bytes without a BOM instead.
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)]$Process,
+        [Parameter(Mandatory)][AllowEmptyString()][string]$Text,
+        [switch]$AddNewLine
+    )
+    $payload = if ($AddNewLine) { $Text + "`n" } else { $Text }
+    $bytes = [Text.UTF8Encoding]::new($false).GetBytes($payload)
+    $stream = $Process.StandardInput.BaseStream
+    $stream.Write($bytes, 0, $bytes.Length)
+    $stream.Flush()
+}
+
+function Read-CcodTestStandardInputText {
+    # Read standard input as explicit UTF-8 bytes and tolerate an optional
+    # byte-order mark, so a child handshake survives any ambient console page.
+    [CmdletBinding()]
+    param()
+    $reader = [IO.StreamReader]::new([Console]::OpenStandardInput(), [Text.UTF8Encoding]::new($false), $true)
+    try { return $reader.ReadToEnd() } finally { $reader.Dispose() }
+}
+
+function Read-CcodTestStandardInputLine {
+    # Read one standard input line without depending on the ambient console page.
+    [CmdletBinding()]
+    param()
+    $reader = [IO.StreamReader]::new([Console]::OpenStandardInput(), [Text.UTF8Encoding]::new($false), $true)
+    try { return $reader.ReadLine() } finally { $reader.Dispose() }
+}
+
+function Get-CcodTestCanonicalTempRoot {
+    # $env:TEMP can be a Windows 8.3 short-name alias such as
+    # C:\Users\RUNNER~1\AppData\Local\Temp on hosted runners. Fixture roots
+    # built from the alias are rejected by the installed lifecycle harness, which
+    # requires canonical long-form paths. Canonicalize once so every fixture root is
+    # already canonical and owned-tree cleanup still matches its allowlist.
+    return [IO.Path]::GetFullPath(([IO.Path]::GetTempPath()).TrimEnd('\'))
+}
+
 function Remove-CcodTestOwnedTree {
     [CmdletBinding()]
     param([Parameter(Mandatory)][string]$Path)
diff --git a/tests/persistence/TrayHostBuild.SelfTest.ps1 b/tests/persistence/TrayHostBuild.SelfTest.ps1
index 5fe0072..88de1a0 100644
--- a/tests/persistence/TrayHostBuild.SelfTest.ps1
+++ b/tests/persistence/TrayHostBuild.SelfTest.ps1
@@ -9,8 +9,8 @@ Invoke-CcodTest 'TrayHost artifact validation binds the manifest and embedded PE
     $package = Get-Content -LiteralPath (Join-Path $repositoryRoot 'package.json') -Raw | ConvertFrom-Json
     $version = [string]$package.version
     $nativeVersion = "$version.0"
-    $artifact = Join-Path $env:TEMP ('ccod-native-version-artifact-' + [Guid]::NewGuid().ToString('N'))
-    $fixtureRoot = Join-Path $env:TEMP ('ccod-native-version-repository-' + [Guid]::NewGuid().ToString('N'))
+    $artifact = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-native-version-artifact-' + [Guid]::NewGuid().ToString('N'))
+    $fixtureRoot = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-native-version-repository-' + [Guid]::NewGuid().ToString('N'))
     try {
         Invoke-CcodTrayHostBuild -RepositoryRoot $repositoryRoot -Version $version -OutputDirectory $artifact -GitCommit ('b' * 40) -BuildTimestampUtc '2026-08-28T00:00:00.0000000Z' | Out-Null
         [IO.Directory]::CreateDirectory((Join-Path $fixtureRoot 'src')) | Out-Null
@@ -56,7 +56,7 @@ Invoke-CcodTest 'TrayHost artifact validation binds the manifest and embedded PE
 
 Invoke-CcodTest 'native build entrypoints reject mismatched package AssemblyInfo and manifest versions before compilation' {
     Import-Module (Join-Path $repositoryRoot 'build\TrayHostBuild.psm1') -Force
-    $root = Join-Path $env:TEMP ('ccod-native-version-contract-' + [Guid]::NewGuid().ToString('N'))
+    $root = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-native-version-contract-' + [Guid]::NewGuid().ToString('N'))
     try {
         [IO.Directory]::CreateDirectory($root) | Out-Null
         $cases = @(
@@ -124,7 +124,7 @@ Invoke-CcodTest 'TrayHost build lock pins the Microsoft net48 reference package'
 
 Invoke-CcodTest 'TrayHost resolver returns only the locked reference directory and rejects a mutated lock' {
     Import-Module (Join-Path $repositoryRoot 'build\TrayHostReferencePack.psm1') -Force
-    $cache=Join-Path $env:TEMP 'ccod-trayhost-reference-pack'
+    $cache=Join-Path (Get-CcodTestCanonicalTempRoot) 'ccod-trayhost-reference-pack'
     $resolved=Resolve-CcodTrayHostReferencePack -LockPath $lockPath -CacheRoot $cache
     Assert-CcodTrue ([IO.Path]::GetFullPath($resolved.ReferenceRoot).StartsWith([IO.Path]::GetFullPath($cache),[StringComparison]::OrdinalIgnoreCase)) 'resolver stays under its cache root'
     foreach($leaf in @('mscorlib.dll','System.dll','System.Core.dll','System.Drawing.dll')){Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $resolved.ReferenceRoot $leaf) -PathType Leaf) "locked reference exists: $leaf"}
@@ -143,7 +143,7 @@ Invoke-CcodTest 'TrayHost build emits one source-auditable artifact and rejects
     $modulePath=Join-Path $repositoryRoot 'build\TrayHostBuild.psm1'
     Assert-CcodTrue (Test-Path -LiteralPath $modulePath -PathType Leaf) 'TrayHost build module exists'
     Import-Module $modulePath -Force
-    $artifact=Join-Path $env:TEMP ('ccod-trayhost-artifact-'+[Guid]::NewGuid().ToString('N'))
+    $artifact=Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-trayhost-artifact-'+[Guid]::NewGuid().ToString('N'))
     try{
         $result=Invoke-CcodTrayHostBuild -RepositoryRoot $repositoryRoot -Version '2.5.22' -OutputDirectory $artifact
         Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $artifact 'CodexRemote.TrayHost.exe') -PathType Leaf) 'TrayHost executable exists'
@@ -204,8 +204,8 @@ Invoke-CcodTest 'TrayHost build embeds the product ICO instead of relying on a r
 
 Invoke-CcodTest 'portable launcher build emits a tamper-bound double-click entrypoint' {
     Import-Module (Join-Path $repositoryRoot 'build\TrayHostBuild.psm1') -Force
-    $artifact = Join-Path $env:TEMP ('ccod-portable-launcher-artifact-' + [Guid]::NewGuid().ToString('N'))
-    $fixtureRoot = Join-Path $env:TEMP ('ccod-portable-launcher-repository-' + [Guid]::NewGuid().ToString('N'))
+    $artifact = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-portable-launcher-artifact-' + [Guid]::NewGuid().ToString('N'))
+    $fixtureRoot = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-portable-launcher-repository-' + [Guid]::NewGuid().ToString('N'))
     try {
         $result = Invoke-CcodPortableLauncherBuild -RepositoryRoot $repositoryRoot -Version '2.5.22' -OutputDirectory $artifact
         Assert-CcodTrue (Test-Path -LiteralPath (Join-Path $artifact 'CodexRemote.Portable.exe') -PathType Leaf) 'portable launcher executable exists'

From 544315e6443a78754b9437630ef3c8393dba9e02 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sat, 19 Sep 2026 17:18:08 +0800
Subject: [PATCH 175/187] test: make the ci gates pass on hosted windows
 runners

Hosted windows-latest runners expose ambient conditions that the repository
test gates did not tolerate. Each defect below was reproduced from a runner log
and fixed on the test side, without weakening a product security check.

Temp roots: %TEMP% is the 8.3 short name C:\Users\RUNNER~1\AppData\Local\Temp
while the installed lifecycle observation boundary requires canonical long-form
paths, so every fixture root built from the alias was rejected with
CCOD_INTEGRATION_OBSERVATION_UNAVAILABLE.

Child stdin: the runner console page is UTF-8, so Windows PowerShell 5.1 derives
Console.InputEncoding from it and Process.StandardInput emits a byte-order mark
that corrupts the first JSON token a child reads. Windows PowerShell 5.1 has no
ProcessStartInfo.StandardInputEncoding, so both sides now use explicit BOM-free
UTF-8.

Inherited owner: the runner runs elevated, so a new directory inherits owner
S-1-5-32-544 (Administrators) rather than the token user. The legacy migration
plan recovery predicate compared the owner against the token user and therefore
rejected safe inherited evidence. It now accepts the token's default owner for
inherited evidence and still requires the token user for exact evidence; a
foreign owner is still rejected.

Line endings: build\CodexControlOtherDevices.iss has no pinned line endings, so a
Windows checkout is CRLF while the line-anchored Source: pattern expects a
trailing [^\r\n]+$. Normalize the text before asserting content.

Module path: npm and Actions start these Windows PowerShell 5.1 suites from a
PowerShell 7 shell, whose PSModulePath cannot resolve inbox cmdlets such as
Get-ExecutionPolicy. Restore the Desktop module paths exactly as
tests/Validate.ps1 already does.

The CI job limit is raised because the 43 sequential persistence suites measured
about 33 minutes on a hosted runner, which the previous 20 minute limit could
not cover.
---
 .github/workflows/ci.yml                      |  6 +++++-
 .../modules/InstallFileTransaction.psm1       |  2 +-
 .../InstallFileTransaction.SelfTest.ps1       | 14 +++++++++++++
 .../InstalledLifecycleHarness.SelfTest.ps1    |  1 +
 ...fficialDraftAcceptanceHarness.SelfTest.ps1 |  1 +
 .../persistence/ReleaseWorkflow.SelfTest.ps1  |  5 +++++
 tests/persistence/TestSupport.SelfTest.ps1    | 21 +++++++++++++++++++
 tests/persistence/TestSupport.ps1             | 21 +++++++++++++++++++
 .../UninstallBootstrap.SelfTest.ps1           |  1 +
 9 files changed, 70 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 080ef97..06077af 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,11 @@ jobs:
   validate:
     name: Windows validation
     runs-on: windows-latest
-    timeout-minutes: 20
+    # The full repository validation runs 43 persistence suites sequentially in
+    # Windows PowerShell child processes. On a hosted runner that takes about 33
+    # minutes, so the job limit must cover it with margin for the lifecycle,
+    # release-contract and TrayHost steps that follow.
+    timeout-minutes: 90
     steps:
       - name: Check out repository
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
diff --git a/src/persistence/modules/InstallFileTransaction.psm1 b/src/persistence/modules/InstallFileTransaction.psm1
index 134437f..378b4b0 100644
--- a/src/persistence/modules/InstallFileTransaction.psm1
+++ b/src/persistence/modules/InstallFileTransaction.psm1
@@ -375,7 +375,7 @@ internal sealed class CcodInstallGenerationRuntimeV7 : IDisposable
     internal static bool IsRecoverableLegacyPlanDirectorySecurity(byte[] descriptor){return TestLegacyPlanSecurity(descriptor,true,true);}
     private static bool TestLegacyPlanSecurity(byte[] descriptor,bool directory,bool inherited)
     {
-        try{RawSecurityDescriptor raw=new RawSecurityDescriptor(descriptor,0);WindowsIdentity identity=WindowsIdentity.GetCurrent();try{SecurityIdentifier user=identity.User;bool protectedAcl=(raw.ControlFlags&ControlFlags.DiscretionaryAclProtected)!=0;if(user==null||raw.Owner==null||!raw.Owner.Equals(user)||protectedAcl==inherited||raw.DiscretionaryAcl==null||raw.DiscretionaryAcl.Count!=3)return false;HashSet<string> expected=new HashSet<string>(StringComparer.Ordinal){user.Value,new SecurityIdentifier(WellKnownSidType.LocalSystemSid,null).Value,new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid,null).Value};AceFlags expectedFlags=directory?(AceFlags.ContainerInherit|AceFlags.ObjectInherit):AceFlags.None;if(inherited)expectedFlags|=AceFlags.Inherited;foreach(GenericAce generic in raw.DiscretionaryAcl){CommonAce ace=generic as CommonAce;if(ace==null||ace.IsCallback||ace.AceQualifier!=AceQualifier.AccessAllowed||ace.AceFlags!=expectedFlags||ace.AccessMask!=(int)FileSystemRights.FullControl||ace.SecurityIdentifier==null||!expected.Remove(ace.SecurityIdentifier.Value))return false;}return expected.Count==0;}finally{identity.Dispose();}}catch{return false;}
+        try{RawSecurityDescriptor raw=new RawSecurityDescriptor(descriptor,0);WindowsIdentity identity=WindowsIdentity.GetCurrent();try{SecurityIdentifier user=identity.User;bool protectedAcl=(raw.ControlFlags&ControlFlags.DiscretionaryAclProtected)!=0;if(user==null||raw.Owner==null||!raw.Owner.Equals(inherited?(identity.Owner??user):user)||protectedAcl==inherited||raw.DiscretionaryAcl==null||raw.DiscretionaryAcl.Count!=3)return false;HashSet<string> expected=new HashSet<string>(StringComparer.Ordinal){user.Value,new SecurityIdentifier(WellKnownSidType.LocalSystemSid,null).Value,new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid,null).Value};AceFlags expectedFlags=directory?(AceFlags.ContainerInherit|AceFlags.ObjectInherit):AceFlags.None;if(inherited)expectedFlags|=AceFlags.Inherited;foreach(GenericAce generic in raw.DiscretionaryAcl){CommonAce ace=generic as CommonAce;if(ace==null||ace.IsCallback||ace.AceQualifier!=AceQualifier.AccessAllowed||ace.AceFlags!=expectedFlags||ace.AccessMask!=(int)FileSystemRights.FullControl||ace.SecurityIdentifier==null||!expected.Remove(ace.SecurityIdentifier.Value))return false;}return expected.Count==0;}finally{identity.Dispose();}}catch{return false;}
     }
     private static void ValidateExactLegacyPlanSecurity(SafeFileHandle handle,bool directory){if(!IsExactLegacyPlanSecurity(ReadLegacyPlanSecurity(handle),directory))throw new InvalidDataException("legacy plan security");}
     internal static object[] ReadAuthorityFile(string path){SafeFileHandle handle=CreateFileW(path,READ|READ_ATTRIBUTES|SYNC,SHARE_READ,IntPtr.Zero,OPEN_EXISTING,NON_DIRECTORY|FLAG_BACKUP|FLAG_REPARSE,IntPtr.Zero);if(handle.IsInvalid){int error=Marshal.GetLastWin32Error();handle.Dispose();throw new Win32Exception(error);}FileStream stream=null;try{stream=new FileStream(handle,FileAccess.Read,65536,false);handle=null;FILE_INFO before=Info(stream.SafeFileHandle);ValidatePlain(before,stream.SafeFileHandle);string finalPath=FinalPath(stream.SafeFileHandle);if(!SamePath(finalPath,path)||stream.Length<0||stream.Length>4194304)throw new InvalidDataException("authority file invalid");byte[] bytes=new byte[(int)stream.Length];int offset=0;while(offset<bytes.Length){int read=stream.Read(bytes,offset,bytes.Length-offset);if(read==0)throw new EndOfStreamException();offset+=read;}FILE_INFO after=Info(stream.SafeFileHandle);ValidatePlain(after,stream.SafeFileHandle);if(before.VolumeSerialNumber!=after.VolumeSerialNumber||before.FileIndexHigh!=after.FileIndexHigh||before.FileIndexLow!=after.FileIndexLow||!SamePath(FinalPath(stream.SafeFileHandle),finalPath))throw new InvalidDataException("path changed");string sha;using(SHA256 hash=SHA256.Create()){sha=BitConverter.ToString(hash.ComputeHash(bytes)).Replace("-","").ToLowerInvariant();}return new object[]{Convert.ToBase64String(bytes),sha};}finally{if(stream!=null)stream.Dispose();if(handle!=null)handle.Dispose();}}
diff --git a/tests/persistence/InstallFileTransaction.SelfTest.ps1 b/tests/persistence/InstallFileTransaction.SelfTest.ps1
index 1de0a98..e27891c 100644
--- a/tests/persistence/InstallFileTransaction.SelfTest.ps1
+++ b/tests/persistence/InstallFileTransaction.SelfTest.ps1
@@ -352,6 +352,20 @@ Invoke-CcodTask2Fix1Test 'unsafe-recovery' 'empty-directory recovery rejects non
             Close-CcodInstallFileTransaction -Transaction $product -Disposition Failed;$product=$null;&$lifecycleModule {param($Fence)Complete-CcodLifecycleProductCleanupFence -Fence $Fence -Outcome Completed|Out-Null} $fence
         }finally{if($null-ne$product){try{Close-CcodInstallFileTransaction -Transaction $product -Disposition Failed}catch{}};if($null-ne$outer){try{&$lifecycleModule {param($Context)Exit-CcodLifecycleProductCleanupLease -Context $Context|Out-Null} $outer}catch{}};Remove-CcodInstallFileFixture $fixture}
     }
+    # A hosted runner runs the suite as an elevated administrator whose inherited
+    # directory owner is the Administrators group (S-1-5-32-544) rather than the
+    # token user, so the recovery predicate must accept the token's default owner
+    # for inherited evidence while still rejecting a foreign owner.
+    $identity=[Security.Principal.WindowsIdentity]::GetCurrent()
+    try{
+        $defaultOwner=$identity.Owner
+        if($null-ne$defaultOwner){
+            $sddl='O:{0}D:AI(A;OICIID;FA;;;{1})(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)'-f$defaultOwner.Value,$identity.User.Value
+            $descriptor=[Security.AccessControl.RawSecurityDescriptor]::new($sddl);$bytes=[byte[]]::new($descriptor.BinaryLength);$descriptor.GetBinaryForm($bytes,0)
+            $sameDefaultOwner=&$module {param([byte[]]$Value)[bool](Invoke-CcodRuntimeStatic IsRecoverableLegacyPlanDirectorySecurity @((,$Value)))} $bytes
+            Assert-CcodEqual $true $sameDefaultOwner 'a directory owned by the token default owner is recoverable inherited evidence'
+        }
+    }finally{$identity.Dispose()}
     $identity=[Security.Principal.WindowsIdentity]::GetCurrent();try{$sddl='O:WDG:{0}D:AI(A;OICIID;FA;;;{0})(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)'-f$identity.User.Value;$descriptor=[Security.AccessControl.RawSecurityDescriptor]::new($sddl);$bytes=[byte[]]::new($descriptor.BinaryLength);$descriptor.GetBinaryForm($bytes,0);$recoverable=&$module {param([byte[]]$Value)[bool](Invoke-CcodRuntimeStatic IsRecoverableLegacyPlanDirectorySecurity @((,$Value)))} $bytes;Assert-CcodEqual $false $recoverable 'foreign owner is rejected by the same native recovery predicate'}finally{$identity.Dispose()}
 }
 
diff --git a/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1 b/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1
index beea18e..d9da3e0 100644
--- a/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1
+++ b/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1
@@ -1,5 +1,6 @@
 $ErrorActionPreference = 'Stop'
 . (Join-Path $PSScriptRoot 'TestSupport.ps1')
+Restore-CcodTestDesktopModulePath
 
 $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
 $harnessPath = Join-Path $repositoryRoot 'tests\installed\Invoke-InstalledLifecycleIntegration.ps1'
diff --git a/tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1 b/tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1
index 345cb81..276de5f 100644
--- a/tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1
+++ b/tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1
@@ -1,5 +1,6 @@
 $ErrorActionPreference = 'Stop'
 . (Join-Path $PSScriptRoot 'TestSupport.ps1')
+Restore-CcodTestDesktopModulePath
 . (Join-Path $PSScriptRoot 'LegacyReleaseFixture.ps1')
 
 $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 948dcba..69d4e7c 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -3,6 +3,7 @@ param([string]$FocusedCase)
 
 $ErrorActionPreference = 'Stop'
 . (Join-Path $PSScriptRoot 'TestSupport.ps1')
+Restore-CcodTestDesktopModulePath
 
 $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
 $defenderPath = Join-Path $repositoryRoot 'tools\Test-ReleaseDefender.ps1'
@@ -1022,6 +1023,10 @@ Invoke-CcodTest 'sealed installer package rejects entry and identity changes bef
 # Production mutation caught: restoring any legacy recursive {app} copy or executing a writable app bootstrap before Ready.
 Invoke-CcodTest 'Setup contains only sealed temporary inputs and no pre-Ready app product write' {
     $source = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw -Encoding UTF8
+    # This text asset is not line-ending pinned, so a Windows checkout with
+    # core.autocrlf produces CRLF while a Unix checkout produces LF. Normalize so
+    # the line-anchored assertions below assert content rather than line endings.
+    $source = $source -replace "`r`n", "`n"
     Assert-CcodTrue ($source -cmatch '(?m)^CreateAppDir=no\s*$') 'Setup never creates app before Ready'
     Assert-CcodTrue ($source -cmatch '(?m)^Uninstallable=no\s*$') 'Setup never creates an Inno uninstaller before Ready'
     Assert-CcodTrue ($source -cmatch 'InstallerPackageSha256' -and $source -cmatch 'InstallerPackageManifestSha256' -and $source -cmatch 'ActivationBootstrapSha256') 'Setup binds package manifest and bootstrap hashes'
diff --git a/tests/persistence/TestSupport.SelfTest.ps1 b/tests/persistence/TestSupport.SelfTest.ps1
index c1ba04e..1082093 100644
--- a/tests/persistence/TestSupport.SelfTest.ps1
+++ b/tests/persistence/TestSupport.SelfTest.ps1
@@ -84,6 +84,27 @@ if ($line -cne 'continue') { [Console]::Error.WriteLine('handshake failed'); exi
         if ([IO.Directory]::Exists($root)) { Remove-CcodTestOwnedTree -Path $root }
     }
 
+
+    # npm and Actions start these suites from a PowerShell 7 shell, which leaks a
+    # PowerShell 7 PSModulePath into the Windows PowerShell 5.1 child processes.
+    $previousModulePath = [Environment]::GetEnvironmentVariable('PSModulePath', 'Process')
+    try {
+        if ($PSVersionTable.PSEdition -eq 'Desktop') {
+            [Environment]::SetEnvironmentVariable('PSModulePath', 'C:\Program Files\PowerShell\7\Modules', 'Process')
+            Restore-CcodTestDesktopModulePath
+            $restored = [Environment]::GetEnvironmentVariable('PSModulePath', 'Process')
+            if ($restored -match 'PowerShell\\7(\\|$|;)') { throw 'ASSERT_TRUE: a leaked PowerShell 7 module path was not replaced' }
+            if ([string]::IsNullOrWhiteSpace($restored)) { throw 'ASSERT_TRUE: the restored module path is empty' }
+            [Environment]::SetEnvironmentVariable('PSModulePath', 'C:\custom-desktop-modules', 'Process')
+            Restore-CcodTestDesktopModulePath
+            if ([Environment]::GetEnvironmentVariable('PSModulePath', 'Process') -cne 'C:\custom-desktop-modules') {
+                throw 'ASSERT_EQUAL: a Desktop-only module path was overwritten'
+            }
+        }
+    } finally {
+        [Environment]::SetEnvironmentVariable('PSModulePath', $previousModulePath, 'Process')
+    }
+
     Write-Output 'TestSupport self-tests passed.'
 } finally {
     if ([IO.Directory]::Exists($sentinel)) { [IO.Directory]::Delete($sentinel, $true) }
diff --git a/tests/persistence/TestSupport.ps1 b/tests/persistence/TestSupport.ps1
index dcbf7bb..b973b79 100644
--- a/tests/persistence/TestSupport.ps1
+++ b/tests/persistence/TestSupport.ps1
@@ -76,6 +76,27 @@ function Read-CcodTestStandardInputLine {
     try { return $reader.ReadLine() } finally { $reader.Dispose() }
 }
 
+function Restore-CcodTestDesktopModulePath {
+    # npm and GitHub Actions launch these Windows PowerShell 5.1 entry points from a
+    # PowerShell 7 shell. The inherited PSModulePath then contains only the
+    # PowerShell 7 module layout, so a 5.1 child process cannot resolve inbox
+    # cmdlets such as Get-ExecutionPolicy or Get-FileHash. The repository already
+    # normalizes this in tests/Validate.ps1 and tests/PersistenceSelfTest.ps1; do the
+    # same for any suite that CI starts directly from a PowerShell 7 shell.
+    [CmdletBinding()]
+    param()
+    if ($PSVersionTable.PSEdition -ne 'Desktop') { return }
+    $current = [Environment]::GetEnvironmentVariable('PSModulePath', 'Process')
+    if ([string]::IsNullOrWhiteSpace($current) -or $current -notmatch 'PowerShell\\7(\\|$|;)') { return }
+    $desktopModulePaths = @(
+        [Environment]::GetEnvironmentVariable('PSModulePath', 'User'),
+        [Environment]::GetEnvironmentVariable('PSModulePath', 'Machine')
+    ) | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }
+    if ($desktopModulePaths.Count -gt 0) {
+        $env:PSModulePath = $desktopModulePaths -join ';'
+    }
+}
+
 function Get-CcodTestCanonicalTempRoot {
     # $env:TEMP can be a Windows 8.3 short-name alias such as
     # C:\Users\RUNNER~1\AppData\Local\Temp on hosted runners. Fixture roots
diff --git a/tests/persistence/UninstallBootstrap.SelfTest.ps1 b/tests/persistence/UninstallBootstrap.SelfTest.ps1
index 8b8db80..0fac4e1 100644
--- a/tests/persistence/UninstallBootstrap.SelfTest.ps1
+++ b/tests/persistence/UninstallBootstrap.SelfTest.ps1
@@ -1,5 +1,6 @@
 $ErrorActionPreference = 'Stop'
 . (Join-Path $PSScriptRoot 'TestSupport.ps1')
+Restore-CcodTestDesktopModulePath
 
 $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
 $bootstrapScript = Join-Path $repositoryRoot 'src\persistence\UninstallBootstrap.ps1'

From 4dbbd568e2e9ea7b404a7226701681dfd9c5cb3f Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sat, 19 Sep 2026 18:48:22 +0800
Subject: [PATCH 176/187] test: keep child stderr assertions self-explanatory

---
 .github/workflows/diag-release-build.yml      | 38 +++++++++++++++++++
 .../InstalledLifecycleHarness.SelfTest.ps1    |  8 +++-
 ...fficialDraftAcceptanceHarness.SelfTest.ps1 |  2 +-
 .../persistence/ReleaseWorkflow.SelfTest.ps1  |  2 +-
 4 files changed, 46 insertions(+), 4 deletions(-)
 create mode 100644 .github/workflows/diag-release-build.yml

diff --git a/.github/workflows/diag-release-build.yml b/.github/workflows/diag-release-build.yml
new file mode 100644
index 0000000..5c3776d
--- /dev/null
+++ b/.github/workflows/diag-release-build.yml
@@ -0,0 +1,38 @@
+name: DIAG release build gate
+
+on:
+  push:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Release build gate
+    runs-on: windows-latest
+    timeout-minutes: 90
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: 22
+
+      - name: Build CodexRemote-fix portable bundle
+        shell: pwsh
+        env:
+          CCOD_RELEASE_TAG: v2.5.22
+        run: |
+          $version = $env:CCOD_RELEASE_TAG.Substring(1)
+          ./build/build.ps1 -Version $version
+
+      - name: Report bundle
+        if: always()
+        shell: pwsh
+        run: |
+          if (Test-Path build/dist) {
+            Get-ChildItem -Recurse build/dist | Select-Object FullName, Length | Format-Table -AutoSize | Out-String -Width 200
+          } else { Write-Output 'NO_DIST' }
diff --git a/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1 b/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1
index d9da3e0..04b33c4 100644
--- a/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1
+++ b/tests/persistence/InstalledLifecycleHarness.SelfTest.ps1
@@ -910,7 +910,8 @@ $ErrorActionPreference='Stop'
             $stdout=Join-Path $root ($mode+'.stdout');$stderr=Join-Path $root ($mode+'.stderr')
             $child=Start-Process -FilePath $powershellPath -ArgumentList $normalArguments -RedirectStandardOutput $stdout -RedirectStandardError $stderr -NoNewWindow -PassThru -Wait -ErrorAction Stop
             try{Assert-CcodEqual 0 $child.ExitCode ($mode+' inert child actually executes')}finally{$child.Dispose()}
-            Assert-CcodEqual '' ([IO.File]::ReadAllText($stderr)) ($mode+' inert child produces no error')
+            $stderrText=[IO.File]::ReadAllText($stderr)
+            Assert-CcodEqual '' $stderrText ($mode+' inert child produces no error; stderr=[' + $stderrText.Replace("`r",'<CR>').Replace("`n",'<LF>') + ']')
             $value=[IO.File]::ReadAllText($stdout)|ConvertFrom-Json
             Assert-CcodEqual $prepared.transactionId $value.transactionId 'actual child retains transaction'
             Assert-CcodEqual $expectedInstallRoot $value.installRoot 'actual child retains spaced trailing-slash path'
@@ -1115,6 +1116,9 @@ if($reader.ReadLine()-cne'continue'){throw 'handshake failed'}
         $text=@'
 param([string]$IntegrationPath)
 $ErrorActionPreference='Stop';$WarningPreference='SilentlyContinue'
+# The parent asserts this child's stderr is byte-empty, so non-error streams must be
+# silent: a progress record would otherwise be serialized to stderr as CLIXML.
+$ProgressPreference='SilentlyContinue'
 . $IntegrationPath -Library
 $script:FixtureFacts=[IO.File]::ReadAllText((Join-Path $PSScriptRoot 'facts.json'))|ConvertFrom-Json
 $spec=[IO.File]::ReadAllText((Join-Path $PSScriptRoot 'spec.json'))|ConvertFrom-Json
@@ -1139,7 +1143,7 @@ if($result.Outcome-cne'InstalledFinalizationStarted'){throw 'wrong completion'}
         Assert-CcodTrue ($child.WaitForExit(20000)) 'actual consumer exits after dependency handoff'
         Assert-CcodEqual 0 $child.ExitCode ('real consumer failure: '+$errors.Result)
         Assert-CcodEqual ('CCOD_RELEASED_BEFORE_EXIT'+[Environment]::NewLine) $rest.Result 'directory authority is released before wrapper process exit'
-        Assert-CcodEqual '' $errors.Result 'child has no hidden errors'
+        Assert-CcodEqual '' $errors.Result ('child has no hidden errors; stderr=[' + $errors.Result.Replace("`r",'<CR>').Replace("`n",'<LF>') + ']')
         [IO.Directory]::Move($runtime,$runtime+'-reclaimed')
     } finally {if($null-ne$child){if(-not$child.HasExited){$child.StandardInput.Close();if(-not$child.WaitForExit(15000)){$child.Kill();$child.WaitForExit()}};$child.Dispose()};if(Test-Path $root){Remove-Item $root -Recurse -Force}}
 }
diff --git a/tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1 b/tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1
index 276de5f..6d3d898 100644
--- a/tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1
+++ b/tests/persistence/OfficialDraftAcceptanceHarness.SelfTest.ps1
@@ -2350,7 +2350,7 @@ try {
             Write-CcodTestProcessInput -Process $process -Text 'release' -AddNewLine
             Assert-CcodTrue ($process.WaitForExit(15000)) 'owned inert child exits after explicit release'
             Assert-CcodEqual 0 $process.ExitCode 'child lease release succeeds'
-            Assert-CcodEqual '' $errors.Result 'native child has no hidden lock error'
+            Assert-CcodEqual '' $errors.Result ('native child has no hidden lock error; stderr=[' + $errors.Result.Replace("`r",'<CR>').Replace("`n",'<LF>') + ']')
             $first=&$module {param($Root)Open-CcodOfficialDraftOperationLease -EvidenceRoot $Root} $evidence
             Assert-CcodTrue ($null-ne$first) 'new acquisition after child exit proves release'
             $blocked=$false;try{[IO.Directory]::Move($evidence,$evidence+'.moved')}catch [IO.IOException]{$blocked=$true}
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 69d4e7c..afcd7ee 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -4152,7 +4152,7 @@ Invoke-CcodTask6Test 'fix1-fresh-process-module-boundary' 'draft release wrapper
                 Assert-CcodTrue ($child.WaitForExit(60000)) 'fresh wrapper process completes within the timeout'
                 $output=$stdout.GetAwaiter().GetResult();$errorOutput=$stderr.GetAwaiter().GetResult()
                 Assert-CcodEqual 0 $child.ExitCode "fresh PowerShell import uses normal process policy with parent override '$inherited'"
-                Assert-CcodEqual '' $errorOutput 'normal-policy module import has no stderr failure'
+                Assert-CcodEqual '' $errorOutput ('normal-policy module import has no stderr failure; stderr=[' + $errorOutput.Replace("`r",'<CR>').Replace("`n",'<LF>') + ']')
                 Assert-CcodTrue $output.Contains('CCOD_DRAFT_WRAPPER_OK') 'fresh PowerShell import exports the expected public command'
                 $policyLines=@($output.Split([char]10)|Where-Object {$_.StartsWith('CCOD_DRAFT_WRAPPER_POLICY=',[StringComparison]::Ordinal)})
                 Assert-CcodEqual 1 $policyLines.Count 'the real child reports exactly one effective policy'

From d863a34161cc367d93cbd735e3c845a64048b695 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sat, 19 Sep 2026 18:52:12 +0800
Subject: [PATCH 177/187] diag: probe the build script on the runner

---
 .github/workflows/diag-build-probe.yml | 21 ++++++++++++++
 tests/persistence/tmp-build-probe.ps1  | 39 ++++++++++++++++++++++++++
 2 files changed, 60 insertions(+)
 create mode 100644 .github/workflows/diag-build-probe.yml
 create mode 100644 tests/persistence/tmp-build-probe.ps1

diff --git a/.github/workflows/diag-build-probe.yml b/.github/workflows/diag-build-probe.yml
new file mode 100644
index 0000000..1e6b7c5
--- /dev/null
+++ b/.github/workflows/diag-build-probe.yml
@@ -0,0 +1,21 @@
+name: DIAG build probe
+
+on:
+  push:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  probe:
+    name: Build probe
+    runs-on: windows-latest
+    timeout-minutes: 30
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Probe the build script
+        shell: pwsh
+        run: powershell.exe -NoProfile -ExecutionPolicy Bypass -File ./tests/persistence/tmp-build-probe.ps1
diff --git a/tests/persistence/tmp-build-probe.ps1 b/tests/persistence/tmp-build-probe.ps1
new file mode 100644
index 0000000..7cd6f01
--- /dev/null
+++ b/tests/persistence/tmp-build-probe.ps1
@@ -0,0 +1,39 @@
+$ErrorActionPreference='Continue'
+Write-Output ("PWSH_VERSION=" + $PSVersionTable.PSVersion + " EDITION=" + $PSVersionTable.PSEdition)
+$build = Join-Path (Split-Path $PSScriptRoot -Parent) 'build/build.ps1'
+Write-Output ("BUILD_PATH=" + $build)
+$bytes = [IO.File]::ReadAllBytes($build)
+Write-Output ("BUILD_BYTES=" + $bytes.Length + " CRLF=" + ([regex]::Matches([Text.Encoding]::UTF8.GetString($bytes), "`r`n").Count) + " LF=" + ([regex]::Matches([Text.Encoding]::UTF8.GetString($bytes), "(?<!`r)`n").Count))
+
+$tokens=$null;$errors=$null
+$ast=[Management.Automation.Language.Parser]::ParseFile($build,[ref]$tokens,[ref]$errors)
+Write-Output ("PARSE_ERRORS=" + @($errors).Count)
+$defs=@($ast.FindAll({param($n) $n -is [Management.Automation.Language.FunctionDefinitionAst]},$true) | Where-Object { $_.Parent -is [Management.Automation.Language.ScriptBlockAst] -and $_.Parent.Parent -is [Management.Automation.Language.NamedBlockAst] })
+Write-Output ("TOP_LEVEL_FUNCTIONS=" + $defs.Count)
+$names = @($defs | ForEach-Object { $_.Name })
+Write-Output ("HAS_PAYLOAD=" + ($names -contains 'Copy-CcodBuildPayloadFile'))
+Write-Output ("HAS_SCOPE=" + ($names -contains 'Invoke-CcodBuildTemporarySetupScope'))
+
+# Which function contains the Copy-CcodBuildPayloadFile call sites?
+$calls = @($ast.FindAll({param($n) $n -is [Management.Automation.Language.CommandAst] -and $n.GetCommandName() -ceq 'Copy-CcodBuildPayloadFile'},$true))
+Write-Output ("CALL_SITES=" + $calls.Count)
+foreach ($c in $calls[0..([Math]::Min(3,$calls.Count-1))]) {
+    $ancestor = $c
+    $chain = @()
+    while ($null -ne $ancestor) {
+        if ($ancestor -is [Management.Automation.Language.FunctionDefinitionAst]) { $chain += ('FUNC:' + $ancestor.Name) }
+        if ($ancestor -is [Management.Automation.Language.ScriptBlockExpressionAst]) { $chain += 'SCRIPTBLOCK' }
+        $ancestor = $ancestor.Parent
+    }
+    Write-Output ("CALL_LINE=" + $c.Extent.StartLineNumber + " CHAIN=" + ($chain -join ' > '))
+}
+
+# Now run the real build and capture the full failure detail.
+$version = ([string]((Get-Content -LiteralPath (Join-Path (Split-Path $PSScriptRoot -Parent) 'package.json') -Raw | ConvertFrom-Json).version)).Trim()
+Write-Output ("ATTEMPT_VERSION=" + $version)
+try { & $build -Version $version } catch {
+    Write-Output ("BUILD_EXCEPTION=" + $_.Exception.GetType().FullName + ':' + $_.Exception.Message)
+    Write-Output ("BUILD_POSITION=" + [string]$_.InvocationInfo.PositionMessage)
+    Write-Output ("BUILD_STACK=" + ([string]$_.ScriptStackTrace).Replace("`r",' ').Replace("`n",' | '))
+}
+Write-Output 'PROBE_DONE'

From c40a2dcadaecd1e7b1685e26c1ec3359eb3e41b5 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sat, 19 Sep 2026 18:53:17 +0800
Subject: [PATCH 178/187] diag: compare build under pwsh and powershell

---
 .github/workflows/diag-build-probe.yml | 16 ++++++++--
 tests/persistence/tmp-build-probe.ps1  | 43 ++++++++++++++------------
 2 files changed, 36 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/diag-build-probe.yml b/.github/workflows/diag-build-probe.yml
index 1e6b7c5..634bf3f 100644
--- a/.github/workflows/diag-build-probe.yml
+++ b/.github/workflows/diag-build-probe.yml
@@ -11,11 +11,21 @@ jobs:
   probe:
     name: Build probe
     runs-on: windows-latest
-    timeout-minutes: 30
+    timeout-minutes: 60
     steps:
       - name: Check out repository
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
 
-      - name: Probe the build script
+      - name: Probe under PowerShell 7
+        if: always()
         shell: pwsh
-        run: powershell.exe -NoProfile -ExecutionPolicy Bypass -File ./tests/persistence/tmp-build-probe.ps1
+        run: |
+          pwsh -NoProfile -File ./tests/persistence/tmp-build-probe.ps1
+          exit 0
+
+      - name: Probe under Windows PowerShell 5.1
+        if: always()
+        shell: pwsh
+        run: |
+          powershell.exe -NoProfile -ExecutionPolicy Bypass -File ./tests/persistence/tmp-build-probe.ps1
+          exit 0
diff --git a/tests/persistence/tmp-build-probe.ps1 b/tests/persistence/tmp-build-probe.ps1
index 7cd6f01..1a995e8 100644
--- a/tests/persistence/tmp-build-probe.ps1
+++ b/tests/persistence/tmp-build-probe.ps1
@@ -1,39 +1,42 @@
 $ErrorActionPreference='Continue'
-Write-Output ("PWSH_VERSION=" + $PSVersionTable.PSVersion + " EDITION=" + $PSVersionTable.PSEdition)
-$build = Join-Path (Split-Path $PSScriptRoot -Parent) 'build/build.ps1'
-Write-Output ("BUILD_PATH=" + $build)
-$bytes = [IO.File]::ReadAllBytes($build)
-Write-Output ("BUILD_BYTES=" + $bytes.Length + " CRLF=" + ([regex]::Matches([Text.Encoding]::UTF8.GetString($bytes), "`r`n").Count) + " LF=" + ([regex]::Matches([Text.Encoding]::UTF8.GetString($bytes), "(?<!`r)`n").Count))
+Write-Output ("SHELL_VERSION=" + $PSVersionTable.PSVersion + " EDITION=" + $PSVersionTable.PSEdition)
+$repoRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+$build = Join-Path $repoRoot 'build\build.ps1'
+Write-Output ("BUILD_PATH=" + $build + " EXISTS=" + [IO.File]::Exists($build))
+if (-not [IO.File]::Exists($build)) { Write-Output 'PROBE_ABORT'; exit 0 }
+
+# Minimal scoping pattern under this exact shell.
+function Copy-CcodBuildPayloadFile { param($Source) return ('COPIED:' + $Source) }
+function Invoke-CcodBuildTemporarySetupScope { param([scriptblock]$Action) & $Action }
+try { Write-Output ("PATTERN=" + (Invoke-CcodBuildTemporarySetupScope -Action ({ Copy-CcodBuildPayloadFile -Source 'package.json' }))) }
+catch { Write-Output ("PATTERN_FAILED=" + $_.Exception.Message) }
 
 $tokens=$null;$errors=$null
 $ast=[Management.Automation.Language.Parser]::ParseFile($build,[ref]$tokens,[ref]$errors)
 Write-Output ("PARSE_ERRORS=" + @($errors).Count)
-$defs=@($ast.FindAll({param($n) $n -is [Management.Automation.Language.FunctionDefinitionAst]},$true) | Where-Object { $_.Parent -is [Management.Automation.Language.ScriptBlockAst] -and $_.Parent.Parent -is [Management.Automation.Language.NamedBlockAst] })
-Write-Output ("TOP_LEVEL_FUNCTIONS=" + $defs.Count)
-$names = @($defs | ForEach-Object { $_.Name })
-Write-Output ("HAS_PAYLOAD=" + ($names -contains 'Copy-CcodBuildPayloadFile'))
-Write-Output ("HAS_SCOPE=" + ($names -contains 'Invoke-CcodBuildTemporarySetupScope'))
-
-# Which function contains the Copy-CcodBuildPayloadFile call sites?
+foreach ($e in @($errors)) { Write-Output ("PARSE_ERROR=" + $e.Message + " @line " + $e.Extent.StartLineNumber) }
+$allDefs=@($ast.FindAll({param($n) $n -is [Management.Automation.Language.FunctionDefinitionAst]},$true))
+Write-Output ("ALL_FUNCTION_DEFS=" + $allDefs.Count)
+Write-Output ("HAS_PAYLOAD_DEF=" + [bool](@($allDefs | Where-Object { $_.Name -ceq 'Copy-CcodBuildPayloadFile' }).Count))
 $calls = @($ast.FindAll({param($n) $n -is [Management.Automation.Language.CommandAst] -and $n.GetCommandName() -ceq 'Copy-CcodBuildPayloadFile'},$true))
 Write-Output ("CALL_SITES=" + $calls.Count)
-foreach ($c in $calls[0..([Math]::Min(3,$calls.Count-1))]) {
-    $ancestor = $c
+foreach ($c in @($calls | Select-Object -First 2)) {
+    $ancestor = $c.Parent
     $chain = @()
-    while ($null -ne $ancestor) {
+    while ($null -ne $ancestor -and $chain.Count -lt 6) {
         if ($ancestor -is [Management.Automation.Language.FunctionDefinitionAst]) { $chain += ('FUNC:' + $ancestor.Name) }
-        if ($ancestor -is [Management.Automation.Language.ScriptBlockExpressionAst]) { $chain += 'SCRIPTBLOCK' }
+        elseif ($ancestor -is [Management.Automation.Language.ScriptBlockExpressionAst]) { $chain += 'SCRIPTBLOCK' }
+        elseif ($ancestor -is [Management.Automation.Language.ScriptBlockAst]) { $chain += 'SCRIPT' }
         $ancestor = $ancestor.Parent
     }
     Write-Output ("CALL_LINE=" + $c.Extent.StartLineNumber + " CHAIN=" + ($chain -join ' > '))
 }
 
-# Now run the real build and capture the full failure detail.
-$version = ([string]((Get-Content -LiteralPath (Join-Path (Split-Path $PSScriptRoot -Parent) 'package.json') -Raw | ConvertFrom-Json).version)).Trim()
+$version = ([string]((Get-Content -LiteralPath (Join-Path $repoRoot 'package.json') -Raw | ConvertFrom-Json).version)).Trim()
 Write-Output ("ATTEMPT_VERSION=" + $version)
-try { & $build -Version $version } catch {
+try { & $build -Version $version; Write-Output 'BUILD_OK' } catch {
     Write-Output ("BUILD_EXCEPTION=" + $_.Exception.GetType().FullName + ':' + $_.Exception.Message)
-    Write-Output ("BUILD_POSITION=" + [string]$_.InvocationInfo.PositionMessage)
+    Write-Output ("BUILD_POSITION=" + ([string]$_.InvocationInfo.PositionMessage).Replace("`r",' ').Replace("`n",' | '))
     Write-Output ("BUILD_STACK=" + ([string]$_.ScriptStackTrace).Replace("`r",' ').Replace("`n",' | '))
 }
 Write-Output 'PROBE_DONE'

From b58f63a1340d635d99e786a60a91fad728dabbb2 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sat, 19 Sep 2026 19:17:12 +0800
Subject: [PATCH 179/187] diag: probe scriptblock scoping across invocation
 styles

---
 .github/workflows/diag-scope.yml    | 45 +++++++++++++++++++++++++++++
 tests/persistence/tmp-scope-lib.ps1 | 12 ++++++++
 2 files changed, 57 insertions(+)
 create mode 100644 .github/workflows/diag-scope.yml
 create mode 100644 tests/persistence/tmp-scope-lib.ps1

diff --git a/.github/workflows/diag-scope.yml b/.github/workflows/diag-scope.yml
new file mode 100644
index 0000000..f3f7de0
--- /dev/null
+++ b/.github/workflows/diag-scope.yml
@@ -0,0 +1,45 @@
+name: DIAG scope probe
+
+on:
+  push:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  probe:
+    name: Scope probe
+    runs-on: windows-latest
+    timeout-minutes: 20
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Relative path invocation (ci style)
+        if: always()
+        shell: pwsh
+        run: |
+          ./tests/persistence/tmp-scope-lib.ps1
+          exit 0
+
+      - name: Call operator with relative path
+        if: always()
+        shell: pwsh
+        run: |
+          & ./tests/persistence/tmp-scope-lib.ps1
+          exit 0
+
+      - name: Call operator with absolute path
+        if: always()
+        shell: pwsh
+        run: |
+          & (Join-Path $PWD 'tests/persistence/tmp-scope-lib.ps1')
+          exit 0
+
+      - name: Child pwsh file invocation
+        if: always()
+        shell: pwsh
+        run: |
+          pwsh -NoProfile -File ./tests/persistence/tmp-scope-lib.ps1
+          exit 0
diff --git a/tests/persistence/tmp-scope-lib.ps1 b/tests/persistence/tmp-scope-lib.ps1
new file mode 100644
index 0000000..c1f68af
--- /dev/null
+++ b/tests/persistence/tmp-scope-lib.ps1
@@ -0,0 +1,12 @@
+$ErrorActionPreference='Stop'
+function Get-CcodProbeInner { return 'INNER-OK' }
+function Invoke-CcodProbeOuter { param([Parameter(Mandatory)][scriptblock]$Action) return (& $Action) }
+function Get-CcodProbeInnerDeep { return 'DEEP-OK' }
+function Invoke-CcodProbeOuterDeep {
+    param([Parameter(Mandatory)][scriptblock]$Action)
+    return (& { param($a) & $a } $Action)
+}
+Write-Output ("RESULT_DIRECT=" + (Invoke-CcodProbeOuter -Action ({ Get-CcodProbeInner })))
+Write-Output ("RESULT_DEEP=" + (Invoke-CcodProbeOuterDeep -Action ({ Get-CcodProbeInnerDeep })))
+Write-Output ("SCRIPT_ROOT=" + $PSScriptRoot)
+Write-Output 'LIB_DONE'

From 4a01e52bc0914f644624f14b979c588b2a56b029 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sat, 19 Sep 2026 19:19:57 +0800
Subject: [PATCH 180/187] fix: keep the temporary setup action a plain
 scriptblock

---
 .github/workflows/diag-build-fix.yml          | 49 ++++++++++++++++++
 build/build.ps1                               |  9 +++-
 .../persistence/ReleaseWorkflow.SelfTest.ps1  | 51 +++++++++++++++++++
 3 files changed, 108 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/diag-build-fix.yml

diff --git a/.github/workflows/diag-build-fix.yml b/.github/workflows/diag-build-fix.yml
new file mode 100644
index 0000000..b2e9ec8
--- /dev/null
+++ b/.github/workflows/diag-build-fix.yml
@@ -0,0 +1,49 @@
+name: DIAG build fix
+
+on:
+  push:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: Build fix verification
+    runs-on: windows-latest
+    timeout-minutes: 90
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: 22
+
+      - name: CI-exact portable bundle build under pwsh
+        if: always()
+        shell: pwsh
+        env:
+          CCOD_RELEASE_TAG: v2.5.22
+        run: |
+          $sw = [Diagnostics.Stopwatch]::StartNew()
+          try {
+            $version = $env:CCOD_RELEASE_TAG.Substring(1)
+            ./build/build.ps1 -Version $version
+            Write-Output 'CI_EXACT_OK'
+          } catch {
+            Write-Output ("CI_EXACT_EXCEPTION=" + $_.Exception.GetType().FullName + ':' + $_.Exception.Message)
+            Write-Output ("CI_EXACT_STACK=" + ([string]$_.ScriptStackTrace).Replace("`r",' ').Replace("`n",' | '))
+          }
+          $sw.Stop()
+          Write-Output ("BUILD_SECONDS=" + [int]$sw.Elapsed.TotalSeconds)
+          if (Test-Path build/dist) { Get-ChildItem build/dist | Select-Object -Expand Name } else { Write-Output 'NO_DIST' }
+          exit 0
+
+      - name: Release contract suite
+        if: always()
+        shell: pwsh
+        run: |
+          npm run test:release-contract
+          exit 0
diff --git a/build/build.ps1 b/build/build.ps1
index 42bd309..79ec98b 100644
--- a/build/build.ps1
+++ b/build/build.ps1
@@ -567,4 +567,11 @@ Write-Host ("  SHA-256:  {0}" -f $setupChecksum)
 Write-Host ("  Provenance: {0}" -f $setupProvenance)
 Write-Host ("  Manifest: {0}" -f $setupReleaseManifest)
 Write-Host ''
-}.GetNewClosure())
+})
+
+# NOTE: this action must stay a plain scriptblock. PowerShell 7 gives
+# GetNewClosure() a fresh dynamic module whose command resolution cannot see the
+# functions defined in this script, so wrapping the action would break every
+# local call such as Copy-CcodBuildPayloadFile. Windows PowerShell 5.1 happens to
+# resolve those names, so the defect only appears under the pwsh used by the
+# release workflow.
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index afcd7ee..12e64ca 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -3399,7 +3399,58 @@ Invoke-CcodTest 'package scripts build provenance and workflows retain the relea
 $iss = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw
 $buildSource = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\build.ps1') -Raw
 Assert-CcodTrue ($buildSource -match 'CodexRemote\.Portable\.exe' -and $buildSource -match 'Copy-CcodBuildPayloadFile' -and $buildSource -match 'New-CcodInstallerPackage') 'build places the portable launcher only in the manifest-listed sealed package'
+Assert-CcodTrue ($buildSource -cnotmatch 'GetNewClosure') 'the temporary Setup action stays a plain scriptblock so script-local functions stay resolvable'
 Assert-CcodTrue ($iss -cnotmatch 'CodexRemote\.Portable\.exe|PortableArtifactDirectory') 'Inno never copies a product launcher outside the sealed package transaction'
+Invoke-CcodTest 'temporary setup scope resolves script-local functions under PowerShell 7' {
+    # The release workflow runs build/build.ps1 from pwsh. PowerShell 7 gives a
+    # GetNewClosure() scriptblock a fresh dynamic module that cannot resolve the
+    # script's own functions, while Windows PowerShell 5.1 resolves them. Exercise
+    # the real action through pwsh so the defect cannot return unnoticed.
+    $pwsh = (Get-Command pwsh.exe -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1)
+    if ($null -eq $pwsh) { return }
+    $buildPath = Join-Path $repositoryRoot 'build\build.ps1'
+    $probe = @'
+$ErrorActionPreference = 'Stop'
+$build = $env:CCOD_BUILD_PROBE_PATH
+. $build -Library
+$root = $env:CCOD_BUILD_PROBE_ROOT
+$result = Invoke-CcodBuildTemporarySetupScope -BuildRoot $root -InstallerPayloadDirectory (Join-Path $root 'payload-stage') -DestinationInventoryPath (Join-Path $root 'inventory.iss') -Action ({ ,([string](Get-Command Copy-CcodBuildPayloadFile -ErrorAction SilentlyContinue).Name) })
+if ([string]::IsNullOrWhiteSpace([string]$result)) { [Console]::Error.WriteLine('CCOD_BUILD_ACTION_UNRESOLVED'); exit 41 }
+[Console]::WriteLine('CCOD_BUILD_ACTION_OK=' + $result)
+'@
+    $probeRoot = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-action-probe-' + [guid]::NewGuid().ToString('N'))
+    $probePath = Join-Path $probeRoot 'action-probe.ps1'
+    try {
+        [IO.Directory]::CreateDirectory($probeRoot) | Out-Null
+        [IO.File]::WriteAllText($probePath,$probe,[Text.UTF8Encoding]::new($false))
+        $start = [Diagnostics.ProcessStartInfo]::new()
+        $start.FileName = $pwsh.Source
+        $start.Arguments = '-NoLogo -NoProfile -NonInteractive -File "' + $probePath + '"'
+        $start.UseShellExecute = $false
+        $start.CreateNoWindow = $true
+        $start.RedirectStandardOutput = $true
+        $start.RedirectStandardError = $true
+        $start.StandardOutputEncoding = [Text.UTF8Encoding]::new($false)
+        $start.StandardErrorEncoding = [Text.UTF8Encoding]::new($false)
+        $start.EnvironmentVariables['CCOD_BUILD_PROBE_PATH'] = $buildPath
+        $start.EnvironmentVariables['CCOD_BUILD_PROBE_ROOT'] = $probeRoot
+        $child = [Diagnostics.Process]::Start($start)
+        try {
+            $stdout = $child.StandardOutput.ReadToEndAsync()
+            $stderr = $child.StandardError.ReadToEndAsync()
+            if (-not $child.WaitForExit(120000)) { throw 'pwsh action probe did not complete' }
+            Assert-CcodEqual 0 $child.ExitCode ('pwsh action probe failed: ' + $stderr.Result.Replace("`r",' ').Replace("`n",' | '))
+            Assert-CcodTrue ($stdout.Result -match 'CCOD_BUILD_ACTION_OK=Copy-CcodBuildPayloadFile') 'pwsh resolves a script-local build function from the temporary setup action'
+        } finally {
+            if (-not $child.HasExited) { $child.Kill(); $child.WaitForExit() }
+            $child.Dispose()
+        }
+    } finally {
+        if ([IO.File]::Exists($probePath)) { [IO.File]::Delete($probePath) }
+        if ([IO.Directory]::Exists($probeRoot)) { Remove-CcodTestOwnedTree -Path $probeRoot }
+    }
+}
+
 Invoke-CcodTest 'release notes extraction emits only the target release English section' {
     $root = Join-Path ([IO.Path]::GetTempPath()) ('ccod-release-notes-fixture-' + [guid]::NewGuid().ToString('N'))
     try {

From 0418d6004382455db13fd3e2059be1f580e003e4 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sat, 19 Sep 2026 19:21:55 +0800
Subject: [PATCH 181/187] diag: probe portable launcher provenance

---
 .github/workflows/diag-pl.yml      | 31 ++++++++++++++++++++++++++
 tests/persistence/tmp-pl-probe.ps1 | 35 ++++++++++++++++++++++++++++++
 2 files changed, 66 insertions(+)
 create mode 100644 .github/workflows/diag-pl.yml
 create mode 100644 tests/persistence/tmp-pl-probe.ps1

diff --git a/.github/workflows/diag-pl.yml b/.github/workflows/diag-pl.yml
new file mode 100644
index 0000000..7464638
--- /dev/null
+++ b/.github/workflows/diag-pl.yml
@@ -0,0 +1,31 @@
+name: DIAG portable launcher provenance
+
+on:
+  push:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  probe:
+    name: Portable launcher probe
+    runs-on: windows-latest
+    timeout-minutes: 30
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Probe under PowerShell 7
+        if: always()
+        shell: pwsh
+        run: |
+          pwsh -NoProfile -File ./tests/persistence/tmp-pl-probe.ps1
+          exit 0
+
+      - name: Probe under Windows PowerShell 5.1
+        if: always()
+        shell: pwsh
+        run: |
+          powershell.exe -NoProfile -ExecutionPolicy Bypass -File ./tests/persistence/tmp-pl-probe.ps1
+          exit 0
diff --git a/tests/persistence/tmp-pl-probe.ps1 b/tests/persistence/tmp-pl-probe.ps1
new file mode 100644
index 0000000..e854723
--- /dev/null
+++ b/tests/persistence/tmp-pl-probe.ps1
@@ -0,0 +1,35 @@
+$ErrorActionPreference='Continue'
+$repo = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+Set-Location $repo
+Write-Output ("PS=" + $PSVersionTable.PSVersion + ' ' + $PSVersionTable.PSEdition)
+Import-Module (Join-Path $repo 'build\TrayHostBuild.psm1') -Force
+$version = ([string]((Get-Content (Join-Path $repo 'package.json') -Raw | ConvertFrom-Json).version)).Trim()
+$commit = ([string](& git -C $repo rev-parse HEAD)).Trim().ToLowerInvariant()
+$stamp = [DateTime]::UtcNow.ToString('o',[Globalization.CultureInfo]::InvariantCulture)
+$out = Join-Path $env:TEMP ('ccod-pl-probe-' + [guid]::NewGuid().ToString('N'))
+try {
+    $r = Invoke-CcodPortableLauncherBuild -RepositoryRoot $repo -Version $version -OutputDirectory $out -GitCommit $commit -BuildTimestampUtc $stamp
+    Write-Output ('PL_BUILD_OK=' + [string]$r.Sha256)
+} catch {
+    Write-Output ('PL_BUILD_FAIL=' + $_.Exception.Message)
+    Write-Output ('PL_BUILD_STACK=' + ([string]$_.ScriptStackTrace).Replace("`r",' ').Replace("`n",' | '))
+}
+$p = Join-Path $out 'portable-launcher-provenance.json'
+if (Test-Path -LiteralPath $p) {
+    $raw = Get-Content -LiteralPath $p -Raw
+    Write-Output ('PROV_RAW=' + $raw.Replace("`r",' ').Replace("`n",' '))
+    $obj = $raw | ConvertFrom-Json
+    Write-Output ('PROV_COMPILER_NAME=[' + [string]$obj.compiler.name + '] TYPE=' + $obj.compiler.name.GetType().FullName)
+    Write-Output ('PROV_COMPILER_SHA=[' + [string]$obj.compiler.sha256 + '] LEN=' + ([string]$obj.compiler.sha256).Length + ' TYPE=' + $obj.compiler.sha256.GetType().FullName)
+    Write-Output ('PROV_COMMIT=[' + [string]$obj.gitCommit + '] ISSTR=' + ($obj.gitCommit -is [string]))
+    Write-Output ('PROV_TS=[' + [string]$obj.buildTimestampUtc + '] ISSTR=' + ($obj.buildTimestampUtc -is [string]))
+} else { Write-Output 'PROV_MISSING' }
+try {
+    Test-CcodPortableLauncherArtifact -RepositoryRoot $repo -Version $version -ArtifactDirectory $out -ExpectedGitCommit $commit | Out-Null
+    Write-Output 'PL_TEST_OK'
+} catch {
+    Write-Output ('PL_TEST_FAIL=' + $_.Exception.Message)
+    Write-Output ('PL_TEST_STACK=' + ([string]$_.ScriptStackTrace).Replace("`r",' ').Replace("`n",' | '))
+}
+if (Test-Path -LiteralPath $out) { Remove-Item -LiteralPath $out -Recurse -Force -ErrorAction SilentlyContinue }
+Write-Output 'PROBE_DONE'

From f533ac3974ff11debd1525aa14ca62fb96982e85 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sat, 19 Sep 2026 19:24:29 +0800
Subject: [PATCH 182/187] fix: keep json provenance timestamps as text under
 powershell 7

---
 build/SetupArtifact.psm1        | 23 ++++++++++++++++++-----
 build/TrayHostBuild.psm1        | 17 +++++++++++++++--
 tools/ReleaseAssetContract.psm1 | 19 ++++++++++++++++---
 3 files changed, 49 insertions(+), 10 deletions(-)

diff --git a/build/SetupArtifact.psm1 b/build/SetupArtifact.psm1
index 629ec6f..1668383 100644
--- a/build/SetupArtifact.psm1
+++ b/build/SetupArtifact.psm1
@@ -1,6 +1,19 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
+# PowerShell 7.5+ materializes ISO-8601 JSON strings as [datetime]. These modules
+# validate provenance timestamps as canonical UTC text, so read every JSON document
+# with -DateKind String when the shell offers it and keep the Windows PowerShell 5.1
+# behavior (dates stay text) identical across both shells.
+$script:CcodSetupArtifactJsonKeepsDateText = @((Get-Command ConvertFrom-Json).Parameters.Keys) -contains 'DateKind'
+
+function ConvertFrom-CcodSetupArtifactJson {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][AllowEmptyString()][string]$Json)
+    if ($script:CcodSetupArtifactJsonKeepsDateText) { return $Json | ConvertFrom-Json -DateKind String -ErrorAction Stop }
+    return $Json | ConvertFrom-Json -ErrorAction Stop
+}
+
 function Throw-CcodSetupArtifactError {
     param([Parameter(Mandatory)][string]$Id,[Parameter(Mandatory)][string]$Message,$Target)
     throw [Management.Automation.ErrorRecord]::new(
@@ -307,11 +320,11 @@ function Test-CcodSetupBuildProvenance {
     $inventory = Assert-CcodSetupRegularFile -Path $DestinationInventoryPath -Kind 'Destination inventory'
     $compiler = Assert-CcodSetupRegularFile -Path $CompilerPath -Kind 'Inno compiler'
     $payload = Assert-CcodSetupRegularFile -Path $PayloadManifestPath -Kind 'Installer payload manifest'
-    try { $payloadRaw = [IO.File]::ReadAllText($payload,[Text.UTF8Encoding]::new($false)); $payloadRecord = $payloadRaw | ConvertFrom-Json -ErrorAction Stop }
+    try { $payloadRaw = [IO.File]::ReadAllText($payload,[Text.UTF8Encoding]::new($false)); $payloadRecord = ConvertFrom-CcodSetupArtifactJson -Json $payloadRaw }
     catch { Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Canonical installer payload manifest is invalid' $payload }
     $actualPayloadHash = Get-CcodSetupArtifactHash -Path $payload
     $actualCompilerVersion = ([string][Diagnostics.FileVersionInfo]::GetVersionInfo($compiler).FileVersion).Trim()
-    try { $raw = [IO.File]::ReadAllText($path,[Text.UTF8Encoding]::new($false)); $record = $raw | ConvertFrom-Json -ErrorAction Stop }
+    try { $raw = [IO.File]::ReadAllText($path,[Text.UTF8Encoding]::new($false)); $record = ConvertFrom-CcodSetupArtifactJson -Json $raw }
     catch { Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Setup provenance is invalid JSON' $path }
     $timestampMatches = [regex]::Matches($raw,'"buildTimestampUtc"\s*:\s*"(?<value>[^"\\]+)"')
     $timestampText = if ($timestampMatches.Count -eq 1) { [string]$timestampMatches[0].Groups['value'].Value } else { $null }
@@ -356,7 +369,7 @@ function New-CcodSealedSetupBuildProvenance {
     )
     if (-not (Test-CcodSetupCanonicalUtc $BuildTimestampUtc)) { Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Sealed Setup provenance timestamp is invalid' $BuildTimestampUtc }
     $package=Assert-CcodSetupRegularFile $PackagePath 'Installer package';$manifest=Assert-CcodSetupRegularFile $PackageManifestPath 'Installer package manifest';$bootstrap=Assert-CcodSetupRegularFile $ActivationBootstrapPath 'Activation bootstrap';$template=Assert-CcodSetupRegularFile $InnoTemplatePath 'Inno template';$inventory=Assert-CcodSetupRegularFile $DestinationInventoryPath 'Destination inventory';$compiler=Assert-CcodSetupRegularFile $CompilerPath 'Inno compiler'
-    try{$manifestRecord=[IO.File]::ReadAllText($manifest,[Text.UTF8Encoding]::new($false))|ConvertFrom-Json -ErrorAction Stop}catch{Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Installer package manifest JSON is invalid' $manifest}
+    try{$manifestRecord=ConvertFrom-CcodSetupArtifactJson -Json ([IO.File]::ReadAllText($manifest,[Text.UTF8Encoding]::new($false)))}catch{Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Installer package manifest JSON is invalid' $manifest}
     if($manifestRecord.schemaVersion-isnot[int]-or$manifestRecord.schemaVersion-ne 1-or$manifestRecord.product-cne'CodexRemote-fix'-or$manifestRecord.version-cne$Version-or$manifestRecord.gitCommit-cne$GitCommit-or@($manifestRecord.files).Count-eq0){Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Installer package manifest identity is invalid' $manifest}
     $packageHash=Get-CcodSetupArtifactHash $package;$manifestHash=Get-CcodSetupArtifactHash $manifest;$bootstrapHash=Get-CcodSetupArtifactHash $bootstrap;$compilerInfo=[Diagnostics.FileVersionInfo]::GetVersionInfo($compiler)
     $record=[ordered]@{
@@ -388,10 +401,10 @@ function Test-CcodSealedSetupBuildProvenance {
     try {
         $raw=[IO.File]::ReadAllText($path,[Text.UTF8Encoding]::new($false))
         Assert-CcodSetupUniqueJsonMembers -Json $raw -Target $path
-        $record=$raw|ConvertFrom-Json -ErrorAction Stop
+        $record=ConvertFrom-CcodSetupArtifactJson -Json $raw
         $manifestRaw=[IO.File]::ReadAllText($manifest,[Text.UTF8Encoding]::new($false))
         Assert-CcodSetupUniqueJsonMembers -Json $manifestRaw -Target $manifest
-        $packageManifest=$manifestRaw|ConvertFrom-Json -ErrorAction Stop
+        $packageManifest=ConvertFrom-CcodSetupArtifactJson -Json $manifestRaw
     } catch { Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Sealed Setup provenance or package manifest JSON is invalid' $path }
 
     function Test-CcodExactObjectProperties {
diff --git a/build/TrayHostBuild.psm1 b/build/TrayHostBuild.psm1
index f767edf..b46022d 100644
--- a/build/TrayHostBuild.psm1
+++ b/build/TrayHostBuild.psm1
@@ -1,6 +1,19 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference='Stop'
 
+# PowerShell 7.5+ materializes ISO-8601 JSON strings as [datetime]. These modules
+# validate provenance timestamps as canonical UTC text, so read every JSON document
+# with -DateKind String when the shell offers it and keep the Windows PowerShell 5.1
+# behavior (dates stay text) identical across both shells.
+$script:CcodTrayHostJsonKeepsDateText = @((Get-Command ConvertFrom-Json).Parameters.Keys) -contains 'DateKind'
+
+function ConvertFrom-CcodTrayHostJson {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][AllowEmptyString()][string]$Json)
+    if ($script:CcodTrayHostJsonKeepsDateText) { return $Json | ConvertFrom-Json -DateKind String -ErrorAction Stop }
+    return $Json | ConvertFrom-Json -ErrorAction Stop
+}
+
 function Get-CcodTrayHostHash {
     param([Parameter(Mandatory)][string]$Path)
     $sha=[Security.Cryptography.SHA256]::Create()
@@ -137,7 +150,7 @@ function Test-CcodTrayHostArtifact {
     $versionContract=Assert-CcodNativeVersionContract -RepositoryRoot $repo -Version $Version -Component trayhost
     $exe=Join-Path $out 'CodexRemote.TrayHost.exe';$config=Join-Path $out 'CodexRemote.TrayHost.exe.config';$provenancePath=Join-Path $out 'trayhost-build-provenance.json'
     foreach($path in @($exe,$config,$provenancePath)){if(-not(Test-Path -LiteralPath $path -PathType Leaf)){throw 'CCOD_TRAYHOST_ARTIFACT_MISSING'}}
-    $provenance=Get-Content -LiteralPath $provenancePath -Raw|ConvertFrom-Json
+    $provenance=ConvertFrom-CcodTrayHostJson -Json (Get-Content -LiteralPath $provenancePath -Raw)
     $commit=$provenance.PSObject.Properties['gitCommit'];$timestamp=$provenance.PSObject.Properties['buildTimestampUtc']
     if([int]$provenance.schemaVersion -ne 1 -or [string]$provenance.version -cne $Version -or [string]$provenance.targetFramework -cne 'net48' -or $null -eq $commit -or $null -eq $timestamp -or $commit.Value -isnot [string] -or $commit.Value -cnotmatch '^[0-9a-f]{40}$' -or $timestamp.Value -isnot [string] -or -not(Test-CcodTrayHostCanonicalUtc $timestamp.Value) -or (-not [string]::IsNullOrWhiteSpace($ExpectedGitCommit) -and $commit.Value -cne $ExpectedGitCommit)){throw 'CCOD_TRAYHOST_PROVENANCE_INVALID'}
     $icon=Join-Path $repo 'assets\codexremote-fix\codexremote-fix.ico';$sourceConfig=Join-Path $versionContract.SourceRoot 'CodexRemote.TrayHost.exe.config'
@@ -218,7 +231,7 @@ function Test-CcodPortableLauncherArtifact {
     $versionContract=Assert-CcodNativeVersionContract -RepositoryRoot $repo -Version $Version -Component portable
     $exe=Join-Path $out 'CodexRemote.Portable.exe';$config=Join-Path $out 'CodexRemote.Portable.exe.config';$provenancePath=Join-Path $out 'portable-launcher-provenance.json'
     foreach($path in @($exe,$config,$provenancePath)){if(-not(Test-Path -LiteralPath $path -PathType Leaf)){throw 'CCOD_PORTABLE_LAUNCHER_ARTIFACT_MISSING'}}
-    try{$provenance=Get-Content -LiteralPath $provenancePath -Raw|ConvertFrom-Json}catch{throw 'CCOD_PORTABLE_LAUNCHER_PROVENANCE_INVALID'}
+    try{$provenance=ConvertFrom-CcodTrayHostJson -Json (Get-Content -LiteralPath $provenancePath -Raw)}catch{throw 'CCOD_PORTABLE_LAUNCHER_PROVENANCE_INVALID'}
     $commit=$provenance.PSObject.Properties['gitCommit'];$timestamp=$provenance.PSObject.Properties['buildTimestampUtc'];$compiler=$provenance.PSObject.Properties['compiler']
     if([int]$provenance.schemaVersion -ne 1 -or [string]$provenance.product -cne 'CodexRemote-fix' -or
         [string]$provenance.version -cne $Version -or [string]$provenance.targetFramework -cne 'net48' -or
diff --git a/tools/ReleaseAssetContract.psm1 b/tools/ReleaseAssetContract.psm1
index 9a47864..c040f91 100644
--- a/tools/ReleaseAssetContract.psm1
+++ b/tools/ReleaseAssetContract.psm1
@@ -1,6 +1,19 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
+# PowerShell 7.5+ materializes ISO-8601 JSON strings as [datetime]. These modules
+# validate provenance timestamps as canonical UTC text, so read every JSON document
+# with -DateKind String when the shell offers it and keep the Windows PowerShell 5.1
+# behavior (dates stay text) identical across both shells.
+$script:CcodReleaseContractJsonKeepsDateText = @((Get-Command ConvertFrom-Json).Parameters.Keys) -contains 'DateKind'
+
+function ConvertFrom-CcodReleaseContractJson {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][AllowEmptyString()][string]$Json)
+    if ($script:CcodReleaseContractJsonKeepsDateText) { return $Json | ConvertFrom-Json -DateKind String -ErrorAction Stop }
+    return $Json | ConvertFrom-Json -ErrorAction Stop
+}
+
 # BEGIN CCOD TRUSTED IMPORT BOOTSTRAP
 # Embedded in each independently trusted entrypoint; an unheld helper import
 # cannot bootstrap its own protection. Keep copies identical (self-test enforced).
@@ -532,7 +545,7 @@ function Read-CcodReleaseContractJsonStringToken {
         if ($character -eq [char]34) {
             $end = $index + 1
             $raw = $Json.Substring($Offset,$end-$Offset)
-            $decoded = $raw | ConvertFrom-Json -ErrorAction Stop
+            $decoded = ConvertFrom-CcodReleaseContractJson -Json $raw
             if ($decoded -isnot [string]) { throw 'json string type' }
             return [pscustomobject]@{Value=$decoded;End=$end}
         }
@@ -610,7 +623,7 @@ function Read-CcodReleaseContractJson {
         if ($item.Length -le 0 -or $item.Length -gt $MaximumBytes) { throw 'length' }
         $raw = [IO.File]::ReadAllText($Path,[Text.UTF8Encoding]::new($false,$true))
         Assert-CcodReleaseContractJsonLexicalShape -Json $raw
-        $value = $raw | ConvertFrom-Json -ErrorAction Stop
+        $value = ConvertFrom-CcodReleaseContractJson -Json $raw
         if ($null -eq $value -or $value -isnot [pscustomobject]) { throw 'shape' }
         return [pscustomobject]@{ Raw=$raw; Value=$value }
     } catch {
@@ -621,7 +634,7 @@ function Read-CcodReleaseContractJson {
 function Read-CcodReleaseContractPinnedJson {
     param([Parameter(Mandatory)]$Authority,[Parameter(Mandatory)][string]$ErrorId,[int64]$MaximumBytes=4194304)
     try{
-        Assert-CcodReleaseAuthorityCurrent $Authority $ErrorId -CheckBytes|Out-Null;$bytes=Get-CcodReleaseAuthorityStreamBytes $Authority.Stream $MaximumBytes;$raw=[Text.UTF8Encoding]::new($false,$true).GetString($bytes);Assert-CcodReleaseContractJsonLexicalShape $raw;$value=$raw|ConvertFrom-Json -ErrorAction Stop;if($value-isnot[pscustomobject]){throw 'json shape'};Assert-CcodReleaseAuthorityCurrent $Authority $ErrorId -CheckBytes|Out-Null;return [pscustomobject]@{Raw=$raw;Value=$value;Bytes=$bytes}
+        Assert-CcodReleaseAuthorityCurrent $Authority $ErrorId -CheckBytes|Out-Null;$bytes=Get-CcodReleaseAuthorityStreamBytes $Authority.Stream $MaximumBytes;$raw=[Text.UTF8Encoding]::new($false,$true).GetString($bytes);Assert-CcodReleaseContractJsonLexicalShape $raw;$value=ConvertFrom-CcodReleaseContractJson -Json $raw;if($value-isnot[pscustomobject]){throw 'json shape'};Assert-CcodReleaseAuthorityCurrent $Authority $ErrorId -CheckBytes|Out-Null;return [pscustomobject]@{Raw=$raw;Value=$value;Bytes=$bytes}
     }catch{Throw-CcodReleaseContractError $ErrorId 'Pinned release JSON is malformed, changed, or outside its bound.' $Authority.Path}
 }
 

From 53eb732235be7c1f959fa016f32bd214f314cb94 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sat, 19 Sep 2026 19:26:50 +0800
Subject: [PATCH 183/187] fix: accept json integer shapes that powershell 7
 produces

---
 build/InstallerPackage.psm1                    | 11 +++++++++--
 build/SetupArtifact.psm1                       | 12 ++++++------
 tests/persistence/ReleaseWorkflow.SelfTest.ps1 |  2 +-
 3 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/build/InstallerPackage.psm1 b/build/InstallerPackage.psm1
index 55fd5ae..0c773e0 100644
--- a/build/InstallerPackage.psm1
+++ b/build/InstallerPackage.psm1
@@ -82,13 +82,20 @@ function Assert-CcodInstallerPackageRegularFile {
     return $full
 }
 
+function Test-CcodInstallerPackageJsonInteger {
+    # ConvertFrom-Json yields [long] for JSON integers under PowerShell 7 and [int]
+    # under Windows PowerShell 5.1, so accept both shapes at one exact value.
+    param($Value,[long]$Expected=0)
+    return ($Value-is[int]-or$Value-is[long])-and[decimal]$Value-eq[decimal][long]$Value-and[long]$Value-eq$Expected
+}
+
 function Read-CcodInstallerPayloadManifest {
     param([Parameter(Mandatory)][byte[]]$Bytes,[Parameter(Mandatory)][string]$ExpectedVersion)
     try { $text=[Text.UTF8Encoding]::new($false,$true).GetString($Bytes);$manifest=$text|ConvertFrom-Json -ErrorAction Stop }
     catch { Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Payload manifest JSON is invalid' $null }
     foreach($name in @('schemaVersion','projectVersion','files')){if((Get-CcodInstallerPackageTopLevelJsonPropertyCount $text $name)-ne 1){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Payload manifest contains duplicate or missing fields' $name}}
     if($manifest-isnot[pscustomobject]-or(@($manifest.PSObject.Properties.Name)-join',')-cne'schemaVersion,projectVersion,files'-or
-       $manifest.schemaVersion-isnot[int]-or$manifest.schemaVersion-ne 1-or$manifest.projectVersion-isnot[string]-or$manifest.projectVersion-cne$ExpectedVersion){
+       -not(Test-CcodInstallerPackageJsonInteger $manifest.schemaVersion 1)-or$manifest.projectVersion-isnot[string]-or$manifest.projectVersion-cne$ExpectedVersion){
         Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Payload manifest metadata is invalid' $null
     }
     $records=@($manifest.files);if($records.Count-eq 0){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Payload manifest is empty' $null}
@@ -111,7 +118,7 @@ function Read-CcodInstallerPackageManifest {
     try{$text=[Text.UTF8Encoding]::new($false,$true).GetString($Bytes);$manifest=$text|ConvertFrom-Json -ErrorAction Stop}catch{Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Installer package manifest JSON is invalid' $null}
     foreach($name in @('schemaVersion','product','version','gitCommit','payloadManifest','files')){if((Get-CcodInstallerPackageTopLevelJsonPropertyCount $text $name)-ne 1){Throw-CcodInstallerPackageError 'CCOD_INSTALLER_PACKAGE_INVALID' 'Installer package manifest contains duplicate or missing fields' $name}}
     if($manifest-isnot[pscustomobject]-or(@($manifest.PSObject.Properties.Name)-join',')-cne'schemaVersion,product,version,gitCommit,payloadManifest,files'-or
-       $manifest.schemaVersion-isnot[int]-or$manifest.schemaVersion-ne 1-or$manifest.product-isnot[string]-or$manifest.product-cne'CodexRemote-fix'-or
+       -not(Test-CcodInstallerPackageJsonInteger $manifest.schemaVersion 1)-or$manifest.product-isnot[string]-or$manifest.product-cne'CodexRemote-fix'-or
        $manifest.version-isnot[string]-or$manifest.version-cne$ExpectedVersion-or$manifest.gitCommit-isnot[string]-or$manifest.gitCommit-cne$ExpectedGitCommit-or
        $manifest.payloadManifest-isnot[pscustomobject]-or(@($manifest.payloadManifest.PSObject.Properties.Name)-join',')-cne'name,length,sha256'-or
        $manifest.payloadManifest.name-isnot[string]-or$manifest.payloadManifest.name-cne'installer-payload.manifest.json'-or
diff --git a/build/SetupArtifact.psm1 b/build/SetupArtifact.psm1
index 1668383..b05506a 100644
--- a/build/SetupArtifact.psm1
+++ b/build/SetupArtifact.psm1
@@ -264,7 +264,7 @@ function New-CcodSetupBuildProvenance {
     $compiler = Assert-CcodSetupRegularFile -Path $CompilerPath -Kind 'Inno compiler'
     try { $payloadRecord = [IO.File]::ReadAllText($payload,[Text.UTF8Encoding]::new($false)) | ConvertFrom-Json -ErrorAction Stop }
     catch { Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Installer payload manifest is invalid JSON' $payload }
-    if ($payloadRecord.schemaVersion -isnot [int] -or $payloadRecord.schemaVersion -ne 1 -or
+    if (-not (Test-CcodSetupArtifactJsonInteger $payloadRecord.schemaVersion 1) -or
         $payloadRecord.projectVersion -isnot [string] -or $payloadRecord.projectVersion -cne $Version -or
         @($payloadRecord.files).Count -eq 0) { Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Installer payload manifest metadata is invalid' $payload }
     $payloadHash = Get-CcodSetupArtifactHash -Path $payload
@@ -330,7 +330,7 @@ function Test-CcodSetupBuildProvenance {
     $timestampText = if ($timestampMatches.Count -eq 1) { [string]$timestampMatches[0].Groups['value'].Value } else { $null }
     $fields = @('schemaVersion','product','version','gitCommit','buildTimestampUtc','payloadManifest','buildInputs','peContract')
     if ($record -isnot [pscustomobject] -or ((@($record.PSObject.Properties.Name | Sort-Object) -join '|') -cne (@($fields | Sort-Object) -join '|')) -or
-        ($record.schemaVersion -isnot [int] -and $record.schemaVersion -isnot [long]) -or [int64]$record.schemaVersion -ne 1 -or $record.product -isnot [string] -or $record.product -cne 'CodexRemote-fix' -or
+        -not (Test-CcodSetupArtifactJsonInteger $record.schemaVersion 1) -or $record.product -isnot [string] -or $record.product -cne 'CodexRemote-fix' -or
         $record.version -isnot [string] -or $record.version -cne $ExpectedVersion -or $record.gitCommit -isnot [string] -or $record.gitCommit -cne $ExpectedGitCommit -or
         -not (Test-CcodSetupCanonicalUtc $timestampText) -or
         (-not [string]::IsNullOrWhiteSpace($ExpectedBuildTimestampUtc) -and $timestampText -cne $ExpectedBuildTimestampUtc) -or
@@ -370,7 +370,7 @@ function New-CcodSealedSetupBuildProvenance {
     if (-not (Test-CcodSetupCanonicalUtc $BuildTimestampUtc)) { Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Sealed Setup provenance timestamp is invalid' $BuildTimestampUtc }
     $package=Assert-CcodSetupRegularFile $PackagePath 'Installer package';$manifest=Assert-CcodSetupRegularFile $PackageManifestPath 'Installer package manifest';$bootstrap=Assert-CcodSetupRegularFile $ActivationBootstrapPath 'Activation bootstrap';$template=Assert-CcodSetupRegularFile $InnoTemplatePath 'Inno template';$inventory=Assert-CcodSetupRegularFile $DestinationInventoryPath 'Destination inventory';$compiler=Assert-CcodSetupRegularFile $CompilerPath 'Inno compiler'
     try{$manifestRecord=ConvertFrom-CcodSetupArtifactJson -Json ([IO.File]::ReadAllText($manifest,[Text.UTF8Encoding]::new($false)))}catch{Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Installer package manifest JSON is invalid' $manifest}
-    if($manifestRecord.schemaVersion-isnot[int]-or$manifestRecord.schemaVersion-ne 1-or$manifestRecord.product-cne'CodexRemote-fix'-or$manifestRecord.version-cne$Version-or$manifestRecord.gitCommit-cne$GitCommit-or@($manifestRecord.files).Count-eq0){Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Installer package manifest identity is invalid' $manifest}
+    if(-not(Test-CcodSetupArtifactJsonInteger $manifestRecord.schemaVersion 1)-or$manifestRecord.product-cne'CodexRemote-fix'-or$manifestRecord.version-cne$Version-or$manifestRecord.gitCommit-cne$GitCommit-or@($manifestRecord.files).Count-eq0){Throw-CcodSetupArtifactError 'CCOD_SETUP_PROVENANCE_INVALID' 'Installer package manifest identity is invalid' $manifest}
     $packageHash=Get-CcodSetupArtifactHash $package;$manifestHash=Get-CcodSetupArtifactHash $manifest;$bootstrapHash=Get-CcodSetupArtifactHash $bootstrap;$compilerInfo=[Diagnostics.FileVersionInfo]::GetVersionInfo($compiler)
     $record=[ordered]@{
         schemaVersion=2;product='CodexRemote-fix';version=$Version;gitCommit=$GitCommit;buildTimestampUtc=$BuildTimestampUtc
@@ -441,13 +441,13 @@ function Test-CcodSealedSetupBuildProvenance {
     $packageLength=[long](Get-Item $package -Force).Length
     $manifestLength=[long](Get-Item $manifest -Force).Length
     $bootstrapLength=[long](Get-Item $bootstrap -Force).Length
-    if($record.schemaVersion-isnot[int]-or$record.schemaVersion-ne 2-or
+    if(-not(Test-CcodSetupArtifactJsonInteger $record.schemaVersion 2)-or
        -not(Test-CcodExactString $record.product 'CodexRemote-fix')-or
        -not(Test-CcodExactString $record.version $ExpectedVersion)-or
        -not(Test-CcodExactString $record.gitCommit $ExpectedGitCommit)-or
        -not(Test-CcodExactString $record.buildTimestampUtc $ExpectedBuildTimestampUtc)-or
        -not(Test-CcodSetupCanonicalUtc $record.buildTimestampUtc)-or
-       $packageManifest.schemaVersion-isnot[int]-or$packageManifest.schemaVersion-ne 1-or
+       -not(Test-CcodSetupArtifactJsonInteger $packageManifest.schemaVersion 1)-or
        -not(Test-CcodExactString $packageManifest.product 'CodexRemote-fix')-or
        -not(Test-CcodExactString $packageManifest.version $ExpectedVersion)-or
        -not(Test-CcodExactString $packageManifest.gitCommit $ExpectedGitCommit)-or
@@ -460,7 +460,7 @@ function Test-CcodSealedSetupBuildProvenance {
        -not(Test-CcodExactString $record.installerPackageManifest.name 'installer-package.manifest.json')-or
        -not(Test-CcodJsonInteger $record.installerPackageManifest.length)-or[long]$record.installerPackageManifest.length-ne$manifestLength-or
        -not(Test-CcodExactString $record.installerPackageManifest.sha256 $ExpectedPackageManifestSha256)-or$record.installerPackageManifest.sha256-cne(Get-CcodSetupArtifactHash $manifest)-or
-       $record.installerPackageManifest.fileCount-isnot[int]-or$record.installerPackageManifest.fileCount-ne@($packageManifest.files).Count-or
+       -not(Test-CcodSetupArtifactJsonInteger $record.installerPackageManifest.fileCount @($packageManifest.files).Count)-or
        -not(Test-CcodExactString $record.installerPackageManifest.payloadManifestSha256 ([string]$packageManifest.payloadManifest.sha256))-or
        $packageManifest.payloadManifest.sha256-isnot[string]-or$packageManifest.payloadManifest.sha256-cnotmatch'^[0-9a-f]{64}$'-or
        -not(Test-CcodExactString $record.activationBootstrap.name 'Activate-CcodRemoteFix.ps1')-or
diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index 12e64ca..c38b1fb 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -3399,7 +3399,7 @@ Invoke-CcodTest 'package scripts build provenance and workflows retain the relea
 $iss = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\CodexControlOtherDevices.iss') -Raw
 $buildSource = Get-Content -LiteralPath (Join-Path $repositoryRoot 'build\build.ps1') -Raw
 Assert-CcodTrue ($buildSource -match 'CodexRemote\.Portable\.exe' -and $buildSource -match 'Copy-CcodBuildPayloadFile' -and $buildSource -match 'New-CcodInstallerPackage') 'build places the portable launcher only in the manifest-listed sealed package'
-Assert-CcodTrue ($buildSource -cnotmatch 'GetNewClosure') 'the temporary Setup action stays a plain scriptblock so script-local functions stay resolvable'
+Assert-CcodTrue ($buildSource -cnotmatch '\.GetNewClosure\(\)') 'the temporary Setup action stays a plain scriptblock so script-local functions stay resolvable'
 Assert-CcodTrue ($iss -cnotmatch 'CodexRemote\.Portable\.exe|PortableArtifactDirectory') 'Inno never copies a product launcher outside the sealed package transaction'
 Invoke-CcodTest 'temporary setup scope resolves script-local functions under PowerShell 7' {
     # The release workflow runs build/build.ps1 from pwsh. PowerShell 7 gives a

From b42b44de3981dfc65f071919a433b89feeb2c94b Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sat, 19 Sep 2026 19:30:37 +0800
Subject: [PATCH 184/187] fix: define the setup artifact integer helper at
 module scope

---
 build/SetupArtifact.psm1 | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/build/SetupArtifact.psm1 b/build/SetupArtifact.psm1
index b05506a..441091b 100644
--- a/build/SetupArtifact.psm1
+++ b/build/SetupArtifact.psm1
@@ -7,6 +7,13 @@ $ErrorActionPreference = 'Stop'
 # behavior (dates stay text) identical across both shells.
 $script:CcodSetupArtifactJsonKeepsDateText = @((Get-Command ConvertFrom-Json).Parameters.Keys) -contains 'DateKind'
 
+function Test-CcodSetupArtifactJsonInteger {
+    # ConvertFrom-Json yields [long] for JSON integers under PowerShell 7 and [int]
+    # under Windows PowerShell 5.1, so accept both shapes at one exact value.
+    param($Value,[long]$Expected=0)
+    return ($Value-is[int]-or$Value-is[long])-and[decimal]$Value-eq[decimal][long]$Value-and[long]$Value-eq$Expected
+}
+
 function ConvertFrom-CcodSetupArtifactJson {
     [CmdletBinding()]
     param([Parameter(Mandatory)][AllowEmptyString()][string]$Json)

From a9c84b8860d849e8b541e474d0012918e47b7505 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sat, 19 Sep 2026 19:34:07 +0800
Subject: [PATCH 185/187] test: use compliant stage names in the build action
 probe

---
 tests/persistence/ReleaseWorkflow.SelfTest.ps1 | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tests/persistence/ReleaseWorkflow.SelfTest.ps1 b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
index c38b1fb..cc3afaf 100644
--- a/tests/persistence/ReleaseWorkflow.SelfTest.ps1
+++ b/tests/persistence/ReleaseWorkflow.SelfTest.ps1
@@ -3414,8 +3414,13 @@ $ErrorActionPreference = 'Stop'
 $build = $env:CCOD_BUILD_PROBE_PATH
 . $build -Library
 $root = $env:CCOD_BUILD_PROBE_ROOT
-$result = Invoke-CcodBuildTemporarySetupScope -BuildRoot $root -InstallerPayloadDirectory (Join-Path $root 'payload-stage') -DestinationInventoryPath (Join-Path $root 'inventory.iss') -Action ({ ,([string](Get-Command Copy-CcodBuildPayloadFile -ErrorAction SilentlyContinue).Name) })
+$id = [guid]::NewGuid().ToString('N')
+$payloadStage = Join-Path $root ('.installer-payload-stage-' + $id)
+$inventory = Join-Path $root ('.installer-destination-inventory-' + $id + '.iss')
+[IO.Directory]::CreateDirectory($payloadStage) | Out-Null
+$result = Invoke-CcodBuildTemporarySetupScope -BuildRoot $root -InstallerPayloadDirectory $payloadStage -DestinationInventoryPath $inventory -Action ({ ,([string](Get-Command Copy-CcodBuildPayloadFile -ErrorAction SilentlyContinue).Name) })
 if ([string]::IsNullOrWhiteSpace([string]$result)) { [Console]::Error.WriteLine('CCOD_BUILD_ACTION_UNRESOLVED'); exit 41 }
+if ([IO.Directory]::Exists($payloadStage)) { [Console]::Error.WriteLine('CCOD_BUILD_ACTION_LEAK'); exit 42 }
 [Console]::WriteLine('CCOD_BUILD_ACTION_OK=' + $result)
 '@
     $probeRoot = Join-Path (Get-CcodTestCanonicalTempRoot) ('ccod-action-probe-' + [guid]::NewGuid().ToString('N'))

From dccce2f8f02128bc30df48c2ad30a546c2364b34 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sat, 19 Sep 2026 19:40:43 +0800
Subject: [PATCH 186/187] chore: drop the temporary diagnostic workflows

---
 .github/workflows/diag-build-fix.yml     | 49 ------------------------
 .github/workflows/diag-build-probe.yml   | 31 ---------------
 .github/workflows/diag-pl.yml            | 31 ---------------
 .github/workflows/diag-release-build.yml | 38 ------------------
 .github/workflows/diag-scope.yml         | 45 ----------------------
 5 files changed, 194 deletions(-)
 delete mode 100644 .github/workflows/diag-build-fix.yml
 delete mode 100644 .github/workflows/diag-build-probe.yml
 delete mode 100644 .github/workflows/diag-pl.yml
 delete mode 100644 .github/workflows/diag-release-build.yml
 delete mode 100644 .github/workflows/diag-scope.yml

diff --git a/.github/workflows/diag-build-fix.yml b/.github/workflows/diag-build-fix.yml
deleted file mode 100644
index b2e9ec8..0000000
--- a/.github/workflows/diag-build-fix.yml
+++ /dev/null
@@ -1,49 +0,0 @@
-name: DIAG build fix
-
-on:
-  push:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  verify:
-    name: Build fix verification
-    runs-on: windows-latest
-    timeout-minutes: 90
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
-
-      - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
-        with:
-          node-version: 22
-
-      - name: CI-exact portable bundle build under pwsh
-        if: always()
-        shell: pwsh
-        env:
-          CCOD_RELEASE_TAG: v2.5.22
-        run: |
-          $sw = [Diagnostics.Stopwatch]::StartNew()
-          try {
-            $version = $env:CCOD_RELEASE_TAG.Substring(1)
-            ./build/build.ps1 -Version $version
-            Write-Output 'CI_EXACT_OK'
-          } catch {
-            Write-Output ("CI_EXACT_EXCEPTION=" + $_.Exception.GetType().FullName + ':' + $_.Exception.Message)
-            Write-Output ("CI_EXACT_STACK=" + ([string]$_.ScriptStackTrace).Replace("`r",' ').Replace("`n",' | '))
-          }
-          $sw.Stop()
-          Write-Output ("BUILD_SECONDS=" + [int]$sw.Elapsed.TotalSeconds)
-          if (Test-Path build/dist) { Get-ChildItem build/dist | Select-Object -Expand Name } else { Write-Output 'NO_DIST' }
-          exit 0
-
-      - name: Release contract suite
-        if: always()
-        shell: pwsh
-        run: |
-          npm run test:release-contract
-          exit 0
diff --git a/.github/workflows/diag-build-probe.yml b/.github/workflows/diag-build-probe.yml
deleted file mode 100644
index 634bf3f..0000000
--- a/.github/workflows/diag-build-probe.yml
+++ /dev/null
@@ -1,31 +0,0 @@
-name: DIAG build probe
-
-on:
-  push:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  probe:
-    name: Build probe
-    runs-on: windows-latest
-    timeout-minutes: 60
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
-
-      - name: Probe under PowerShell 7
-        if: always()
-        shell: pwsh
-        run: |
-          pwsh -NoProfile -File ./tests/persistence/tmp-build-probe.ps1
-          exit 0
-
-      - name: Probe under Windows PowerShell 5.1
-        if: always()
-        shell: pwsh
-        run: |
-          powershell.exe -NoProfile -ExecutionPolicy Bypass -File ./tests/persistence/tmp-build-probe.ps1
-          exit 0
diff --git a/.github/workflows/diag-pl.yml b/.github/workflows/diag-pl.yml
deleted file mode 100644
index 7464638..0000000
--- a/.github/workflows/diag-pl.yml
+++ /dev/null
@@ -1,31 +0,0 @@
-name: DIAG portable launcher provenance
-
-on:
-  push:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  probe:
-    name: Portable launcher probe
-    runs-on: windows-latest
-    timeout-minutes: 30
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
-
-      - name: Probe under PowerShell 7
-        if: always()
-        shell: pwsh
-        run: |
-          pwsh -NoProfile -File ./tests/persistence/tmp-pl-probe.ps1
-          exit 0
-
-      - name: Probe under Windows PowerShell 5.1
-        if: always()
-        shell: pwsh
-        run: |
-          powershell.exe -NoProfile -ExecutionPolicy Bypass -File ./tests/persistence/tmp-pl-probe.ps1
-          exit 0
diff --git a/.github/workflows/diag-release-build.yml b/.github/workflows/diag-release-build.yml
deleted file mode 100644
index 5c3776d..0000000
--- a/.github/workflows/diag-release-build.yml
+++ /dev/null
@@ -1,38 +0,0 @@
-name: DIAG release build gate
-
-on:
-  push:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    name: Release build gate
-    runs-on: windows-latest
-    timeout-minutes: 90
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
-
-      - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
-        with:
-          node-version: 22
-
-      - name: Build CodexRemote-fix portable bundle
-        shell: pwsh
-        env:
-          CCOD_RELEASE_TAG: v2.5.22
-        run: |
-          $version = $env:CCOD_RELEASE_TAG.Substring(1)
-          ./build/build.ps1 -Version $version
-
-      - name: Report bundle
-        if: always()
-        shell: pwsh
-        run: |
-          if (Test-Path build/dist) {
-            Get-ChildItem -Recurse build/dist | Select-Object FullName, Length | Format-Table -AutoSize | Out-String -Width 200
-          } else { Write-Output 'NO_DIST' }
diff --git a/.github/workflows/diag-scope.yml b/.github/workflows/diag-scope.yml
deleted file mode 100644
index f3f7de0..0000000
--- a/.github/workflows/diag-scope.yml
+++ /dev/null
@@ -1,45 +0,0 @@
-name: DIAG scope probe
-
-on:
-  push:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  probe:
-    name: Scope probe
-    runs-on: windows-latest
-    timeout-minutes: 20
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
-
-      - name: Relative path invocation (ci style)
-        if: always()
-        shell: pwsh
-        run: |
-          ./tests/persistence/tmp-scope-lib.ps1
-          exit 0
-
-      - name: Call operator with relative path
-        if: always()
-        shell: pwsh
-        run: |
-          & ./tests/persistence/tmp-scope-lib.ps1
-          exit 0
-
-      - name: Call operator with absolute path
-        if: always()
-        shell: pwsh
-        run: |
-          & (Join-Path $PWD 'tests/persistence/tmp-scope-lib.ps1')
-          exit 0
-
-      - name: Child pwsh file invocation
-        if: always()
-        shell: pwsh
-        run: |
-          pwsh -NoProfile -File ./tests/persistence/tmp-scope-lib.ps1
-          exit 0

From 0a7a37ca119c2834c89a01e0fb78f8bf42a82880 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sat, 19 Sep 2026 19:40:56 +0800
Subject: [PATCH 187/187] chore: drop the temporary build probes

---
 tests/persistence/tmp-build-probe.ps1 | 42 ---------------------------
 tests/persistence/tmp-pl-probe.ps1    | 35 ----------------------
 tests/persistence/tmp-scope-lib.ps1   | 12 --------
 3 files changed, 89 deletions(-)
 delete mode 100644 tests/persistence/tmp-build-probe.ps1
 delete mode 100644 tests/persistence/tmp-pl-probe.ps1
 delete mode 100644 tests/persistence/tmp-scope-lib.ps1

diff --git a/tests/persistence/tmp-build-probe.ps1 b/tests/persistence/tmp-build-probe.ps1
deleted file mode 100644
index 1a995e8..0000000
--- a/tests/persistence/tmp-build-probe.ps1
+++ /dev/null
@@ -1,42 +0,0 @@
-$ErrorActionPreference='Continue'
-Write-Output ("SHELL_VERSION=" + $PSVersionTable.PSVersion + " EDITION=" + $PSVersionTable.PSEdition)
-$repoRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
-$build = Join-Path $repoRoot 'build\build.ps1'
-Write-Output ("BUILD_PATH=" + $build + " EXISTS=" + [IO.File]::Exists($build))
-if (-not [IO.File]::Exists($build)) { Write-Output 'PROBE_ABORT'; exit 0 }
-
-# Minimal scoping pattern under this exact shell.
-function Copy-CcodBuildPayloadFile { param($Source) return ('COPIED:' + $Source) }
-function Invoke-CcodBuildTemporarySetupScope { param([scriptblock]$Action) & $Action }
-try { Write-Output ("PATTERN=" + (Invoke-CcodBuildTemporarySetupScope -Action ({ Copy-CcodBuildPayloadFile -Source 'package.json' }))) }
-catch { Write-Output ("PATTERN_FAILED=" + $_.Exception.Message) }
-
-$tokens=$null;$errors=$null
-$ast=[Management.Automation.Language.Parser]::ParseFile($build,[ref]$tokens,[ref]$errors)
-Write-Output ("PARSE_ERRORS=" + @($errors).Count)
-foreach ($e in @($errors)) { Write-Output ("PARSE_ERROR=" + $e.Message + " @line " + $e.Extent.StartLineNumber) }
-$allDefs=@($ast.FindAll({param($n) $n -is [Management.Automation.Language.FunctionDefinitionAst]},$true))
-Write-Output ("ALL_FUNCTION_DEFS=" + $allDefs.Count)
-Write-Output ("HAS_PAYLOAD_DEF=" + [bool](@($allDefs | Where-Object { $_.Name -ceq 'Copy-CcodBuildPayloadFile' }).Count))
-$calls = @($ast.FindAll({param($n) $n -is [Management.Automation.Language.CommandAst] -and $n.GetCommandName() -ceq 'Copy-CcodBuildPayloadFile'},$true))
-Write-Output ("CALL_SITES=" + $calls.Count)
-foreach ($c in @($calls | Select-Object -First 2)) {
-    $ancestor = $c.Parent
-    $chain = @()
-    while ($null -ne $ancestor -and $chain.Count -lt 6) {
-        if ($ancestor -is [Management.Automation.Language.FunctionDefinitionAst]) { $chain += ('FUNC:' + $ancestor.Name) }
-        elseif ($ancestor -is [Management.Automation.Language.ScriptBlockExpressionAst]) { $chain += 'SCRIPTBLOCK' }
-        elseif ($ancestor -is [Management.Automation.Language.ScriptBlockAst]) { $chain += 'SCRIPT' }
-        $ancestor = $ancestor.Parent
-    }
-    Write-Output ("CALL_LINE=" + $c.Extent.StartLineNumber + " CHAIN=" + ($chain -join ' > '))
-}
-
-$version = ([string]((Get-Content -LiteralPath (Join-Path $repoRoot 'package.json') -Raw | ConvertFrom-Json).version)).Trim()
-Write-Output ("ATTEMPT_VERSION=" + $version)
-try { & $build -Version $version; Write-Output 'BUILD_OK' } catch {
-    Write-Output ("BUILD_EXCEPTION=" + $_.Exception.GetType().FullName + ':' + $_.Exception.Message)
-    Write-Output ("BUILD_POSITION=" + ([string]$_.InvocationInfo.PositionMessage).Replace("`r",' ').Replace("`n",' | '))
-    Write-Output ("BUILD_STACK=" + ([string]$_.ScriptStackTrace).Replace("`r",' ').Replace("`n",' | '))
-}
-Write-Output 'PROBE_DONE'
diff --git a/tests/persistence/tmp-pl-probe.ps1 b/tests/persistence/tmp-pl-probe.ps1
deleted file mode 100644
index e854723..0000000
--- a/tests/persistence/tmp-pl-probe.ps1
+++ /dev/null
@@ -1,35 +0,0 @@
-$ErrorActionPreference='Continue'
-$repo = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
-Set-Location $repo
-Write-Output ("PS=" + $PSVersionTable.PSVersion + ' ' + $PSVersionTable.PSEdition)
-Import-Module (Join-Path $repo 'build\TrayHostBuild.psm1') -Force
-$version = ([string]((Get-Content (Join-Path $repo 'package.json') -Raw | ConvertFrom-Json).version)).Trim()
-$commit = ([string](& git -C $repo rev-parse HEAD)).Trim().ToLowerInvariant()
-$stamp = [DateTime]::UtcNow.ToString('o',[Globalization.CultureInfo]::InvariantCulture)
-$out = Join-Path $env:TEMP ('ccod-pl-probe-' + [guid]::NewGuid().ToString('N'))
-try {
-    $r = Invoke-CcodPortableLauncherBuild -RepositoryRoot $repo -Version $version -OutputDirectory $out -GitCommit $commit -BuildTimestampUtc $stamp
-    Write-Output ('PL_BUILD_OK=' + [string]$r.Sha256)
-} catch {
-    Write-Output ('PL_BUILD_FAIL=' + $_.Exception.Message)
-    Write-Output ('PL_BUILD_STACK=' + ([string]$_.ScriptStackTrace).Replace("`r",' ').Replace("`n",' | '))
-}
-$p = Join-Path $out 'portable-launcher-provenance.json'
-if (Test-Path -LiteralPath $p) {
-    $raw = Get-Content -LiteralPath $p -Raw
-    Write-Output ('PROV_RAW=' + $raw.Replace("`r",' ').Replace("`n",' '))
-    $obj = $raw | ConvertFrom-Json
-    Write-Output ('PROV_COMPILER_NAME=[' + [string]$obj.compiler.name + '] TYPE=' + $obj.compiler.name.GetType().FullName)
-    Write-Output ('PROV_COMPILER_SHA=[' + [string]$obj.compiler.sha256 + '] LEN=' + ([string]$obj.compiler.sha256).Length + ' TYPE=' + $obj.compiler.sha256.GetType().FullName)
-    Write-Output ('PROV_COMMIT=[' + [string]$obj.gitCommit + '] ISSTR=' + ($obj.gitCommit -is [string]))
-    Write-Output ('PROV_TS=[' + [string]$obj.buildTimestampUtc + '] ISSTR=' + ($obj.buildTimestampUtc -is [string]))
-} else { Write-Output 'PROV_MISSING' }
-try {
-    Test-CcodPortableLauncherArtifact -RepositoryRoot $repo -Version $version -ArtifactDirectory $out -ExpectedGitCommit $commit | Out-Null
-    Write-Output 'PL_TEST_OK'
-} catch {
-    Write-Output ('PL_TEST_FAIL=' + $_.Exception.Message)
-    Write-Output ('PL_TEST_STACK=' + ([string]$_.ScriptStackTrace).Replace("`r",' ').Replace("`n",' | '))
-}
-if (Test-Path -LiteralPath $out) { Remove-Item -LiteralPath $out -Recurse -Force -ErrorAction SilentlyContinue }
-Write-Output 'PROBE_DONE'
diff --git a/tests/persistence/tmp-scope-lib.ps1 b/tests/persistence/tmp-scope-lib.ps1
deleted file mode 100644
index c1f68af..0000000
--- a/tests/persistence/tmp-scope-lib.ps1
+++ /dev/null
@@ -1,12 +0,0 @@
-$ErrorActionPreference='Stop'
-function Get-CcodProbeInner { return 'INNER-OK' }
-function Invoke-CcodProbeOuter { param([Parameter(Mandatory)][scriptblock]$Action) return (& $Action) }
-function Get-CcodProbeInnerDeep { return 'DEEP-OK' }
-function Invoke-CcodProbeOuterDeep {
-    param([Parameter(Mandatory)][scriptblock]$Action)
-    return (& { param($a) & $a } $Action)
-}
-Write-Output ("RESULT_DIRECT=" + (Invoke-CcodProbeOuter -Action ({ Get-CcodProbeInner })))
-Write-Output ("RESULT_DEEP=" + (Invoke-CcodProbeOuterDeep -Action ({ Get-CcodProbeInnerDeep })))
-Write-Output ("SCRIPT_ROOT=" + $PSScriptRoot)
-Write-Output 'LIB_DONE'